Hello world,
McDonalds has managed to accidentally leak the credentials to a confidential monopoly
competition database to their entire email list.
And one of the most infamous ransomware gangs ever, returns - and gives some juicy inside
details explaining how they screwed up the largest ransomware attack the interwebs has
ever seen.
That’s in today’s episode of the weak web where we break down and dissect cyber
security related tech news. McDonalds have managed to pwn themselves,
leaking the credentials to their own McDonalds Monopoly database to their customers via email.
I’m sure most of you guys are familiar with how McDonalds monopoly works, but if you’re
not... In certain countries, every year McDonalds runs this promotion which sees little mystery
stickers added to their food. You peel off the stickers, and if you manage to match them
in certain combinations as per the monopoly board you can win a car, a lot of money, or
even a serving of medium fries.
These stickers also come with mystery codes you can enter on the mcdonalds website in
order to win yet more prizes. Cynics may just see this as just a ploy for mcdonalds to harvest
your user data, but there are some great prizes in the lineup, you could even be in with the
chance to win a 10% discount code on your next dishwasher.
After entering your code, McDonalds notifies you of your win, or non-win via email. Now,
this is where the problem arose. You see, in addition to your prize the emails also
came pre-appended with a real prize, in the form of a user id and password mapping to
a confidential McDonalds database. We don ’t know for sure what the database contains,
as no one, at least not publicly, seems to have actually tried their luck with the creds
to see what those keys unlocked. Though the database is clearly linked with marketing,
it could be user data, or perhaps a list of all winning codes.
The founder of the startup ‘creatorsphere’ - one Greig - was the first to come across
the mistake. He explained in an interview with ‘theregister’ that the string was
a “Windows Azure database connection string.” The problem, he explained, was simple: a variable
in the string “persist security info” had mistakenly been set to true, when true
you get the credentials pre-appended to the output. Theregister explains “Greig noted
that when viewed in the web app version of Microsoft Outlook, the email didn't display
the code string.” - suggesting that whoever tested this email, if tested at all - was
using outlook.
Greig tried getting in touch with McDonalds to report the issue, however no one bothered
to return his calls or emails. With nowhere else to turn, Greig publicly posted the issue
on TikTok, as that’s one surefire place to get attention. And it worked… he managed
to grab the attention of McDonalds who promptly fixed the issue.
McDonalds have claimed that the credentials were just for a staging database, if true
this means the leaked creds aren’t so much of a big deal, still embarrassing all the
same, but not quite as cataclysmic as is could have been - a staging database is an intermediate
storage area used for data processing. New data is loaded into a staging database and
processed before it is sent to its final destination. Some are doubting McDonald's claim as merely
an attempt to downplay the situation, but I suppose we’ll never know.
Just 2 months after one of the internet’s most infamous ransomware gangs, revil - vanished,
ceasing operations. Their dark web sites have suddenly rebooted, the group is apparently
aiming to become fully operational, once again. They disappeared under strange circumstances,
however rumours about them being pwned by the Russian government have been greatly exaggerated.
Since their re-emergence a spokesman for revil has popped up on cybercrime forums, giving
some juicy insights as to the gang’s future plans and explains some dumb mistakes they
made in their last campaign.
But who is revil? The Russian ransomware gang was one of the internet’s largest, according
to Emisoft in Q1 this year their malware accounted for 4.6% of ransomware attacks globally. They
were responsible for some of the internet’s most memorable ransomware stings, too many
to go through in one video, see their wikipedia page for that. Though to mention just a couple,
they exfiltrated Macbook schematics from a taiwanese manufacturer, and tried to charge
Apple 50 million dollars not to leak them.
But their most notable attack, which immediately preceded their disappearance was the Kaseya
hack, in which they exploited a vulnerability in software sold by Kaseya, this software
is used by companies to monitor and control whole fleets of computers. Thousands of companies
each saw dozens if not hundreds of their computers infected which caused a massive headache for
IT admins. Revil set the ransom in this case at 70 million dollars - which wasn’t paid.
Revil’s re-emergence has seen their dark web blog resurrected. They call this the “Happy
Blog”. Here they post data from the companies they hack which refuse to pay the ransom.
Some of you guys in the comments have pointed out that revil is probably meant to be pronounced
r-evil, which does kinda make sense I suppose - though until we get an official advisory
from the group itself, I’m sticking with revil. Besides, revel is a word, though spelt
differently, it means to “enjoy oneself in a lively and noisy way” - which does
somewhat fit in with the gang’s brand, after all they call their dark web site the “happy
blog.” Anyway, speaking of their “happy blog”, it doesn’t seem to contain any
new entries appended since they went dark, suggesting that they’re not actively pwning
victims, at least not yet.
Revil is ransomware as a service group meaning they rely on their affiliates to spread their
malware, affiliates which may have moved on in their cybercrime careers since revil’s
departure. Given revil’s reputation, it won’t be hard for them to attract attention,
though persuading affiliates to rejoin, after having just left them so suddenly will be
a challenge.
A new account has popped up on cybercrime forum ‘exploit’ claiming to represent
revil. Flashpoint details the activity of the account which explained “the ransomware
group has managed to come back online using their backups.” The account also details
how the gang screwed up the Kaseya hack. You might remember a week or two after the Kaseya
hack went down, a universal decryptor key mysteriously appeared and was distributed
by Kaseya to victims. The rumour mill was rife with speculation at the time, some suggesting
that the Russian government had compromised revil, and handed the key over to the FBI
as an act of goodwill, others thought Kaseya had simply paid the ransom. However, we now
know that the universal decryption key was leaked, by mistake.
The revil spokesman says “we had to generate between 20 and 500 decryption keys for each
[individual] victim [because the victims of the Kaseya attack all had networks of different
sizes].” “One of our coders misclicked and generated a universal key, and issued
the universal decryptor key along with a bunch of keys for one machine.” Flashpoint said
the universal decryptor “was then discovered and sent to Kaseya and law enforcement agencies.”
There’s not much left to say about Revil's return, we shall have to wait and see if they
ever manage to regain the ground they’ve lost in the last
couple months.