Yet Another QNAP Ransomware Attack, Google Drops FLoC For Topics, and the
biggest DDoS in the History of DDoSes! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for February 1 2022 - this is your
summary of the threats to our security, privacy and Internet freedom. THANK YOU to BSD and Lou
on Patreon.com/threatwire. Patrons get early access to the show,
free merch throughout the year, and a ton more.
You probably noticed I turned off commercials before you watch this show on youtube, so Patreon
is the sole reason this show is funded every week. We have some great stories this week, including
one that’ll really affect your security if you use Chrome this week, so, onto the first story.
Last week a new series of attacks started to hit QNAP NAS devices that are connected and
accessible to the web, encrypting user files, appending .deadbolt to the file extension,
and demanding a ransom of 0.03 bitcoin per user hit, equaling about $1100 USD.
The attackers explained this wasn’t personal but they are targeting QNAP systems because of
the quote “inadequate security provided by your vendor”. If paid, the decryption key is sent to
the user. Multiple users have reported that the decryption key sent to them does indeed work.
So far, this has affected about about 4000 internet connected NAS devices that we know of.
This is being caused by the DeadBolt ransomware group and they claim they’re
exploiting a zero day vulnerability within the NAS software. QNAP originally told users
they could bypass the ransom screen and access their admin page with a unique link.
The attackers left a message for QNAP as well, demanding 5 bitcoins which total $184,000 USD
for details on the zero day, and demanding 50 bitcoins, totalling $1.85 million USD,
for a master decryption key and the zero day information.
QNAP started investigating this issue early last week and decided to force
update NAS devices starting on the 26th, to firmware version 5.0.0.1891. They thought
this would protect customers as that firmware update, which was originally released in December,
did fix a remote code execution vulnerability they knew about. But, reports have surfaced
from users stating they’re still getting hit with the ransomware and encryption lock
even after this firmware update, so it’s likely the attackers are using another vulnerability.
To make this matter worse, when applying the firmware update, if already infected, it
deletes the ransomware executable and the ransom screen so if a user wanted to decrypt their files
after paying the ransom, they wouldn’t have access to the decryption tool supplied by the attackers.
Because of this, a free decryption tool has been created and shared via
Emsisoft, but you’d still need to pay the attacks in order to be granted the key.
QNAP has been targeted by several attacks recently, including Qlocker, Agelocker,
and eChoraix as well in the last year. Because of this slew of attacks, it’s recommended to
update to the latest available version, disable port forwarding on your router, and disable UPnP
on the QNAP NAS. You can also turn off SSH and Telnet connections, change the system port number
and change passwords, and enable IP and account access protection within the device settings.
While the vendor should be doing more to protect their customers and given the severity of issues
with QNAP in the past year, it would be hard to recommend, this is still a personal attack
because it affects the livelihoods and personal data of regular users and businesses that use
these devices. It affects users even more so, because they are the ones paying for it. As of
recording, we don’t know if QNAP has paid the ransom or fixed this alleged zero day.
Big news from Google! The company has decided to replace FLoC with Topics. So, let’s break this
down. Google’s wanted to replace third party cookies via Interest Based Advertising (or IBA
for short), for quite some time now. Their first plan of attack was FLoC. FLoC stands for Federated
Learning of Cohorts, and was planned to replace third party cookies in the Chrome browser in 2022,
but was later delayed to a 2023 rollout. FLoC was planned to be a new technology that would
offer more anonymization for users while still yielding good conversion rates for publishers.
FLoC received a lot of criticism from privacy advocates including the EFF because it still
shares a summary of recent browsing history with marketers. Vivaldi is a Chromium based
browser and shared these sentiments, saying ad companies could originally only see aspects of
a user’s personality with third party cookies, but FLoC would share new information with those
same marketers, so a FLoC ID on a user would be accessible to ad companies. If a user was
grouped into a FLoC “cohort” that was relatively small, then it could potentially be used to track
individual users. It kinda defeats the purpose of replacing third party cookies, because that
potential would lead to the same end result. As such, Google ended development in July of 2021.
Google has been working on a replacement, though,
called Topics. Topics plans to track users anonymously with a new API that would keep
privacy intact for users by making it difficult to re-identify users,
make recorded data less personally sensitive, and be transparent and easy to understand for users.
The browsing history would only be associated for a few weeks on the user device.
Their plan is to allow IBA with relevant ads but advertisers wouldn’t know the sites visited.
Privacy Lead Ben Galbraith shared technical details on a Github post,
explaining that Topics will track behavior across a few hundred areas of interest,
but these wouldn’t include sensitive topics such as race or gender. When a user visits a site with
internet based advertising on it, the Topics API will share a small portion of the detected
areas of interest with advertisers randomly, of which one topic would be selected from the top
interests. From a user perspective, you could disable tracking for specific
areas of interest and you could review Topics that have been associated with you.
The technical information explains how Google is hoping to fix what FLoC
would’ve failed at - Topics would have more transparency and less digital fingerprinting,
especially around sensitive topics. Google is still pushing ahead on removing third party
cookies but is trying to keep existing components of digital advertising.
Google is planning to roll out a testing phase of Topic
this year. Why haven’t they just blocked advertising altogether? You guessed
it - money. Google makes 80% of their revenue from advertising. Alternatively,
Mozilla and Safari both blocked third party cookies by default in the past few years.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for the
support. Let’s finish out today’s episode with my last top story about a huge ddos attack, !
Microsoft posted a release last week detailing the rise in DDoS attacks they’ve protected customers
against throughout 2021 Q3 and Q4, going into detail on the biggest attack ever seen in history.
They also explained in this post that they’d detected a rise in attacks that lasted for more
than 30 minutes, but they also saw a drop in attacks that lasted less than 30 minutes, from
74% of attacks down to 57%. On average, they saw 1955 attacks per day on Azure customers. Compared
to Q1 and Q2 of 2021, the last two quarters saw a 43% increase in attacks, totalling over 350,000.
Back in November, Microsoft blocked a huge DDoS attack targeting an Azure customer in Asia.
This was the biggest record breaking and publicly reported DDoS attack ever, amounting 3.47 terabits
per second of data with a packet rate of 340 million packets per second. It originated from
10,000 sources from multiple countries including the US, China, South Korea, India, Iran,
Taiwan, Indonesia, Russia, and more. The entire thing happened via UDP on port 80 and 443.
The attack happened for 15 minutes,
but Microsoft mitigated it using their Azure DDoS Protection Platform.
They also noted that two more attacks occurred in December, also targeting Azure customers
in Asia. This is bigger than the previously reported attacks on Google, Yandex, and AWS.
Azure Networking Product Manager Alethea Toh explained the reason these hit asian customers
can be contributed to gaming, with gaming being the hardest hit industry, no surprise
given that industry is incredibly popular in asian countries. Financial institutions,
media, ISPs, retail and supply chain industries were also at the top of the list.
Want to see more tech videos from me? Check out my youtube channel - youtube.com/ShannonMorse
for everything from tech reviews to security tutorials. And with that,
don't forget to like and subscribe to Hak5! I'm Shannon Morse, I'll see you on the Internet!