Hello, World!
Flipper Zero Scammers want your crypto, The Ring doorbell swatters have been identified,
and the FBI was hacked.
That’s all coming up in today’s roundup of cyber security tech news.
There’s zero chance you haven’t heard about this thing, the cybersecurity pentesting
swiss army knife, otherwise known as the flipper zero.
Armed with an array of wireless hacking capabilities including NFC, RFID, bluetooth, infrared and
more, the flipper zero can do a lot.
Having gone viral on TikTok of all places, there’s a plethora of videos showing people
wreaking havoc, turning off TVs in public, reading credit cards, and there’s even custom
firmware that can hack some cars - and of course it can run Doom.
But nothing the Flipper Zero can do is new per se, I mean - devices that can spam IR
codes to turn off TVs and RF tools that can open cars have been around for years.
But having all these capabilities on one small noob friendly device that also features dolphins
is definitely new.
And this has made it rather popular, I mean to say it’s exploded in popularity over
the past 6 months is kinda putting it lightly.
According to Google trends, more people are currently searching for the flipper zero than
the rtx 4090.
This has all made getting your hands on one, a little…
difficult.
Unless you’re willing to pay scalpers doub - excuse me, triple the retail price, you
ain’t getting one.
I mean, I don’t even have one yet.
This has created a ripe opportunity for scammers.
And now there’s a new phishing campaign which uses the flipper zero as bait in an
attempt to scam you out of crypto.
It’s taking place on twitter, where an array of fraudulent Twitter accounts have spawned.
Some of these fake accounts are really quite believable.
I mean, take this one, the username looks pretty much identical to the legit Flipper
Zero account - but if you look closely, and I mean really closely you’ll notice the
‘L’ in ‘flipper’ is ever so slightly thicker than the genuine account’s ‘L’
- that’s because it’s not an ‘L’, but rather just an upper case ‘i’.
It’s the kinda thing you need to really zoom in on to see.
And apparently Elon himself is aware of this problem with Twitter’s font, but nothing
has been done about it, yet.
The modus operandi of these scammers is to reply to real ‘flipper zero’ comment threads
as if they were the genuine flipper zero account, the only discernible difference to the genuine
account being the lack of verified status - and people are unsurprisingly falling for
this, unwittingly responding to the scammers, leading them to their bios which encourage
people to visit their fake stores where you can finally get your hands on a prized flipper
zero.
Unfortunately some of the stores, and fake twitter account for that matter were scrubbed
from the interwebs before I could get my screengrabbing hands on them.
But one is still live, and just so happens to have flipper zeros in stock, the site is
even kind enough to offer free shipping.
But they only accept crypto payments, for well - obvious reasons.
In addition to the campaign on Twitter, there’s also reports of Instagram bots messaging people
who follow the genuine flipper zero account.
Of course scams like these are quite low level and not usually a problem with cyber security
stuff, because people in the community tend to be rather security conscious.
So something tells me these scams are moreso targeting the people who’d use a flipper
zero to turn off the displays at McDonalds.
Amazon’s Ring doorbells, have a rich history of controversy.
And now, cyber criminals have found a new use for them: swatting.
This did initially make headlines a couple years back, hackers who made false 911 calls,
would watch swatting events unfold via their victim’s Ring doorbell - in one swatting
spree which lasted only a week but saw a dozen people swatted, the miscreants used the hacked
doorbell to scream naughty words at the police officers, all whilst live streaming the whole
thing on social media.
There was no financial motive, it was all done for the lulz - and the perpetrators,
seemingly got away with it.
Until now.
2 people have been charged with this swatting spree, and court documents explain just how
they managed to pull it off, the details of which will surprise no one.
You see, there was no vulnerability in the doorbells themselves - instead this operation
began with Yahoo.
The duo “[acquired] without authorization the username and password information for
Yahoo! email accounts” And, there have been a few Yahoo data breaches, enough to warrant
a whole wikipedia page on them, but these breaches are old and well outdated by now.
It’s most likely the miscreants just bought a bunch of accounts on the dark web… after
which they would check if there was a Ring account using the same email and password
combination - and if there was, well, the owner of the doorbell was going to have a
very bad day.
But hang on, Ring introduced mandatory 2FA back in early 2020, so how was it possible
to breach an account with just the password alone?
Well, one of the 2FA methods is a code sent to your email, so go figure.
If you needed another reason to create unique passwords, well here you have one.
After this duo swatted a dozen people in a one week span, their campaign abruptly ended,
presumably our perps just got bored?
And speaking of, what do we know about the alleged perpetrators here?
Well, our first ‘respectable fellow’, “Christian Nelson” otherwise known as
“ChumLul” just so happens to already be locked up, on unrelated charges.
As for the other guy, it looks like he’s made a bit of a name for himself in the SIM
swapping world.
In his group he was the “holder” - as in, his job was to physically keep the SIM
cards in his possession - a risky job.
And it seems he made a few enemies along the way, apparently defrauding his associates,
one of which even put out a hit on the guy, asking in a telegram group if anyone lives
near his address and wants to “do a job”, offering up to $50k in bitcoin.
And whilst you might think this is just an empty threat to scare the guy - I mean, we
are on the internet here.
“Violence as a service” is actually a thing, it’s become a popular way to exact
revenge in SIM swapping communities.
There was even a case just a few months ago of a SIM Swapper being abducted, beaten, and
held on a 200 thousand dollar ransom.
There’s a video of the guy bleeding out with guns to his head, it’s pretty gruesome
stuff.
But why SIM swapping sees this kind of thing, well I imagine is because it’s one of the
few cyber crimes that has a physical irl component, the crime doesn’t exist purely in cyberspace.
But luckily for our miscreant won’t have to worry about being kidnapped - at least
not for a while, because there’s a good chance if found guilty, he’ll land lengthy
prison sentence.
The FBI was hacked, and whilst this did happen a little while ago over Christmas, there’s
been a few plot twists that I haven’t seen many people cover so I thought we’d take
a look at it.
So, the FBI runs a service called InfraGard, a “partnership for protection” they say.
It’s essentially a private club for US critical infrastructure companies, things like energy,
healthcare, emergency services and so on.
The FBI uses this league of organisations to communicate security threats - and members
can also use it as a kind of private forum.
You’d think this kind of thing would be invite only, but no… anyone can apply to
join it.
Well - at least you could, before it got hacked.
The application form asks for things like name, social security number, where you work,
your job title - so you’d expect this would all be for due diligence, with the FBI heavily
scrutinising every application.
But it appears not, because a bad actor got in literally through the front door, filling
out the application form using the identity of an unnamed high profile CEO.
The FBI, believed he was who he said he was, and let him right in.
Once in, the miscreant discovered that InfraGard has an API “that help[s] InfraGard members
connect and communicate with each other”.
So, in order to exfiltrate all Infragard member’s details the miscreant just wrote up a python
script and queried the API, retrieving all Infragard members data.
It really was that simple.
Which brings us to the sales thread on breachforums, the bad actor, who goes by the name “USDoD”
put trove of data containing details of 87 thousand members up for sale for $50 thousand
dollars.
But whilst forum members were pretty impressed with the breach, no one, it seems was willing
to stump up that kind of cash.
I mean - if you look at the sample data it isn’t really all that juicy, you do have
names and email addresses, but that’s about it.
More sensitive data like social security numbers just weren’t queryable via the API.
So at this point it probably dawned on the hacker that the small amount of money they
could gain from a sale, probably wasn’t worth the wrath of the FBI hunting them down
and the years in prison that would inevitably follow if they were caught.
Which brings us to our first plot twist.
The thread was updated with a notice saying “this data will no longer be posted for
sale and won't be used in the future.”
“I realized that selling it would cause more harm to everyone than it would benefit
me financially.”
“I have emailed Troy Hunt to add all emails to [(have I been pwned)]” “so that all
Infragard members can search and see if they were affected, plus I don't want to cause
any more trouble.”.
Changes of heart like this aren’t unusual, we see them all the time, the most recent
example being the miscreant behind the optus hack getting cold feet after the FBI joined
the hunt to find them, prompting the miscreant to renege on their 1 million dollar ransom
demand and delete all the stolen data.
But back to the Infragard hack, and we’re treated to yet another plot twist.
The miscreant changed his mind yet again, this time posting the data publicly, with
forum members able to unlock and download it for 8 credits, equivalent to roughly $2.
This video was made possible by Octopart - a website I've been relying on over the last
few years in my electronics business.
Octopart.com is essentially your component sourcing swiss army knife - making it simple
to keep tabs on component stock levels in real time throughout a range of distributors
- which is pretty important given the current component supply situation, you can also easily
grab datasheets and cad models for components when you need them.
The best part is it's free to use, and Octopart is integrated right into altium 365, if you
want to give altium a go you can find your free trial link in the description.
As always, thanks for watching and I’ll see you in the next video, have a good one.