Hello, world!
First up in today's exploration of cyber security tech news.
A Dad has managed to take out an entire town's internet by mistake.
This story's actually been on my list for a while, but I just had to talk about it even
if it is a couple months old.
This all went down in a small, picturesque coastal town in the South of France, whose
name I'm not even going to try and pronounce.
It all kicked off when a local mobile phone operator spotted something odd, every day,
between midnight and 3am, a black hole in their coverage would mysteriously appear.
It was clear that something or someone was interfering with the signal.
And so, they reported the problem to the ANFR - this is essentially the French version of
the FCC, these guys are tasked with policing the electromagnetic spectrum.
The ANFR figured that someone must be jamming the 3g and 4g frequencies, so they sent a
technician to locate the miscreant.
Jammers work by spewing out noise on whichever frequency they want to disrupt, this makes
it hard for devices like phones to recognise legitimate communications.
But, a jammer can be located using a directional receiving antenna paired with a compass.
By moving the antenna in a circle you can paint a picture of the level of noise coming
from each direction - and then you just walk in that direction until you stumble across
the jammer.
The technician discovered that the jamming was coming from a single home - the culprit...
a Dad that couldn't get his kids to stop using their phones at night, and "After consulting
forums on the internet" he bought a "multi-band jammer" to do his parenting for him - and
in doing so had inadvertently prevented a good chunk of the town from using their "mobile
phone connections or wifi".
Of course, this is very illegal, and in France it carries a potential sentence of "6 months
imprisonment and 30,000 euro fine".
But judging from google translate's poor job it looks like he's gotten away with a 450
euro fine and confiscation of the jammer.
Which I think is fair, I doubt the guy knew he was breaking the law, but at the same time
you'd hope people have a bit of common sense.
I mean, when you find yourself half way across town, having trouble with your 4g connection,
you'd think it would cross your mind that, huh maybe it has something to do with the
jammery thing I bought of the internets.
The situation isn't helped by the fact that jammers aren't too difficult to buy on the
internet, you don't even need to dip your toes into the dark web - just search "buy
jammer" on google - and the very first search result is "jammer 4 uk".
This website sells jammers which work on various frequencies - they even sell GPS jammers - not
sure what the practical use of those is, unless of course you're an invading Russian army.
However the video testimonial on their homepage is the fakest thing I've ever seen [video]
I dunno, maybe this is too harsh, but this guy doesn't come across as someone who has
important meetings, surely this has to be one of those fiverr testimonials.
But if you want to read more about the French jammer Dad I'll link the article from the
ANFR below, it's kinda funny, this blog post is written almost like a novel, they've titled
it "THE TEETH, THE JAMMER AND TO BED!".
It's almost like this is the most exciting thing that's happened in their office in years.
Next up, after 14 of their members were arrested by Russian authorities just a couple of months
ago, rEvil - arguably the world's most infamous cyber crime gang is back - kinda, maybe.
This group has an eventful history, they've used their weapon of choice, ransomware - to
conduct some of the most well known financially motivated cyber attacks.
The obvious one being the Kaseya ransomware attack - where almost every company which
used certain Kaseya remote management software was held to ransom.
rEvil demanded $70 million dollars to free the one "million devices" they claim to have
infected.
These guys have also been responsible for attacking US nuclear weapons contractors,
so nothing too important then.
But like I said the party was shut down a couple months back, when Russian authorities
arrested 14 of the group's members.
Since then, they've been silent - until about a week ago when their dark web blog on which
they would leak data from victims that refused to pay ransoms - mysteriously reappeared.
This is significant because you can only host a site on a given onion domain if you hold
the corresponding private key, so any activity on this domain must come from a rEvil member,
or someone that somehow managed to get a hold of that private key.
Their domain now redirects to a new onion site which contains the data from previous
rEvil victims, plus a couple of new victims.
The apparently rebooted rEvil is looking for new affiliates to join their team, offering
them an 80% slice of profits.
However is this site really the work of rEvil members who managed to evade arrest, or could
there be another explanation.
For example, after the FBI took down rEvil servers last year - which I've done a whole
video on.
So a month after the FBI take down, researchers discovered their dark web site had been replaced
with - well I'm not sure what to make of this... it's in Russian, but translated, the page
is titled "rEvil is bad", along with some cryptic messages "They are not the masters
they think they are", "we have the skills and experience", "do you want to be with the
most qualified or losers", as well as a login prompt.
Now obviously this makes no sense to me, and I couldn't find any ideas from researchers
as to what this means.
Someone was obviously trolling, but whether that's rEvil members that had escaped arrest,
the FBI or another group that had hacked rEvil's servers, no one seems to know - but it does
at least suggest someone other than rEvil might have access to their site.
So this rEvil reboot could be the FBI just trying to entrap ransomware affiliates.
Or perhaps it's another cyber crime group altogether, which after gaining control after
rEvil's site simply decided to simply adopt the rEvil brand - which wouldn't be unheard
of, last year a cyber crime gang was found to be falsely operating under the name of
darkside.
The real darkside ransomware gang was really well known at the time for the colonial pipeline
hack, so this unrelated group was using the reputation of darkside to intimidate companies
into paying them 100 bitcoin.
No Russian And whilst we're on the topic of ransomware,
I need to put out a bit of a PSA and retract some of my previous advice, and thanks to
those of you that've been giving me a heads up in the comments about this.
So I had previously suggested that you could protect yourself from malware, or at least
to some limited extent, by installing a Russian keyboard layout on your computer - not necessarily
using it, but just having it installed in the background was enough.
Why?
Because Russian malware will often refuse to run on computers it thinks are located
in Russia.
This is to comply with the unwritten rule that so long as Russian cyber criminals don't
target Russians, they'd be left alone by authorities.
And so cybercriminals added code to their malware that would check what keyboard layouts
a potential victim had installed, and if it found Russian it'd just assume the computer
is located in Russia and then delete itself.
So this is why I suggested downloading a Russian keyboard layout, as a kind of a vaccine to
Russian malware.
But things have changed, and now this may not be such a great idea, if you do have a
Russian keyboard layout installed for this reason, now might be a good time to delete
it.
This is due to the emergence of "protestware" - this term seems to have only been invented
in the last month or so in response to a brand new phenomenon - in which maintainers of open
source projects have been protesting the invasion of Ukraine by adding little easter eggs for
their Russian users.
In many cases, these Easter eggs are relatively benign.
In one case the code checks if a computer uses a Russian timezone, and if true, it'll
just display an anti-war message.
But in another example, code was added to a popular open source project which after
determining a computer was in Russia by geolocating their ip, it would wipe files and replace
them with heart emojis - which I imagine is very inconvenient to be on the receiving end
of.
So... whilst these two examples rely on timezones and ip addresses to determine location, having
a Russian keyboard layout installed may not be the best of ideas, just incase that's the
variable software decides to use.
And protestware is more of a problem than it may seem because one open source project
may be a dependancy in a lot of other software.
And given a project may only be maintained by a small number of people, or perhaps even
just a single person, it doesn't take many people to create absolute havoc.
However, so far this problem has been relatively contained - other than a couple of incidents
last month this has been a non issue.
But yea, remember, no Russian.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace which makes it super easy to spin up servers
with preconfigured software.
For example, use Linode's pi-hole app to set up a DNS sinkhole, that you can use to block
ads across all your devices - and yes I recognise the irony in promoting ad blocking within
an ad!
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always, thanks for watching, you know the drill, make sure to tickle the notification
bell and follow me on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.