Hello world,
Apple admits under oath that Mac OS’s security is unacceptable
The Pipeline hacking group DarkSide is back, and they’ve being taken to hacker court
And the ransomware gang responsible for crippling Ireland’s health service has given them
the decryption key… for free - but there’s a catch.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
Apple’s Senior Vice President of software Engineering, one “Craig Federighi” has
admitted that “the level of malware on macs is unacceptable”. If this sounds odd, that’s
because it is. Apple isn’t one to downplay any aspect of their products. Besides, if
we’re going to talk about Apple’s security and privacy, the level of malware on Mac OS
isn’t the first thing I’d bring up. In my previous video I discussed the scary level
of compromises Apple has made on security to certain countries.
The reason for Apple scoring this own goal comes from Apple’s lawsuit against Epic
Games. Epic Games is suing Apple because they allege Apple has built an illegal monopoly
in the form of its App store. Apple forces Apps to use their payment system to buy apps
as well as in app purchases, for which Apple skims off a 30% commission. Epic wants the
ability to create their own App store on IOS, Apple isn't too thrilled with the idea.
“Craig Federighi” who you may recognise from a couple of interviews with “Marques
Brownlee” said under oath in court that the “level of malware on Macs is unacceptable”
and that to allow purchases from a third party store, would be a “pretty devastating setback
for iOS security". He’s saying all of this in an effort to make the insecurity of MacOS
look like the result of Apple not locking down the OS as much as it has done in their
IOS products.
Does Craig really mean all of this when he says it? Well, it’s not something you’d
hear at an Apple keynote, that’s for sure. This is a tactic, if they can convince the
judge that disallowing 3rd party app stores on IOS is in the interests of user’s security
then they might just clinch the W in the lawsuit - or so they hope.
Interestingly, Craig here compared Mac OS to a car, in that it requires a certain level
of responsibility to use properly, whereas an iphone is something you’d let a child
use, and thus the bar for security on an iphone is set a lot higher - and Apple argues that’s
something that shouldn’t change.
This lawsuit is a big deal because App store purchases last year raked in 72 billion dollars,
Apple’s cut of 30% leaves them with roughly 22 billion dollars. This revenue stream will
have crazy high profit margins for Apple because there aren’t too many costs associated with
downloading an app to a device. Epic estimates it to be about 80% - which is double Apple’s
overall profit margin of 40%. Apple refutes this number, saying they don’t “even calculate
App Store margins”, probably because it’s so high they have no need to! But in any case
there are ridiculous amounts of money at stake here. If Apple needs to throw the security
of Mac OS under the bus in order to hold onto control of the IOS App ecosystem, then so
be it - IOS accounts for about 90% of Apple’s user base, so the stakes in this lawsuit couldn’t
be higher.
When researching this story I came across a pretty good defense of Apple in the comment
section of an ArsTechnica article. This user who switched to MacOS and IOS Development
explains just how incredible the breadth and depth of framework APIs and developer tools
are, and how good the documentation is. “That it’s true to say”, “Apple has developed
a large part of nearly every app on their store”, that without all these resources
Apple provides, “app-makers themselves would be on the hook for a stupidly massive undertaking
to get anywhere NEAR the functionality they have”
In addition Apple did recently announce they were halving their commission of 30% for developers
earning less than a million dollars a year, bringing their cut for those guys down to
15%. I do think this whole issue really has two sides. On the one hand, sure, of course
you want developers to profit as much as possible from their hard work, though Apple has halved
the commission they charge smaller developers. Paying 15% for access to the ecosystem and
all the tools Apple provides, sounds like a pretty good deal to me.
However that being said, 30% - bit much, and Apple does have a monopoly on IOS, that’s
quite easy to see imo - having a single company which decides whether your product is able
to enter the market at all, is more so a problem for me than the commission itself. For example,
in China, Apple is forced to remove Apps that criticise the government and help in organising
protests, for those Chinese users - they’re kind of screwed as there’s no third party
app store on IOS, so if they can’t get these apps from the App store then they can’t
get them at all.
I would like to see some kind of 3rd party store - if that means Epic winning the lawsuit,
then I’m all for it. Let me know your thoughts on this in the comments.
The pipeline hacking ransomware bandits darkside, are back. Just a couple weeks ago, they claimed
their servers had been seized by some still unknown law enforcement agency and that they
had decided to close down darkside and move on, they even sent decryption keys to victims
yet to pay up and that was that. But not for long.
As it turns out, they may have never had any intention of going anywhere at all, because
just a few days ago an insurance company in the UK was hit with... a ransomware attack…
all the company computers locked up and displayed the group’s trademark message “welcome
to the darkside” - 15 million pounds has been demanded from them, or according to an
anonymous employee, Darkside will leak all data stolen including “passwords and bank
details”. Presumably when the employee says passwords they’re referring to the hashed
equivalent, though “One call insurance” wouldn’t be the first company to store passwords
in plain text.
According to a local paper, the company has been accused by staff of covering up the attack
and of deleting comments on its facebook page from concerned customers. Police are of course
investigating the incident.
Though this isn’t the only darkside related shananigan that’s come to light in the last
day or two. Darkside’s business partners are taking them to hacker court, as threatpost
has put it. This stems from Darkside’s refusal to pay its affiliates. Darkside claims along
with their servers being seized by law enforcement, their bitcoin which was stored on these servers
was also seized and transferred away from them. I questioned this in a previous video,
a criminal gang keeping their private keys on a server, doesn’t make sense - they’re
too smart for that. Their claims are fishy at best, imo just an excuse not to pay affiliates
Darkside, like many other ransomware gangs, operated an affiliate program. Affiliates
are tasked with spreading the malware and earn an 80% commission on ransoms paid by
their victims. Meanwhile darkside handles the technical side of things, such as maintaining
the malware, etc.
XSS - a forum darkside operated on, is seeing a number of cases opened against them by their
unpaid affiliates. You see, in order to exist on these forums, darkside had to pay a deposit
of 20 bitcoin, roughly three quarters of a million dollars. This is what the affiliates
are after, the claims involve affiliates providing proof to forum admins that darkside owes them
money and hasn’t paid. If they can prove this, then they’ll get bitcoin paid out
from that deposit.
It’s really all quite professional, in this hacker court, the terms plaintiff and defendant
are used - just like in the real thing. From threatpost’s screenshots, one of the plaintiffs
is requesting 150 thousand dollars in compensation, so not insignificant sums of money. It feels
rather strange reading these disputes, the fact a hacking forum takes a deposit from
a cybercrime group to settle disputes like this is almost impressive.
A couple videos back I discussed how the Irish healthcare system had been hit with a crippling
ransomware attack. Numerous hospitals had to resort to pen and paper, because they were
completely locked out of their systems. However, despite the Irish government’s refusal to
pay the 20 million dollar ransom, the Conti ransomware gang responsible for this mess
have just released the decryption software, free of charge.
Why? There’s no concrete answer, but many ransomware gangs have a quasi code of ethics,
they often pledge not to attack hospitals, schools or government agencies - so it’s
possible Conti were pressured by their peers in the cybercrime community to end this madness,
or they may have suddenly grown some level of a conscience. Another explanation is they’re
not a fan of this public attention they’re suddenly receiving, and would prefer to stay
out of the spotlight.
The Irish government is carrying out a detailed analysis on the decryption software, to make
sure it won’t somehow cause more havoc - that there’s no sneaky surprise hidden in the
code. However there is a catch to all of this, Conti is.., still demanding the 20 million
dollar ransom, is paid by Monday, or else the 700GB of patient records and payroll information
will be made public.
However I’m not convinced they will release the info, they might forgo releasing it for
the same reason they’re decrypting the data for free - but I suppose we won’t have long
to find out.
In addition, Dublin’s High Court has issued an injunction, that’s a legal ruling, preventing
sharing and publishing of this stolen data. A legal ruling, against criminals, intent
on breaking the law? That doesn't sound like it’ll be very effective. However the Irish
healthcare provider has said this was done in order to make it illegal for sites like
Google and Twitter to share the data.
We all have some server running something somewhere, whether that’s in the form of
a website or a dinky minecraft server, here’s why you might want to switch them for free
to today’s sponsor, linode. Linode is a totally customisable cloud hosting platform
that grows with you, from hosting small personal projects to enterprise scale neural networks,
if it runs on linux it’ll run on linode.
Linode launched way back in 2003, that’s 3 years before AWS was even a thing, Linode
doesn’t spend a second on side hustles like grocery chains or reading you bedtime stories,
cloud computing is what they do best, and is their only focus. Linode is offering all
of you guys $100 in free credit just for signing up, claiming your $100 is the easiest decision
you’re going to make today, use it to spin up a minecraft server, set up a pentesting
lab, instantiate your own VPN, the possibilities are endless. They have 24/7 phone support
(which is a godsend in the world of servers) so you’ll never be left out in the cold.
Go to linode.com/seytonic or click the link in the description to claim your $100.
If you want to see more of this kind of video make sure to let me know in the comments and
turn those sub notifications so you don’t miss any hacking news. For behind the scenes
footage do follow me on instagram. As always sources will be linked in the description,
stay tuned for more hacking videos, have a good one.