Hello, World!
Hackers have taken over live TV in Iran, Tile wants to fine their users $1 million dollars,
and stealing cars with USB cables is set to become a thing of the past.
That’s all coming up in today’s roundup of cyber security tech news.
Last week, Iran’s president was giving a speech on Iran’s revolution day.
Crowds gathered to watch, and of course it was streamed live on TV.
However, what people watching from home didn’t expect, was that their TVs were about to be
taken over by hackers.
After commandeering the airwaves hacktivists wearing what looks like some flavour of anonymous
mask encouraged people to rise up against the Iranian government, and withdraw all their
money from their bank accounts in an effort to crash the country’s currency
The hackers’ video played uninterrupted for a whole 60 seconds, and they signed off
with their slogan “Death to the Islamic republic”, before the stream returned to
footage of the president’s speech.
The reason for this this hack is quite straight forward.
There’s little chance you’ll have escaped news of the protests going on in Iran… what
was sparked by the suspicious death of a protestor is now an existential problem for the Iranian
regime.
The group behind this TV hack calls themselves “Edaalate Ali”, these guys have a huge
following on Twitter, which they’ve built on the back of their previous hacks, their
speciality is hacking TV streams.
They first hacked Iranian state TV in February of last year, and then again later that year
in October.
Given how often they manage to pull off these takeovers, it would be quite interesting to
know how they’re doing it.
However, we don’t know, there just isn’t any public info on it.
Something to point out though is that these hacks don’t seem to be of equal proportions.
For example, their TV hack last October lasted just a few seconds before it was cut off,
returning to a pretty flustered presenter.
So in that case it’s reasonable to assume that the broadcaster themselves suffered some
kind of an intrusion and all channels playing the stream were affected.
However in this latest hack, the hackers’ video played uninterrupted for a whole minute,
and there were a lot less people talking about it on social media, so at a guess I’d say
in this case it was just a case of one channel that was streaming the event being hacked
rather than it being more widespread event.
But “Edaalate Ali” isn’t just known for their television takeovers, a couple years
back they hacked into an Iranian prison, exposing the abuse of its prisoners.
And you can actually see the very moment that prison employees realised they’d been hacked.
Footage from a prison control room shows an employee doing the boring job of keeping tabs
on the prison’s CCTV systems when gradually one by one each display is taken over by “Edaalate
Ali” hackers.
The company behind Tile - has come up with an interesting new solution for the security
nightmare that is creeps using their products for stalking - and a lot of people aren’t
very happy about it.
The problem surrounding bluetooth trackers like tiles and airtags being used by stalkers
is pretty well documented, it’s something that Apple pre-empted before releasing their
AirTag, baking in features that would alert you if an AirTag that didn’t belong to you
was following you around.
But barely a month after the AirTag’s release in 2021, Apple committed to improving these
anti stalker safeguards, decreasing the time before an iPhone would alert you that an AirTag
is potentially being used to stalk you, and even releasing an Android app that allows
non-iPhone users to scan for nefariously placed AirTags.
And whilst all this has gone some way to suppress AirTag enabled stalking, it hasn’t killed
the problem, and 2 women recently launched a lawsuit against Apple because of it.
On the other hand, all these anti stalker features do a pretty good job of reducing
the usefulness of an AirTag in tracking stolen items.
And this is where Tile has identified a gap in the market, announcing their controversial
new “anti theft mode”.
With anti-theft mode it’s impossible for a third party to locate your tile, it won’t
give anyone notifications, and it won’t work with Tile’s feature that allows you
to scan for devices that are potentially tracking you.
Perfect for when a Tile is stolen, but also perfect for stalkers.
However, there’s a catch - well actually there’s a few of them, in order to enable
“anti theft mode” on your tile you have to upload government issued id to Tile’s
App, and agree that “if your Tile devices are suspected of being used with criminal
intent” you accept that “your information may be shared with law enforcement”, and
by the way “suspected” means without a court order, Tile’s CEO made clear in a
medium post that they’ll provide your information to law enforcement “even without a subpoena”.
And you also have to agree to pay “$1 million dollars in damages if you’re convicted in
a court of law for using your tile devices to illegally track any individual without
their consent”.
Ok, so now we’re getting in to marketing stunt territory, you see, penalty clauses
like this often just aren’t enforceable in contracts when the intent is to punish
the individual for breach of contract which
it seems to be in this case, rather than compensate
Tile for a fair amount of damages.
And keep in mind, I’m most definitely not a lawyer, however even the Tile CEO admitted
that this is a grey area.
If this fine is completely unenforceable and purely a marketing stunt, it’s doing a pretty
good job.
So let me know down below would you use this new feature?
Though, something tells me regardless of whether the fine is enforceable, Tile’s new identity
verification and willingness to hand over your data to law enforcement without the need
for a court order is probably going to be the deal breaker here.
Stealing cars using a USB cable is set to become a thing of the past, after patches
for affected models have just been released.
And if you don’t know what I’m talking about, let me introduce you to, the “Kia
Challenge” - it swept over TikTok last year.
Encouraging people to break into certain Kia and Hyundai models, and then steal them with
the help of a USB cable, any flavour of cable will do, as long as it has a USB-A male connector
on one end.
The idea is, after smashing a car’s window you rip the plastic cover off the steering
column.
And this is where I’m going to be intentionally vague, so as to avoid the wrath of YouTube’s
moderation team.
So, after ripping apart the steering column you pop off the bit that the key goes in,
also known as the ignition cylinder.
Doing this, exposes this little nob.
And this is where that USB cable comes in handy, because it just so happens to be the
right size and shape to fit right into the nob, which allows you to turn it, starting
the car as if you had used the key.
If you’re an owner of one of the over 8 million cars affected, it’s not professional
thieves you have to worry about, but rather TikTok addicted kids who will steal, joyride
and then probably abandon your car all busted up in some ditch.
And this is more of a problem than you might think, if we take the city of Buffalo as an
example, thefts of Kia vehicles increased 500% from 2020 to 2022, and in one case 4
teenagers were actually killed when they crashed a car they’d stolen.
The problem has become so bad that some insurers are flat out refusing to touch affected models.
And the “Kia Challenge” is largely an American problem, because the US is one of
the few countries that doesn’t by law require all new cars to have immobilisers.
An immobiliser being an RFID transponder enclosed within genuine keys.
Upon turning the key, the car will check that the transponder is emitting a valid security
token and the car will start.
Without it the car is as good as dead.
But whilst there’s no law mandating that cars sold in the US must have these immobilisers,
the vast majority of car manufacturers install them anyway, after all they’re a cheap and
effective way to prevent a car from being hotwired, or stolen by a “Kia Boy” - yes
that’s the name given to the kids doing the challenge.
This does all seem to be a straight forward case of Kia and Hyundai cutting corners on
security to save money.
However Kia Boys are now, out of luck, because
finally, after thousands of cars stolen, widespread
media coverage and a class action lawsuit, Kia and Hyundai have finally gotten around
to releasing a fix in the form of a software update.
Now, after locking a vehicle with the remote, an “ignition kill” feature is activated,
which can only be deactivated by unlocking the vehicle with the remote.
So any attempt to fiddle the car with a USB cable would be pointless.
However some models are just too old for the software update to be applied, so the owners
of those vehicles will get free steering wheel locks, which definitely aren’t notoriously
easy to overcome.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace
which makes it super easy to spin up servers
with preconfigured software.
Use Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer
makes it easy to configure the basics, like VNC passwords, whether you want a desktop
environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always, thanks for watching and I’ll see you in the next video, have a good one.