In un recente post su un forum dell’underground è stata rivendicata una grave violazione dei dati che coinvolge Nike Inc. Un utente noto come Sorb, ha pubblicizzato un database CRM compromesso appartenente al gigante dell’abbigliamento sportivo.

Questo database, compilato utilizzando un bot chiamato esnkrs.com, contiene oltre 42 milioni di record di log.

Attualmente, non possiamo confermare l’autenticità della notizia, poiché l’organizzazione non ha ancora pubblicato un comunicato ufficiale sul proprio sito web in merito all’incidente. Le informazioni riportate provengono da fonti pubbliche accessibili su siti underground, pertanto vanno interpretate come una fonte di intelligence e non come una conferma definitiva.

Il database compromesso copre un periodo che va dal 2020 al 2024 e include informazioni sensibili come ID Discord, email, indirizzi fisici e IP, taglie di scarpe, nomi dei prodotti, link e timestamp. Sorb ha messo in vendita questi dati per 1300 dollari, fornendo campioni in formati JSON e CSV. Il post evidenzia che il database è ancora accessibile a causa dell’incapacità degli sviluppatori di individuare l’amministratore finale del server.

La violazione colpisce in particolare il settore retail, con un focus specifico sul settore dell’abbigliamento sportivo. Le informazioni sensibili esposte potrebbero portare a gravi conseguenze per gli utenti coinvolti, inclusi rischi di furto d’identità e altre forme di abuso dei dati. Da una prima analisi dei dati effettuata da Darklab la struttura dei dati e la consistenza sembrerebbe essere autentica.

La violazione dei dati di Nike evidenzia l’importanza di implementare misure di sicurezza robuste e di monitorare costantemente i sistemi per prevenire accessi non autorizzati. Le aziende devono essere pronte a rispondere rapidamente in caso di violazione per proteggere i dati dei loro utenti e mantenere la fiducia dei clienti

Come nostra consuetudine, lasciamo sempre spazio ad una dichiarazione da parte dell’azienda qualora voglia darci degli aggiornamenti sulla vicenda. Saremo lieti di pubblicare tali informazioni con uno specifico articolo dando risalto alla questione.

RHC monitorerà l’evoluzione della vicenda in modo da pubblicare ulteriori news sul blog, qualora ci fossero novità sostanziali. Qualora ci siano persone informate sui fatti che volessero fornire informazioni in modo anonimo possono utilizzare la mail crittografata del whistleblower.

L'articolo Il CRM della NIKE è stato violato? Un Threat Actors mette in vendita i dati proviene da il blog della sicurezza informatica.

The mad lads at watchTowr are back with their unique blend of zany humor and impressive security research. And this time, it’s the curious case of backdoors within popular backdoors, and the list of unclaimed domains that malicious software would just love to contact.

OK, that needs some explanation. We’re mainly talking about web shells here. Those are the bits of code that get uploaded to a web server, that provide remote access to the computer. The typical example is a web application that allows unrestricted uploads. If an attacker can upload a PHP file to a folder where .php files are used to serve web pages, accessing that endpoint runs the arbitrary PHP code. Upload a web shell, and accessing that endpoint gives a command line interface into the machine.

The quirk here is that most attackers don’t write their own tools. And often times those tools have special, undocumented features, like loading a zero-size image from a .ru domain. The webshell developer couldn’t be bothered to actually do the legwork of breaking into servers, so instead added this little dial-home feature, to report on where to find all those newly backdoored machines. Yes, many of the popular backdoors are themselves backdoored.

This brings us to what watchTowr researchers discovered — many of those backdoor domains were either never registered, or the registration has been allowed to expire. So they did what any team of researchers would do: Buy up all the available backdoor domains, set up a logging server, and just see what happens. And what happened was thousands of compromised machines checking in at these old domains. Among the 4000+ unique systems, there were a total of 4 .gov. domains from governments in Bangladesh, Nigeria, and China. It’s an interesting romp through old backdoors, and a good look at the state of still-compromised machines.

The Cameras are Leaking

One of the fun things to do on the Internet is to pull up some of the online video feeds around the world. Want to see what Times Square looks like right now? There’s a website for that. Curious how much snow is in on the ground in Hokkaido? Easy to check. But it turns out that there are quite a few cameras on the Internet that probably shouldn’t be. In this case, the focus is on about 150 license plate readers around the United States that expose both the live video stream and the database of captured vehicle data to anyone on the Internet that knows where and how to look.

This discovery was spurred by [Matt Brown] purchasing one of these devices, finding how easy they were to access, and then checking a service like Shodan for matching 404 pages. This specific device was obviously intended to be located on a private network, protected by a firewall or VPN, and not exposed to the open Internet. This isn’t the first time we’ve covered this sort of situation, and suggests an extension to Murhpy’s Law. Maybe I’ll refer to it as Bennett’s law: If a device can be put on the public Internet, someone somewhere inevitably will do so.

youtube.com/embed/0dUnY1641WM?…

Some related research is available from RedHunt Labs, who did a recent Internet scan on port 80, and the results are a bit scary. 42,000,000 IP addresses, 1% of the IPv4 Internet, is listening on port 80. There are 2.1 million unique favicons, and 87% of those IPs actually resolve with HTTP connections and don’t automatically redirect to an HTTPS port. The single most common favicon is from a Hikvision IP Camera, with 674,901 IPs exposed.

The Big Extension Compromise

One of the relatively new ways to deploy malicious code is to compromise a browser plugin. Users of the Cyberhaven browser plugin received a really nasty Christmas present, as a malicious update was pushed this Christmas. The Cyberhaven extension is intended to detect data and block ex-filtration attempts in the browser, and as such it has very wide permissions to read page content. The malicious addition looked for API keys in the browser session, and uploaded cookies for sites visited to the attacker. Interestingly the attack seemed to be targeted specifically at OpenAI credentials and tokens.

This started with an OAuth phishing attack, where an email claimed the extension was in danger of removal, just log in with your Chrome Developer account for details. The Cyberhaven clicked through the email, and accidentally gave attackers permission to push updates to the extension. This isn’t the only extension that was targetted, and there are other reports of similar phishing emails. This appears to be a broader attack, with the first observed instance being in May of 2024, and some of the affected extensions used similar techniques. So far just over 30 compromised extensions have been discovered to be compromised in this way.

And while we’re on the topic of browser extensions, [Wladimir Palant] discovered the i18n trick that sketchy browser extensions use to show up in searches like this one for Wireguard.

The trick here is internationalization, or i18n. Every extension has the option to translate its name and description into 50+ languages, and when anyone searches the extension store, the search term can match on any of those languages. So unscrupulous extension developers fill the less common languages with search terms like “wireguard”. Google has indicated to Ars Technica that it is aware of this problem, and plans to take action.

Safety Labels

The US has announced the U.S. Cyber Trust mark, a safety label that indicates that “connected devices are cybersecure”. Part of the label is a QR code, that can be scanned to find information about the support timeline of the product, as well as information on automatic updates. There are some elements of this program that is an obviously good idea, like doing away with well known default passwords. Time will tell if the Cyber Trust mark actually makes headway in making more secure devices, or if it will be just another bit of visual clutter on our device boxes? Time will tell.

Bits and Bytes

SecureLayer7 has published a great little tutorial on using metasploit to automatically deploy known exploits against discovered vulnerabilities. If Metasploit isn’t in your bag of tricks yet, maybe it’s time to grab a copy of Kali Linux and try it out.

Amazon, apparently, never learns, as Giraffe Security scores a hat trick. The vulnerability is Python pip’s “extra-index-url” option preferring to pull packages from PyPi rather than the specified URL. It’s the footgun that Amazon just can’t seem to avoid baking right into its documentation. Giraffe has found this issue twice before in Amazon’s documentation and package management, and in 2024 found it the third time for the hat trick.

It seems that there’s yet another way to fingerprint web browsers, in the form of dynamic CSS features. This is particularly interesting in the context of the TOR browser, that turns off JavaScript support in an effort to be fully anonymous.

And finally, there seems to be a serious new SonicWall vulnerability that has just been fixed. It’s an authentication bypass in the SSLVPN interface, and SonicWall sent out an email indicating that this issue is considered likely to be exploited in the wild.

hackaday.com/2025/01/10/this-w…

Marco Cappato, tesoriere di Associazione Luca Coscioni per la libertà di ricerca scientifica APS, partecipa come relatore all’iniziativa nell’ambito del ciclo di conferenze Scienza, tecnologia e diritto: what’s next? A cura diAmedeo Santosuosso, Beatrice Marone e Giulia Pinotti. Il titolo dell’iniziativa è Intelligenze artificiali e naturali nella società e nel diritto.

L’appuntamento è per mercoledì 15 gennaio alle ore 21, nell’aula Goldoniana del collegio Ghislieri, in Piazza Collegio Ghislieri, 5, a Pavia.

L'articolo “Scienza, tecnologia e diritto: Who’s next?” – Marco Cappato a Pavia proviene da Associazione Luca Coscioni.

THE YEAR IS STILL YOUNG. But it's time for a bonus Digital Politics. I'm Mark Scott, and on Jan 10, the US Supreme Court will hear oral arguments over whether TikTok's should be banned in the United States on Jan 19 (if it's not sold by then.)

It marks the second event in a pretty eventful week in the world of social media. Meta announced on Jan 7 it was ending its fact-checking program and overhauling its content moderation policies. My take on that here.

At stake in the TikTok hearing, at least on paper, is whether the US governmenthas the right to outlaw a foreign-owned social media company — all in the name of national security. In response, TikTok and some of its users accuse Washington of illegally constraining their free speech rights under the First Amendment.

You'll likely hear a lot about the case, both on Jan 10 and in the build-up to the prospective ban/divestiture ahead of the Jan 19 deadline within the Protecting Americans from Foreign Adversary Controlled Applications Act. You can watch the oral arguments from 10am ET / 5pm CET here.

Much of what will be said won't get to the nub of the issue: That TikTok (and its popularity with mostly young Americans) is now entrenched in an increasingly open geopolitical dispute between the US and China.

Let's get started:

digitalpolitics.co/tiktok-goes…

The LM3914 LED bar graph driver was an amazing chip back in the day. Along with the LM3915, its logarithmic cousin, these chips gave a modern look to projects, allowing dancing LEDs to stand in for a moving coil meter. But time wore on and the chips got harder to find and even harder to fit into modern projects, what with their giant DIP-18 footprint. What’s to be done when a project cries out for bouncing LEDs? Simple — get a RISC-V microcontroller and roll your own LED audio level meter.

In fairness, “simple” isn’t exactly what comes to mind while reading [svofski]’s write-up of this project. It’s part of a larger build, a wavetable synth called “Pétomane Ringard” which just screams out for lots of blinky LEDs. [svofski] managed to squeeze 20 small SMD LEDs onto the board along with a CH32V003 microcontroller. The LEDs are charlieplexed, using five of the RISC-V chip’s six available GPIO lines, leaving one for the ADC input. That caused a bit of trouble with programming, since one of those pins is needed to connect to the programmer. This actually bricked the chip, thankfully only temporarily since there’s a way to glitch the chip back to life, but only after pulling it out of the circuit. [svofski] recommends adding a five-second delay loop to the initialization routine to allow time to recover if the microcontroller gets into an unprogrammable state. Good tip.

As for results, we think the level meter looks fantastic. [svofski] went for automated assembly of the 0402 LEDs, so the strip is straight and evenly spaced. The meter seems to be quite responsive, and the peak hold feature is a nice touch. It’s nice to know there’s a reasonable substitute for the LM391x chips, especially now that all the hard work has been done.

youtube.com/embed/4ZVkaHjhwek?…

hackaday.com/2025/01/10/risc-v…

Medienmitteilung
Piratenpartei ergreift das Referendum gegen das E-ID-Gesetz

Das Gesetz für den digitalen Schweizerpass (E-ID-Gesetz) befördert die missbräuchliche Nutzung von sensiblen Personendaten: Es schützt ungenügend gegen die zunehmende Zahl von Cyberangriffen. Und es gibt die Daten der Bürgerinnen und Bürger an private Unternehmen preis, die sie mit Hilfe von KI analysieren und Profit daraus schlagen. Damit unterläuft das Gesetz die Privatsphäre der Menschen und gefährdet ihre demokratischen Freiheiten.

Wir ergreifen das Referendum gegen das E-ID-Gesetz, damit die notwendigen Schutzvorkehrungen getroffen werden.
_

Presseanfragen an Jonas Sulzer / Kampagnenleitung / jonas.sulzer@piratenpartei.ch
_

Webseite: E-ID-Gesetz-NEIN.ch

piratenpartei.ch/2025/01/10/pi…