🌙 Tekin Night April 18: Bluesky DDoS & 13-Year ActiveMQ Bug 🔒💻

🔵 Bluesky Under Sophisticated DDoS Attack: Social Network Under Pressure

Bluesky, the decentralized social network known as an alternative to Twitter (X), has been under a severe and sophisticated DDoS (Distributed Denial of Service) attack since Thursday, April 17. According to the Bluesky team, this "sophisticated" and "coordinated" attack has caused intermittent outages across various platform services.

DDoS attacks typically flood target servers with massive amounts of fake traffic, overwhelming them and disrupting access for legitimate users. In these types of attacks, hackers usually use botnets - thousands of infected devices that send coordinated requests to the target server.

The Bluesky team has emphasized in their statements that there is no evidence of unauthorized access to users' private data. This is an important point because DDoS attacks are sometimes used as a "smokescreen" to hide actual intrusions. However, Bluesky's security team has stated they are monitoring all systems and have observed no signs of breach.

🚨 13-Year-Old Apache ActiveMQ Vulnerability Added to CISA List

The US Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in Apache ActiveMQ to its Known Exploited Vulnerabilities (KEV) catalog on April 16. The amazing thing is that this bug had been hidden in the code for 13 years and was only just discovered!

Apache ActiveMQ is an open-source message broker used for transferring data between applications and services. This vulnerability is located in the Jolokia management API and allows an attacker to execute arbitrary code remotely - essentially turning a message broker into a remote command executor!

CISA has ordered all US federal agencies to patch their systems by April 30. If you also use Apache ActiveMQ, immediately update to patched versions. This is a serious warning because the bug is being actively exploited.

💻 Hackers Using QEMU to Evade Windows Security

Security researchers have discovered that hackers are using QEMU virtual machines to evade Windows security systems. This new technique allows attackers to hide their malware in a virtual environment and escape detection by antivirus and EDR (Endpoint Detection and Response) systems.

QEMU is an open-source software for creating virtual machines typically used by developers and IT professionals. But now hackers have realized they can use it to hide their malware. Since most antivirus software only scans the host system and doesn't check inside virtual machines.

This technique is known as "VM-based evasion" and is one of the most sophisticated detection evasion methods. Hackers can even send a stripped-down version of QEMU (about 15 megabytes) along with their malware, making installation and execution very fast.

💰 ShinyHunters Threatens Three Major Brands

The notorious ransomware group ShinyHunters has announced they've stolen sensitive data from three major global brands - Zara, Carnival Cruise Lines, and 7-Eleven. The group threatens to release over 9 million customer records if ransom isn't paid by April 21.

ShinyHunters is one of the most active ransomware groups with a history of attacking major companies like Microsoft, AT&T, and Ticketmaster. The group typically exploits API and database vulnerabilities to gain access, then sells stolen data on the dark web or uses it for extortion.

Interestingly, ShinyHunters typically releases stolen data samples as "proof" on hacker forums to show their claims are real. In this case, they've published samples from Zara and Carnival data including names, emails, phone numbers, and even portions of credit card information.

😰 Teenagers Concerned About AI Impact on Mental Health

A new survey shows that teenagers are increasingly concerned about AI's impact on their mental health. Interestingly, while 67% express concern, 12% are using AI tools for mental health counseling - a worrying paradox!

This survey conducted by a reputable research institute shows that Gen Z teenagers (born 1997-2012) have deep concerns about AI's impact on their daily lives. They fear that over-reliance on AI will reduce social skills, increase loneliness, and cause mental health problems.

But here's the paradox: while teenagers are concerned about AI's negative impact, many use AI chatbots like ChatGPT, Character.AI, and Replika to talk about their mental health issues. Reasons include: easy 24/7 access, no judgment, free cost, and privacy protection.

Mental health experts warn that while AI can be a useful support tool, it should never replace professional counseling. AI chatbots cannot recognize emergencies, show real empathy, or provide specialized treatments. Using AI for mental health should be done cautiously and as a complement - not a replacement - to human counseling.

🇪🇺 EU Forces Google to Share Search Data with Competitors

The European Union, under the Digital Markets Act (DMA), has forced Google to share its search data with competitors. This historic decision could forever change the search engine landscape and break Google's monopoly.

The DMA, which came into effect in March 2024, forces large tech companies (called "Gatekeepers") to stop their monopolistic behaviors. Google, with over 90% search market share in Europe, is recognized as a Gatekeeper and must comply with these rules.

Google is obviously unhappy with this decision, arguing that sharing search data could compromise user privacy and eliminate the company's competitive advantage. But the EU argues that Google's monopoly harms innovation and users deserve more choices.