Hello, World!
How pro Russian hackers sabotaged Polish trains for $20, TOR is getting an upgrade, and a
famous phishing service has been shut down after it’s operator made some hilarious
opsec mistakes.
That’s all coming up in your roundup of cyber security tech news.
“Hackers [have brought] down Poland’s train network in [a] massive cyber attack”.
It affected trains near the city of Szczecin in Northwestern Poland.
Mainstream media is reporting that “Hackers broke into railway frequencies”, and not
only were “20 trains … brought to a standstill” but the attackers played a “recording of
Russia's national anthem and a speech by President Vladimir Putin”.
Whilst there were no collisions and no one was hurt, it does all sound pretty dramatic,
with “a senior security official” saying "For the moment, we are ruling nothing out”.
And just a couple days later, it all happened again, there was another case of trains being
sabotaged.
So, what the hell is going on here, is this the result of some super sophisticated Kremlin
sponsored Russian cyber espionage campaign as the mainstream media is making it out to
be?
Well - not quite.
To even call this a “cyber attack” is a bit of a stretch.
In fact, this “cyber attack” is about as sophisticated as those kids on TikTok that
maraud around armed with Flipper Zeros, turning off TV’s in department stores.
The way that hack works - if we can call it a hack… is just by brute forcing all known
infrared codes that are used to turn off different different models of TVs.
And as it turns out Polish trains also have a remote off button that anyone can activate.
It’s called RADIOSTOP, and it allows anyone with cheap radio equipment costing just a
few dollars, to activate the emergency brakes on Polish trains.
RADIOSTOP isn’t a secret, details of it are publicly available in the European Union’s
law directory, just search this reference code and you’ll find this document, on the
“signalling subsystem of the trans-European high speed rail system”.
The RADIOSTOP section explains, that this function is typically activated by pressing
a button on a train which “causes vehicle emergency braking”, there are youtube videos
demonstrating that, however it goes on to explain that when this button is pressed,
a radio frequency alert is sent out, consisting of a sequence of 3 particular tones, f1, f2,
and f3 for a duration of 100 milliseconds each, in 500 millisecond intervals.
And if any other trains nearby receive this warning twice, they will also apply their
emergency breaks.
The exact frequencies of these tones can just be found in a paragraph above - which I’ve
blurred out so the YouTube Gestapo don’t come after me - but yes this is all public
knowledge.
An attacker can transmit this sequence of tones with a basic walkie talkie that you
can buy from aliexpress for less than $20.
It’s crazy, there’s no authentication here, no encryption - as long as the tones
are transmitted on the right frequencies, any trains in the area will apply their emergency
breaks, pissing off passengers, but more importantly
bringing to a halt NATO’s military transports
- which seems to have been the motive here, given the attackers’ apparent pro-Russian
broadcasts.
On the bright side, this attack can’t be done with a flipper zero, as those things
just can’t transmit on the frequencies required - which well - thank God for that.
But regardless, it doesn’t take much in in terms of technical skill or money to pull
this off, I mean, when I read this could be done with a cheap walkie talkie, I thought
I was being trolled.
However, the main limitation of this attack is proximity, an attacker would have to be
real close to a train in order to activate RADIOSTOP.
Depending on the power of an attacker’s radio equipment we’re talking a few hundred
meters or perhaps a couple miles at best.
But whoever was behind the recent attacks seem to have gone on a bit of a road trip,
because the “disruptions … occurred in three different Polish … regions across
the country”.
However, in the couple days, two suspects have been arrested - “both Polish citizens
aged 24 and 29”, with radio equipment being confiscated from their home.
It’s unclear how they were identified, whether the signal was traced back to them, or if
this is a case of them bragging on social media or something.
The Polish department of transport is planning to deprecate the current radio communication
system in favour of an authenticated cellular system - which will of course render this
attack useless, but that’s not going to come into effect till 2025.
Until then, the problem that RADIOSTOP poses remains - and, I don’t think this is the
last we’ll hear of it being abused.
Next up, if you’ve used TOR in the past year you might have noticed it’s sometimes
pretty slow, and at times impossible to use - this has all been thanks to a string of
DDoS campaigns that’ve been targeting the TOR network, in fact - earlier this year the
Tor Project reported that one of these campaigns lasted 7 months.
We don’t who’s behind it, or why.
But it’s hard to imagine that cyber criminals are the culprit, those guys love TOR - it’s
more likely the attacks are in some way state sponsored.
Regardless, DDoS attacks targeting TOR are rather effective because the network is of
course designed around anonymity, so there just isn’t a great way of differentiating
malicious traffic from regular traffic.
However, the Tor Project has a new idea to hopefully put a stop to the DDoS attacks plaguing
the network, and it’s inspired by a technique described in a research paper published way
back in 1992, a technique which was made famous by bitcoin - ‘proof of work’.
From now on, people wanting to use TOR will have to complete a small ‘proof of work’
task to prove they’re not a bot.
This isn’t some some kind of new fangled captcha, it’s a computational task that
goes in in the background, something that’s easy enough for a regular CPU to complete
within a reasonable amount of time, but difficult enough to prove that the computer you’re
connecting from likely isn’t some kind of IOT device that’s part of a botnet.
Client side you’ll probably just see a loading screen, which - depending on Tor demand could
take anywhere from a few milliseconds to even a whole minute, because this will all be done
dynamically, the complexity of the ‘proof of work’ task will automatically scale up
as demand increases on the Tor network.
The ‘proof of work’ algorithm that’s being used here is called EquiX - it’s designed
by the same guy who developed Monero’s algorithm, however there’s no cryptocurrency involved
here, nothing is being mined on your computer - which is arguable a lost opportunity for
the Tor project - these guys rely on donations.
They could hit two birds with one stone, by making a little bit of cash on the side with
this.
However, there’s a good reason not to - a handful of countries have effectively banned
cryptocurrencies altogether, so mining in the Tor browser could give them a pretty good
excuse to treat even a whiff of TOR traffic as a financial crime.
There are downsides to using ‘proof of work’ as an anti-DDoS mechanism.
It might make using Tor on mobile devices pretty tedious, as their limited computing
power of course means the ‘proof of work’ challenge will take quite a bit longer than
it will on a computer.
Also, this isn’t going to stop DDoS attacks once and for all… it’s thought that whilst
this will be effective against script kiddies and small botnets.
When it comes to attackers with deep pockets and those armed with really large botnets,
they will still be able to make a dent in the Tor network, but hopefully less of a dent
than they’ve been able to inflict up until now.
Next up, you probably haven’t heard of them, but chances are you’ve seen their emails.
16shop is a notorious phishing platform - which has for years made it incredibly easy for
newbie cyber criminals to create realistic landing pages which impersonate a variety
of brands.
And it’s just been shutdown by interpol, after its creator made a whole series of hilarious
opsec mistakes.
Som 16shop acted as a kind of website builder, but for phishing attacks… a cyber bad guy
would select the brand they want to impersonate, customise the phishing email they want to
blast out, as well as the highly realistic landing pages, the language of which would
even be automatically changed based on the victim’s geolocated ip.
After victims had entered their personal information,
it would all be exfiltrated straight to the
16shop customer, who’d be paying in some cases just $60 a month for access to the platform.
16Shop had become so well known amongst cyber bad guys, that some cyber criminals even created
pirated versions of it, but they came with a hidden backdoor, siphoning off any collected
information to the pirates via Telegram.
As for the real 16Shop, it’s been around since 2017, but the question of who’s behind
it is a little complicated.
The service was originally run by someone going by the name 'DevilScreaM’ - and his
opsec sucked.
One of his silly mistakes, that ultimately led to his demise, was accidentally leaving
his personal gmail address in 16shop’s source code as a placeholder.
He also - and this is kinda unbelievable… he documented the development of 16shop on
his instagram story, I mean - if you look closely at the code, you can see references
to a fake American Express login page.
Security researchers of course subsequently identified the true identity of 'DevilScreaM’,
- a 21 year old Indonesian who was apparently a member of the cyber crime group, the ‘Indonesian
Cyber Army’.
The guy was then arrested and imprisoned.
But 16shop remained online - the site was now being run by two of his friends.
Who it seems have now been arrested themselves, with Indonesian police “[seizing] several
luxury vehicles in the process” - proving it is still possible to become rich as a freelance
web designer.
Interpol estimates that since 2017 the service has been used to compromise over 70 thousand
users, but that’s likely to be a severe understatement - because 16shop was incredibly
popular - the cyber security company Group IB which actually helped Interpol shut them
down, reports that over 150,000 phishing domains were created using 16Shop.
It’s hard to overstate just how big of a problem phishing really is - it’s thought
that 90% of breaches start with just a single phishing email.
Even some of the highest profile data breaches we’ve seen, like the Colonial pipeline hack
which led to literal fuel shortages, are thought to have started with a solitary phishing email.
If you happen to be in need of web hosting, but the legit kind, then today’s sponsor
can help you out with that.
Akamai connected cloud is your swiss army knife for cloud computing, these guys can
handle everything cloud, and they’re giving you a $100 60 day credit to get started.
One of their features that I love is their app marketplace which makes it super easy
to spin up servers with preconfigured software.
Need an instance of Kali?
Just configure the basics with their installer and you’re done.
So click the link in the description now to claim you’re free $100 credit.
As always thanks for watching and I’ll see you in the next video, have a good one.