Hello, World!
What is a digital red cross and could it stop cyber attacks, Crypto stealing malware gets
an upgrade, and the feds seize a billion dollars in crypto from the silk road hacker.
That’s all coming up in today’s roundup of cyber security tech news.
Everyone knows what the red cross is, in wartime it’s painted on the side of trucks, tents,
and people - all to let your enemy know that these are medics, so please don’t shoot
them.
Anything bearing this symbol is protected under the Geneva convention, or at least,
that’s the idea.
But now, medical services have a new threat they need to deal with, cyber warfare and
cyber crime.
And I don’t imagine painting red crosses on the back of laptops is going to deter hackers.
Whilst many cyber criminals do pledge not to target healthcare organisations, malware
doesn’t necessarily know who it’s infecting, and will just lock up the computer of whoever
is unfortunate enough to download it.
So a new report has been published on “digitalising the red cross”, as in how can a computer
let malware know that it’s medical related and to please leave it alone.
It seems like a “digital red cross” would be a relatively easy thing to implement - I
mean, similar things already exist, say for example you want to let Google know that you’d
rather they didn’t crawl your website, you’d just create a robots.txt file in the root
directory, inside which you mark it as disallowed.
So there could be something similar in this case, red-cross.txt, the very existence of
which would let hackers know that the computer is medical related.
I mean, sure anyone could abuse this by creating the txt on their own computer, but anyone
can wear an armband, so this isn’t a new problem.
But there is another major downside with this solution, and it’s not what you might think.
If an attacker hacks a computer and tries to check for the existence of this file, the
victim computer could detect this access attempt and would therefore know it’s under attacked.
This would mean that pretty much all organisations regardless of whether they’re medical related,
would keep tabs on whether the existence of this file is being checked for, if it is,
then they’d know they’re being attacked attack and would lock down their systems.
Consequently, hackers just wouldn’t want to check for the file, which makes the whole
point of it redundant.
So, for hackers to be willing to check for a “digital red cross” it needs to be designed
around their needs, they need to be able to look for it without raising alarm bells, this
is crucial.
The report has several ideas about how this could be implemented, a solution could be
DNS based - as in a new top level domain specifically for healthcare organisations… but DNS isn’t
immune to people messing with it.
And the organisation’s domain might not even be visible from all the computers in
the network.
A second idea is IP based, medical organisations could submit the ip addresses they use to
a neutral third party, which could compile and publish a list of all the ip’s that
people should leave alone… but thanks to “network address translation” - there
could be a huge number of devices hiding behind a single public ip.
So how do you know that these are all medical systems, and some bad actor isn’t just exploiting
this virtual shield?
You don’t - and well, that’s the thing - a ‘digital red cross’ is much more tricky
to implement than it seems.
Whilst the report doesn’t give a definitive answer on how this could be solved, it settles
on what’s being called an ‘Authenticated Digital Emblem’ or ADEM for short, which
would mean an organisation digitally signing traffic the traffic their network generates
on certain protocols - so bad actors would be able to tell whether a target is healthcare
related with a simple ping.
Whether this actually works in practice, well, we’ll have to wait and see, this whole idea
hasn’t left the whitepaper yet, it still needs to be prototyped.
Clipboard hijacking malware is evolving, a new variant has been discovered which comes
with an interesting feature.
And if you don’t know what this kind of malware is, you definitely should - this malware
is simple, but sneaky, and if you’re not careful it could cost you a bunch of crypto
- and unfortunately I do have a few experiences with this malware, but we’ll get to that
in a sec.
If you’re not familiar, ‘clipboard hijacking malware’ exploits the fact that when making
a crypto payment, you’ll usually copy the payment address before pasting it into your
wallet.
So this kind of malware simply monitors anything you copy to your clipboard and compares it
against a bunch of regular expressions matching crypto wallet addresses.
If it finds a match, it’ll replace that kind of crypto address with one of its own.
So when you hit paste you end up sending your crypto to cyber criminals by mistake.
It really is one of the sneakiest kinds of malware out there, and like I say, I’ve
had a couple run ins with it.
So, I run an online store, maltronics.com - where I sell various pentesting devices
- and I accept payments in crypto.
I’ve had numerous instances of confused and sometimes angry customers emailing me
to say they paid for their order, but the payment page just doesn’t acknowledge it.
In one case, a customer told me “I think there is something wrong with your Coinbase
payment web page, when you click “copy” the eth address, the address is different
every time” - a clear sign that this person’s computer is infected - they then listed a
bunch of addresses that appeared on their clipboard each time they hit copy.
And by searching these addresses on etherscan, you’ll see they’ve received thousands
of dollars in payments, there’s even comments from people saying they sent their crypto
to this address by mistake, not realising that their mishap was actually the result
of malware.
And to add insult to injury, people are responding to these comments saying that if you get in
touch with a certain email, “they should be able to reverse your transaction”, but
they charge for this service, which is of course just another scam - in what seems to
be a case of the same cyber criminals behind the malware, double dipping.
However ‘clipboard hijacking malware’ is relatively easy to counter, after you’ve
pasted an address just make sure the last few characters match the address you’ve
copied, and there you go, job done.
But new malware, which goes by the name Laplas, changes this.
This malware is similar to any other malware, it’s sold on hacker forums via a subscription
of $59 per month, in return, cyber criminals get a web interface where they can generate
an executable, view their infections as well as their crypto wallets.
But it has a unique feature which has made it increasingly popular amongst cyber criminals.
Laplas makes sure to replace wallet addresses with an address where the last few characters
are identical, dramatically increasing the chance that even if you checked these last
few characters, you wouldn’t notice that it’s a completely different address - and,
this is a significant upgrade for cyber criminals.
But exactly how the developers implemented this feature, is still a bit of a mystery
- I mean, generating a bitcoin address with a certain string on the end could take a few
seconds depending on a victim’s hardware, potentially longer than it’d take for a
victim to paste the address.
So it’s possible the developers used a tool like vanitygen to precompute billions of wallet
addresses and just substitute them in as needed.
Either way, next time you paste a crypto address, save yourself some coins by skimming through
the whole thing.
In 2012, Silk Road - the internet’s most notorious dark web marketplace was hacked,
50 thousand bitcoin was stolen in a robbery which was made possible due to a “withdrawal
processing flaw” in Silk Road’s systems.
You see - every time someone withdrew their crypto from the marketplace there was a bit
of lag before their balance was updated…
Which was eventually exploited by someone who made a series of withdrawals in rapid
succession, extracting in total, 50,000 bitcoin, making this one of the largest crypto heists
of all time.
But the hacker, was never identified.
And just a year later, the Silk Road was shut down, it’s owner, Ross Ulbricht imprisoned,
and heist, remained a mystery.
Until now - the DoJ, using what they describe as “state-of-the-art cryptocurrency tracing
and good old-fashioned police work” have identified and arrested the hacker, one James
Zhong.
And, you might be a little confused as to why the DoJ are spending their time and resources
investigating decade old instances of criminal on criminal hacks.
Well, at the time of the heist, the haul was only worth a few hundred thousand dollars
- I say only, because in September of 2012, bitcoin was at $12 a coin… however things
have changed a bit since then, the small fortune is now a much larger fortune, roughly a billion
dollars - which will now presumably become the property of the government for them to
auction off.
James Zhong’s home was raided, and as expected the feds found a literal treasure trove.
Stacks of cash, bars of silver and gold - even physical bitcoin, these things are called
Casascius coins, coming in various denominations, they have a sticker you can peel off to reveal
a private key.
But of course the big seizure was the 50 thousand bitcoin, which court documents say was found
on a ‘single board computer’, which I’m just going to go ahead assume was a raspberry
pi, as it isn’t specified.
I’m guessing this was the microsd card that the pi was using to store the fortune - it
was found in a popcorn tin, which was apparently hidden in his bathroom closet.
Funnily enough on the exact day of the raid, November 9th last year, bitcoin was just hitting
its all time high of 68 thousand USD, meaning this micro sd card was worth in excess of
3 billion dollars.
But of course bitcoin has had a bit of a rough time since then, so the feds won’t get quite
so much for it at auction.
And unfortunately for James Zhong it’s pretty hard to explain away a multi billiondollar
crypto fortune hidden in a bathroom closet and so he’s pled guilty on charges which
could land him in prison
for 20 years.
If you found this video interesting make sure to hit that subscribe button, and I’ll see
you in the next video, have a good one.