Hello world, a ransomware insurance company have themselves been attacked with... ransomware.
Apple’s findmyiphone feature has been hacked
How you can potentially stop ransomware dead in its tracks with this one simple trick
The new apple airtag has been jailbroken
And bogus vaccine certificates overtake the dodgy vaccines for sale on the dark web
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
A ransomware insurance company has been hit with… a ransomware attack. Ironic. The victim
here, AXA insurance, had roughly 3 terabytes of data including customers’ medical records,
passport scans, and a myriad of other things encrypted as well as stolen by the cybercrime
group Avaddon. In addition to holding them up for ransom, Avaddon has seemingly started
DDoSing AXA’s company’s website, Avaddon did say back in January that they’d initiate
DDoS attacks against their victims if they didn’t come to the negotiating table and
pay up.
DDoS attacks don’t cost cybercriminals a whole lot to carry out, a few hundred dollars
at most. Given typical ransom demands are a few hundred thousand dollars at least, shelling
out for a DDoS attack on a victim acts as a bit of encouragement for them to pay the
ransom and is probably worth the investment on the part of the criminals. Especially when
DDoS attacks themselves cause a ton of damage in lost business on their own.
We don’t know how much money has been demanded from AXA and their public statements to the
media really aren’t all that interesting, they said they’ve set up a dedicated task
force to deal with the incident, etcetera etcetera, but there’s no acknowledgement
of the irony and comedy inherent in this situation, not so for those that’ve had their medical
records stolen though.
Interestingly this ransomware attack comes just days after AXA pledged to stop providing
ransomware insurance to companies, could this be retribution on the part of Avaddon, afterall
ransomware insurance is often seen as one of the great enablers of ransomware becoming
such an issue. Ransomware insurance typically covers the fee of the ransom itself along
with costs related to restoring data as well as business interruption.
There’s no word on whether AXA is going to pay the ransom, I wonder… does a ransomware
insurance company have ransomware insurance?
Apple’s “Find My Iphone” service has been hacked. This story is really quite interesting,
pretty much all apple devices work with the “Find My” Network, idea being if your
iphone, ipad, macbook or airtag, gets lost or stolen you can report the device as lost
via the FindMy app.
Then, Apple will use their network of over 1.5 billion apple devices out in the wild,
to find your lost device. The lost airtag for example will transmit bluetooth beacons
to other nearby apple products owned by random passers by. When another Apple device picks
up these beacons it’ll transmit them to Apple, which in turn, pings you the location
of where your lost gadget is. So this effectively uses everyone’s apple products as a kind
of lost property network.
Well now, it’s been hacked to provide unlimited upload of arbitrary data to apple’s servers
which can then be downloaded. Using the researcher’s open source tool on an esp32 development board,
you can emulate an airtag, and send any data using the FindMy network. This is a big deal,
because it provides a method of extracting data from environments without internet access,
anonymously. According to the researcher who developed this, Apple has done a really good
job of privacy here, meaning Apple can’t read the data sent by the lost device, and
apple doesn’t even know which airtags belong to your apple id. Also Apple doesn’t have
access to the decryption keys, only you do.
One use case of this project, could include exfiltrating data from airgapped systems.
If an attacker managed to breach a network using a malicious USB stick for instance,
and wanted to remotely retrieve data, this could potentially be an option if the network
itself doesn’t have internet access. A major caveat here though is that you can only exfiltrate
3 bytes a second, a pretty big downside. A more realistic use case of this, could be
using the FindMy network to transmit data from iot devices.
The code is publicly available, and it looks fairly simple to get working, I’ll link
it in the description. The researcher has said it’d be quite difficult for Apple to
defend against this kind of misuse because of the level of inbuilt privacy and security
in the system.
With this one simple trick you can potentially protect your computer from ransomware, and
no I’m not about to sell you some antivirus software. This idea, is kind of genius, and
I got it from krebsonsecurity.com. When we hear of ransomware in the news, a lot of the
time it tends to originate from Russia. Why that is, is debatable, some say that the Russian
government is turning a blind eye to cybercriminals or even protecting them, whether this is true
or just politics I don’t know - but it doesn’t matter here.
The point is, Russian authorities will usually only initiate a cybercrime investigation against
a Russian citizen, if a report is filed by a company or individual that lives in Russia.
So, in order for cyber criminals to protect themselves from the law, Russian ransomware
often runs a language check. If the ransomware detects that a Russian language pack is installed,
it’ll usually just assume the computer is based in Russia, nope out, and delete itself
instead of encrypting the victim’s files and demanding bitcoin.
This doesn’t mean you need to learn Russian and change the default language of your computer,
you just need to have the Russian language pack installed and that’ll probably be enough.
Will this protect you 100% from ransomware, of course not, but I’ve covered various
ransomware attacks on this channel before and have seen instances where code samples
show language checks hidden within Russian ransomware code. So I reckon this is probably
worth doing, it doesn’t cost you anything and only takes up a few megabytes, on windows
just head over to ‘language settings’, tap add language, search for Russian, hit
install and you’re done.
If you like hearing about cybersec news, tips and tricks do let me know by hitting like,
and turn on sub notifications so you’re notified as soon as new episodes go live.
The airtag has been successfully hacked, just a couple weeks after it’s launch, ‘stacksmashing’
on youtube managed to successfully modify the firmware of an airtag and program a little
surprise into it. Airtags use the same bluetooth chip as many bluetooth development boards,
one of the nrf family of chips.
This chip in the airtag, comes locked down by Apple, meaning the ability to retrieve
the firmware from the device is disabled. However, by using a technique called voltage
based fault injection he was able to jailbreak the thing.
Voltage based fault injection otherwise known as glitching basically means removing power
from the device for a very miniscule amount of time, which allows you to skip certain
instructions.
By essentially brute forcing and skipping random sections of code, you’re eventually
able to skip the part of code which checks if the debug tools are disabled - and thus
access the chip with debug tools en-abled and gain unauthorised access to the device’s
firmware.
After successfully hacking the airtag he modified the code, and turned an airtag into a dedicated…
rickrolling nfc tag, because why not. His video with the full explanation will be linked
below.
Whilst the race to vaccinate everyone rages on, the darkweb is cashing in on the situation
as it is now possible to purchase vaccines on the darkweb, along with phony proof of
vaccination papers all in exchange for bitcoin. In one instance a seller is offering 10 doses
of the Moderna vaccine for $2000, but how do you know you’re actually getting a real
vaccine and not a vial of cat piss? You don’t, that’s the beauty of the darkweb. Some doctor
could be pilfering legit supplies, or some guy is just urinating into bottles, you just
don’t know.
You have been able to buy these wares on dodgy sites for a few months now, though interestingly,
darkweb sales of vaccines have decreased in recent weeks in favour of sales of bogus vaccine
certificates. Probably because in Western countries at least, it’s really not that
hard to get a legit vaccine if you’re in a high risk group, but given lockdowns are
easing up and some countries require vaccine certificates for travel, those documents are
becoming more valuable.
Speaking of value, Maltronics is a website, run by myself where you can find an array
of super cool pentesting products, our gear is used in over 100 countries and you can
get 10% off with code seytonic. Trusted by hobbyists, pentesters and educational institutions
you can learn more at maltronics.com
If you want to see more of this kind of video make sure to let me know in the comments and
turn those sub notifications so you don’t miss any hacking news. For behind the scenes
footage do follow me on instagram. As always sources will be linked in the description,
stay tuned for more hacking videos, have a good one.