Hello, World!
Russia’s Missile alert system was hacked, Putin’s speech was DDoSed, and GoDaddy suffered
an enormous breach, That’s all coming up in today’s roundup of cyber security tech
news.
Emergency alerts warning of impending missile strikes have been playing on radio stations
across Russia.
[alert message] This wasn’t a test, it was a genuine missile alert that played on numerous
Radio stations.
But luckily for residents it was a false alarm, but it wasn’t caused by someone in a control
room pressing the wrong button by mistake, just like what happened in Hawaii in 2018
- this was the work of a bad actor.
Exactly how they did it mystery, one idea is that this was the work of a pirate radio
station, ie some guy sticking an aerial on his roof just looking to cause a bit of havoc.
But that’s unlikely, because almost a dozen cities spanning a thousand miles were affected,
way too big of an area for just some guy with an aerial on his roof.
Russian state media reported that this incident wasn’t isolated to radio, people also received
text messages telling them to seek shelter.
Pretty much confirming that the underlying emergency alert system was somehow breached,
with it being reported that this was done via an “attack … on the infrastructure
of a satellite operator”.
Anonymous related Twitter accounts have of course taken responsibility for it, but anonymous
twitter accounts take responsibility for everything, so - take that with a pinch of salt.
The Russian emergency alert system isn’t alone in being targeted.
Back in 2013 a similar system at several TV stations in Montana and Michigan were hacked
to play an emergency alert message warning about an impending zombie apocalypse.
[beep] Civil authorities in your area have reported that the bodies of the dead are rising
from their graves and attacking the living.
Follow the messages onscreen that will be updated as information becomes available.
In that case it was a default password which made the takeover possible.
Also, a few months back critical vulnerabilities were discovered in the decoder boxes that
many American TV stations use to relay these emergency alert messages.
I’ll make sure to link to my video on that at the end of this video.
Putin was giving his annual address to the Russian nation a few days ago.
The speech was much anticipated, expected to include clues about how Russia was going
to proceed with the war, however half way through, the Russian state broadcaster’s
stream of the speech, went dark.
The stream was quickly replaced with a message saying that technical work was in progress.
However it is a little hard to believe that any ‘technical work’ was planned to coincide
with what was slated to be a historic event.
And we soon learned what really happened, when the “IT army of Ukraine” took responsibility
for the disruption via their Telegram channel, a claim that was corroborated by Russian state
media.
This wasn’t a sophisticated takedown, it was achieved with a simple DDoS attack that
was made possible via the “IT Army’s” global network of volunteers who donate their
bandwidth to the “IT Army’s” botnet.
Which is as simple as downloading and installing their software.
Not something I recommend by the way, DDoSing - if you weren’t aware, is illegal, and
your ISP probably won’t be too thrilled with the idea of you saturating your connection
to dunk on Putin.
However this operation is a window into the tit for tat world of voluntary botnets that’ve
been trading blows ever since the war in Ukraine began.
With the ‘IT Army of Ukraine’ on one side and on the other, their nemesis, ‘Killnet’
- a Russian aligned group which operates in a similar way.
Now - I don’t cover this topic much, because whilst there is a lot that goes on in this
bubble, it tends to be rather repetitive and the attacks are almost always just designed
to just get media attention rather than do anything impactful.
For example in the last couple of weeks Killnet attacked hospitals across the US, creating
headlines like this “Russian hackers target US hospitals in huge cyberattack” - what
does sound pretty scary, resulted in just a few hospital websites going offline for
a few hours, actual patient services were completely unaffected.
Also in Killnet news, about a week ago there was a major disruption at German airline Lufthansa.
Thanks to an “IT failure” there were scenes of chaos in European airports as flights were
grounded and those already in the air had to be diverted.
Later that day Killnet took responsibility, saying it was down to one of their DDoS attacks,
using the opportunity to create memes of dubious quality.
But what was claimed to have been a case of Russian international cyber espionage was
in reality caused by an accidentally cut fibre optic cable.
Construction work on a railway line was the real perp here, creating an outage affecting
whole areas of Frankfurt.
With Killnet seizing the opportunity to get some airtime.
However Killnet has actually attacked airports before, launching an array of DDoS attacks
last October against American airports, but just like in the hospital attacks, the only
result was public facing websites going dark for a few hours, actual airport functions
were unaffected.
Godaddy has just suffered an enormous intrusion.
Well - they haven’t really ‘just’ suffered it, because it’s been going on for the past
3 years, this is bad.
Godaddy explains that “In early December 2022, we started receiving a small number
of customer complaints about their websites being intermittently redirected”, the “intermittent
redirects were happening on seemingly random websites hosted on our cPanel shared hosting
servers and were not easily reproducible by GoDaddy, even on the same website.”.
As it turns out, hackers had infiltrated Godaddy’s cPanel servers, and instead of straight up
taking over customer’s websites, the hackers instead programmed in a probability that every
so often someone tried to visit a Godaddy hosted site it would redirect that visitor
to a malicious domain - making it seem like the website was just glitching rather than
it being hacked.
This way their operation could go undetected for a lot longer than if they outright started
taking over domains.
Godaddy has been pretty quiet about this breach, in fact it looks like they disclosed it in
what is probably the quietest way possible.
So, to find this statement, you have to scroll all the way down to their footer, go to “Newsroom”,
and you’re not going to find anything in this overview, or even in the press releases,
you have to specifically go to “godaddy news” - and even then, this statement leaves
out some key information that you can only find in their recently filed 10-K form.
A 10k form is a comprehensive annual report that publicly traded companies in the US are
legally required to file.
Their latest one is 139 pages long, and hidden away on page 30 there is some interesting
information about this intrusion.
Here Godaddy starts talking about previous breaches they’ve experienced in the past
few years - the one in March 2020 when threat actors compromised the hosting login creds
of 28,000 customers.
Then they bring up another breach they suffered in November 2021 which saw 1.2 Million of
Godaddy’s wordpress customers affected - things like emails, credentials and SSL private keys
were all exposed.
It leaves you wondering why Godaddy is bringing up these past intrusions, but soon get our
answer… after connecting the dots Godaddy realised all 3 hacks are linked and were carried
out by the same threat actor.
Whether that means the same threat group kept on coming back for more, or that they retained
persistent access to Godaddy’s systems for the past 3 years is unclear.
It’s also not clear if Godaddy has even notified affected customers, I do unfortunately
have a site hosted with them and I haven’t received anything.
I say unfortunately because I actually meant to cancel it but just forgot at the last renewal.
In fact, migrating completely away from Godaddy is something I’ve been procrastinating over
for years, but now I definitely have some motivation.
Because Godaddy does kinda suck, I mean - even if we put these breaches to one side, the
sheer amount of time I’ve spent on the phone with Godaddy’s technical support over basic
things like DNS changes is actually … well I was going to say comical, but it’s actually
kinda depressing, I don’t know anyone who has anything good to say about them.
What was a pioneer in the web hosting landscape 20 years ago, now seems to just be riding
on their legacy reputation.
So whilst I like to try and keep these videos bias free, here I’m making an exception
- if you’re thinking of Godaddy, just don’t.
This video is brought to you by PlexTrac, who’re offering you a FREE one month trial
of their premier cybersecurity reporting and collaboration platform.
Get started today to learn why the best offensive security teams trust PlexTrac.
PlexTrac empowers users to build better reports in half the time, exponentially increasing
ROI and time savings, To aggregate findings from all their tools by consolidating the
testing process into one platform, creating a single source of truth, and to maximize
their reusable report content, like findings writeups and narratives, improving consistency
across the team.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement.
Ready to elevate your reporting, improve collaboration across teams, and demonstrate real progress?
Spend more time hacking and less time reporting with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always, thanks for watching and I’ll see you in the next video, have a good one.