Hello, World!
Hackers have invented yet another way to steal files from a computer - the new technique
exploits a computer's sata cable to act as an antenna - so malware can send files to
a nearby hacker controlled receiver.
Now, if you've ever put a PC together you'll be familiar with SATA cables, they're used
to connect things like hard drives to the motherboard - and given pretty much all computers
use them, this technique will work on virtually all computers.
However, obviously such an exotic exfiltration technique is kinda redundant when malware
can just... send files to hackers over the internet.
But, that's not always possible, the research paper which explains this method describes
this as a technique to extract data from "air-gapped systems" - in other words, computers with
no internet connection.
These computers are common in nuclear power stations, military facilities, banks and so
on - high value targets where the convenience of internet access just isn't worth the risk
of being hacked.
However, hacks of these high value air gapped systems do happen every so often.
But there's only 17 instances that we know about, and all of them had one thing in common:
USB sticks were used to both infect the air gapped computers, as well as exfiltrate files.
But this new research provides an alternative way to exfiltrate those files other than the
humble USB drive.
In the researcher's scenario, an air gapped computer would first have to be infected with
malware - I imagine probably using a USB stick.
But after which, the malware would create a covert communication channel by exploiting
the fact that any cable can theoretically be used as an antenna, the researchers of
course opted to exploit a computer's internal sata cable.
And, after the malware encodes the target files for transmission it would then perform
certain read/write functions to and from the drive in order to generate a 6GHz RF signal
emanating from the SATA cable.
In the researcher's proof of concept video they do just this to transmit the string "secret"
to a nearby computer.
Though it is pretty slow, taking a good few seconds to transmit what is effectively 6
bytes, but it does work and is arguably more reliable than waiting for an employee to unwittingly
insert a USB stick into the computer, something which may not even happen.
In terms of countermeasures, the paper suggests software which performs random read/write
operations to disrupt any transmissions.
But that would wear down drives - I propose a much simpler solution of wrapping cables
in aluminium foil, or better yet using RF shielding tape that you can quite easily buy
on Amazon.
However, there are quite a few caveats to this exfiltration method, which themselves
act as pretty good countermeasures.
This technique works on 6GHz, a frequently which just doesn't travel very far in air
- the paper suggests a usable range of just 120cm, so a receiver would have to be pretty
close to the machine in order to grab anything at all.
And there's the other issue, the receiver would have to be able to listen on 6GHz, an
SDR receiver like the hack rf one ought to do it - but it would need to be smuggled in
to the secure location, at which point an attacker might as well just smuggle in a USB
stick and manually exfiltrate the files.
So, I can't imagine this method will see any real world use, though it is admittedly really
pretty cool.
After doing some googling, I figured that the guy behind the research paper, one "Dr.
Mordechai Guri" is somewhat of an air gap fanatic... if such a thing exists... he has
what looks like a couple dozen papers, all on different ways of exfiltrating data from
air gapped computers, including turning a power supply into a speaker, modulating a
screen's brightness, and transmitting data through a hard drive's LED, as well as a bunch
more.
I'll link his other papers in the description.
Next up, a new operation targeting industrial control systems has been uncovered.
Now news like this is generally really pretty bad, it evokes memories of stuxnet, and thoughts
of the chaos that could ensue if something like the power grid was targeted.
At the center of the newly discovered operation are something called PLCs (programmable logic
controllers), these things are essentially industrial computers which control the operation
of industrial machinery, like anything from centrifuges making highly enriched Uranium,
to textile machines making knockoff Pikachu blankets.
These things are pretty versatile and can be programmed to do almost anything in an
industrial environment.
But, the security situation around them is pretty unique, PLCs are often quite old and
insecure, but they're typically air-gapped so hackers usually can't even get to them
- and getting to them is the main hurdle to overcome if you wanted to, oh I don't know,
sabotage centrifuges used in Iran's nuclear program.
And in the case of stuxnet, it's thought malicious USB sticks were dropped around Iran's nuclear
facility, in the hope an unwitting employee would plug one in, which they did.
But anyway, it seems that miscreants have figured out another way to reach those valuable
PLCs.
Researchers from Dragos have uncovered an army of posts on social media advertising
software to crack the forgotten passwords to PLCs, because engineers also forget passwords
and sometimes have to turn to google to find a solution, just like the rest of us.
This "password cracking software" actually does what it says on the tin, kinda, you plug
the PLC into your computer via a serial connection, click "readpass" and the software tells you
the credentials - it retrieves the password by exploiting a vulnerability in the PLC's
firmware.
But the strange part of this story is that the software doesn't actually do anything
to the PLC - far from being stuxnet 2.0, the malice comes in the form of malware known
as "sality" being installed on the computer running the software rather than the PLC itself.
"Sality" is actually pretty basic in the grand scheme of things, after adding the victim
to it's botnet, it does things like mine crypto on the infected computer as well as monitor
the clipboard for crypto wallet addresses, replacing them with its own hardcoded wallets,
so victims unknowingly paste incorrect addresses, sending crypto to the bad actors.
It's kind of ironic, the bad guys here have figured out a way to socially engineer the
engineers themselves into providing them access to PLCs, but have used the opportunity to
drop pretty basic malware onto the engineers' computers.
That being said, in this case it looks like the miscreants are moreso targeting the knockoff
Pikachu blanket makers rather than Uranium enrichment facilities.
So I found posts advertising this software in facebook hacking groups.
An odd string of words that, "facebook hacking groups", these groups are generally made up
of people in and around India.
So it looks like this whole operation is simply exploiting the Indian subcontinent's array
of factories, and their forgetful engineers to add more victims to their botnet.
This is better, or should I say less worse, than what I initially thought when I started
reading into this story, that this was some kind of espionage operation.
Next up, six severe vulnerabilities have been found in a popular car tracking device, some
of which could enable an attacker to effectively take over a victim's car.
The culprit is this thing, the Micodus MV720.
The scale of the vulnerabilities is pretty embarrassing, and the manufacturers apparent
unwillingness to fix the issues makes this so much worse, but we'll get to that shortly.
To use the thing you plug it into your car, then, using its onboard gps and cellular connection
you can control it via an app - where you can do things like track it's location, set
up geofencing to alert you if your car moves outside of a predefined area.
Also, if you car has been stolen you can remotely cut off its fuel supply, even when it's moving,
which they eloquently demonstrate on the product page.
It has a load of more features, and seems pretty useful, for less than 10 pounds, or
11 dollars, it seems like a steal - so, what's the catch?
Well - what isn't advertised are the 6 severe security vulnerabilities that come complimentary
with every purchase.
Cybersecurity company 'BitSight' originally identified them last September, and did the
obvious thing, alerting the manufacturer, or at least they tried to, several times,
without any response.
It eventually became clear the people making these things probably didn't care, so BitSight
was forced to publish a paper detailing all the problems, that are still to do this day,
unpatched.
For example, the HTTP communications used by the app to communicate with the server
are unencrypted, allowing man in the middle attacks to modify requests.
But there are bigger problems, like the hardcoded master password which exists in each unit,
but a bad actor probably wouldn't even need to use it, because all the devices come with
the same default password '123456', the problem is intensified because the device ID numbers
are sequential, so guessing them is easy.
Given that these two pieces of information are all you need to log in, it's trivial to
maliciously access 94% of accounts.
I say 94% because that's the proportion of devices still using the default password according
to BitSight.
But this story wouldn't have even made it into the news if it wasn't for just how many
of these devices there are, out in the wild - 1.5 million are currently active, and BitSight
found they were being used "by organisations including government agencies, military, and
law enforcement", along with just regular people.
I found the trackers are still available for purchase on amazon, ebay and aliexpress - where
they're a best seller.
I'll of course link the full report in the description, because of just how easy these
things are to exploit I'd be actually really quite surprised if there isn't already an
army of trolls already trying to screw with them just for the hell of it.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace which makes it super easy to spin up servers
with preconfigured software.
For example, use Linode's pi-hole app to set up a DNS sinkhole, that you can use to block
ads across all your devices - and yes I recognise the irony in promoting ad blocking within
an ad!
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always thank you for watching, sources can of course be found in the description,
stay tuned for more hacking videos and have a good one.