Hello, World!
Hackers have found yet another way to infect your computer with malware, by exploiting
the Windows calculator app.
The malware behind this creative new technique is called qakbot - it's been around for ages,
since 2007, so this, clever new infection method is merely the developer's latest invention.
It all starts when a victim receives a phishing email, encouraging them to download an attached
HTML file.
The HTML file isn't malicious per se, there's a few layers of obfuscation to peel back before
we get to that calculating payload.
Once the victim opens the HTML file, the page says that the file couldn't be displayed correctly,
so the user should instead refer to the "[locally] downloaded file".
This file is a password protected zip, which downloads as soon as the HTML page is opened.
The zip isn't downloaded from the internet, but is actually encoded within the HTML file
using base64.
Obviously, this is all done to evade malware scanners.
Once extracted, the zip spawns an iso file, and once that's extracted, we're given our
4 files.
Only one of which is actually visible, the rest are hidden files, it's only in these
example screenshots that you can see them all.
The visible file looks like a pdf, but look closely and you can see that it's clearly
a shortcut file with a spoofed icon just to give it the appearance of a pdf.
In the properties we can see, that by running the shortcut, you are actually running calc.exe,
which is contained within the same folder.
This calculator app is actually a legit Microsoft application, there's nothing malicious about
it whatsoever.
The bad actors chose to specifically include the windows 7 calculator app - for one important
reason - it happens to be vulnerable to DLL sideloading.
DLL sideloading takes advantage of the way DLL files work.
These files contain extra code which some software needs in order to work.
The Windows calculator app requires the use of 'windowscodecs.dll' - the legit version
of this file is located in System32.
But when calc.exe is executed, it will first check it's current directory to see if it
can find this DLL, before looking elsewhere.
And it just so happens that the bad actors have conveniently included a file with the
same name, in the same folder.
This is the DLL file which is hiding the malicious code.
The reason the bad actors are using the calculator app, is because it's already trusted by windows,
so there's a good chance anti malware software will just let it run, picking the DLLs is
needs, and just assuming it's clean - and fair enough, it's a calculator app, what's
the worst that could happen.
Well, once the malicious DLL has been executed it injects code into windows explorer, qakbot
can then get to work on whatever malicious mission it was designed for, which could be
a range of things - as whilst the qakbot operation started life as a banking trojan, way back
in 2007, since then, the developers behind it have teamed up with other cyber crime gangs,
repurposing their malware to drop ransomware.
Next up, this is a strange and somewhat disturbing story.
Spanish police have arrested two miscreants alleged to have hacked into and sabotaged
Spain's radioactivity alert network.
This network, consists of 800 sensors dotted around Spain's 7 nuclear power stations - the
sensors continuously scan for gamma radiation, reporting their readings to a control center
- so engineers can identify potential radiation leaks and impending disasters.
If it sounds like a pretty important system, well that's because it is, and one that was
apparently sabotaged successfully by the duo of arrested hackers.
So, the two alleged saboteurs had previously worked for the company contracted to maintain
this network of sensors, so they were intimately familiar with how it worked and how they could
disrupt it.
The duo launched a two pronged operation, firstly a denial of service attack, in which
they managed to knock offline 300 of the 800 sensors.
Exactly how though, isn't disclosed in the police's press release.
However it is mentioned that "Each of the sensors in this network is connected by telephone
to the control center", and it's important to note the network was brought online in
the 1990s, so it sounds like they may have been communicating via dial up... not very
secure.
In the second phase of their attack the duo managed to gain access to the web portal which
received the data sent by the 800 sensors, apparently using stolen credentials...
then they proceeded to, simply, delete the application from the server.
Not the most incognito plan of attack... which inevitably led to law enforcement quickly
becoming aware of the situation and launching an investigation into what the hell happened.
An investigation which took a whole year, concluding with investigators tracking down
the IP address of the attackers to a public WiFi hotspot of a café in Madrid.
Which resulted in police identifying and arresting the hackers.
The obvious question I had after reading the police report is... well, why?
I mean, surely, there has to be a pretty strong reason for sabotaging your own country's radiation
alert system.
And there are a few theories...
firstly that this was part of some bigger scheme to blow up a nuclear power plant, delay
emergency response and cause Chernobyl 2.0 - though I reckon this is quite unlikely,
because the sabotage wasn't done with stealth in mind, I mean, they did literally just go
around deleting entire applications off servers - also, there was no radiation leak during
the time of the sabotage, otherwise you'd be hearing about this story on primetime TV
rather than from me.
It's more likely, and it is actually being reported that these guys fell out with their
employer - the one that was contracted to maintain the sensors.
And that after they left the company they wanted to get some revenge and sabotage their
former employer's work, simply out of spite.
Either way, news of this sabotage has only come out in the last couple of days, so...
we're short on facts.
Next up, a look at a cyber crime gang doing things, differently.
"Atlas intelligence group" is a cyber crime gang with barely any permanent members, instead
of having - I suppose what you could call employees, which stay with the group throughout
various operations, like most cyber crime gangs do - this group hires cyber mercenaries
for each individual task, outsourcing different aspects of an operation to a pool of blackhats
through their Telegram channels.
This business model is rather unique and prompted Cybersecurity company "Cyberint" do publish
a whole report on "Atlas intelligence group".
The benefit of having no permanent members is it means they can scale easily and cover
an array of different illicit activities, including DDoS services, database leaking,
and selling initial access to compromised servers.
The other bonus is great opsec - because outsourcing different parts of an operation keeps whoever
was hired for each task in the dark as to what the overall operation is - so if one
person was to somehow be compromised, the risk to the wider group is minimised.
So, "Atlas" has 3 telegram channels, the first is a "database marketplace, in which they
put on display the leaked databases they are currently selling", the second is "where the
leader and the admins publish the contracts", and the third - the only one I was able to
get access to... is a bit random, here they post general updates - and they actually seem
quite happy with all the attention they've been getting in the last week or so following
the report.
They also use this channel to dox people who try to scam them - and like some cyber crime
groups "Atlas" is somewhat politically active, recently announcing a currently undefined
operation against Israel - like I say this channel is a bit random.
Nevertheless the reason I wanted to have a quick look at this group is down to their
unique business model.
In cyber crime, just like any industry, business models evolve.
For example ransomware as a service just wasn't a thing, before it was, now it's everywhere.
So it'll be interesting to see whether this gig economy for cyber criminals catches on
and becomes more of a thing - or if it just dies the inevitable death of most business
models.
This video was made possible by Octopart - a website I've been relying on over the last
few years in my electronics business.
Octopart.com is essentially your component sourcing swiss army knife - making it simple
to keep tabs on component stock levels in real time throughout a range of distributors
- which is pretty important given the current component supply situation, you can also easily
grab datasheets and cad models for components when you need them.
The best part is it's free to use, and Octopart is integrated right into altium 365, if you
want to give altium a go you can find your free trial link in the description.
As always thank you for watching, you can of course find my sources in the video description,
stay tuned for more hacking videos and have a good one!