Hello world,
Leaks from an anonymous source reveal how Iran is researching hacking into and blowing
up fuel pumps at petrol stations, and how they want to hack and sink cargo ships,
A new report uncovers that 4% of encrypted malware downloads are now coming from Discord
And Kaseya, the victim of the largest ransomware attack this year, mysteriously manages to
acquire a universal decryption key
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
Just in the past day, seemingly classified Iranian documents detailing plans for explosive
new cyber attacks have been leaked. This bundle of top secret reports uncovered by Sky News
lays out how Iran is exploring how they could hack into and sink cargo ships and blow up
petrol station fuel pumps. I’m not exaggerating this in any way.
The files are marked “very confidential” and are all headed with a quote from Iran’s
supreme leader which reads “The Islamic republic of Iran must become among the world’s
most powerful in the area of cyber”. The anonymous source designates the author of
these documents as “Intelligence team 13” - I haven’t come across this moniker before,
it seems like no one else has either. Though it’s said to be a component of Iran's Islamic
Revolutionary Guard Corps' cyber command. The source said that “intelligence team
13” is "supposed to be rather clandestine. Working on offensive cyber operations globally".
The Iranian hackers have seemingly set their sights on cargo ships as first of the leaked
reports was titled "Ballast Water" - referring to ballast tanks that cargo vessels use - these
are compartments within boats that hold water in an effort to provide stability to a ship,
as you can imagine, stability is pretty important when you’re floating. The report details
how “pumps are used to bring water into the tanks through centrifuges” and that
“the task must be completed with precision. Any problems could result in the sinking of
the ship.” A “diagram showed how commands could be sent remotely to a ship from a control
centre on land via a satellite link.” The section concludes with “Any cyber attack
or disruption of these systems could cause irreversible damage to the ship”. This all
sounds rather spooky and ominous, cargo ships are pretty important - the vast majority of
global trade is facilitated by sea, how else are we to get our 50 cent fidget spinners?
However there is good news, these seem to be very high level explanations of ideas or
plans if you could call them that. They discuss the possibility of an attack of this kind
as opposed to a detailed low level explanation of how one might carry out an assault of this
magnitude. Sky News points out “the authors appeared to rely on open source research rather
than any privileged information”.
Another segment of research of interest to “Intelligence team 13” was aimed at delineating
attack vectors of petrol stations. The leaked top secret document focused on a system known
as an automatic tank gauge which tracks the flow of fuel at fuel pumps. Specifically referring
to a product of this kind developed by “Franklin Fueling Systems” - a US company, the report
details how this system has “the ability to cut off the fuel supply or change its temperature.”
It went on to say "[An] explosion of these fueling pumps is possible if these systems
are hacked and controlled remotely."
Again, this is a high level analysis of a potential attack rather than a codified conspiracy
of some kind. Though a spokesman for the company which develops these systems said “he did
not think it would be possible to trigger an explosion” - very reassuring.
The Iranian embassy in London obviously “did not respond to a request for comment on the
allegations”. As with most leaks there’s only one source, so all I have to go on for
this topic is Sky News’ report. I don’t think we have to worry about petrol stations
randomly exploding or cargo vessels sinking just yet, I highly doubt Iran has any active
plot to sink cargo ships or blow up fuel pumps. The leaked bundle of reports comes across
as a kind of white paper as to what type of vulnerabilities may exist in critical infrastructure
- Iran’s aim as the source explains would be to create a “target bank to be used whenever
they see fit". Saving their knowledge of these vulnerabilities for a rainy day.
A brand new report published by Sophos, explains why 4% of worldwide encrypted malware downloads
are now coming through Discord’s servers. I made a video on this topic a while back,
malware hosted on discord is nothing new per se, but over the past year it’s become a
whole lot more popular. Judging from the past two months, there’s been an increase in
Discord hosted malware by nearly 140 times when compared to the same period last year.
Firstly a quick primer on how this all works. Using Discord you can send files, including
executables to your mates - by right clicking and copying the link, you can extract a direct
download link to your file. Criminals are taking advantage of this feature to host their
malicious files, sharing the links wherever people will click them. For bad actors this
is a really attractive way of hosting malware for a few reasons - firstly not many file
sharing sites these days provide static direct download links, so that in of itself is a
big bonus. Also, files uploaded to discord never expire, not only that but Discord itself
is large enough that fiendish files get lost in the ether of countless legitimate files
that’re also being uploaded to the service. And best of all, Discord is free, so even
if a dodgy account does get banned, an attacker can just create a new one.
The new report specifically refers to 4% of TLS encrypted malware downloads, TLS is the
same protocol which HTTPS uses to encrypt web traffic. Just like the legitimate side
of the web has spent the past few years switching over to HTTPS, the same has been happening
in malware, albeit more slowly. Nowadays almost half of malware uses TLS to conceal their
communications in an attempt to make them harder to identify.
Sophos reports most of the fractious files hosted by discord “focus on credential and
personal information theft”, a good portion of malware lurking on discord’s CDN has
been identified as RATs or remote administration tools. These programs are often disguised
as game cheats, license key generators, etc. Or for the more gullible users, Sophos have
observed Discord nitro generators. The ploy is you enter your username, click start boost,
and that’s all it takes to unlock nitro perks, apparently. These nitro generators
are often called “nitrogen” utilities.
To be crystal clear, none of this Discord hosted malware is really Discord’s fault
- malware has to be hosted somewhere, and those so inclined will simply go with whichever
service is most feature rich at the time, at the moment it’s Discord. Bad actors use
other services such as slack to host their malware, but the meteoric rise of Discord
in the past few years, has made it one of the prime choices for miscreants looking to
host their wares.
There’s been puzzling new developments in the sticky situation that is the Kaseya ransomware
hack. For a quick 20 second recap incident:
Kaseya makes remote administration tools used by companies in order to manage their fleet
of computers, this software had a vulnerability which was exploited by a Russian ransomware
gang to lock up 1500 organisations worth of computers. The gang demanded a staggering
$70 million in exchange for the decryption key.
The new development to unfurl is that Kaseya has mysteriously managed to obtain this universal
key which has the ability to decrypt all ransomed computers. I say mysteriously because how
this key was gotten a hold of, remains a mystery. Remember, the ransomware group responsible
here, rEvil liquidated themselves shortly after the attack, following which they torched
their servers and went completely dark - since then there’s been no apparent way to get
in contact with them.
There are a couple theories here, firstly that somehow rEvil made contact with Kaseya
by means other than their pre-existing official channels, and Kaseya paid either the full
$70 million ransom or some measure of it. When asked, if Kaseya themselves paid the
ransom they simply responded that they “can’t confirm or deny that”.
An alternative theory I read via “bleeping computer” revolves around the notion that
the Russian state was involved in shutting rEvil down, to show they were playing ball
with the US, following this Russia obtained the decryption key and handed it to US authorities
as a gesture of goodwill, from where it was passed to Kaseya such that they could disseminate
it to their customers.
To make matters more ambiguous Kaseya is apparently forcing their customers to sign an NDA before
handing them the universal decryptor. There’s a good chance we’ll never know what really
went on here, but I’m open to hearing you guys’ theories in the comments.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next go watch my previous video on the troublesome spyware developed
by NSO group which is being used by dictatorial regimes to spy on journalists.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.