Hello, World!
First in your roundup of hacking news…
For years Discord has been a useful weapon in the toolbox of many hackers.
Everyone from small scale cyber criminals up to Russian state sponsored hackers love
Discord, for the very simple reason that it’s great for hosting files.
Forget drop box or google drive, if you need to quickly send someone a file just drag it
into Discord, right click and tap copy - to grab a direct download link, which link never
expires.
Even if you delete the original message from Discord, that file remains permanently hosted
in the cloud.
Not only is this useful for us mere mortals to share stale memes, but cyber criminals
love this, because not only does it provide somewhere for them to host their malware,
but these links are direct download links - so there’s no annoying landing page that
makes a victim wait a couple seconds before downloading.
It also means that the links can be embedded within malicious scripts.
The icing on the cake though is that the Discord domain name is well trusted, so downloads
are less likely to be blocked by a victim PC, than if they came from some obscure Russian
file hoster.
All this has led to an absolute explosion of Discord being used to host infectious files.
But with a recent analysis finding that thousands of different malware samples are abusing Discord
to host malware, the party is coming to and end.
Recently announced changes mean that from now on, if you copy a download link from Discord,
you’ll find it has three parameters tacked on the end, one being an expiration timestamp
- because these links are now going to spontaneously combust after just 24 hours, so they’re
just not going to be all that useful to cyber criminals anymore, because for example, by
the time a victim reads a phishing email with a malicious Discord download link, that link
will likely already be dead.
However this won’t make a difference at all to downloading files within the Discord
client, as those links will automatically update when they expire.
Whilst these new parameters are already live, they don’t actually do anything yet, you
can just delete them and the download link works fine - however that’ll change next
month when this whole system goes live.
If you’re subscribed to this channel there’s a 0.2% chance that your sensitive personal
data has been stolen by a certain ransomware gang, that’s because 0.2% of you guys so
happen to live in the US state of Maine.
Who’s government has just admitted that it was hacked, resulting in the theft of 1.3
million of Maine’s residents' data.
And, given the state’s population is only 1.37 million, pretty much everyone in Maine
is affected.
The list of data stolen is pretty extensive, which is now in the hands of the CL0P ransomware
gang.
These guys exploited a vulnerability in certain software that Maine’s government was using
to transfer files.
This is most definitely not an isolated incident, earlier this year hundreds of organisations
started reporting they’d fallen victim to CL0P ransomware.
And all of them had one thing in common, they’d been using MOVEit - an enterprise grade file
transfer solution, it’s meant to be super secure, ensuring compliance with a bunch of
regulations, which is why a hell of a lot of government departments and businesses use
it.
But CL0P came across the holy grail of ransomware gangs, a zero day SQL injection vulnerability
in MOVEit, which gave CL0P access to sensitive data being held by governments and big businesses
that rely on it.
Maine’s government is only the latest victim to reveal themselves.
But there is some good news, CL0P hasn’t leaked any of the stolen data or even listed
Maine on their dark web site.
Instead they say, and bear with me here because the broken English is very broken “we now
delete more of 30 companies that are government”, which seems to be them saying they don’t
want to extort or publish the data of governments, like Maine.
This isn’t unheard of, cyber bad guy often avoid targeting governments because the consequences
of angering someone with unlimited resources, far outweighs the tiny chance they’ll cave
and actually pay the ransom.
But Maine isn’t taking any chances, the government is encouraging people to call a
dedicated hotline to see if their data is involved - though I can’t imagine the hold
times with over a million people trying to phone in.
In certain circumstances, like this, you don’t realistically have much of a choice but to
just cross your fingers and hope your data stays protected - but something you can actively
protect yourself from is misinformation and biased news.
This is where today’s sponsor ‘Ground News’ comes in.
Ground News is an independent app and website that compiles news articles into one place
so you can easily compare coverage.
I’ve been using the vantage plan with Ground News for my research because it helps me see
the full story from all perspectives.
For instance, this data breach story has more than 20 sources that mainly lean toward the
center, but given the 11% low factuality rating, it means there could be sensationalised headlines
in the mix.
I particularly like how I can see the ownership, factuality and bias labels for each source
which provides a new level of transparency.
For example, Mashable with mixed factuality says the breach was with the entire state’s
population, whereas Tech Radar with high factuality says nearly all state residents were affected.
Despite being the same story, it's framed slightly differently.
And of course you can follow the specific topics that interest you, like Cyber Security,
Hacking or Tech!
Right now they’re having their biggest sale of the year.
You can get 40% off their Vantage subscription if you use my link at ground dot news slash
seytonic in the description below, or you can subscribe to their Pro plan for less than
$1/month.
I really like what Ground News is doing and I hope you’ll check them out.
You’re going to love this story.
If you’ve ever found yourself casually browsing the dark web out of boredom, you will have
come across hitman for hire darknet sites.
There’s tonnes of them out there, but as is well known the ones that aren’t FBI honeypots,
are just outright scams.
But every so often, some idiot with a grudge who’s heard of the mysterious dark web,
downloads the Tor browser and orders one of these ‘hitmen’, only to end up in jail.
This is where ‘rentahitman.com’ comes in - it’s a clearnet site that parodies
dark web murder for hire services.
And as far as parodies go, this is a good as it gets.
“TIRED OF GETTING BULLIED?”, “RENT-A-HITMAN has assisted individuals just like you who
have been the victim of bullying at the gym, in the office, or at the club.
With a wide variety of solutions available, we ensure that your situation is resolved
accordingly with the proper care and attention it deserves” - the website has customer
testimonials, and even discount packages for seniors and group buys.
It’s obviously a parody site, I mean - they sell merch.
Surely no one is dumb enough to believe that this is an actual hitman for hire site, and
unironically fill out the contact form for a free consultation, right?
Well, think again, because the DoJ has just revealed, that on one summers afternoon last
year, someone requested a free consultation, going by the name “Jasmine Brown”.
The owner of rentahitman.com immediately contacted the FBI, who put Jasmine in touch with an
undercover agent, going by the name ‘Ace’.
The pair met up at a waffle house in New Orleans, where Jasmine explained that she’d been
having a feud with another woman over social media, and well - wanted her dead.
After they agreed on a price of just $1000 - which seems suspiciously cheap, Jasmine
paid a down payment of $100, after which she was arrested on the spot.
Jasmine - otherwise known by her real name ‘Zandra Ellis’ has just been jailed for
18 months.
But this, isn’t a one off case, the operator of rentahitman.com claims that over the years
he’s disrupted over 150 credible murder for hire requests.
White hat hackers have demonstrated how a keylogger hidden within a keyboard can abuse
Apple’s ‘Find My’ network in order to steal keystrokes.
As is well known, Apple’s ‘Find My’ network, harness the worldwide network of
all iOS devices in order to locate lost apple products.
After being separated from its owner an AirTag sends out frequent pings, which are picked
up by the iPhones of random passers by, which then tack on the GPS coordinates of the ping
and sends the data back to Apple, so the owner can track down their missing item.
But a couple years back, researchers reverse engineered the ‘Find My’ protocol, discovering
that Apple actually did a really good job of privacy here.
The location reports can only be decrypted by the owner of the missing item.
And because of how the ‘Find My’ protocol is designed, Apple can’t even see which
AirTags belong to your Apple ID.
Apple’s focus on privacy whilst laudable, inadvertently made possible some interesting
uses of the network.
Using a cheapo bluetooth development board it’s possible to emulate a bunch of AirTags,
encoding short strings of arbitrary data in their public keys.
Then, this data can be pieced together by the receiver - creating a kind of global one
way communication channel.
Whilst all this research did come out a couple years back, it’s only now been put to use
in something more practical.
German researchers embedded an EvilCrow keylogger (that can be bought for just $35) within a
keyboard - by default this keylogger just spawns a WiFi hotspot, that an attacker can
connect to in order to retrieve logged keys.
But the chip that powers the EvilCrow - an esp32, also supports bluetooth.
Which the researchers used to emulate a bunch of homeless AirTags, harnessing the FindMy
network to send keystrokes back to a would-be attacker.
The researchers achieved a bandwidth of 26 characters per second - which is pretty good,
but it came with a potentially unlimited latency, because that depends on how often an apple
user happens to stroll by.
But with 2 billion Apple devices world wide, it shouldn’t take long.
Whilst using the ‘Find My’ network to send keystrokes might not be quite as reliable
than say a 3g dongle hidden in the casing of a keyboard, it is a hell of a lot stealthier,
and it’s free.
However there probably won’t be an explosion of malicious keyboards abusing this in the
wild, because irl use of hardware keyloggers, regardless of the exfiltration method is incredibly
rare.
There’s only a handful of publicly known cases of these things being used maliciously,
and more often than not it’s just some kid trying to get their teacher’s creds so they
can change their grades.
As always thanks for watching and I’ll se you in the next video, have a good one.