Hello world,
An embarrassing Huawei vulnerability was ignored for months,
The world's largest password leak has been dumped on hacking forums, or has it?
There’s a new old cybercrime gang on the block.
And this remarkably elaborate fake streaming site
is going to impressive lengths to install malware on your PC
That’s in today’s episode of the weak web where we break down and dissect cyber security tech news.
Huawei has come under fire for an embarrassing vulnerability in one of their LTE USB sticks.
These things are meant to provide cellular connectivity to laptops,
but came with an extra hidden feature. A researcher at trustwave discovered the bug,
which only affects MacOS users. The software the dongle comes packaged with,
creates a root-owned script which autoruns every time the device is inserted.
Usually this script just opens the device’s management interface,
but the researcher noticed the permissions on the script were set incorrectly which meant any user,
regardless of their privileges could overwrite the script and execute malware on the victim pc
every time the device was inserted. Sure, this may not sound all that interesting, at the end
of the day a miscreant would require local access to the computer in order to exploit it
along with the victim using a very specific LTE adapter as well as running on MacOS. In
the grand scheme of things this is a relatively low risk vulnerability.
But the reason this exploit has turned out a little embarrassing for Huawei is in how
they handled it. The researcher first contacted Huawei last October to report the problem and have
it fixed, but heard no response. He persisted for several months and still didn’t have much
luck - until news website theregister pestered Huawei about it and eventually it got resolved.
You would expect a little better from one of the world’s largest telecom equipment providers.
Huawei has a pretty poor track record when it comes to security, this instance is relatively
mild compared to their previous blunders. For example, back in 2019 when many countries were
becoming dubious about using Huawei equipment in their 5G networks - the UK commissioned a report
into Huawei equipment, the report went through a lot of source code to identify if there were
any hidden backdoors or security holes. And whilst they didn’t find any backdoors, they did find some
horrendous security practices. In one instance they found 4 different OpenSSL versions being used
within the same piece of software, which were vulnerable to a myriad of exploits, with some
dating back to 2006. OpenSSL for the uninitiated is used to implement a secure communication layer,
which as you can imagine is pretty important especially in telecommunications equipment.
Following these findings the UK issued a blanket ban on Huawei equipment at a cost of £2 billion.
Billions of passwords have been leaked and you should be incredibly worried,
according to certain news sites - so should you scramble to change your passwords as yahoo puts it
or is this a bit of a non story? A user on raidforums has posted a 100GB txt file which
they claimed comprised 82 billion passwords, in reality the file contained just 8 billion
plaintext passwords according to cybernews - but that is still quite a few. The poster dubbed this
dump, “rockyou2021” - which is probably why this news story has been getting so much attention.
The original rockyou password list is famous in the hacker world and originates from the
now dissolved company “RockYou” which was hacked in 2009, the hackers used a 10 year
old SQL vulnerability to breach the company, and 32 million passwords were then leaked - the hack
wasn’t handled well, firstly passwords stored in plaintext should be a nono, the company also
took ages to notify users... It was a bit of a disaster. The password list rockyou.txt went
on to gain a lot of notoriety in the hacker community and it even comes preloaded in kali.
The new version rockyou2021.txt is less exciting,
whilst yes, it is over 250 times the size of the original version, the new iteration seems to just
be a compilation of previous smaller breaches - there’s sady or gladly, nothing new to see here.
It was probably only named as such to increase the attention it received. However, certain websites
have gotten all hyped up over this new leak and have designated it the “mother of all password
leaks”. When in reality there’s no real need to scramble to check haveibeenpwned over this news.
If you weren’t pwned yesterday, this leak isn’t going to have changed that.
Researchers at proofpoint have identified a new old cyber extortion group.
This group has been around for a while, and is known for impersonating various APTs
such as the Russian “Fancy Bear” group, as well as the North Korean “Lazarus” group.
They do this in order to scare victims into paying up, after all if you believe an elite Russian
state sponsored hacking group is after you, you’re well within your rights to be a little spooked.
Well, now the shapeshifting gang is back, and have christened themselves
“Fancy Lazarus”, if larping as one world renowned APT wasn’t enough,
now they’ve figured out a way to cover both fronts at the same time, innovation at its finest.
This group sends out emails to victim companies, threatening to shut down their operations with a
2 Terabit per second DDoS attack if a ransom of 2 bitcoin isn’t paid within a matter of days.
This price increases for each day past the payment deadline. DDoS attacks have seen quite an uptick
during lockdowns as people working from home need to use company servers - if these go down
then you have an issue. It’s one thing for your customer-facing website to become inaccessible,
but if your employees can’t even work, then that’s a whole other mess.
Luckily for victims of “Fancy Lazarus” an FBI flash, details that their threats are
more often than not, bluffs. As most organisations targeted do not receive that 2 Terabits of power,
or if they did, it was easily mitigated. There’s a new fake streaming service on the
interwebs, Bravomovies is a remarkable example of the extent some bad actors will go to in order to
compromise your PC. On the face of it Bravomovies looks like any other streaming service,
but on closer inspection some of its “top rated movies” look a little,
odd. Judging by its cover, you’d be forgiven for thinking
“The Dog Woof” is a critically acclaimed, intense psychological thriller.
Unfortunately I must disappoint you, in that it doesn’t exist. In fact none of these films exist.
I’m not sure why our bad actors here went to the trouble of making covers for fake films.
There are plenty of real ones out there, and I don't think the possibility of
copyright infringement should be too high up their list of worries - the
fact they’re trying to hack you with this site is more of a crime I would’ve thought.
Anyhow the rest of the site is equally elaborate, and rather convincing.
Cybersecurity company Proofpoint wrote a report which details just
how this site aimed to ransack your PC. Victims would receive a phishing email,
a rather poorly put together one considering how much effort went into the site - anyhow
the email claimed that the recipient’s bravomovies free trial was coming to an end
and their card was about to be charged. Of course there was no free trial, the objective of this
email was to convince users that they had somehow signed themselves up to a free trial by accident,
and get them to phone the Bravomovies support line and request a cancellation.
A real person would answer the phone and instruct users to visit the site,
but clicking the cancel subscription button would for some reason download an excel spreadsheet.
You might know where this is going. The customer service agent told users
in order to cancel their subscription they should open the spreadsheet and then, enable macros.
Macros in Microsoft Office are regularly abused, macros simply allow custom code to
be inserted into an excel or word document, so enabling macros in an untrusted document is as
bad as opening an untrusted exe file. Luckily for criminals this is a little known fact.
Enabling macros in this case would cause BazaLoader to be covertly installed.
Bazaloader is a first stage payload meaning it’s used to download additional malware.
Proofpoint didn’t observe what the second stage payload in this campaign was, however
bazaloader has been known to install ransomware. The infection chain here is really quite involved,
there’s a lot a user has to do in order to become pwned, usually bad actors don’t create
such elaborate infection chains as it increases friction for the user which usually means less
people end up getting infected, cybercriminals prefer infection vectors which are less hassle.
It’s interesting that streaming cancellation has been used as a vector in this campaign. According
to fortune, in the past few months people have been scrambling to reduce the streaming services
they’re subscribed to. As during the pandemic with the free time we all had, the average streaming
customer had 5 subscriptions, but unsurprisingly that’s now falling. Seeing an opportunity to cash
in, this may have been what prompted criminals to go after the trend, to just convince people
Bravomovies was one of the streaming services they had signed up to and just forgotten.
Bravomovies has since disappeared from the internet in the past few days.
If you enjoy this kind of video make sure to help me out by hitting like for the youtube AI
as well as turn on those sub notifications. If you’re looking for something to watch next,
go check out my previous video on how the FBI modified google pixels,
introducing a secret backdoor allowing them to spy on criminals and track their every move.
If you like this series of videos do consider becoming a channel member, as always sources
will be linked in the video description, stay tuned for more hacking videos, have a good one.