Internet advertisements have become very obtrusive and more apparent over the last several years. Users conducting research from various sources on the web are often met with a vexatious experience full of distractions. Children watching YouTube videos that have inappropriate advertisement content embedded in the videos are also becoming a concern for many parents. Normally users will install ad-blocking software and extensions on their operating systems and web browsers. Most of the software installed for ad-blocking purposes ends up not being updated and extensions for web browsers often stop working when the web browser itself has been updated.

A more efficient solution is now available thanks to single board computing.  The Raspberry Pi being the most readily available single board computer. For a mere $16 anyone can have a multi-platform, network-wide ad blocker on their local network. This software plays very nice in both office and home networks. Pi-hole offers a wonderful dashboard with real time analytics if you’re someone who loves numbers.

Below is an example of a Raspberry Pi, with Pi-hole installed showing real time stats via an LCD installed on the Raspberry Pi:

So what is needed to get this project going?

• Raspberry Pi Kit – $16
• Ethernet Cable (Optional) – $6
• Screen for Raspberry Pi (Optional) -$20

After you have purchased these components it’s very simple to install Pi-hole.

You can install an Operating System image on your Raspberry Pi. Step-by-step directions are provided and the entire process takes less than 10 minutes to complete.

Installing Pi-hole:

1. Install Pi-hole on the Raspberry Pi. The program can be downloaded here or via the install “curl -sSL https://install.pi-hole.net | bash|”” command.
2. Configure your router DHCP settings to force clients in using your PI-hole as their DNS server. You can also manually configure each device but that takes much more time than blocking ads on the whole network at once. This step sounds more difficult than it actually is. The only thing that you have to change are some ports and DNS settings on your router. Most routers have this setting displaying on the main page and it can be changed within a matter of a few seconds. A straightforward guide is provided on Pi-Holes official site.
3. Completion! Your Pi-hole blocks all advertisements at a DNS level. This means your whole network is protected and any device connected will automatically block online commercials even inside Apps and programs. You have freed your laptop, iPhone, Nexus tablet and desktop PC from all online commercials! Enjoy faster loading times on all your favorite websites and apps.

If you’d like to pull up Pi-holes nifty dashboard and see how many advertisements were blocked from your entire network you’ll see a clean interface exactly like the one below :

Fun Facts About Pi-hole :

– The code is completely open, and you are able to modify it in any way you’d like. (Yay for open-source!)
– Pi-hole is very lightweight as it only handles DNS queries and returns a blank HTML file so it doesn’t need much processing power. (Yay for efficiency!)
– Pi-hole will run on most Debian-based distros and is the preferred platform for it.(Yay for compatibility!) source

Block Internet ads at home with Pi-hole

LETS DIVE DEEPER….

How does Pi-hole work?

Pi-hole blocks ads by acting as a DNS sinkhole.

To understand what a DNS sinkhole is, you need to understand what DNS is. Here are a few key terms:

IP address: unique numeric address of a web resource (e.g. 104.22.23.160)

DNS: Domain Name System, associates domain names with IP addresses

DNS server: a server that translates domain names into IP addresses

Domain Name: unique alphanumeric address of a web resource (e.g. raspberrypi.com)

When you type www.raspberrypi.com into your browser, your computer asks a DNS server where to find that domain. The DNS server responds with an IP address (e.g. 104.22.23.160). Then your computer queries that IP address for the resource you’re looking for.We use domain names because IP addresses aren’t very human-readable; it’s a lot easier to read and write “raspberrypi.com” than four bytes’ worth of numbers.Usually, your computer queries a DNS server hosted somewhere on the internet. It might be hosted by your internet provider, a website hosting company, or any company that runs a lot of servers. Your machine submits a domain, and the DNS server returns the IP address corresponding to that domain. The DNS server doesn’t care if the domain provides something you want (like the article you’re trying to read) or an ad. It just resolves domains into IP addresses.

Here’s where Pi-hole comes in. Pi-hole stands between your network and a DNS server. Consider a client device, like your smart toilet, performing a DNS lookup for a domain. The Pi-hole in your network acts like a DNS server; DNS lookups from all client devices, whether that’s your smart toilet or your phone, go to the Pi-hole.

But Pi-hole doesn’t store a perfect up-to-date mapping of all domain names to all IP addresses. Instead, Pi-hole queries a real DNS server outside of your network. However, before it queries that real DNS server, Pi-hole checks a blocklist. If the domain passes this filter, Pi-hole requests the IP address from the DNS server, and returns it to the client device on your network. If the domain doesn’t pass the filter — if it’s included on the blocklist — Pi-hole returns a non-routable address such as 0.0.0.0.

The following diagram shows a lookup via a Pi-hole for the unblocked domain raspberrypi.com:

The following diagram shows a lookup via a Pi-hole for the blocked domain raspberryads.com:

TL;DR: Pi-hole blocks requests made to ad domains from your network, before the requests ever leave your network. Your client devices can’t connect to domains that host ads, but can connect to domains that host useful content.

Overview

To install a Pi-hole in your network, you’ll need to do the following things:

1. Configure a Raspberry Pi running Raspberry Pi OS.
2. Set up Pi-hole software on your Raspberry Pi.
3. Direct DNS queries on your network to your Raspberry Pi.

Supplies

• Raspberry Pi
• suitable power supply (see the documentation for details)
• microSD card (see the documentation for details)
• adapter to connect your microSD card with your usual computer
• USB cable (check your 3D printer for details)

For the initial SD card setup, you will need:

• Another computer connected to your network. We’ll refer to this as your usual computer to distinguish it from the Raspberry Pi computer you are setting up.

Choose a Raspberry Pi

You can use any Raspberry Pi model for this. We recommend Zero 2 W if you can’t decide which model to use.

Configure your Raspberry Pi

To begin, follow the Getting Started documentation to set up your Raspberry Pi. For your operating system, choose Raspberry Pi OS Lite (32-bit) to run headless (without a mouse and keyboard).

During the OS customisation stage, edit settings as follows:

• Enter a hostname of your choice (we suggest pi-hole for this tutorial)
• Enter a username and password; you’ll need these later to authenticate
• Check the box next to Configure wireless LAN so your Pi can automatically connect to Wi-Fi
• Enter your network SSID (name) and password; you can find these in your Wi-Fi settings or on a sticker on your router
• Check the box next to Enable SSH so we can connect to the Pi without a mouse and keyboard

Connect via SSH

Open a terminal on your computer. If you use a Windows computer, you may need to install a terminal; we suggest PuTTY. Enter the following command to connect to your Raspberry Pi, replacing the <username> placeholder with your own username that you chose in Imager:

$ ssh <username>@pi-hole.local

If ssh asks you if you’re sure you want to continue connecting, reply yes. Enter the password you chose during advanced configuration when prompted.

You’ll know you’ve connected successfully when you see the following prompt with your configured username and hostname:

<username>@<hostname>:~ $

Now that you’ve connected to your Raspberry Pi, run two commands to make sure that all of your packages are up to date:

$ sudo apt update
$ sudo apt full-upgrade

Once the package update commands finish running, reboot your Raspberry Pi to allow all changes to take effect:

$ sudo reboot

Running this command will disconnect you from the Raspberry Pi SSH session. Wait a few seconds for your Raspberry Pi to reboot, and enter the ssh connection command again to reconnect to your device.

tip

On most terminals, press the Up arrow key, then the Enter key to re-run the most recent command.

Install Pi-hole

Run the following single-line command to run the Pi-hole setup script:

$ curl -sSL https://install.pi-hole.net | bash

The setup script is relatively self-explanatory, but follow these tips if you aren’t sure how to proceed:

• When warned about needing a static IP address, click Continue to proceed; we’ll deal with this later
• When prompted to select an interface, select wlan0 to use your Raspberry Pi’s Wi-Fi connection
• When prompted to choose an upstream DNS provider, choose OpenDNS
• Include StevenBlack’s Unified Hosts List
• Install the Admin Web Interface
• Install lighttpd and the required PHP modules to run the Admin Web Interface
• Enable query logging
• When prompted to choose a privacy level, choose Anonymous mode

When you see “Installation complete!”, the setup is complete. This screen shows the IP address of your Pi-hole, a link to the admin interface, and your administrator password.

• Save this password somewhere safe, like a password manager — you’ll need it to work with your Pi-hole in the future
• Save the IP address — you’ll need it to configure a static IP address shortly

Pi-hole only provides a single administrator account, so there’s no username. Press the Control key (Command on macOS) and click the link to the admin interface that uses an IP address. It’ll look something like http://192.168.1.24/admin. Don’t use the pi.hole domain link yet; until we configure the Pi-hole as our DNS provider, it won’t work. The link should open in your browser. You can also copy and paste the link into a browser if control + click doesn’t work in your terminal. Use the admin password from the setup script output to authenticate. You can now see your Pi-hole admin console! We recommend bookmarking this console for future maintenance.

Configure your network to use your Pi-hole

warning

The tasks below require you to change global settings in your wireless network. You might break your internet connection (for a little while). Proceed with caution!

To complete these tasks, visit the admin interface for your router. You can usually access the admin interface through your router’s IP address. Here are a couple of common ways to find that interface:

• Run the following command on your Raspberry Pi to output your router’s IP address:

  $ nmcli -f IP4.GATEWAY device show wlan0

• Check for a sticker on your router — look for a value called “admin URL” or similar

Once you’ve found the IP address, log in to your router’s admin interface by typing the address (sometimes with the suffix /admin) into your browser. Enter your username and password (if you don’t know these, you may be able to find them on a sticker on your router). Now that you’ve got your Pi-hole configured, you have three choices to use it to block ads. All of them involve getting Pi-hole between your network and the internet:

• configure Pi-hole as the DNS server for your network
• configure Pi-hole as the DHCP provider for your network
• manually point devices at Pi-hole for DNS

It’s easiest to use your Pi-hole as a DNS server. However, some routers don’t provide a setting to control the default DNS server. If you can’t set a DNS server, try configuring Pi-hole as your DHCP provider. And if you can’t do that either, you can always manually point devices at the Pi-hole for DNS — it’s not as good as full-network ad blocking, but it’s a lot better than nothing.

Configure Pi-hole as your network’s DNS server

This is the most common way of configuring a Pi-hole. For this method, you’ll first assign your Raspberry Pi a static IP address from your router’s interface, then point your router’s DNS server settings to the Pi-hole’s static IP address. With this setup, your router controls IP reservations across your network, but devices on the network send DNS queries to your Pi-hole instead of to a DNS server on the internet.

Assign your Raspberry Pi a static IP address

IP addresses are unique numeric codes that allow you to directly interact with devices on your network. For instance, many routers automatically assign themselves the first address in the IP block they are using, such as 192.168.1.1. Most networks use Dynamic Host Configuration Protocol (DHCP) to assign IP addresses to devices automatically. These IP addresses are known as dynamic IP addresses, because they can change at any time.

To run a Pi-hole on your network, we recommend assigning your Pi-hole a static IP address. A static IP address never changes. This allows devices on your network always to find the Pi-hole at the same address.

To start, run the following command on your Raspberry Pi:

$ hostname -I

You should see output similar to the following:

$ 192.168.1.24

This value is the current (dynamic) IP address of your Raspberry Pi on the network.

To assign a static IP address, you also need the MAC address of your Raspberry Pi. A device’s MAC address is a hardware identifier that your router uses to uniquely identify it. Run the following command to find the MAC address of your Raspberry Pi:

$ nmcli -f GENERAL.HWADDR device show wlan0

You should see output similar to the following:

GENERAL.HWADDR:                         A8:42:EA:58:E0:1C

The value on the right is the MAC address of your Raspberry Pi. Now that we know your Raspberry Pi’s MAC address and IP address, we can configure your router so it always associates the Raspberry Pi’s MAC address with its current IP address. Effectively, we’re turning the current dynamic address into a static one using the MAC address. In your router’s admin interface, configure a static IP address for your Raspberry Pi. There are several ways to accomplish this, depending on your router:

• You might be able to find this setting in the “Advanced” section of the router admin interface. Look for a list called “DHCP Reservations”, and enter your Raspberry Pi’s IP address and MAC address.
• Look for a list of connected devices and find your Raspberry Pi’s IP address or MAC address. Select the option to “Always use this IP address” to make the IP address reservation static.
• Check the documentation for your router model for specific instructions.

Set Pi-hole as your network’s default DNS server

Once you’ve assigned your Raspberry Pi a static IP address, you can configure individual devices to use Pi-hole as a DNS server in their network settings. But this process is tedious, and some devices don’t provide an easily accessible DNS server setting. However, there is an easier way: most routers automatically suggest a DNS server for devices connected to your network. All you have to do is change the suggested server in your router’s settings, and your entire network should start using your Pi-hole for DNS.

Look for a setting called DNS in your router’s admin interface. You may be able to find the setting in a section called “Internet”, “DHCP”, “Internet Connection”, or “DDNS”.

Enter your Pi-hole’s IP address in the DNS (or similarly named) field.

If your router provides multiple custom DNS fields, add your Pi-hole address in each field.

important

Whatever you do, don’t add any separate DNS entries after the Pi-hole entries — this can break Pi-hole’s ad blocking functionality. When your Pi-hole blocks a domain, it returns a non-routable address such as 0.0.0.0, and some devices will query the secondary DNS server when the first server returns such a non-routable address. If your secondary DNS server isn’t a Pi-hole, every single request blocked by Pi-hole will succeed on the secondary server, and ads will load as if you weren’t running an ad blocker at all.

Configure Pi-hole as your network’s DHCP provider

If your router doesn’t support configuration for static IP addresses or DNS servers, you may still be able to use your Pi-hole automatically across your network. First, check whether you can change the network DHCP server in your router settings. If you can, you can use your Pi-hole both as a DNS server and as the DHCP server that handles IP address reservations across your network.

First, navigate to the Pi-hole admin console. If you type your Raspberry Pi’s IP address into your browser, it should redirect you there.

In the left side menu, select the “Settings” page.

In the DHCP tab, in the “DHCP Settings” block, check the “DHCP server enabled” box.

Pi-hole should pre-populate the IP address range with the IP block that your router currently uses, and the router IP address with the router’s current IP address. You can leave these values as they are. Click the Save button in the bottom left to start hosting a DHCP server from Pi-hole.

Finally, visit your router’s admin interface, and set your Pi-hole’s IP address as the DHCP provider for your network. When your Pi-hole is functioning as the DHCP provider, your router delegates all IP-related tasks to it. This includes DNS server configuration, so your Pi-hole can suggest itself as the default DNS server for all devices on your network. Check the documentation for your router model for specific instructions.

Manually point devices at Pi-hole for DNS

On many devices, you can configure DNS settings in Wi-Fi preferences. Look in the “Advanced” section of your Wi-Fi or wired connection preferences for a DNS server setting. Put your Raspberry Pi’s IP address in this field. Your device should immediately start issuing DNS queries to the Pi-hole.

Unless you’ve configured a static IP address for your Raspberry Pi, this IP address can change at any time without warning. Follow the instructions under “Assign your Raspberry Pi a static IP address” in the DNS section above to configure a static IP address — this will prevent your device from losing its connection to the Pi-hole (and most of the internet!) when your Pi-hole’s dynamic IP address changes.

Is my Pi-hole working?

With a Pi-hole acting as the DNS server for your network, many pages will load without ads at all. Most privacy-invading trackers won’t work either. You’ll still see cookie and app install banners, because those can’t be blocked at the DNS level. To check to see if your Pi-hole is working correctly:

• Check out Adblock Tester. Without Pi-hole, many browsers score near 0; with Pi-hole, you should see a score at or near 100.
• Try visiting http://pi.hole/admin/login.php. Pi-hole always routes the pi.hole domain to your Raspberry Pi when you use Pi-hole as your DNS server.
• Visit any site where you normally see ads and visually confirm that ads are no longer there.
• Check the proportion of “queries blocked” on the Pi-hole dashboard. Many networks see between 10% and 50% of queries blocked!
• Check the DNS server used by other computers in your network. You should be able to find this information in “Details” or “Advanced” Wi-Fi settings. If you see your Raspberry Pi’s IP address, your configuration worked!

If you’ve completed all of the setup steps but you’re still seeing ads (or, worse, DNS queries don’t resolve), try the trusty solution of turning your router off and on again. This should disconnect all devices from your network and renew all DHCP leases, putting your new settings into effect for every device. Congratulations! Your home network is now protected from ads. Put a slice of bread in your smart toaster, watch a movie on your smart TV, and flush your smart toilet in the comfort of privacy and security. source

 

1. Install a supported operating system

You can run Pi-hole in a container, or deploy it directly to a supported operating system via our automated installer.

Docker install

Supported operating systems

2. Install Pi-hole

Our intelligent, automated installer asks you a few questions and then sets everything up for you.  Once complete, move onto step 3.

Install Pi-hole

3. Use Pi-hole as your DNS server

Configure your router’s DHCP options to force clients to use Pi-hole as their DNS server, or manually configure each device​ to use the Pi-hole as their DNS server.

Use Pi-hole as your DNS server

4. Block ads everywhere, even on the go

By pairing your Pi-hole with a VPN, you can have ad blocking on your cellular devices, helping with limited bandwidth data plans.

Pi-hole + VPN

Network-wide protection

Instead of browser plugins or other software on each computer, install Pi-hole in one place and your entire network is protected.

Block in-app advertisements

Network-level blocking allows you to block ads in non-traditional places such as mobile apps and smart TVs, regardless of hardware or OS.

Improve network performance

Since advertisements are blocked before they are downloaded, network performance is improved and will feel faster.

Monitor statistics

Our Web interface offers control of your Pi-hole and a central place to view statistics.  We also include an API for extending these stats.

Web Interface

In addition to blocking advertisements, Pi-hole has an informative Web interface that shows stats on all the domains being queried on your network.

Built-in DHCP Server

Pi-hole works fine with an existing DHCP server, but you can use Pi-hole’s to keep your network management in one place.

Manage White And Black Lists

Fine-tune your experience by blacklisting or whitelisting domains.  Extend this capability with powerful regex statements.

Query Log

See all the domains being queried on your network, where they originated, and more.

Long Term Statistics

Queries are stored in a database and can be queried at any time.  Learn about what’s happening on your network over time.

Audit Log

Keep track of the most queried domains and add them to a white or blacklist from a central page.

Privacy Modes

Choose from four different privacy modes that works for your environment.

Other Settings

Control and configure other settings from the Web interface.

source

 

 

 

 

 

 

 

 

 

“The machines wouldn’t take our ticket,” said one MGM Resorts customer.

Five days after a cyberattack crippled operations of MGM Resorts International, including its signature Las Vegas properties the Bellagio and the MGM Grand, the company said Thursday morning it is still working to resolve issues as another major resort operation, Caesars Entertainment, acknowledged it was also the target of a cyberattack.

Hackers struck MGM Resorts on Sunday morning, rendering doors to the chain’s casinos and hotels unusable. Slot machines and ATM machines were also inoperable, elevators were out of order and customers had to wait hours to check into rooms. Even the company’s website remains down.

“We continue to work diligently to resolve our cybersecurity issues while addressing individual guest needs promptly,” MGM Resorts said a statement Thursday. “We couldn’t do this without the thousands of incredible employees who are committed to guest service and support from our loyal customers. Thank you for your continued patience.”

But for MGM Resorts Las Vegas visitors like Walter Haywood, patience is running out.

“It was kind of chaotic,” Haywood told ABC Las Vegas affiliate station KTNV. “The machines wouldn’t take our ticket. Lines everywhere. Just chaos.”

MGM Resorts has acknowledged the attack but has released no details on how it occurred or who might be responsible.

The company said it “took prompt action to protect our system and data, including shutting down certain systems.”

The FBI said it is investigating the attack and has been in contact with the chain since Sunday.

The Cybersecurity and Infrastructure Security Agency, which is part of the U.S. Department of Homeland Security, announced on Thursday that it is in contact with MGM Resorts “to understand the impacts of their recent cyber incident.”

“We are also offering any necessary assistance should the organization need or request it,” the CISA said in a statement.

Nevada Gov. Joe Lombardo and the Nevada Gaming Board released a joint statement, saying they are “monitoring the cybersecurity incident with MGM Resorts and are in communication with company executives.”

“Additionally, the Nevada Gaming Control Board remains in communication with other law enforcement agencies,” the statement from Lombardo and the gaming board said.

VX-Underground — a research group boasting the largest collection of malware source code, samples and papers on the internet — posted to X that the ransomware group “ALPHV,” also known as Black Cat, is allegedly is behind the MGM cyberattack. Authorities have not confirmed the report.

“All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk. A company valued at $33,900,000,000 was defeated by a 10-minute conversation,” VX-Underground said.

Bloomberg News reported Wednesday that the same ransomware group is responsible for a cyberattack this month on Caesars Entertainment Inc. and that the company paid “millions” to get its data back.

Caesars Entertainment — which runs more than 50 resorts including, Caesars Palace and Harrah’s in Las Vegas — acknowledged the attack occurred on Sept. 7 in a filing Thursday with the U.S. Securities Exchange Commission.

“Caesars Entertainment Inc. recently identified suspicious activity in its information technology network resulting from a social engineering attack on an outsourced IT support vendor used by the Company,” Caesars said in its SEC Form 8-K filing.

While the company said it did not pay a ransom, it noted that “we have incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter. The full scope of the costs and related impacts of this incident, including the extent to which these costs will be offset by our cybersecurity insurance or potential indemnification claims against third parties, has not been determined.”

Caesars Entertainment, according to the filing, said its investigation determined that hackers acquired a copy of its loyalty program database, which includes driver’s license numbers and Social Security numbers “for a significant number of members in the database.”

Caesars added, “We have taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result.” source

The Morning After: Hacking a Vegas casino may just take a single phone call

The ALPHV ransomware group used social engineering to attack MGM Resorts.

The ALPHV/BlackCat ransomware group claimed responsibility for the MGM Resorts cyber outage on Tuesday, and it apparently took the group only 10 minutes on a phone call to glean the information needed to shut down systems and slot machines — not the slot machines! — at casinos owned by MGM Resorts.

“All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk,” the organization wrote in a post on X. Those details came from ALPHV but have not been independently confirmed by security researchers.

MGM Resorts didn’t respond to a request for comment but said on Tuesday that “Our resorts, including dining, entertainment and gaming, are currently operational.” source

Caesars Entertainment Paid Millions to Hackers in Attack

Hackers stole data, extorted company, people familiar said

Caesars breach came in weeks before MGM announced cyberattack

Both MGM and Caesar’s Entertainment were hacked by a group named “Scattered Spider” in recent weeks. Caesar’s even paid a ransom

A bunch of hackers aged between 19 and 22 are bringing the Las Vegas Strip’s casino-hotels to their knees.

A group dubbed “Scattered Spider” by cybersecurity researchers paralyzed the systems of MGM Resorts International this week. MGM, a $14 billion hospitality and entertainment giant, disclosed its “cybersecurity issue” in a Sep. 12 regulatory filing.

Although MGM claims to have dealt with the issue, social media posts say that everything from slot machines to hotel communication systems have been inoperable at MGM venues in Las Vegas for four days. Check-in lines are growing, room access cards and ATMs won’t work, and people are unable to use food, beverage, and free play credits. Regressing to the past, to use manual cash payouts and physical room keys, is proving slow and clunky. (One tiny silver lining: free parking.)

MGM is investigating the matter, and as is the FBI. Moody’s, the rating agency, warned that the breach, which highlights MGM’s heavy reliance on tech, could affect its credit rating negatively.

Hospitality giant of interest: Caesar’s Entertainment

A Bloomberg report revealed that another casino operator, the $12 billion Caesar’s Entertainment, had been the victim of a similar cyberattack in recent weeks. The hackers, who threatened to leak its data, demanded $30 million in ransom; Caesar’s paid roughly half. In this case too, the hackers belonged to “Scattered Spider,” thought by cybersecurity analysts to be made up of young hackers in the US and the UK.

Hackers demanded a ransom from MGM as well, two anonymous sources told Fortune. But it remains unclear how much was requested and which systems the company was locked out of.

Quotable: Scattered Spider’s modus operandi

“Although members of the group may be less experienced and younger than many of the established multifaceted extortion/ransomware groups and nation state espionage actors, they are a serious threat to large organizations in the United States. Many members are native English speakers and are incredibly effective social engineers.”

—Charles Carmakal, chief technology officer at Mandiant Intelligence, a part of Google Cloud, in a Sep. 15 LinkedIn post

How Scattered Spider hacked MGM and Caesers

Scattered Spider uses social engineering to gather login credentials or one-time-password (OTP) codes, which helps bypass multi-factor authentication, according to a January blogpost by the security research firm CrowdStrike. The group has previously targeted telecom and business process outsourcing (BPO) companies to perform SIM swaps, which can then be used in phishing attacks to steal data and extort ransoms.

In the case of Caesar’s, the hackers breached an outside IT vendor first to subsequently gain access to the company’s network, two people familiar with the matter told Bloomberg.

With MGM, a short telephonic exchange and some collaboration with a ransomware-as-a-service group called ALPHV, also known as BlackCat, was all it took. In April 2022, America’s cyber defense agency issued an alert noting that ALPHV had “compromised at least 60 entities worldwide.”

“All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk,” VX-Underground, a malware research group, posted on X. “A company valued at $33,900,000,000 was defeated by a 10-minute conversation.”

The white-hat hacker Rachel Tobac, who uses similar attack methods in her work by posing as an internal teammate, wrote on LinkedIn that organizations are less equipped to deal with phone-based attacks than email. It works for three reasons, according to Tobac: “lack of verification protocols, easy spoofing, compensation tied to how fast they handle requests.”

By the digits: The impact of the MGM hack

$13 million: The revenue that MGM’s Las Vegas Strip properties bring in daily on average, calculated based on the the $1.2 billion in revenue these hotel rooms and casinos earned for in the quarter ended June 30

30: The number of hotel and gaming venues that MGM operates around the world, with a dozen on the Vegas Strip. The websites for MGM’s biggest resorts, including MGM Grand, Mandalay Bay, Bellagio, Aria, and The Cosmopolitan, have been inaccessible for days

6,852: The number of rooms at the MGM Grand, the world’s single largest hotel

$6.99: The ATM fees that guests were charged to withdraw cash, when they wanted to keep playing during the hack, and when credit card machines had stopped working

Charted: Las Vegas’ hacked casino-hotels stocks dropped

One more thing: Casinos are ideal cyberattack victims

Casino cyberattacks aren’t uncommon. The Hard Rock Hotel and Casino was breached twice in 2015 and 2016, when hotel guest names, card numbers, expiration dates, and CVV codes were stolen. In 2019, the personal data of roughly 10 million MGM guests was published on a Russian hacking forum.

In fact, casinos are prime targets for financially motivated crimes because their cybersecurity isn’t top-notch and hackers are “more likely to get paid because they’re disrupting casino operations,” Allan Liska, an intelligence analyst at the security firm Recorded Future, told Reuters. “Casinos around the world should be on heightened alert because ransomware groups love it when they get this kind of attention, so we will likely see copycats.” source

Groups linked to Las Vegas cyber attacks are prolific criminal hacking gangs

Apair of criminal hacking groups have been linked with attacks in recent weeks on two prominent Las Vegas hotel and casino operators that has left one struggling to resume operations and prompted another to reportedly pay a multimillion dollar ransom payment.

The attacks on MGM Resorts and Caesars Entertainment have resulted in widespread outages at MGM properties, and according to a Wall Street Journal report, forced Caesars to pay roughly half of a $30 million ransom demand.

Exactly who is behind the attacks remains unclear, but two hacking groups have been linked with the breaches:ALPHV and Scattered Spider. A person claiming to be a member of the latter told CyberScoop that their group was responsible for the attack on MGM but denied responsibility for the breach of Caesars. Earlier this week VX-Underground, a well-known online malware research repository, wrote on the social media platform X that an ALPHV representative said they were behind the MGM hack.

Late Thursday, ALPHV claimed responsibility for the attack on MGM in a statement on its website. It is unclear whether Scattered Spider’s claim of responsibility for the breach of MGM is false or whether overlaps between the two groups mean that members of both hacking collectives were involved in the breach of MGM. The Scattered Spider member who spoke with CyberScoop described their group as a well-known affiliate of ALPHV.

In a Thursday regulatory filing, Caesars confirmed that the company had identified “suspicious activity in its information technology network resulting from a social engineering attack on an outsourced IT support vendor” used by the company. The attackers gained a copy of “among other data, our loyalty program database, which includes driver’s license numbers and/or social security numbers for a significant number of members in the database,” the company said.

Caesars said it took steps “to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result,” the company reported, in what may have been a veiled reference to the reported ransomware payment.

Neither Caesars nor MGM responded to multiple requests for comment. The FBI acknowledged that it was investigating the incidents Thursday but declined to comment further.

As of Thursday, MGM appears to be continuing to struggle to recover from the attack. The company’s website remains down, and reports on social media show digital slot machines in MGM casinos bearing error messages.

The member of Scattered Spider who spoke with CyberScoop said that negotiations with MGM were ongoing but would not disclose the terms of any demands. The individual claimed that stolen data included customer information, sexual abuse incident reports and other corporate records. The individual’s claims could not be independently verified.

“If MGM decide they want to discuss if they paid or how much is completely up to them, if they decide they want to pay the money we assure them their systems wont [sic] be breached again,” the person said in an online chat.

The two groups — Scattered Spider and ALPHV — linked to the attacks on the two casino operators are a set of aggressive online criminal groups with well-documented history of carrying out ransomware attacks.

Scattered Spider is the name given to a financially motivated hacking group by private industry researchers. The group was likely behind a “massive phishing campaign” targeting Okta, the U.S.-based authentication firm, which led to follow-on attacks against users of the Signal messaging app, Twilio and Cloudflare, cybersecurity firm Group-IB reported in August 2022.

Scattered Spider has been active since May 2022, and has mostly attacked telecommunications and business process outsourcing organizations until recently, when it began targeting other sectors, including critical infrastructure, according to an Aug. 17 analysis from cybersecurity firm Trellix.

The group “heavily relies on email and SMS phishing attacks and have also been observed attempting to phish other users within an organization once they’ve gained access to employee databases,” according to a May 2023 Mandiant analysis.

Charles Carmakal, Mandiant’s chief technology officer, called Scattered Spider “one of the most prevalent and aggressive threat actors impacting organizations in the United States today.” The group’s members may be “less experienced and younger” than more established criminal hacking groups, but they are “native English speakers and are incredibly effective social engineers,” Carmakal added, referring to the practice of tricking or persuading a person with access to a particular company or network to provide access to someone not authorized to have it.

The exact relationship between Scattered Spider and ALPHV is difficult to determine. Scattered Spider is considered a distinct, financially-motivated cybercrime group that has demonstrated connections to the ALPHV ransomware operation by using some of its tooling, experts say. ALPHV is a well-known ransomware operation, also known as BlackCat, and was perhaps the first entity to operate ransomware using the RUST language in the wild. source

---

MGM Resorts breached by ‘Scattered Spider’ hackers: sources

SAN FRANCISCO/WASHINGTON, Sept 13 (Reuters) – A hacking group named Scattered Spider brought down the systems of the $14 billion gaming giant MGM Resorts International (MGM.N) this week, two sources familiar with the matter said, as U.S. law enforcement officials started a probe into the breach.

Several MGM systems remained paralyzed for a third straight day after it said on Monday it had shut some of them to contain a “cybersecurity issue.” The company, which operates over 30 hotel and gaming venues around the world including in Macau and Las Vegas, said it was investigating the incident.

A Bloomberg report separately said another casino operator, Caesars Entertainment, had been hacked and paid ransom to hackers who threatened to leak its data in recent weeks, citing two people familiar with the mater.

Shares of Caesars Entertainment and MGM both fell on Wednesday.

The cause and the full impact of the breaches was not immediately clear, although social media posts showed slot machines and systems down at MGM venues in Las Vegas.

Two sources familiar with the matter told Reuters the hacking group Scattered Spider was behind it. Identified by analysts last year, this group uses social engineering to lure users into giving up their login credentials or one-time-password (OTP) codes to bypass multi-factor authentication, the security firm Crowdstrike said in a blog post in January.

It is “one of the most prevalent and aggressive threat actors impacting organizations in the United States today,” Charles Carmakal, chief technology officer at Alphabet Inc’s (GOOGL.O) Mandiant Intelligence said in a post on LinkedIn on Wednesday, following reports about the MGM breach.

“Although members of the group may be less experienced and younger than many of the established multifaceted extortion/ransomware groups and nation state espionage actors, they are a serious threat to large organizations in the U.S.,” he added.

Scattered Spider, also known as UNC3944, has hit telecom and business process outsourcing (BPO) companies in the past, but more recently also targeted critical infrastructure organizations, according to analyst reports.

“They leverage tradecraft that is challenging for many organizations with mature security programs to defend against,” Carmakal said.

The FBI said on Wednesday it was investigating the incident, but did not elaborate. The rating agency Moody’s warned the breach could negatively impact MGM’s credit rating.

Such attacks are typical hallmarks of ransomware incidents in which extortionists encrypt victims’ computer systems and demand ransoms in digital currency.

Analysts say casinos are prime targets of financially-motivated cybercrimes.

“They’re more likely to get paid because they’re disrupting casino operations,” said Allan Liska, intelligence analyst at the security firm Recorded Future.

“Casinos around the world should be on heightened alert because ransomware groups love it when they get this kind of attention, so we will likely see copycats.”

Moody’s analysts said in a report that the incident “highlights key risks related to (MGM’s) business operations’ heavy reliance on technology and the operational disruption caused when systems need to go offline or are inoperable.”

Messages seeking further comment from MGM and the U.S. cybersecurity watchdog agency CISA were not immediately returned. MGM Resorts’ website was “currently unavailable,” according to a holding message posted to the group’s homepage.

“Our investigation is ongoing and we are working diligently to determine the nature and scope of the matter,” MGM said in a post on the social media website X on Monday. source

Caesars and MGM grapple with hacks as cybersecurity in Vegas is under scrutiny

Hackers stole Social Security numbers and driver’s license numbers from a “significant number” of loyalty program customers of Caesars Entertainment, the hospitality and casino giant said Thursday.

The disclosure comes as another big Las Vegas brand, MGM Resorts, is recovering from its own apparent cyberattack in which guests on Monday reported being unable to make room charges and access their rooms with their digital keys.

The pair of hacks has put a spotlight on the computer defenses of the multibillion-dollar casino and hospitality business in Las Vegas, which are ripe targets for cybercriminals to extort.

Caesars Entertainment, which owns famous hotel-casinos such as Caesars Palace, confirmed on September 7 that the hackers had stolen a copy of the customer loyalty program database, in a filing with the Securities and Exchange Commission. The hackers broke into computer systems via “a social engineering attack” on an IT support contractor, according to the filing.

“We have taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result,” Caesars Entertainment said. The company did not immediately respond to CNN’s questions as to what steps were taken and whether they included paying a ransom.

For its part, MGM Resorts has repeatedly referred to a “cybersecurity issue” in describing the disruption to some of its computer systems, but the incident has the hallmarks of a cyberattack.

“We continue to work diligently to resolve our cybersecurity issue while addressing individual guest needs promptly,” MGM Resorts said in a statement on Thursday morning. The company said on Monday, when news of the incident broke, that it had shut down certain computer systems to protect its data.

MGM Resorts did not respond to multiple requests for comment from CNN this week on how it was dealing with the apparent hack.

An FBI spokesperson said the bureau was investigating the cybersecurity incident at MGM Resorts but declined further comment, citing an ongoing investigation.

Scattered Spider considered a ‘serious threat’

It’s unclear who exactly was responsible for the cyberattacks. But a cybercriminal group known in the industry as Scattered Spider has been targeting casinos and hotels in recent weeks, according to Mandiant Consulting, a Google-owned cybersecurity firm.

Members of the hacking group “may be less experienced and younger” than many of the established cybercriminal gangs and state-backed cyber-espionage teams, but “they are a serious threat to large organizations in the United States,” said Charles Carmakal, Mandiant Consulting’s chief technology officer.

Some of the members of the group appear to be based in the United States and the United Kingdom, according to Carmakal and other sources interviewed by CNN. Bloomberg News reported on Wednesday that Scattered Spider was responsible for the pair of cyberattacks on Caesars Entertainment and MGM Resorts.

Reports that the hackers had used social-engineering techniques in which, for example, they pose as an IT support employee to gain access to an organization, raised concerns for cybersecurity experts.

“Most organizations focus on email-based threats in their technical tools and protocols,” Rachel Tobac, CEO of SocialProof Security, a social-engineering prevention firm, told CNN. “Many [organizations] are not yet equipped with the social engineering prevention protocols necessary to catch and stop a phone-based attacker in the act.” source

MGM cyberattack continues to create chaos for Vegas operations; SEC notified

MGM Resorts International website remains down

MGM Resorts International in Nevada confirmed a recent cyberattack in a Wednesday filing with the Securities and Exchange Commission (SEC).

The Las Vegas-based company experienced a computer system outage on Monday that affected operations at headquarters as well as its properties and websites.

MGM RESORTS EXPERIENCES ‘CYBERSECURITY ISSUE’ IMPACTING OPERATIONS, PROMPTS INVESTIGATION

“MGM Resorts recently identified a cybersecurity issue affecting certain of the company’s systems,” an MGM spokesperson said in a statement. “Promptly after detecting the issue, we began an investigation with assistance from leading external cybersecurity experts. We also notified law enforcement and are taking steps to protect our systems and data, including shutting down certain systems. Our investigation is ongoing, and we are working diligently to resolve the matter. The company will continue to implement measures to secure its business operations and take additional steps as appropriate.”

On Monday, FOX 5 in Las Vegas reported that one of the company’s properties, the Bellagio Las Vegas, confirmed that the computer systems were down at all resorts and that all computer-based operations were forced to go manual.

This view shows the MGM Grand in Las Vegas. (iStock / iStock)

Personnel at the resort also said the outage affected credit card machines at the properties.

When visiting mgmresorts.com, a page comes up that says, “The MGM Resorts website is currently unavailable,” followed by an apology as well as numbers to make reservations, reach out to member services or call a concierge. On social media, the company posted a statement about the technical issues the company is facing.

MGM Resorts International in Las Vegas confirmed a recent cyberattack in a Wednesday filing with the Securities and Exchange Commission. (Ethan Miller / File / Getty Images)

MGM did not immediately respond to inquiries from Fox Digital about the cybersecurity outage. The company operates 19 resorts with more than 40,000 rooms around the world, including the MGM Grand, Mandalay Bay, Luxor and New York-New York in Las Vegas as well as the Borgata in Atlantic City, New Jersey, and more. source

Angry Birds is now completely and utterly irrelevant. If you could travel back in time and tell this fact to somebody in the early 2010s, they simply wouldn’t have believed you. That’s because a decade ago, Angry Birds was more than just the #1 mobile-game series of all time. Angry Birds was a true media empire with games, toys, movies and more. But Now? The name “Angry Birds” is nothing but a distant memory. The brand has rapidly faded into irrelevance, and is now a forgotten relic of the Internet’s past. source

The classic version of Angry Birds is being delisted from Google Play but renamed on the App Store