First up in today’s roundup of cybersecurity tech news: 200 military trains are being sent
from Russia to Belarus, they’re loaded with tanks among other things, that’ll be stationed
near the Belarussian border with Ukraine - waiting on Putin’s orders for an apparent invasion.
Now Belarus is often called the last dictatorship in Europe, it’s effectively a puppet state,
run by a dictator - this guy: “Alexander Lukashenko”, who is allowing his country
to be used by Russia as a staging ground for a potential invasion of Ukraine.
But hacktivists have other plans, a group calling themselves the “Belarusian Cyber-Partisans”
has hacked into Belarus’ national railway network in an attempt to disrupt the buildup
of these Russian vehicles and troops in their country.
The “cyber-partisans” are essentially an anti government group, their manifesto
says they want to overthrow the “Lukashenko regime” and return to democracy.
And by the way, there’s no evidence in the slightest that this is some kind of CIA funded
group, or anything like that, but of course if you know otherwise, feel free to post your
theories in the comments.
Now they initially gained access to the computer systems of the state owned railway network
in December, but they spent weeks planning their attack before striking just a few days
ago, announcing on twitter - because every hacking group has a twitter account - that
they’ve “encrypted some of ‘Belarussian railway’s’ servers, databases and workstations
to disrupt its operations.”
in a bid to frustrate the movement of Russian troops through their country.
The hacktivists posted proof of their hack, for example a leaked document showing railway
staff begging their superiors to upgrade their computers, which all run on windows XP by
the way.
They also posted screenshots of the computers they hacked, which seem to show that employees
were using cracked versions of vmware and other software - and that this is apparently
how they were hacked, whether through malicious software itself, or more likely vulnerabilities
in pirated software which often never get security updates.
The operation to disrupt the railway seems to have worked, at least to some extent, the
railway company was forced to issue a press release stating that “for technical reasons”,
some services, like “electronic travel documents” have been disrupted.
However, just 2 days later they announced that their services have been “restored
in full”.
So was this operation successful?
Erm, well if success means preventing or delaying a Russian invasion, then no it seems not.
However this attack is only one chapter in a whole saga of operations carried out by
the “cyber partisans”.
One of which being the leaking of secret recordings showing government officials discussing orders
to beat the crap out of pro democracy protesters.
Belarus’ regime seems to take the cyber partisans seriously, they’ve designated
them a terrorist organisation, because - of course they have.
Lukashenko even told his ministers that “If you cannot … protect information on your
computers, then go back to using paper,” - so I think it’s obvious that these guys
are being treated as a real threat.
As far as hacktivist groups go, the cyber partisans have quite a public profile, they
post regular updates on twitter, and it seems they even have a youtube channel with about
50k subscribers - they also love their memes, using those recordings they leaked in one
of their previous operations to make little animations, I don’t speak Belarussian - obviously,
so I can’t comment on the quality of these memes, but for the Belarussians watching,
let me know in the comments.
An entire country’s internet has been crippled in a string of DDoS attacks targeting a minecraft
tournament.
Probably not a headline you ever expected to hear.
So, Twitch was hosting the “SquidCraft Games” tournament.
Idea being, they’d recreate the games from Squid Games in minecraft - 150 streamers would
battle it out - and the winner would go home with 100 thousand USD.
It only involved Spanish speaking streamers from places like South America and Europe,
which is why you probably haven’t heard about it, however what happened next is hilarious.
For whatever reason, someone decided to DDoS the Andorran streamers taking part.
Why?
No idea.
A lot of the time, DDoSing streamers and minecraft servers is done purely for the lols, as in
taking joy in watching the chaos and the ensuing fallout - knowing that they caused the mess.
Y’know, think server mods raging in chat, and streamers raging on twitter.
But in DDoSing these Andorran streamers, there was some collateral damage, you see - Andorra
is a pretty small country, with a population of less than 80 thousand people.
Such a small country only has a single ISP, and in DDoSing this ISP, the whole country’s
internet was disrupted.
Home internet users, businesses and even the government all started experiencing timeouts.
And the attacks took place over 4 days, with Andorra Telecom giving blow by blow updates.
The Andorran streamers announced on Twitter that they were of course being forced to drop
out - and it seems, google translate…
could use some work.
Some of the streamers are even offering a 10k bounty to anyone who can identify the
DDoSers.
But this was likely carried out by a DDoS for hire service, as in someone probably paid
a couple hundred dollars to a guy with a botnet to have them boot off the streamers.
It’s crazy, just a few hundred dollars is all it took to cripple an entire country’s
internet.
Segway, the company that makes segways has had their website hacked using an interesting
and creative little technique which involves favicons - those little icons that represent
websites.
This was discovered by MalwareBytes which initially became suspicious when they noticed
segway’s online store was communicating with a known malicious domain operated by
Magecart.
Magecart is an umbrella term for a collection of blackhat groups that specialise in skimming
credit card credentials from ecommerce sites.
Researchers discovered a malicious snippet of javascript in Segway’s store, it was
disguised as having something to do with copyright, maybe in a bid to make it look boring and
innocuous, something likely to be ignored.
The javascript grabbed a favicon from an external domain, again this seems innocuous and boring
- or at least it did, until they analysed the icon itself, and while the favicon was
a normal image, it was laced with a hidden credit card stealing script, designed to pwn
the credit card numbers of the poor souls who just wanted to buy a segway.
It’s unknown exactly how segway’s website was compromised in the first place.
But we can make some guesses.
Magecart group 12, the perpetrators here typically go after ecommerce sites that use Magento
or woocommerce for their backend.
Segway uses Magento, most likely they were either using an outdated version of Magento
itself or they were using a vulnerable plugin.
If you’ve bought anything on segway.com since January 6th.
Then you might want to get your card cancelled, as there’s a good chance your creds are
up for sale on some darkweb carding marketplace.
Let this serve as a PSA, if you’re shopping online you have to use a credit card rather
than a debit card, or use one of those apps that’ll generate you a one time use card
for each purchase.
Keep in mind, the only reason this operation was rumbled was because the attackers were
using an old domain they’d used before, had they been using fresh, new, untainted
infrastructure to run their attack then it wouldn’t have been uncovered so quickly.
This video was made possible by Altium Designer, the world’s number 1 PCB design software.
35 years of innovation and development has gone into this bit of kit, and it really shows.
Nothing else I’ve used comes close to the sheer breadth and depth of features.
If you dabble in PCB design at all, you have to give this a go - the routing engine even
just in of itself is just sublime.
Grab your free trial via the link in the video description.
As always, make sure to tickle the notification bell, and follow me on instagram for behind
the scenes content.
Thanks for watching and I’ll see you in the next video, have a good one.