Hello, World!
I want to experiment with a more consistent weekly hacking news update that covers 4 or
5 topics, as opposed to just 3 topic videos every so often, so first up, in this week’s
hacking news update.
A critical vulnerability in Signal allows hackers to takeover your phone just by sending
you a malicious link - allegedly.
Rumours that this exploit is being used in the wild started to go viral last weekend,
with the source of the news apparently being an anonymous US government insider.
The exploit was said to abuse ‘Generate link previews’ - a feature in Signal, which
like most messaging apps, gives you a sneak peak of a link before you click it.
However the root cause of the bug is reportedly related to that recent .webp image vulnerability
- so, the idea being, you receive a link which causes a preview to load within Signal, which
has a specially crafted image, containing malicious code, which results in your device
being hacked, and all your secrets ending up in the hands of some guy in a dark room
wearing a hoodie.
But the .webp vulnerability was patched weeks ago, so that just can’t be behind this - which
only added to the uncertainty of not knowing what the hell was behind all of these claims
- causing the panic to go viral and actually register on google trends.
And fair enough, I mean - Signal isn’t just used by privacy enthusiasts, but also a hell
of a lot of journalists and activists, people who would likely end up being the target of
whatever government had access such an exploit.
But the Signal team quickly descended on this, investigated and crushed the rumours, saying
that they’ve seen “no evidence that suggests this vulnerability is [even] real” - they
also “checked with people across [the] US Government”, since that was apparently the
source of the news, but those guys were just as clueless as everyone else.
Who started the rumour and why is a bit of a mystery.
But, regardless of this Signal hack turning out to be total bs, Signal remains an incredibly
lucrative target for blackhats, I mean - the Russian exploit broker ‘opzero’ is currently
offering $1.5 million dollars to anyone who can find a remote code execution vulnerability
in the App, and ‘opzero’ is quite open about the fact that they then sell these exploits
on to Russian companies and government organisations.
Spyware, disguised as a rocket alert app has been targeting Israel.
These rocket Alert apps are used by millions of Israelis to provide advanced warnings of
Hamas rocket fire into civilian areas.
And it’s no surprise that in the past week or so, the popularity of these apps has, well
- skyrocketed.
Presenting opportunity for cyber bad guys to create their own rocket alert apps, with
hidden undocumented features.
Researchers at Cloudflare discovered a website ‘redalerts.me’ claiming to offer one such
app.
Whilst the website is fairly convincing, if you go to download the Android version, instead
of taking you to the play store, you’re instead served a malicious APK, which lights
up virustotal like a Christmas tree.
The app’s permissions allow it to view your call log and SMS’s, as well as see your
contacts, and google account.
And even access things like your device’s IMEI number.
But, this isn’t a list of things which cyber criminals generally go for, those guys are
more interested in your credit card details and passwords, suggesting that whoever’s
behind this App has other motives.
As long as the app is installed it’ll continually grab your phone’s data, encrypt it and upload
it to an attacker controlled ip address.
And the victim would have no idea, because the app functions like an actual rocket alert
app, providing genuine rocket alerts just as the victim would expect.
The spyware element of the app is only an extra feature, which is all made possible
because the App is actually a clone of a genuine rocket alert app that millions of Israeli’s
use on a daily basis, and this App just so happens to be open source, making it straight
forward for a bad guy to clone, and add a sneaky surprise.
But the bad guy in this case is unknown, no hacktivist group has taken responsibility,
and there’s no suggestion from researchers as to who could be behind it.
It’s not the first time in recent days that rocket alert apps have been abused.
We saw in a recent video that self-proclaimed Palestinian hacktivists discovered a vulnerability
in the API of a different rocket alert app, allowing them to send false alerts warning
of incoming nuclear bombs.
Cybercriminals claim to have “taken control of the systems of colonial pipeline”…
again.
This pipeline supplies almost half of the fuel used by America’s East coast.
And, you might remember, the first cyber attack on it back in 2021, had dramatic irl consequences.
To refresh your memory, after the Pipeline’s billing and accounting systems were locked
up in a ransomware attack, Colonial just wasn’t able to charge their customers, so they shut
down the pipeline for 5 days.
Which resulted in fuel shortages at petrol pumps, and some airlines even had to change
their flight schedules, for a few days there was chaos.
Making the hack one of the most consequential cyber attacks of all time.
So in the last few days, when a new cyber criminal group posted to Telegram that they’d
hacked the Colonial Pipeline - the response was far from enthusiastic with many people
expecting a replay of the events of 2021.
However, the group behind this supposedly devastating new hack is ‘Ransomed.vc’
- and these guys have a history of exaggerating their hacks for clout, just a couple weeks
back they claimed to have perpetrated a disastrous hack against Sony… which spoiler alert,
turned out to be kind of a nothing burger - I’ve leave a link to that video below
if you want a full rundown.
So, is this claim of a new Colonial Pipeline hack, also just empty hype?
Well, yeah… kinda.
After RansomedVC made the announcement, the Pipeline company quickly rushed out a statement
saying the claims were unsubstantiated, but RansomedVC then posted a download link to
all the stolen files, proving that they weren’t completely lying.
But they just stole some data here, they didn’t encrypt anything, or “[take] control of
the systems of [the] Colonial Pipeline” like they claimed, so they quietly edited
their Telegram post to reflect reality.
And as for those stolen files, it doesn’t look like these even came from the Pipeline
company at all, but rather a consultancy firm that just had some contracts with them.
In the 3GB dump are details of those contracts, emails between employees, and photos of them
working.
it doesn’t look like there’s any credentials or anything which could immediately threaten
the operations of the pipeline like last time, but as always with these kinds of breaches,
it could be a pretty good source of intel for other cyber criminals wanting to perpetrate
further attacks in the future.
Russian and Chinese state backed hackers have been caught exploiting WinRAR to do international
cyber espionage.
But before we get to that, I need to tell you about today’s sponsor.
Akamai connected cloud is your swiss army knife for cloud computing, these guys can
handle everything cloud, and they’re giving you a $100 60 day credit to get started.
One of their features that I love is their app marketplace which makes it super easy
to spin up servers with preconfigured software.
Need an instance of Kali?
Just configure the basics with their installer and you’re done.
So click the link in the description now to claim you’re free $100 credit.
But back to those pesky state sponsored hackers.
They’re using a vulnerability in WinRAR that was actually patched a couple months
back, but thanks to WinRAR not having an auto update feature, meaning you actually have
to head to the website and grab updates manually - a hell of a lot of people are still vulnerable
to this.
The vulnerability itself is incredibly easy to exploit.
It’s made possible thanks to a bug in WinRAR’s capability to open files with a trailing space
in their name, when you open one of these files, if there just so happens to be a folder
of the same name in the archive, then WinRAR will open the first file in that folder, if
and if, that file’s name matches the original filename, before the space, and if it has
an extension from a predefined list.
Given this list of extensions involves executables, it’s not hard to see how this could be misused.
An attacker could easily create a scenario where opening a totally innocent jpg, would
trigger a malicious script to run in the background.
It’s a very elegant exploit, which Google has just discovered multiple instances of
government hackers exploiting.
One case involves a hacker group linked to the Russian armed forces - SANDWORM.
These guys recently launched a phishing campaign which impersonates a Ukrainian drone warfare
training school.
They blasted out emails telling victims that they’d been invited to join the school,
and that they’d find their offer in a PDF within an attached zip file.
but upon opening the booby trapped PDF, a hidden batch script was run, which downloaded
a nasty infostealer called “RHADAMANTHYS” and ran it in the background.
This infostealer is apparently known as “The everything bagel infostealer” thanks to
the extensive list of software it can steal credentials from, which even includes incredibly
obscure browsers you’ve probably never even heard of, like K-meleon, or ‘pale moon’.
In another case, Google observed a Chinese hacker group, known as ISLANDDREAMS launching
a phishing campaign targeting an organisation in Papua New Guinea.
In this case the booby trapped archive used a fake invoice as a lure.
Opening the invoice triggers a powershell script hidden in an LNK file, which downloads
a malicious DLL file which is then side-loaded into legitimate windows software, resulting
in something Google is calling BOXRAT being run on the victim PC - I couldn’t find much
information on BOXRAT.
But it seems to be some kind of a backdoor which allows ISLANDDREAMS persistent access
to the victim’s computer.
As always, thanks for watching and I’ll see you in the next video, have a good one.