Hello, World!
How fake WinRAR hacks are being used to hack Hackers themselves, Pegasus spyware returns
to hack a Russian journalist and fake Telegram apps are targeting certain groups in China.
That’s all coming up in your roundup of cyber security tech news.
Critical vulnerabilities in WinRAR always draw a lot of attention - I mean, WinRAR’s
is used by over 500 million people, so if an hacker can find a vulnerability in it,
that’s a lot of potential victims - though take that number with a pinch of salt, because
WinRAR’s creators haven’t updated that figure in 10 years now.
But the point still stands.
And recently two critical vulnerabilities were found in WinRAR, one of which allows
hackers to create specially crafted archives which masks a file’s real extension - so
what looks like a jpg, is really an executable in disguise.
And researchers at groupib discovered that before this exploit was patched it was actually
being used by cyber criminals for months to target users of trading forums by spreading
archives apparently containing genius trading strategies, which in reality contained malware
that would allow them to empty the brokerage accounts of fellow forum users.
But when critical vulnerabilities like these are patched and become public knowledge, a
new opportunity spawns… to hack the hackers themselves.
This is because blackhats and white hats alike will predictably descend on github to find
proof of concept code that they can use to recreate the exploit, whether that’s out
of pure curiosity, or to incorporate the exploit into their “products”.
But sometimes these exploit proof of concepts aren’t proof of concepts at all, but rather
contain malware in order to hack the hackers - it’s a tactic that’s actually been used
in the past by groups such as North Korea’s Lazarus, with the intention of infecting white
hat hackers in order to steal whatever security research it is they’re working on.
And something similar has been going on with one of those recently disclosed WinRAR vulnerabilities.
A now deleted github repository, claimed to have proof of concept code that you could
use in order to recreate the exploit.
Upon executing the python script that supposedly demonstrates the vulnerability, it crashes,
but that’s more of a distraction, because by the point it crashes the malicious code
has already run.
In the background, the python script secretly constructs a URL, downloading and executing
a powershell script, which results in the victim being infected with a copy of ‘VenomRAT’.
VenomRAT is a typical remote access tool - it allows a cyber bad guy complete remote access
to a victim PC, and it’s sold on cyber crime forums for as little at $150 for 3 months.
But who’s behind this?
Whilst using fake vulnerability proof of concepts to target security researchers is a common
tactic of North Korean hackers, the problem is actually a lot more widespread - in a recent
paper, researchers combed through a sample of over 47,000 github repositories supposedly
containing these proof of concepts, of which 1.9% were malicious, which is actually really
pretty high if you think about it, that’s a 1 in 50 chance of being infected.
But security researchers aren’t always the intended target, in the case of this fake
WinRAR proof of concept, the researchers who discovered the campaign said that they don’t
think this was done “to specifically target researchers”, but rather the bad actor here
was “looking to compromise other miscreants trying to adopt new vulnerabilities into their
operations.”.
Next up, an iPhone belonging to a prominent Russian journalist has been hacked by Pegasus
spyware which infected her phone by exploiting a zero click vulnerability in Apple’s smart
home app.
The victim - one Galina Timchenko is the editor of Meduza, a Russian news website… which
is actually based in Latvia - because the Russian government isn’t too happy with
Meduza, and recently declared them an “undesirable organisation” - a legal status which essentially
makes the company totally illegal in Russia.
And earlier this year, Meduza was added to the list thanks to their coverage of the war
in Ukraine which wasn’t very favourable to Putin.
Fast forward a few months, and the head of Meduza received a text message from Apple
letting her know that oh by the way - “State sponsored attackers may be targeting your
iPhone”.
Now, if you get one of these text messages from Apple, you’re well within your rights
to well, panic - because this isn’t a message letting you know that some script kiddy hacked
your Netflix account.
This means some organisation, likely a government has hand picked you personally to be targeted
with advanced spyware capable of “remotely access[ing] your sensitive data, communications,
or even the camera and microphone”.
Meduza’s editor immediately sent her iPhone to be analysed by Accessnow and Citizenlab
- pro digital rights organisations which often forensically examine the phones of journalists
if they’re suspected of being hacked by some government.
And it was discovered that her iPhone had been infected with none other than the the
infamous spyware developed by NSO group - Pegasus - which made its way onto her phone via ‘PWNYOURHOME’
- a zero click exploit which works in two stages, firstly it exploits the victim’s
Home app by sending malicious requests to access their smart home setup, it seems all
an attacker would need to know in order to pull this off, is your Apple ID, and by the
way, this works regardless of whether you even have a smart home setup - just having
the ‘Home’ app makes you vulnerable.
The malicious requests cause the app to crash, leading to stage 2 of the hack - which involves
iMessage.
Specially crafted PNG images containing malicious code, were sent to her iPhone which bypassed
Apple’s blast door service, causing it to crash.
Blast door was introduced by Apple only a couple years back - it’s a security system
responsible for checking images and attachments you receive in iMessage for any kind of malicious
code, but in this case, it obviously didn’t to its job very well - leading to a successful
Pegasus infection.
Now, you might think the question of who’s behind this attack is kinda obvious - but
Russia isn’t actually a customer of NSO group, so they just don’t have access to
Pegasus spyware.
So who could be behind it?
It recently came to light that government agencies in 14 EU countries have purchased
Pegasus spyware - and I realise these countries obviously aren’t on the side of the Russians,
but it’s not like spying on your allies is a new concept.
Alternatively a few former soviet countries have been NSO group customers, so they’re
also suspects here.
But realistically we’ll never know for sure.
But what we do know is that lockdown mode - recently introduced by Apple to combat state
sponsored hacking, works.
If the journalist here, had lockdown mode enabled, not only would this attack likely
have been stopped in its tracks, but she would’ve received notifications letting her know that
lockdown mode had blocked a gmail account from trying to access her smart home setup.
But regardless, since the journalist was hacked, the exploit used ‘PWNYOURHOME’ has now
been patched.
Next up, Telegram clones infected with spyware have been discovered targeting the Uyghurs
in China.
Now, for some context here, if you’ve been living under a rock, the Chinese government
isn’t too fond of the Uyghurs - an ethnic group which mainly lives in the Xinjiang province
in China.
The Chinese government has been accused of rounding these guys up and sending them to
re-education camps, forcibly sterilising them, and all kinds of other nasty stuff, it’s
a massive rabbit hole and way out of the scope of this video.
But in addition to all of that, for the past few years there’s been an ongoing surveillance
campaign targeting Uyghurs using Android devices - presumably run by the Chinese government,
in order to keep tabs on any kind of Uyghur resistance.
For example, last year researchers at cyble blew the lid on a campaign which used an anti-China
book as a bait to get people to download malware.
What was disguised as a pdf, was really a malicious APK, which stole “SMSes, Contacts
data [and] call logs”.
And then just a few months later another campaign was discovered, which involved spreading seemingly
benign Android Apps in Uyghur Telegram channels, things like battery managers and dictionaries
- but of course they were infected with spyware which resulted in pretty much complete ownage
of the victim device.
Those apps however were just distributed via rogue APKs, but some apps do end up in the
Play store, like the recently discovered Telegram clones.
These apps, which are being distributed in Chinese and Uyghur languages, are marketed
as Telegram but ‘faster’ - whatever that means…
Once downloaded you’ll find the app looks no different from original Telegram - it feels
exactly the same.
This is made possible because whilst Telegram’s server side code is all private and closed
source, it’s client side apps are all open source, which makes it easy for third party
developers to create their own custom Telegram powered apps using the legit Telegram api
- so you can log into and use them with your existing Telegram account - but this also
means bad guys can create their own Telegram clones which come with some hidden undocumented
features.
And these apps are packed to the brim with spyware, any messages a victim sends and receives
are all exfiltrated straight to the attacker’s servers.
You can see here, code present in these apps that just doesn’t exist in the original
telegram, which will copy and exfiltrate your messages.
There’s also code in here which monitors the victims contacts list, exfiltrating everything
to that bad guy controlled subdomain.
Following Kaspersky’s report which uncovered these apps, Google has of course removed them
from the Play store, but in the 8 months or so they were live they had over 60,000 installs
- though that number might be inflated by bots, because of course people are just more
likely to trust apps which already have a bunch of installs.
But the number of people spied on in this campaign is going to be far far greater than
the real number of installs, because each person is bound to have a bunch of contacts
and be in various group chats, all the messages of which are now going to be in the hands
of whoever’s behind the apps.
Speaking of hosting command control servers, if you need somewhere to host your next project,
assuming it’s totally above board, today’s sponsor can help with that.
Akamai connected cloud is your swiss army knife for cloud computing, these guys can
handle everything cloud, and they’re giving you a $100 60 day credit to get started.
One of their features that I love is their app marketplace which makes it super easy
to spin up servers with preconfigured software.
Need an instance of Kali?
Just configure the basics with their installer and you’re done.
So click the link in the description now to claim you’re free $100 credit.
As always, thanks for watching and I’ll see you in the next video, have a good one.