First up in today's roundup of cybersecurity tech news: Anonymous is back with a fresh
new hack.
The target?
The official website for the Chinese Communist party in the city of Pingxiang, China.
As is tradition, Anonymous have plastered their logo across the page - we've also got
some pro Taiwan, and anti CCP memes, only text based memes, surprisingly bland and boring.
I mean, if you've gone to the effort of hacking a Chinese Communist party website, for the
purpose of posting memes, you could at least inject some flair, use your imagination - this
is your canvas!
Anyhow, joking aside, it's pretty obvious this hack was carried out by the same people
that recently pwned China's polar research website just a couple of weeks ago, the same
memes were used in both attacks, and the political message which we'll get to shortly is virtually
identical.
Some of you guys commented on my video covering Anonymous' hack of the Chinese polar research
website, saying that it was a bit of a low blow - as in, it may be a government owned
website, but it's apolitical so targeting it just feels kinda wrong.
Well, there will be no such comments this time around, because this website is a full
blown communist outpost, complete with enough hammer and sickles to start a revolution,
and lots of the colour red.
Though the site could use a bit of a refresh, we've even got some adobe flash lingering
on the side here - which is never a good sign in 2022.
Now it doesn't look like Anonymous pwned the site in its entirety, but rather they gained
privileges to post content to the site, probably in the form of acquiring account credentials
- now this is judging from the URL of the page they've graffitied - as it looks like
some kind of attachment as opposed to an existing page on the site.
That being said, the hack was enough to spook the Chinese communist party's sysadmin into
taking the whole site 100% completely offline.
So what was Anonymous' message in doing all of this?
Well, it's complicated - as they're pushing various messages.
Firstly they slam China for the Pengshuai saga - I won't go into detail on that here,
because it's a bit of a rabbit hole, she's a Chinese pro Tennis player who after accusing
a senior CCP official of assault, randomly disappeared for a few weeks.
And, on her return she took back her accusations.
So it really looks like she was coerced in some way.
Then Anonymous has a bunch to say about the Ukraine crisis, threatening that "If the current
tension in Ukraine continues to worsen or does not defuse, then [they'll] take hostage
of industrial control systems.".
Which would be quite a step up from hacking CCP websites.
But - I don't know - this whole page is really confused and all over the place, there's even
a section where they push an experimental antiviral drug for covid.
I'm really not sure what the goal behind this hack is, as there's no coherent message - are
these guys larping as anonymous?
Let me know your thoughts on that in the comments.
Next up, a familiar foe on this channel has just had their death certificate signed by
Microsoft.
This is even being described by some as a "historic security milestone".
We are of course talking about, malicious Microsoft office macros!
Might sound like a boring topic, but I assure you it is anything but - these things are
dangerous.
Macros are feature of microsoft office applications like excel, they allow for visual basic code
to be embedded within documents, so it's easy to automate certain tasks.
For the most part, macros are dead, barely anyone uses them anymore, but they haven't
been deprecated because they're still being used in legacy infrastructure by organisations
like banks, who have been using them since the turn of the millennium, and see no reason
to migrate away from them.
This is a problem for the rest of us, because cybercriminals figured out that they could
weaponise innocent looking excel documents by having them contain macros - with malicious
code.
Open an excel spreadsheet containing one of these macros and you're opening yourself up
to: ransomware, banking trojans, who knows?
The typical blackhat playbook has been to send phishing emails with these malicious
documents attached - using some kind of a lure, like claiming the document is an invoice.
But when you open the document, you'll receive a security warning - and this yellow bar here,
is the last layer of protection before a victim becomes pwned.
A victim would have to manually click enable content for the malicious macro to run, but
this doesn't make much of a difference, as miscreants have become quite creative in how
they encourage victims to click that button.
IMO, this is one of the most pitiful security warnings I think Microsoft could've come up
with.
I'd even argue a basic security warning like this is kinda useless nowadays, simply because
we're so accustomed to them, they almost just feel like disclaimers at this point.
It's like - you receive a work email from another company, "security warning - this
email originated from outside your organisation", open an application you downloaded from the
internet, "Warning, you downloaded this, from the internet, are you sure you want to open
it".
Warnings like this have been become so ubiquitous that many of us ignore them.
Though of course, the technically literate like you and I, we understand you don't want
to press this button.
But all it takes is Karen in accounting to not quite catch on, for the whole company
to be ransomed for millions of dollars.
That is - until today!
After 2 whole decades of shenanigans, Microsoft has finally awoken to the scourge of the malicious
macro and is implementing some meaningful changes to help stamp out this curse until
Malicious macros exist as nothing more than a crusty old wikipedia page.
Microsoft has announced that in the coming months macros will be disabled by default
in documents downloaded from the internet.
If a document carries a "Mark of the web" - which is an invisible attribute automatically
applied to things downloaded from the internet then you'll be met with a new security warning,
which looks a lot scarier - but crucially there's no "enable content" button, but rather
a link to an article which tells you someone's probably trying to hack you.
However, you can bypass the block by right clicking the file, going into properties and
checking the "unblock" attribute in the security section.
It'll be interesting to see if bad actors still utilise macros even after this change,
trying to prompt victims to manually check this box.
I'm almost kinda surprised Microsoft haven't made this section scarier, a big warning symbol
perhaps, maybe a skull and crossbones even.
But in either case, this is great news - on the other hand Microsoft's attempt to move
macros to the metaphorical recycle bin is going to take some time.
Many organisations will be slow in updating, and some, just won't so you can expect the
malicious macro to be a familiar foe on this channel for some time to come.
This video was made possible by Altium Designer, the world’s number 1 PCB design software.
35 years of innovation and development has gone into this bit of kit, and it really shows.
Nothing else I’ve used comes close to the sheer breadth and depth of features.
If you dabble in PCB design at all, you have to give this a go - the routing engine even
just in of itself is just sublime.
Grab your free trial via the link in the video description.
Thanks for watching, you know what to do, tickle that notification bell and follow me
on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.