Hello, World!
Badly designed CIA websites got people killed, ATM card skimmers are evolving, and North
Korean hackers aren’t giving up.
That’s all coming up in today’s roundup of cyber security tech news.
This is a covert CIA website, it’s disguised to look like some random Iranian sports blog;
when translated you can see it has some commentary on Iranian football, some links, and even
some ads at the bottom.
But it’s all a decoy, this is actually one of many covert websites that the CIA was using
for years to communicate with undercover informants living in countries like Iran and China.
See this text box here, disguised to look like some search box?
Start typing, and you’ll quickly realise something is off, it’s actually a password
prompt.
Get the password correct and a java applet will launch - dated?
Yes, but this website is from 2011, so I suppose we can cut the CIA some slack, same goes for
their ancient web design.
A correct password will return this text box, where an informant can communicate with their
CIA handler.
Now, when you start hearing about the top secret ways CIA agents communicate with their
confidential informants on YouTube, there has to be a pretty bad reason for it.
In this case, that reason is that the CIA’s web development practices were so awful that
they resulted in whole networks of spies being discovered by Iran and China, which led to
many of them being executed.
We’ve seen some of the more obvious bad decisions already, a search box which is obviously
a password prompt is very sus, the fact it’s on the homepage also makes it stand out more.
But this is just the tip of the iceberg.
What made this such a disaster, is that until 2013 the CIA was operating hundreds of these
websites, each with a different theme.
One of them is a Bob Marley fan page, another is a nature photography site, and this one
is a fitness blog.
But they all had one thing in common, a password prompt disguised as a search box, and a hidden
communication field.
But it gets worse, sequential blocks of IP addresses were used to host these sites, and
many of them were hosted on the same servers.
No doubt this made life easy for the CIA, copy pasting code, and hosting the sites centrally.
But the same can’t be said for those informants.
If an adversary found out about just one of these websites, it would be easy for them
to uncover the rest.
And, that’s exactly what happened.
“Former U.S. intelligence officials said that the Iranians cultivated a double agent
who led them to [this] secret CIA communications system”, from there, in about 2011, everything
unravelled.
The Iranians used Google to uncover the rest of the websites, apparently just Google dorking
to find sites based on reused code.
After making a list of websites, finding the undercover informants that were using them,
was also easy.
Each informant had a website made specifically for them which no one else used, so I imagine
identifying the informants was as easy as just logging DNS requests.
Following which, “Iran executed some of the CIA informants and imprisoned others”,
and after tipping off China, their “authorities rounded up and executed around 30 agents working
for the U.S.”.
If you try to visit the first website we looked at, iraniangoals.com you’ll find it’s
been re-registered and now redirects to the Reuters article which blew the lid on this
a couple of days ago.
But with the help of the wayback machine, the original site lives on.
What you’re looking at here is the next generation of ATM card skimmers.
Now, these things are dangerous, because whilst it’s quite easy to check for the skimmers
we’re all familiar with, by just giving the card reader a little tug and squeeze,
that won’t work with these new skimmers, they’re called “‘Deep Insert’ ATM
Skimmers” for a reason, because they’re designed to go inside the card slot itself,
making them borderline impossible to check for.
This ultrathin design, which is only .68 millimetres thick is made possible by an unbelievably
thin lipo battery and a flexible pcb - two things which aren’t all that high tech.
Batteries as thin as 0.4mm are easy to find, and these days most PCB manufactures do offer
flexible PCBs.
So this skimmer itself will copy your card’s magnetic stripe information, but the miscreants
do also need to capture your pin code, which they typically do by hiding a tiny camera
somewhere on the ATM, in this this case miscreants have been hiding cameras in a fake panel which
covers literally the entire side of the machine.
I don’t know how you’re meant to check for these latest skimmers with anything less
than complete paranoia, by trying to pull apart literally every part of the machine
and peering into the card slot.
However luckily these new skimmers have only been found in New York City, so it doesn’t
look like they’ve become the standard, but are rather the innovation of one criminal
gang.
Bad news though do if you do live in New York City.
Card skimmers are only able to exist because cards still have magnetic stripes, these things
contains all the details of your card, minus the pin number.
This 1960s era technology only still exists because a small handful of countries haven’t
yet moved on to chip and pin.
In fact the first time I ever used the magnetic stripe on my card was on holiday in America
a couple of years back, when a cashier was confused by me trying to insert my card into
the bottom of the machine when there was no slot.
Good news though is that magnetic stripes are going away.
In a mastercard article titled “Swiping left on magnetic stripes” - very punny,
they explain that they are phasing out the technology, but it’ll take a while, until
2033 apparently.
No doubt other credit card companies will have similar timelines, so until then you
do have to be vigilant.
Exactly how you beat card skimmers that are hidden in the slot itself, I don’t know.
But the best thing to do is attack the skimmer at its weakest point, the pin code.
Usually skimmers grab this with a camera, so just make sure to cover the keypad with
your hand.
But then again some skimmers actually ditch cameras in favour of fake keypads, which - complicates
things.
I don’t think there’s a foolproof way to check if a keypad is fake, I mean you can’t
really pull on something that’s flat - I’m out of ideas here, let me know your thoughts
in the comments.
Next up, we have another instalment in the never ending series of North Korean recruitment
scams.
In this latest episode, brought to you by Microsoft’s security division, Zinc, which
is better known by their other stage name “Lazarus Group” has been weaponising open
source software.
This latest operation sees Lazarus hackers posing as recruiters on LinkedIn - going by
names like “Brian Wright” - which is an upgrade from the names Lazarus hackers have
previously used, which have included “James Willy” and “Billy Brown”.
There was legitimately a time when you could seemingly spot a North Korean hacker based
on whether it looked like an 8 year old had come up with their name.
In this latest operation, the fake LinkedIn recruiters would message the employees of
companies that Lazarus wants to hack, and after migrating the conversation over to WhatsApp,
Lazarus will leverage the prospect of lucrative job offers to encourage the victim to download
a trojanised version of some open source application, like PuTTY or TightVNC.
Microsoft haven’t given us screenshots of conversations between Lazarus and their victims,
so we don’t know exactly how victims were convinced to download a modified version of
open source software, which on the face of it, does kinda sound like a dumb thing to
do.
But I can’t imagine Lazarus’ persuasion needed to be all that elaborate, as by the
time a trojanised version of…
PuTTY for example, is sent to a victim, most of the social engineering will have already
been done, the prospect of a lucrative job will be looming over a victim’s head, so
Lazarus could just say ‘you need to download our pre configured version of PuTTY as part
of some skills test’ After downloading and running the modified version of PuTTY, it
wouldn’t infect the victim by default, but rather only when they used it to connect to
a certain ip address with specific credentials.
Presumably they coded this in to prevent accidental infections.
And a similar tactic was observed when the attackers used a malicious version of tightVNC,
which would only drop malware when it was used to connect to a certain host.
In either case, the malware would simply configure a backdoor that the North Korean hackers could
use to remotely access the victim’s computer.
Exactly what they would then do, isn’t clear.
But North Korea’s Lazarus hackers are usually financially motivated and specifically target
companies they want to hack for some reason, often that reason is stealing a company’s
crypto assets.
Just earlier this year, they stole over $600 million dollars in mostly Ethereum via one
of these recruiting scams, so whilst you might scoff merely at the idea of someone falling
for one of these recruiting scams, they do work.
And recently the US “Department of state” doubled their reward on information which
could lead to the arrest of North Korean hackers, to $10 million dollars.
The best pentesting teams trust PlexTrac - the cybersecurity reporting and collaboration
platform - helping them build better reports in half the time, aggregate findings from
all their tools, and maximize their reusable report content, like writeups and narratives.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement, whilst exponentially increasing ROI and time savings.
Ready to elevate your reporting, improve collaboration across teams, and demonstrate real progress?
Spend more time hacking and less time reporting with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching, sources can of course be found in the video description,
stay tuned for more hacking videos and have a good one.