Hello, World!
Rockstar Games, NVIDIA, Uber, Samsung, and a hell of a lot more… were all hacked by
a group of teenagers, in a string of breaches which made even the most experienced of cyber
criminals jealous.
Whilst their hacker group - ‘Lapsus$’ has for now gone dark, now comes the questions,
how did a bunch of kids with no experience, no secretive zero day vulnerabilities, pull
off such an impressive series of hacks?
US intelligence agencies think this is such an important question, that America’s ‘Cyber
safety review board’ which up until now has only ever published one report, has just
dedicated its second ever report to dissecting and trying to understand the techniques of
Lapsus$.
Lapsus$ spawned in December of 2021, spending their first few months attacking targets in
South America.
Brazil’s Ministry of health was first - with Lapsus claiming via Telegram they’d nabbed
50TB of data.
Next came the Brazilian telecoms company Embratel, followed by an Argentinian payment processor.
It was kinda just assumed that Lapsus$ was just another cyber criminal extortion Gang,
they’d hack a company, steal some files then demand some bitcoin in exchange for deletion
of the data - these kinds of criminal groups are run like businesses, they’re interested
in money and nothing but money.
But that theory didn’t hold out for long, because Lapsus$ quickly went off the rails,
after they hacked a Brazilian car rental company, they didn’t bother extorting them at all,
but rather just redirected their website to a certain adult entertainment site.
On top of that, the group started running polls on their Telegram channel, letting their
legion of followers decide which of their victims data they should leak next.
It quickly became clear that Lapsus$ wasn’t your typical financially motivated cyber crime
gang when they landed their first big target in February 2022, NVIDIA.
The group announced on their Telegram channel that they’d grabbed 1TB of data, including
“schematics, drivers and firmware”, but instead of trying to privately negotiate a
ransom payment with NVIDIA, they instead made some very bizarre public demands, that NVIDIA
should remove “lite hashrate limitations” from their GPU’s - something NVIDIA was
implementing at the time to bottleneck their GPU’s cryptomining abilities - in a bid
to make it easier for gamers to get their hands on graphics cards.
Lapsus$ also demanded they should commit to open sourcing their drivers, something NVIDIA
was never going to agree to.
In another of Lapsus’ high profile hacks that you’ll no doubt be familiar with, one
of their members breached Rockstar games, stealing and then leaking top secret gameplay
of GTA6.
And in another of their hacks they breached the Uber’s slack server, again, stealing
and leaking confidential data.
In total Lapsus was responsible for well over a dozen hacks, some of them incredibly high
profile, and they all took place within the span of only a single year, with such speed
that the ‘Cyber Safety review board’ said in their report that in some instances the
operations almost “appeared automated”.
Given the high calibre of victims you’d think Lapsus$ would employ highly technical
attack methods, but not really.
One of the main techniques used by Lapsus was sim-swapping, but with a twist.
So, in order for an attacker to conduct a successful sim swap they first need to obtain
a bunch of information on the victim, like name, address, phone number and so on.
Typically this information might be obtained by phishing, but Lapsus abused something called
EDR’S - ‘emergency disclosure requests’.
These EDRs allow law enforcement agencies to obtain your personal data from tech companies,
without a warrant - if and only if, there’s some kind of time sensitive situation that
could result in “danger of death or serious physical injury”.
Like, if there’s a kidnapping, or a suspected terraced incident.
However if a cyber bad guy was to somehow gain access to a law enforcement email account,
and submit an EDR form from it - filled out with fake data, then you can bet the tech
company is just going to assume it’s legit and comply, sending the cyber criminal whatever
personal data it is they’re after.
Once Lapsus$ had what they needed to conduct a SIM swap - they typically didn’t call
carriers themselves, hoping to convince them to do the swap - that would’ve taken too
long, and Lapsus$ was about speed, instead they opted to hire people working at cellular
carriers who could do the dirty work for them, this is a post one of their members made on
the Verizon subreddit, “offering upwards of $20k per week to do some inside jobs”.
Another of Lapsus’ techniques discussed in the report was their use of “multi factor
authentication fatigue” attacks, as in just spamming a victim with login request notifications
until the they become annoyed enough just to hit accept.
It’s incredibly low tech, but Lapsus$ famously employed this technique to successfully hack
Uber.
You could argue in that case Lapsus just got kinda lucky, but you can’t get lucky every
time.
Whilst the details of how they carried out each breach just isn’t public, from what
we do know - Lapsus$ wasn’t very technically sophisticated, but rather they employed creativity,
mixing well known techniques to achieve a string of breaches that experienced cyber
criminals could only dream of.
As for the question of why - at this point I think it’s clear that the lulzs was their
priority.
Whilst at points it did seem like they were purely in it for the money, Lapsus$ often
wasn’t very good at extorting their victims.
For example after they hacked EA Games, Lapsus$ couldn’t figure out where to send the extortion
request, so they tried to recruit a journalist at Vice who was interviewing them, to be their
messenger and put them in touch with someone at EA games.
Obviously, the journalist refused.
Lapsus$ also wasn’t very good at opsec, because regardless of fact that the FBI was
hot on their trail for months - Lapsus unravelled all by themselves…
after the alleged leader of Lapsus$ - who goes by ‘White’, fell out with a business
partner, White was doxxed, in what was probably the most in depth dox I think I’ve ever
seen, this was brutal.
Following the dox, 7 apparent members of Lapsus including ‘White’ were arrested in the
UK - and thanks to just how young some of them were - I mean the youngest here was just
16 - the police aren’t revealing much.
However, just as I was wrapping up this video, the trial of White, who’s real name is ‘Arion
However the guy was previously deemed unfit to stand trial, apparently because of his
autism - so there’s a good chance he won’t spend a day in prison.
This is the only Lapsus member we know the identity of, the rest, currently are a mystery.
What isn’t a mystery though, is our sponsor, Akamai.
Akamai connected cloud is your swiss army knife for cloud computing, these guys can
handle everything cloud, and they’re giving you a $100 60 day credit to get started.
One of their features that I love is their app marketplace which makes it super easy
to spin up servers with preconfigured software.
Need an instance of Kali?
Just configure the basics with their installer and you’re done.
So click the link in the description now to claim you’re free $100 credit.
As always thanks for watching and I’ll see you in the next video, have a good one.