Hello world, for years the Google translate desktop app has secretly been mining Monero
on people’s computers - except, Google translate doesn’t have a desktop app - so if you have
this on your PC, it’s probably malware.
So, hackers have been taking advantage of the surprisingly large amount of search traffic
for a ‘google translate desktop’ version.
Google trends doesn’t give actual search volume numbers, but if we compare it to another
search term, we can see - similar amounts of people have been searching for ‘how much
ram do I need?’.
I think that puts into perspective the sheer scale of the search volume.
And, given there’s little competition for this traffic, if any, since a desktop version
of Google translate simply doesn’t exist, the miscreants have been able to rank pretty
highly in Google search.
And their website shows they’ve been taking advantage of searches for other things like
‘Microsoft translator desktop’ and ‘PC Auto shutdown’ - whatever that is.
And, I’ll never cease to be amazed by just how sloppy these kinds of malware spreading
websites can be, in the customer testimonials section, they’ve accidentally pasted the
same fake testimonial, twice.
Once downloaded, the exe does actually do what it says on the tin, it gives you Google
translate.
It turns out the bad actors have embedded the actual google translate web page into
their exe using the chromium framework, which is quite easy to do just by following tutorials.
Here, we get to the clever bit, because this translate app doesn’t do the crypto-mining
itself - instead it drops a separate executable, which then drops another exe, and then another
- with each new executable cleaning the trail left behind it.
On top of that, a whole load of delays programmed into this process cause it to take weeks - so
by the time the actual crypto-miner starts working, the victim might have even just deleted
the initial translator app and forgotten all about it.
By the time the crypto-miner is discovered, if at all, you have no idea where it came
from.
This has allowed this campaign, which is being called “Nitrokod” - to go undetected for
years, it’s only now been exposed in a report by ‘CheckPoint’.
And shortly after the report was released, the micreants wiped their domain, scurrying
away into the abyss.
Next up, there are reports of a massive TikTok hack.
The hackers claim to have accessed almost a terabyte of data, and information of 2 billion
users.
The group responsible tweeted, “Who would have thought that TikTok would decide to store
all their internal backend source code on one Alibaba Cloud instance using a trashy
password?”.
As is becoming tradition it seems, details of the leak were posted on breachforums, but
in the “Achievements” section rather than the leaks market, suggesting that the hackers
behind this aren’t in it for financial gain - but we’ll get to their motives shortly.
The leak hasn’t been posted in full, but the hackers published roughly 100 Megabytes
of it as proof - which I of course downloaded.
So, one of the files contains a single TikTok user’s entire list of videos, and I’m
not blurring anything out here because this is actually all public information.
The problem with verifying this kind of proof is you don’t know whether it actually came
straight from TikTok’s database, or if it’s just been scraped from public sources.
And, scraped databases of TikTok videos have been floating around for a while, there’s
nothing special about them.
In another leaked file we have what looks to be a sample of PayPal transactions from
the TikTok shop - OK so this data definitely can’t be scraped from public sources.
But, all the transactions are from a “John Doe” who lives on “1 Main Street”.
This screams test data (ie.
data used to test TikTok’s backend, and not actual real user data), and based on those
email addresses, I’d say yup that’s about right.
There’s a bunch of other files in the sample, but they either just comprise of empty tables
or yet more sample data.
So far, I have to admit, this leak seems like nothing more than just a grab for internet
points.
TikTok themselves responded to the hackers’ tweet saying “Our security team investigated
these claims and found no evidence of a security breach”.
At a guess, I would say that there has been a breach of some kind, but it’s insignificant
and has been wildly misrepresented for the sake of those juicy internet points.
The group behind this drama is called “Against The West”.
And their name does need some explaining, so, this is a pro western group, they chose
their name so that after they had hacked someone they could say, we hacked you because you’re
“Against The West” - hopefully that clears that up, though confusing choice of name imo.
I was actually in this group’s Telegram channel back when the invasion of Ukraine
had just kicked off, at the time “Against The West” was very active, but from what
I saw, these guys have a history of making big claims which rarely amount to much.
For example, on one occasion they claimed to have infiltrated the “Central Bank of
Russia”, but the only proof was this single screenshot of some random directory.
I did interview “Against the west” a few months ago, but I just never made a video
on it because I couldn’t verify a lot of what they said, and before I could arrange
a second interview, their main guy who was my contact within the group, apparently died
of brain cancer.
Which at the time I was very skeptical of, because when I spoke to the guy, literally
a couple days before his apparent demise, he was 100% cognitively fine - brain cancer
is meant to cause a whole load of cognitive impairments, especially in someone’s final
days.
So I can only presume this was some kind an excuse to disappear, or at least give the
illusion of disappearing, perhaps to pop up under a different identity.
As for this latest ‘hack’ if we can even call it that at this point, after receiving
a lot of hate for the worthless samples, they deleted their post on breachforums and were
subsequently given a 2 week ban for “Lying about data-breaches”, which was then made
permanent.
They were also banned on twitter.
And, something tells me this might be the last we’ll hear of “Against The West".
Next up, in what looks like some kind of physical DDoS attack, there has been a mysterious traffic
jam in central Moscow caused by taxis.
It seems that someone, somehow exploited the Yandex taxi app to send dozens of taxis to
one single spot in Moscow, bringing traffic to a standstill - the Yandex taxi app - it’s
like Russian Uber, if you need to get around and are too lazy to use public transport,
this is the app you use.
As per the clue in the name, this app is run by Yandex, Russia’s largest tech company.
Of course when there’s some kind of hack targeting anything Russian, people automatically
assume it must be some kind of hacktivism.
And, there are a few reasons why hacktivists would want to go after Yandex, firstly, it’s
a large tech company, and it’s Russian, two things hacktivists tend not to like.
Also, Yandex’s CEO was sanctioned by the EU after Yandex’s search engine was accused
of bias and removing content critical of the Kremlin.
However there’s no real evidence that this was done by hacktivists.
Some anonymous related twitter account have reposted the video and claimed responsibility,
but, these Twitter accounts don’t launch attacks of their own and rather just claim
they’re responsible for any act of cyber sabotage against anything and everything Russian.
No one has posted proof that they were behind the traffic jam.
As for how the traffic jam was caused in the first place, well that’s still a bit of
a mystery - someone might have created a bunch of bots to requests taxis, or maybe they used
stolen Yandex accounts, or perhaps there was some kind of vulnerability in the taxi app
itself.
Either way, the hack, if we can call it that - didn’t have a massive effect, it did bring
the area to a standstill for about an hour, and Yandex will have to compensate all those
drivers for wasting their time.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace which makes it super easy to spin up servers
with preconfigured software.
Use Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer
makes it easy to configure the basics, like VNC passwords, whether you want a desktop
environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always thanks for watching, and I’ll see you in the next video, have a good one.