Uniden Website now down, was hijacked and spreading malware earlier

Status
Not open for further replies.

pto

Member
Feed Provider
Joined
Dec 19, 2002
Messages
79
Location
Grundy Co. IL.
Uniden's website for commercial security products has been hacked to host a Word document that delivers what appears to be a garden variety of the Emotet trojan, also known as Geodo and Heodo.

Compared to Uniden's main website, which offers a wide range of electronic products (radios, scanners, radar detectors, dash cams, cellular boosters), the solutions available on the commercial branch are limited to cameras (both IP and analog), network video recorders (NVR).

Hacked Uniden Commercial Site Serves Emotet Trojan
 

DJ11DLN

Member
Joined
Mar 23, 2013
Messages
2,068
Location
Mudhole, IN
Does anyone know why I keep getting Trojan warning when I want to go to the Uniden Bear-Cat Web page or any associated pages?


Thank you,
I get a pop-up from Malwarebytes about a trojan when I just hover my cursor on it in my bookmarks folder.o_O
 

ot0tot

Member
Premium Subscriber
Joined
Mar 9, 2012
Messages
96
Just found out about this after getting a warning, and it seems Uniden finally took their site down now, six days after the initial notification. Ridiculous!
 

CorwinScansNM

Member
Joined
Aug 28, 2013
Messages
303
Location
NM
WOW! What is trange & scarry now that I am hearing & finding out about this, is that I have a security web browser extension called Malwarebytes Browser Extension installed on my web browser. I visit at least once a week, the Uniden BCD536HP Firmware Update web page looking for & checking for new firmware version releases for my Uniden BCD536HP. Wishful thinking & hoping that is on my end anyway.

In the last week of trying to visit the web URL/website for my Uniden product, Malwarebytes Browser Extension has been stopping me from getting there & telling me "Trojan" meaning that there is or was a Trojan Virus detected when trying to visit the web page or URL for the BCD536HP Firmware Updates Information page contains release notes & the latest versions of the Uniden Sentinel Software. A couple of times, I kind of took it as a false positive by the Malwarebytes Browser Extension as for it is in BETA. I told it that I wanted to continue & visit the website anyway which was taking chances & not fully believing the Malwarebytes Browser Extension. I guess that was a bad decision & not such as good idea after all now that I am finding out that it may have had a Trojan Virus after all called Emotet Trojan. Therefore, the Malwarebytes Browser Extension must have known & been right spot on & knew about the infected Uniden Website before we or I ever did.
 

poltergeisty

Truth is a force of nature
Banned
Joined
May 7, 2004
Messages
4,012
Location
RLG, Fly heading 053, intercept 315 DVV
Therefore, the Malwarebytes Browser Extension must have known & been right spot on & knew about the infected Uniden Website before we or I ever did.


Probably not. They most likely had a definition for that virus and thus your browser add-on got triggered due to it. Then again, the extension may not actually use an anti-virus engine with updated signatures, but quries a database of known infected sites.
 

poltergeisty

Truth is a force of nature
Banned
Joined
May 7, 2004
Messages
4,012
Location
RLG, Fly heading 053, intercept 315 DVV
And here's why a hacker was able to upload malware. 34.227.232.229

Unreal. Something tells me someone was pissed off at one of Uniden's scanners and thus did that. You just don't place a trojan on a webiste without a reason.

If anyone here works for Uniden and is in charge of the server, you better tackle those CVEs. It'll more than likely just happen again or worse.
 

poltergeisty

Truth is a force of nature
Banned
Joined
May 7, 2004
Messages
4,012
Location
RLG, Fly heading 053, intercept 315 DVV
Holy crap!

the malicious Word file is stored in the '/wp-admin/legale/' folder

They're using WordPress! *sigh* I would have never expected a well renowned company to use the CMS of WordPress for a website. I wouldn't do that because for the most part there are vulnerabilities after vulnerabilities with WordPress all the time especially plug-ins you may use. Even if those plug-ins aren't vulnerable now they can be. Then if those plug-ins don't stay updated by the author you run into the risk of a hack vector.

Don't get me wrong. WP is a great platform to build upon. But only for your own crudey little website, blog or church website, etc and at that you should do some research on how to secure it. For a major company you should just pay for a good web developer to create your website.

Because WP is so popular like bloody Windows, it's gonna be attacked like no tomorrow.

If anyone chooses to use WP, at least install Ninjafirewall and for God sakes use mod_security. Ninjafirewall also has a WordPress plug-in. For the most part it shouldn't mess around with your user base, and it does have an option to run it in test mode or what ever it's called to iron out any false positives. Going beyond that check out a reverse proxy like CloudFlare or Incapsula in an effort to hide your origin IP address. And with that you have to do certain things to make sure the IP is hidden. For one, you can't use your origin server for email anymore because a MX lookup will rat your origin IP out. So check out Amazon email services.

Anyway. That's just incredible. I don't ever recall seeing a company use it before for their webpage. Though, I could be wrong since I don't look at the page source all the time and have no reason to. It's as if they don't want to pay for real website development. I mean, WP can be deployed in no time at all. Very little coding required. Anyone can do it. And therein lies why so many people get hacked because they don't know what the hell they're doing. I see this all the time with phpBB. People can easily deploy it, but don't know how to secure it. Then come to the phpBB website saying they are being inundated with spam or have been hacked.
 
Last edited:

poltergeisty

Truth is a force of nature
Banned
Joined
May 7, 2004
Messages
4,012
Location
RLG, Fly heading 053, intercept 315 DVV
Ionut Ilascu

Ionut Ilascu is freelancing as a technology writer with a focus on all things cybersecurity. The topics he writes about include malware, vulnerabilities, exploits and security defenses, as well as research and innovation in information security. His work has been published by Bitdefender, Netgear, The Security Ledger and Softpedia.

No wonder why the article had writing mistakes. LOL
 

poltergeisty

Truth is a force of nature
Banned
Joined
May 7, 2004
Messages
4,012
Location
RLG, Fly heading 053, intercept 315 DVV
I see my two posts were liked so I just want to add something. I really feel bad for Uniden. I've owned many of their scanners and to this day I still own my very first P25 digital trunk capable scanner the BC296D. In fact, I still use it to this day since it does what I need it to do. I don't know what type of people they hired for web development or IT, etc. But I would be more inclined to higher professional web development. Like I said, WordPress is really not something I'd use for a big company. I just know about reading time and time again about all the vulnerable plug-ins and patches and hack crap with WP. It's just not a platform I'd use if I were a major company. For me personally I actually don't even know HTML or PHP, let alone Java Script or even CSS. I'd like to learn those one day, but it's on the back burner. But using WordPress or even phpBB really doesn't require any coding skills once so ever. In fact, a lot of hosts that give you something called cPanel have a one click install feature of all kinds of websites. That's how easy it is to use WordPress. And that's probably why so many are attacked because so many people use those without even knowing how to lock them down. I didn't know anything when I decided to run my own website just to help learn about it. But in the course of about 4 years I've learned all kinds of things about security and I've heeded that advice I have read. In fact, I have a few posts on my own forum on how to properly use CloudFlare to keep your origin IP hidden and I wrote about Ninjafirewall.

That Shodan website is a real booger. If you have any CVEs it will report them and so everyone will know about it. So it's very important to stay abreast of any and all patches that may exist. So that's why using a reverse proxy like CloudFlare is helpful because a website like Shodan can't really say this website has these CVEs. I've actually informed a few websites about the CVEs they had and I told another website that was using CloudFlare that their MX record exposed their origin IP which makes the whole point of using CloudFlare pointless. But try as I might, it seems to all fall on deaf ears. It's like they either don't care or just think they won't suffer from a DDoS or a hack, etc. It really is mind boggling. And this same thing happens when I try to help people on computer forums. I tell them what they should do, but it's like they completely ignore my post and quote someone else as if I didn't even say anything at all. So that's when I unsubscribe from the topic and move on. Oh well, I tried. What can I say? One one computer forum I was a member of circa '07 I was such a valuable asset that the owner of the website sent me a $50 gift certificate to my email for Amazon.

Edit-

Looks like this thread got moved.
 
Last edited:

belvdr

No longer interested in living
Joined
Aug 2, 2013
Messages
2,567
Unfortunately, this seems like it's on par with other security issues they have (or had) with My Uniden. I was surprised to learn Sentinel used FTP to download firmware. Moving that to HTTP/HTTPS would at least eliminate another daemon exposed publicly.
 

darkness975

Latrodectus
Premium Subscriber
Joined
Nov 4, 2016
Messages
850
So what are you saying? The update I did to my SDS100 and BCD325P2 might have given my PC malware? Or my scanner?
 

N8TXX

Scanner Enthusiast
Joined
Dec 26, 2002
Messages
264
Location
S.E. Michigan
I would like to purchase DMR and NXDN upgrades for my SDS200, but when I try to go to the web site my Malwarebytes won't let me. It says there is a Trojan. I took the link out in case it really does have a Trojan.
Is there a good link I can use?
 
Last edited:

mule1075

Member
Feed Provider
Joined
Jan 20, 2003
Messages
3,959
Location
Washington Pennsylvania

poltergeisty

Truth is a force of nature
Banned
Joined
May 7, 2004
Messages
4,012
Location
RLG, Fly heading 053, intercept 315 DVV
Unfortunately, this seems like it's on par with other security issues they have (or had) with My Uniden. I was surprised to learn Sentinel used FTP to download firmware. Moving that to HTTP/HTTPS would at least eliminate another daemon exposed publicly.


If that's the case they really should look into something like Amazon S3.
 
Status
Not open for further replies.
Top