Hello world,
The largest ransomware attack of 2021 has just been perpetrated, this operation has
infected thousands of computers worldwide, and has already crippled some businesses - this
attack looks pretty brutal,
A coalition of international law enforcement agencies have set their sights on certain
VPNs
And governments in particular countries keep unplugging the internet, for a strange reason.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
The largest ransomware attack of 2021 has just gone down. Thousands of computers have
been infected in one single swoop - this is pretty big news and the attack is still ongoing.
At the center of the drama is a company called Kaseya, they provide IT management software
to businesses who need to keep tabs on all of their computers.
Specifically their Kaseya VSA software has been hit with a supply chain attack. Meaning
cybercriminals have somehow managed to inject malicious code into a software update. Kaseya
VSA is a remote monitoring tool, you can think of it as a kind of ‘remote access tool’
or RAT - it allows complete unfettered access to computers it’s installed on, which is
useful for IT technicians to diagnose and fix problems remotely.
The thing is, many companies don’t have the resources to manage their IT systems in
house, so they outsource this task to MSPs (managed service providers). These MSPs often
manage the systems of hundreds of other companies. You might be starting to see where this is
going, if an MSP which uses this software to manage their clients gets infected - then
all of their clients are open to potential infection.
So, whilst Kaseya themselves are reporting only 40 of their customers have been infected,
the true number of infected computers is a hell of a lot more. We don’t yet know specifically
which companies have been infected, though 500 co-op supermarket stores in Sweden have
been forced to close after their checkout system was ransomed. This chain was a client
of one of these MSPs which was hacked. Most infected companies are going to want to stay
quiet about any intrusions.
The ‘managed service provider’ subreddit is absolutely buzzing over this attack, some
users are reporting that the MSPs they work for have seen thousands of endpoints infected,
one endpoint means one client computer.
It would seem the rEvil ransomware gang is responsible for this mess. We don’t know
if rEvil perpetrated this attack themselves or if it was one of their affiliates. If companies
do start paying these ransoms, then this single attack becomes very lucrative for rEvil as
they’re demanding anywhere from a few thousand dollars up to a few million. rEvil makes an
appearance quite frequently on this channel, but if you’re new here, rEvil is the world’s
most successful ransomware gang, they were recently responsible for the attack on the
US nuclear weapons contractor sol oriens.
Kaseya has been forced to completely shut down their cloud infrastructure to stop the
malicious updates from spreading, and they advise customers to completely power down
their servers. This is pretty bad news for Kaseya themselves, they’re planning to go
public later this year, whether that IPO will still go ahead I’m not too sure. The solarwinds
supply chain attack caused solarwinds corp to lose 40% of their market value overnight,
whilst this attack isn’t quite as severe as solarwinds it is still up there. Also Kaseya’s
community forums have mysteriously gone down, some people are suggesting the site has just
been given the hug of death, but others are suggesting Kaseya would rather people didn’t
discuss this hack.
More details will transpire in the coming days shedding more light on this attack, but
it looks really bad. This is one epic mess, just imagine being one of these managed service
providers, and having hundreds of angry calls from all of your clients blaming you for not
properly securing their systems - and at the same time having to restore thousands of computers
from backups - all without the help of your remote management software. Some redditors
are even offering to give up their weekends and help their fellow redditors recover from
the carnage. In any case, this could cripple some businesses.
Governments of the world have started an all out offensive on VPNs - kind of - well, not
really. A VPN service, supposedly used almost exclusively by cybercriminals, has been shut
down and raided by an international coalition of law enforcement agencies. The operation,
led by the Dutch national police saw servers belonging to the service ‘DoubleVPN’ seized
and impounded.
The main feature of DoubleVPN was that they offered multi-layer VPNs, the idea being that
instead of bouncing traffic off a single server, traffic would instead be routed between 2
or even 3 servers before it reached its final destination. This is done in an effort to
make the service more anonymous, as no single server will know both the source and destination
ip of a packet. Other more mainstream VPN providers like NordVPN offer a similar feature.
However, the usefulness of this feature is questionable, at first glance it sounds a
lot like tor which also bounces packets around a few servers before they reach their destination.
But tor is decentralised, so no single entity controls all the servers in the chain - or
at least that’s the assumption. With a doubleVPN feature, it’s the same company which controls
the whole chain of servers, so the claim that this makes the service more anonymous is weak.
DoubleVPN was quite expensive, starting out at $25 for a monthly subscription, or $42
if you want that triple action routing. In their sales pitch they defend their high prices
by saying “Ask yourself a question: where do free and cheap VPN services get money to
pay for their expenses?” Obviously implying that cheap VPNs must sell your data or something
to that extent. Whether that’s true or not, it is believable - VPNs have become super
cheap. Though I would argue that bringing this up is simply a ploy to justify their
super high prices, psychologically if you’re paying so much more a month, you must be getting
a better service, right?
DoubleVPN also asserted they implemented no “logging of client activity”. This claim
turns out to have been a little dubious, the now seized domain displays a typical seizure
splash page, interestingly, it also notes that law enforcement “seized personal information,
logs and statistics kept by DoubleVPN about all of its customers”. Seemingly mocking
users by adding “DoubleVPN’s owners failed to provide the services they promised”.
And that “The investigation regarding customer data of this network will continue.”
Ouch, paying 42 dollars a month for a VPN which logs your activity, talk about buyer’s
remorse… We can only speculate on why doubleVPN failed to keep their promise of no logs, maybe
they just couldn’t be bothered to implement configurations to match their promises, or
perhaps they were planning some kind of exit scam in the future, in which they would threaten
to release customer’s logs if they didn’t pay a ransom? In either case it never ceases
to amaze me why criminals use services like VPNs or encrypted messaging apps that are
quite obviously marketed at the criminal underworld. These businesses are to law enforcement what
lamps are to moths - they attract so much attention you’d have to be a pretty dumb
criminal to use them. I can’t understand why a criminal wouldn’t just use already
proven services like tor - as far as anonymity goes, that’s your best bet, it also doesn’t
cost $42 per month.
There’s no evidence that law enforcement agencies are going after VPN services as a
whole, as VPNs aren’t illegal last time I checked, however this service in particular
was directly marketed to criminals, so I’m assuming that’s why it was targeted, presumably
for the crime of aiding and abetting miscreants.
In a rather strange case, Syrian and Sudanese governments have been observed pulling the
plug on internet access to their entire countries - what’s new, I hear you ask? Authoritarian
governments cutting off internet access is nothing to be surprised about, this was probably
done in an attempt to suppress dissent or something along those lines.
Apparently not, internet access has been restricted to stop students cheating in exams. Cloudflare
noticed at various points over the last few weeks internet traffic for both Sudan and
Syria has mysteriously tumbled to zero. These cut-outs correspond to dates for exams in
the countries. In each instance the internet was suppressed between the hours of 4am and
8:30am in a bid to prevent any last minute sharing of leaked examination papers before
exams.
Papers leaking just before exams is a real issue, it happens routinely here in the UK,
as you’re relying on every school in the country to play by the rules and it takes
just one teacher in one school to mess everything up. However, shutting down the entire internet
for everyone in the country seems a bit drastic. After all, people use the internet for things
other than just leaking exam papers - by shutting off the interwebs you’re essentially crippling
your country’s online economy, if only for a few hours.
If you enjoy this kind of video make sure to help me out by tapping the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next, go check out my previous video on why google has delayed the death
of the cookie.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.