Hello world,
For the first time ever hackers have been found using morse code to encrypt their malicious
files.
The largest crypto hack of all time has taken place, $600 million was looted, and the hacker
claims it was “just for fun”.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
A strange year-long phishing campaign has been uncovered by Microsoft researchers. This
is a weird one, in that it seems to be the very first example of hackers actively using
morse code to obfuscate their malicious files. It’s somewhat genius when you think about
it, what anti-malware software is programmed to be suspicious of a communication protocol
invented in the 1830’s, to transmit data over telegraph lines?
The scheme, used malicious email attachments, which were designed to look like excel spreadsheets
- given that they had “XLS” in the document name. In reality they are html files, it’s
obvious to anyone with a trained eye, but these emails were aimed at Karen in accounting,
not a company’s IT department. These aren’t the best crafted phishing emails I’ve seen,
the sender email looks ever so slightly dubious and the lack of content in the email body
isn’t too realistic.
Nevertheless the attachment itself is rather creatively put together. Opening the HTML
file will of course have it pop up in a browser window, though in trying to preserve the excel
camouflage - a greyed out excel document takes up the background. And a prompt appears asking
the user to re-enter their office 365 password - giving the illusion the victim’s login
has timed out. If you fall for the trick your password will be exfiltrated to a hacker controlled
server, it’s not quite clear how they’d proceed from there. Though given the current
trend, utilising the office 365 account to stage some kind of a ransomware type scenario
would be my guess.
In this attack, the bad actors were particularly adept at changing their code obfuscation techniques,
with Microsoft noting that over the year long escapade the “attackers changed obfuscation
and encryption mechanisms every 37 days on average, demonstrating high motivation and
skill to constantly evade detection and keep the credential theft operation running.”
This is where the morse code comes in, it was one of the many encryption methods employed
by the bad actors. As evident in javascript embedded within the malicious HTML file, a
section of the javascript maps morse code to ASCII characters. A long string underneath
contains a block of code the hackers here have hidden using morse code, as bleepingcomputer
explains “The script then calls a decodeMorse() function to decode the Morse code string into
a hexadecimal string. This hexadecimal string is further decoded into JavaScript tags that
are injected into the HTML page.”
Other than this being a bit of fun for the attackers to implement, the reason for going
to these lengths was to evade automatic malware detection mechanisms in place on the victim
PC which scan files looking for dodgy looking code, though of course to anyone with a bit
of knowledge, the contents of this HTML file do look rather sus. As usual with write ups
like this, Microsoft’s analysis only really explains the mechanism of this attack, we
are in the dark as to whether anyone actually fell for this phishing campaign. Whilst Microsoft
have only just published their writeup, this was rumbled on reddit about 6 months ago.
Unfortunately Microsoft hasn't attributed this campaign to any known threat actor, so
we don’t know who was behind it.
In the last few days the largest crypto hack ever took place. 600 million US dollars was
stolen from poly network. This is a strange story, the perpetrator claims he was doing
people a favour by stealing the coins, that he couldn’t trust anyone to fix the vulnerability
he had discovered, and that by looting the crypto, in his words, he was “saving the
world”. He also adds it was done “for fun”. And yes, I’m just as confused as
you.
The victim, Poly Network is a Decentralised Finance platform that facilitates peer-to-peer
transactions with a focus on allowing users to transfer or swap tokens across different
blockchains. This is the largest crypto hack of all time, at least in terms of the value
of the spoils in US dollars at the time of the intrusion.
But how did our crypto hacker here plunder this fortune? I’m going to keep this explanation
as simple as possible. If you’re a crypto connoisseur and want to have a much more detailed
low level analysis, check the sources in the description. This wasn’t a trivial hack,
only made possible because someone reused a password or opened some email attachment
they probably shouldn’t have, no - the miscreant took advantage of a vulnerability in a poly
network smart contract. As IBM explains, “Smart contracts are simply programs stored on a
blockchain that run when predetermined conditions are met.” One basic example could be facilitating
a loan. Smart contracts have the potential to be incredibly useful because they’re
automatic, cheap, fast and generally inordinately more efficient than traditional contracts
executed by centralised organisations.
The hack was made possible due to a “mismanagement of the access rights between two important
Poly smart contract”. The hacker essentially tricked the network into thinking he had certain
privileges, enabling him to transfer large amounts of crypto held by the network - this
was all done without needing to compromise any private keys.
So 600 million dollars richer, presumably the perp will be spending the rest of his
days on some private island being hand fed peeled grapes by his many wives? Not quite,
given the blockchain is public, transactions are traceable, meaning any movement of the
loot would be trackable. And whilst crypto mixing services exist which aim to launder
coins tainted by illegal activities, 600 million dollars worth of crypto is way too much to
launder - it’s an almost impossible feat. The bad actor here has swiped a worthless
fortune.
Poly network asked miners and exchanges to blacklist the wallets holding the stolen funds,
soon after Tether froze 33 million dollars worth of coins. Tether is a stablecoin, these
coins aim to keep their value tied to a certain fiat currency like the dollar, as such they
usually reserve the right to freeze crypto wallets at will, “In order to remain compliant
with regulators”.
The writing was on the wall for our hacker at the center of the plot. Quickly realising
he’d never be able to enjoy his fortune, he decided to radically change tactics, or
at least that’s what it looks like. He ended up returning pretty much all the crypto. By
releasing a Q&A embedded within the blockchain, he explained his thoughts.
He claimed this was done “for fun” and transferred the tokens “to keep them safe”.
Usually, it’s the done thing for white hat hackers to report bugs they find in the wild
to the developers, though our hacker goes on to say “asking the project team politely
so that they can fix it? Anyone could be the traitor given one billion. I can trust nobody!
The only solution I can come up with is saving it in a trusted account”. Now this doesn’t
come across as very believable. Shortly after the initial hack, the attacker seemingly tried
to “exchange their holdings of a centralized stablecoin, USDC, for a decentralized one
like DAI in order to decrease the chances of the funds being frozen.”
When asked in the Q&A why he would do such a thing, if his goal was simply to keep the
coins safe, he responded “I was pissed by the poly team for their initial response”,
“they urged others to blame & hate me before I had any chance to reply” - I mean come
on, you reckon you can just steal 600 million worth of crypto and think people will give
you the benefit of the doubt? His response here, and the whole Q&A in general just screams
teenage angst, he seems really immature and turbulent.
In exchange for returning the cash, the poly network team quite surprisingly told the miscreant
"we believe that your action is white hat behaviour, we plan to offer you a $500,000"
reward. And added "We assure you that you will not be accountable for this incident.".
Now I’m just guessing of course, but it sounds like the poly network team were so
sure this hack meant armageddon for them, to suddenly start receiving the crypto back
bit by bit - it must have felt like a miracle. With most of the crypto already returned it
seems to me they wanted to encourage the culprit to return the rest, sweeten the deal and not
give him reason to change his mind. That being said, the bounty was refused by the hacker
for reasons unknown.
This hack exposes one of the major problems with crypto and smart contracts in particular,
if there are exploitable bugs hidden within the underlying code, then all hell could break
loose if someone manages to take advantage of the vulnerability. This is one reason why
certain blockchain platforms like Cardano opt to put an emphasis on “academic peer
review” to make sure code is thoroughly verified before it goes live.
Let me know your thoughts on this saga in the comments, were his intentions kosher all
along, or do you think he bit off more than he could chew, panicked and returned the crypto
in an effort to make his life easier in the event he was caught.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next go check out my previous video which explores a new dark web marketplace’s
bizarre marketing ploy of releasing 1 million credit cards publically to attract new customers.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.