Hello, World!
This music video from 1989 can crash your computer - well, probably not your computer,
but definitely some computers.
And although it might sound ridiculous, this vulnerability has even been assigned a CVE.
The problem had been forgotten for 20 years, until now when a Microsoft developer finally
broke the silence.
It all began way back in the Windows XP era when a laptop manufacturer approached Microsoft
with a problem, whenever they played a certain music video on their laptop, specifically
"Rhythm Nation - by Janet Jackson", the laptop, crashed.
I can't play the song here, as I just wasn't able to get the rights in time - but think
80s, R&B, Michael Jackson vibes.
But anyway, the manufacturer wasn't content with putting the problem down to the laptop's
personal taste in music, and so an investigation was launched - an investigation which found
that "playing the music video also crashed some of their competitors’ laptops.", and
even "Playing the music video on one laptop, caused a laptop sitting nearby to crash".
Eventually the source of the problem was found, it turns out that this particular song contains
one of the "resonant frequencies" for the model of 5400 rpm hard drive used in the laptop.
When exposed to this particular frequency, the vibrations within the hard drive were
so great that it just couldn't function and crashed.
So, a resonant frequency is the frequency at which an object vibrates at its highest
amplitude, this is the same principle an Opera singer can use to break a glass with their
voice.
Though, in this case the hard drive didn't explode, but rather just stopped working and
shut itself down - there was no permanent damage.
I was of course eager to at try and reproduce this, so I ordered some old random 5400rpm
hard drive off Amazon - only to quickly realise that resonant frequency is determined by a
lot more than just the rpm, there's the material the hard drive is made of as well as shape
and size of parts, as the CVE explains only "a certain 5400 RPM hard drive" "shipped with
[laptops] in approximately 2005" is vulnerable to this, "denial of service" attack.
The exact model of drive, isn't mentioned - which might make this whole story sound
like some kind of "urban legend" - but this kind of "acoustic attack" (if we can call
it that) - has been demonstrated before in a lab setting, in a paper titled "Acoustic
Denial of Service Attacks on [Hard Drives]", researchers were able to crash different models
of drives by simply exposing them to various frequencies.
And, you don't even need to use a particular frequency to interfere with the operation
of a drive.
In a YouTube video from 2008 which I'll link below, an engineer shows that by just shouting
at a rack of drives - the vibration caused to the disks resulted in the average latency
of the drives increasing, and the latency of two of the drives even momentarily spikes
above 500 milliseconds.
Luckily of course, since hard drives are declining in use these days, this whole problem is a
bit of a non issue.
But, if you're wondering what that laptop manufacturer did to fix the problem way back
in the day?
Well - they apparently added a filter in their hardware to detect and simply remove the offending
frequencies during audio playback, bit of an ad hoc solution.
As you can imagine, this news story has received a lot of mockery in comment sections - with
people pointing out the song in question was pretty popular during the XP era, so surely
it wouldn't have taken over 20 years for this to come to light.
Also, the CVE is very non specific, it doesn't even mention which hard drive model is vulnerable.
However the Microsoft engineer reporting this - one "Raymond Chen" is quite well established,
and an out of season April fool's joke doesn't really seem like his style.
And given we've seen "acoustic attacks" are possible, this whole story does seem plausible
- but let me know in the comments, are you calling BS?
Next up, cyber criminals are improving their operations, in a strange way - by taking technological
steps backwards, they are in fact evolving, their operations, and thus making more money.
I realise this doesn't make much sense, so let's take the example of a recent PayPal
phishing scam.
People have been receiving phishing emails purporting to be from PayPal themselves, claiming
that your "PayPal account has been accessed unlawfully", "$600 has been debited", and
that you should "immediately", call this customer support number.
The email itself, does actually come from PayPal, it turns out that cyber criminals
are using stolen PayPal accounts to utilise the legitimate PayPal invoicing function in
order to send these phishing emails - pasting their 'pitch' in the "message to customer"
section.
Whilst this abuse of Paypal's systems is admittedly quite clever, the bit that's become quite
common recently is where they ask you to call a certain phone number.
With cyber criminals waiting on the other end of the phone line, hoping to convince
you that the only way to fix the problem is by giving them remote access to your computer.
And, you can probably see where this is going...
if you're gullible enough to do that, the miscreants will then use the opportunity to
install malware on your PC, giving them access to further explore your systems, which will
more than likely result in ransomware being deployed.
The tactic of having the victim initiate a phone call has become known as "BazarCall",
and it's being described has having "Revolutionized Data Breaches".
It reeks of the typical "Indian tech support scam", which seems rather low tech - and it
begs the question - if ransomware gangs have the ability to send phishing emails on a mass
scale, automating initial access with downloadable microsoft office macros, malicious lnk files,
and so on... why would they want to take on the extra work of operating a call center?
Surely this is a step backwards?
Well, the reality is, that the traditional way of gaining initial access, is getting
old - companies are getting better at combating phishing emails laced with malware, with a
Conti ransomware gang member recently saying that "We can’t win the technology war because
on this ground we compete with billion-dollar companies, but we can win the human factor".
And, they're achieving that through social engineering - by having the victim themselves
make the phone call, the target believes they're the ones reaching out for help, so they're
much more likely to give who they think is customer support, the benefit of the doubt
when it comes to that remote access.
In another example, a phishing email claims that you've been charged a bunch of money
for a Duolingo subscription, and that if you have concerns you should contact customer
support, who will then, rather predictably, encourage you to download remote access software,
something like zoho assist - a legitimate tool, which won't be blocked by antivirus
scanners.
Exactly how the cyber miscreants then download malware onto your PC, varies, because the
attackers can adjust their plan on the fly, adapting to the OS and privilege level of
the victim computer.
Because 'BazarCall' makes good use of social engineering, it results in a very high conversion
rate, meaning cyber crooks can be selective about who they target.
Where as in the past they would've sprayed their usual malware laden phishing emails
at anyone and everyone - they can now target the specific industries they want to hack,
for example if you look at a breakdown of ransomware victims before this new 'BazarCall'
method arrived on the scene, the sector of victim companies is very random.
But now that cyber criminals can target specific industries, tailoring those phishing emails
to impersonate certain companies, like mortgage companies, or even cyber security companies,
the breakdown of victims looks very different.
Ransomware gangs love tech and manufacturing companies because they tend to have valuable
intellectual property, and also finance and legal companies, because they hold a lot of
sensitive information that can be held to ransom.
To be honest I was quite surprised when I heard cyber criminals had taken this technological
step backwards, but after understanding it a bit more, it is kinda genius - do you agree?
Let me know your thoughts in the comments.
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always, thanks for watching, make sure to tickle that like button if you found this
video interesting, and I'll see you in the next video, have a good one.