A massive dump of sensitive Chinese documents has randomly appeared on Github, which seems
to reveal top secret Chinese hacking tools.
Also in your hacking news roundup: A consumer grade spyware app has itself been hacked,
and the FBI has taken out a Russian government botnet.
But first, this could be big... a github user 'I-S00N' recently spawned and published a
repository, when translated into English it reads "The truth behind An Xun.".
Anxun or I-S00N I'm not exactly sure how to pronounce is a Chinese company that on the
surface at least only deals in standard cyber security services, like penetration testing,
risk assessments, that kind of thing.
But thanks to what seems to be a disgruntled former employee, we've been granted access
to a whole treasure trove of secret documents that reveal spyware and even physical hacking
devices that have allegedly been made for and used by the Chinese government.
So, what does the 200 megabyte dump contain?
In one document, there's a description of what's called a 'WiFi proximity attack system'
- a physical device that can be disguised as a power bank or a more barebones variant,
that once covertly deployed on a victim's network can be set up to provide a proxy tunnel
into that network, providing access to remote hackers.
It kinda sounds similar to hak5's LAN turtle.
There's a whole document in here on a 'Twitter public opinion guidance and control system',
which talks about the need to "strengthen the initiative in controlling overseas social
public opinion" - well this is pretty Orwellian.
The platform seems to exploit some kind of vulnerability in Twitter private messages.
A target account can be sent an 'evidence collection link', after which the system obtains
permissions to "publish tweets, view private messages" and more.
In another file there's details on custom Remote Access Tools that can infect Windows,
Mac, Android and iOS devices.
We've also got a description of some kind of physical device that's capable of pulling
sensitive data from Android devices, after they simply connect to its WiFi network - though
there's no description at all of how that works.
Also in the dump are details of an anonymous communication network that overseas Chinese
spies can use to stay hidden.
It kinda sounds like a private version of TOR.
There's a description of a physical device that seems to be what makes up nodes in the
network, and we even have it's specifications.
The leak goes further, there's details of some kind of DDoS client, a WiFi triangulation
device and a hell of a lot more.
We've really only scratched the surface here.
Not only are there details of custom spyware and hacking devices, there's also a lot of
employee communication in the dump, exposing the internal politics of the company which
includes employees complaining about low pay and that kind of thing.
Oh and there's also details on offensive cyber operations allegedly carried out by this company
on behalf of the Chinese government.
This leak is all very fresh, despite being made public 4 days ago, it all went under
the radar until yesterday at which point it went kinda viral.
On the surface this seems like a leak of epic proportions, however there are some important
caveats: Firstly, here's no dates on a lot of these documents, so we don't know if these
tools are old and deprecated or if they're still in use.
Also, the company in question hasn't made any statements confirming or denying the breach,
so it is possible at least, that some or maybe all of it could simply be fake.
After all, the leaker is clearly hellbent on damaging this company as much as possible,
I mean - the original github repo is divided into how the company allegedly deceived the
CCP, employee complaints, there's even an exposé on their financial issues, and their
apparently low quality products.
I've tried to give you guys a bit of an overview here, but no doubt in the coming days this
story will develop as researchers comb through and make sense of more of the documents, so
make sure to hit the subscribe and bell icon, so you don't miss the follow up.
A spyware app has been hacked, leading to the personal data of tens of thousands of
its victims being leaked.
TheTruthSpy is a consumer grade spyware app, so this thing isn't used by oppressive governments,
but rather by oppressive parents.
It's advertised as a parental control tool, that helicopter parents can use to keep an
eye on their kids, however whilst that's the advertised use case, these kinds of apps are
often used maliciously by stalkers, to, well stalk - and so this type of app is often called
"Stalkerware".
The app enables the recording of calls, tracking a phone's location, grabbing photos, and a
hell of a lot more.
Whilst this functionality might be similar to other spyware we've seen on this channel,
Pegasus comes to mind - to compare this to Pegasus would be like comparing an old rust
bucket to a Rolls Royce... because this app has to be manually installed on a victim's
Android device via an APK, there's no fancy zero day exploits here.
It turns out, TheTruthSpy also has rust bucket level security.
The hacker groups "SiegedSec" and "ByteMeCrew" teamed up to reveal a vulnerability in TheTruthSpy's
servers which allows anyone to grab the sensitive data that's exfiltrated from the victims of
this app.
So a bunch of super sensitive data is not only visible to potential stalkers, but also
the entire world.
The root cause is an IDOR or "Insecure direct object reference" vulnerability - this kind
of vulnerability happens when a server doesn't check if you have permissions before giving
you access to something.
For example, let's say you have a link to a photo on facebook, you still need to be
logged into an account with permissions to view that photo before you can actually see
it, just having the link doesn't inherently grant you access to it.
But TheTruthSpy servers are apparently not performing this basic check, consequently
anyone can scrape the personal data of those who are being spied on.
The hackers were able to grab browsing history, GPS history, and even contacts of an arbitrary
victim.
However, the hackers aren't releasing specific details on how to reproduce the hack and for
good reason...
Because this vulnerability isn't new, seemingly the exact same vulnerability was exposed by
TechCrunch almost exactly 2 years ago, it was even assigned a CVE, however in the years
since, TheTruthSpy have shown zero willingness to actually fix the problem, and so in all
likeliness this will go unfixed.
Stalkerware in general has a pretty awful reputation for caring about the security of
their customer's information, a quick google search will yield numerous examples.
The two groups that rediscovered the bug, despite being responsible for some pretty
brutal data leaks in the past, have taken the rare decision not to leak all this personal
information, instead they teamed up with TechCrunch to add the IMEI numbers from the dump to a
database, so you can check whether you are a victim of the app.
One of the hackers behind the investigation has a blog post that goes into much more detail
on this, which I'll make sure to link below.
The FBI has hacked and taken down a Russian government botnet that was being operated
by Russia's 'Military Unit 26165', better known by the name 'Fancy Bear'.
Now, it's only February but this is the second government controlled botnet that the FBI
has taken out this year, a couple weeks back, China's 'KV botnet' suffered a similar fate.
But this Russian botnet is unique, not because of its intended use - I mean cyber espionage
is usually the purpose of state backed hackers.
But what makes this botnet different is that it wasn't actually built by Fancy Bear.
Instead this botnet was put together by just regular cyber criminals who successfully hacked
over a thousand 'Ubiquiti Edge OS routers', thanks to default admin passwords - proving
that no matter how much people spend on fancy networking gear, money can't buy common sense.
The cyber miscreants infected the routers with Moobot malware - this kind of malware
isn't new, it's been used by cyber bad guys over the past few years to build botnets for
use in DDoS attacks.
But in this case, the botnet somehow made it's way into the hands of Fancy Bear, whether
that means the Russian government is working with cybercriminals, or simply bought the
botnet from them - we just don't know.
After acquiring the botnet, Fancy bear repurposed it for use in spearphishing campaigns, credential
harvesting operations - all of course targeting Western governments, military installations,
and companies of interest to Russia.
However, this is where the FBI stepped in and launched "Operation Dying Ember" in an
attempt to take down the botnet for good.
Exactly how the FBI hacked the botnet isn't clear, the warrants simply describe their
methods as some kind of mysterious "technical ability", however in all likeliness they reverse
engineered the malware, finding a vulnerability in it which gave them access to individual
compromised routers.
The FBI was granted a whole list of permissions which meant they were allowed to copy the
malware for analysis, delete the malware from compromised devices, and change the router's
firewall rules to prevent the Russians from regaining control over their botnet.
As is usual with these operations the FBI does not have to get permission to hack back
your hardware from the Russians, however they are working with ISPs to maybe at some point
drop you a letter in the mail giving you a heads up.
As always thanks for watching, and I’ll see you in the next video, have a good one!