Hello, World!
An Iranian government hacking group which unironically goes by the name “Charming
Kitten” is taking inspiration from the humble YouTube spam bot.
A typical YouTube spam bot comment looks something like this - you’ve probably seen one or
two of them before, there’s an initial hook, a claim of untold riches, if you’d only
message “hackerkelly65” on telegram to learn his secrets.
This comment was actually screenshotted straight from the comment section on my latest video,
and - it’s a pretty basic spam comment, I can’t imagine these things are all that
effective.
I mean, come on “Wow so glad foe what you make me became.
I can’t believe I’ll be this rich”.
It’s embarrassing.
However, a 2.0 version of YouTube spam comments looks something like this, a whole comment
chain with various bots taking part.
It all starts with a single seemingly innocent comment, someone saying “bitcoin is the
future, investing in it now will be the wisest thing to do especially with the current rise”
- I’m not sure about that “current rise”, I’m guessing this comment is slightly outdated.
But anyway, other bots, posing as newbies respond, saying they want to buy bitcoin but
they just don’t know how.
Then comes another bot, recommending someone’s trading services, followed by a whole bunch
of bots supporting this, recommendation.
Only after a dozen or so replies does a bot finally give the contact information for the
(airquotes) “trading services”.
This whole comment chain is a lot more effort for scammers than one single comment, but
it’s way more effective, because it creates a kind of social proof.
But once you’ve seen a few of these fake conversations, they are quite easy to spot,
if someone encouraging you to call a phone number in a YouTube comment section wasn’t
red flag enough, all the comments are posted within just a few minutes of each other and
the level of English and grammar is pretty similar throughout the whole thing, suggesting
that one single person typed all of this up.
And as with many things in cyber security this social engineering technique has been
given a fancy technical name “MPI” or “multi-persona impersonation” - and now,
an Iranian state backed threat group is jumping on board.
The group is called TA453, but I prefer the other name they’re known by, “charming
kitten”.
They’re thought to be controlled by Iran’s Islamic revolutionary guard corps.
These guys aren’t after your satoshis, but are rather employing this technique to target
nuclear arms academics and genome researchers.
In one example of Charming Kitten’s use of “multi-persona impersonation”, which
is explained in research by ProofPoint - they create a whole series of emails exchanged
by fake personas, all whilst CC’ing in their target (which ProofPoint have redacted).
In this case the fake persona “Aaron Stein” who is masquerading as director of a research
institute, sends an email establishing a pretext for a whole exchange of emails.
In this case a block of text about the Arab Israeli war in 1948.
A different persona - this one masquerading as the director of Pew Research responds to
the email, making the first one in the chain seem legitimate.
The idea is, the intended target sees the whole conversation and is encouraged to join
in - in which case Charming Kitten will do the done thing and serve them malware.
But on this particular occasion Charming Kitten was ghosted by the victim, who’s identity
has been kept anonymous by ProofPoint.
However the attackers had more luck in a different recently unearthed operation, in which the
target is described as a “prominent academic involved in nuclear arms control”.
After responding to one of the emails in the chain, our victim was served a document, supposedly
research on a possible clash between the US and Russia, thankfully they never opened the
document, but that didn’t stop the other personas in the chain, in which case there
were 3 of them, from harassing the victim to hurry up and download it already, which
they never did.
But ProofPoint did download it, and analysed the document.
The document contained, a familiar foe, a malicious office macro.
Which when executed, malware within the macro collected information like the computer’s
‘username’, ‘list of running processes’ and the user’s ‘public IP’ - exfiltrating
it all via the Telegram API.
The malware did nothing else, which is kind of odd because a lot of effort was put in
here, seemingly just to retrieve some very basic information.
So ProofPoint have made the assumption that given a “list of running processes” was
exfiltrated, the malware would only further exploit the victim if they were found to be
running certain software.
Next up, in a recent cyber security conference, the FBI defended their recent offensive cyber
operations against quite understandable concerns from privacy activists.
The drama started with the FBI’s unprecedented response to the Microsoft exchange exploits,
what they did had never been seen before.
To give you a quick reminder: early last year, servers running Microsoft exchange email software
had been found to have 4 severe security vulnerabilities, which unfortunately, when combined, allowed
an attacker to completely take over email servers.
This mainly effected companies and governments as they’re the only ones who bother to run
their own on premises email infrastructure.
The first threat group to exploit the bugs was Chinese state sponsored hacking group
Hafnium, they planted backdoors on thousands of email servers in the Western world, giving
them full access to any and all sensitive information on those email servers.
The vulnerabilities were of course eventually patched by Microsoft, but thanks to a mix
of laziness and incompetence many organisations didn’t patch their systems, or even remove
the backdoor Chinese hackers were using to spy on them.
So the FBI decided to, do it for them.
After getting a court order, they remotely accessed the computer systems of people that’d
been hacked by the Hafnium, and removed the backdoor on their behalf.
This was only made possible because the backdoor just wasn’t properly secured by the intruders.
The privacy implications are pretty straight forward here, I mean, who wants the FBI poking
around in their systems, even if they are supposedly doing you a favour.
The FBI defended their actions saying “our work does not touch anything on the victim’s
computer server infrastructure besides that malware”, “That malware is essentially
surgically copied for evidence and then removed”.
On top of that, this action by the FBI was pretty limited, in that they didn’t even
patch the vulnerable systems, the only thing they were authorised to do was to simply remove
the malware.
So, I don’t think anyone’s suggesting that the FBI took advantage of this specific
operation to do any array of evil things.
The question rather, is about the precedent this sets, and it actually reminded me of
a famous Reagan quote “The most terrifying words in the English language are: I’m from
the government and I’m here to help”.
Now, whilst I’m not cynical enough to doubt that those behind this particular operation
weren’t acting with the best of intentions, they do say the road to hell is paved with
good intentions - and I just can’t imagine a future where governments routinely accessing
our computers to do us favours, doesn’t somehow go disastrously wrong.
And, the FBI have already doubled down on this new reality when earlier this year they
were again granted a warrant to remotely access and remove malware on routers infected with
“Cyclops Blink” - which is allegedly tied to Russia.
All this drama, reminded me of a BBC report my 12 year old self watched on tv, back in
2009.
The report was in the BBC’s technology show called Click, and it got the BBC in a bit
of trouble.
To give you some context, at the time the idea of ‘botnets’ was entering the mainstream,
and to demonstrate the power of botnet, the BBC bought a botnet consisting of 20,000 computers
- and they used it to run a bunch of experiments which included sending a bunch of email spam
and they even did some DDosSing.
After their experiments, the BBC changed the victim’s wallpapers, letting them know they
had been hacked…
so whilst they didn’t mean any harm, the BBC did at the end of the day use hacked computers
to carry out illegal acts.
But of course, BBC privilege meant they were never charged.
Something tells me I wouldn’t be so lucky if I did similar experiments for ‘educational
purposes’ here on this channel, but don’t worry youtube mods, I have no plans.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace which makes it super easy to spin up servers
with preconfigured software.
Use Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer
makes it easy to configure the basics, like VNC passwords, whether you want a desktop
environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always thanks for watching, and I’ll see you in the next video, have a good one.