Hello, World!
Police hacked this encrypted messaging app, and Iranian government hackers launched an
operation over a cartoon contest.
That’s all coming up in today’s roundup of cyber security tech news.
Police have hacked and shutdown an encrypted messaging app that was quite literally hosted
in a former military base.
This story is amazing, illustrating perfectly how dumb some criminals can be.
We’re talking about Exclu chat, which, according to its website was the “Most sophisticated
communication platform”.
On the face of it the app does look underwhelming and basic, but the real selling point here
is security, and luckily enough Excluchat’s team have “many years of IT security experience”.
With exclu chat you can “encrypt everything”.
If this sounds like a lot of buzz words and no substance, well, that’s because it is
- and we’ve basically gone through their whole single page website here, this is pretty
much their entire sales pitch.
So, how much does access to this amazing App cost?
900 euros for 6 months, that equates to $2000 per year, a fee that can of course only be
paid in bitcoin.
Now, if I had to speculate, I’d say the users of this app are largely technically
illiterate criminals, who are convinced by this admittedly well designed website that
Exclu chat is just what they need to level up the security of their criminal enterprise.
And at 900 euros per 6 months, it must be infinitely more secure than something like
Signal which costs $0, right?
Well, even if Exclu chat did deliver on all their security promises, history has shown
us that when a messaging app is almost exclusively used by criminals, it attracts the attention
of police like moths to a flame.
And it didn’t help that the operators of Exclu chat were just as dumb as their customers,
choosing to host their service in what was at the time, the worlds most infamous bullet
proof hoster, cyber bunker.
Specifically cyber bunker 2.0, a datacenter located within a former nato military base
in Germany.
By choosing to host their servers here, they were pretty much guaranteeing that when police
did inevitably raid it, they’d be giving the authorities access to their entire operation.
And on one Autumnal day in 2019, 600 German police raided the facility, shutting down
all kinds of nefarious operations.
Whilst ‘Exclu chat’ did manage to migrate to other servers, the raid put them in the
sights of authorities, but more importantly gave police the ability to infiltrate their
operation.
Exactly how they managed to do that, isn’t explained in the police’s press release
on a technical level, instead they just vaguely refer to “using the hacking power”.
Using this ‘hacking power’, German and Dutch police have for the past few months
been listening in on the supposedly end-to-end encrypted conversations of people using the
app, mapping out the various criminal enterprises using Exclu chat.
An operation which concluded last Friday when they raided 79 properties in various European
countries, arresting 48 people, all either users or operators of the app.
Strangely, Exclu chat’s website is still up, with the police not yet having gotten
around to seizing the domain.
And at the time of its demise 3000 people were using Exclu chat, which, via the extortionate
fees, will have been generating about $6 million dollars per year.
Y’know, it’ll never cease to amaze me how criminals manage put their trust in these
kinds of Apps, even if we put to one side how wishy washy and vague Exclu chat’s sales
pitch was, there’s a lot of precedent for police taking out these kinds of criminal
focused messaging services, there was encrochat which was shut down in 2020.
And then just a year later there was Anom, a messaging service marketed to criminals,
which turned out to quite literally be an FBI honeypot.
If you want to hear more about the story behind Anom, I’ll link to my video on it at the
end of this video.
Charlie Hebdo, the satirical magazine - a household name thanks to the deadly attack
perpetrated against them in 2015, has been hacked, by the Iranian government, well - at
least according to Microsoft.
The intrusion first became public early last month on breachforums - yeah… apparently
government backed hackers are now using breachforums.
A user claimed to have “gained access to database of charliehebdo.fr”, and was selling
it for 20 bitcoin, about $450k.
Included in the dump is the personal information of a quarter of a million of Charlie Hebdo’s
customers, as in people who are subscribed to the magazine.
Information like names, emails and physical addresses.
This information being public is bad, potentially deadly, because of course public supporters
of Charlie Hebdo have a habit of losing their heads, take the example of a teacher who had
this happen after simply showing his students one of their cartoons.
And as far as we can tell, the leak is legit, the miscreants made public the first 10 thousand
records, and a French newspaper was able to verify people in the leak were subscribed
to the magazine.
In addition to personal data, the leak is said to include ‘Documents [belonging to]
Charlie Hebdo’, things like invoices, tax reports and ‘classified documents’ - whatever
that means.
The post links to an email address for potential buyers and a YouTube channel apparently run
by the group.
Remarkably the video announcing the hack, which itself doxes hundreds of Charlie Hebdo
readers remains live, over a month after it was posted and this story receiving widespread
media attention.
I tweeted YouTube support about it, but got no response.
The hack coincided with a campaign of Twitter bots, all tweeting the same screenshot of
the Charlie Hebdo website apparently being defaced, but there’s no news of any actual
defacement of the site, so as far as I can tell, this is probably a false flag.
And I do find it quite funny that despite trying to hype up this hack, no one, it seems,
cared - well, at least in the hacking community.
The breachforums thread only got one reply and a mere handful of views, with the same
going for their posts on other hacking forums.
As for who’s behind all this, a group going by ‘holysouls’.
You won’t find anything about them on the googles, and their accounts on various hacking
forums are all new, because - according to Microsoft researchers, this group is just
a front for NEPTUNIUM, otherwise known as a group who’s name I’m probably going
to horribly mispronounce, “Emennet Pasargad” - said to be run by the Iranian government,
these guys are well known, already on the radar of the department of justice for their
operation to influence the 2020 election, an operation they were actually sanctioned
for.
But why would these guys go after a magazine?
Well - the running theory is that this was done in response to a cartoon contest Charlie
Hebdo launched, which invited their readers “to produce caricatures of the Islamic Republic
of Iran’s Supreme Leader.”
- something the French ambassador to Iran was actually summoned over.
But this theory doesn’t account for the fact that the hackers are trying to sell the
dataset, you would have thought maximum damage would be done by just leaking the dump in
it’s entirety.
This video is sponsored by Sumsub.
This super cool YouTube channel is all about how to survive in what they call the online
jungle.
Each month they release a video investigation on emerging new technologies like deepfakes,
neural networks and AI Art.
They also make sure you know how to protect yourself online, sharing cybersecurity tips
each week in their shorts.
The Sumsub team is made up of real-life digital security professionals fighting against money
laundering, terrorist financing, and online fraud, and in their spare time they provide
you with some serious nerd knowledge that you certainly won’t find anywhere else.
In a recent video the Sumsub team investigates how and when AI is going to usurp our jobs.
But it’s not all doom and gloom, the Sumsub team also shares cybersecurity tips and tricks,
like how to detect keyloggers or how to spot a deep fake.
Make sure to sub to Sumsub, using the link in the video description.
As always, thanks for watching - I’ll have my video on anom linked onscreen, and I’ll
see you in the next video, have a good one.