Hello, World!
ChatGPT now has an evil twin, Millions of US military emails have been leaked, and security
researchers hack doors with CCTV cameras.
That’s all coming up in your roundup of cyber security tech news.
Cyber criminals have been using ChatGPT ever since it was released, to do everything from
write phishing emails to help them code malware.
If you browse cyber crime forums you’ll find users discussing all kinds of ways they’ve
weaponised ChatGPT - and some forums have even created whole sections dedicated to the
topic.
ChatGPT’s creator, OpenAI isn’t too happy about all of this, and has tried cracked down
on malicious prompts.
And so, the inevitable has happened.
Cyber criminals have created their own AI chatbots, training them on malware focused
datasets, and removing the ethical restrictions of tools like ChatGPT.
The first of which is called “WormGPT” - and as soon as it was released, it created
absolute panic in the mainstream media, “'WormGPT': New destructive AI tool that can cause large-scale
havoc”, “WormGPT: New AI Tool Allows Cybercriminals to Launch Sophisticated Cyber Attacks", “What
is Worm GPT?
The new AI behind the recent wave of cyberattacks”.
But are all the apocalyptic headlines warranted?
So, wormGPT is being sold on cyber crime related forums as a kind of ‘ChatGPT’ with no
limitations.
It costs 100 euros, that’s about $110, per month - so this ain’t cheap.
But most notably its creator says that it’s not using an openAI API.
As in, this isn’t piggy backing off of chatGPT like other tools that’ve come before it,
rather WormGPT relies on an open source large language model called ‘GPT-J’, which has
been specifically trained with a malware focused dataset.
But is it any good?
Is wormGPT going to turn newbie cyber criminals into godlike hackers, the kind of which that
can only be found in stock footage?
Well, let’s have a look at some example prompts…
when asked for an example of malware - it’ll create a malicious python script to run on
startup which will recursively delete all files in the user’s home folder - in another
example WormGPT can answer basic questions about what features are best in worm malware
- and in another it is pretty good at writing phishing emails.
There’s a couple more examples that I’ll put on screen.
And given these prompts are what’s being used to advertise WormGPT, I think it’s
fair to assume these represent the pinnacle of it’s capabilities.
Which might look a bit underwhelming, I mean - sure this tool does look like fun to play
around with, and whilst it might be of use to wannabe cyber criminals - this isn’t
going to put malware creation skills in the hands of anyone who couldn’t figure it out
on their own, so - the mainstream media can chill, wormGPT isn’t going to be turning
script kiddies into 1337 haxors anytime soon.
However, thanks to those apocalyptic headlines - WormGPT is attracting a lot of newbies,
and some of them are very new.
I found a bunch of posts across the forum that wormGPT is being sold in, made by confused
people with newly created accounts asking where they can find the elusive wormGPT, despite
it quite literally being the first result in a simple forum search.
I DM’d the tools creator - who is actually a regular viewer of this channel.
And WormGPT it seems is doing pretty well - he says the tool has 180 users, and if those
guys are all paying monthly that’d be 20k per month, as in a quarter million dollars
per year.
So if theres one thing wormGPT has proved it’s that there’s definitely a demand
for malicious AI chatbots and clearly people are willing to pay for it - so…
WormGPT only the beginning.
Also, I noticed that in the WormGPT sales pitch, the ‘blackhat allowed’ feature
was quietly changed to ‘no limitations’, I asked the creator about that - and he claims
this was because white hats are also using the tool, apparently for research purposes.
Speaking of white hat tools, that professionals can use to speed up their workflow, I want
to tell you about PlexTrac who’re kind enough to sponsor this video - PlexTrac is a cybersecurity
reporting and collaboration platform used by the best pentesting teams - empowering
them to build better reports in half the time, exponentially increasing their ROI and time
savings.
PlexTrac helps them aggregate findings from all their tools by consolidating the testing
process into one platform, creating a single source of truth, and maximizes their reusable
report content, like findings writeups and narratives, improving consistency across their
team.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement.
Simply put, you'll be spending more time hacking and less time reporting.
And PlexTrac is offering you a free month of their platform, using the link in the description.
So big thanks to PlexTrac for sponsoring this video.
Next up, for the past 10 years, millions of emails containing sensitive US military documents,
have been leaked, thanks to a typo.
The problem exists because of ‘.mil’ - which is the top level domain reserved for US military
websites.
There’s army.mil, navy.mil, airforce.mil - and so on.
And if you work for any of these branches of the US military, you’ll be assigned a
fancy .mil email address.
However for the past decade many people have forgotten the ‘i’ in ‘mil’, and millions
of emails meant to be sent to these .mil email addresses have been been mistakenly sent to
.ml addresses.
But on the surface this might not seem like a big deal, because for the most part these
.mil domains don’t exist as .ml domains - so any emails sent to them would just bounce
and the sender would just get one of those ‘address not found’ notifications.
But if the organisation which manages the .ml ‘top level domain’ realised what was
going on here, instead of just letting these emails bounce, they could put measures in
place to scoop up and save all these wrongly sent emails.
And the owner of the .ml ‘top level domain’ is the country of Mali - which is particularly
not so great because Mali just so happens to be a close ally of Russia, which I imagine
might be interested in millions of sensitive US military emails.
But luckily for the US, in 2013 Mali actually sold the rights to the .ml TLD to a dutch
company - from whom you can actually register a .ml domain completely for free!
Or at least you could until earlier this year, when the site closed registrations thanks
to “technical issues”.
Coincidentally at the same time, Meta actually sued the company, alleging that their free
domains are too often used by cyber criminals and that nothing was being done about it.
But that’s a topic for another video… the guy who runs the dutch company “Johannes
Zuurbier” noticed that something was up, there were a bunch of DNS requests to .ml
domains that simply didn’t exist.
On a hunch that this was due to typos in email addresses, he set up mailservers on a bunch
of these typosquatted domains.
And his hunch was right… he started scooping up sometimes over a thousand emails per day,
and the documents in those emails were staggering - there were maps of military installations,
staff lists at bases, naval inspection reports, identity documents, and so on.
Oh and he didn’t just catch documents, but also military personnel would often send passwords
in plaintext that could then be used to access DoD websites.
This mailserver that ‘Johannes’ had set up was so overwhelmed that he actually had
to shut it down, but in the short time it was live, he collected over 117,00 emails.
So, obviously was a pretty catastrophic problem for the US military, but instead of deciding
to sell his treasure trove to the Russians, ‘Johannes’ instead decided to notify the
US Department of defence.
But this story doesn’t end there, because the DoD didn’t care…
I mean - to put it into perspective, this was reported to the US way back in 2013 when
‘Johannes’ had only just taken over the rights to .ml domains.
Since then it’s reported that he “approached US officials repeatedly, including through
a defence attaché in Mali, a senior adviser to the US national cyber security service,
and even White House officials.”.
But nothing was ever done.
The problem was all the more serious because firstly - absolutely anyone could just register
a .ml domain and start scooping up emails.
But more worryingly, ‘Johannes’s’ contract to manage the .ml TLD was about to expire,
and control was to revert to Mali’s government, a Russian ally.
But if there’s one way to get the attention of the US government, it’s to embarrass
the hell out of them.
And that’s what he did, teaming up with the Financial Times to reveal how a simple
typo mixed in with a bit of incompetence, could’ve led to one of the biggest US military
leaks of all time.
But there is more to this story, because other than US officials ignoring or just not caring
about the problem, this problem isn’t technically their fault.
A spokesman for the Pentagon said that if someone with a .mil email address accidentally
sends an email to a .ml domain, those emails “are blocked before they [even] leave the
.mil domain and the sender is notified that they must validate the email addresses of
the intended recipients”.
So the root of the problem here is people with non .mil email addresses, such as military
contractors and foreign militaries who are trying to email the US military.
And those guys might want to come up with some kind of a fix for this quickly, because
as of making this video, the Dutch company’s contract has expired and the Malian government
now holds the reins over .ml domains.
Next up, this is wild, security researchers have come up with an ingenious way of unlocking
doors protected by smart cards.
We’ve all seen these things before, you find them everywhere, from military bases
to hotels.
You tap your smart card, and the door opens.
But what you might not have noticed is that the LED on the card reader, flickers when
you tap the card - it’s very subtle and it’s usually so fast you can’t even see
it.
This flickering wasn’t implemented on purpose by the designers of the card reader, rather
it’s an unintended consequence of small changes in power consumption of the card reader’s
CPU as it runs its cryptographic algorithm in order to figure out whether or not to open
the door.
And researchers have discovered that just by recording the flickering of the LED you
can analyse these small changes in power consumption, and then extract a card’s encryption key.
Then you can just copy it to another card, giving you access to whatever’s behind the
door.
No special hardware is required, this can all be done using a phone’s camera.
But the researchers used a CCTV camera, in order to simulate a scenario where a hacker
in control of a CCTV system could clone smart cards.
So to do this, an attacker would first need to zoom in on and record the LED of a card
reader whilst someone taps their card.
But this is where the attack gets kinda clever, because a smart card reader’s CPU works
at thousands if not millions of operations per second, and the LED will be flickering
just as fast.
But a typical phone or CCTV camera only shoots at 30 or maybe 60fps, which is nowhere near
high enough to record this high speed flickering.
I mean - even if you were recording using slow mo at several hundred frames per second
it wouldn’t even scratch the surface of what’s required.
But the researchers figured out a way - and this might seem crazy but hear me out - to
get 60,000 FPS from a standard phone or CCTV camera - well kinda.
So, in order to make this work, the researchers exploited the fact that camera sensors don’t
typically record all the pixels for each frame of video all at once, rather a camera sensor
is read each line of pixels at a time, this explains why you get weird artifacting when
you’re recording something that’s moving quickly as the object will have moved by the
time the next line of pixels is read.
It’s called the ‘rolling shutter’ effect, and it looks kinda strange so it’s usually
seen as a disadvantage of cheaper camera sensors, and so more expensive film cameras will record
the whole frame at once.
But, a ‘rolling shutter’ is actually useful here - because the researchers can treat each
line of pixels as a new frame, to increase the effective FPS of a CCTV camera from 60
FPS to 60,000 FPS - at which point it’s more than possible to analyse the super quick
fluctuations in the LED.
The researchers then extracted the RGB values from each line of pixels, and performed what’s
called a ‘Minerva attack’.
This kind of attack exploits the timing of cryptographic operations to infer a card’s
256 bit key.
But the ‘Minerva’ attack isn’t new, it was first published in 2019 - but back
then the attack didn’t have anything to do with LEDs and cameras…
instead it required physical access to a smart card itself.
This new attack though basically takes the concept of timing cryptographic operations
and Mr Robotifies the whole thing to the point where a CCTV camera 16 meters away can steal
a card’s encryption key.
The researchers identified eight smart readers that were vulnerable to this kind of attack
- so it’s not like this only affects one or two brands on the market.
But there are downsides to this attack method, the most obvious one that I came across when
looking for stock footage, was that when someone taps their card they often cover up the LED
- so if a hacker were to gain control of a CCTV camera it would have to be in just the
right spot for this attack to even be possible.
And then there’s the problem of time, an attacker would need need to capture 65 minutes
of smart card operation in order to scoop up all the data they’d need to carry out
the cryptanalysis, so this definitely isn’t a quick hack.
And at the end of the day, mitigating this attack in new versions of smart card readers
would be easy and would cost pennies, a simple capacitor over the LED’s power lines to
smooth out the voltage would likely be enough to render this whole attack useless.
Or cheaper still, just get rid of the LED entirely.
As always thanks for watching, and I’ll see you in the next video, have a good one!