Hello world,
A Russian cyber crime forum is offering 100 thousand dollars in prize money to whoever
can come up with the best scam
We finally know exactly how the Dark Side ransomware group broke into the colonial pipeline
And for some reason Norton 360 antivirus is going to start mining cryptocurrency.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news. A top Russian cybercrime forum is running
a competition. I was quite surprised when I read about this, but apparently this kind
of thing is very common. The contest calls on forum members to write research papers
on novel new methods of targeting cryptocurrency users. For example “ways to steal private
keys and wallets, unusual cryptocurrency mining software, smart contracts, non-fungible tokens
(NFTs)” etcetera, etcetera. The forum owners have put 100 thousand US dollars in prize
money up for grabs, and a reputable member has recently added 15k to the prize pot.
Any papers submitted will be made publicly available to the wider cybercrime community,
so it seems to be a real community effort - if that’s a good way to put it? This is
being reported by intel471 - a threat intelligence company which frustratingly hasn't mentioned
which forum is actually running this contest, presumably intel471 have undercover accounts
on various blackhat forums monitoring what goes on.
To give you a flavour of the kind of entries in this contest, one competitors’ paper
relates to creating phishing websites which help criminals harvest crypto keys and wallet
seed phrases - hopefully when the contest concludes, some of the more interesting papers
are leaked.
Surprisingly contests like this are commonplace on these kinds of forums. For example cybercrime
forum XSS runs a yearly competition, last year their competition asked forum members
to write an article on “zero-day vulnerabilities, developing exploits, APT attacks, and so on”
- this competition was apparently sponsored by the rEvil ransomware gang, rEvil is the
world's most successful ransomware group with a total market share of 11%. This all sounds
rather corporate, research papers, competitions, prize money, sponsors - I’d be lying if
I said I wasn’t slightly impressed.
Though, whilst the cybercriminals may look like they’ve been getting their act together,
there have been some major developments on the opposite side of the spectrum. The US
is now giving cybercrime attacks a similar priority to terrorism in terms of how they’re
investigated.
Why? Well, ransomware attacks in particular have recently been going a little crazy, there
was the colonial pipeline attack which caused fuel shortages, the apple schematic leaks,
irish healthcare hack which forced numerous hospitals to resort to pen and paper and the
world's largest meat producer which supplies 20% of America’s meat was temporarily shut
down just a few days ago. It seems every other day some major ransomware attack surfaces.
In fact, to make things sound even more crazy, the security company Sophos commissioned an
independent survey of 5000 IT managers of companies with between 100 and 5000 employees.
51% of them reported their company had suffered a ransomware attack in the last year. It’s
mind boggling, I almost struggle to believe it. And this research was conducted in May
last year, so I’d imagine those figures will have gotten worse, not better.
After hearing those numbers it shouldn’t come as much of a shock that the US has created
a new task force based in Washington to coordinate investigations of various cybercrimes, this
includes cases which involve illicit forums, bulletproof hosting services, botnets, money
laundering - and interestingly ‘cryptocurrency exchanges’ is on this list, some people
think this signifies an intensifying of cryptocurrency scrutiny - I’m not too sure about that as
this is only a directive concerning centralising of cases which involve crypto exchanges, rather
than wholesale going after them, but maybe I’m not reading between the lines.
The whole point of this is that by centralising investigations instead of having a multitude
of agencies investigating different cases, you can track “cases regardless of where
they may have originated in the country, so you can make the connections between actors
and work your way up to disrupt the whole chain” - or at least that’s the plan.
In addition to this new front being opened up, Biden is meeting with Putin later this
month. This could be significant as it’s said Biden will bring up the whole ransomware
issue as much of the time it seems to emanate from Russia. This isn’t necessarily an allegation
that Putin is orchestrating it, but rather an accusation that Russia is doing little
about the problem. The narrative from Biden will be that Russia whether purposefully or
via wilful neglect has created a safe space for cybercriminals to conduct their international
operations from. It’ll be interesting to see if this diplomatic pressure changes anything
at all.
Speaking of places to conduct your international operations from.
We all have some server running something somewhere, whether that’s in the form of
a website or a dinky minecraft server, here’s why you might want to switch them for free
to today’s sponsor, linode. Linode is a totally customisable cloud hosting platform
that grows with you, from hosting small personal projects to enterprise scale neural networks,
if it runs on linux it’ll run on linode.
Linode launched way back in 2003, that’s 3 years before AWS was even a thing, Linode
doesn’t spend a second on side hustles like grocery chains or reading you bedtime stories,
cloud computing is what they do best, and is their only focus. Linode is offering all
of you guys $100 in free credit just for signing up, claiming your $100 is the easiest decision
you’re going to make today, use it to spin up a minecraft server, set up a pentesting
lab, instantiate your own VPN, the possibilities are endless. They have 24/7 phone support
(which is a godsend in the world of servers) so you’ll never be left out in the cold.
Go to linode.com/seytonic or click the link in the description to claim your $100.
We have new developments regarding the origins of the colonial pipeline hack. These new details
will surprise no one. According to a cybersecurity consultant who was brought in to respond to
the attack, Darkside’s entry point was: a single compromised password.
Lets not forget, this pipeline provides 40% of the East Coast’s supply of fuel, the
shutdown caused a mass run on gas stations - and it was all down to an old compromised
VPN account not being pruned, you see - employees at colonial use VPNs in order to remotely
access the company network, the account in question was no longer in use, but it was
still active.
During a post attack investigation, this account’s password was found inside a database of leaked
passwords on the darkweb - so it’s postulated that the employee who once used the account,
re-used the same password for a different account which was then hacked. This is just
an educated guess however, investigators say they may never know exactly how the password
was procured. Given the VPN didn’t use 2FA, getting in was as simple as keying in the
credentials, that being said, how the attackers figured out the username is still a mystery.
However there’s been yet another development in the colonial pipeline saga.
A report by Inky, an anti-phishing technology company shines a light on just how opportunistic
some cybercriminals can be. Within just weeks of the colonial hack, miscreants started capitalizing
on the headlines and fear. Employees at a number of companies began receiving spear-phishing
emails pretending to be from their IT department. The emails said “Given the recent ransomware
attack against Colonial, blah blah blah… is requiring all employees to run a new update
to detect and prevent the latest strains of ransomware.”
The email linked employees to a convincing looking website prompting them to download
a mysterious file. Inky describes just how convincing this phishing attack was. The malicious
site used the target company’s logo and imagery, and it looks pretty modern and authentic.
The totally non-suspicious sounding file “Ransomware_Update.exe” was in fact, malware, surprise, surprise - in
particular “cobalt strike” which is a legitimate pentesting toolkit which can be
used for a whole manner of mischievous things, like reconnaissance, executing powershell
scripts, recording keystrokes, taking screenshots, etcetera.
Cobalt strike is popular among cybercriminals, who tend to use cracked copies of the software
to exploit targets. Luckily this episode of the colonial saga seems to have been stopped
dead in its tracks, so we don’t know the exact intentions of the attackers. However
I think it’s a reasonable guess that this was ironically a ploy to install ransomware
on the victim’s network. Norton has announced they’re integrating
an Ethereum crypto mining feature into their Norton 360 antivirus product. Strange, usually
it’s malware mining crypto, not the other way around. They’ve come up with a really
original and imaginative name for this new offering, “Norton Crypto”.
Reading the press release I was hoping for some interesting unique selling point, but
it does seem to be just a bog standard Ethereum miner baked into an antivirus program. Norton
claims many antivirus programs often clash with mining software, meaning miners have
to disable security features, this is their main selling point apparently - but programs
can usually be whitelisted within antivirus software, so I’m not sure if this is such
a big deal. Also Norton will store any mined crypto in the cloud, which in their words
has the benefit that it “cannot be lost due to hard drive failure”, but then again
it’s standard practice to store your recovery phrase offline. It’s fairly clear that Norton
is clutching at straws here trying to sell this feature which no one asked for.
Besides, seasoned miners aren’t going to scramble to grab a copy of Norton 360, I can
only imagine Norton is targeting less savvy users who can be excited at the prospects
of earning a couple dollars extra a week. If Norton can recruit a small army out of
their 13 million Norton 360 customers, then it could be a decent money maker for them
- I’m assuming Norton will be creating their own pool and taking some kind of a commission
- and I would expect you’d be paying a hefty premium to Norton for the convenience of all
this.
At the bottom of the press release Norton says there may be certain hardware requirements,
which makes things more complicated because most computers will just run on integrated
graphics, meaning there’s next to no money to be made after electricity costs. And that’s
another issue, the less savvy people this will appeal to probably won’t understand
the economics of crypto mining in that electricity bills can easily eat up the majority of mining
income.
I’m obviously not sold on this, let me know in the comments if I’m missing something,
is there some revolutionary new feature I’ve skipped over?
If you liked this video make sure to tickle the like button, subscribe and join the notification
squad so you’re notified as soon as new episodes go live. If you’re looking for
something to watch next, go watch my previous video on how US Nuclear secrets were leaked
via quizlet - it’s ridiculous. As always sources will be linked in the description,
stay tuned for more hacking videos, and have a good one.