First up in today’s roundup of cybersecurity tech news: People are finding that their Google
Drive accounts have been flagged, and almost banned, for storing files which simply contain
the number 1.
But why..
How?
So Google drive has somehow been interpreting these files to be be copyright infringement.
As in, the AI tasked with clearing Google’s servers of pirated films and software has
suddenly developed an acute case of arithmophobia.
Of course, the person who discovered this did the done thing and complained about it
on twitter, demanding that their 1 be released immediately.
But it transpired that this isn’t an isolated issue - a bunch of people are experiencing
the same exact problem…
At first it was thought this must be some kind of a hash collision - as in if Google
is comparing a file's hash with a database of hashed copyrighted content, then maybe
the hash of the number 1 corresponds to the hash of some Disney film.
This is of course very unlikely mathematically speaking, but it's not impossible.
However this theory was thrown out when it came to light that google’s AI has not only
been bullying 1, but also 500, 174, 833 and even 285.
To make matters worse, the copyright notice Google has been displaying says that “A
review cannot be requested for this restriction”.
So by harbouring one of these apparently illegal numbers you’re deemed guilty and not even
allowed to request a review?
You can’t even appeal?
In terms of how this was all discovered, based on the path of the original offending file,
it looks like the file containing a solitary 1 was the output of some programming homework.
Luckily, Google doesn’t ban an account after one copyright violation, but if you’re curious
enough to write a script to generate a bunch of files with random numbers, then don’t
be surprised if you rack up enough violations to get your account deleted.
Thankfully though this technical embarrassment for Google hasn't gone unnoticed, it gained
a bunch of traction on Twitter and they’re now apparently “working on it”.
Cybercriminals are scared, they're going through an existential crisis over the recent arrests
of rEvil ransomware gang members - they're worried that they'll be next.
The thing is, over the past few years Russia has kinda been ignoring cybercrime, turning
a blind eye to cyber miscreants operating within their borders - if, and only if - this
is a big if, they didn't target Russian citizens or companies, the rest of the world being
fair game.
Many cybercriminals have gone so far as to code a language check into their malware - the
malware - whether that be ransomware, a banking trojan or whatever - the malware would check
what language packs were installed on a victim PC before running.
If it was detected that Russian - or a language of an ex soviet country was installed then
the malware would simply nope out and delete itself, sparing the victim.
The reason ex soviet countries got a pass as well is is because these countries share
a close working relationship with Russia, so they're considered high risk to target
from within Russia.
This is how seriously Russian criminals were taking these unwritten rules - they were willing
to lose money on potential victims if it meant they could stay in the clear with authorities.
I've even suggested in previous videos, you might as well install the Russian language
pack within windows in case you catch a strain of malware for which Russian is an antidote
- you don't have to use it, just having it installed is enough.
However since the arrests of members of rEvil, the world's most infamous ransomware gang
- the unwritten rule that as long as you "don’t attack Russia or its allies, life will be
sweet." is... unravelling.
Cyber security company 'digital shadows' has gone undercover on cybercrime forums and reported
on this existential crisis looming over the cybercriminal community.
They found that "questions such as: “What will happen to my stuff if I get arrested
for money laundering?”
or “How many years will I get for ransomware?”
are becoming increasingly common" .
One thing these guys are particularly worried about is how they'd be treated in prison.
Because of course in prison criminals are often treated depending on their crime - a
bank robber is going to be treated quite a bit differently than a kiddy fiddler - both
by staff and other inmates.
But where does cybercriminal fall on this totem pole of depravity?
Forum members have a few different theories, one being that they'd be fine, able to “serve
and enjoy” - that they'd even be respected for targeting westerners.
But the theories do get a little more interesting, with others thinking that they'd most certainly
not be fine.
"One forum member claimed that the [Russian prison mafia] would force cybercriminals to
work for them, even after their sentence had finished" - whilst this does sound literally
like a Mr Robot plot point, it is realistic - being a cybercriminal comes with a pretty
unique and rare skillset.
Some of these guys are even worried about spending time in American prisons - but in
reality Russia's constitution prevents the extradition of Russian citizens, so, as long
as these miscreants don't leave the country, they'd theoretically at least be fine.
It felt kinda strange reading through this report, usually we only ever hear from cybercriminals
and ransomware gang members in particular through posts on their dark web blogs, which
always read with an air of arrogance and smugness.
Seeing them in this kind of context, being able to just feel the fear radiating from
them, it is a refreshing change, but in a weird way makes them come across as more human.
The record for the world's largest DDoS attack has been broken... again!
So, this is a record which seems to be smashed every few months or so, when a more powerful
botnet or better DDoS attack method inevitably comes along.
The 3.47 terabit per second attack used 10,000 sources located in 10 countries, but it only
lasted 2 minutes - going to refrain from sexual innuendo on that one.
The target of this monster 3.47 terabit DDoS attack is... unknown.
All we know is that it was an Azure customer based in Asia, and that Microsoft did manage
to successfully mitigate the attack.
Now, other than the shear scale there wasn't anything particularly noteworthy about this
DDoS.
The attack vector was "UDP reflection on port 80" - as in the attackers exploited misconfigured
servers on the internet to amplify the scale of their attack.
One of the reflection methods they used was a DNS amplification attack - this is when
an attacker uses bots to send DNS queries to a DNS server, but spoofs the source ip
address to be the address of the victim.
So the DNS server sends the DNS response to the victim's IP.
instead of the real sender
Given the DNS server's response is much larger than the query, the victim receives way more
traffic than if you just DDOSed the victim with the bots directly.
So the attackers are using the DNS servers parasitically, exploiting it to DDoS the victim
for them.
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered.
If it runs on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware.
Linode’s philosophy is to focus on providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
Thanks for watching, you know what to do, tickle that notification bell and follow me
on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.