First up in today's roundup of cyber security tech news - Something I've never seen before.
A TV station's live broadcast has been hacked, Mr Robot style.
You know what I'm on about - the fsociety videos - consisting of a dude in a funky mask
with a voice changer, those videos which themselves are of course a reference to the archetypal
Anonymous video, a format which has become a bit of a tradition, it goes back years.
Well, just a few days ago this format entered the real world when Iran's national TV station
had their web stream hijacked by a hacktivist organisation.
They quite literally interrupted normal broadcasting and played their video - let's have a watch.
I've had to mute it because the sound track could get me copystriked - but I think you
get the idea, the masked man calls on fellow Iranians to rise up against the government.
It also features images of Iran's supreme leader burning, as well as a clip of a well
known Iranian rights activist ripping off her hijab.
I can't say much about the politics of the message, this isn't a middle eastern politics
channel - thank god.
But what I can say is this will have been supremely embarrassing for Iran's Supreme
leader - and to add insult to injury, the video was repeated every so often for a few
hours, until the company behind the stream "Telewebion" finally managed to regain control
of their systems.
They did eventually acknowledge the hack - if you can even call it an acknowledgement - tweeting
that "despite widespread cyber attacks telubion hosted more than 4 million users, and so on"
- they just refused to take the L, which is funny because this is the second time in recent
weeks that Iranian TV has been highjacked by hacktivists, a few days prior the regime's
TV channel was taken over - only for a few seconds though, this time the broadcaster
actually managed to wrestle away control from the intruders pretty quickly.
As for the group behind the attacks, responsibility has been widely attributed to the "Adalat
Ali" hacktivist group - which is responsible for a lot more than just this one operation
- they were also behind the hacking the CCTV of an Iranian prison, not only did they expose
the apparent abuse of prisoners - which I of course can't show on the youtubes, but
they also - and this has strong Mr Robot vibes - when they had exfiltrated what they needed
from the prison's network, they took over the CCTV feeds, take a look at this.
So a prison guard is keeping tabs on CCTV feeds, until they start flashing, and then
display anti regime messages.
Then instead of trying to frantically respond to the hack, other prison staff come over
and start taking photos, as you do.
The hacktivist group made their debut in 2018 when they hacked departure screens in an Iranian
airport, and displayed similar anti regime messages.
And by the way, these kinds of stories almost never make mainstream news, probably the only
way you're going to hear about these shenanigans is through this channel, so make sure to scroll
down right now and hit that subscribe button.
Next up, and this story is almost as insane as the previous one, script kiddies have been
trying to get activists jailed by planting false evidence of assassination plots on their
computers.
This story caught my eye because despite these hackers being incredible basic and amateurish,
they have been rather successful.
And on top of that, this group seems to be government sponsored - allegedly of course.
This all comes from a report recently published by sentinelLabs - almost everything from here
on out is according to them - so let's dive in.
The group of miscreants has been dubbed "Modified Elephant" - they've been operating for over
a decade, but have gone largely under the radar because they only target a handful of
victims on the Indian Subcontinent - victims include "Activists, human rights defenders,
journalists" and so on, their objective being "long-term surveillance" before planting "evidence"
on their computers, leading to "conveniently coordinated arrests".
One such activist "Rona Wilson" had plans for a literal assassination attempt against
Indian Prime Minister Modi placed on his PC, he was then arrested and charged with Terrorism.
But how does "Modified Elephant" conduct their operations, well, they seem to be script kiddies
in the finest sense.
They typically send spearphishing emails, laced with malware which is disguised using
double extensions - think ".pdf.exe" - not much of a disguise, and in some cases they'll
forego the ".pdf" part and just use really long filenames for their malware, presumably
in the hopes that victims fall asleep halfway through reading it?
All whilst relying on low quality one liner email bodies - of course.
As for the malware itself, "Modified Elephant" has been known to utilise "dark comet" - it's
an off the shelf RAT, which is widely available and has often been the go to choice for script
kiddies.
In fact, way back in my minecraft server hosting days, back when under 30s used skype - an
ancient era, darkcomet was the standard tool kids would use to mess with eachother - it
comes with dumb features like a musical keyboard which outputs straight to the victims' speakers,
so you can oppress people with your awful musical abilities - there's even a whole section
called "Fun Functions".
Of course it can do more useful things, but for the most part, it is the script kiddies'
weapon of choice.
In fact, it gets worse - this group uses a software keylogger which looks like it's been
made using copied visual basic code posted on an Italian hacking forum way back in 2012.
But "Modified Elephant" has evolved through the years, upgrading to using emails containing
microsoft word documents which of course contained malicious macros.
In one interesting case the group was observed trying to evade antivirus software by using
really large files - exploiting the fact that some anti malware solutions will ignore files
over a certain size because they take too long to scan.
So by using executables over 300MB they could slip under the radar, but cleverly most of
the file would just consist of the same byte repeated over and over, so they could compress
it into a relatively small .rar archive that wouldn't take ages to download.
Also, it doesn't look like our hackers were much concerned with trying to stay quiet,
forensics shows that in one case they planted the same evidence on two different people
within 15 minutes of each other.
To make matters worse, they are quite the impatient bunch, "in specific attacks, the
actor would be particularly persistent and attempt to compromise the same individuals
multiple times in a single day."
Whilst this is all very funny, hilarious in fact - this group has seen success.
Two of the people apparently targeted are currently in jail, awaiting trial - it should
be noted that they are on trial for other things as well as the apparent "assassination
plots", but their other charges are out of the scope of this video.
As for figuring out who's behind "Modified Elephant", sentinelLabs calls that an "interesting
challenge", they add "ModifiedElephant activity aligns sharply with Indian state interests",
and point out the odd coincidence of people being arrested right after evidence is planted.
If you want to go down a rabbit hole I'll have the full research paper on this story
linked in the description.
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
Thanks for watching, you know what to do, tickle that notification bell and follow me
on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.