Welcome to HBH V2 ! If you had an account on hellboundhacker.org you will need to reset your password using the Lost Password system before you will be able to login.

Tech News

Bose headphones share your lstening habits with third parties.

When it comes to privacy concerns, the mind naturally drifts to the likes of Facebook, Microsoft and Google. But in reality, there is the potential for privacy issues with any connected device -- and that includes Bluetooth headphones from Bose. Illustrating this is a man from Illinois who has filed a lawsuit against the Massachusetts-based audio company for secretly collecting, transmitting, and disclosing its customers private music selections to third parties, including a data mining company.  Kyle Zak alleges that his Bose QuietComfort 35 wireless Bluetooth headphones and the associated Bose Connect app gathered information about him, and sold it on to third parties including Segment.io. Zaks lawsuit points out that the same problem probably exists with other Bose Bluetooth headphones that work in conjunction with the Bose Connect app. Other affected products include the Bose SoundSport wireless, SoundSport Pulse wireless, QuietControl 30 and SoundLink wireless II headphones, as well as its SoundLink Color II, SoundLink Revolve and SoundLink Revolve+ speakers. The allegation is that Bose is engaged in what amounts to wiretapping, but Bose denies that data is personally identifiable.

Hackers dump 1.7 million snapchat user accounts on Dark Web

The hackers are particularly upset after Evan Spiegel, Snapchat CEO, reportedly made a rather nasty remark regarding expansion plans. According to claims that emerged last week as an ex-employee filed a lawsuit against the company, Spiegel shut down suggestions to expand to certain international markets, saying Snapchat is for rich people and did not want to expand into poor countries like India or Spain. The allegations were slammed by the company. Obviously Snapchat is for everyone! It is available worldwide to download for free. these words were written by a disgruntled former employee. We are grateful for our Snapchat community in India and around the world! Snap said. After a widespread boycott campaign was launched, demanding Spiegel to apologize, hackers did their part. In fact, the Indian hackers claim the vulnerability they discovered in Snapchats database allowed them to siphon details on 1.7 million users sometime last year. To make matters worse, the database has been leaked on the dark web.

Smart dishwasher found connected to unsecured web server for months

A smart dishwasher has reportedly been found connected to an unsecured web server, giving experts further arsenal to warn about the dangers of IoT devices. A bug report by a security expert alleges that Miele, the manufacturer of the smart dishwasher, ignored the security issue despite having been notified of it, indicating that the smart device may have been left exposed to an unsecured server for months. According to Jens Regel of Schneider & Wulf, Mieles Professional PG 8528 PST10 devices were found to be prone to a directory traversal attack; therefore, an unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks. According to Regel, he was able to get his hands on the embedded systems shadow file, which in turn provided him access to all files in the system. We are not aware of an actual fix, Regel said. According to Mieles product description page, the ethernet connection is used to extract text reports from the dishwasher. The ethernet interface is the universal solution for data exchange, the description states. In comparison with other interfaces the user is offered a particularly high level of functionality. However, security experts have reportedly bemoaned such situations, warning about the potential dangers such security flaws could pose, and the IoT security situation is unlikely to get any better any time soon. The price of turning a dumb device into a smart device will be about 10 cents. It is going to be so cheap that vendors will put the chip in anything electronic they produce, even if the benefits are only very small. But those benefits will not be benefits to you, the consumer -- they will be benefits for the manufacturers because they want to collect analytics, and you will probably not even know that it is an IoT device.

Millions of accounts from 25 vBulletin forums for sale on dark web

The dark web has been flooded with millions of accounts from recently compromised vBulletin forums. A hacker using the name Cfnt claimed to have hacked 25 web forums, which were running on outdated versions of the vBulletin software. Among the compromised forums are subagames.com, rappers.in, forums.spybot.info, cashcrate.com, codingforums.com, dcemu.co.uk, asia-team.net, dbforums.com and forums.3dtotal.com. Around 38 million accounts from the 25 hacked forums are now up for sale in a popular dark web marketplace. The hacked forums were all running on vBulletin 4.x, which is vulnerable to SQL injection. The security issue with this version was reported in June 2016, according to vBulletin support forums. A warning to those using older vBulletin versions last year reads: A security issue was reported to us that affects vBulletin 4. We have released security patches for vBulletin 4.2.2 & 4.2.3 to account for this vulnerability. The issue could potentially allow attackers to perform SQL Injection attacks via the included Forumrunner add-on. It is recommended that all users update as soon as possible. If you are using a version of vBulletin four older than 4.2.2, it is recommended that you upgrade to the latest version as soon as possible. Lists of accounts from each of the forums are being sold for around $150. It is highly recommended that users with accounts on such vBulletin forums change their passwords now.

Police want to know everybody who googled this guys name

Police in Minnesota want to solve a crime by combing through Google search history. Officers in Edina, a city of around 50,000 people, got a warrant compelling Google to divulge information about people who searched for the name of a financial fraud victim between Dec. 1, 2016 and Jan. 7, 2017. Someone convinced a credit union to wire $28,500 from an Edina mans account by creating a fake passport using the mans name alongside a photo of someone else. In their warrant application, police stated that the fake photo came up by googling the victims name, but did not come up in other search engines. The warrant for the five-week period compels Google to hand over information regarding anyone who searched the victims name, including email addresses, social security numbers, birthdates, IP addresses and information related to the content the user is viewing/using.

US govt dismisses child porn case to protect their Tor exploit.

Disclosure is not currently an option. Rather than share the now-classified technological means that investigators used to locate a child porn suspect, federal prosecutors in Washington state have dropped all charges against a man accused of accessing Playpen, a notorious and now-shuttered website. The case, United States v. Jay Michaud, is one of nearly 200 cases nationwide that have raised new questions about the appropriate limitations on the governments ability to hack criminal suspects. Michaud marks just the second time that prosecutors have asked that case be dismissed. The government must now choose between disclosure of classified information and dismissal of its indictment, Annette Hayes, a federal prosecutor, wrote in a court filing on Friday. Disclosure is not currently an option. Dismissal without prejudice leaves open the possibility that the government could bring new charges should there come a time within the statute of limitations when and the government be in a position to provide the requested discovery. The Department of Justice is currently prosecuting over 135 people nationwide whom they believe accessed the illegal website. However, in order to find those people, federal authorities seized and operated the site for 13 days before closing it down. During that period, the FBI deployed a Tor exploit that allowed them to find out those users real IP addresses. The use of Tor, which obscures and anonymizes IP addresses and browser user agents, makes it significantly more difficult for individuals to be tracked online. With the exploit, it became extremely easy for suspects to be identified and located. The DOJ has called this exploit a network investigative technique, (NIT) while most security experts have labelled it as malware.