Hello, World! A TikTok trend is being exploited to spread malware, North Korea has a new crypto scam,
and Australia is setting up an anti hacker task force. That’s all coming
up in today’s roundup of cyber security tech news. TikTok is known for its dumb trends, whether it’s
scaling mount milk crate, or super gluing vampire fangs to your teeth, there’s always something to
cringe at on this app. And now, we have something new - the “Invisible Challenge”. So there’s a
filter on TikTok that makes you invisible - well kinda, it works like a blur background feature,
but instead - this blurs you, it only works on bare skin rather than clothes - so as could
probably be foreseen, a trend emerged where people use this filter whilst completely naked. And the
comment sections on these videos have been taken over by two kinds of people, trolls and
creeps. The trolls say they’ve somehow managed to remove the filter, and the creeps are asking how.
Of course, removing a TikTok filter is impossible, given videos are fully rendered with the filter
baked in prior to upload. But this seems to be a little known fact, one which cyber criminals
are stepping in to exploit. I found dozens of TikToks claiming to have special software that
can remove the invisible filter entirely. This is extra creepy given the number of undermage
kids doing the challenge. But luckily, the cyber miscreants are only spreading malware,
which they’re hosting on Discord servers. And it seems quite a few people are falling
for this, to put it into perspective, one of these Discord servers has over 30
thousand members. Which I suppose shouldn’t be surprising given the trend itself has been
getting millions if not billions of views. At this point, researchers at Checkmarx
stepped in to investigate, and after joining the server a bot messaged them a link to a
Github repo which claims to host the “TikTok unfilter API” - made by one “420World69”. The
same Github account also hosts a “Discord Nitro generator” tool, and given the file structure is
almost identical it looks like this bad actor has just been copy pasting code and changing the name
based on the campaign. But what do these tools actually do? When you run the python script,
it let’s you know that it’s “open source and definitely not a virus” - before spitting out some
ASCII art. Whilst you’re distracted by trying to make sense of the ASCII art, behind the scenes the
malware’s actual payload is being downloaded. In this case, that’s malware called “Wasp stealer”,
which grabs and exfiltrates saved passwords, discord tokens, crypto wallets and so on.
And since CheckMarx published their research this campaign has vanished. But before it could
be nuked it looks like quite a few people were infected - at one point ”TikTok unfilter API” even
managed to make it onto Github’s trending page. North Korean hackers are back with a new crypto
scam. It comes in the form of this website, “BloxHolder” - “The world's most advanced
automated crypto trade bots”, no citation on that, but anyway - the website does look pretty well
designed, however if you browse it a bit you’ll notice that something just doesn’t feel right,
I mean - on the pricing page you’ll notice there’s no way to buy anything,
and you won’t find any contact information for the people supposedly running the company.
Something feels off. The mask slips if you just Google some arbitrary text on the site, because
you’ll find a very similar looking website, “haasonline”. It’s pretty much a carbon copy,
it seems as if the North Koreans just hit ctrl+s on this site, and changed any references from
hassonline to bloxholder, and replacing their logo with what is probably the most generic
looking crypto logo they could’ve come up with. The purpose of the bloxholder website is to act
as a pretext for spreading fake crypto trading software. The installer file contains a copy of
the legitimate open source crypto trading application QTBitcoinTrader, but it comes
with an extra, undocumented feature, AppleJeus - this is North Korea’s favourite malware - and
it isn’t after your Discord token, in fact this malware isn’t interested in you at all. Because
this website won’t have been advertised to some large audience, but rather a small handpicked
group of people, who can act as stepping stones to stealing large sums of crypto, typically
this’ll be engineers at a crypto exchanges. For example in 2019, North Korean government
hackers operating under the Lazarus group launched an almost identical operation to this latest one.
A website supposedly offering crypto trading bots hosted a download link to a copy of QT
Bitcoin Trader, laced with malware - which an employee at the crypto exchange “dragonex” fell
for. Lazarus stole $7 million dollars worth of crypto from their hot wallets, with the exchange
going out of business several months later. And, $7 million dollars is actually a relatively
small sum for North Korea, I mean, in the first 9 months of this year, it’s estimated
that “North Korea-linked groups have stolen approximately $1 billion of cryptocurrency”,
the only way to do that is by going after a small number of high value targets. But w hat
happens to the stolen coins? It’s thought they’re funnelled into Kim’s nuclear weapons program.
And by the way, the bloxholder website is still up as of making this video,
but it looks like the sting in its tail, that fake crypto trading malware was promptly
removed by the North Koreans after research by Volexity exposed this campaign. That being said,
Lazarus has been known to exploit browser zero days, so visit the site at your own risk.
Australia, they’ve been having a pretty rough time lately with cyber attacks. It started in
September with the hack of Australia’s second largest telecoms company, “Optus” - over 10
million people (that’s almost half of Australia’s population) had sensitive data including passport
numbers nabbed by cyber miscreants. Just weeks later one of Australia’s largest health providers
fell victim to a ransomware attack which saw the health records of millions, stolen. Since then
there have been numerous other data breaches, it feels like every other week there’s some new hack
targeting Australia popping up in my RSS feeds. I mean, there was even one which exposed the
identities of Australian secret agents working undercover in the Colombian drug trade. So,
as you can imagine, pressure has been mounting on the Aussie government to do something about
the threat hackers pose. And they’ve come up with a plan, announcing the creation of a new
“Task Force” that will “Hack the hackers”. And this is what Australia’s “Minister for
cyber security” had to say about the new task force: “This is a new operation,
a permanent standing force of 100 of the best most capable cyber experts in this country”,
“so this is not a model of policing where we wait for a crime to be committed”,
“What they will do is scour the world”, “hunt down the criminal syndicates and gangs who are
targeting Australia in cyber attacks, and disrupt their efforts”, “This is Australia standing up
and punching back”, “We are offensively going to find these people, hunt them down and debilitate
them before they can attack our country”. I have a sneaky feeling that whilst the creation
of this new anti hacker army will make for some spicy content for me to cover in the future, it’s
probably not going to have much of a real world impact. I mean, take the Optus hack that affected
almost half of Australia’s population, propelling the problem of hacking into public discourse… it
was arguably not even a hack - the root of the data breach was an unauthenticated API, which
handed a curious miscreant complete access. No amount of offensive actions against hacking groups
could’ve stopped him, because he wasn’t affiliated with any of them, he was just an opportunist.
As for the medibank hack, well that seems to have been perpetrated by the rEvil ransomware
gang. This gang is a good case study because last year they were themselves hacked by none other
than the FBI, taking them offline for months. A number of rEvil members were also arrested in
Russia - a rare show from the Russian authorities. But regardless of all of this rEvil has seemingly
bounced back, perpetrating this medibank hack. So whilst the creation of this new task force
will make for some good headlines, it seems to be mostly a PR campaign. And whilst I’m sure they
will see some level of success, their time would probably be better spent auditing and shoring
up the defences of Australian companies. But in fairness, the government does have other plans,
they’ve increased fines for data breaches dramatically. Previously the maximum fine
was just a couple million dollars - pocket change for a large corporation.
This video was made possible by Linode, who are giving you a $100 60-day credit
just for signing up. Linode is essentially your swiss army knife for cloud computing,
if it runs on linux it'll run on Linode. One great feature of Linode is their app
marketplace which makes it super easy to spin up servers with preconfigured software. Use
Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer makes it
easy to configure the basics, like VNC passwords, whether you want a desktop environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices. Use the link in the description now to claim your free $100.
As always thanks for watching and I’ll see you in the next video, have a good one.