So we’ve all heard of brands like Kia that have been getting issues with them getting hacked, but what if you didn’t even need to get near the car to find out information about it? Well, Volkswagen has 800, 000 EV customers data that have been breached, and this is only the beginning. You should be worried about this, and we need to talk about it.
As well, Mirai Botnets have been expanding, and now they’re targeting industrial routers. That’s also not good news. All this in this episode of Exploit Brokers. Today we are facing an unprecedented array of data breaches, hacking attempts, and surges in digital crime. Why is there such a widespread amount and how little is noticed in our everyday lives?
Malware, dark sites, brute forcing, zero day script kiddies, and nation state hackers are all on the rise. Learn more about the threats we face and gain a bit more knowledge than yesterday. Hey everyone, another episode of Explore Brokers is coming to you now. Hey guys, it’s Cipherceval hosts. Thank you for tuning in.
If you could do me a big favor and hit that like, subscribe, and bell notification icon if you’re on YouTube. And if you’re on a podcast platform like Apple Podcasts or Spotify. If you could please give us a follow and 5 stars if you think we deserve it. It helps the channel grow and I would appreciate it immensely.
So guys, 800, 000 EV customer data. Is out there. I mean, it’s a mind boggling number. Volkswagen had major issues. They got breached and now there’s data is out there. Now I know a lot of you may be wondering, well, I don’t have a Volkswagen. I don’t have an Audi. I don’t have a seat or a Skoda. So why does that matter?
It matters because this is a trend we’ve been seeing. It’s no longer about just a car getting hacked. It’s about the entire infrastructure that gets hacked. And then the car is just kind of. An accessory to that. And what I mean by that is we’re seeing more and more of these cars are hooking up to servers and hooking up to other stuff.
There’s even a bunch of technologies that are going into it. You know, you can do stuff from spoofing GPS to apparently stealing data without ever being near the car. And that’s kind of where my concern lies, with this hyper connectivity of everything, we’re seeing more breaches happen, and information that shouldn’t necessarily be available, becoming available.
Let’s kind of dive into it with this article by Dark Reading. Volkswagen Breach exposes data of 800, 000 EV customers. Ethical Hacking Group Chaos Computer Club uncovered exposed data of electrical vehicle owners across the companies of Volkswagen, Audi, Seat, and Skoda brands. Volkswagen Group experienced a data breach last month exposing sensitive personal information of roughly 800, 000 electrical vehicle owners across its brands including Volkswagen, Audi, Seat, and Skoda.
Initially reported by German publication Spiegel, The breach has been attributed to an Amazon cloud storage system misconfiguration, which is managed by software subsidiary Cariad. The group reportedly left personal and location data openly accessible online for months on end, prompting the breach. So to give a bit of context and to give some information here from a software side, the Amazon cloud storage, which is generally an S3 bucket.
Uh, there is some other stuff, but S3 is kind of the most. Common any kind of cloud storage mechanism you have is kind of what it sounds like you put files and other stuff up there For whatever resources you might need granted when you put in text fields A lot of the stuff is probably held in the database, right whether you’re thinking information such as registration usernames blah blah blah But sometimes there’s stuff that gets put into cloud storage for a variety of reasons here What I’m wondering is why?
This kind of information, which we’ll get to in a second, what was actually leaked, why was this in a cloud storage instead of some kind of database? Who knows? Now, I just, I find that interesting. A lot of times you have, and this is something we’ve seen in the bug bounty community. You have misconfigurations as a bug because you shouldn’t be able to access things just on the open internet, but it does happen.
Let’s continue. The anonymous hacker who discovered the breach reported it to the chaos computer club, CCC. A well known organization of ethical hackers in Europe, the CCC tested the open, insecure access before informing Cariad and Volkswagen. As a good security research group does, you want to verify and confirm that what you’re about to send isn’t just blowing smoke in the air.
The data exposed in the breach included vehicle information, such as when EVs were switched on and off, along with location data, email addresses, phone numbers, and home addresses of car owners. And that’s, that’s where I just find it a bit mind boggling. Electric cars are pretty much just computers with wheels.
If we really want to talk about it, right? Whether it’s Volkswagen, Tesla, some of the Ford lightenings or whatever, all of the electric cars we’re seeing are just computers with electrical motors. At the end of the day, it’s no longer like the old, uh, ice, I believe they’re called internal combustion engine vehicles, where there’s a lot of systems at play, but it’s mostly mechanical.
Okay. Now you have a computer system. That’s pretty much electrical to mechanical and just where we’re seeing this go. And I find it interesting now on the security side, why did they have all this stuff somewhere easily available for months? There probably wasn’t proper auditing of anything. Um, whether that’s, there was a lot of turnover at the company.
I know a lot of the vehicle manufacturers have been having layoffs. I’m not sure if Volkswagen or Audi was one of them, regardless of the reason why it’s something that we’re seeing a lot of companies go to these cloud providers. And you have a lot of novice or even mid tier and even senior software engineers, if I’m being honest, you have a lot of engineers who are just not super familiar with some of the cloud and that’s where you get misconfiguration stuff.
If you have someone who’s done desktop apps and they go to a company that does a lot of cloud stuff. And they’re not sure of the best way to do it. And their it isn’t sure of the best way to do it, or they just have high turnover. That’s where we get into these kinds of scenarios. Is it the only way? No, but it’s something I’ve been seeing.
Because with anything, a lot of hacking tends to be just some kind of human error. And when it comes to misconfiguration bugs, a lot of the time is because there was things that the administrator wasn’t aware of stuff that they didn’t change. Think default passwords, you know, admin, admin, root, root, et cetera.
And just like that, there’s also access control misconfigurations and other stuff. So here, it seems like they just kind of left it open to the public. A wide variety of individuals have been affected by the breach, including at least two German politicians and the Hamburg police. While most affected vehicles were located in Germany, Spiegel’s hired researchers found details about cars in Norway, Sweden, the UK, the Netherlands, France, Belgium, and Denmark.
And I’m honestly kind of surprised it only went that far. I’m surprised it didn’t hit the U S it didn’t hit Australia, et cetera, et cetera. Now part of that also probably is the way that they segment their data, right? When you think about servers and when you think about cloud providers, a lot of times, a lot of the times they will have a cloud in one region.
And you have like, for example, AWS has like East Ohio, the West, they have several in Europe, right? So it just depends where. That S3 bucket was being held and it might not be an S3 bucket. There might be more to it, but wherever that server was being held, that was probably the part that was misconfigured versus, you know, maybe some of their cloud in another, uh, region is not privy to that.
It might be better security. It may have just been that this was. One of the backup or one of the fallbacks or et cetera. And that was not properly, not probably put behind access controls. It’s stuff we see. It’s kind of sad to see this kind of stuff happen, but it does happen. And with that, let’s go ahead and jump into the next one.
So this is by the hacker news. Mirai botnet variant exploits for faith router vulnerability for DDoS attacks. So for those of my listeners who either have been with me for a little while or haven’t been with me for a little while. I want to give a bit of context for those who haven’t been, or who aren’t privy to it, or aren’t aware of it.
The Mirai botnet is a botnet that’s been around for a while. They’re pretty powerful. They tend to do a lot of IoT based and other stuff. And the DDoS attacks that they’re mentioning is a distributed denial of service attack. A denial of service attack essentially means that one computer hits a server or a computer as much as they possibly can to try to prevent service.
A distributed denial of service attack is pretty much that scaled up. Where you have a couple thousand computers, a couple hundred, doesn’t matter, more than one. And that computer is sending as much data packets to a server to try to overload it with requests. Because if a server can only handle say a thousand requests per second or a thousand requests per minute.
And you flood them with a million per minute. You’re pretty much going to overload that server to the point that packets are even going to fall that they’re just not going to get picked up by the server at all, because you’ve overloaded it to the point that they can’t even do basic handshakes and stuff like that.
And the, for faith router. Is a brand from China, as far as I can tell. And that’s kind of the main things I would like to know, but I would like you to know before we jump into this and break down some other stuff. So MRI botnet variant has been found exploiting a newly discovered security flaw impacting for faith industrial routers since early November, 2024 with the goal of conducting distributed denial of service attacks, which I already explained.
The botnet maintains approximately 15, 000 daily active IP addresses with the infections primarily scattered across China, Iran, Russia, Turkey, and the United States. So if they have 15, 000 daily active IP addresses, that means They should have 15, 000 bots online daily. Could there be other bots? And, um, we’re seeing, you know, they just get taken down.
Some get brought back online. Very possible. But if we’re seeing about 15, 000, that’s a pretty good amount of bots that we’re seeing exploiting an arsenal of over 20 known security vulnerabilities and weak telnet credentials for initial access. The Mauer is known to have been active since February, 2024.
The botnet has been dubbed something I’m not going to say on this channel. And you’re welcome to look up the article to, to read what that is in reference to the offensive term present in the source code that should say a lot. So before I continue, when you’re talking about weak credentials, telnet is Another way to remote into a server.
If you want to think like SSH or, you know, a secure shell and you want to think like a FTP, right, a file transfer protocol, whenever you remote into a server to either do stuff, pull files, push files, telnet is just another way of doing that telnet is, I think not used as often as SSH is, or at least it shouldn’t be used as often as SSH is.
But it’s still around. It’s, it’s been around for a while and it’s going to be around for a while. Now, GQ Engine X Lab said it observed the malware leveraging a zero day vulnerability in industrial routers manufactured by China based Forfaith to deliver the artifacts as early as November 9th, 2024. So, a zero day being anything that is a vulnerability or a bug that the vendor doesn’t know about.
So, there’s been zero days that they’ve known to fix it. Last month, Volchek told the Hacker News that the vulnerability has been explored in the wild to drop reverse shells and a Mirai like payload on compromised devices. So the way that botnets will generally operate is they’ll have some kind of mode of infection.
They’ll have a dropper or something like that. And then they’ll have the actual botnet payload, the thing that does infection. Now I’ve seen this play out in very different ways. Sometimes they’ll have different versions of the bot. Sometimes there’ll be just one bot that tends to change over time. You have like version one, version two, version three, and as the developers get better at it, they’ll make new versions.
Um, and I bring that up because the fact that dropping a reverse shell means that they want some kind of remote access to do stuff, and you have to be careful of the kind of vulnerabilities used there. Some vulnerabilities can give you root access, and those are like the most dangerous because if it’s root access with a remote code execution, RCE, That’s where you can pretty much take over a system pretty quickly.
Now, some CVS could be something like you get in, but you have low level. So you need a chain it with something akin to a privilege escalation attack, right? Where you get in as a weaker user, but use privilege escalation tax to kind of go up. And I bring that up because right here, some of the other security flaws exploited by the botnet to extend its reach and scale include.
Several CVEs, but I’ll go through them really quick. CVE 2013 3307, CVE 2013 7471, CVE 2014 8361, CVE 2016 20016, CVE 2017 17215, CVE 2017 5259, CVE 2020 25499, CVE 2020 9054, CVE 2021 35394, CVE 2023 26801, CVE 2024 8956, and CVE 2024 8957. You’re probably wondering, you, you know, why did I just go over all those?
Good question. The biggest problem I have with this list is some of these CVEs are from 2013. The first ones on that list Surprised me the most because something from 2024 may not get patched as quickly, but something from 2023 probably has a patch. And if it doesn’t have a patch, then, oh my, that’s bad.
But the 2013 CVE should have a patch, which means it’s just harder to patch this stuff. The problem with routers, the problem with IoT devices, the problem with embedded devices, and that’s something you’ve heard me talk about on this channel before, the problem with these devices is, once they’re set up, they’re generally not maintained the way you would like your phone, or your tablet, or your computer.
When you get on your phone, most of the times you’ll be prompted, hey, there’s an update. But how many times do you update your router if you’ve ever updated a router? Because those are just not as easy to update from a user perspective. If you think about security cameras, routers, Heck, your fridge or your, I would hope not, but your range or your oven.
If they have any kind of firmware, how easy is it to update them? Now, if they’re not connected to the internet, that’s less of a concern, but if they’re connected to the internet and you have one of those smart fridges, what if that has CVEs in it and they’re stuff from 2013, 2015, they just never patched?
But the biggest problem with routers compared to the smart devices is the smart device isn’t necessarily facing the internet. You could misconfigure it, of course, but a router by definition is always facing the internet. And that’s what makes it much more problematic. And when you talk about industrial routers, you probably have a bunch of old outdated routers in the middle of a facility that just don’t get touched because they work and they’ve been there for a long time.
Now, to continue on, once launched, the malware attempts to hide malicious processes and implements a Mirai based command format to scan for vulnerable devices, update itself, and launch DDoS attacks against targets of interest. Now, like any good malware, or any Advanced malware. It tries to hide itself, which, you know, if we’re assuming a piece of malware is good, they should at least try to hide themselves, obfuscate their activity, things like that.
And then they pretty much look for ways to propagate. If you find other vulnerable devices, you can start a spread like a worm and so on and so forth. So DDoS attacks leveraging the botnet have targeted hundreds of different entities on a daily basis. With the activity scaling a new peak in October and November 2024.
The attacks while lasting between 10 and 30 seconds generate traffic around 100 gigabits per second, which comes out to roughly 12. 5 gigabytes per second, which if you kind of extrapolate that out, that’s roughly 750 gigs a minute. I don’t know about you, but that’s a good amount of data to be hit at once.
Now, the disclosure comes weeks after Juniper Networks warned that the Smart Session Router SSR products with default passwords are being targeted by malicious actors to drop the Mirai Botnet malware. Akami has also revealed Mirai malware infections that weaponize a remote code execution flaw in DG Ever DVRs.
Which going back, RCE, whenever you have an RCE that makes it so much easier to do stuff because if you can run a command that says download this bot, it’s just, it’s just that much easier. Now, the DigiEver DVRs, I have not come across this brand, but a DVR generally is a digital video recorder, I’m assuming that’s what they’re talking about here.
And DVRs is kind of one of those other, like, It’s one of those other devices. Sure. You may interact with it, but if they don’t have a very good way to run updates, if they don’t prompt you, Hey, do you want to update? If you got to go into some obscure setting and see if there’s an update functionality in it, then that’s where a lot of this.
Becomes more vulnerable to old CVs, right? Because even if they find a way to patch these digi ever DVRs, if the way to update it is plugging in a USB, downloading some zip off the internet, um, and plugging it in, booting it up into some special mode and running it, you’re going to have almost nobody update that router and nobody update that DVR or embedded device or camera or whatever.
The same kind of applies to all of them because. I’m not sure about you, but I’m pretty sure most people won’t do that. Most people that I know won’t do that. Most of my family members won’t do that. Because it’s kind of difficult. You gotta be a techie, you gotta be technically savvy. And even if you are technically savvy, how many of us are trying to download a zip to install on our fridge?
It’s just not something that’s done. Not often. Anyways, I know that I’ve had to update like old lenses on some camera that I had. And I was shocked because it was like, you left it connected to the camera. Then the camera would get connected to the computer and then you could update it that way. They didn’t have any, like connect to wifi and just update the camera.
Now this is a, you know, and a DSLR. And that is often not connected to the internet, but still, it’s just kind of crazy that there’s in the modern day, you have expensive equipment like DVRs, cameras, and all this other stuff that don’t have some better mechanism to update or even to be able to update themselves.
Now, the final part of the article, DDoS has become one of the most common and destructive forms of cyber attacks, X Lab researchers said. Its attack modes are diverse, attack paths are highly concealed, and it can employ continuously evolving strategies and techniques to conduct precise strikes against various industries and systems.
Posing a significant threat to enterprises, government organizations, and individual users. The development also comes as threat actors are leveraging susceptible and misconfigured PHP servers to deploy cryptocurrency miner called a packet. And this goes back, right? Misconfigurations, misconfigurations are probably much more common that they should be.
If you have a misconfigured SQL, misconfigured ports, misconfigured service, misconfigured anything. It’s just a lack of knowledge on the admin, the developer, the it, whoever’s controlling, maintaining, and updating that piece of software. Now, could it be that there’s some obscure configuration that no one’s aware of?
Sure. But we are seeing a lot of like admin admin, whoever set it up did not even bother to change the default creds. And that’s bad because that is like an easy thing to fix. That should be like day one. You go in, you do your best to wipe everything that has default creds, updated, secure it, harden it. Um, especially when you’re talking about devices that may never get updated ever again, I would hope that the tech or the it people who set it up should at least configure it where it should be.
Harder than admin admin. Was it admin admin in this case? No, but if they’re using default credentials, it could be pretty easy to just brute force, but guys, I want to thank you for tuning back in. I am trying a new format. I am getting rid of the music. So if you’ve gotten this far and you prefer that format, please leave a comment or send me an email through exploitbrokers.
com. There’s a contact form on there. You want to reach me. And you can always email me at support or support at exploitbrokers. com. This has been your host Cipherceval. I want to thank you for staying this long and I’ll see you in the next one.
Note: This is a transcript of the episode.
📢 Connect with us:
Newsletter: https://follow.exploitbrokers.com
Twitter: @ExploitBrokers
Medium: https://medium.com/@exploitbrokers
TikTok: https://www.tiktok.com/@exploitbrokers
🔗 References & Sources
* Volkswagen: https://www.darkreading.com/cyberattacks-data-breaches/volkswagen-breach-exposes-data-of-800k-customers
* Mirai: https://thehackernews.com/2025/01/mirai-botnet-variant-exploits-four.html
Leave a Reply