Hello world,
The solarwinds hackers have launched a new offensive,
Quantum safe cryptography is well on its way,
HaveIbeenpwned is teaming up with the FBI,
And a guy lands himself in prison over an encrypted picture of a block of cheese.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
The same group responsible for what was arguably the largest and most sophisticated hack ever,
is back at it again with a new series of escapades. This APT has a few names: 'cozy bear’, ‘Nobelium’,
‘Office monkeys’, ‘StellarParticle’ and a myriad of other monikers - simply because
each security company seems to have their own internal name for them.
Anyhow, in their latest campaign they compromised the US Aid agency - which isn’t a very high
value target in of itself, though the agency was just a means to an end, in that they somehow
broke into the agency’s constant contact account. Constant contact is a mass emailing
service, used by government agencies and companies to send emails en masse to their mailing list.
The miscreants put together this phishing email and sent it to the entire list. It claims
that Donald Trump has published new documents on collection fraud, with a couple links to
download them. Usually phishing emails are sent from random looking email addresses,
but of course this one was from the real US aid agency’s account. This agency works
with many other government agencies and companies which will themselves be high value targets.
Once a victim clicked the download link, an ISO image was downloaded to their computer,
it contained 3 files, a dangerous DLL file which was hidden by default so the user couldn’t
see it. But also an innocent pdf document and a not so innocent shortcut file. The shortcut
was disguised with a folder icon, in the hopes users wouldn’t become suspicious. Of course
a shortcut like this probably wouldn’t fool you or I, but to Karen working in HR, it’d
probably be quite convincing. Upon opening the shortcut, a script was executed, which
runs that DLL.
After which the system would have been pwned, nobelium (as Microsoft likes to call them)
would have persistent access to the compromised system, giving them scope to conduct lateral
movement, data exfiltration and delivery of additional malware.
We don’t know which or how many victims there were in this case other than the US
aid agency themselves, though Microsoft assert that most of the emails will have been marked
as spam, so that’s good news, though some inevitably will have gotten through. This
new attack comes just weeks after the US imposed sanctions on Russia for the solarwinds hack,
it’s quite obvious that those sanctions haven’t deterred them, it’s business as
usual - and we can expect more from cozy bear, nobelium, whatever you want to call them in
the future.
Several new exciting developments in the realm of quantum cryptography. South Korea is planning
large scale adoption of the technology. In partnership with the US, quantum key distribution
infrastructure is being built across South Korea. Though it’ll be used in only mission
critical super important applications such as nuclear emergency broadcasts, healthcare
data, among other things.
Quantum key distribution is a method of exchanging encryption keys in such a way to be certain
via the laws of physics that no one is listening in on the communication. I’m not going to
go in depth on quantum key distribution, we’d need a whole video for that.
Instead I want to discuss why this is really important and how the demise of cryptography
as we know it could be a real concern, though first we need a bit of a primer on quantum
computing in the context of cyber security, why we might be screwed, but also not really
at the same time.
Quantum computers are still in their infancy, we have them - but the ones we have suck.
Just like regular computers back in the 1960's were massive and slow, our quantum computers
today are also massive and slow. It could be only 5 years before we have useful quantum
computers, or maybe it’ll take 20 years - we just don’t know.
The problem is when they arrive they’re going to be able break a good chunk of the
encryption we use today. This is more of a problem if they’re here in the next 5 to
10 years. Quantum computing is only really useful for cracking asymmetric encryption,
this is a problem because we use this kind of encryption a lot. Asymmetric encryption
is the kind where you have a public key and private key, anyone can use the public key
to encrypt something, but only the person with the private key can decrypt it.
Most encrypted web traffic uses this, think https for example. This kind of encryption
is also really useful for digital certificates, where you can verify the authenticity of something
because it was signed by the private key.
Theoretically all asymmetric encryption we’re currently using is crackable by quantum computers
- this is bad, but we’re not completely screwed because it’s just been announced
that researchers working on quantum safe encryption algorithms have made a lot of progress and
will be publishing new standards later this year, this means new encryption techniques
resistant to cracking by quantum computers.
That’s great, but why the rush? If we’re still 5 to 20 years away from proper quantum
computers surely we can chill out and wait a bit. Ah, well that leads on to another problem,
there’s great fear that adversaries could harvest data now and simply wait for the quantum
future when they can crack that data.
Sure this isn’t very useful for hackers that want to steal your credit card data by
man in the middling your internet traffic, as by the time quantum computers roll around
your credit card will have expired. However for governments, spying on eachother, or journalists,
it’s more feasible for them to record this data in the hopes of decrypting it in a few
short years when the data is still relevant.
This is why it’s really important we adopt those quantum safe encryption algorithms sooner
rather than later. However it should be mentioned that quantum computers don’t impact all
cryptography we use today, in particular symmetric cryptography will remain largely unaffected
by a quantum world despite it being older and much more primitive than asymmetric encryption.
Symmetric cryptography means only having one key for both encryption and decryption - however
it relies on everyone keeping that key safe, so it’s not as useful as asymmetric encryption,
apart from it being largely quantum safe, as long as you increase the length of the
keys a bit.
Have I been pwned is teaming up with the FBI. Have I been pwned as I’m sure you’re aware
is the website to go to, when you want to know if your email or password has been included
in a recent data dump. They get close to 1 billion requests every month, that’s almost
400 requests per second.
Last year the creator, “Troy Hunt'', announced he was taking the site open source, which
means anyone can spin up their own instance of the service. The code is already live on
github, as well as a 3d printable haveibeenpwned logo, bit random. But what’s more interesting
is that haveibeenpwned is going to be supported by the FBI. The FBI for obvious reasons has
way more access to pwned passwords than most other organisations. During their investigations
and server seizures, you can imagine they will have scooped up quite a few passwords
over the years.
And so in the interests of cyber security they’re providing a feed of these passwords
into the haveibeenpwned service. The passwords will come in hashed pairs so the raw passwords
aren’t known, they’ll be added to the site’s growing list of about 11 billion
passwords. Given you can already download haveibeenpwned’s database, presumably the
FBI dumps will be added to this, so we’ll have direct access to the passwords, or at
least hashes of those passwords found in FBI raids.
In true Hollywood style, a mug dealer has been convicted based on an encrypted message
he sent consisting of a picture of a block of cheese. Going by the name ‘Toffeeforce’,
our criminal here was a user of the infamous encrochat messaging service. Encrochat was
a popular communications network used by criminals worldwide. Encrochat sold phones disguised
as android devices, they looked totally normal, but when you powered them on by holding the
power and volume buttons they’d load into Encrochat OS, designed with privacy in mind
it locked down the camera, gps and microphone by default and allowed access to the encrochat
messaging service.
For one reason or another using his device, Mr Toffeeforce sent his criminal mates a picture
of cheese, M&S pure blue stilton, to be precise. However, the police raided and shut down Encrochat
last year, revealing a treasure trove of communications, they found the cheesy picture and tracked
down Toffeeforce using his fingerprints in the photo.
He was eventually convicted of dealing a whole host of drugs, which I’m not going to mention
as that word salad will definitely get me demonetised - he was sent down for 13 years
and 6 months