Hello world,
Ransomware gangs now have to worry about piracy - apparently, as the world’s most successful
ransomware strain has been stolen by a rival gang.
And after promising to cancel tracking cookies, Google gives them a last minute stay of execution,
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
Cybersecurity company secureworks have released an illuminating report on a supposedly new
strain of ransomware meandering around the internet. It turns out that legit companies
aren’t the only ones at risk of their software being pirated, but ransomware groups are now
facing the same problem. The rEvil ransomware, aka sodinokibi the world’s most successful
ransomware - which was responsible for the Apple schematic leak and JBS hack, is now
being ripped off by a rival cybercrime gang.
This new ransomware, named ‘LV’ is a reverse engineered copy of a rEvil beta version. The
researchers note the “code structure and functionality .. are identical to REvil”.
Rather amusingly the original rEvil code comes laden with insults aimed at prominent security
researchers, take this example.
rEvil creates a random file with this name, Kremez is the CEO of Advanced Intelligence,
a firm dedicated to disrupting cybercrime - which helps explain why rEvil and him aren’t
the best of friends. There is another line which I’m going to avoid reading for fear
of demonetisation, probably some inside joke, some reference I’m not getting. But I had
no idea malware source code comprised little jabs like this aimed at their enemies, it’s
actually pretty entertaining. Anyhow in the modified version of rEvil, LV - these vulgarities
are removed and have just been replaced with whitespace, this kind of modification suggests
that the pirates “do not have access to REvil's source code”, and that they “likely
used a hex editor to remove potentially identifying characteristics from the binary to conceal
that LV is a repurposed version of REvil.”
The original rEvil ransomware is authored by a group going by “Gold Southfield”,
the researchers have given the pirates the moniker “Gold Northfield” - I don’t
quite know how they come up with these names - some hacker group nicknames are super cool,
but some like in this case end up sounding like names of retirement homes.
Gold Northfield isn’t quite as sophisticated as their Southern counterpart. In one example
the researchers visited the dark web site run by the group, upon loading it you’re
prompted to enter a key generated by the ransomware before you’re given their sales pitch, and
asked to pay up. The researchers entered their key, but this broke the site, and a bunch
of HTTP errors were returned. This suggests our pirates are struggling here, perhaps suffering
from acute lack of skill, but potentially just teething issues.
Ransomware groups typically operate a ransomware as a service model, taking on affiliates who
spread the malware for a cut of the profits. The researchers have found no such offering
tied to this modified version of rEvil, just yet, though it’s possible this could change
- rEvil has proven to be a pretty successful ransomware strain, the world’s best in fact
with a market share of 16%, why expend resources creating ransomware from the ground up when
you can leech off an already successful group’s code.
No word from rEvil on these new developments, they presumably aren’t too thrilled with
their work being appropriated. The researchers suggest rEvil will likely do everything in
their power to “impede future attempts to overwrite the REvil configuration”.
We all have some server running something somewhere, whether that’s in the form of
a website or a dinky minecraft server, here’s why you might want to switch them for free
to today’s sponsor, linode. Linode is a totally customisable cloud hosting platform
that grows with you, from hosting small personal projects to enterprise scale neural networks,
if it runs on linux it’ll run on linode.
Linode launched way back in 2003, that’s 3 years before AWS was even a thing, Linode
doesn’t spend a second on side hustles like grocery chains or reading you bedtime stories,
cloud computing is what they do best, and is their only focus. Linode is offering all
of you guys $100 in free credit just for signing up, claiming your $100 is the easiest decision
you’re going to make today, use it to spin up a minecraft server, set up a pentesting
lab, instantiate your own VPN, the possibilities are endless. They have 24/7 phone support
(which is a godsend in the world of servers) so you’ll never be left out in the cold.
Go to linode.com/seytonic or click the link in the description to claim your $100.
Google has been caught with their hand back in the cookie jar. In January last year Google
promised that they’d put an end to the infamous 3rd party tracking cookie. The death warrant
was marked 2022. However in the last few days Google has backtracked and said they’re
going to need a little more time. But why would Google changing Chrome’s default setting
on 3rd party tracking cookies take years to implement. Sounds like it could be done and
dusted in half an hour. The reason lies in Google’s cookie replacement plan being postponed.
Chrome is the last major browser yet to ban 3rd party tracking cookies, Safari, Firefox,
Brave etcetera have already done away with them. But Safari, Firefox and Brave also have
nothing to lose from the demise of the tracking cookie as none of them also run the internet’s
largest ad network. 50% of Google’s revenue comes through their ad network which relies
on being able to profile users’ interests in order to serve highly targeted behavioural
ads. Disabling cookies without a replacement would mean Google shooting themselves in the
foot - in fact the only reason they’re planning on getting rid of cookies to begin with is
because they kind of have to, it’s not sustainable to be the only browser which allows these
tracking cookies in a time when privacy is becoming way more important to people.
As such Google have come up with an alternative to the cookie - which they claim is compatible
with privacy, but we’ll get to that in a bit. The replacement is something Google is
calling FLoC, or ‘federated learning of cohorts’. In this system chrome uses your
recent browsing history to determine your interests and puts you in a group or cohort
according to these. For example if you visit a lot of technology news websites chrome will
recognise this and put you in a cohort labelled ‘reads technology news’ - this is a simplification
but you get the idea - importantly this processing is done locally within the chrome browser
as opposed to on some Google controlled server somewhere. Chrome then communicates your cohort
with websites you visit, which serve you ads based on these. Google’s argument is that
given the processing is done locally on your PC, Google doesn’t know which sites you
actually visit.
This is technically true, however FLoC has some issues... The Electronic Frontier Foundation
- a digital rights group - has produced a detailed analysis of the plethora of privacy
problems pertaining to FLoC. The first issue is fingerprinting, fingerprinting means to
uniquely identify a user across browsing sessions using various pieces of data, like for example
the size of a browser window, OS, installed fonts and so on, the dilemma is that given
each cohort may only consist of a “few thousand” people, the cohort a user belongs to will
be a valuable variable that can be used to help track users through fingerprinting. Think
of it this way, if a website wants to fingerprint you, it has to use details about your browser
or behaviour to distinguish you from millions of other people, but if it knows your cohort
then it only needs to distinguish you from a “few thousand other people”.
There are a myriad of other issues, such as the risk of websites performing their own
statistical analysis of users using their cohort id’s and other information they hold
on users to infer characteristics like age, gender, political affiliations, etcetera.
The EFF says cookies are “perhaps the Web’s biggest mistake”, but that Google’s proposals
show that it hasn’t learned the right lessons from the ongoing backlash to the surveillance
business model.”, signing off with “Google, please don’t do this”.
This system will only work on Chrome, which is used by about 70% of people. Google has
already launched a FLoC trial; about 0.5% of Chrome users have been automatically enrolled
in FLoC for testing purposes. The electronic frontier foundation has set up amifloced.org
where you can check if your browser is part of this trial - however GDPR rules have frustrated
its roll out in Europe - as such so far Europe is FLoC free.
It seems to me that FLoC is an example of Google trying to take advantage of the demise
of the cookie. Cookies are at least useful for different things other than just tracking,
but FLoC only exists for the benefit of Google’s ad network, it introduces a lot of new privacy
issues and seeks to cement Google’s position as the number one ad network - given only
Google will be able to take advantage of FLoC, the EU has already launched an antitrust probe
into Google regarding the whole plan.
Hopefully Google delaying its launch means we’ll see some changes to FLoC, taking into
account privacy concerns, but I wouldn’t bet too much on it.
If you enjoy this kind of video make sure to help me out by tappingthe like button for
the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next, go check out my previous video on how allegedly racist malware targeted
the pirate bay...
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.