Imagine this, you buy a webcam off Amazon, you don’t really think much of it, and then a couple of years later, it’s no longer getting updates. You still don’t think anything of it. But then, suddenly you find out that you’re not the only one who’s looking through the webcam. It’s creepy. Not only that, but we have another article that we’re gonna touch on where over 900, 000 people’s medical information got shared or breached.
So imagine your private, intimate information going back and forth with the doctor, or stuff like your prescriptions, or what you’ve been Diagnosed with has kind of been thrown out on the internet There’s been a new breach and we need to talk about it today We’re facing an unprecedented array of data breaches hacking attempts and surges in digital crime Why is there such a widespread amount and how little is noticed in our everyday lives?
Malware dark sites brute forcing zero day script kitties and nation state hackers are all on the rise Learn more about the threats we face and gain a bit more knowledge than yesterday. Hey everyone, another episode of Exploit Brokers is coming to you now. Welcome to another episode of Exploit Brokers.
I’m your host, Cipherceval, and if you could please do me a big favor because it helps the channel grow, if you can hit that like, subscribe, and bell notification icon, and If you’re on YouTube, if you’re on a podcast platform like Spotify or Apple Podcasts, if you could please give us a subscribe or a follow, and give us a 5 star rating if you think we deserve it.
With that said, if you are on YouTube, check out our podcast, which is the audio version of this, and if you’re on the podcast, check out our YouTube. I’m hoping to try to get some educational content out, and as much as I can, But with that, let’s jump into it. So, let’s talk about the first article by Bleeping Computer.
FBI spots hiatus rat malware attacks targeting web cameras, DVRs. I know, creepy, but let’s jump into it. The FBI warned today that the new hiatus rat malware attacks are now scanning for and infecting vulnerable web cameras and DVRs that are exposed online. As a private industry notification, a pin, published on Monday explains the attackers focus their attacks on Chinese branded devices that are still waiting for security patches or have already reached end of life.
So, when you have a lot of devices that reach end of life, and this is also for software, for devices, devices are kind of a bit different. More extreme because if the devices don’t have a very good way of updating over there, updates or stuff like that, they can get out of a, you know, stable and safe operating system or safe firmware software that they’re running quicker.
But what’s happening is you have a lot of these devices that either users aren’t technically aware how, or there’s just no good method of updating or patching the firmware. Or, if they’ve reached end of life, there’s just no more firmware that’s gonna be made for these devices. You see this a lot with like, older devices, as well as devices whose company just decided it wasn’t worth the effort, or the time, or the money, to keep updating these devices.
In March 2024, Hiatus Rat Actors conducted a scanning campaign targeting Internet of Things, IOT devices. In the us, Australia, Canada, New Zealand, and the United Kingdom. The FBI said, the actors scanned we cameras and DVRs, which is I believe digital video recorders for vulnerabilities including CVE 20 17, 7 9 2 1 CVE 20 18, 9 9 9 5.
There’s three nines, CV 20 22, 5 0 7, 8 C, V, 20, 21, 3, 3, 0, 4, 4, C, v, 20, 21, 3, 6, 2, 6, 0. And weak vendor supply passwords. Yes. The admin admin is, I know, shocking. The threat actors predominantly targeted HikeVision and Zhongmai devices with Telnet access using Ingram, an open source webcam vulnerability scanning tool, and Medusa, an open source authentication brute force tool.
So the CVEs are as old as 2017 kind of gets at what I’m saying, right? You have a vulnerability that was found back in 2017 at this point. It’s no longer a zero day It is a known vulnerability. I would have assumed at some point after a patch would have been made available But if a camera or device is still vulnerable to the cve It’s been what we’re in 2024.
So you’re talking like seven ish years if they couldn’t Find a way to patch that device or if they don’t have a good over the air update method You Or if it’s just a very, you know, not straightforward user friendly way for that device to get updated, like a lot of IOT devices are, um, I’m not an IOT expert, so if you know about IOT devices and you think there’s a easy way for a bunch of them to get updated, please reach out to me.
I’d love to find out more, but. In this case, there’s 2017, right? Followed by a 2018, 2020. CVEs, for those of my listeners who are not aware of the nomenclature, is essentially CVE dash the year it was found, and then I believe the next number is the number in the list of vulnerabilities found in that year.
Now, their attacks targeted web cameras and DVRs with the 23, 26, 554, 2323, 567, 5523, 8080, 9530, and 56575 TCP ports exposed to internet access. So, whenever you expose any port to the internet, you are bound to get a flood of bots, a flood of Hacking attempts on that because you’re opening up to the internet, right?
This isn’t something that’s kept within your internal network If these devices are purposefully exposing them to stream data to open up an admin Website to do anything like that, right? You’re opening up a new way for people to hit it Which is probably where some of these CVEs are located if I had to be honest Now, the FBI advised network defenders to limit the use of devices mentioned in today’s PIN and or isolate them from the rest of their networks to block breach and lateral movement attempts following successful hiatus rat malware attacks.
It has also urged system administrators and cybersecurity professionals to send suspected indications of compromise, IOC, to the FBI’s Internet Crime Complaint Center or their local FBI field office. So the isolation part, I want to touch on that because some people might know what that is. Some people might not.
Whenever you break into or a hacker breaks into a system, right? Ultimately IOT devices and all this, they generally will run some kind of Linux or something else in them. Or if not, they still run a way to be able to run a shell. So when you do a lateral movement, that’s you’ve successfully breached. A computer in this case, let’s, let’s assume for simplicity sake, the camera is running a Linux operating system.
So you’re in the camera and it has Linux operating system. And because it has something, some kind of Linux on there, you have a shell and some other capabilities. Now that you have a pivot point on a network, you can start to scan other devices. And if another device on that network also has some kind of CVE or also is weak password or something, then you can start hopping between the initial entry point and other devices on the network.
And the reason that’s bad is right. Say your camera is mostly locked down. You have a mostly locked on camera. But there’s a CVE so they get it. If they’re able to pivot to another machine and that machine has higher privileges Then you can start to kind of work laterally and start to get more information and eventually you’ll be able to get us like Really really interesting data.
I’m oversimplifying that but that’s kind of why this is bad No, that is why this is bad Now if we keep going the campaign followed two other series of attacks one that also targeted a Defense Department server in a reconnaissance attack and an earlier wave of attacks in which more than a hundred businesses from North America Europe and And South America had their Draytek Vigor VPN routers infected with HiatusRat to create a covert proxy network.
So proxy networks being, you know, you have a machine in between you and the target server that you’re trying to get to, so you use that as a way to bounce the traffic off. Lumen, the cyber security company that first spotted HiatusRat, said the malware is mainly used to deploy additional payloads on infected devices.
Converting the Compromise Systems into SOCKS 5 proxies for command and control server communication. HIDAS RAT shifting in targeting preference and information gathering aligns with Chinese strategic interests. A link also highlighted in the Office of the Director of National Intelligence’s 2023 Annual Threat Assessment.
So when you have threat actors, like in this case, China, they are trying to get Intel, anything that could potentially give them an edge, anything they can find that is worth a lot of money. So if they’re deploying these rats and all this other stuff through their threat actors and efforts to get as much information, right?
The more devices you have hacked, especially stuff like webcams, the more information you can literally see, right? A webcam, if you hack it, you can get a bunch of data. Now, the reason that’s also very. Interesting and important, right? You have a lot of IOT devices that may go years with never being touched, right?
It’s not like your computer where you get a virus, you notice it’s slower, you take it to Geek Squad, and stuff like that, right? There’s IOT devices, and just their devices in general, have this kind of set it and forget it that I think a lot of average consumers and just most consumers have that mentality.
There was um, there’s two interesting things that come to mind one was a Twitter post and if I can find it I’ll tag it in the description, but there was a Twitter post that was showing how someone’s washing machine was like downloading three gigs of data a day and I don’t remember what the reason was it might have been something legitimate might have been malware.
I don’t remember But the fact that your washing machine can download any kind of data over the internet is just miles, right? We went from Devices being like these huge things that would fit, you know in a bag or somewhere else So, I mean almost everything’s internet connected now you have stuff like stoves which are concerning to me You have the fridges you have smart air fryers.
Everything has a chip in it Now everything’s an IOT device technically But You are seeing the shift with that and that’s where it’s just, it’s concerning, right? You don’t want your microwave to phone home to some threat actor and get information or, you know, maybe there’s other things that they can steal from the network, move laterally from your coffee machine to your computer devices.
There’s so much to this. I could probably list a bunch of things and keep going, but. Let’s jump into the next article because it’s just as concerning as someone looking at you through your webcam. So, in an article by Bleeping Computer, again, Connect on Call breach exposes health data of over 910, 000 patients.
Healthcare software as a service company, Freesia, is notifying over 910, 000 people that their personal and health data was exposed in a May breach of its subsidiary, Connect on Call, acquired in October 2023. Connect OnCall is a telehealth platform and after hours on call answering service with automated patient call tracking for healthcare providers.
So, for my listeners in the other parts of the world, in the U. S. you have, uh, telehealth, which I imagine different countries, uh, probably do also have telehealth. I’m not familiar with telehealth. Other countries health, but for this case, I just kind of want to give some context the u. s A lot of insurance providers and there’s a lot of these popping up where you can call a doctor, right?
If you have something like a ear infection Or a throat infection stuff that’s kind of easy to diagnose Then stuff like a telehealth visit is sometimes more accessible and easier to get to especially with the I believe it was like 24 7 or at least I know there’s some services that are 24 7 where you just need maybe some nausea meds or you need some cortical steroid or you need Antibiotics something right where getting to a doctor would be prohibitively expensive Otherwise, because some of these services are offered through insurance providers for free, or maybe you have to take half a day from work to go to this doctor when you could just telehealth and get something in a couple of hours.
Um, it’s just becoming more, more ubiquitous. Now, on May 12th, 2024, Connect On Call learned of an issue impacting Connect On Call and immediately began an investigation and took steps to secure the product and overall security of its environment the company revealed. Connect on Call’s investigation revealed that between February 16th, 2024 and May 12th, 2024, which is several months mind you, an unknown third party had access to Connect on Call and certain data within the application including certain information in provider patient communications.
After discovering the breach, Freesia notified federal law enforcement of the incident and hired external cybersecurity specialists to investigate its nature and impact. So, at that point, you have to escalate. If you have, especially when it comes to healthcare, you have such sensitive information that if exposed, it just becomes more problematic.
And I’ll get to why I think it’s problematic in a minute. So, Freesia also took Connect On Call offline and has since been working to restore the systems within a new and more secure environment. Be cool to see a write up on what they did, but don’t worry. I don’t know if they would release that. While the statement does not include the total number of people impacted, Kinect On Call told the U.
S. Department of Health and Human Services. Or the HHS, that the breach affected the protected health information of 914, 138 patients. The personal information exposed during the almost 3 month long breach, not an insignificant amount of time, includes information shared in communication between patients and their healthcare providers, such as names and phone numbers.
But wait, there’s more! This may have also included medical record numbers. dates of birth, as well as information related to health conditions, treatments, or prescriptions. And in a small number of cases, the affected individual’s social security number. Oh my. This is, this is where it gets bad. Like, it wasn’t bad enough that there’s another data breach.
It’s bad, right? You have more information that you can use to build a profile on potential victims. Which is just, oh my, that’s horrible. Okay. So, you already have a bunch of social securities. Social security numbers that are out there. If you can start correlating someone’s social security number. With their conditions, their treatments, their prescriptions, their house location, their phone number.
You can start to build a very, very detailed profile on some individuals. Which, I mean, it’s no surprise that people’s data is out there on the dark web and on the internet. Fine. But now you’re getting stuff that should be better secured. Stuff that should be encrypted and hard to get to. And it’s just out there.
I mean, oh my, it’s just out there. And this is where I’m going to put on my developer hat for a second. This is where I think best practices would be a great way to kind of mitigate some of this, right? If we do proper encryption, if we do proper storing of data, if we do more things to protect the information, so if it gets leaked or, you know, Breached or whatever, then it just becomes harder for a hacker to use.
If a hacker pulls something with a 256 bit encryption on all of the data, and you know, assuming you’re doing it properly and other stuff, then it It’s almost garbage to them. If the keys are properly sanit Not sanitized, but if the keys are properly loaded in a way that doesn’t expose them. You have stuff like AWS secrets and other things you can do where they would have to not only breach the server, but they’d also have to breach an AWS account.
There’s, like, other things that a hacker would have to breach into. But even then, three months is not an insignificant amount of time. To get data. Um, I think it was Kali Linux that popularized it around or who popularized it, but it was the quieter you are, the more you can listen to. And I, yeah, I mean, three months, they were either really good at hiding or the mechanisms that they had for finding like individuals that shouldn’t be on the network on the network were just lacking.
I don’t know. It’s one of the two, either they were really good or the company was not as good as they need it to be. The connect on call service is separate from freesia’s other services including our patient intake platform based on an investigation to date there is no evidence that our other services has been affected freesia said in a separate statement on its official website so freesia Acquire Connect On Call.
So that kind of doesn’t surprise me. When you have a company acquire another company, generally the way that I know, you don’t have an instant like, oh, they’re integrated, they’re in next day, right? You have these two different entities that are merging, right? An acquisition. But that means you have employees that have to get onboarded to the new one, assuming they’re not laid off.
You have different resources, different systems, even just simple stuff like, well not simple, but even stuff like payroll, from one company to another, or the HR software, or the IT software, or the ticketing software. There’s like dozens upon dozens of different things that need to get migrated, and merged together, and even then you can’t just smush it together and hope it works, because if you lose critical information, that’s bad.
Continuing, we understand the importance of this service to our client’s business and we are working to restore the Connect On Call service as quickly as possible. Freesia also advised to potentially impact individuals to report suspected identity theft or fraud to their insurer, health plan, or financial institution even though the company has no evidence that the exposed personal information has been misused.
Just because you don’t have any evidence it’s been misused doesn’t mean it’s not going. If the data was breached, it’s gonna end up on a dump somewhere. And when I say dump, I mean literally a copy paste dump. Like, that information’s somewhere on the dark web, normal web, somewhere. Pastebin. So, the fact that they don’t know of any that hasn’t been misused doesn’t mean it’s not going to be.
It, it’s out there now. And just like everything else, there’s gonna be more and more data that’s out there. So, the advice I would give, Is always check your credit scores, always check your stuff and find a way to get access to it. Um, not sponsored, but you know, stuff like Experian, even Credit Karma, just something that lets you view your credit reports.
And if you see an account that you don’t know, or that shouldn’t be there, You can start to take action against it, right? Identity theft sucks. It’s not good, but there is ways we can do to kind of fight back against that. Freezing your credit helps. There’s different things. I’m not a financial advisor, but you know, there’s a huge financial burden that comes with identity.
Now putting my developer hat back on, there was probably a lot of mistakes that were made on the connect on call, right? The fact that they caught acquired means that there was probably a bunch of scrambling. You might have had IT that wasn’t sure on the best way or the most timely way to migrate the systems.
Maybe they were just running old systems and they didn’t have the capabilities or the resources to patch everything. There, there could be dozens of ways, right? If they got in, I don’t think I saw any reason or any, any information on how they were breached, right? Could it be, you know, some user reused passwords and they got in that way?
I don’t know. If you guys know anything about that, please feel free to leave a comment in the, send me a message or leave a comment on the YouTube comments. But, this is something that we’re seeing more and more. There is more data breaches. There is more stuff that’s out there to build profiles on potential victims.
And, it’s, it’s gonna get easier for some threat actors and some hackers to just get that and abuse it. And, we We, the collective we, we as whether you’re a developer or a cybersecurity person just someone who’s interested in this and wanting to find out more. I think it’s up to people who know about it to spread it to other people who may not, right?
Granny may not know, now granted, I don’t know if granny would be using connect on call, but granny won’t know that it was breached. I know a lot of these companies send out email, or not emails, but letters saying, hey, We had a breach and we’re offering like three months of identity theft or something like that.
We’re, I get those cards go out, right? But that’s not going to be enough. And I don’t think we’re going to get to a point where we have no data breaches. And that’s just the reality of it. Um, bugs exist, bugs will always exist and we’ll always have to patch them. Um, and that’s kind of, kind of the gist of it.
Um, now. To circle back to the first article, if you have a webcam by HikeVision or the other one, so pulling that name up, HikeVision or Zhongmai Devices. I would decommission it, if you can’t patch it, right? If it’s one of their end of life devices, just, just dump it. Uh, get rid of it. If it’s, needs a security patch, patch it.
And this goes for any of your devices, right? Make sure your stuff’s up to date, make sure you’re running updates on everything. And if it’s connected to Wi Fi, see if you can update it. Um, there’s another horror story that I read a while back where, um, there’s certain light bulbs, I would assume a lot of the light bulbs, when you connect it up to Wi Fi and all this other stuff, that Wi Fi information is stored on the light bulb.
So if you were to go throw it away, there is a way to pull the Wi Fi and Wi Fi password off the device, and now you have an entry point into the Wi Fi, right? Granted, stuff like WEP and all that, there is ways to hack Wi Fi, that isn’t new. Now you can literally just go and try to pull it off the device itself, for, you know, for the case of the lightbulb, not pertaining to this per se.
But here, if they’re opening up to the internet, and there’s already tools, Ingram and Medusa, then, it’s really, really the best way to combat this. From a consumer perspective is to pull vulnerable and end of life devices offline, try to patch the ones that can be patched and upgrade to either newer stuff, a different vendor.
There’s just a couple of different avenues. And if you’re a cybersecurity researcher and you find indicators compromise, send them over to the right people. See if we can get more information on it. And if you were hit with, uh, if you were using connect on call or know someone who was, uh, affected by the connect on call thing.
Just check your credit reports and that’s all we really can do. It’s up to us to put pressure on these kinds of companies to make sure that companies are more responsible in the way they develop their software to make sure that we’re encrypting sensitive information and making environments as secure as possible.
There will never be a 100 percent unhackable system. There just won’t be. But if we can make it harder and harder, then I’m hoping we can see less and less data breaches. But guys, With that, it’s been fun. I am your host Cipherceval, also known as Lauro, and I will see you in the next one.
Note: This is a transcript
🔗 References & Sources
* Webcams Hacked: https://www.bleepingcomputer.com/news/security/fbi-spots-hiatusrat-malware-attacks-targeting-web-cameras-dvrs/
* Health Data breach: https://www.bleepingcomputer.com/news/security/connectoncall-breach-exposes-health-data-of-over-910-000-patients/
Leave a Reply