hello world shitexpress.com a website
that allows you to literally send a box
of poo to anyone on the planet has been
hacked by a prolific troll who then
leaks the site's entire database a
database which includes the addresses of
all those who received the pui packages
along with the very mean personalized
messages that were included in the
deliveries
so express it's one of those
websites that has received a lot of
media attention for just hierarchic
listeners idea being if you don't like
someone enough to spend 16.90
to send them a box of poo then this is
the site for you just type in the name
and address of your worst enemy write
them a personalized message select your
favorite kind of animal droppings then
just pay and that's it best part is the
package is sent anonymously as the
recipient has no idea who sent it well
anonymous until a few days ago when a
customer found an sql injection
vulnerability in the site rather than
doing the responsible thing and letting
the site's owners know he instead
exploited the bug downloading the site's
entire database and then publishing it
for free on breach forums the database
has roughly 20 000 records going back
all the way to 2014 it contains the
addresses of the poo recipients along
with those personalized messages that
were included in the deliveries now i've
had a look at the leaks data
specifically those personalized messages
for journalistic reasons of course and
whilst many of these poo packages were
sent by people to their friends as a
kind of prank there are people who've
used this service to break up with their
partner accuse people of murder and all
kinds of awful things believe me there
is no limits to what people have written
in that message box and after doing some
rudimentary analysis i found that u.s
supreme court justices have received
dozens of packages and there are
non-famous people who've been sent
numerous packages for reasons unknown
aside from of course being very funny to
read through this database could find a
use in cyber criminals one forum member
called the leak a blackmailing kit and
they do have a point if someone who used
this service added their email to the
order so they could receive shipping
updates then their email address will be
in the database so it could be possible
for a bad actor to personally identify
them and demand a fee if they don't want
to be outed to the poo boxes recipient
but regardless who even leaked this
database to begin with well it was none
other than pom pom perrin you're
probably not immediately familiar with
him but this cyber miscreant has popped
up before on this channel he also
happens to be the owner of breach forums
itself a site for selling data leaks
which recently passed sixty thousand
users
so pom pom point has been a regular
customer of express having
previously used the service to send
smelly packages to a security researcher
whom he has a long-standing feud with
one vinny troyer now we don't have time
to go into detail on that feud for that
you have to see my video about the time
pom pom perrin literally hacked the fbi
so he could use their email server to
send thousands of emails to random
people emails which claimed that you had
been hacked by vinnie troyer and that he
was still in your systems which
obviously wasn't the case pom-pom paren
is a master troll and he no doubt leaves
this database just for the hell of it
however the data leak was handled as
well as could have been expected by the
website's owners they issued a statement
accepting that they were at fault and
had fixed the problem
next up this story is bizarre so a
ransomware gang hacked into a uk water
company spending months in their system
gaining access to industrial control
systems and exfiltrating five terabytes
of data only to mess up right at the
last moment when the cyber criminals
tried to extort the wrong water company
for money completely derailing their
operation
it's the clock ransomware gang taking
the l here a few months ago they hacked
into what they thought was thames water
which is the uk's largest water company
supplying to 15 million households here
in the uk
but but hang on after the drama of the
colonial pipeline hack which caused
literal fuel shortages hadn't ransomware
gangs kinda agreed to the unwritten rule
of not targeting critical infrastructure
things like water suppliers simply
because disrupting their operation tends
to piss off governments and gets the fbi
on their case well yes but klopp came up
with a plan where they could have their
cake and eat it too instead of
encrypting the files of the water supply
that they tacked into because that could
prevent the water supplier from being
able to pump water they would instead
exfiltrate as much data as they could
from their systems and would threaten to
release it publicly if the ransom went
unpaid so the cyber criminals executed
on their plan a few days ago which just
so happened to coincide with water
shortages here in the uk klopp
threatened to publicly post five
terabytes of thames waters data if they
didn't pay the ransom the ransom amount
isn't public but you can bet it was in
the millions the miscreants also
apparently gained enough access to mess
with the water supply itself posting
screenshots of the water company's
industrial control systems as proof if
they did try to poison the water supply
it wouldn't be the first time last year
someone tried to do just that after they
gained access to a water treatment
facility in florida but in this case the
cyber miss screens were more preoccupied
with getting paid
in response to the ransom demand thames
water simply refused claiming that they
hadn't even been hacked in the first
place putting out a press release
calling this a cyber hoax
in response klopp started leaking data
through their dark website releasing
files bit by bit starting with
photocopied passports and driving
licenses of employees but cyber security
researchers started looking through the
leaks and spotted something peculiar on
one of the leaked driving licence
documents it clearly says that the
person is employed by south
staffordshire and not thames water
it quickly became apparent that sure the
cyber criminals had hacked into a uk
water company but they had been trying
to extort the wrong one
the clop ransomware gang quickly changed
the name of the victim on their dark
website but by that point it was too
late given that they had already started
leaking data there was no chance of
getting ransom payments from the actual
victim company south staffs months of
work was ruined over what i'm struggling
to describe as a simple error i really
can't understand how the two companies
were confused i mean sure they both have
water in their name but i i'm just going
to go ahead and call this divine karma
next up a quick story of a developer who
tries hacking his car's entertainment
system only to realize how hilariously
insecure it was that the car's
manufacturer was signing updates using
encryption keys copied from online
programming tutorials
so a green luigi one wanted to hack his
new hyundai's entertainment system so he
could play around with it and ultimately
see what he could do with it which is
quite common in the hacker world just a
few days ago at defcon someone was
showing off a track to display they had
hats to run doom but anyway our
developer plans to hack the system by
modifying a firmware update adding
custom code which would give him root
access the first hurdle was that the
official updates provided by hyundai
used password protected zips although he
managed to bypass this by exploiting a
known vulnerability in protected zips
whereby if you have the plain text of
one of the encrypted files within the
archive you can leverage that to decrypt
the entire archive he managed to find a
plain text version of one of the files
on the internet so the first hurdle was
gone
however he hit another snag in that the
firmware updates were of course
cryptographically signed by hyundai
themselves so modifying code in an
update would ultimately cause the update
process to be rejected by the car
however the zip he decrypted earlier
contained the public key used for
signing which he googled on the off
chance someone else had documented the
process of hacking this particular
entertainment system
and this google search led him to a
peculiar discovery that the public key
being used to sign official firmware
updates was copied from an online
programming tutorial the tutorial of
course contained the corresponding
private key alongside it making the
eventual routing of his car possible
i'll make sure to link his blog post in
the description it's super in-depth and
really worth reading if you want all the
juicy details
this video was made possible by lenod
who are giving you a 100 60 day credit
just for signing up lenode is
essentially your swiss army knife for
cloud computing if it runs on linux
it'll run on the node one great feature
of lenod is their app marketplace which
makes it super easy to spin up servers
with pre-configured software use the
node's kali linux app to quickly spin up
a fresh instance of kali the installer
makes it easy to configure the basics
like vnc passwords whether you want a
desktop environment and so on the node
can run almost anything by providing all
the tools a developer really needs at
competitive prices use the link in the
description now to claim your free 100
as always thanks for watching sources
can of course be found in the video
description and i'll see you in the next
video have a good one