Is this the biggest crypto hack ever? Print Spooler is an actual Nightmare, and a hacker
claims t-mobile data was stolen in a server hack! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for August 17,
2021! This is your weekly summary of the threats to our security, privacy and Internet freedom.
We have some hacks and zero days to get into today so.. Onto the news!!
Last week, the PolyNetwork announced they’d been the victim of a cryptocurrency hack,
wherein over $611 million in crypto was stolen and transferred to an attackers digital wallet.
The attackers reportedly gained access to Binance Chain,
Ethereum, and Polygon assets. This makes it the biggest decentralized finance hack
ever to occur. Poly Network allows users to exchange tokens across different platforms,
like Bitcoin and Ethereum. In total, 273 million in Ethereum, 253 million in Binance Smart Chain,
and 85 million in Polygon Network were stolen. Some tokens tied to this attack were blacklisted.
At the time of the hack, several theories arose, one being that the hack was due to a cryptography
issue, and that problem sounds plausible and eventually the vulnerability was determined.
Poly Network did publicly announce how it happened,
saying the problem lied in a vulnerability that concerns contract calls, and is tied
to a privileged contract called the “EthCrossChainManager”. Tokens can
be swapped between the blockchains using smart contracts, and those contracts have instructions
saying when to release assets to counterparties. Poly Networks smart contract has lots of liquidity
so swapping tokens is really efficient, but the attacker was able to override
the contract instructions for all three of the blockchains affected and divert funds.
Security Firm SlowMist stated they’d traced the attackers ID and found their email address,
IP address, and device fingerprint, showing the attacker used Monero originally
and exchanged it later for tokens used in the attack. Many networks that rely on Poly Network
were concerned they’d have to suspend operations, with one, O3, halting cross chain features.
On August 10th, Poly Network posted an open letter to the hacker to return the assets as they’d be a
target for law enforcement given the high amount of money stolen. The next day, Poly Network had
recovered just 4.7 million of the over 600 million stolen. Poly Network posted just a day after that
that all remaining user assets had been transferred to a wallet controlled by
both the hacker and Poly Network, with exception to some of the frozen tokens.
According to reports, Poly Network offered a bug bounty payout of $500,000 to the attacker
if they repaid the crypto. The attacker did an AMA online, answering questions about the hack,
saying they’d found a vulnerability and exposed it before someone else could exploit it.
Poly Network called the perpetrator “Mr White Hat”. [[screenshot 9]] While ethical hackers
are sometimes nicknamed white hats, this seems to fall short of a lot of those ethical standards,
and the money is probably being given back due to difficulty laundering it,
or worry of being investigated and found by agencies. The attacker themselves asked how
to use Tornado Cash, which allows for private Ethereum transactions.
So was this an overzealous hacker who wanted a quick cash grab
or were they actually an ethical hacker looking to help Poly Network fix a bug?
The entire story is really odd but at least Poly Network recovered the funds.
The Windows Print Spooler is having a worst year ever, with the announcement back in June
that a vulnerability in the print spooler could allow remote code execution and gaining of local
SYSTEM privileges. This is tracked as CVE 2021 34527 and dubbed PrintNightmare. Microsoft fixed
the remote code execution part of that problem. But soon after, researchers exploited the Point
and Print feature in order to install malicious print drivers allowing for privilege escalation.
Along with this, another issue, tracked as CVE 2021 34481, could also allow for escalation of
privileges. Microsoft addressed the issues with a Patch Tuesday update for August, which now
requires users to have admin privileges to install printer drivers with that Point and Print feature.
Users will not be able to install new printers using remotely available drivers
unless they have admin privileges now.
A short time after this security patch went live,
Microsoft had to issue another advisory for another bug. This one is tracked as CVE 2021
36958 and allows local attackers to get SYSTEM privileges on a computer using the print spooler.
Researcher Benjamin Delpy called out this problem and the fact that it hadn’t been
fixed yet. In this case, if a driver already exists on a client device,
connecting to a remote printer could execute CopyFile, and a malicious DLL could be copied and
executed. Microsoft issued a warning and workaround for this by disabling Print Spooler.
This one was originally credited to Victor Mata of FusionX who disclosed this in December of 2020.
Now, we’ve learned that ransomware groups are using these exploits to target Windows
servers with Magniber malware, as discovered by CrowdStrike. A second group called Vice Society,
was discovered to be using PrintNightmare bugs as well and according to Cisco Talos, is using
this vulnerability in ransomware attacks. Because these flaws are well known now and not completely
patched, it’s likely other ransomware groups will join in on exploiting them in various ways,
so your best course of action is to mitigate these issues as Microsoft recommends.
I love it when y’all send me these adorable pictures of your pets so these are a few
from my hush puppy Patreon Alliance members. And also THANK YOU to Aaron for joining. Patrons are
starting to receive their new merch rewards in the mail like mugs and stickers depending on your perk
level - also mad props to Nome for sharing this mugshot. You can always sign up at any time to
get access to those perks! Patreon.com/ThreatWire as always for that - OK, onto the third story.
Shoutout to Joel for sending this story my way! According to a report by Motherboard,
an investigation is underway by T-Mobile to find out if a dark web forum post which claims to be
selling personal data from T-Mobile servers about their customers is indeed real. The seller on
this forum claims to have obtained data on over 100 million people from the carriers servers,
including social security numbers, phone numbers, names, physical addresses, IMEI numbers for
devices, and driver license info. The attacker claims the IMEI data stolen goes back to 2004.
The seller wants 6 bitcoin, about $270,000 USD in today’s rates,
for about 30 million of the SSNs and driver license numbers they claim to have,
while they’re also selling the entire dataset privately.
Alon Gal, CTO of Hudson Rock, a cybercrime intelligence firm, the attacker did this in
retaliation for the US quote “kidnapping and tortue of John Erin Binns in Germany [] in
2019. [They] did it to harm US infrastructure.” While the forum post doesn’t mention T-Mobile,
the seller has told news outlets that that is indeed where the data came from.
They claim the specified servers are T-Mobiles production, staging, and development servers,
along with an Oracle database with customer data. T-Mobile has not commented further on the
validity of the claims. The seller did mention they’d lost access to the backdoored servers,
though, but not before they made backups of the data.
I’m pretty excited because my tech channel - youtube.com/ShannonMorse,
just hit 60,000 subscribers. Can you believe it? I can’t. But I know a lot of y’all watch my
security content on both channels so THANK YOU!!! You are awesome! And with that, don't forget to
like and subscribe to this channel as well! I'm Shannon Morse, I'll see you on the Internet!