Hello world,
A new report explains how credit card hackers hide their loot in images,
The world’s most successful ransomware group, rEvil, vanishes overnight.
And the embarrassing bug that can disable iPhone’s WiFi has a version 2
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
Web security company securi have published a writeup detailing how malicious hackers
have been stealing credit card information from ecommerce websites, encoded in images.
This is being perpetrated by Magecart. Magecart is an umbrella term used to describe miscreants
targeting ecommerce websites - there are little more than a dozen of these groups which typically
target websites running on the magento ecommerce platform.
Magento is open source and owned by Adobe, it’s used by about 10% off all ecommerce
websites online. Securi’s writeup explains how after gaining unauthorised access to a
website, via a vulnerability in magento itself or by some other method, after all websites
run on servers which could be running a whole host of other exploitable services - after
gaining access the bad actors would inject malicious PHP into the magento checkout process,
in this particular case the code was cleverly obfuscated, concealing the fact that each
time someone entered their credit card information, it would be appended to a seemingly innocuous
file ‘arrow.gif’. The idea is to make this image file seem completely innocent - to
have it look like any other random unimportant icon file, steganographically masking it’s
true contents. Probably because people caught on to credit_cardzz.txt
The criminals would come along later and just download this publicly visible file, and then
extract the loot which could contain hundreds of credit card numbers, which would usually
be sold on dark web marketplaces. Simply because emptying a whole trove of bank accounts would
be a risky business, so magecart typically sell on individual credit card information
at a fraction of its value to others keen on pilfering the victim’s accounts.
The issue is exacerbated by the fact that ecommerce stores often pay a load of cash
upfront for flashy looking websites using magento, but neglect the need to pay someone
to maintain their website - within a few short years a site becomes vulnerable. Securi explains
the problem is made worse by the fact that adobe - magento’s owners - have taken security
patches offline for older versions of magento, these patches do exist - but you have to manually
grab them from github. To put into perspective the scale of the issue, this particular website
had six different credit card skimmers installed, credit card fraud is big business, people
are making millions from it, so I suppose it’s not too surprising that a website with
more holes than a slab of swiss cheese will attract a horde of rats.
In a surprising twist in the ransomware chronicles, the world’s most successful ransomware gang,
rEvil has seemingly melted into the ether, whether they’ve been vanquished by the feds
or if this is a voluntary departure is not immediately clear.
Formed in 2019 rEvil quickly became the world’s most infamous ransomware gang, both statistically
in terms of market share and in the gamut of targets they went after, some of their
greatest hits include stealing Apple product schematics, the meat supplier heist, the nuclear
weapon contractor hack and the ballsy recent Kaseya hack which alone saw 1500 companies
locked up with ransomware, causing never seen before carnage to a whole array of organisations
simultaneously.
A few days ago rEvil infrastructure in its entirety went offline, the dark web site they
operated, which they called the ‘happy blog’ has become inaccessible as well as seemingly
every other server related to them. I planned on talking about rEvil porting their malware
to Linux, to address some of you linux supremacists in the comments, but it seems like that’s
become a bit of a moot point.
rEvil themselves didn’t announce a departure or leave any clues hinting at some kind of
tactical withdrawal. However there are several credible theories - a rival ransomware gang
‘lockbit’ is claiming to have intel that rEvil received a government legal request
which forced them offline, though this isn’t confirmed. If this is true however, it will
have been a request from Russian authorities as rEvil, being based in Russia isn’t phased
by US law enforcement. Typically Russian cybercrime gangs have been able to freely operate unhindered
as long as they don’t attack Russian entities. Due to this fact, Russian authored ransomware
typically runs a language check before it encrypts a victim; if the victim PC is Russian,
then the malware will nope out and just delete itself.
It is possible Russian law enforcement is starting to tackle the ransomware problem,
the recent Russia/US summit saw Biden and Putin discuss the issue. At first glance the
stance Biden took seemed to have been rather tepid. But the Russian government, ie: Putin,
really has nothing to gain from these ransomware attacks, they’re being carried out by private
individuals, which let’s be real, probably aren’t paying taxes on the takings. By shutting
down the ransomware gangs it takes away a stick the west uses to beat Russia with. However,
that being said a Kremlin spokesman has said they had no hand in this whatsoever.
It could be the case that rEvil was forced to shutter operations for other reasons, such
as an internal dispute forcing the group to splinter and perhaps pop up under a different
moniker later on. As you can tell, no one knows what’s really going on. Other ransomware
gangs are unsurprisingly pleased with these developments - Flashpoint reports that other
threat actors are actively celebrating rEvil’s demise.
Though interestingly in the wake of all of this, the cybercrime forum XSS has banned
the rEvil spokesperson - who went by the username ‘Unknown’. According to flashpoint, this
was probably done in an effort to protect the XSS forum itself, if the takedown was
a government operation then they could usurp the unknown account and use it to infiltrate
the forum.
rEvil’s evaporation has adversely affected some victims of the recent Kaseya ransomware
attack. Zdnet reports one particular victim paid the ransom only to find the decryption
key they were provided doesn’t fit the lock! It works on some files, but not others. rEvil
usually operates a kind of help desk support system, some kind of live chat feature to
assist victims in decryption - but given all rEvil infrastructure has gone awol the victim
has no recourse and is being forced to rebuild from scratch, even after paying the ransom.
A few videos ago I told you about how certain WiFi network names could quite literally crash
iPhones. A researcher discovered that by including string format specifiers used in the C programming
language, within a network name - you could disable the WiFi function of any iPhone which
tried connecting to it. All because the WiFi network names weren’t sanitised in iOS’s
logging function.
However you could remedy the issue by simply resetting your network settings. You can go
watch my previous video for more detail on that bug, it was pretty embarrassing for Apple
- a bit of a basic bug to let slip through the cracks. Just a few days after that vulnerability
was exposed the same researcher discovered yet another bug - this one though can almost
permanently disable WiFi on an iPhone, it can’t just be fixed with a simple reset.
In this case by connecting to a network titled “%secretclub%power” you could disable
WiFi to the point where you’d have to manually back up your device, edit the offending stored
WiFi network names out of the backup, then restore from said backup - a fix above the
capabilities of most iPhone users I would expect. This of course works via the same
mechanism as before, those pesky string format specifiers. But before you go out of your
way to change your WiFi SSID in an attempt to get under the skin of iOS users for no
reason in particular. This series of bugs were fixed a few days
ago, Apple quietly rolled out patches for the vulnerabilities and they exist no more.
If you enjoy this kind of video make sure to help me out by tapping the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next, go check out my previous video which covered how a Russian state sponsored
hacking group was found using NordVPN in a recent operation.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.