Hello world, first up in today’s roundup of cybersecurity tech news
A brand new campaign involving BadUSBs has been spotted in the wild - this is coming
from the FBI, which explains those targeted include businesses in the transportation and
insurance industries, and even defence firms.
These attacks came in the form of BadUSBs being physically mailed to companies, disguised
as coming either from Amazon, or the “US Department of Health & Human Services” - the
FBI hasn’t explained exactly what the cover story for the USB sticks was, but somehow
accompanying letters in the packages will have encouraged victims to plug the USB sticks
in.
And when they did, the things injected keystrokes which typed out a powershell script, downloading
malware - surprise, surprise.
I’m assuming you guys know what a BadUSB is, if not see my video up here.
BadUSB hacks in the real world are incredibly rare, why?
Because it’s a lot of effort, and comes with a high risk of getting caught.
The physical world, for the most part, just isn’t the blackhat’s domain.
It’s much easier for them to send spearphishing emails from their basement, it’s what they
know.
By shipping a physical thing, they now have to worry about fingerprints on the device,
potentially CCTV in post offices, and so on - the hassle just isn’t worth it, I think
is why we don’t see many BadUSB hacks irl.
In fact, the only other BadUSB hack in the real world I’m aware of is one that took
place a couple of years ago, the miscreants impersonated “Best buy”, with a gift card
that only worked with a list of products apparently stored on the USB stick.
Funnily enough both that attack and this latest one were perpetrated by FIN7 - a famous cybercrime
gang, often described as a “billion dollar hacking group” because they’re notorious
for stealing millions of credit cards and hacking thousands of businesses.
I couldn’t help but notice that these BadUSB attacks have specifically used “Bad Beetle”
USB devices, or those with a “LilyGo” logo, these are all arduino based BadUSBs
- the fact that these things even exist at all, is probably my fault.
Allow me to explain.
I didn’t invent the concept of the BadUSB, I also didn’t invent the concept of keystroke
injection using arduino development boards.
However what I did do was put the two together and popularise the concept of an arduino based
BadUSB.
You can go back to my videos from 4 years ago, when I made a proof of concept BadUSB
device based around arduino, after which I made the MalDuino, which was - as far as I’m
aware the first commercially available arduino based BadUSB.
It was only after I made the malduino that cheaper copies like this one started popping
up on sites like aliexpress - oh and look at that, it’s exactly the same one that
was used in the bestbuy scam.
Unfortunately because news of this latest BadUSB campaign came from the FBI, there isn’t
much publicly available knowledge on the saga, so we don’t which companies specifically
were targeted, or even what the end goal was here, ransomware perhaps?
I think you guys are going to really appreciate this little nugget of poetic justice, in that
no matter how polarised the world may have become, we can all agree on one universal
truth, printer ink is too bloody expensive.
Whenever there’s a reddit post on criminally overpriced things, printer ink pretty much
always takes the cake.
And one of the great enables of overpriced ink is that cartridges often come with DRM
chips, these chips verify that an ink cartridge is genuine, so if you use a cartridge without
one of these chips, the printer will suss it out and depending on the brand, the printer
will sometimes even just refuse to work.
Not all brands to this, so you can usually avoid it by researching a printer before you
buy it, but even if you buy a printer that accepts 3rd party cartridges it’s not guaranteed
that the printer manufacturer, say for example HP, won’t roll out a firmware update after
you buy it - preventing your printer from using anything but genuine cartridges.
This has happened.
Last year someone even tried to bring a class action lawsuit against HP after they did this
to his printers - but before you grab your pitchfork, the judge threw out the case, in
part because HP printer boxes come with warnings not to use anything but genuine ink, so apparently
that absolves them of wrongdoing.
But anyway, as the global chip shortage rages on, the supply of the chips that enable DRM
is drying up fast.
Canon in particular has been having so much trouble getting them that they’re now having
to ship ink without them.
A press release on Canon’s website explains that they’ve decided to ship cartridges
without these “semiconductor components until normal supply is restored.”
They’ve even had to post instructions on how to bypass the angry prompts from printers,
which will just assume you’re using non genuine ink.
Luckily though, when it comes to Canon printers at least, you just need to press ‘Close’
on the prompt - and the ink will work perfectly fine, except you won’t be able to tell how
much ink you’ve got left as Canon chose to prevent 3rd party cartridges from even
being able to tell the level of ink to the printer.
Whilst it is possible and even likely that the chips Canon needs are just unavailable,
there’s also a good chance that the chips are very much so available, but the price
of them has skyrocketed to such a point that it no longer makes sense to even use them.
It’s been a while since I’ve seen Kazakhstan in the news for anything unrelated to Borat.
But I’m sure at this point, you’ll have heard of all the anti-government protests
- it’s been pretty intense the past week or so.
But the reason I wanted to talk about it, is that there have been reports that the Kazakh
government has been screwing with people’s internet connections, presumably in an attempt
to hamper protests - we’ve seen this recently in other countries like Sudan and Myanmar.
It’s typical of authoritarian regimes, where instead of censoring specific websites, those
in charge unplug the metaphorical ethernet cable to the whole country - making it hard
for people to organise protests.
Cloudflare has recorded instances of Kazak internet traffic dropping to pretty much zero.
Literally turning off the internet is a pretty nuclear censorship tool, and given it affects
a country’s ability to do a lot of other things other than just protest, these outages
tend not to last too long - and so the internet is at the moment at least, back to normal.
However, google trends shows that in the past few days the demand for VPNs from Kazakhs
has absolutely skyrocketed, particularly in the ‘Almaty’ region - which as I understand
it, is at the epicentre of the protests.
Whilst a VPN can’t get around a literal internet outage, it can help circumnavigate
blocks of certain websites, if, or probably more so when the government decides to start
blocking things.
Don’t worry, no VPN ad is coming up next - I promise.
I don’t have many Kazakh viewers, I did the maths, about 0.006% of my views come from
Kazakhstan, but for the 2 Kazakh viewers I have I’ll link an article from the torproject
on how you can use tor in Kazakhstan - it’s a little more complicated for you guys as
your government has been known to mess with and censor tor - so you might need to use
a tor bridge.
Screwing with tor is one thing but it gets even crazier, in that the Kazakh government
has launched several campaigns in the last few years, pushing their citizens to even
install a government issued root certificate on their browsers, this would essentially
give the government the ability to intercept and read HTTPS encrypted traffic, it’s a
pretty audacious thing to even try.
In response both google and mozilla, announced they would protect users by blocking the certificate
from even being installed manually in their browsers.
This video was made possible by Intigriti: Europe’s biggest bug bounty platform, allowing
you to make hard cash in exchange for finding and reporting security vulnerabilities.
Intigriti’s stands out based on their focus on their community, with monthly challenges,
weekly newsletters and their own youtube videos in which they cover new tools and hacking
techniques.
Despite amassing over 40 thousand active security researchers they maintain blazing fast triages,
typically getting back to reports in under 24 hours.
Intigriti uses your goals and skills to connect you with their ever increasing array of over
200 active programs with millions of bounties already paid out.
Join Intigriti’s vibrant and growing community today, create an account via the link in the
video description.
That’s all for this video, you know the drill, mutilate the like button, scrub and
scribe, all that fun stuff.
Follow me on the instagrams for behind the scenes content, sources are linked in the
description, and I’ll see you in the next video.