In today's exploration of cyber security tech news - Russia is invading Ukraine, from the
North, East and South - but one front that's often forgotten is the war in cyberspace.
In this video I'll be covering everything we know about what the hell is going on in
the cyber realm when it comes to Ukraine's invasion.
Firstly, Anonymous has declared 'cyber war' on Russia.
This comes from various anonymous related twitter accounts.
And, whilst we do have to be careful when it comes to these "Anonymous announcements"
- as they can often be made by larpers, just using the brand of Anonymous for attention
- in this case we have some real hacktivist action.
Following DDoSing from the collective some Russian government websites have been, experiencing
technical diffifculties - this includes the Russian president website, the government
site and Russia's parliament website - all of which I notice don't even use HTTPS.
Anonymous also briefly took offline "Russia Today", the infamous Putin controlled news
outlet.
Russia has responded, deploying geofencing to some of its sites, for example mil.ru,
Russia's main military defence website is inaccessible from outside Russia.
Try to load it from a western ip and the site literally responds with a meme, HTTP error
418 - this needs some explaining, error code 418 originates from an April fool's joke from
way back in 1998 by the organisation who's job it is to set the standards for TCP/IP.
The official standards say that this error code should only be returned by teapots that
are requested to brew coffee.
So, Error 418 has become a bit of a meme, and yes, this is the Russian military memeing
at us.
Next up - and this is rather strange.
A few days ago I received a message sent to my youtube channel's contact email.
It claimed to be from a Russian aligned hacking group calling themselves "The Red Bandits",
they asked me to follow them on twitter.
I get strange emails all the time - this one in particular claimed to be sent by "Volodymyr
Zelenskyy" - which is the president of Ukraine.
I figured this was just someone larping for attention - and was about to delete it, until
I realised it was sent from a Ukrainian government email address.
Having got my attention I checked their Twitter account only to see that they had been suspended.
I did some Googling and found an alt account they created, on which they claim to have
"gained access to [the] Ukrainian government mail service" and "created a script to use
their email service to email over 500,000 real emails from a databreach".
Suddenly I don't feel so special just being one of the 500,000.
To further confirm this breach, I noticed the Ukrainian government email login page
does warns of accounts being taken over, so it seems they aware of a breach of some kind.
The red bandits describe themselves as a cyber crime group, however they seem at least to
have taken a temporary break from their cyber criminal day jobs and have aligned themselves
with Russia, against Ukraine - as their latest operations suggest, and by the way I can't
verify their claims, but they say they've "hijacked Ukrainian Police dashcams", and
even gained access to confidential Ukrainian government meetings.
Again, I can't verify any of this, if there are any developments or updates on this thread
I will pin a comment down below.
Some cyber attacks which have been confirmed though are a wave of operations that took
place the very day before the invasion of Ukraine even started, now these attacks took
multiple forms, the first being wiper malware.
Wiper malware can be compared to ransomware, but instead of encrypting data to cause havoc
like ransomware does.
Wiper malware simply deletes data, making it impossible to recover.
It's clearly a weapon of sabotage, rather than a tool cyber criminals can use for monetary
gain.
The malware was discovered to be "installed on hundreds of machines" in Ukraine.
But, since this news is so recent, and of course the targeted organisations clearly
have more important things to worry about, we don't know who the victims were or to what
extent the attacks were successful.
But we can take some clues from a similar string of attacks which took place in January,
in those attacks, wiper malware targeted "multiple government, non-profit, and information technology
organizations, all based in Ukraine."
The malware was made to look like ransomware, it even had a low effort ransom note, a txt
file that asked for 10k in bitcoin to be sent to a certain wallet.
But there is no recovery mechanism inherent within the malware, so this is clearly a disguise.
In addition to the wiper malware, the day before the invasion the Ukrainian government
and banks were hit by DDoS attacks.
This is the second time this has happened in recent weeks, with the previous attacks
being attributed to Russia's spy agency the GRU.
The timing of the DDoS attacks and malware is no accident, they will have been fired
off the day before the invasion to create as much confusion and chaos as possible.
But Ukraine's Defence ministry has other plans.
What I'm about to tell you will sound odd, and it's only come out in the last few hours,
"Reuters" has reported that "Ukraine is calling on its hacker underground to defend against
Russia".
In other words the Ukrainian defence ministry has been popping up on hacking forums, trying
to encourage cyber criminals to volunteer for service in the military's cyber units.
This would include an offensive volunteer unit which would "conduct digital espionage
operations against invading Russian forces".
So... this is what we know so far about the Russia's invasion of Ukraine on the cyber
front.
Now, I put this video together a lot faster than I usually do, so I realise I have been
quite light on detail - but I really wanted to get this out asap and cover as many topics
as possible.
Remember it's a fast moving situation, so if there's something I've missed out on - which
inevitably there will have been, or if any of my information is incorrect please let
me know in the comments.
Also if you want to read further into any topic I've discussed in today's video all
my sources are as always linked in the video description.
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered.
If it runs on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware.
Linode’s philosophy is to focus on providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
Thanks for watching, you know the drill, make sure to mutilate the notification bell and
follow me on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.