Hello world,
You know that meme, about having an FBI agent reading all your messages - it’s come true.
The FBI has been covertly running a messaging service for 3 years, completely unbeknownst
to its users.
Anonymous is back and they’re not happy with Elon Musk
The colonial ransom has been recovered, well some of it.
And what caused the internet to break yesterday?
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
This is the first case of its kind I’ve ever seen, and it’s all been made public
in the last 24 hours. The FBI and Australian police have teamed up to create an undercover
company which sold encrypted mobile phones via the dark web. The aim of this plot was
to get the devices in the hands of as many criminals as possible, and listen to every
single word that was communicated using a hidden backdoor built into the devices. This
didn’t target small scale dealers, oh no, described by Europol as the “biggest ever
law enforcement operation against encrypted communication" - this scheme ensnared South
American drug cartels, Asian Triads, motorcycle gangs among others.
The plan was hatched by the FBI and Australian police in 2018 - over a few beers apparently.
The two forces jointly developed these ANOM devices, they’re essentially google pixels
- however they run a modified version of android, you couldn’t make phone calls on them, send
texts or emails. All communications had to go through the “encrypted” ANOM messaging
service. Using undercover informants, police got these devices into the hands of some influential
criminals, one of them being “hakan Ayik” - this Australian drug trafficker recommended
the devices to all of his criminal mates helping propagate the ANOM brand throughout the criminal
underworld. This machination dubbed operation ironside by Australian police wasn’t a smash
and grab, here today executed tomorrow kind of a plan. Police were snooping on criminal
communications for 3 years, during that time miscreants had no idea why their drug shipments
were being caught, at its peak the anom service had 11,000 users.
This operation was only cut short by legal authorities which “prevented the app from
being covertly used for a longer time frame”, though we’re not sure why as of now. In
the last few weeks police have been raiding users of anom, in total 800 criminals have
been arrested worldwide, 8 tonnes of coke has been seized, police said they rumbled
21 murder plots and prevented a mass shooting in an Australian cafe. Over 9000 police officers
were involved in the sting - of which an album of pictures have been released. There’s
this one picture of a guy all cuffed up reconsidering his life choices, with an ironic Breaking
Bad poster in the background.
The domain anom.io is showing as seized, bit misleading as it was in police hands all along,
there is a contact form however for former users of anom to get in touch with police
and enquire if they’re under investigation - not sure why you’d want to do that. Wayback
machine is showing a previous version with a pretty slick animation advertising how shiny
anom devices are.
This is all quite reminiscent of ‘encrochat’, a similar service of encrypted devices which
was shut down last year, the only difference being ANOM was run by the police themselves.
On the whole this operation is really quite impressive, though it’s ironic these criminals
would have been better off with a bog standard signal group chat, rather than going to all
the effort of procuring these devices.
Anonymous is back, maybe, not really. Some channel called “Anonymous” - which happens
to be verified by the way - posted a video going after Elon Musk. A lot of people seem
to be taking this very seriously, and don’t get me wrong - I like drama too, but unfortunately
this seems to be a bit of a non story - which is why I wanted to talk about it.
Firstly people have to understand there are dozens if not hundreds of channels on youtube
claiming to represent anonymous, you could create one yourself, all you need is a text
to speech generator. And some anonymous stock footage, some dude in a dark room set up with
a projector splashing HTML all over his face will do. Oh would you look at that we have
a subscription to the same stock footage website!
The video makes various allegations, that Tesla uses child labour, makes a bunch of
money from government subsidies - but also a few frivolous ones for example, anonymous
has apparently taken great offence at Musk crowning himself “emperor of Mars”. They
also trash him because he apparently isn’t intelligent enough to have found Tesla himself,
but rather he bought it.
But the crux of the video is that Elon has been meming too hard when it comes to crypto,
that his childish tweets are screwing up the crypto market, causing people to lose their
life savings, and introducing more volatility than there needs to be. On this point I find
myself agreeing to an extent, crypto is volatile by nature sure we get it, but at the end of
the day Musk tweeting half truths about bitcoin’s energy usage and propping up meme coins seemingly
just for the hell of it - doesn’t help the macro goal of instantiating some crypto financial
revolution or whatever you want to call it.
And sure, maybe I’m just a little salty that my crypto holdings have halved in the
past month. The whole rocket thing is cool, but I don’t think Elon has been healthy
for crypto.
But anyway, when it comes to this anonymous video - putting out videos like this gets
a lot of media attention, views, etcetera - but talk is cheap. The heyday of Anonymous
actually doing things, seems if not extinct to be dormant.
Another update on the colonial pipeline ransomware attack. The US Department of Justice has just
announced they’ve managed to recover 63.7 of the 75 bitcoin ransom paid by colonial
to darkside. It’s not often a ransom is recovered, but with this case being so public
there will have been extra pressure on the FBI to score some level of a victory.
Whilst court documents detail how the FBI traced the ransom through the blockchain,
we don’t know how the bitcoin ended up in the FBI’s hands. All we know on that front,
is that the majority of the ransom now resides in a wallet “for which the FBI has the private
key”, how it got there is under wraps. It’s been suggested that darkside may have transferred
some of the bitcoin to an exchange in order to cash out the coins - this would have been
really dumb, but sometimes the simplest explanations are correct.
However, about a month ago Darkside claimed their servers had been seized by some law
enforcement agency and that their crypto stash had also been confiscated. At the time, people
including myself wrote this off as just an excuse for darkside to avoid having to pay
their business partners, but it looks like they may have been being truthful.
It’s been speculated that the FBI only managed to seize the affiliates share of the ransom.
Darkside ran an affiliate program, affiliates would spread the malware and get an 85% cut
of the ransom for their work, darkside would keep 15%. Given only 63.7 bitcoins were captured,
that leaves 11.3 bitcoin or 15% still unaccounted for, which you could assume is still in darkside’s
hands.
This is all conjecture of course, until the FBI spills the beans we just won’t know
for sure. An interesting theory I read in an arstechnica article suggested that the
FBI may have actually pressured colonial into paying the ransom in bitcoin. Reason being
Darkside actually accepts both Bitcoin and Monero. Monero’s main selling point is that
it’s untraceable, hence why darkside offers a 10% discount if you pay the ransom using
it rather than bitcoin. Whilst Monero transactions are confidential, bitcoin is all public so
you have a much better chance at catching a criminal who uses Bitcoin. However I don’t
see any evidence for this theory other than the fact the ransom was $4.4 million dollars.
A 10% discount saves you 440k - if you only cared about the money then a discount of half
a million dollars sounds like a pretty good deal to me.
You’ll probably already be familiar with yesterday’s major internet outage, Americans
slept through the ordeal so this might be news to you guys. The downtime affected sites
such as reddit, github, stackoverflow, twitter, the UK government website among countless
others.
The one thing all of these websites have in common is they use Fastly’s CDN. A CDN essentially
caches a website in many different geographic locations, this takes the load off the website
in question but also makes loading web pages faster as the physical server you’re connecting
to is much closer by.
But what caused the outage specifically? According to Fastly they “identified a service configuration
that triggered disruptions across our POPs” - POP means points of presence which basically
means servers. So no real drama to see here - cyberattack was trending on twitter for
a while but the truth isn’t as exciting as everything came back online after just
a few minutes.
If you enjoy this kind of video make sure to help me out by hitting like for the youtube
AI. If you’re looking for something to watch next, go check out my previous video on how
the US is now treating cyberattacks in a similar way to terrorism.
If you like this series of videos do consider becoming a channel member, as always stay
tuned for more hacking videos, have a good one.