Hello World, Seytonic here with another dose of hacking news...
First up, the Zucc might just owe you a bunch of money. A German court has ruled
that if your data was included in the famous Facebook data breach of 2021, and there's a
good chance it was, then Facebook owes you €100. Even Zuckerberg himself was doxxed in the breach,
leaking his phone number, where he lived, who he's married to. And sure you could
get most of that from his Wikipedia page, but this level of data was also leaked for over
500 million other Facebook users. We're talking Dates of birth, email addresses,
employer details, locations and phone numbers of half a billion people.
The breach wasn't really the result of a hack, rather Facebook had this feature
that allowed you to search for people using their phone number. And so I guess it was
inevitable that some enterprising cyber criminal would write a script to search
random phone numbers en masse, and well - they did, enabling them to scrape the
data of 20% of Facebook's entire user base. After acquiring the megadump,
it was traded privately between cyber criminals for a couple of years, before the inevitable
happened and it was posted publicly on the now deceased hacker community, raidforums.
At the time this caused a bit of a meltdown, and a year later the Irish data protection
commission fined Facebook a couple hundred million Euros for their privacy violations.
However whilst governments did get a nice payout, the actual victims of the breach
have so far failed to get any compensation because it just can't be proven that the data
breach led to any specific criminal activity. But that's a pretty high standard of evidence,
I mean - how can you prove that a phishing email you fell for was only made possible
because your email address was leaked by facebook 3 years ago - it's impossible.
And now a German court agrees, they said there doesn't have to be any specific
misuse of the data, and just the fact it was stolen is enough to warrant some kind
of payout. The court suggests that the level of compensation should be €100 Euros, which
is less than the €1000 Euros that the complainant in this case was after,
but it's something. You can check whether your data was included in the breach over
at haveibeenpwned. But the bad news is, you've kinda gotta live in Germany to benefit from this.
But hopefully it sets some kind of a precedent,
I mean - shouldn't you be the one to receive compensation for your data being stolen,
rather than some government agency, let me know your thoughts down below.
Next up, the battle between WhatsApp and NSO Group just got a little more interesting. New
court documents allege that NSO continued to use WhatsApp exploits, even whilst WhatsApp
was in the process of suing them for it. So, to give you some context, NSO is the famous Israeli
spyware company behind Pegasus, a world class spyware tool, sold to governments all around
the world which helps them hack terrorists and criminals phones, and sometimes journalists and
human rights activists allegedly, though you won't find that on NSO's homepage.
Pegasus spyware is the definition of noob friendly, according to court documents,
"The customer (as in the government agency),
only needed to enter the target device’s \[phone] number and “press Install,
and Pegasus will install the agent on the device remotely without any engagement.”"
This kind of power is possible because NSO spends a lot of time reverse engineering messaging apps,
finding vulnerabilities and developing exploits for them,
which are then incorporated into the Pegasus spyware platform. But we've known all about that
for years... what the new court documents reveal is the apparent idgaf attitude NSO
had whilst they were being dragged through the courts by one of the world's biggest companies.
Court documents describe how NSO developed an exploit called 'Heaven', that used a 'WhatsApp
installation server', which is just a fancy term for a modified WhatsApp client capable
of sending malformed messages, containing the exploit giving them the ability to
hack arbitrary WhatsApp users. However just a few months later, WhatsApp detected and blocked the
'Heaven' exploit. After which, in 2019 WhatsApp sued NSO group, because would you believe it,
using WhatsApp for international cyber espionage doesn't really align with their terms of service.
However court documents say that even after WhatsApp had started this legal process,
NSO developed a new Malware Vector called 'Erised' - seemingly named after that one
mirror from Harry Potter. It's alleged that 'Erised' gave governments the same ability
to infect WhatsApp users with Pegasus spyware, which NSO has admitted in total was installed
on "between hundreds and tens of thousands of target devices" - a pretty wide range.
WhatsApp eventually blocked Erised, but it's not so clear if NSO is still
exploiting WhatsApp. As it's being reported that NSO witnesses are refusing to say
whether the spyware maker developed further WhatsApp exploits. But the lawsuit continues,
as it has done for the past 5 years now.
For our next story, law enforcement is once again not very happy with Apple - a new update in iOS
18 is making it much harder for 3 and 4 letter agencies to pull the data off iPhones. Up until
now, it's been relatively straightforward for police to seize an iphone, and just stick it in an
evidence locker for as long as needed, until they get around to hooking it up to a forensic analysis
tool so they can grab the data off it. This is possible because seized iPhones are very likely
to be in what's called an AFU state, meaning the device has been unlocked at least once since its
last reboot. In this state, the phone's decryption keys are still stored in memory, and so it's
very likely that a forensics tool, usually from some Israeli company will be able to grab them.
However in the last week, a document has started circulating in law enforcement group chats,
warning that iPhones sitting around in evidence lockers are mysteriously rebooting themselves.
This has made it way harder for the feds to read the data off them because once an iPhone
is rebooted it gets put into what's called a BFU state and those keys can't be grabbed
from memory anymore. This is why caller ID won't work before you unlock your phone,
because your contacts list is still encrypted and inaccessible until the phone is in an AFU state.
It was 404media who initially reported on these mysterious reboots, after which security
researchers discovered that this is down to a new undocumented feature in iOS 18 called 'inactivity
reboot' - which causes phones to automatically reboot themselves after being idle for a couple
days, putting them into that BFU state. It's not impossible for phones in this state to be
cracked by law enforcement, but it makes it way harder since they now have to be bruteforced.
And this bruteforcing ability is only usually developed months if
not years after the ability to unlock a particular phone in its AFU state.
But Apple's new 'inactivity reboot' feature only explains half the story here. Because
that leaked document claims older iphones are also exhibiting the same behaviour,
there is some suggestion that iOS 18 devices are somehow communicating with older iphones
in their vicinity - perhaps via Apple's FindMy network, instructing them to reboot in some way.
In fact the law enforcement document actually advises other agencies that, "if your AFU devices
have not been exposed to iOS 18 devices, take action to isolate those devices now".
Next up, one of the cyber criminals alleged to be behind 2024's largest
string of breaches has just been arrested in Canada. 'Conor Riley Moucka', also known as,
'waifu' has just been charged in connection with the Snowflake hacks. Snowflake is a company that
provides cloud storage and analytics solutions to some pretty large corporations. And earlier
this year, when the cyber criminal group 'UNC5537' discovered that many of these
corporations' Snowflake accounts, storing huge amounts of customer data, were protected by
nothing more than a basic username and password combo - they started scouring the dark web,
buying up snowflake credentials, which had been stolen from employees with infostealer
malware. Then, thanks to a total lack of multi factor authentication they were able
to simply log into those accounts and exfiltrate mountains of data.
There was a period earlier this year when it seems every few weeks we'd hear of yet another company
falling victim to the wave of snowflake breaches, with 165 companies affected in total. Conor,
or Waifu - has been charged with 10 of these hacks, the biggest of the bunch being the AT&T
breach when the call and text records of nearly all AT&T's customers for a 6 month
period were stolen by the gang. We're talking a database that included the phone numbers that
each customer had called or texted, and for some of those interactions, even the
cell site id's was included, which could've be used to unmask those customer's irl location.
AT&T managed to negotiate a surprisingly small ransom of just $370 thousand dollars in exchange
for deletion of the data. But the indictment alleges that from all their breaches,
Waifu and his co-conspirators in total profited 36 bitcoin, roughly 2.5 million dollars. As for
how he was caught, a researcher from Unit 221B who was tracking Waifu and the group, claims
that the guy recently made some kind of opsec slipup, which might have leaked his identity,
but the researcher didn't go into detail. After which, Waifu told a different researcher at
404media that he was starting to become worried he would soon be arrested, and had started destroying
data. And I suppose he was right, and the guy is now facing extradition to the US.
As always thanks for watching, and I'll see you in the next video, have a good one.