Hello, World!
How you can be hacked from a simple Google search, iPhone hacking tools have been leaked,
and T-Mobile suffers a devastating hack, again.
That’s all coming up in today’s roundup of cyber security tech news.
Google has a problem so bad, that the FBI was forced to publish a PSA about it.
I’m talking about Google Ads, more specifically the tidal wave of fake Google search ads that
that are out to hack you.
It starts with bad actors cloning a genuine website, one recent example being ‘MSI Afterburner’,
then they’ll switch out the download link for some flavour of malware.
Afterwhich, using a stolen credit card they’ll buy a bunch of Google Ads for their cloned
website, propelling it to number 1 on Google search, so whenever you search for ‘MSI
Afterburner’, there’s a good chance you’ll visit the fake site, and unknowingly download
malware, and well - get hacked.
It doesn’t help that Google does a pretty good job of blending ads into real search
results, I mean - all you have to delineate whether you’re looking at an Ad is a really
small ‘Ad’ identifier.
Of course this is by design as you’re way more likely to click an ad if you believe
it to be a genuine search result.
And the websites that hackers choose to impersonate, isn’t random - they’ve been creating fake
ads for MSI afterburner and blender, because they can serve victims cryptojacking malware
in the knowledge that people looking for these tools are likely to have expensive graphics
cards.
It’s devilishly smart, and is made way more effective because a lot of companies do run
ads against their own search terms.
Like when you search ‘Apple’ you get an ad for the genuine Apple website - I don’t
know why Apple would want to pay for these ads when they’re the top result anyway,
but hey they’re doing it, and it conditions us all into trusting Google search ads.
However the one dead giveaway of these malvertising campaigns is their URLs, they’re obviously
fake.
But that’s not always the case - in a recent campaign fake ads appeared for the internet’s
favourite photoshop alternative - Gimp.
This ad looks completely legit, the URL is exactly the same as in the actual search result.
However, clicking this ad of course takes you to a clone of the genuine gimp page, encouraging
you to download what is in reality a nasty infostealing trojan, VIDAR.
But hang on, when you’re on the fake site you’re clearly not on gimp.org but rather
on a typosquatted gilimp.org.
So how do the bad actors manage to use the real domain in their ad?
Well - this is where things get mysterious.
In the past, when setting up an ad, Google allowed the Display URL to be completely different
from the actual landing page, they gave you a blank text box, you could enter anything
you wanted.
But for the past few years, changing the display URL hasn’t been possible, I mean - you can
change the path, but not the domain.
So, perhaps this was made possible via an ‘IDN homograph attack’?
This is when a bad actor utilises another character set, like the cyrillic alphabet,
to construct a domain using characters that look almost identical to English, there’s
even free tools which enable bad actors to type in an English string then pick and choose
similar looking characters from different character sets, creating a ‘Gimp’ that’s
almost indistinguishable from the real ‘gimp’.
But this just isn’t the case here.
Maybe this was achieved via someone breaching gimp’s google ads account and then just
redirecting traffic?
Except gimp doesn’t use Google ads.
O-k-a-y, perhaps there was an open redirect vulnerability in the gimp site that allowed
a bad actor to use the gimp domain in their ad.
Except this would’ve been easily spotted by someone inspecting the traffic, I mean,
a ton of people have investigated this, and I’ve read a load of articles on this gimp
malvertising operation and no one seems to have a plausible explanation as to how this
was done.
There’s also no communication at all from Google on this - which is really kinda strange,
Google is usually pretty protective of their ad business, I mean, you’ve probably heard
of their strict new policy regarding monetising YouTube videos that include swearing.
Hell - am I allowed to say hell?
idk, anyway, but, hell, one of my recent videos was demonetised because 8 minutes in at the
very corner of a screenshot I took of breachforums, there was a naughty word.
the text is tiny, you’d never even notice it, or even if you did, you wouldn’t care.
So why Google is so pedantic about enforcing some of their rules, but so silent when their
service is actually abused?
It’s beyond me.
And it’s not like there aren’t already casualties of fake search ads, one case that
went viral on Twitter regarded one “NFT_GOD” who fell for a fake OBS ad, and downloaded
malware which stole tens of thousands of dollars worth of Ether from a hot wallet stored on
his PC.
As I mentioned in the beginning of this segment, the problem is so bad that the FBI has put
out a PSA about it, within which the FBI themselves suggest using “an ad blocking extension”.
It really has gotten to that point.
Hacktivists have leaked 1.7TB worth of tools made by the infamous Israeli company Cellebrite.
Now, I’ve seen this company described as many things, a cyberweapons arms dealer, a
spyware company, but in its most basic terms, Cellebrite sells tools that are used to extract
data from mobile phones.
After hooking up an IOS or Android phone to their software, you can extract things like
call logs, text messages and files.
In fact, in 2019 Cellebrite claimed their new tool could completely unlock almost any
iOS or Android device.
And whilst the exploits that enabled that almost certainly don’t work on the latest
versions of IOS and Android available today.
Cellebrite’s tools are still incredibly useful to law enforcement, it’s reported
that in the US, “Cellebrite is everywhere”, “Thousands of local, state, and federal
agencies nationwide have used the company’s products”, in fact after the FBI’s very
public spat with Apple over their refusal to unlock the San Bernardino shooter’s phone,
it’s reported that the FBI went to Cellebrite.
As you can imagine, this company is somewhat controversial, in large part due to the many
human rights abuses allegedly committed by governments using their tools, there’s cases
all over the globe - some of which have forced the company to take action, for example, in
2021 they halted sales to Russia and Belarus because their “tools were allegedly used
to spy on opposition activists”.
It won’t come as much surprise that Cellebrite has a less than rosy relationship with privacy
activists…
the responses to Cellebrite’s tweet that they could hack any iOS or Android phone are
somewhat less than appreciative.
And now a South American hacktivist group ‘Enlace Hacktivista’ claims “An anonymous
whistleblower sent [them] phone forensics software and documentation from Cellebrite”,
The leak is said to contain “the full suite of Cellebrite programs” And it’s all downloadable
via the hacktivist group’s website or as a torrent on Distributed Denial of Secrets.
Whilst some people seemingly expect these leaks to spell the death of Cellebrite, they’re
likely to be disappointed.
Firstly most of the files in the leaks are just maps and translation files.
As for the software though, there’s no source code here, the leaked programs seem to be
the exact software that Cellebrite customers can all access, and as such - to be able to
actually use it, you need a license key - which isn’t in this dump.
Whilst we might see cracked versions of this software pop up in the near future, I suspect
the motives of the hacktivists behind the leaks was less to give us all free forensics
software which will quickly go out of date, but moreso to damage the company itself.
On that dimension the leaks were not very effective.
I mean, Cellebrite is a publicly traded company, and we can clearly see on the day the leaks
were published their share price closed unchanged from the previous day, and actually went up
the following day.
T-Mobile has been hacked, again.
This time, a threat actor stole the personal information of 37 million people.
And, if you’re experiencing a bit of deja-vu here, well - that’s because this is the
8th T-mobile data breach since 2018.
I don’t know what company holds the record for most data breaches, but T-mobile is becoming
a pretty strong contender.
Now, when a publicly traded company suffers a severe data breach like this one which could
affect it’s share price, they have to file an 8-k form with the SEC which explains what’s
gone on - a process that T-Mobile is no doubt pretty familiar with at this point
Within which, they explain that a bad actor siphoned off data through one of their APIs,
they don’t say exactly how this API was accessed, but bad actors do often find ways
of accessing API’s without prior authentication… sometimes an API isn’t secured at all, I
mean - that’s is exactly how a miscreant stole the data of 10 million people from the
Australian telecoms giant Optus.
In the T-Mobile hack though, the miscreant got away with a “set of customer account
data, including name, billing address, email, phone number, date of birth, [and] T-Mobile
account number”.
But don’t worry, T-Mobile explained in a press release that this is just “basic customer
information (nearly all of which is the type widely available in marketing databases or
directories)”, so, no need for panic.
And besides, T-Mobile has suffered so many data breaches, that if you’re one of their
customers, at this point, your data is probably already be in one of the prior breaches, and
so this doesn’t really change much.
In their 8k form, T-Mobile admits “We may incur significant expenses in connection with
this incident.”
- and, well - they would know, because in one of their previous breaches, T-Mobile reached
a 350 million dollar settlement.
In researching for this segment, I came across first hand reports of T-Mobile being caught
in a kind of double screw up.
Someone who claims to work at a T-Mobile affiliated store says they received an “internal memo
disclosing the recent data breach”, which looked something like this.
Trouble is, the URL that T-Mobile is linking to for more information on the hack, has a
slight typo.
They’ve accidentally put ‘.co’ rather than .com.
So instead of sending people to the genuine T-Mobile site, they’re inadvertently linking
to what is reportedly a typosquatted domain used for sending spam.
However, I can’t find any evidence that this domain is used for spamming, though that
being said it is registered in the Seychelles, a place commonly used by bullet proof hosters.
And the site is currently empty, with its owners seemingly unaware of the amount of
free traffic they’re probably getting.
To make matters worse this link has apparently been sent out to actual customers, how many
isn’t yet clear.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace which makes it super easy to spin up servers
with preconfigured software.
Use Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer
makes it easy to configure the basics, like VNC passwords, whether you want a desktop
environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always, thanks for watching and I’ll see you in the next video, have a good one.