Hello, World!
How I was scammed when I tried to buy a few hundred microSD cards from China, and how
ChatGPT is revolutionising phishing.
That’s all coming up in today’s roundup of cyber security tech news.
We’re starting off this video with something a but different.
We’ve all heard about fake sd cards, they’re advertised as having a super high capacity,
but come at a super cheap price.
But that’s not the end of the story when it comes to fake cards, there are other ways
sd cards can be dodgy, and I found out the hard way.
So a few weeks ago I was in the market for some microsd cards, and I needed a lot of
them.
What for?
Well, I run Maltronics.com - we make and sell various pentesting products, including the
MalDuino, a kind of BadUSB.
Similar to Hak5’s USB Rubber Ducky, this thing is a keystroke injection device capable
of carrying out tasks on a computer in just a few seconds.
But anyhow, we made a new version of our MalDuino and thought it would be a nice addition to
include a microSD card with the device, instead of expecting people to buy one separately.
So I loaded up Alibaba - the mecca of wholesale electronics - chose a microSD card seller
and bought some cards.
But here, I made the fatal error of not buying samples first, something I always do, well
- apart from this one time - but hey, I was in a big rush, we were working to a deadline
and time wasn’t on our side.
And whilst I am aware of microSD cards with fake capacities, I was buying 2GB cards, not
something you’d expect to be scammed over.
Anyway, I bought 800 cards, for $1.25 each - when you account for shipping and import
taxes the total was something like $1200.
And if you’re wondering what 800 microSD cards looks like, well - something like this,
it’s a pretty small package, with the cards packed together like sardines.
I tested a card in one of our new MalDuinos, with no luck - it didn’t recognise the card
at all.
But I tried the same card in a computer and it worked just fine, hmmm strange.
This is when we made an interesting discovery, well - to be more precise, Spacehuhn, who
develops the firmware for the MalDuino made an interesting discovery.
It turns out the real capacity of the cards was actually 4GB, but they had been partitioned
to make them look like 2GB…
so, had I been reverse scammed?
I mean, these things are double the capacity it says on the tin.
So, you might think I’d be pretty chuffed that I’d gotten more than what I paid for,
but no - MalDuino isn’t compatible with partitioned cards, and I wasn’t too thrilled
about the prospect of having to manually repartition 800 microSD cards.
Besides, we needed 2GB cards specifically, I’ll explain why in a bit.
But anyway, I repartitioned one of the cards to its true capacity, 4GB, but it still wouldn’t
work in our MalDuinos, despite working fine on my laptop, why?
Our working theory is that these cards are flat out fake, you see, genuine SD cards work
in two modes, SD mode and SPI mode.
SD mode is high speed, and it’s used by computers, mobile phones, laptops, and so
on.
SPI mode is lower speed, and is commonly used in lower end hobbyist electronics platforms
like Arduino - which is what our MalDuino is built on.
The bonus of using SPI mode is that you don’t need to pay a license fee to implement it
in your product, something you have to do if you want to use SD mode.
And whilst SD mode obviously works fine on these cards, the manufacturer seems to have
forgotten all about SPI mode, perhaps on the assumption that no one would notice.
But who is the manufacturer of these cards?
Well, we tried to read the ROM off them, but we found the manufacturer ID, OEM ID, and
Product number, were all blank.
It’s almost as if whoever made these cards is a little shy about revealing themselves.
But regardless, at this point we’d missed the deadline for rolling out the new version
of the MalDuino, so I turned my attention to getting my $1200 dollars back for these
obviously dodgy cards.
Luckily Alibaba has what they call “trade assurance” meaning your orders are protected
incase a seller tries to screw you over, great!
So I sent Alibaba proof that the cards weren’t as described - I wanted 2GB cards, but these
are 4GB - and by the way the reason why I wanted 2GB cards specifically is that lower
capacity cards work faster in SPI mode.
I of course, pointed out to Alibaba that the cards just don’t work properly in SPI mode,
making them completely non compliant with the SD standard.
But this is where the mental gymnastics of this Alibaba seller comes into play, you see,
despite the product page clearly referencing SD cards, the seller explained in their response
that no no, these aren’t microSD cards, these are mitos cards, they even produced
a trademark certificate which seems to be their excuse for the cards not working as
microSD cards should.
This is obviously a ludicrous excuse, but it’s one that Alibaba accepted, turning
down my refund request - implying there was no wrongdoing here.
So here I am, $1200 lighter and left with hundreds of “mitos” cards.
So, I thought I’d document this story as a bit of a cautionary tale, firstly - always
buy samples and secondly don’t rely on Alibaba’s trade assurance, I’ve been providing them
with evidence for well over a month that these cards are full of BS on various dimensions,
but Alibaba doesn’t seem to care, and would rather throw their customers under the bus
in favour of their sellers.
We did eventually manage to source some cards that work properly with the new version of
our MalDuino, if you want to learn more about that, head on over to Maltronics.com
Ever since the inception of the internet, one of the easiest ways to spot a phishing
email has been how awfully written they are.
Take this email, supposedly from Apple, “Dear customer, we have received your iTunes account
is used for fraud.
Your account will be suspended until you confirm that you are the original user account”
- it’s embarrassingly bad, I mean - regardless of how good this bad actor’s malware might
be, it’s irrelevant - because you’re just not going to fall for this.
A better phishing email might look something like this, pretending to be from PayPal, letting
you know your account has been limited.
It’s well formatted with headings, subheadings, and the button looks like the style of button
that PayPal might actually use.
But its credibility disintegrates the second you start reading it - there’s incorrectly
capitalised text, misspellings.
And the sentence structure is off, it just doesn’t read like something you’d find
in a PayPal email.
I mean, look at the button text “Restore Payment to PayPal” it just doesn’t make
sense.
Poor quality phishing emails is something I’ve been making fun of for a very long
time, I find it hilarious that regardless of how democratised cyber crime has become,
with malware as a service enabling script kiddies to pay just a few dollars a month
to access technically sophisticated tools, their results are significantly truncated
by their poor literary skills.
However, the days of poorly written phishing emails are sadly, numbered - thanks to AI.
Like many of you, I’ve spent way too much time playing around with image generating
AI’s like midjourney and DALL-E 2, but it never really occurred to me that a text based
AI could blow my mind in the same kind of way, well - that’s until I tried OpenAI’s
ChatGPT.
And I’ll spare you the explanation of what it is, because it’s been everywhere the
past few weeks.
But for the uninitiated, using this chatbot is like talking to an expert on whatever topic
you want, who just so happens to also be a linguistics genius.
So, aside from being able to write poetic explanations of quantum entanglement, chatGPT
is also pretty good at writing phishing emails.
For example, I wanted to see if I could recreate the PayPal phishing email from earlier, but
better.
So I asked it “Write an email from PayPal's customer support, telling a customer that
their account has been limited because of suspicious activity, and they must click a
link to solve the issue”.
Notice ChatGPT identified the request as being against their terms of service, but it answered
it anyway.
And its answer, was jawdropping.
The chatbot understood the assignment perfectly, the output is written in the exact style you’d
expect from customer support, there are no grammatical errors, and it even puts a placeholder
where the link should be.
It also went out of its way to add some encouragement “Please note that this is a time-sensitive
matter and failure to verify your identity may result in your account being permanently
suspended”.
I then just asked it to, “Make it more convincing”, and it added a whole paragraph saying that
“someone may have attempted to log in to your account without your permission.”
And that “to prevent unauthorised access to your account, we strongly recommend that
you verify your identity as soon as possible”.
At this point, I kinda felt like I was playing with fire.
I mean - sure, generating phishing emails with AI isn’t unique to ChatGPT, I first
saw research popping up last year on generating phishing emails with GPT-3 - ChatGPT’s predecessor.
However the quality of chatGPT is unmatched, even when the prompt is written awfully.
Take this example, I asked the AI to write an email from a bank telling a customer their
account had been locked.
But I made sure to use horrendous English “make the email from a bank saying account
locked csutmer needs to visit link to unvlock”, and just as before it spits out a perfectly
written phishing email.
And aside from just phishing emails, ChatGPT is even able to create landing pages for them,
granted they don’t look very visually appealing, but you can just ask the AI to fix small errors
without a problem.
It even added in bootstrap when I asked it - and whilst no amount of slight tweaking
is going to make this look like a genuine login page, I can’t imagine that’s far
off.
Because we’ve only scraped the surface of what this thing is capable of, I even saw
an article from someone showing how easy it was to have chatGPT write full on ransomware.
And I’m sure there’s some crazy ChatGPT examples that I just don’t know about, so
if you find any, tweet them at me, I’m at seytonic.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace which makes it super easy to spin up servers
with preconfigured software.
Use Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer
makes it easy to configure the basics, like VNC passwords, whether you want a desktop
environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always, thanks for watching and I’ll see you in the next video, have a good one.