Hello World, Hackers are now using drones - we have the very first documented use of
them by cyber criminals.
And police trick a ransomware gang out of their decryption keys.
That’s all coming up in today’s roundup of cyber security tech news.
The idea of hacker drones, has previously been, just that, an idea.
We’ve seen the potential of them discussed at various hacking conferences, some people
have even made proof of concept devices, but we’ve never seen one actually being used
in the wild by cybercriminals.
That is until now…
It might not be on the same level as a watchdogs hacking drone, which can seemingly do anything,
but it is still big news.
A security researcher has given us a breakdown of events, the incident affected a financial
company on the East coast of the US.
They knew something was wrong when they spotted “unusual activity on their internal confluence
page”.
Confluence is a popular project management tool used by businesses - a valuable target
for cyber miscreants because it contains juicy topics like intellectual property which could
be held to ransom.
And so, in the context of a hack, unusual activity on a company’s confluence server
isn’t all that unusual, what was unusual though is that this activity “was originating
on their own network.”.
This is strange, because hackers typically prefer to work remotely.
Actually physically showing up in person to hack a company, Mr Robot style, is quite rare
- but this wasn’t quite the case here.
The company launched an investigation and found an unknown WiFi device had connected
to their network, and was trying to cover its tracks by spoofing the MAC address of
an employee.
With the help of some fancy WiFi tracing equipment, they began a hunt for the offending device,
which led them to the roof.
Where they found two drones, firstly a ‘dji phantom’ - a pretty standard drone you’ve
probably seen before.
Strapped to this thing was a ‘WiFi Pineapple’ - a popular WiFi hacking tool.
The second drone was a ‘dji matrice 600’, which is a beast, described as a ‘heavy
lifting platform’, this thing is designed to carry 6 kilos of camera equipment, though
in this case it was loaded with a ‘raspberry pi, gpd mini, 4g modem’ and of course a
bunch of batteries to power the whole setup, which all in all is estimated to have cost
in the region of $15 thousand dollars.
The plan of attack here was to use the WiFi pineapple on the smaller drone to intercept
an employee’s credentials, and then, with the gear on the larger drone, use those credentials
to log into the company’s network and access their confluence site, all whilst managing
the attack from miles away with the help of the 4g modem.
But, this is where we have to employ some guesswork, because thanks to NDAs the exact
technical details behind the hack can’t be revealed by those who investigated it.
However WiFi attack methods are a fairly well trodden topic.
It’s likely the miscreants initially used an ‘evil twin’ attack, as in creating
a WiFi network with the same name as the company’s legit one - and then they just waited for
an employee to connect to it by mistake.
The process of waiting could’ve be sped up by intentionally kicking devices off the
legit network, in what’s called a deauth attack, hoping that in their frustration an
employee would connect to the imposter WiFi network by mistake.
At this point the attackers might’ve used a captive portal - as in, those web pages
that sometimes spawn when you connect to a new WiFi network.
You typically get them when you connect to WiFi hotspots at airports or coffee shops,
prompting you to sign in or something.
But these can be repurposed to impersonate a genuine login page, socially engineering
an employee out of their credentials.
At this point the attackers would have everything they needed to access the businesses services
and do whatever it is they came for, probably to steal data and hold it to ransom.
In this case “the attack was a limited success”, because whilst they did actually manage to
access that confluence site, it looks like they were rumbled before much harm could be
done.
One thing that stood out to me about this whole story, is that whilst on the surface
it seems like the setup the miscreants were using was super high tech and fancy, when
you think about it, it was actually rather primitive and crude.
It seems like the threat actors got a bit carried away here and just duct taped all
their favourite devices to whatever drone was capable of carrying all that weight.
Resulting in a very expensive, bulky and power hungry setup.
A more skilled threat actor would be more thoughtful about their hardware, like maybe
running the WiFi exploitation on a WiFi development board or a pi zero, and instead of controlling
it via a power hungry 4g modem, which I imagine is very traceable back to whoever bought the
data plan for it… they could’ve used a low power lora module transceiver, these things
have several kilometres of range.
An added bonus of a setup like this is that it would be so low power that they wouldn’t
need quite so many batteries, which would reduce weight further so that it could all
be stuck on a much smaller and cheaper drone - that if found on a roof wouldn’t raise
quite so much suspicion as a drone costing many thousands of dollars.
I mean I’m not trying to give anyone any ideas here, I’m just trying to make the
point that the setup the miscreants were using was really quite ridiculous, it’s as if
they loaded everything but the kitchen sink onto their drones - like, I can’t understand
why they needed to strap a GPD mini laptop to the larger drone when they already had
a raspberry pi on it, what point is there in a second computational device, redundancy
maybe?
In the future I think we can expect to see this kind of drone attack evolve to be a bit
more sophisticated.
So, one thing I wanted your guys’ opinion on, is what to call this kind of ‘drone
attack’.
‘Hacker drones’ doesn’t roll off the tongue very well and I haven’t read about
any better ideas, let me know your thoughts down below.
Dutch police have tricked the “Deadbolt” ransomware gang out of 155 decryption keys,
now this story is amazing, if you needed some uplifting news, well we have some here.
The “deadbolt” ransomware gang have recently become well known for attacking QNAP devices
- which is a brand of “network attached storage” device.
Back in January “Deadbolt” discovered a zero day vulnerability in these things,
and ever since then they’ve been exploiting it to encrypt and hold QNAP devices to a ransom
of 0.03 bitcoin, roughly $600.
Once a victim pays up, Deadbolt has an interesting way of delivering the decryption key.
In their ransom note they proudly state that “our decryption key delivery process is
100% transparent and honest”.
So, after a victim pays the ransom, “the decryption key will be delivered to the bitcoin
blockchain inside the OP_RETURN field”.
This is a special field in a bitcoin transaction which can be used to store up to 40 bytes
of arbitrary data on the blockchain.
Deadbolt are using this field to send the decryption key to the same wallet which paid
the ransom, the victim can then just paste it into the decrypter and get their files.
This is really quite a clever way of doing things as it removes any need for Deadbolt
to operate their own infrastructure, like a dark web site or something to send the key
to the victim.
Instead they can just have a script to monitor the payment address, and automatically plop
the key onto the blockchain when a payment is made.
It’s quite a slick set up, however unfortunately for Deadbolt, there’s a really basic but
severe problem with it.
You see, Deadbolt’s script didn’t take into account how many confirmations a ransom
payment had before sending out the corresponding decryption key.
And if you know a bit about bitcoin can probably see where this is going…
So, Bitcoin transactions aren’t instant, the second you send a bitcoin payment it enters
the bitcoin transaction pool, before it eventually gets included in a block which is then written
to the chain.
Only once the transaction is in a block, on the chain, in other words, on the blockchain,
is it generally considered complete.
And this usually takes 10 minutes or so.
The number of “confirmations” refers to how many blocks deep a transaction is on the
blockchain, the more confirmations means the less reversible a transaction is.
A crypto exchange like coinbase will wait till there’s three confirmations before
it’ll consider the transaction finalised.
Exactly, how many confirmations are needed before a transaction is considered 100% irreversible,
is up for debate, but Deadbolt didn’t wait for any before sending out decryption keys.
This is really dumb on their part, because whilst a transaction is in the pool it’s
really easy for someone to cancel it.
And this is pretty much what the Dutch police did, they paid the ransoms for 155 victims
and instantly received the decryption keys.
At this point Deadbolt was probably over the moon at their payday, which would’ve been
equal to roughly $90 thousand dollars.
But before they could celebrate, and more importantly before the transactions could
be written to the blockchain, Dutch police cancelled the ransom payments.
So they effectively got those decryption keys, for free.
The operation to nab the keys was done in collaboration with responders.nu - who initially
discovered this vulnerability.
And they’ve set up a website where victims can get their decryption key.
However, this was always going to be a one off operation, because after realising their
mistake, Deadbolt fixed the vulnerability and now require transactions to have two confirmations.
This video is sponsored by PCBWay, the complete solution for all your PCB Fabrication and
on demand 3D printing needs.
From standard PCBs to the more advanced varieties, PCBWay provides granular control over every
element of your PCB.
With superfast turnaround times you’ll be spending more time creating and less time
waiting on packages.
PCBWay also offers on demand machining, from CNCing and sheet metal cutting to 3d printing
and injection molding, there’s an array of materials to choose from, and of course,
superfast turnaround times.
Sign up now using the link in the description to get a $5 coupon, which can be used site
wide.
As always thanks for watching, and I’ll see you in the next video, have a good one.