The hacker behind the most sociopathic cyber attack you'll ever come across has finally been
sent to prison. Also in your hacking news roundup... the FCC has fined 4 major cell
carriers for selling your location data, and white hat hackers target a zombified Chinese botnet.
But first, 6 years in prison is nothing compared to the pain and suffering caused
by this hacker. In 2018 Julius Kivimäki gained access to a server operated by
Finlands largest psychotherapy company Vastaamo. He stole tens of thousands of patient records,
and we're not talking usernames and passwords here, but rather the incredibly sensitive
notes from conversations between patients and their therapists.
Julius tried to make some quick cash out of his hack by demanding a ransom of roughly
500 thousand dollars from Vastaamo. But, when they refused he started leaking the records of
100 people each day while that ransom went unpaid. When it became clear the company
had no intention of paying up, Julius set his sights on the 33 thousand people he'd stolen
the records of, emailing them individually, demanding hundreds of euros in bitcoin,
or else their therapy notes would be leaked for the world to see.
And the fallout from this was intense, the week this happened Finland's nationwide
police reports statistics more than doubled, and there's reports of some patients just
not being able to cope with the prospect of their inner thoughts being revealed,
and unaliving themselves. Julius followed through on his promise to leak the data dump, however he
made one critical OPSEC mistake when uploading the records, he included a copy of his '/home'
folder in the archive by mistake, revealing his SSH keys, details of his other projects and
various log files - sparking in investigation which eventually led to his identification.
However Julius went on the run, sparking a man hunt for the guy which saw him jetsetting around
the world on fake IDs, posting pictures of his extravagant lifestyle to social media
and occasionally even hopping on reddit to taunt those he hurt. However this all came to an end
when he was arrested in France last year. But despite the mountain of evidence against him,
Julius maintained his innocence and the case went to trial. He was of course found guilty
on all counts but the most disappointing thing about the judgement was despite the fact the guy
has a long criminal history, the guy has been sentenced to just 6 years in a Finnish prison,
which are known for being rather comfy. You see, a quirk of Finnish law meant
that despite his extensive criminal history, having previously been convicted of thousands
of cyber crimes owing to his associated with Lizard squad, as well as having called in
bomb threats and had people swatted, because all of that happened more than 5 years ago,
he's being treated as a first timer, hence the light sentence, which chances are he'll
only serve half of. This sentencing pretty much concludes the case of the Vastaamo hack,
though something tells me we'll be hearing more from this guy when he's released. And if you
want more details on the Vastaamo hack itself, you can find my previous video on it up here.
4 major US cell networks have just been fined almost $200 million dollars for selling access
to the real-time locations of their customers, it's an almost unbelievable thought, but given
these carriers dominate the US market, the real time location of almost every phone in the US was
at one point being sold to data brokers. This fine from the FTC has been a long time in the making.
It all started in 2018 when a US senator wrote to the chairman of the FTC, blowing the lid on
"potentially unlawful practices of wireless carriers". This was initially all about just
one company "Securus Technologies". They'd been purchasing this real time location data
and then making that information available to law enforcement to assist in criminal investigations.
But it turns out the system they built was used to do a lot more than just catch bad
guys. In one case, a US Marshall pleaded guilty after he abused this Securus service to track a
phone belonging to his ex. But this shouldn't have been possible because in order for law
enforcement to use the service, they had to upload a legal document proving they have permission
to track someone. But these documents weren't verified at all, meaning this US Marshall was
not only uploading blank documents, but in some cases they were literally called blank doc.doc.
But even if Securus was verifying documents properly, it really doesn't matter - because
this data was illegally obtained in the first place. Cell carriers simply didn't get consent
to sell this data - I mean, it wasn't even buried deep in the 'Privacy Policy'. And as
the FCC explains "each carrier attempted to offload its obligations to obtain customer
consent onto [the companies that the data was eventually sold to]". And to make matters worse,
Securus was only the tip of the iceberg - the FCC's investigation found that in just
the case of AT&T for example, this location data was sold to 88 companies.
Another example of a company that was buying this location data was called "Location Smart",
they even had a demo page that was completely public on the internet, that anyone could use
to find the real time location of any given phone number, however the phone being tracked did have
to provide consent via SMS, well... unless you were accessing the service via its API,
which was horribly insecure and had no authentication at all. So in essence,
you could find the real time location of any phone in the US, for free - this news is insane.
The only good news here, is that this selling of data isn't going on anymore - at least as far as
we know. The carriers suspended their location selling programs 5 years ago,
and this $200 million dollar fine is actually the result of a 4 year long FCC investigation. But as
you could've guessed, the carriers aren't too happy about the fine and intend on appealing.
An out of control zombified botnet is being targeted by white hat hackers. The PlugX botnet,
was created by China's 'Ministry of State security' back in 2008. And once it infects a
computer, the Chinese hackers are able to perform screen capturing, keylogging, managing processes,
pretty much all the features you'd expect. And the list of references on malpedia is extensive,
because this malware has seen widespread use in various campaigns over the past 15 years.
However in 2023 for unknown reasons the hardcoded IP used to control the botnet went silent,
it's Chinese owners had simply abandoned it. Since then, the infected computers have essentially
been zombies, which every so often ping their master's IP for instructions that never come. So,
as it stands, the malware on infected computers isn't actually doing anything malicious,
however this isn't a solved problem, because if a bad actor were to somehow take control of that ip,
they could easily awaken the thousands of sleeper agents.
And this is where researchers at Sekoia come in, they decided something needed to be done and in
September last year contacted the hosting company behind the IP and bought it for a
measly $7. By buying and sinkholing the IP they ensured it couldn't be used maliciously. But the
researchers were in for a surprise, because the PlugX botnet was thought to be more or less dead,
the researchers said they only thought a few thousand computers were still active
and trying to reach that command and control server. Instead in the months since they took
control they've observed almost 2.5 million unique IPs trying to connect to that up,
way more than anyone expected. The researchers actually think the vastness
of the botnet might be the reason why it was abandoned by its Chinese overlords.
This is probably because in 2020 the Chinese hackers upgraded PlugX by adding
worm capabilities, allowing the malware to infect connected USB sticks. Upon infection,
the stick's real contents would be moved to a hidden folder. Another
hidden folder would contain PlugX malware files,
but all the end user would see is a shortcut file with the same of the drive, which when
opened would result in the PlugX malware being executed and a new computer added to the botnet.
The researchers think that this worm feature might've caused the botnet got a bit out of
control, and that the management interface of PlugX just wasn't designed for this many bots.
Regardless of why it was abandoned, leaving the millions of bots as they are isn't a great idea
as you don't know who might come along next and take over the botnet. The researchers
considered utilising a self-deletion command to completely erase the botnet, but that comes with
its own problems, because if something goes wrong and the researchers delete more than
they meant to or somehow mess up victim PCs then they could get sued into oblivion. And
besides there's probably a bunch of infected USB sticks lying around that,
when plugged back in could just reinfect the computer anyway. So the white hats have made
the probably wise decision to hand the task over to law enforcement and make it their problem.
as always thanks for watching, and I'll see you in the next video, have a good one!