In today's exploration of cyber security tech news: ever since Russia invaded Ukraine the
hacktivism world has been rather eventful... to say the least, we've seen sabotage, leaks,
and defacements.
But could Anonymous' latest operation be the biggest of them all?
In the last week or so, over 20GB of data from Russia's central bank was leaked onto
the open internet.
Have Anonymous actually hacked the Russian Rouble itself, or is this leak largely inconsequential,
kinda boring and actually nothing of interest?
let's find out.
But where did this leak even come from?
So - I first came across this data dump on twitter, the torrent for which was hosted
on a website called "anonymousleaks.xyz".
Now, I haven't come across this website before, and I think it's really important to be sceptical
of websites claiming to be hosting Anonymous data leaks, in particular when they make themselves
look all hackery with flashing green text, and especially when the site only popped up
in the last week or so - simply because you don't know if they've got some kind of ulterior
motive, like disguising malware as data dumps.
In fact, I saw a few twitter accounts posting warnings about this particular site, claiming
it's unsafe.
We don't know's behind anonymousleaks.xyz, because it was set up... well - Anonymously
of course.
It says there's 7 leaks available - strangely, the web page has a server ID, which is odd...
I wasn't sure what that referred to, and it changes every time you refresh the page.
Turns out it's just a randomly generated number, implemented to make the website look more
"hackerish" I can only presume?
Arguably kinda cringe, but anyway.
After checking a couple of the torrents, they do seem legit, as in they're the exact same
ones hosted by more established and reputable leak sites like distributed denial of secrets.
Even so, just as a PSA, I would be very cynical about websites which randomly pop up claiming
to host leaks from Anonymous, especially when they look kinda flashy like this and implement
silly random numbers, as they could just be trying to whip up noobs, encouraging them
to download malware.
A website you can trust for leaks - at least from my experience - is "distributed denial
of secrets", it's become the default website for people wanting to anonymously submit data
dumps for public release.
If it's here you can reasonably assume the leak isn't just some kind of a front to spread
malware.
But anyway, let's get to the hack of Russia's central bank.
The dump seems to have originated from "The Black Rabbit World" on twitter, which of course
aligns themselves with the brand of Anonymous.
Interestingly they announced the hack in advance of actually leaking the data, tweeting that
"More than 35 thousand files will be released within 48 hours", presumably in an attempt
to drum up hype.
They also posted one of those classic Anonymous style press release videos., which I can't
play, because the background music will get me copystriked - but you know how these things
go "We do not forgive, we do not forget, expect us" etcetera, and so on.
Anyway, a lot of mainstream news outlets covered Anonymous' initial announcement of the hack,
but none that I could find covered the contents of the data leak itself.
That may because the actual leak is somewhat, dare I say, boring.
I downloaded it of course and trawled through it.
There are a lot of boring and inconsequential files in here, for example, there's accounting
documents and audit reports.
I found what appears to be a tool the bank uses for viewing the supply of Roubles - however
I'm pretty sure a lot of this data is all public knowledge already.
As far as I can see there doesn't appear to be anything of supreme interest in this data
dump, which explains why news outlets didn't bother to cover the leak itself.
In fact it doesn't even seem like everything which was claimed to be in this leak actually
was in this leak, for example in the announcement video, the leak was said to contain secret
"conference videos" from the bank.
However, I recursively unzipped the contents of the dump and ran a search for a couple
dozen different video formats, and found nothing...
apart from a couple "swf" files, which were just 1 second audio clips - irrelevant.
However the dump does contain thousands of files in Russian, which will take time for
people to comb through and make sense of, so there may be something juicy hidden within
the archive, but it's unlikely at this point.
Is there something juicy in this leak I haven't spotted?
Do let me know in the comments.
So, other than the central bank, in the last week or two there have been a few other Russian
organisations breached under the banner of Anonymous - for example, we have a couple
of Industrial companies, one being mashoil, they manufacture equipment for drilling and
mining - the company had 140,000 emails leaked which amounts to 110 gigabytes, all downloadable
of course via a torrent hosted on distributed denial of secrets.
And then there's the Nestle hack which was kinda interesting.
So Nestle - y'know the makers of the legendary kitkat - had initially refused to stop doing
business in Russia.
Many people weren't too happy about this (as you can imagine), and a few days later Anonymous
related twitter accounts started tweeting that the collective had exfiltrated and leaked
10GB of Nestle emails, passwords and so on.
The news rippled throughout the interwebs, until someone actually checked the leaked
data... and found it whilst it did originate from Nestle's servers, it wasn't quite what
it seemed to be.
The database just consisted of test data, as in it was fake, imaginary made up data,
just used by Nestle to test their backend.
You can tell this, just from the sheer amount of example.com emails scattered throughout
it.
So the leak was kinda pointless.
You may have noticed it's been a couple weeks since I made a video on the Russo-Ukrainian
drama, I've had a bunch going on behind the scenes, but I'm back and I'm keeping my eye
on the hacktivism world - so you can expect more videos as things unfold
Thanks for watching, you know what to do, tickle that notification bell and follow me
on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.