Bharatiya Janata Party (BJP) website Hacked

The Bharatiya Janata Party is one of the two major political parties in India.

The party has seen high political success in 2014 winning many seats and achieving an outright majority in the Indian Parliament. In 2019 the BJP won the general election increasing its majority.

Elliot Alderson, a French Security researcher, shared different pictures of the Hack.

From the picture, it is clear that Shadow_Vip3r behind the attack, although, after first research, there is no Twitter account or other social media account to be reached for further comment.

What is striking of the Hack is what has been deliberately changed by the Hacker.

Usually, Hackers replace the whole website with one page to display not only the name of the attackers but also a message.

Such posts are also a common practice of Hacktivists, yet in this, there is no clear message.

Since the Hacker is not reachable for comment, there are some speculations that one can make.

The website had its pages replaced with pages with beef recipes, beef pictures and the world beef associated to Indian Politics.

Such action can be a protest against the rise of Hindu Nationalism in India, that have been legitimised and helped by Modi and the BJP.

Cartoon Network Hacked

On April 27 Ethan Nunn a Youtuber that goes with the handle of ENunn, tweeted about Cartoon Network co.uk site being hacked.

The Twitter thread shows additional examples of other Cartoon Network domains being compromised.

ATTENTION! This video may be NSFW!

The company in UK acknowledged the issue and released this information.

Two hackers, sudorealistic and danilao are possibly behind the hack.
Edit 02.05: it appears that sudoreall has deleted his profile.

Although it looks like the site was taken down by CN IT department to solve the issue.

Edit 05.02: all tweets have been deleted, so here is the original tweet:

Sudorealistic claims that the hack was intended to show how vulnerable CN is, yet from the timeline there is no indication that the hackers tried to contact the company to fix the vulnerability before the attack.

According to this google doc, it looks like Sudorealistic has a history in downloading, streaming or consuming CN content.
There is also a hint that the Turner Media admin panel may have been used to perform the hack.

I tried to reach out to the Hacker for more clarification, but the request remained answered.

If you see any errors, want to send an update to feel free to contact me via twitter or key base.

Hacking Radio RDS messages

It’s always refreshing when hacking is just funny and not new threatening APT attacks or huge data breaches.

Lately I stumbled upon this tweet:

After a nice laugh, I was curious to understand how this works.
And most importantly if it can happen.

First of all, it’s important to understand how this information is broadcasted to then know what are the possible vulnerabilities.

The protocol responsible for broadcast such information is called RDS

RDS is a method to transmit information such as station name, song title, alternative frequencies, etc. from the radio station to the listener.

Jonti (Jonathan Olds) from Wellington New Zealand wrote an informative and elegant article that will explain to you how this works. Also he created JMPX a software-based FM stereo encoder with RDS support.

Once you understand how RDS works, then it’s time to know how it can be hacked.  And I couldn’t find more fun and engaging presentation than Injecting RDS-TMC Traffic Information Signals by two guys Andrea Barisani Chief Security Engineer and Daniele Bianco Hardware Hacker.

The video is both hilarious and informative, it’s a must watch.

Also, you can check the full presentation.

Just some examples of their sense of humor and fun Hack.

Fake radios are nothing new as during WWII they were vital in disseminating disinformation between enemy lines.

A transcript from the fake radio German Freedom Station.
You can find more here.

Now add to fake radios, RDS to havea new dimension of disinformation.

This is a valid reminder that It’s always good to question two times the information that we receive.

Stay vigilant!

Mega bad day.

Extensions for your browser are cool.
Such cool gadgets are in reality programs that run autonomously.
So if you have tons of not updated extensions, you risk getting hacked.

MEGA is a cloud storage service with a focus on Privacy. They have all sort of apps, and of course, handy Chrome extensions.

A Hacker managed to hack into MEGA's Google Chrome web store account and upload a malicious version. Upon installation or auto-update, the malicious extension asked for elevated permissions to access personal information, allowing it to steal login/register credentials from ANY websites like Amazon, Github, and Google, along with online wallets such as MyEtherWallet and MyMonero, and Idex.market cryptocurrency trading platform.

The Hacker received all this info on his website megaopac[.]host and cashed in all stolen cryptocurrencies.

Remember always make sure that you need an extension, and if it is asking for more information than usual, be suspicious!

You can read the details of how this was discovered here.
great cath /u/gattacus and  @serhack_ 

Photo by Kari Shea on Unsplash.
The rest we beautified ⚡️❤️🌈💩.

[zombify_post]

Hackers can break your Heart.

Billy Rios, a security researcher, found out that peacemakers can be hacked and cause the death of patients with just a click of a button.

The Hack occurs because of the peacemaker 's insecure updates.

To patch this is very simple, yet the company behind the device Medtronic will not do it.

They are aware of the issue since 2017 when Billy and Jonathan Butts informed the firm.

Seems like a typical situation where the money comes first than patients.

[zombify_post]