Hello world, 2021 has been a year of some very epic hacks, and so I thought we’d start
a new tradition here on this channel, looking back at some of the most notorious hacks of
the past year. Now, there’s one thing that has of course dominated the cybersecurity
world in 2021. When I was making the shortlist for this video I realised almost everything
on my list was ransomware related. So I’ve switched up plans a bit, this video will be
ransomware free, and instead I’ll be making a separate video specifically for the top
ransomware hacks of the year. And so, in no particular order, here are the
top 5 hacks of 2021.
In September, the controversial hosting provider
epik was hacked. Epik have made a name for themselves by hosting websites deplatformed
by silicon valley, in doing so they’ve made quite a few enemies. On September 13th a group
claiming to be Anonymous leaked 180GB of what can only be described as pure humiliation
for Epik.
The leak includes such things as domain purchases, payment history, account credentials and so
on, it’s a really long list. And to make matters worse, the dump revealed that Epik
had been storing passwords as unsalted MD5 hashes, which is quite remarkable in 2021
- it’s analogous to locking up your bike with a zip tie, it’s better than nothing,
but just asking for trouble.
Anonymous aptly named the breach ‘Epik Fail’ - because how could you not? After the leak
went live Epik initially refused to even acknowledge
the hack, in response the miscreants published
a blog post on Epik’s own website, simply making fun of them. After finally acknowledging
the breach, the CEO sent probably the strangest breach disclosure email I’ve ever seen,
in which he said he was praying for his customers. I dunno, regardless of my religious convictions,
if my hoster has been hacked I just want to know what data has been hacked and what you’re
going to do about it.
But how did this disaster of a hack even happen? A remote code execution bug was discovered
in Epik’s website in January of this year, the researcher who found it tried reporting
it to the CEO but he was just ignored. The bug was a decade old, and allowed anyone to
remotely run code on Epik’s servers without any authentication. This is the best guess
as to how the hack went down. Next on the list are the infamous Microsoft
Exchange hacks. This was arguably the most serious saga of hacks in the whole of 2021.
It all started on January 5th when a security researcher who is well known for their work
tweeted they had stumbled across “the most serious [remote code execution flaw they]
have ever reported!”
It was discovered that there were a total of 4 rather scary vulnerabilities in Microsoft
exchange. Specifically this affected on-premises exchange servers, these are essentially email
servers run by organisations themselves in their own offices and on their own physical
hardware - but of course running Microsoft’s
exchange software. The 4 vulnerabilities collectively
gave attackers the ability to falsely authenticate as a standard user, escalate their privileges
to that of an administrator and then inject malicious code into the server.
For organisations that use Microsoft Exchange, of which there are many, think businesses,
NGOs, governments even, and so on. For these organisations this was essentially a doomsday
kind of scenario, you had a situation where an attacker could remotely, with only knowledge
of your ip address, gain admin rights to a server which held access to all of your emails.
Microsoft accused the cyber-espionage group “Hafnium” of targeting certain customers
with these exploits, this group “Hafnium” is alleged to have ties to the Chinese government.
However other cybercrime groups quickly caught wind of the exploits, and it wasn’t long
until the situation devolved into a bit of a free for all, with mass scanning of ip’s
underway by various groups, identifying vulnerable servers, before trying to somehow profit.
Whether with ransomware, cryptomining, or some other flavour of illegal.
Microsoft eventually released patches, but not before 250,000 servers apparently fell
victim to some level of exploitation. Next up, in May we heard about Frag Attacks.
Frag Attacks wasn’t a hack against any single company, but rather it was a whole suite of
vulnerabilities discovered in WiFi. These hacks were quite remarkable in that some of
them have been laying around undiscovered for over 24 years, since the very first version
of WiFi itself, and so every single version of WiFi was vulnerable, even the brand new
and barely even unwrapped WPA3.
One of the headline vulnerabilities discovered, enabled an attacker to inject packets into
a network even if the network was password protected. In one example the researcher manages
to turn on and off an IOT lightbulb connected to a network that he doesn’t even have access
to. This ability could of course be repurposed to do much more evil things.
However whilst on paper at least these exploits were very bad news and they do affect billions
of devices, an attacker would of course need to be in the vicinity of a network to be able
to screw with it. So bad guys taking advantage of these vulnerabilities on a large scale
just isn’t realistic. If you want to learn more about frag attacks, I’ll link my
video on them in
the description.
Back in October the entirety of twitch was
leaked by hackers on the popular vulnerability disclosure website: 4chan. And when I say
the entirety of twitch was leaked, I mean it. The 128GB torrent included the entirety
of Twitch’s codebase, including all their apps, internal SDKs, and it even revealed
a secret project in development by Twitch, a steam competitor called vapor. Top streamers’
earnings were also in the dump, which was literally the only thing the mainstream media
was talking about when it came to this hack, though it did spawn some pretty solid memes.
This wasn’t a ransomware attack, or some kind of money making mission. Whoever was
behind this seems to have had some beef with Twitch. Though the leaker does justify this
hack by means other than pure spite, saying “To foster more disruption and competition
in the online video streaming space, we have completely pwned Twitch”. If this was the
plan, I’m not sure it’s done its job, I’m yet to see any competitors using forked
twitch code.
But anyway, the hacker, who was never identified apparently got in through “an error in a
Twitch server configuration change” - looks like a system that was meant to be air gapped
was accidentally connected to the internet, watch my previous video if you want to know
why airgapping is so important. Twitch of course downplayed the hack. And whilst the
original 4chan post was titled “part 1”, the sequel, if there ever even was one, was
never released.
And last, but most certainly not least is
the solar winds supply chain hack, now I can already hear the comments, solar winds went
down last year, it doesn’t count. You may be right, but I disagree anyway. We first
learned of the hack on December 13th of 2020 - but many details of the hack or hacks I
should say (plural) only really started being published months later, simply because the
effects were so widespread and deep, in fact the president of Microsoft said this was the
‘largest and most sophisticated attack’ the world has ever seen. And so, I figured
it deserved a spot on this list.
It’s suspected that Russian state backed hackers belonging to the groups “Berserk
bear” and “Cozy bear” were behind the operation which targeted the “Orion platform”,
developed by solar winds. “Orion” is an IT management tool used to monitor and control
fleets of computers, it’s quite popular - or at least it was - if a graph of their
install base looks anything like their stock price then maybe not so popular anymore.
Somehow our attackers managed to gain a foothold in the build system of solarwinds. The build
system handles compiling code into the final executables, if a bad actor could gain access
to it, then they could modify the software before it was sent to solar winds’ thousands
of customers. And that’s well, exactly what they did. We don’t know exactly how they
gained initial access to solarwinds systems, though in an SEC filing solar winds seems
to blame a compromised “Office 365” account, saying this “may have provided access”
to “productivity tools”.
The hackers injected malicious code which gave them access to each system solar winds
orion was deployed on - which included a lot of high value targets. There’s the “US
department of the treasury”, “U.S. National Nuclear Security Administration”, “Department
of homeland security” and so on - the victims are a diverse bunch, it affected both public
and private sector organisations.
It was such a monumental hack that some even questioned whether it should be designated
an “act of war” - though thankfully this idea was quickly rejected.
So, that’s my list. Did I miss anything? Let me know in the comments.
This video was made possible by Intigriti: Europe’s biggest bug bounty platform, allowing
you to make hard cash in exchange for finding
and reporting security vulnerabilities. Intigriti’s
stands out based on their focus on their community,
with monthly challenges, weekly newsletters
and their own youtube videos in which they cover new tools and hacking techniques. Despite
amassing over 40 thousand active security researchers they maintain blazing fast triages,
typically getting back to reports in under 24 hours. Intigriti uses your goals and skills
to connect you with their ever increasing array of over 200 active programs with millions
of bounties already paid out.
Join Intigriti’s vibrant and growing community today, create an account via the link in the
video description.
If you enjoy this kind of video make sure to help me out by mutilating the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on how
to hack an airgapped system.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.