Hello, World!
Hackers have taken over a live TV broadcast
in Iran, A teenager has been arrested in connection
with the massive Optus hack, and an Uber executive has been found guilty of covering up a data
breach.
That’s all coming up in today’s roundup of cyber security tech news.
A couple of days ago, Iran’s supreme leader was in the middle of giving a speech live
on state TV, when hackers took over the broadcast.
The hijack featured a masked hackerman, followed by Iran’s supreme leader on fire, the hackers
called on people to rise up against the government.
Why?
Well, the context here is quite clear, pictures of people killed in recent protests were displayed
at the bottom, and you can’t have missed this in the news, over the past few weeks
protests have erupted across Iran over women’s rights and political freedom.
The hack took place at 6pm local time, primetime viewing.
But it only lasted about 10 seconds before returning to a flustered presenter.
But who’s behind this hack, I hear you ask?
Well, that’s not too difficult to figure out, because the group responsible conveniently
overlayed their social media accounts.
The group is called Adalat Ali, and this isn’t the first time they’ve hacked Iranian state
TV.
Back in February they took over the channel, pushing a similar message - but just like
this latest hack we don’t know a thing about how it was carried out, whether it was done
remotely or if they had someone on the inside.
Either way the broadcaster clearly hasn’t learnt their lesson.
Often hacktivist groups are criticised for only doing attention grabbing hacks, like
defacements, which don’t serve to do much other than get them attention.
But this group has been behind more impactful operations.
Last year they hacked the CCTV system of an Iranian prison, exposing the abuse of political
prisoners.
They also released a video of the very moment they took over the security observation room
in the prison, one by one the displays started flickering before displaying the hackers’
message.
So, Iran does have a bit of a history with Mr Robot style hacks, last year a cyber attack
targeted the smart card system that Iranians use to buy fuel - knocking out the system
for an entire day, causing chaos, and massive queues at fuel stations.
It’s unknown who was behind that attack, but Iran officially blamed an unnamed foreign
country.
Also last year, parts of Iran’s railway system came under attack.
Computers in offices were locked up, and departure screens started displaying messages of fake
train cancellations.
This hack was attributed to a group called Indra, but not much is known about them, or
many of the other groups behind these hacks targeting Iran, other than they can’t be
very fond of the Iranian regime, but they likely have their different reasons.
A teenager has been arrested in connection with the Optus hack and he's facing
over a decade in prison.
So, a couple weeks ago, Australia’s second largest telecoms company, Optus, was hacked, 11.2
million people had their data stolen - and given Australia’s population is only about
25 million, almost half of Australians were affected by this.
Now, this wasn’t your average data breach where some names and email addresses were
leaked, oh no, it was far, far worse.
Sure, the breach included the standard stuff like names, email addresses and phone numbers,
but there were also dates of birth, physical home addresses, driving license numbers and
passport numbers.
This leak really is the stuff of nightmares, because the data could be used to commit severe
identity theft, like taking out credit cards and loans in someone else’s name.
The hacker claims to have downloaded the data via an unauthenticated API, that allowed anyone
on the internet to access Optus user data - so it was a really easy entry for the
miscreants,
who demanded a million dollars from Optus - in exchange, they wouldn’t sell their
copy of the data to other hackers and would instead delete it.
And to prove they meant business, the hackers leaked the data of a couple hundred people.
But Optus didn’t pay… so a few days later the miscreants leaked the information of 10,000
more people, and pledged to release more if they didn’t get their money.
In response, the Australian police, with the help of the FBI, launched “operation Hurricane”
in a bid to hunt down the hackers.
After this news, the miscreants behind the hack began to have, second thoughts, and ended
up making a surprise U-turn, reneging on their million dollar demand and publishing an apology.
They claimed to have “personally deleted the data from their drive”, and that they
only had “one copy”.
They offered their “Deepest apology to Optus” and added “Optus if you’re reading, we
would have reported the exploit if you had a method of contact.
No security email, no bug bounties, no way to message”.
Obviously these crocodile tears aren’t fooling anyone, in fact, the miscreants had already
made clear they were abandoning ship because this story received “Too many eyes”, not
because of some change of heart.
But by this point, the damage had already been done, the hackers had already released
the personal information of 10,200 Australians in their sample data.
They apologised to them, but it’s way too late for that.
A bunch of scams, have already been launched targeting the people unlucky enough to be
included in the leaks.
One of which was in the form of a text message.
The message impersonated the hackers, and basically said if you don’t send us $2000
dollars within the next 2 days, we’re going to sell your data to other hackers.
Obviously this is a bluff, because the data is already public.
And strangely this scammer didn’t demand payment in some cryptocurrency, but instead,
via a regular bank transfer - a strange request from a cybercriminal in 2022.
Police quickly found out who was behind these text messages.
Not because of some small opsec failure on behalf of the scammer.
But because these redacted bank details were for an account registered in his real name.
It turns out that this scam was being run by a 19 year old.
And it doesn’t look like he put more than 5 minutes into planning his scam, because
after police raided his home, they found a mobile phone, which sent the messages, it
sounds like there’s a good chance this guy was actually just sending the texts manually.
And unfortunately for him, he’s now facing two charges, the first could land him in prison
for 10 years, and the other for 7 years.
But this guy had nothing to do with the initial Optus hack, the miscreants behind that, are
still at large.
A former Uber executive has just been found guilty of covering up a hack, in which data
on over 50 million users was stolen by criminals.
The hack went down back in 2016, hackers accessed an Uber employee’s Github account, where
they found some aws login credentials - which they then used to access a backup containing
data belonging to 50 million Uber customers, and 7 million drivers - containing things
like names, email addresses and phone numbers.
And as you would expect, the hackers demanded a bunch of money from Uber, in return for
their silence and deletion of the data, $100,000 to be precise.
At the time, Uber’s ‘Chief Security Officer’, one ‘Joe Sullivan’ had only just finished
testifying to the US Federal Trade Commission about a completely different cyber attack
on Uber that happened in 2014.
I can’t imagine he wanted to go through that process again, and to save Uber some
reputational damage he agreed to the hackers demands - in a move that would spectacularly
backfire.
So, the $100k payment was disguised as a bug bounty, as in, Uber directed the blackhats
to sign up to their bug bounty program, after which Uber sent them the cash.
Now, abusing a bug bounty program to buy the silence of blackhats is pretty bad practice,
to put it lightly.
But what makes this whole cover up so illegal is that Californian law requires companies
to disclose data breaches to their customers.
To make matters worse, the ‘Chief security officer’, Joe Sullivan, who signed off on
all of this, was previously a prosecutor for the US Department of Justice, so if there’s
anyone who should know better, it’s this guy.
Funnily enough, after the $100k was paid, Uber discovered the real identity of one of
the hackers…
did Uber use the opportunity to report the guy, and come clean about the hack?
Of course not, they instead had him sign an NDA, promising never to spill the secret.
But, secret the cover up did not stay for very long.
The plot was eventually rumbled, which resulted in Sullivan losing his job and being charged
with ‘obstruction of justice’, and… well, he’s just been found guilty of the
cover up and is now facing potentially 8 years in prison, though he hasn’t yet been sentenced.
So, this is the first time a senior executive has faced criminal charges over a data breach,
so I guess it does set a bit of a precedent for future incidents.
However as always there is some controversy, in that it’s thought that Uber’s CEO knew
about the cover up, but for whatever reason he wasn’t even charged - you could argue
and it is being argued, that way more people are to blame than just the ‘Chief security
officer’.
In fact Uber has a bit of a history with questionable
practices and data breaches.
Their first data breach was in 2014, then later in the same year it emerged that an
Uber executive was using a tool called “God View” to track the locations of journalists
and celebrities - which they were then fined $20k for.
Then there’s the cover up of the 2016 hack, which by the way cost Uber almost $150million
dollars in fines.
And finally there’s the uber embarrassing hack I covered in a recent video, where an
18 year old managed to gain almost complete access to Uber’s systems, just
to troll them.
As always thanks for watching and I’ll see you in the next video, have a good one.