Hello, World!
How this App is powered by slavery, How the nofly list itself was leaked, and the FBI
have infiltrated a cyber crime gang.
That’s all coming up in today’s roundup of cyber security tech news.
Cyber security company Sophos have uncovered a campaign of fake cryptocurrency trading
apps, but hidden beneath the surface of what seems like a basic scam is something a whole
lot more sinister.
The scam is called “CryptoRom”, standing for “Crypto” “Romance”, and it begins
on an App like Tinder, where bad actors operating sock puppet accounts are on the hunt for lonely
guys.
After matching with a victim they’ll convince them that they’ve found their soulmate,
the love of their life, etcetera, etcetera.
Whilst you might presume that the fake account is probably run by a low level cyber criminal
who’s just bought an e-whoring course from some hacking forum - that’s not the case,
the rabbit hole here runs deep.
After weeks if not months of talking with the victim, gaining their trust and building
rapport, eventually the sock puppet turns the conversation to… investing in crypto
- how romantic.
In particular there’s talk of an “Uncle [working] for a financial analysis firm”,
who recommends using a certain crypto trading app, “MBM Bitscan”.
The app looks legit, I mean - it has good reviews - and at the end of the day it’s
an App on Apple’s App store.
Apple is known for their strict App review process, and so, malicious IOS apps are incredibly
rare and chances are any given IOS user has never come across one.
It looks like a regular crypto trading App, but this is a fake interface - upon depositing
crypto it’s sent straight to the bad actors’ wallet.
But that’s not where this ends.
The trading app actually does let you make withdrawals - at least for a while.
Once the victim has developed a false sense of security and makes a big enough deposit,
their account is immediately frozen and they receive a message saying they need to make
a further deposit of 20% of their account value in order to unfreeze their account.
If the victim falls for that, well, the bad actors just come up with yet more excuses
for why the victim needs to deposit yet more money, and then yet more excuses, and more,
until the victim eventually accepts they’ve been swindled or just runs out of money, and
nopes out.
But how does a fake app make it’s way past Apple?
Well - It’s actually quite simple, the app is designed to pull its interface from a server,
so… after the app is reviewed by Apple and deemed to be perfectly innocent, they just
switch the server with a malicious server, completely changing the App’s functionality.
You can actually see that the app’s malicious interface looks nothing like the original
interface in the App store screenshots, that’s because when the app was initially reviewed
by Apple, it was disguised as a crypto price tracker, not a crypto trading platform.
I said earlier that the rabbit hole here, runs deep and it sure does - the bad actor
said to be behind this campaign is called “ShaZhuPan”, they initially targeted people
in China and Taiwan, but have since gone global.
The group has a corporate like structure, with the bottom of the food chain being the
‘keyboarders’, these are the guys that spend weeks if not months on end talking to
victims every single day, building trust before the victim is eventually pointed to the malicious
app.
And it’s reported that many of these ‘keyboarders’ are victims themselves, they’re often Indian
citizens lured with the promise of a lucrative tech job, before being trafficked to places
like Cambodia or Thailand where they have their passports confiscated and are trained
in extortion and forced to commit fraud.
A leaked training manual shows just how organised these guys are.
And “If they want to leave or do not follow the script”, well - only bad things follow.
A situation that could accurately be described as modern day slavery.
“ShaZhuPan” roughly translated to “pig butchering” - and, well - that’s what
this scam is called, the “pig butchering scam”.
And the money that bad actors are making from the scam is mind boggling, the FBI’s internet
crime report said that in 2021 alone, they received “more than 4,325 complaints”,
“with losses over $429 million” - and that only represents victims who reported
the crime.
Realistically the number is going to be far higher, probably in the billions.
The United States’ no fly list which, as it’s name suggests contains the details
of people considered too dangerous to be allowed to board planes, has been leaked.
And, no - this isn’t the result of some highly sophisticated hack perpetrated by terrorists,
but rather the document was found on an unsecured server wide open to the internet.
And yes, it was literally called “nofly.csv”.
The discovery was made by a security researcher, who explains, “like so many other of my
hacks this story starts with me being bored and browsing shodan (or well, technically
zoomeye,” - similar to Shodan, Zoomeye enables searching of internet connected devices, by
pretty much anything, ip, open port, or the software they’re running.
And, in this case our researcher was “looking for exposed jenkins servers”.
Jenkins being an “open source automation server”, used for compiling projects and
automating testing.
After “[clicking] through about 20 boring exposed servers with very little of any interest”
she stumbled across a server containing “some familiar words.
"ACARS", lots of mentions of "crew" and so on.”
- these are aviation terms, which our hacker apparently recognised from their addiction
to aviation youtube.
Unbeknownst to our researcher, she had stumbled across a server run by “CommuteAir” - a
small, regional airline based in Ohio.
After FTPing into it, she discovered this development server, used for testing purposes
was home to about 70 different projects.
Two of which were called “noflycomparison and noflycomparisonv2” - these projects
seemingly took the noflylist and a list of the airline’s employees as arguments, and
simply compared the two, checking that none of the employees are on the no fly list.
However, these files where nowhere to be found, but all that changed when our hacker came
across some hardcoded AWS credentials, which provided access to “pretty much [the airlines’]
entire aws infrastructure”, which contained test data for “noflycomparison”, which
included a suspiciously named “nofly.csv” - a legitimate copy of the no fly list from
2019, at 80 megabytes in size it contained 1.56 million rows of data.
On the list are the names and aliases of people banned from boarding flights in the US, one
person confirmed to be on the list was the “Russian arms dealer Viktor Bout”, the
guy recently freed in a prisoner exchange a couple months back.
Our hacker gave the list to “Distributed Denial of secrets”, which is where it can
be downloaded from, but given it is ‘the no fly list’ you have to request access
to it, and chances are you’ll probably be denied, as it’s only being made available
to journalists and researchers.
Now you might expect this document to be considered ‘top secret’ or ‘confidential’ by
the US government, but that just isn’t the case, based on how many people need access
to the document, that’s impossible.
So it’ll be interesting to see what kind of charges if any, our hacker faces.
And as it happens, the hacker here, is already in a bit of hot water with the US government,
I mean - when I found this hacker has a wikipedia page I knew there was going to be a bit of
history here - so, she was actually indicted in 2021 on unrelated charges - which seem
to be relate to her now seized git.rip on which she would post confidential leaked source
code.
However she’s a Swiss citizen, living in - well, Switzerland.
You’d think she’d be extradited, but apparently Swiss law prohibits the extradition of their
citizens unless the person in question agrees to be extradited.
Which no sane person would do, so it doesn’t seem like there’s much prospect of our hacker
facing any time for this latest hack either.
“We are here to announce that last night the Justice department dismantled an international
ransomware network … Known as the ‘Hive’ ransomware group”.
It’s not often the FBI offensively goes after cyber criminals, so when it happens
it’s a pretty big deal.
The ‘Hive’ gang, thought to be Russian based, appeared in June 2021, since then they’ve
hacked and attempted to extort more than 1500 victims globally, making off with more than
$100m dollars.
Now, ‘Hive’ is a particularly nasty cybercrime gang.
You see, many cybercriminals have what what could be described as a code of ethics, pledging
not to attack things like hospitals - for example, after the Lockbit gang recently ransomed
a hospital, causing chaos forcing doctors to resort to pen and paper - the gang quickly
apologised, handing over the decryption keys for free and banishing the member of their
group responsible for launching the attack.
Whether Lockbit’s reaction came from a place of actual concern for patients, or that they
just wanted to avoid bad press is… debatable.
But ‘Hive’ didn’t compromise on ethics and was on occasion, happy to attack hospitals
and steal patient data, bad move - because the FBI responded - when 7 months ago they
“Covertly Infiltrated [the] Hive Network”, Whether this was a hack or if some disgruntled
member on the inside giving them access, we just don’t know.
But it resulted in the FBI gaining persistent access to Hive’s backend, and they probably
couldn’t have believed their luck when they discovered that Hive’s servers, were located
in California of all places - so shutting this gang down would have been as easy as
filing a warrant.
But the FBI didn’t do that, instead they stayed quiet, monitoring Hive’s systems
for 7 months, secretly stealing decryption keys and providing them to more than 300 of
Hive’s victims, saving $130 million in ransom payments.
Though they had to call it a day at some point, and just days ago a warrant was filed for
that server in California, resulting in the seizure of the group’s dark web site.
A massive W - you would think, and I mean - yea sure, this is the longest the FBI has
stayed behind enemy lines in a ransomware gang.
But seemingly the only real W here was providing those decryption keys to victims.
Because whilst the gang has been shut down on paper at least, there were no arrests,
no one was charged and as far as we know, the FBI still has no idea who’s behind the
group.
So, this is less of a takedown and more of a setback, as no doubt the miscreants will
regroup and re-emerge a few months from now under a completely different name.
But that’s just the nature of cybercrime at this point.
However, in a bid to tempt anyone out of the shadows who is aware of the identity of those
behind Hive, the US has put out a $10 million dollar bounty on these guys via the ‘rewards
for justice’ program.
But coincidentally , the very next day the ‘rewards for justice’ website was actually
blocked in Russia by the government censor, the Roskomnadzor.
Though the new bounty and the block probably aren’t related, I mean - at the same time
Russia also blocked the CIA and FBI websites on grounds they were “spreading [fake news]
about the Russian military and discrediting them”.
And besides, there is a TOR version of the site if anyone does want to come forward.
This video was made possible by Octopart - a website I've been relying on over the last
few years in my electronics business.
Octopart.com is essentially your component sourcing swiss army knife - making it simple
to keep tabs on component stock levels in real time throughout a range of distributors
- which is pretty important given the current component supply situation, you can also easily
grab datasheets and cad models for components when you need them.
The best part is it's free to use, and Octopart is integrated right into altium 365, if you
want to give altium a go you can find your free trial link in the description.
As always, thanks for watching and I’ll see you in the next video, have a good one.