Hello, World!
How it’s possible to hack a car's license plates, A mysterious ransomware attack, and why Russian
hackers targeted New York Taxis.
That’s all coming up in today’s roundup of cyber security tech news.
License plates have been hacked with potentially disastrous consequences, but how is that possible?
I mean - a license plate is just a solid sheet of metal…
right?
Well, not this one.
Reviver is the world’s first e-ink digital license plate.
Only legalised in America just 4 months ago, this is probably the first license plate to
have an App.
Not only can you customise your reviver plate, it also makes your annual vehicle registration
easy.
And it has GPS, so if your car is stolen you can track it, and literally mark it as ‘stolen’.
Though, uhh, maybe I’m missing something, but the reviver plate seems like one of those
things that’s a solution in search of a problem, and an expensive solution at that,
because if you want the wired version, it’ll cost you $275 dollars per year on a 4 year
plan.
I mean, you could just get a cheapo GPS tracker - sure, it doesn’t have a fancy e-ink display,
but something tells me having your expensive GPS tracker on show might not be the best
of ideas.
That being said, cheap trackers are notorious for security vulnerabilities, in a recent
video I covered how this very tracker had unpatched security vulnerabilities enabling
hackers to go so far as to cut fuel to a running car.
So maybe for the added cost you get something a little more secure.
Except, it’s been discovered that these reviver plates have some vulnerabilities of
their own.
Vulnerabilities which could give hackers “Full super administrative access to manage all
user accounts and vehicles.”
Allowing bad actors to not only “Track … physical GPS [locations]”, but also add “arbitrary
text” to the plate and mark any and all reviver equipped vehicles as ‘STOLEN’.
And to top things off, the exploits give hackers “Access [to] all user records”.
A pretty dangerous array of capabilities.
I mean - given there’s at least 10,000 reviver plates on the road in California alone, you
can just imagine the chaos that was possible if someone with an affinity for anarchy discovered
these vulnerabilities first.
However luckily for reviver, it was a security researcher who discovered them.
And in a blog post he says that “Since the license plate could be used to track vehicles,
we were super interested in Reviver and began auditing the mobile app.”
After creating an account he proxied traffic to and from the reviver website and App, discovering
that his account was assigned a JSON object, which was editable.
It contained things like user id, email, name, but also a field called “type”.
Turns out this field was responsible for determining a user’s permissions, the default value
being “consumer” - so he tried brute forcing this parameter using wordlists.
Until he figured that he could “simply run through the numbers 0-100 and find all the
roles on the website.”, this is when he found “The “0” role” corresponding
to the type “REVIVER” - the administrator type.
This gave him full remote access to all reviver plates, made possible due to each one having
an LTE modem.
But rather than raining hell, which would’ve been such a big story it likely would’ve
killed the concept of digital license plates for years, the researcher instead responsibly
disclosed the vulnerabilities.
With reviver patching them in just 24 hours.
Royal Mail, the UK’s national postal service has suffered a crippling “cyber incident”,
causing much of their operations to grind to a halt - so what’s happened?
Well ‘cyber incident’ is as specific as we’re being told, officially at least.
Unofficially though, pictures have been leaked from a Royal Mail distribution center, showing
a ransom note, strangely, it’s printed on paper “Lockbit Black Ransomware”, “Your
data are stolen and encrypted”, and “will be published on TOR website … if you do
not pay the ransom”.
This seems at least, to be a typical ransomware attack.
Well, hacking Royal Mail’s printers to print out the ransom note is somewhat unconventional,
but LockBit - the group responsible here is known for doing things differently, I mean
- this was the first ransomware gang to launch a bug bounty program.
These guys are currently the words most formidable ransomware group, outperforming other notorious
ransomware gangs last year by a large margin.
As for this Royal Mail hack, it’s being reported that they’ve “infected machines
used … to print customs labels for parcels being sent … overseas.”
If you can’t print customs labels then you can’t ship parcels.
However whilst this all seems like a generic ransomware attack, there is a problem…
Bleepingcomputer (a tech news website I follow), “reached out to LockBitSupport”, who said
“they did not attack Royal Mail”, instead “[blaming] it on other threat actors using
their leaked builder.”.
You see, a few months ago, LockBit servers were hacked, and their source code was leaked.
Whilst it was quickly removed from github, the code is still out there.
So it’s possible that someone has repurposed this leaked malware and used it against Royal
Mail.
Making it look like a ransomware attack carried out by LockBit, when in reality there’s
no way to recover the data, and this is in essence a destructive wiper attack.
Also, Royal Mail is considered by the UK government to be “critical infrastructure”, a category
that the group pledges not to attack.
However LockBit it seems doesn’t agree with this classification of Royal Mail, and was
so impressed with the hack, that in a forum post they offered whoever was behind it, a
job.
Saying they’d waive the deposit usually required for affiliates to join their team.
Also, just a sidenote, I find it kinda funny that lockbit refers to their victims as “pentest
clients with post-payment”, but somehow I don’t feel like they’re joking.
But in another twist LockBit ended up solving the mystery behind who carried out this hack.
In a follow up post they admit this was actually carried out by one of their affiliates, and
that the LockBit team just didn’t realise, saying they have trouble keeping up with their
“endless stream of targets”.
As of making this video it doesn’t look like Royal Mail have paid the ransom, of an
amount currently undefined.
But LockBit also haven’t leaked the data, at least not yet.
It might seem like most money making hacks we cover on this channel involve cryptocurrencies
or banking trojans, but Russian hackers have proved this doesn’t have to be the case.
In a recently uncovered plot, Russians apparently hacked JFK airport’s taxi dispatch system
for profit.
You see, JFK airport - the main airport serving New York City is understandably pretty congested
with taxis.
So much so, that taxi drivers wanting to service the airport are first directed to a holding
lot, where they have to wait before being summoned by dispatch.
However taxis can be waiting in this holding lot for hours - I checked the “Taxi Driver
Information Dashboard” whilst typing up this video, and the current waiting times
are well over 2 hours, and it’s barely 6am in New York.
But braving the queue is worth it given the extra money that drivers can make from an
airport pickup.
But with waiting times often over 3 hours, this situation is a breeding ground for corruption,
and in 2014 a number of dispatchers were charged with taking bribes from taxis wanting to skip
the queue.
This prompted the introduction of a shiny new “electronic taxi dispatch system”,
which handles everything automatically in a bid to make things fairer.
But it hasn’t quite worked out, a recently unsealed indictment explains how 2 Americans
allegedly worked with Russian hackers to undermine this new system.
The group were seemingly brainstorming money making ideas when one of them said “I know
the Pentagon is being hacked…
So, can’t we hack the taxi industry”.
In figuring out how to hack this new dispatching system, they considered, “bribing someone
to insert a flash drive containing malware”, hacking the “Dispatch System via [its] Wi-Fi
connection”, and “stealing computer tablets connected to [this] Dispatch System”.
Court documents don’t say which method they decided on, but once they were in, they “used
large group chats” - I imagine on Telegram, where Taxi drivers would message their “medallion
numbers” to skip to the front of the queue a $10 fee.
At its peak, the scheme was enabling a thousand queue jumpers a day.
And they managed to get away with it for 2 years until being caught, exactly how that
happened?
Well we just don’t know.
But we do know that these guys can’t have been very smart, because they weren’t accepting
payments in crypto, but rather, in cash.
Both the Americans charged are facing up to 10 years in prison, each.
As for the Russians who seem to be the brains behind all of this, they played their part
remotely, from Russia, so there’s zero chance of them standing trial.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace which makes it super easy to spin up servers
with preconfigured software.
Use Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer
makes it easy to configure the basics, like VNC passwords, whether you want a desktop
environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always, thanks for watching and I’ll see you in the next video, have a good one.