Stuxnet is back. Back in the news at least, a report in a dutch newspaper claims to reveal
the identity of the guy who actually planted the virus along with details on how he smuggled
it into Iran's nuclear facility. Also coming up in today's hacking news, the infamous cyber
criminal Pompompurin is in trouble yet again and China claim to have hacked Airdrop.
But first, Stuxnet - a new report claims that it was planted in the Natanz nuclear facility
by one 'Erik van Sabben', who isn't American or Israeli, but rather Dutch. Apparently the
two countries who developed the now famous virus weren't actually capable of getting
it into the nuclear facility, so they had to enlist the help of the AIVD - which is
basically the Dutch version of the CIA. Erik was the man chosen for the job, because - in
addition to being a secret agent, he was also working for a logistics company in Dubai,
which did a lot of business with Iran by supplying industrial parts for Iran's oil and gas industry,
at a time when international sanctions meant there were few companies Iran could rely on.
An infected water pump - this is how Erik smuggled Stuxnet into the nuclear facility.
He didn't have to break into the place 'James Bond' style - rather it seems he was just
invited in, like any other contractor to install equipment. But there's more to the story here,
because according to the the investigation, the CIA and Mossad weren't very honest with
the Dutch. Whilst the Dutch knew they were helping to sabotage the facility in some way,
they didn't know about the sheer extent of Stuxnet and that it could be argued that they
were committing an act of war. Leading to a dutch intelligence source to say "The Americans
have used us very hard". And it seems likely that Erik himself didn't know much about what
was in that pump - in an interview with his family, they said that after the operation,
"He [seemed] panicked", "'We all thought it was very strange.' His Iranian wife: [said]
'He was so upset and insisted we leave [Iran] immediately.'" Of course, all this time his
family had no idea that he was leading a second life in the secret service.
Erik did flee Iran, but just 2 weeks later, he was killed in a motorcycle accident in
Dubai. Talk about sus, if we put our tinfoil hats on for just a moment - it's unlikely
that the Iranians could've assassinated him, because the effects of Stuxnet hadn't yet
materialised. So, was this the CIA and Mossad clearing up a loose thread? Quite possibly.
But according to the report "From conversations with people who were at the scene of the accident
at the time, there is nothing to indicate possible intent." I mean - pretty much everyone
I know who rides a motorcycle has at some point been involved in a horrific crash, but
nevertheless the timing could not be more suspect, and I look forward to reading your
theories in the comments.
I'll link the full article below, it is in Dutch so you have to translate it. But this
report is the result of 2 years of investigation, and involved speaking to ex employees of Mossad,
the CIA but also "former employees of the nuclear facility" itself. Stuxnet is seen
by many as the starting gun for the era of digital warfare. It caused a thousand centrifuges
used to enrich Uranian to break down, delaying Iran's nuclear program by years. A costly
way to learn the importance of regular penetration testing, which is where today's sponsor, PlexTrac
comes in.
What if we told you penetration testing doesn't have to suck? With PlexTrac you can rapidly
generate a pentesting report in as little as 5 minutes. Using the content library you
can easily pull pre-written narratives and findings writeups into your report, and just
edit the specifics so you don't waste time copy-pasting from previous engagements. Shortcodes
help keep your report modular and reusable across pentests. PlexTrac makes your peer
review workflow easy, and adding comments and collaborating across your team is a breeze.
The goal with PlexTrac is to set your formatting and create reusable content once, then present
your best work every time. Build consistent, high-quality reports in a fraction of the
time by automating with PlexTrac.
If you use the link in the description to attend a one-on-one personalized demo, PlexTrac
will send you a starbucks 10 dollar, euro or pounds gift card, totally free, just for
your time. But better yet, you’ll finally make what was previously a mundane and time-consuming
task, easy.
The infamous hacker Pompompurin is in the news yet again. If you're new here, Pompompurin
gained his fame by running the infamous blackhat site breachforums as well as perpetrating
a string of high profile hacks, allegedly. However his luck ran out last year when the
FBI managed to track him down thanks to his embarrassingly awful opsec - I have a whole
playlist on the shenanigans surrounding his downfall. And at the time of his arrest the
guy was really popular and even gained a bit of a cult following, however his reputation
was absolutely trashed in the wake of his arrest, because after inspecting his hard
drive, the feds found hundreds of images of cheese pizza, CSAM, whatever you want to call
it...
However this all took place months ago. He's back in the news today because he's in trouble
with the law yet again. You see, despite pleading guilty to 2 cybercrime offences and 1 offence
relating to those images he was released on a $300k bond cosigned by his parents, whilst
he awaits his sentencing. However his release came with a bunch of conditions, he's not
allowed to create any websites, or register a domain, and he's not even allowed to "access
a computer or the internet" well - unless it has an FBI approved RAT installed that
gives the feds pretty much complete access to it. Also, other than not being able to
have contact with minors for obvious reasons, there was another condition that prevents
him from using VPNs, Tor or proxies.
And, I think you can see where we're going here, Pompompurin, otherwise known as Conor
Fitzpatrick has just been re-arrested for violating these conditions - in particular
he's accused of using a computer that didn't have an FBI approved RAT installed, he also
committed the high crime of using a VPN. However, the court documents don't mention what Pompom
was up to, and it would be interesting to know how the FBI knew he was violating his
conditions. But given Pompom's history of god awful opsec, it could be as simple as
the feds detecting his google account or something being accessed from an ip in say Panama - which
would definitely arouse suspicions of VPN use, or perhaps the FBI had instructed his
ISP to monitor his home connection for use of VPNs. Because whilst your ISP obviously
can't see what you do through a VPN, they can most definitely detect if you're using
one.
Either way, it doesn't really matter because the guy is facing potentially 30 years in
prison, and that's before he even gets to potential extra time for violating his release
conditions.
China claims to have hacked Apple's AirDrop, in particular this is coming from researchers
at the "Beijing Wangshendongjian Forensic Appraisal Institute" - which I'm sure we're
all familiar with. The researchers say they've devised a way to identify the senders of random
airdrops - the kind of thing that kids use to send fake bomb threats, and weirdos use
to creep people out on the morning commute.
However in China, anonymous AirDrops are a much bigger deal because they've been a really
useful tool for anti government protestors to share anti government things with strangers
at protests. So much so that last year, Apple kneecapped AirDrop by modifying the option
to receive AirDrops from 'Everyone', so now you can only enable Airdrops from Everyone
for 10 minutes at a time - this change was applied in China first, before it was implemented
globally - so yea it seems that Apple did this at the behest of the CCP.
But anyhow, how can anonymous AirDroppers be identified? The researchers "analyzed iPhone
device logs" and found that when it comes to AirDrops, the "sender's device name, email
address, and mobile phone number were [all] recorded [on the receiving phone] in the form
of hash values". The problem is that phone numbers in particular are kinda predictable,
they're all 11 characters long and contain only numbers - so a bad actor, like the CCP
- could just precompute every possible hash for all possible phone numbers - and then
just match the hash with the one stored in the device logs and without much effort they've
identified the sender.
However, this technique might not be as new and novel as the Chinese researchers claim
- a couple years back German researchers published details on a seemingly identical vulnerability.
So this Chinese research seems like it's moreso geared at dissuading people that aren't fans
of the CCP from wanting to use AirDrop in the first place. But wouldn't the CCP rather
keep this method as secret as possible? Well - this airdrop identification method can't
be done remotely, the CCP would need direct access to someone's phone to be able to pull
the logs off it - and well, they can't catch everyone; so scaremongering about AirDrop
is going to dissuade way more people from using it than the CCP could ever catch.
As always thanks for watching and I'll see you in the next video, have a good one.