Hello world,
An Anonymous fugitive who has been on the run for 10 years, has finally been tracked
down and arrested in Mexico,
Google has reached a verdict on the future of the humble URL,
The world’s largest dark web marketplace for stolen credentials has been raided and
shut down by the FBI,
And cyber security stocks are booming, but why?
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news. After a decade on the run, the infamous Anonymous
hacktivist going by the name of “Commander X” has been caught in Mexico and deported
to the US in what seems to be the first Anonymous related arrest in years. The story of Commander
X otherwise known as “Christopher Doyon” reads like quite an adventure.
The tale starts in 2010 when Doyon organised a DDoS attack against California’s Santa
Cruz county website. He did this in response to the county’s policy on homeless people,
which prohibited them from setting up camp overnight. Doyon admits he was rather naive,
he explains his associates and himself didn’t take any precautions to hide their web traffic
or encrypt their communications, this was one decision he’d live to regret.
9 Months after the DDoS attack he was sitting behind his laptop working on an unrelated
Anonymous operation in a coffee shop. When suddenly his laptop was snatched from him
by what turned out to be an FBI agent. This is a common tactic used by investigators,
in order to confiscate computers whilst they’re unlocked, as the drives will be in an unencrypted
state. This is similar to how silk road operator Ross Ulbricht was arrested in 2013.
Doyon’s DDoS attack knocked out the county website for just 30 minutes, you would expect
this to carry pretty minor charges, a small fine, perhaps some community service at worst?
However the county claimed damages had been caused in excess of $5,000 - this makes the
attack a federal crime, despite the fact those damages would likely just have amounted to
the cost of the time it took employees to investigate the DDoS, because of course no
computer equipment is actually damaged in a DDoS attack.
Faced with the prospect of a combined 15 years in federal prison along with a fine of 500
thousand US dollars, Doyon came to the conclusion there was no other option but to skip bail
and flee the country. Initially to Canada, during which he endured a whole series of
escapades in his bid to reach the Canadian border, including being attacked by bears
and what not, I’ll link the interview he did with arstechnica which explains that ordeal
in the description.
He eventually trekked from Canada to Mexico where he put in an application for political
asylum. He had been living with friends in a Mexican gated community until a week ago
when he was arrested by authorities. We don’t have many details surrounding the arrest,
but one of his friends said that armed uniformed men tried to gain entry to the community posing
as DEA agents, not having much luck they later returned, scaled the walls and nabbed commander
X.
It all sounds pretty dramatic, and all over a county website being booted offline for
30 minutes a decade ago. I do feel sorry for the guy, I reckon he’ll be made an example
of especially given the latest bout of cyber crime sweeping the interwebs has made the
issue of hacking or in this case ddosing a hell of a lot more relevant, despite his actions
being completely unrelated and non-financially motivated.
However, he hasn’t helped his case by fleeing the country, since his escape he’s done
many interviews with journalists, at one point he claimed anonymous “might well be the
most powerful organization on Earth”, which is a rather bizarre claim. He also wrote a
book whilst on the run titled “Behind The Mask: An Inside Look At Anonymous” giving
his account on the early days of Anonymous, which no doubt the FBI have combed through
with great interest. Google has reached a decision on the fate
of the humble URL. You see, a year ago google began experimenting with a new feature in
chrome which would hide almost all of a URL from the address bar, leaving only the domain
name in view. Their reasoning behind this was to make it easier to spot phishing domains,
dodgy domains sometimes only differ from the real thing by a couple of characters, the
logic is that when a URL consists of a couple hundred characters - those deviant domains
are a little too difficult to spot.
I can’t say I relate with this issue, I imagine you guys who watch my videos are also
scratching your heads, but I suppose this could be an issue for less savvy people?
Either way google has been “exploring a prototype in a study”, they also rolled
it out to a small percentage of real Chrome users to ascertain if it actually helps them
identify phishing domains. The verdict is in, google has decided that the full fat URL
will live to see another day - this comes after their experiments essentially failed.
Which doesn’t come as much of a shock, if you know how domains work, you know the bit
at the beginning is responsible for who you’re connecting to, I can’t see how removing
the rest of the URL changes that.
But don’t rejoice yet, this isn’t the first time google has come for our URLs, and
it likely won’t be the last. In 2014 chrome implemented a similar URL cloaking feature,
dubbed ‘origin chip’. This innovation put the domain of the current site in a little
box to the left of the address bar which itself was left empty to enable quick google searching.
At the time this was criticised as simply a ploy to draw in more google search traffic,
it also came with a few little bugs of its own which further complicated things.
I don’t know why Google doesn’t just make the domain bold? That way you get the best
of both worlds, we get to keep our URLs and google gets to scratch their itch and implement
a feature no one asked for.
As a side note, whilst researching this topic I came across a cool little URL shortening
website, shadyurl.com shortens URLs, but makes them look as suss as possible. It’s outputs
are sometimes a little risque, but if you’ve got some time to kill it’s good fun to play
with - and you get some good reactions when you send them to people.
The world’s largest dark web marketplace for stolen credentials has been shut down,
courtesy of the FBI. At the time of its demise, the slilpp marketplace had 80 million username
and password combos up for sale - these mapped to bank accounts, paypal accounts, amazon
accounts, among countless others, accounts for almost any site you could imagine were
up for sale in exchange for crypto.
These were sold as active accounts, meaning people would buy them in order to loot them,
such as transferring money away from bank accounts, or ordering things off amazon, at
the expense of the account’s owner. Slilpp featured 1400 sellers, many of them will have
been malware operators, each hoovering up thousands credentials with dodgy software
- given ransacking each account themselves would be quite time consuming, as well as
increasing the chances of them getting caught up in the law - these guys sell pilfered credentials
on marketplaces like slilpp.
It’s estimated that the exchange of credentials on slilpp resulted in $200 million of losses
in the US alone, but this sounds like a rather low estimate given this dark web site has
been active since 2012. The FBI along with their counterparts in Germany, the Netherlands
and Romania executed server seizures, following this the website now hosts the famous FBI
seizure banner. The details pertaining to how slilpp saw its downfall remain unknown,
but we do know that a dozen people have been arrested in connection with the site.
It’s unlikely the downfall of slilpp will make any large impact on the criminal underworld,
whilst it was the largest marketplace for creds, no doubt one of the still outstanding
marketplaces will soon exploit the opportunity of filling the gap in the market the FBI have
created.
Usually marketplaces like slilpp are automatic, ie: the customer receives their credentials
as soon as the crypto payment is received - so presumably unless I’m missing something,
the creds should be stored unencrypted in some database, meaning the feds should be
able to notify the websites that the accounts belong to that they have been compromised.
Cyber security companies seem to be making a lot of money, who would’ve thought? With
all the ransomware offensives and assorted cyber attacks seemingly ravaging corporations,
it’s not too surprising that the companies which aim to defend against this very problem
have been benefiting from the turmoil. In the last week alone, EA games was hacked which
caused parts of their source code to be exposed and McDonalds was hit with a data breach which
resulted in user data being stolen.
Cybersecurity stocks like cloudflare, crowdstrike, veronis, among others, are up in some cases
over 10% in the last week alone - cybersecurity solutions aren’t a one time fix for companies,
the issue is constant threat, which means a lot recurring revenue in the form of subscriptions
is being realised for the companies which aim to plug and monitor security holes.
A good example is the ‘First Trust Cybersecurity ETF’ which is a fund that essentially consists
of a lot of cybersecurity stocks, by buying into this ETF you are in essence buying into
a range of different cybersecurity companies in order to mitigate the risk of buying into
a single stock whilst still retaining the benefit of exposure to the industry at large.
Over the last month, this ETF is up 10%, which just goes to show how this whole sector is
seeing a bit of a boom. Full disclosure, I own some of this fund, so far I’ve made
an eye watering 50p since I bought in, so Ima go plan my early retirement...
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next, go check out my previous video on how a US military contractor which
works on nuclear weapons was targeted with ransomware.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.