Hello, World!
The United States emergency alert system - the one that manages broadcasting those scary
warnings has been hacked.
Severe vulnerabilities have been found in the decoder equipment which transmits these
messages, vulnerabilities which could allow a bad actor to send fake alerts, and even
block legitimate ones.
This is obviously not great news, and to give you an idea of the chaos that a fake alert
can cause, I refer you to the alert sent to Hawaiians in 2018 - that a "ballistic missile
threat [was] inbound" - causing literal mass panic.
In that case there was no hack, but rather someone pressed the big red button by accident.
As is evident, this 'emergency alert system' is a critical piece of infrastructure in the
US, that exists to "provide the President with capability to address the American people
within 10 minutes during a national emergency.", but it is also used for local emergencies
such as for things like severe weather.
But, how does this system work?
Well - when there's some kind of emergency, the authorities put out a message through
IPAWS, the "integrated public alert and warning system", alerts are then sent out via various
technologies.
For example, digital signage on roads, mobile phone alerts, and the "Emergency alert system"
which includes television and radio - this is the section found to be vulnerable.
So, all radio and TV networks in the US are required to have one of these things tucked
away in their studio, an "Emergency alert system decoder".
In the event of an emergency, these boxes receive alerts through that IPAWS system,
they then decode them, and since they're hooked up to a broadcaster's system they can automatically
broadcast the alert via TV or radio...
And, these boxes are where the problem lies - security researcher "Ken Pyle" discovered
multiple vulnerabilities in a particular model of decoder, which when combined, give an attacker
full access to broadcast their own alerts and block existing ones.
Exactly how the vulnerabilities were discovered and how they can be exploited, isn't being
revealed - at least not yet.
A proof of concept demonstration is going to take place at this year's defcon, which
is only in a few days.
In the meantime, the department of homeland security has put out an advisory, pleading
with broadcasters to patch the vulnerability by updating their decoder's software, before
details of the hack are exposed and paraded around at defcon.
Next up, a new ransomware operation has been spotted which, doesn't make sense.
After encrypting a victim's files, the ransomware asks them to join a discord server, where
a bot gives the victim the decryption key, for free.
No ransom payment is demanded, and no files are exfiltrated and published on some dark
web site.
Researchers were, confused to say the least, until they found out just who was behind this
operation.
The story begins with researchers at 'sonatype' discovering a bad actor typosquatting the
python library 'requests' - this is a popular HTTP library for python.
Our miscreant created three python packages each with a common typo of 'requests' such
that when developers in a hurry made a typo, they'd download the bad actor's malicious
package by mistake, instead of the legit one.
Typosquatting is of course, nothing new - there are even online tools that'll generate you
a bunch of typos for any given word - tools which are apparently made for marketers to
find common typos for clever marketing campaigns, but also of course find a use in cyber miscreants.
After being downloaded, the malicious python package encrypts all files in "Documents",
"Downloads," and "Pictures," after which it displays a message: "If you close this window
your files will be encrypted forever", "Unfortunately we don't have a key", "Join the discord server
to get one".
At this point you'd just assume the bad actors were, too lazy to build their own dark web
site to communicate with victims, and instead were using discord to talk to them, so they
could, negotiate a ransom payment.
However, that just wasn't the case.
After joining the server, researchers noticed a channel called "ransomware-notifications",
where a bot was posting victim's decryption keys, for free.
It's nonsensical, I mean - the malware was encrypting files, then immediately offering
to decrypt them, free of charge.
The researchers did some googling and found a Github account with the same name as the
owner of the discord server - "b8ff".
Here they found a public repository, containing all of the malicious code used by the ransomware.
And linked in the Github's bio is a youtube channel, where whoever is behind this stunt
has posted videos of them using cheats in Minecraft, Roblox, and CS:GO, bit random,
however - at this point I think it's obvious we're not dealing with some kind of hardened
cyber criminal.
Confused, researchers simply messaged the guy via his discord server - and finally got
some answers.
He explained that he was a school kid, and this ransomware was just a "project that [he]
developed, for fun".
"Based in Verona, Italy, b8ff describes himself as a school-going "learning developer" who
has recently been intrigued by exploits and the ease of producing them.".
However, he doesn't seem to understand that sure whilst his project isn't malicious per
se, the grey area he's operating in, is a pretty dark shade of grey.
I mean - you don't know what a victim might do after having their files encrypted, especially
if a victim isn't very technical, they might do something dumb like, delete the encrypted
files in a panic.
In total, the python packages were apparently "downloaded about 258 times", so there's a
good few people who had their files locked up - that being said I personally wouldn't
be too hard on the kid, as whilst this project was obviously a very bad idea, I think it's
clear he didn't have any ill intent, and it does sound like he's only 15 or something
- but, in fairness pulling something like this off at that age is really quite impressive
- but hey, if you think I'm being too lenient let me know your thoughts in the comments.
I'm really quite interested hear your guys' opinion on this one.
Next up, Twitter has confirmed that a zero day vulnerability was used to expose the data
of 5.4 million accounts.
The vulnerability itself was actually reported to Twitter via their bug bounty program - a
white hat hacker discovered that the bug in Twitter's API, could be leveraged by a bad
actor to check whether a certain email address or phone number had a twitter account associated
with it, and what that twitter account's id is.
The white hat reported the bug properly and was rewarded 5 thousand dollars for his efforts.
Twitter of course fixed the problem - but not soon enough.
It turns out that before the bug was reported, it had already been exploited by a bad actor
who used it to build a list of 5.4 million twitter accounts.
Presumably the bad actor, used already public email address and phone number lists, testing
them against Twitter's systems, looking for matches.
After building a list of twitter IDs and corresponding emails, they then further scraped public data
- eventually building a database of users, including things like 'screen name', 'location',
'verified status' and of course the all important email addresses and phone numbers.
On the face of it, a list of twitter usernames and their email addresses might not seem that
valuable - however, the miscreant, who goes by 'devil' put the stash on sale for $30k
on breachforums, but did eventually sell it for less than the asking price.
What makes a database like this so valuable, is the potential in spear phishing attacks
against high value twitter accounts.
After all, the database includes the follower count of each user and their verification
status - so a bad actor could just sort the list by those, and try to phish celebrities
out of their passwords - eventually using any stolen accounts for 'Elon Musk crypto
scams' - which can be quite lucrative.
Another issue caused by this breach is that there are a number of political dissidents
living in oppressive regimes who use anonymous Twitter accounts - Twitter encourages this,
having recently launched an onion site.
However if the owners of these anonymous Twitter accounts have their personal email address
or phone number tied to the account, then, they could be in trouble.
As whilst the threat actor who purchased this dump probably has no interest in outing political
dissidents - privately bought databases often eventually become public once their owner
has squeezed most of the usefulness out of it.
So one day the owners of anonymous twitter accounts on this list, could be outed.
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching, sources can of course be found in the description, stay
tuned for more hacking videos and have a good one.