Aggregator

The Australian telecommunications provider TPG Telecom has reported a serious security incident affecting the infrastructure of its subsidiary brand iiNet, which offers Australians fixed-line and mobile internet, telephony, and television services. An unidentified attacker...

The post TPG Telecom Data Breach: How One Hack Exposed 300,000 Customers appeared first on Penetration Testing Tools.

A vulnerability in the widely used AI deployment tool Ollama exposed users to the risk of drive-by attacks, enabling malicious actors to surreptitiously interfere with the local application through a specially crafted website. Exploitation...

The post Flawed AI Tool: How a Simple Website Could Have Hijacked Your Ollama App appeared first on Penetration Testing Tools.

Securing UK Hospitality SMBs and their supply chains in 2025 UK hospitality, including hotels, guesthouses, pubs, restaurants and their supply chains, thrives on reputation, efficiency, and trust. In 2025, data-driven bookings, contactless dining, and digital loyalty programmes accelerate gains, but also expose severe cyber risks. For small and medium-sized hospitality businesses, tight budgets, minimal IT […]

The post Securing UK Hospitality SMBs and their supply chains in 2025 appeared first on Clear Path Security Ltd.

The post Securing UK Hospitality SMBs and their supply chains in 2025 appeared first on Security Boulevard.

A hacker who targeted websites across North America, Yemen, and Israel, stealing the credentials of millions of users, has been sentenced to prison. 26-year-old Al-Taheri Al-Mashriki, from Rotherham, South Yorkshire, was arrested in August...

The post The Spider Team Hacker: How a UK Man Stole 4 Million Passwords appeared first on Penetration Testing Tools.

The United Kingdom has formally accused North Korea of stealing £17 million ($22.8 million) in cryptocurrency from Lykke, a London-registered exchange. The breach forced the platform to suspend operations, cease activity altogether, and ultimately...

The post North Korea’s Digital Heist: The £17M Crypto Theft That Brought Down an Exchange appeared first on Penetration Testing Tools.

The book From Day Zero to Zero Day, published by No Starch Press, has been released, offering a comprehensive introduction to the fundamentals of vulnerability research. The author presented it at DEF CON 33...

The post Beyond the Cookie Jar: Uncovering Privacy Flaws in Google’s New Ad Tech appeared first on Penetration Testing Tools.

ERMAC安卓银行木马3.0版本的源代码已在网上泄露，这使得该恶意软件即服务平台的内部机制以及运营者的基础设施被迫曝光。

2024年3月，Hunt.io的研究人员在扫描暴露的资源时，于一个开放目录中发现了这一代码库。

他们找到了一个名为“Ermac 3.0.zip”的压缩包，其中包含该恶意软件的代码，涵盖后端、前端、数据窃取服务器、部署配置，以及木马的生成器和混淆器。研究人员对代码进行分析后发现，与之前的版本相比，其目标攻击能力大幅提升，可针对超过700个银行、商城及加密货币相关应用。

ERMAC最早于2021年9月由ThreatFabric（一家为金融服务领域提供在线支付欺诈解决方案及情报的供应商）记录在案。它是Cerberus银行木马的升级版，由名为“BlackRock”的威胁者操控。

2022年5月，ESET发现了ERMAC 2.0版本，该版本以每月5000美元的费用租给网络犯罪分子，当时可攻击467个应用，较上一版本的378个有所增加。

2023年1月，ThreatFabric观察到BlackRock在推广一款名为Hook的新型安卓恶意软件工具，该工具似乎是ERMAC的进一步演进版本。

ERMAC 3.0的功能

Hunt.io发现并分析了ERMAC的PHP命令与控制（C2）后端、React前端面板、基于Go语言的数据窃取服务器、Kotlin后门，以及用于生成定制化木马化APK的生成器面板。

研究人员表示，ERMAC 3.0目前可针对超过700个应用中的用户敏感信息。

ERMAC的一个表单注入

此外，这个最新版本在以往记录的表单注入技术基础上进行了拓展，采用AES-CBC进行加密通信，对运营者面板进行了全面改造，并增强了数据窃取和设备控制能力。

具体而言，Hunt.io已记录了ERMAC最新版本的以下功能：

·窃取短信、联系人及已注册账户信息

·提取Gmail邮件主题及内容

·通过“列表”和“下载”命令访问文件

·发送短信及呼叫转移，滥用通信功能

·通过前置摄像头拍摄照片

·全面的应用管理（启动、卸载、清除缓存）

·显示虚假推送通知以实施欺骗

·远程卸载（killme）以实现规避

基础设施暴露

Hunt.io的分析师通过SQL查询识别出威胁者当前正在使用的、处于暴露状态的活跃基础设施，包括C2端点、面板、数据窃取服务器及生成器部署。

暴露的ERMAC C2服务器 

除了泄露恶意软件的源代码外，ERMAC的运营者还存在其他几处严重的操作安全失误，例如硬编码的JWT令牌、默认的root凭据，以及管理面板缺乏注册保护，这使得任何人都能访问、操纵或破坏ERMAC的相关面板。

最后，面板名称、标题、包名以及其他各种操作痕迹，无疑为溯源提供了依据，也让基础设施的发现和映射工作变得容易许多。

访问ERMAC面板

ERMAC 3.0源代码的泄露削弱了该恶意软件的运营——首先，它削弱了客户对这一恶意软件即服务平台的信任，客户会怀疑其能否保护信息不被执法部门获取，或是能否在低检测风险下开展攻击活动。

威胁检测解决方案也可能会在识别ERMAC方面变得更加高效。然而，如果源代码落入其他威胁者手中，未来有可能会出现更难检测的ERMAC修改变体。