Hello, World!
It's finally happened, screenshots showing the control center of the Pegasus spyware
have finally been leaked, which reveal just what this infamous malware is capable of.
So, Pegasus spyware has been in the news a lot over the last few years, but we've never
seen what it actually looks like behind the scenes, until now.
To give you a quick reminder, this spyware is developed by 'NSO Group', it primarily
targets IOS and Android devices, and - it's very good at it.
Pegasus has been known to take advantage of zero click exploits, enabling a victim's device
to be hacked without them even knowing.
Pegasus is sold to governments all over the world, for (well - on paper at least), legitimate
uses, such as, targeting terrorists, kiddy fiddlers and so on.
However this malware often makes the news when governments allegedly use it to target
human rights campaigners, journalists and so on.
The rabbit hole on Pegasus runs very deep, I can't cover it all here, but I'll link some
of my previous videos on it below.
However - in a nutshell, Pegasus spyware enables quintessential 1984 level surveillance - and
thanks to recent screenshots being published we now know what this threat looks like.
The first thing that comes to mind when looking through these screenshots, is just how awful
the interface is.
It looks like it was designed to emulate software from cringy hacking films - it's obvious this
billion dollar company didn't reinvest much into UX, but anyway - the interface is really
quite revealing, it shows that once a victim has been infected with Pegasus, an operator
can do a number of things, like view the victim's messages from various apps, even the encrypted
ones.
You can see what looks like different facebook and whatsapp group chats a victim is in, and
full transcripts of each.
In another screenshot you can see that Pegasus can not only record calls, but it can turn
a phone into a listening device, recording the device's surroundings.
In the camera tab, operators can turn on a victim's camera and take photos.
And of course a target's location can be tracked via GPS, creating a complete map of their
movements.
Unfortunately there's a lot these screenshots don't show - I'd be curious to see what miscellaneous
features Pegasus has.
It's well known that Pegasus apparently has a self destruct feature, automatically removing
any trace of the spyware if the victim's phone hasn't connected to the command and control
server in a few days.
So, all these screenshots come from a presentation the Israeli police were apparently making
for their government, to show them just how useful Pegasus could be to them - this was
way back in 2014.
So these images are 8 years old, but the reporter who published them said that according to
his sources, the UI is still "extremely similar", "though the colours are different now".
Next up, in a rare and surprising W for the Tor Project's ongoing battle with the Russian
censorship machine, the Tor website has been unblocked in Russia - not something I ever
imagined I'd be covering.
So Tor's website was initially blocked last December when a Russian "prosecutor" alleged
that Tor allowed people to visit "sites that host materials included in the Federal List
of Extremist Materials" - which whilst this shouldn't be a reason to block Tor - his allegations
were probably true I suppose, the courts agreed with him and Tor's website was blocked in
Russia.
And just so we're clear this ban only covered Tor's website, not the Tor service itself
- but more on that in a second.
The ban on the website persisted until recently when it was overturned.
Now - if you're hoping the overturning of this decision represents some kind of shift
in policy on censorship...
I have bad news.
Whilst the ban was lifted, it was only done so because the lawyers representing Tor, found
a technicality that was overlooked in the original judgement, the "court session [] passed
without the participation of the site owners", which in Russian law is a "violation" - and
so the lawyers lodged an appeal, resulting a new court judgement, which overturned the
block.
However, this reversal in decision will obviously have no effect on Russia's long term ambition
to exert more control over the internet.
It seems like every few months Russia unleashes a new wave of VPN bans.
However, blocking the Tor service itself is much more tricky - Russia has blocked all
tor nodes, after all those are publicly known and easy to block - you can literally just
google and find a list of all tor's nodes.
However Russia has been much less effective at blocking Tor bridges, these are effectively
tor nodes which aren't public, and exist to help people circumvent Tor blocks.
The only country which has been able to block these Tor bridges is, you guessed it: China!
Thanks to their internet infrastructure having been built from the ground up with censorship
in mind, it's design is a lot more centralised, so it's much easier for them to block things
- Russia on the other hand has more decentralised internet infrastructure, which makes blocking
a lot more difficult.
When Russia wants to block something, the government has to tell ISPs to do the dirty
work for them, which has very inconsistent results given each ISP will use a different
blocking technique.
This is obviously something Russia wants to change, whether they'll manage to - well you'll
just have to subscribe to find out.
Next up, cyber criminals are being forced to "improvise, adapt, overcome" after Microsoft
has finally started blocking office macros by default.
Malicious Microsoft office macros make regular appearances on this channel, to the point
where they're getting pretty boring to be honest.
But you might not have to hear about them for much longer because cyber crooks after
finding new ways to hack into computers, leading to a 66% drop in the use of macros over the
past few months.
So for the uninitiated, Microsoft office macros have been a cyber criminals best friend over
the past few years, as they've enabled hackers to embed malicious code within Excel or Word
documents, setting the scene for a very believable social engineering trick which typically involves
cyber crooks sending phishing emails, asking someone in admin to "check the attached invoice",
an unwitting victim would download and open up the document - which would then encourage
them to tap 'Enable Content" in order to view the mystery invoice.
This button is the only safeguard Microsoft implemented, standing in the way of malicious
visual basic code executing - and if executed it could do any number of malicious things.
That being said, macros can be used legitimately, albeit by a minority of business customers
to automate certain tasks, and because these business customers are very important to Microsoft,
they opted not to kill macros outright, but rather implement changes so documents downloaded
from the internet are unable to run macros by default.
So how have miscreants adapted after losing their favourite toy?
By switching to using malicious lnk files, otherwise known as shortcuts, recently the
use of them has skyrocketed.
Other than doing the obvious, pointing to another file, shortcuts can do pretty much
anything a run prompt can do, like running something on the command line or a Powershell
script.
But, the big reason why cyber criminals love shortcut files so much, is that for some strange
reason Windows has a feature whereby you can change the icon of a shortcut to anything
you want.
Making them perfect for social engineering - the only giveaway being the little shortcut
symbol in the corner, and the filetype saying "shortcut" - though in fairness these two
things are easy to miss, and if you weren't educated on shortcut files you probably wouldn't
even notice them anyway.
The situation isn't helped of course by the fact file extensions are hidden on windows
by default.
Aside from abusing shortcuts, miscreants have developed another trick: completely bypassing
Microsoft's security changes to Macros.
So Microsoft's changes prevents office documents downloaded from the internet from running
macros - windows does this via a "mark of the web" attribute which is automatically
appended to anything you download from the internet, it's kind of like a danger sticker.
But miscreants figured out they can prevent their malicious office documents from being
contaminated with a "mark of the web" attribute by simply zipping them beforehand - because
certain zip extraction software simply won't apply this attribute to its containing files.
The problem is worse with ISO archives, because they use the FAT32 file system, which is simply
incompatible with the "mark of the web" attribute, as it only works with NTFS file systems.
Thus office documents hidden within an ISO archive, whichever extraction software is
used, won't inherit the "mark of the web", and so will run just fine.
So, as it turns out, we probably haven't seen the last of the malicious office macro, but
at least it won't be popping up quite so frequently as it has done in the past.
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching, sources can be found in the video description, stay tuned
for more hacking videos and have a good one.