Hello, World!
Infected versions of Tor are spying on users, a former NSA employee is facing the death
penalty, and there’s a new phishing technique you need to know about.
That’s all coming up in today’s roundup of cyber security tech news.
Malicious copies of Tor are being spread in YouTube Videos, this is according to new research
by Kaspersky, which found a channel with over 180k subscribers taking advantage of Chinese
internet users who are just trying to evade censorship, and download Tor - which is of
course banned in China, so it’s not like you can just download it from the official
website.
And whilst there are better ways for Chinese users to grab tor, like Github, which remains
unblocked in China - many people default to finding their solutions on YouTube, which
is itself banned in China - so presumably people are accessing it through VPNs.
The offending YouTube video was apparently number 1 in YouTube’s search results for
Tor in china, the video, links to a tor download.
And it is a genuine copy of the Tor browser, but with some extra, undocumented features.
This copy of Tor is configured to store browsing history, enable caching of pages, memorise
login data, and so on - but why?
So that other malware downloaded in the background can grab all of this data as well as browsing
history from other browsers and exfiltrate it to a hacker controlled server.
Not only that but it’ll also grab the id’s of the victim’s wechat and QQ accounts.
These are popular messaging apps used in China, and people’s accounts are tied to their
real identity.
So, it seems pretty clear what’s going on here, the miscreants behind this are probably
going to threaten to send copies of people’s browsing history to the Chinese police if
they don’t up pay a bunch of money.
I mean - even just using Tor in China can land you in a bunch of trouble, so threatening
to expose someone’s dark web browsing history is certainly going to spook them.
Especially when a lot of dark web browsing isn’t of things people are actively involved
in, but is rather just for curiosity’s sake, like, even if you haven’t bought anything
from dark web market, I can pretty much guarantee you’ve browsed them out, if only out of
curiosity.
The offending YouTube video has been removed from YouTube, but it was live for almost 9
months and got 50 thousand views.
To make matters worse the channel behind the video is still up, and it doesn’t look like
this is a case of a channel just being hacked to spread malware.
Because pretty much all of this channel’s other videos are quite similar to the tor
one, promoting some kind of download, using a similarly designed thumbnail, description
and they often even use the same file hoster.
I had a look at one of these other videos, which promises a download of a free VPN, and
yea.
virustotal found some problems with this one as well.
Y’know, something tells me that channels like this just wouldn’t do so well, if basic
ways of evaluating the trustworthiness of YouTube videos, like... idk the dislike button,
weren’t removed.
Next up, a former NSA employee is facing the death penalty for espionage.
Our perpetrator, one “Jareh Sebastian Dalke” is almost a quarter million dollars deep in
debt, and to clear this up, he came up with the grand plan of stealing classified documents
from his workplace at the NSA, and then, trying to sell them to the Russians.
However, thanks to his awful opsec, things didn’t quite go to plan.
After stealing the documents, the next step in his plot was to somehow contact Russia’s
secret service, to do this, your best bet is probably their official dark web site.
Yes, the Russian government is in fact using tor, which at the same time they’re actively
trying to get shut down.
Our miscreant submitted a tip through the site… and if he stopped there, and had the
patience to wait for a response, then he probably would’ve gotten away with everything, received
a big pay day and would at this point, be on a beach, sipping Pina Coladas, or something.
But no, in his desperation for quick payout he also tried contacting the Russian secret
service through what is described in the court documents as “multiple published channels”,
which probably translates to sending a bunch of emails to people he believes can set him
up with the Russian secret service.
And, this is where he screwed up, because one of these emails seems to have ended up
in the hands of the FBI - who then emailed him, pretending to be a foreign spy.
After a brief exchange, our miscreant sent the undercover FBI agent small sections of
3 secret documents to prove he was in possession of them, which among other things included
a “threat assessment of sensitive U.S. defence capabilities”, so pretty high value documents.
In fact he claimed, that the information he had access to was due to a “misconfiguration
in the NSA’s system that granted him access to information beyond what he should otherwise
have.”
However unfortunately for our miscreant, the NSA keeps pretty good logs of which secret
files are accessed by employees, and they found that only one person in the whole of
the NSA had printed off those 3 specific documents.
After that revelation, our perp wasn’t immediately arrested, the undercover operation continued
so more evidence could be gathered.
In return for the 3 documents in full, our miscreant demanded to be paid in what the
court documents describe as a “specific type of cryptocurrency”… they don’t
say which one, but we can actually infer it by cross referencing one of the payments that
the undercover FBI agent sent him, it was about 0.64 units, which was worth approximately
$100 on the 24th of August, and there’s only one cryptocurrency that fits the bill.
Now, $100 isn’t much for state secrets, but the FBI seems to have done a pretty good
job of somehow stringing this guy along with relatively small amounts of money, after that
first payment they sent him two more goodwill payments of about $5k and then $11k - which
the miscreant cashed out using a Kraken account registered in his real name.
But finally, his biggest opsec failure, was agreeing to transfer the 3 secret documents,
in person.
It gives a whole new meaning to “this meeting could have been an email”, and this question
will no doubt be going through the miscreant’s head the rest of his life, which might be
cut short.
Because, after his prompt arrest - he is now facing the death penalty for espionage.
However, I’m no legal expert, but I reckon it’s more likely this guy will just get
a really long prison sentence, a death sentence for espionage would be unprecedented in modern
times, the last time someone that happened was in the 50s, when a couple funnelled top
secret nuclear weapon schematics to the Soviet Union, earning them the chair.
Next up, it’s almost impossible to distinguish between these two ‘Microsoft’ login prompts,
but one is real and spawns when you open ‘Microsoft Teams’, and the other is a phishing website.
But, there’s no indication at all that this is a website, there’s no navigation controls,
no address bar, it looks like any old regular windows application.
This very convincing fake is made possible by Chrome’s “application mode”, it’s
a legitimate feature that webdevs use to create web apps that appear at least, to be native
applications.
But new research shows how “Application mode” can be repurposed to make some incredibly
convincing phishing pages.
Just about any website can be launched in application mode via, the command line in
windows, or terminal on mac, just pre-append the ‘app’ parameter to the website you
want to launch and it’ll pop up as if if were a native application, there’s no URL,
no bookmarks bar and no navigation buttons.
But this is where it gets dangerous because not only is there no indication you’re actually
on a website, if you’re on windows the task bar will even display the sites’ favicon
as its icon, making it look like a legit app.
But let’s say an attacker does want to make it look like you are on a website, just a
different one to the one you’re actually on, that’s no problem, by using CSS trickery
it’s possible to spawn a fake address bar, and even an SSL padlock icon.
And, a website opened in application mode can control certain aspects of the window,
like closing it after it’s phished you of your credentials, something a regular website
just can’t do.
The good news, is that application mode can’t be used by just any random website on the
internet, it can only be launched locally.
The bad news though is that a shortcut file could easily do that with a command baked
into it, so you could imagine a scenario where a legitimate download could be bundled with
a dodgy shortcut file, using the context of the legit thing you downloaded to encourage
you to log in to some account.
But Seytonic, I don’t even have Chrome.
Well “application mode” is a feature of all chromium based browsers, so this’ll
also work just as well on Edge, which of course comes bundled in all windows installs by default.
So I suppose the lesson here is just not to trust shortcut files, for anything, ever.
But if you’re ever suspicious…
just hit F12 as bringing up devtools will clearly show you which domain you’re on.
There are some other, more subtle ways to tell, like, a browser window might have more
window controls than the app it’s trying to imitate, it’ll also default to dark mode
if that’s your browser’s default.
And in this example the footer isn’t properly aligned to the bottom, and if the phisher
is using a fake address bar, the scrollbar might go into it, which of course shouldn’t
happen.
Of course an attacker could mitigate some of these small errors, but I suppose the point
here, is that phishing pages almost never look 100% accurate, so even if something small
looks ever so slightly off, then there’s definitely reason to be sus.
As always thanks for watching, and I’ll see you in
the next video, have a good one.