Hello, World!
A free VPN has a secret feature, malicious smartwatches are targeting the US military,
and dozens of private jets were seized after the police hacked EncroChat.
That’s all coming up in your roundup of cyber security tech news.
“Are VPNs worth the money”, is a controversial question.
But why not use a free VPN?
There’s tonnes to choose from, and if the developer really does log all your activity
and sells it to the devil, at least you’re not paying for the privilege.
Well, it’s potentially worse than that - because a popular free VPN has just been exposed as
a DDoS botnet in disguise… and this isn’t a one off case.
The discovery comes from a security researcher who investigated ‘SwingVPN’ after a friend
of theirs complained about some strange activity on his phone.
The “Swing VPN” Android app has over 5 million downloads and some pretty good reviews.
On the surface, if you need a VPN in a pinch, SwingVPN seems like a pretty good choice - there’s
no indication at all that by installing the App you’re actually donating the use of
your phone to a DDoS botnet.
Our researcher started their investigation by using a network monitoring app to see exactly
what SwingVPN was up to, they discovered that for some reason in the background the App
was visiting ‘turkmenistanairlines.tm’ - the website of Turkmenistan’s national
airline, every 10 seconds.
If we take a look at the exact URL the app is loading, we can see it’s clearly a search
for flights between two specific airports on certain dates.
Now, something tells me this probably isn’t the ‘SwingVPN’ developer outsourcing their
holiday planning to users.
In fact, the URL isn’t as innocent as it might seem - searching for flights is an intensive
operation for a website, it has to query its databases and use a lot of server resources.
However loading this link every 10 seconds obviously isn’t enough to crash an entire
website - but that equation changes when you realise the App has 5, million, downloads.
When you combine all these users, the App commands some serious DDoS power…
The best theory for all of this, is that the bandwidth of people who use this app is likely
being rented out behind the scenes to anyone who for whatever reason wants to boot a site
from the interwebs.
Those stresser services you see on cybercrime forums need to get their power from somewhere,
whether that’s a network of infected iot devices, or a botnet of people who have a
malicious VPN app installed.
And for whatever reason, someone really doesn’t like Turkmenistan’s government, because
our researcher found a github repository that the App was pulling its targets from, and
there’s a lot of tm.gov domains in here.
Our researcher did some more digging and found that right after you install the App, you’re
added to the DDoS botnet before you even accept their privacy policy.
You can see as you’re scrolling through the privacy policy, in the background the
App is grabbing the stresser configuration files, and the DDoSing kicks in before they
even hit accept.
But surely this is a one off, and for the most part free VPNs are perfectly fine and
safe to use?
Well, no.
Free VPNs have been investigated on an academic level.
One paper analysed 283 different Android free VPN Apps.
And the findings will make you never want to even think of using a free VPN ever again.
Of the 283 apps, which is a pretty big sample “over 38% of them contain … malware … according
to VirusTotal” … “18% of the VPN apps implement tunnelling protocols without encryption”
and “66% of the VPN apps do not forward DNS traffic through the VPN”.
It seems whether by malicious intent of the developer, or sheer incompetence you’re
somehow being screwed over.
But the crazy thing is, people don’t even realise just how awful these apps are.
The researchers analysed the reviews for these apps, and many negative reviews are just complaints
about bugs and poor battery life.
Not even 1.5% of negative reviews are about how exploitative the App really is.
On average these free VPN apps have a 4 star rating, so it’d be hard to tell, if not
impossible whether or not an App is malicious.
However this study is from 2016, so perhaps things will have improved since then.
But I wouldn’t put much money on it.
As for ‘Swing VPN’, Google has removed it from the Play store, and banned the developer.
However, I find it curious that just 2 days later, Swing VPN reappeared under a different
developer.
But it has the same logo, same cover images, and even the same description.
Now I’m not about to make accusations that I can’t completely verify, because this
could just be an innocent developer trying to exploit the massive userbase that the original
SwingVPN had, I mean - judging by the reviews there’s clearly people that didn’t quite
get the memo about the old malicious version.
But regardless, save yourself a potential headache and avoid free VPNs entirely…
Now, this would be the perfect time to shill a paid VPN, but since VPNs are largely pointless
I won’t - instead if you found this segment useful make sure to leave a like and let’s
move to our next topic.
Next up, smart watches are being used to target the US military.
So, a number of US army personnel have been receiving unsolicited smart watches in the
mail, they haven’t ordered them, they haven’t asked for them, they’re just receiving them
unexpectedly.
But as the saying goes, “if you aren’t paying for a product then you are the product”,
and well - that applies here too, because after the recipient sets up their free new
watch it’ll connect to their phone and malware will scoop up their “banking information,
contacts, and account information such as usernames and passwords”.
Not only that but “malware may be present which accesses both voice and cameras”.
The “Army criminal investigation division” has put out this warning to all personnel
warning them to be on the lookout for “unsolicited smartwatches … in the mail”.
But who’s sending them and why?
Well - it’s unlikely that cyber criminals are trying to hack and steal from individual
soldiers, as these guys just aren’t highly paid.
Rather, this seems to be an operation, targeting their employer.
The warning notice, makes some pretty big claims, apparently after turning the watches
on they “began connecting to cell phones unprompted”, which implies that the watches
took advantage of some kind of vulnerability, perhaps in bluetooth.
I would like to investigate and tell you more about that, but this warning is all we really
have, there’s no technical info at all.
However I found a flyer being circulated by the US military which claims that these watches
are the culprit, “LED D18 Smartwatch”.
It’s the kind of thing you can find on aliexpress for just a few dollars.
But if you wanted to buy them in bulk for I don’t know… an espionage operation,
you could get the price down to an unreal 65 cents, making an operation using these
things way cheaper than you might have thought.
Who could be behind such an espionage operation, well there’s the usual suspects.
But financially motivated cyber criminals have also been known to make use of unsolicited
packages.
For example, a couple of years back the FIN7 cyber crime gang targeted companies by mailing
them BadUSBs laden with ransomware - they included a letter in the package explaining
that the USB sticks could be used to redeem a gift card.
In one more elaborate example the BadUSBs even came packaged in little gift boxes, along
with a note explaining to the victims that they were the lucky recipient of a $500 gift
card thanks to them being such a loyal Amazon customer.
It’s not the greatest example of social engineering - I mean, I can’t remember the
last time I redeemed a gift card from a USB stick.
But it’s likely these smart watches were also mailed with some kind of a pretext, explaining
away the oddity of receiving a free smart watch in the mail, and encouraging the victims
to actually use the things.
However there is an alternative, less exciting theory behind the watches.
The warning from the US army says that the watches “may be used for brushing”.
Brushing is when a seller on amazon or aliexpress places orders for their own products which
will be sent to seemingly random people.
But since it’s the seller who placed the order, the seller gets to leave the review,
which will of course be a glowing 5 star review - and therein lies the whole point - to increase
the proportion of positive reviews, inflate their sales figures, and thereby boost the
ranking of their product on whatever marketplace it is they sell on.
But if the free watches are part of an espionage campaign it wouldn’t be the first time US
service members have been targeted with the allure of free stuff.
Back in 2008 a USB stick left in the parking lot of a US military base in the Middle East
was picked up by a curious employee who plugged it into military systems.
The USB stick contained malware, because of course it did - and the resulting infection
spread to 300 thousand computers, culminating in what was described at the time as the "worst
breach of U.S. military computers in history”.
That operation was blamed on Russia.
I’ll make sure to come back to you guys with an update when we get more news on the
mysterious smart watches, so subscribe so you don’t miss it.
Next up, European police have finally revealed the sheer extent of their operation against
the users of Encrochat.
Encrochat was a company that sold privacy focused mobile phones.
Essentially they were modified Android devices that came preinstalled with a suite of proprietary
encrypted messaging apps, but the hardware was modified too, the website explains that
these phones come with their “camera, microphone, GPS, and USB data port” completely removed.
But the whole project - if we can call it a project, was closed source - so this was
never going to appeal to privacy enthusiasts.
Instead Encrochat’s clientele was pretty much made up of organised criminal gangs,
I mean - only criminals could afford these things.
Each device cost around 1100 USD, and a 6 month subscription to use the phone would
set you back around $1600.
Europol have just released a breakdown of Encrochat’s users, there’s drug traffickers,
money launderers, murderers.
Quite a diverse crowd.
Though one category you won’t find on here is cyber criminals, for the simple reason
that anyone with a shred of knowledge of secure communications would have avoided Encrochat
like the plague.
Why?
Well, communication services that are primarily used by criminals have a habit of being raided
by law enforcement.
On top of that, it’s actually quite difficult to design reliably secure messaging services,
so when they are inevitably shutdown, police often manage to somehow get a hold of all
those supposedly encrypted messages.
And Encrochat was no exception, because in 2019 European police hacked the platform,
gaining access to all its users communications, and the resulting law enforcement operation
was staggering.
We now know that following the hack of Encrochat, worldwide there were over 6000 arrests, almost
a billion euros in funds were seized, along with 83 boats, 40 planes and so on.
It’ll will never cease to amaze me just how uneducated some of these criminal gangs
can be.
Instead of paying thousands for a messaging service that was doomed from the very beginning,
had they instead downloaded Signal for free, instead of sitting in a cell, they might still
be in business.
But regardless, make sure to subscribe and hit that bell icon to hear when the next supposedly
“secure” messaging app bites the dust.
We seem to get an operation like this once a year or so.
A few months ago there was ‘ExcluChat’, before that there was ‘SKY ECC’, and let’s
not forget Anom which quite literally turned out to be an FBI honeypot.
If you found this video interesting, let me know by hitting that like button, and I’ll
see you in the next video, have a good one.