Hackers Leave Credential Stuffing Botnet Wide Open With Full Worker Access and Root Passwords

The article highlights a significant security lapse by hackers who left their credential stuffing botnet exposed, potentially allowing anyone with network access to manipulate or take over the operation. Here are the key points:

1. Exposed Botnet: A credential-stuffing botnet was discovered to be publicly accessible via an unsecured web interface.

2. Vulnerable Infrastructure:

   • 18 Linux servers were found running on Hetzner and Komuta Savunma cloud providers.
   • The main control server had a hardcoded root password, allowing anyone to gain full access to the botnet's infrastructure.

3. Full Access to Operations:

   • Anyone with network access could start or stop the entire botnet operation.
   • They could upload their own credential lists and download results without detection.
   • The ability to push new settings to all machines and reinstall checking software was also accessible.

4. Security Recommendations:

   • Twitter/X should block the identified IP addresses and reset compromised accounts.
   • Cloud providers Hetzner and Komuta Savunma need to process abuse reports urgently.
   • Individual users are advised to enable two-factor authentication (85.6% of tested accounts were protected by this measure) and avoid

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.