Hello world,
Russian hackers are seemingly using NordVPN to conduct their international cyber espionage.
Weak, almost useless encryption has been identified in ios and android mobile phones.
And the vulnerability which caused the massive Kaseya hack had apparently been known about
for months.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
A Russian state sponsored hacking campaign commanded by ‘Fancy Bear’ has just been
uncovered. Since mid 2019 the miscreants have been running what can be best described as
a ‘password guessing crusade’.
A new report released jointly by US and UK intelligence agencies details the targets
to have been various western government agencies, defence contractors, energy companies, as
well as political organisations. Funnily enough just as I was writing this script it was announced
that the Republic party in the USA, was (allegedly) hacked by none other than ‘Cozy Bear’,
another moniker for ‘Fancy Bear’ - but more on that in a bit.
The report outlines the plan of attack used in this saga. After identifying valid accounts,
the hackers would attempt to bruteforce them, they would combine login attempts with vulnerabilities
in order to gain a foothold in the target network - within which they would conduct
lateral movement, mapping out the network for further exploitation - which usually consists
of exfiltrating any and all files that interest them.
Interestingly, the first couple stages of this attack were carried out using kubernetes.
Kubernetes is essentially an open source container platform which makes developing scalable web
applications easier. It was authored by Google and is a legitimate tool used by many high
profile corporations. This campaign was automated, or at least the first couple stages were,
this allowed the attackers to target potentially hundreds of organisations with many thousands
of brute force attempts.
In a bid to mask their activities, the campaign was conducted via TOR as well as commercial
VPNs including IPVanish, ProtonVPN and NordVPN. If I worked for NordVPN, I’d definitely
use this as some kind of a marketing ploy, “Our privacy is so good, Russian hackers
use us to conduct international cyber espionage”.
This looks to have been largely a fishing campaign, fishing with an ‘f’. Fancy bear
will have devised a wish list of all the organisations they’d like to have a backdoor in and then
will have sprayed those organisations with login attempts. It’s a very basic attack
- going for low hanging fruit. But it is effective.
So effective it seems to have been successful in breaching the RNC. The breach is still
in “allegedly” territory as the RNC are denying there was a hack, but according to
Bloomberg “two people familiar with the matter” say otherwise - take that for what
you will… It’s not clear exactly how this attack was carried out, whether it was part
of this specific operation, but it does seem to have been carried out by Fancy Bear.
Mitigating these kinds of hacks luckily isn’t rocket science. 2 factor authentication as
well as cool downs after failed login attempts go a long way. The Russian embassy in the
US has of course categorically denied any involvement in both the RNC hack as well as
the wider accusation of targeting various organisations. And to be fair no evidence
of these attacks being perpetrated by Russia has been made publicly available, though on
the other hand US and UK intelligence agencies won’t want to make their attribution methods
public for obvious reasons.
Super weak encryption algorithms have been found lurking in modern mobile phones - this
affects iOS... and android devices, so no one can really claim OS superiority here.
The GEA/1 encryption algorithm was introduced way back in 1998, it was used in GPRS, i.e.
2G networks. GEA/1 was marketed as providing 64 bit encryption for transmitted data, however
a new paper courtesy of German academics has uncovered after more than 20 years this was
arguably a bit of a lie. A weakness hidden in the algorithm, which is being described
by some cryptographers as a “deliberate backdoor” downgrades the true number of
encryption bits to just 40.
It may not sound like a big deal, after all 40 is only 26 less than 64 - so it still should
be about 2 thirds as effective, right? Not really, the number of possible keys scales
exponentially as you add more bits, in reality 64 bit encryption has more than 16 million
times more possible keys than 40 bits, so this discrepancy would be considered a major
downgrade.
The “European Telecommunications Standards Institute” which was responsible for developing
this algorithm has responded to these findings, they allege that this purposeful weakness
was due to export restrictions. Point being, back in 1998 many countries restricted the
export of encryption of over 40 bits due to matters of national security. At the time
a lot of people felt this was a bit silly, so back then people even had t-shirts made
detailing the RSA encryption algorithm to protest the restrictions. These t-shirts were
legally classed as munitions and couldn’t be exported or shown to foreigners.
The GEA/1 algorithm was eventually retired in 2013 and is no longer in active use, however
as I mentioned in the beginning of this segment it is still supported by many modern phones
as a backup algorithm. The researchers tested a few recent IOS and Android devices, all
were found to support the algorithm. This is a problem because rogue phone masts can
downgrade a device’s data traffic to this old security standard, an attacker could intercept
this traffic and quite easily crack the code, decrypting transmitted data.
In addition rogue phone masts aren’t all that hypothetical, intelligence agencies already
have devices called stingrays which can do just this along with an array of other capabilities.
The university team that discovered this weak encryption still lurking around today has
put out a press release calling on manufacturers to end support for it.
In my previous video I discussed the pretty brutal Kaseya hack. Kaseya - a company which
makes remote monitoring tools to help technicians keep tabs on their fleet of company computers
suffered a pretty brutal ransomware hack. We now know that 1500 organisations which
use the Kaseya VSA software, fell victim to the intrusion, there have been a few more
illuminating developments since my last video as well as some corrections I need to make.
It was previously thought that this was a supply chain attack, meaning miscreants managed
to somehow hack into Kaseya’s development environment and inject malicious code into
a software update, however that doesn’t seem to be the case, we now know the vector
of intrusion stemmed from an array of existing vulnerabilities in the Kaseya software, interestingly
these exploits were already on Kaseya’s radar having been reported to them by the
Dutch Institute for Vulnerability Disclosure back in April. Several of the bugs were patched
in the proceding weeks, but not all of them.
One of the vulnerabilities still unpatched was a credentials leak flaw. It’s postulated
that this exploit was combined with a couple other vulnerabilities in order to wreak the
havoc that revil succeeded in. Researchers at huntress labs managed to reproduce the
exploits used by the bad actors and released a proof of concept video. It’s becoming
clear that both the good guys and bad guys both had knowledge of the exploits used, but
as the race ensued in patching the bugs before they could be exploited, the Dutch Institute
for Vulnerability Disclosure conceded “Unfortunately, we were beaten by REvil in the final sprint”.
Given the exploits were encapsulated within servers being operated by Kaseya's customers,
the attackers had to individually target these instances. Revil will have found these servers
using a service like Shodan. Shodan is essentially a search engine for internet connected devices
- it uses metadata returned by these devices in order to map servers, iot devices, etcetera.
With a simple search it’s quite easy to find a few servers running Kaseya software.
It will have been quite straightforward for our attackers to build a list of servers running
Kaseya VSA.
Kaseya is struggling to return to normal, they had to take their servers offline in
the wake of the hack and have had a few setbacks getting them back online. Revil have posted
an acknowledgement of their part in the hack on their darkweb site. They’ve set a 70
million dollar ransom for a universal decrypter which they claim could end the crisis in less
than an hour.
It doesn’t look like this is going to be paid, and I’m not aware of any individual
companies taking it upon themselves to negotiate with rEvil. On the whole I haven’t really
seen anyone berating Kaseya themselves for this mess, I think people in the biz kinda
just accept black swan incidents like this are sadly part and parcel of running an IT
services business. After all, Kaseya was in the process of fixing the vulnerabilities
used in this hack.
If you enjoy this kind of video make sure to help me out by tapping the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next, go check out my previous video which discusses the Kaseya hack in a
little more detail.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.