20-year-old Trojan King Revealed, Maker of over 100 Banking Trojans

A 20-year-old Brazilian kid has been revealed as the maker of more than 100 banking trojans by the security firm Trend Micro. He is known online by the name of ‘Lordfenix’, ‘Filho de Hacker’ and ‘Hacker’s Son.’

The security firm writes that a 20-year-old college student from Tocantins, Brazil known by the name Lordfenix has become Brazil’s top malware maker. He has developed this reputation by giving birth to more than 100 online banking trojans. Most of these banking trojans were sold by him for about $300 each.

He is a computer science student who earned this money between April 2013 and targeted banks like Bank of Brazil, HSBC Brazil and Caixa. He began his career by asking for hacking advice in forums and today he is found offering free version of highly-efficient banking Trojan source code to the forum members in the underground world.
One of the Trojans detected called TSPY_BANKER.NJH identifies and wakes up when a user enters its target banks’ URL. Then it closes the active browser window and displays an error message to open a new fake browser windows. This is so smooth and unnoticeable that user doesn’t have a clue.
Now the user enters the login username and password in the fake window and the trojan sends back the information to the attacker. For more protection, the trojan terminates the process GbpSV.exe associated with the popular security software G-Buster Browser Defense, a security program used by many Brazilian banks.


Lordfenix claims that these free versions can steal credentials of bank customers of four different banks. On the other hand, the paid $300 versions target more banks using the tricks to disable the popular security software popular in Brazil. The security company has posted a picture of programmer’s Facebook page that shows a big pile of local currency on his bed.



Apart from his expertise in this area, the other factors that helped Lordfenix were the facts that more than half-population of Brazil uses internet for transaction and dealing with digital crime isn’t a top priority in the country.

Did you like this story about the 20-year-old Trojan King? Tell us in comments.

Image: David Goehring/Flickr

How To Capture Someone’s Picture Who Tries To Unlock Your Phone

Some things are better if kept private. I have seen many people hating it like anything when their friends or family members try to unlock their smartphone without their permission. And sometimes due to lots of successive incorrect attempts, the phone gets hard-locked – that means the only way to unlock your phone is via your email. This is enough to irritate a person. Also, you can not do anything about it because you don’t know whom to yell at.

Today, I am going to tell how you can capture a photo of that intruder who tries to unlock your phone without your permission. The only thing you have to do is to download and install this free Android app called Hidden Eye. Hidden Eye once installed will capture a photo of the intruder each time he/she tries to unlock your device.

How Hidden Eye Works?

It’s very simple to use the Hidden Eye app: just open it and tap on the OFF button which is located at middle and then tap to ACTIVATE it. Now tick the options on which you want to get alerted, and this is it.

Hidden Eye app work on a very simple idea- each time intruder tries to unlock your device, it will capture an image of him/her which you can see by tapping on View Intrusions. You can also see the date and the timing below the image captured by app.



If you have turned on the first option, your phone will ring after 3 attempts with the default ringtone. With enabling the second option, you will get to see the intrusion in notification bar. And if you enabled the third option, you will get to see the intruder’s image at the time of unlocking your phone.

Anonymous Hijacks Thousands of Insecure Routers to Power Its DDoS Tools

Lack of some elementary security measures can risk your router’s security and this has stemmed to grow into a large-scale denial-of-service (DDoS) attacks using these hacker-controlled routers. A web security firm Incapsula has discovered a new router based botnet Mr Black while investigating some DDoS attacks against its customers since this December.
 
Hackers exploited routers’ negligent security measures to launch these attacks all over the world. According to this report published by the security firm, the routers made by Ubiquiti Networks had DDoS malware installed on them.

The routers were not hacked due to some vulnerability in the hardware. Instead, it happened because of the deployment of the router in an insecure manner that exposed their management interfaces using the default credentials over SSH and HTTP.

The routers that were inspected were found to have 4 versions of Mr Black, a DDoS program and altogether thirty-seven variations of Mr Black were detected. Other DDoS programs included DoFloo, Mayday and Skynet (a remote sensing tool).

In some earlier versions of the report, Incapsula said that it believed that the hacktivist group Anonymous was one of the few groups those used the compromised routers. It is yet not clear that why Anonymous was highlighted in the report, but it is certain that few people who call themselves “Anonymous” were using the routers. The original article on the Daily Dot was edited to remove the fact that botnet directs to irc (dot) anonops (dot) com.

Total 40,269 different IP addresses were detected from 1,600 ISPs spread across 109 countries. The main affected countries were Thailand (64%), Brazil (21%), United States (4%) and India (3%). To control these routers, 60 servers were hacked and majority of these were in China and the U.S.

This image and the text have been removed from the original story, without explanation pic.twitter.com/TWxhg3k1dK

— Anon.Dos (@AnonDos_AnonHQ) May 13, 2015

To save themselves from the DDoS attacks, users must make sure that their routers’ management interfaces aren’t exposed over HTTP or SSH to the internet. They can also use some tools available to scan their router’s IP for open ports and change their default login credentials.