Hello world,
Top secret US nuke locations have been leaked due to an embarrassing error,
Amazon is turning on a spooky new feature, and you only have a few days to opt out,
And UK Police raid an illegal bitcoin mine, by mistake,
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
The first story is going to sound like an April fools joke, but I can assure you, it
is not April, nor are either of us fools. The security of America’s nuclear arsenal
is rather important and I imagine is generally taken pretty seriously, however this has all
been thrown into doubt, and - it’s almost funny.
In particular this concerns the nukes the US keeps in Europe; America keeps a few nukes
in various European countries, it’s always been controversial because many Europeans
don’t like nukes.
Anyway, you see - storing nukes is a complicated business, soldiers are expected to memorise
a lot of acronyms, procedures, laws, etcetera - A handful of these soldiers on US bases
in Europe took it upon themselves to aid in their learning by using websites like quizlet.
Quizlet is a site for making flashcards, idea being you type up the things you need to learn,
and then test yourself later, like a mini self-quiz.
The problem here, is that quizlet and similar sites used by soldiers, set all flashcards
to public by default - meaning anyone can find them on the internet. Researchers at
bellingcat uncovered many such flashcards, have been out in the wild, publicly searchable,
since 2013. The information these flashcards were found to comprise, is as follows. “Exact
locations of vaults which contain nukes”, “positions of security cameras and their
thermal imaging capabilities”, “Details on the frequency of patrols around vaults”,
and “secret duress words”, among other things.
It wasn’t even hard for researchers to find these flashcards, as bellingcat explains all
they had to do was search for “terms publicly known to be associated with nuclear wapons”.
By simply searching military related jargon they found these flashcards on platforms such
as “Chegg, Quizlet, and Cram”.
The researchers did some pretty impressive investigatory research to verify the authenticity
of these flashcards. They cross referenced one of the flashcards which detailed the location
of US nukes stored in the Netherlands, with a group photo they found on a soldier’s
facebook account.
The group photo contained certain flags, which confirmed this US base was in the Netherlands.
Certain markings on the ground, and landmarks, matched up with satellite imagery confirming
the exact location the photo was taken. The image shows soldiers posing with a B61 thermogravity
bomb - it’s very unlikely this is a live bomb, that would be an even more epic security
blunder. So given this is only a training bomb, the vault behind it would be a cold
site, in that it doesn’t contain nukes.
The flashcard confirms this particular vault is cold and doesn’t house live weapons.
The researchers have blacked out the other vaults, some of which are “hot”. In addition,
just a few days after reaching out to the US Department of Defence for comment, these
flashcards mysteriously disappeared from the interwebs. So it’s safe to say these flashcards
were legit.
This is one of the worst examples of opsec I’ve ever come across, you can only imagine
how useful this would have been to bad actors as long as they had the motivation to do something
with the info of course. It’s also pretty embarrassing, and could create problems for
local politicians, who could previously just deny knowledge of nuke locations to avoid
being dragged into some kind of debate about it.
This video is sponsored by you, maybe. A few people have reached out telling me how much
they enjoy this new weak web series, and asking if I have a patreon or something similar.
So I’ve set up youtube memberships on the channel, which is a direct way to help support
the content I make. If you would like to throw a few bones my way I’d of course be greatly
appreciative, you even get a cool seytonic logo next to your name in the comments as
well as priority comment reply from myself, you literally can’t buy it elsewhere.
If you’re not in the position to, a cheeky like and notification toggle goes a long way,
as does sharing this video with a friend, co-worker, your nan, or dog, and any other
lifeforms you’re acquainted with.
Amazon is turning on a scary new feature on June 8th. Amazon sidewalk as it’s being
called links all amazon echos and ring doorbells into a kind of network. Amazon announced this
controversial feature way back in 2019, so they will have been working on it for some
time.
This network allows your amazon devices to share your internet connection with randos,
idea being, if for whatever reason your ring doorbell or echo loses connection to your
router, it can simply connect to your neighbour’s amazon device and use their internet connection
as a backup. Amazon says, for each device they’ll only use at most 80 Kilobytes per
second and 500 Megabytes of data per month. Other third parties are able to use the service,
for example: Tile, if your lost tile enters the range of an echo, you’ll be pinged with
the location of the device. This service is similar to Apple’s findmy network, which
as I recently discussed has its own issues.
If this whole concept sounds a bit spooky, it gets worse. Amazon is making this an opt
out feature. Meaning it’ll be turned on by default for all compatible devices on June
8th - though this isn’t too surprising though - for this network to gain the critical mass
it needs in order to be useful Amazon need it to be on by default, though thankfully
opting out is as simple as flicking a setting in the alexa app - however of course the less
technically apt among us won’t have any idea what they’re being automatically signed
up to, and it won’t come as much of a shock that people are a little worried about sidewalk,
security and privacy issues come to mind.
To Amazon’s credit they have at least realised this is going to cause them problems and have
released a white paper specifically addressing these concerns. Amazon claims they’re minimising
metadata they receive, making sure not to procure any data other than what’s necessary
to implement the service. They go on to explain that sidewalk will use 3 layers of encryption,
one for each time data passes from one layer of the network to another.
And in fairness, I’ve read quite a few different perspectives of what this new service means
for privacy and security, no one seems able to point to one specific glaring hole in Amazon’s
plan here, but then again whilst being detailed, this is at the end of the day just a 13 page
whitepaper. The actual technology is closed source so there’s no possibility of outside
scrutiny.
The issue is, wireless technologies are often insecure. In a previous video I discussed
new bluetooth vulnerabilities, in another one from a couple weeks back I talked about
vulnerabilities in WiFi that went undetected for more than 20 years. As arstechnica puts
it: “If industry-standard wireless technologies have such a poor track record, why are we
to believe a proprietary wireless scheme will have one that’s any better?”
This is the real concern, after all we’re not talking about just another potentially
insecure IOT lightbulb here. Ohno hackers gon’ turn off my lights, shock horror. I’m
kidding, slightly - I know even IOT lightbulbs are an entry point to the rest of your network,
there are a litany of DDoSing IOT botnets out there, etcetera,etcetera. But in reality,
a lightbulb isn’t a home security product like a ring doorbell is, nor is it a device
which listens to your every word like an amazon echo is. The repercussions of sidewalk devices
going rogue are much worse, and the chances of that only increase when allowing random
devices to connect is a feature not a bug.
Though of course it’s obviously in Amazon’s best interest to keep this as secure as possible,
and I’m sure they’ve put a lot of effort into security - all I’m saying is at minimum
you probably don’t want to be an early adopter. This is rolling out in America first, no word
on when it’ll come to the rest of the world. Luckily opting out is quite easy.
Let me know in the comments what you think of sidewalk, especially if you’re cool with
it - why?
UK Police had a bit of a surprise when they raided what was assumed to be a lucifer’s
lettuce grow operation. Using a police drone equipped with thermal imaging cameras, a large
amount of heat was detected emanating from a roof of a warehouse situated just outside
of Birmingham. This is usually a typical sign of a herb farm because lighting used for growing
gives off a ton of heat. There were also a lot of people randomly going in and out of
the building, another sign something wasn’t right.
Though upon raiding the building, there was no broccoli in sight. Instead police found
about 100 of what appear to be antminers, which are asic bitcoin miners - this explains
the heat as they don’t run cool. Also, it appears that the electricity meter had been
bypassed, meaning the miners were running on free fuel.
When it comes to crypto mining, the main cost other than the equipment itself is the electricity
used, which is why many pro miners set up near power sources like hydroelectric dams
with the promise of cheaper electricity. I’m no mining expert, though these look like antminer
s9’s - it also says so on the label, if we take it at face value and assume these
are 2016 models, they’re mining at 11.5 Terahashes per second. Each one makes about
a grand per year, excluding electricity - so if you’ve got 100 of them, then you’re
raking in 100k per year. Obviously this doesn’t take into account the volatility of bitcoin,
which can work either for or against you.
If you’re looking for something to watch next, my video on the recently discovered
WiFi vulnerabilities which went undetected for over 20 years goes some way to shedding
light on the issue of wireless technologies.
If you haven’t liked the video yet, make sure to smash that button, for behind the
scenes footage do follow me on instagram. As always sources will be linked in the description,
stay tuned for more hacking videos, have a good one.