Hello world,
Anonymous have hacked the Texas republican website and spammed it with pokemon memes
The “largest known [DDoS] attack in the entire history of the Internet” hits Russia’s
largest search engine.
And the popular leaked hacking tool Cobalt Strike has been ported to linux.
That’s in today’s episode of the weak web where we break down and dissect cyber
security related tech news.
A new operation carried out by Anonymous, or at least perpetrated under the banner of
anonymous has seen the Texas republican website hacked and defaced with a strange combination
of pokemon memes, pro abortion messaging, and a photo I don’t know how to describe
without resulting in this video being taken down.
The hack was executed in protest of the new Texas abortion law. Now this isn’t a politics
channel, if only because I couldn’t handle that level of drama - so if you want to learn
more about the law itself you’re going to have to do a googles. But for some context,
the law effectively bans abortion from 6 weeks after conception.
In the new offensive Anonymous have dubbed ‘operation Jane’ - Texasgop.org was embossed
with the anonymous logo, as well as a link to donate to planned parenthood. They also
changed the website banner to depict an army of what I am reliably informed are Mudkip
pokemon, there’s also a link in the header to a pokemon wiki page on mudkip. Why Mudkip?
Well, Mudkip is an old anonymous meme, suggesting that whoever carried out this attack isn’t
new to the movement. Back in 2008 during the project chanology protests against the church
of scientology, many protestors used mudkip as a mascot, adopting the shibboleth of asking
others if they like mudkip as a way of identifying other anons.
The defaced website bears a phone number, I called the number out of mere curiosity…
Scrolling down there’s a youtube video…
The header links to a twitter account purporting to represent the movement, it sports one of
anonymous’ classic press release videos...
At the bottom of the page, there’s a very nsfw image, and like I mentioned in the intro
I don’t think there’s a way of describing it in terms that won’t get me demonetised
- the curious among you can just head to the texasgop.org cached page on the wayback machine.
The vandalised version of the site was live for a few hours before being taken down.
Since control of the site was regained by the GOP, the site bears a notice detailing
the hack, which was carried out on the anniversary of 9/11. There’s no indication as to how
the hack was perpetrated, the most probable explanation is an insecure or reused password,
as opposed to some kind of zero day wizardry.
It’s important to note on the topic of anonymous related operations, and I realise this may
sound obvious and fall on tired ears - but whenever I make videos on anonymous, a common
reaction is to exclaim “anonymous is back” - and that’s not necessarily the case. Anonymous
is only a name to act under, meaning every anonymous operation you see on wikipedia could
have been carried out by different groups of people, and that probably is the case to
a large extent, whilst there will of course be some overlap.
The world’s largest DDoS attack has been detected. A botnet made up of tens of thousands
of devices has been observed attacking Yandex, Russia’s largest search engine. The botnet
“is growing rapidly”, and has been dubbed “Mēris” - which means plague in Latvian.
Yandex describes this newly discovered botnet in a new blog post, “The attacks have been
going on for several weeks, their scale is unprecedented, and their source is a new botnet,
about which little is known so far.” “Yandex [the victim here, has] collected data on 56,000
attacking devices.” “But [they] assume that the true number is much higher - probably
over 200,000 devices.”, and “their number is growing rapidly”
Yandex, apart from being Russia’s largest search engine, dips their toes in many other
industries, they’re kind of like a Russian version of Google. There doesn’t seem to
be any apparent motive for the DDoS, it can only be assumed that Yandex has been chosen
by the botnet’s operators to “[test] the capabilities of the Mēris botnet.”
The new offensive is arguably the largest attack of all time - I say arguably because
there’s various different types of DDoS attacks, and thus various ways of measuring
them. Mēris inflicted an attack of about 22 million RPS or (requests per second), the
second largest was observed by cloudflare just last month, which came in at 17 million
RPS. However these attacks have a lot in common, both consisted of HTTP requests, and a “similar
pattern in the duration and distribution of source countries.” - Yandex reckons they
were both carried out by the same bad actor.
It would be reasonable to assume that this is yet another Mirai style botnet, comprised
of infected IOT devices, a common sight in DDoS attacks over the past couple of years.
But no, Yandex notes all the attacking devices “seem to belong only to the manufacturer
Mikrotik.” - Mikrotik is a Latvian network equipment manufacturer. Yandex analysed several
of the attacking devices and found they had a lot in common, as all had certain ports
open, this is congruent with Mikrotik devices which also use these ports, helping them to
make the attribution.
Mikrotik responded to these findings, and made a depressing discovery. They said “these
attacks use the same routers that were compromised in 2018”. They’re referring to a vulnerability
which was discovered being exploited 3 years ago, despite being swiftly patched many users
still haven’t updated their firmware.
And it’s not just megacorporations being targeted with Mēris, a blog I follow for
cybersec analysis was also taken offline by the botnet. The motivation for which is a
mystery, but I can only guess that if you have access to such a powerful tool, you’re
going to want to try
it out, just to
see what happens.