Hello, World!
RTX4090 is a password cracking beast, Hackers Steal sensitive documents from Iran’s nuclear
program, And pro-Russian DDoSers are apparently getting paid.
That’s all coming up in today’s roundup of cyber security tech news.
The RTX4090 has made headlines for various reasons, and now there’s there’s something
new, turns out it’s pretty good at cracking passwords.
For example, it can brute force an 8 character long windows NTLM password hash in just 42
minutes, and by the way that’s a password consisting of upper and lower case characters,
numbers and even the top row of special characters.
So, when benchmarks show that the 4090 is twice as good as Nvidia’s previous flagship,
that seems to apply to password cracking as well.
However, should you care?
I mean, how relevant even is password cracking?
Well, for a hacker to even attempt to crack one of your passwords they first have to obtain
it’s hashed version, probably from a data breach, they’d then load it into hash cracking
software like hashcat.
And at this point they’re probably not going to do an exhaustive brute force against every
possible password combination, because that would just take ages - and cybercriminals
much prefer low hanging fruit, so they’ll instead perform a dictionary attack, testing
hashed passwords against a wordlist of the top few million most common passwords.
The problem, is that as GPUs get faster, the definition of “low hanging fruit” changes,
miscreants can reach higher up the metaphorical password tree and crack more passwords.
To put it into perspective, the 4090 is 8 times faster than a 1080 at calculating hashes
- granted the 1080 was released 6 years ago, but in that time the hashing methods used
by companies to scramble your passwords likely won’t have changed.
This all makes the idea of setting up a password cracking rig an increasingly attractive proposition
for cyber criminals, sure it’d cost quite a bit to pick up a few 4090s, assuming you
can even get your hands on them, but it’s not like cyber miscreants don’t have money
to spend, in a previous video we saw a case of hackers willing to burn $15 thousand dollars
on drones just so they could have an attempt at landing WiFi hacking gear on the roof of
a financial company.
And unfortunately, there is a lot of money to be made from a correct password.
Remember the colonial pipeline hack, which caused fuel shortages?
It’s thought that whole drama was caused by a careless employee who reused their password
to a valuable corporate VPN, on a site which then suffered a data breach.
The miscreants who realised how valuable that password was, earned a $4.4 million dollar
ransomware payment from the colonial pipeline company.
And, reusing passwords is arguably worse than just having individually insecure passwords.
Let’s say for example you were using the password ‘pizza123’, on a website which
suffered a data breach, the worst that could happen is that your account on that particular
site would just get pwned.
But if you reused ‘pizza123’ across a dozen different accounts then miscreants would
be able to do quite a bit of damage.
And - this isn’t theoretical, this is pretty much what happened to the news website ‘fastcompany’
last month.
They reused the password ‘pizza123’ across a dozen different wordpress accounts, giving
a miscreant the ability to vandalise their website and send rather rude Apple News notifications
to all of their subscribers.
So yea reusing passwords is a bad idea, the fact that many people do, is probably one
of the main reasons why a cyber criminal might want a password cracking rig in the first
place.
There are more niche uses of course, for example, an attacker might want to crack the password
to your Windows PC.
A case of this was recently documented by Symantec, where hackers were targeting Honk
Kong government organisations with mimikatz - a tool capable of pulling password hashes
from memory.
Iran’s nuclear energy program is run by the “atomic energy organisation of Iran”
- now these guys are pretty controversial, so much so that a decade ago Israel and the
US collabed to target Iran’s nuclear program in what came to be known as one of the most
famous hacks of all time.
But now, Iran’s nuclear program is back in hacking news for different reasons.
A few days ago a hacktivist group calling themselves “Black Reward”, which was only
recently set up alongside all the protests going on in Iran, hacked an email server run
by Iran’s “Atomic Energy Organisation”, they stole a hundred thousand emails, totalling
50 gigabytes.
After which, they sent a mass email to all the organisation’s employees with an ultimatum
for the Iranian government - release all political prisoners within 24 hours, or we’ll publish
the contents of your email server for the world to see.
It didn’t come as much surprise that the government wasn’t willing to negotiate,
and so “Black Reward” published the data dump, which turns out to be, pretty spicy.
Included in the dump are photos and videos of Iran’s nuclear sites, technical drawings,
photocopies of the passports belonging to Russian engineers working in Iran’s nuclear
program, and even documents discussing the best way to transport radioactive material
between Russia and Iran.
This is definitely one of the more interesting data dumps I’ve covered, but exactly how
useful it would be to Iran’s adversaries, is kinda hard to say - whilst it doesn’t
look like there’s been any bombshell discoveries resulting from this leak, it is quite fresh,
so there might be some useful nuggets that just haven’t been discovered yet, I mean,
there are 100 thousand emails to go through.
But, who is “Black Reward”?
This group only appeared about a month ago - with their debut hack being the defacement
of various Iranian websites.
Since then they’ve been rather busy, they sent 5 million text messages to Iranians,
urging them to join the protests - they also hacked an email server belonging to Iranian
state TV network Press TV, setting up a dark web site where people can explore those emails…
and of course their latest operation being the hack of the “atomic energy organisation”…
Which published a statement in response to their email server being hacked, they claim
that it was perpetrated by a “specific foreign country”, which by proxy of course is an
allegation that “Black Reward” is state sponsored.
How likely is that?
Well, this could just be an empty accusation illustrating Iran’s unwillingness to accept
that their own citizens may want to work against them, which many of them obviously do.
But in fairness, a couple of countries have gone after Iran’s nuclear program before,
so a round 2 wouldn’t surprise anyone.
But is there any real hard evidence that “Black Reward” is state sponsored?
Well, no.
That being said, this group does seem like it’s run rather professionally, almost,
dare I say, suspiciously so.
Their tweets and telegram posts are written in a very direct way, there’s no memes or
childish insults.
The dark web site they set up to host leaked emails from PressTV is very clean and well
put together, and in their hack of the “atomic energy organisation’s” email server they
even went so far as to go through the dump and clean it of “advertising, spam, and
phishing emails”, publishing the juicy bits only.
None of this is in any way proof that “Black Reward” is state sponsored - but they do
contrast themselves with pretty much all hacktivist groups we’ve seen on this channel, which
tend to be quite chaotic.
Whoever is behind this group seems to be experienced, thoughtful about how they conduct themselves,
it looks like they started the group with a plan.
And “Black Reward” has been, well - rewarded for their efforts, they’ve gained 100 thousand
followers on twitter and 50 thousand subscribers on Telegram.
And with the rate at which these guys are pumping out operations, I think we can expect
to see more from them soon.
There’s been an interesting development in the Russo-Ukrainian DDoSing saga, which
I’ve covered quite a bit here on this channel.
Pro Ukrainian groups have been DDoSing the websites of Russian businesses and vice versa,
ever since the war kicked off - the DDoS attacks are usually short lived and don’t have much
real world effect other than just to make headlines.
However, in what seems to be a first, one of the pro Russian groups engaged in all of
this, is paying people to take part, as in they’re handing out crypto payment to people
who DDoS pro Ukrainian organisations.
They have a prize fund consisting of a few thousand dollars which is dispersed after
successful attacks, the latest of which was a coordinated attack against American airports,
which I covered in a recent video.
The top prize awarded for that campaign was 80 thousand rubles, or $1300 - it’s not
much, well - I mean, who wouldn’t want an extra $1,300, but this isn’t headline making
amounts of cash that’s going to attract an army of script kiddies to become pro Russian
DDoSers.
However, where that money comes from, is a bit of a mystery, it doesn’t look like they’re
crowd funding it… and I think it’s quite probable that this group has some kind of
a benefactor, perhaps a Russian cybercriminal who just has money to burn - or I suppose
there is a chance that just there is no money, and this is just a ploy to get people to join
in.
Regardless, miscreants who want to get involved have to turn to a Telegram bot called ‘DDoSia’
- which’ll ask them how they want to get paid, before it generates an executable which
can be run on windows - and a couple python scripts for Mac and Linux.
I couldn’t find any specific terms regarding how people are paid… the Telegram channel
seems to focus moreso on posting pictures of bears.
DDoSia was launched in August, and it seems to take inspiration from the Ukrainian equivalent
tool called disbalancer - the concept is pretty much the same, the only differences being
Disbalancer targets Russian organisations and their users aren’t paid.
And I feel like I have an obligation to repeat my stance on this for people new here, getting
involved in all of this is a bad idea, firstly it’s probably illegal, secondly even if
it isn’t your ISP could disconnect you, and thirdly, even if we disregard points 1
and 2, downloading any level of “hacking tool” which runs on obfuscated code and
gives some unknown person control direct over your internet connection will always be a
bad idea.
This video is sponsored by PCBWay, the complete solution for all your PCB Fabrication and
on demand 3D printing needs.
From standard PCBs to the more advanced varieties, PCBWay provides granular control over every
element of your PCB.
With superfast turnaround times you’ll be spending more time creating and less time
waiting on packages.
PCBWay also offers on demand machining, from CNCing and sheet metal cutting to 3d printing
and injection molding, there’s an array of materials to choose from, and of course,
superfast turnaround times.
Sign up now using the link in the description to get a $5 coupon, which can be used site
wide.
As always thanks for watching, and I’ll see you in the next video, have a good one.