Hello world,
A database containing the FBI’s top secret Terrorist watch list, otherwise known as the
No-Fly list has been made publicly available on the interwebs, by mistake.
And a new ransomware operation sees Nigerian scammers trying to recruit employees to infect
their own companies in exchange for $1 million dollars.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news A database containing the FBI’s top secret
no-fly list has been leaked, seemingly in its entirety. The database consisting of information
on 2 million people was found by a security researcher on an unprotected server. Not only
is this rather embarrassing, it is also potentially pretty bad news - we don’t know if anyone
with mal intent managed to download it before it was scrubbed from the internet, and the
FBI is being rather tight lipped about the whole incident. The no fly list contains the
identities of people suspected or known to be terrorists. The database is maintained
by the FBI’s Terrorist Screening Center, the TSC.
This was all discovered by one Bob, who is head of security research over at comparitech
- a company which reviews consumer security tools. He found the server containing the
loot after it had been indexed “by search engines Censys and ZoomEye” - these aren’t
typical search engines, they’re much like shodan, if you’re familiar. These search
engines index internet connected devices such as servers, making it easy to search the interwebs
for anything internet connected, based on details such as their OS, location, the software
they’re running, etc.
We’re in the dark as to the events which led to Bob’s discovery of the server, however
we do know that somehow he managed to stumble across an “Elasticsearch cluster” that
contained 1.9 million publicly viewable records. “Elasticsearch” allows for quick searching
and analysis of large amounts of data, perfect for a database of almost 2 million records.
Each record included such information as names, gender, date of birth, passport id, and no
fly indicator. It quickly dawned on Bob that there was a good chance this was the FBI’s
terrorist watchlist, colloquially referred to as the no-fly list. 1.9 million is a lot
of records, that’s almost one in every 200 people living in the US, as such in his report,
Bob notes, “it seems plausible that the entire list was exposed”.
Interestingly the server containing the data wasn’t even based in the US, instead it
had a Bahraini IP address, it’s not clear why this server was hosted overseas. Bob says
the exposed data was “immediately reported to the Department of Homeland Security”.
However the server wasn’t taken down until “three weeks later” - that’s a long
time for such sensitive information. This news story didn’t quite make it to the mainstream
media for whatever reason, with little pressure to explain things, the FBI have gotten away
with “no comment”. So we’re left only to guess what the database was doing on a
Bahrani server, unencrypted and publicly downloadable by anyone.
Also, because the server had already been indexed by search engines it’s possible
that someone else, more nefarious than Bob managed to download it - but there’s of
course no way for us to tell if that happened. However that being said, in the replies to
Bob’s initial tweet just after discovering the database, it would seem someone posted
a link to it - though there’s no indication if this was legit or just a troll as it has
now of course now been taken down. A newly spawned ransomware campaign sees Nigerian
scammers trying to recruit employees to infect the company they work for with ransomware.
The mission, should an employee choose to accept it, comes with an advertised reward
of 40% of the ransomware takings, in this case that’s $1 million dollars in bitcoin.
The bad actor has been making contact with potential recruits via their company email
addresses. A contact email and telegram are provided, the miscreant also confirms that
they’re using the demonware ransomware - otherwise known as “Demon” and “Black Kingdom”.
This variant of malware made the news earlier this year when it was found to be exploiting
the infamous Microsoft exchange vulnerabilities. This malware isn’t all that cutting edge,
it’s pretty shoddily put together, but more on that in a bit.
This new campaign was discovered by abnormal security, which is an email security platform.
After noticing several of their customers were receiving these emails, they decided
to investigate further. Abnormal goes on to explain how they “constructed a fictitious
persona and reached out to the actor on Telegram to see if [they] could get a response.”,
and added “the resulting conversation gave us an incredible inside look at the mindset
of this threat actor.”
The fiend who responded goes by the name “Pablo”, after checking if abnormal had access to their
company’s windows server he proceeded to send over one “Walletconnect (1).exe”
hosted on mega and wetransfer - this was surprise, surprise, ransomware. Pablo suggested either
deploying the ransomware remotely or via a malicious USB stick, however it quickly became
apparent that the figure of $1 million dollars advertised in the original email was just
bait. Abnormal explained that their fictitious company had an annual revenue of 50 million
USD, at which point Pablo suggested they should go with a ransom of just 120k, the low ransom
as explained by Pablo was due to him “just being a little considerate for them, lol”.
In reality, you’re much more likely to have a ransom of 120k paid, compared with a ransom
of a few million - I imagine he went for this, just to maximise the chances of actually receiving
anything at all. The only thing Pablo suggested abnormal should do to cover their tracks was
to delete the exe after running it.
Abnormal tried to probe a little deeper and learn a bit about the ransomware itself, Pablo
said he “programmed the software”, “using python” - however this seems to have just
been an attempt by abnormal to stroke Pablo’s ego a bit, butter him up for what was to come
next. Because as abnormal explains in their report, after analysing the exe, “all of
the code for DemonWare is freely available on GitHub”.
“Ransomware as a service net”, is open source - meant to be a proof of concept project,
illustrating how simple ransomware is to make. It’s written in python, as such it’ll
run on windows, linux and mac. It even has a nice web interface, but as the developer
explains “ this script [is] for research only”. Pablo has essentially ripped off
this code, and repurposed it for mal intent.
The conversation with Pablo continues. He explains he scraped a bunch of corporate emails
from linkedin, and focused his attention on CFO’s and CEO’s. But abnormal wanted to
learn a bit about the man behind the operation, Pablo himself. They did some “open source
research to see if [they] could get any clues about his identity.”. The username from
the ransomware email matched a profile on a Russian social media platform, which was
tied to a Nigerian phone number.
At this point abnormal turned the tables, using social engineering tricks to elicit
personal information from the miscreant, abnormal said “how do I know you aren’t going to
screw me”, Pablo tried to instill some trust in his would-be recruit by linking his own
linkedin profile, which confirmed he was the CEO of an African social networking platform,
however it seems to be a startup project rather than something well established. Pablo - which
we now definitively know is merely a made up name, if there was any doubt - even went
on to claim he’s the next “Mark Zuckerberg”.
Pablo quickly realised his mistake in revealing his true identity and deleted those messages,
but not before abnormal could take some screenshots. This is where abnormal’s report ends, we
don’t know if they just dropped the conversation here, or actually went on to break the bad
news to him.
This case is reminiscent of that one time last year when a Russian criminal tried to
recruit a Tesla employee to install malware on Tesla’s systems. In that case they planned
to exfiltrate sensitive documents and use them “to extort the company for a multi-million
dollar ransom demand.” Unfortunately for “Egor Igorevich Kriuchkov” the miscreant
in that saga - the Tesla employee wasn’t swayed by the 500,000 dollar bribe, and instead
turned him into authorities.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next go check out my previous video on how the dark web’s most infamous
marketplace has returned, though suspected by some to be an FBI honeypot.
As always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.