HandsOnKB

S1x2: eps1.1_ones-and-zer0es.mpeg

The episode title refers to the MPEG series of video file formats from the “Moving Picture Experts Group.”

EVILCORP Mail Servers Haven’t Been Patched Since “ShellShock”

In the scene hacking EVILCORP’s mail servers (which would probably be a great target to be honest judging by how often Exchange gets attacked) Elliott mentions that they haven’t been patched “since ShellShock.”

Shellshock (CVE-2014-6271) ended up being a series of vulnerabilities that came out in 2014 and were the result of Bash allowing arbitrary code execution via web request if an attacker first defined an empty function, then added additional commands to the end of it using semicolons between each command (which is standard Bash syntax but shouldn’t be possible in this way).

This can be seen in the web request Elliot sent to the mail server:

wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" http://evilcorp-intl.com/login.email.srf?wa=wsignin1.0&rpsnv=4d

• wget -U — (Used to send a web request with a modified user-agent header)
  • The Common Gateway Interface (CGI) script of the server takes user-agent strings as inputs into the Bash it runs on the backend for the script.
• () { test;}; — (This is the empty Bash function definition that was used to start the exploit. The semicolon at the end allows the attacker to add another command for the server to run afterwards.)
• echo “Content-type: text/plain”; echo; echo; — (This header sets the format of data Elliot wants to receive when processing the response from the server and the output of his later “/bin/cat /etc/passwd” command. The CGI script expects this header, so without forging it Elliot would just receive an error message and no illicit data.)
• /bin/cat /etc/passwd — (Here Elliot uses the “cat” binary (short for “concatenate”) to display the contents of the passwd file, which contains a listing of all accounts on the system, their User IDs (UID), Group IDs (GID), home directory paths, and default system shell environments (like /bin/bash).
  • Example:
    • An interactive regular user (Allowed to log in)
      • john:x:1001:1001:John Doe,,,:/home/john:/bin/bash
    • A non-interactive system user (Blocked from logging in)
      • www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
• http://evilcorp-intl.com/login.email.srf?wa=wsignin1.0&rpsnv=4d — (The target for the attack, which seems to be a web form that processes mail server logins on the web UI.)

This command is used by Elliot to display the contents of the /etc/passwd file, and save the output of that command to a file named “status” which is then transferred to his desktop from the EVIL Corp mail server. He then uses John the Ripper to crack Tyrell Wellick’s password of “olofsson66.”

Fun Fact: This attack seems to omit a step for narrative pacing. Elliot wouldn’t have been able to crack Tyrell’s password with that information because his password hash would be in the /etc/shadow file which would require root or sudo access to read.

John the Ripper has a tool named unshadow included in it where you can combine the contents of /etc/passwd and /etc/shadow to get hashes in a format that can be cracked, like so:

sudo unshadow /etc/passwd /etc/shadow > ecorp_pw_hashes.txt

I get why they omitted this, and adding that extra detail doesn’t add much to the scene, so I won’t fault them for it.

Elliot’s Pretty Thorough Hardware Tear Down

After feeling like the hack of EVIL Corp and Tyrell Wellick’s social media accounts was too easy, Elliot freaks out thinking it was a setup and they knew he would do this.

He then proceeds to rip a SIM card and MicroSD chip out of what’s probably a burner phone and throw them in the microwave.

Elliot then drills holes in storage drives and PCB components to destroy their platters for HDDs and flash memory chips for SSDs beyond what a Digital Forensic expert could recover.

Afterwards he rips what’s probably the BIOS/EEPROM chip out of his motherboard and microwaves that as well.

Finally, Elliot puts all these ruined hardware components into a trash bag to be thrown away.

Mr.Robot’s “Steel Mountain” Tape Destruction Plan

After meeting with fsociety later in the day, Mr.Robot tells Elliot of their plan to blow up “Comet,” a natural gas pipeline in Albany. They plan to do this in order to destroy a large-scale secure data storage facility used by many of the largest corporations in the world run by a company named “Steel Mountain” (a slightly altered name of the real-world company Iron Mountain).

Mr.Robot’s plan for destroying the pipeline is to have Elliot use his AllSafe security clearance (implying that Comet is a client of AllSafe) to hack into one of their PLCs (Programmable Logic Controller) and increase the pressure of the gas in the pipeline in order to cause an explosion. This would destroy the neighboring facility but also kill an untold number of innocent people, so Elliot’s not a fan.

Colonial Pipeline Ransomware Attack

Funny enough, in 2021 the Colonial Gas Pipeline was ransomed by hackers causing mild unrest throughout much of the eastern United States due to gas stations running out of gasoline. There were lines of of angry and stressed drivers desperate for gas, and that was just from turning off the supply for a little bit. Blowing it up would be another level of catastrophe.

In that case the hackers got in due to reuse of a simple password from someone’s personal accounts (found in a dark web leak) on an inactive corporate VPN account that was never deleted, retroactively making this hack hilariously realistic.

Target Data Breach

Using the access of a third-party vendor to breach a more secure target is also how Target got hacked in 2013 through an HVAC vendor that had remote access to their network and left the door wide open for hackers to steal 40 million customer credit cards collected from their Point-of-Sale (PoS) terminals.

STUXNET: The Infamous Anti-Iranian Worm

This plan to hack industrial equipment to cause a slight change in settings that lead to catastrophic effects is also reminiscent of STUXNET, an infamous worm that was used to set back Iran’s nuclear program by speeding up their centrifuges purifying uranium just enough so that their failure rate increased discretely. Kim Zetter has a great book on the subject named “Countdown to Zero Day.”

Dark Army Hacker Web Cam Stalking & Extortion of Angela

Earlier in the episode Angela and her boyfriend run into a supposed rapper on the street begging people to try his album and giving it away for free. This is something you’ll see in a few cities, but I’ve never heard of it being free so that should’ve been the first red flag. Later when Angela’s boyfriend tries to play it on his laptop he mentions that “it just freezes up [his] computer” and the laptop’s disc drive “spits it back out again.”

It turns out that this man on the street was actually a member of The Dark Army who now has access to the boyfriend’s laptop, and webcam, and uses it to record Angela getting ready to hop into the shower. We also see him chatting with someone on IRC in Chinese on his own computer, implied to be another member of their group.

Conclusion

Overall this was a pretty good depiction of a classic exploit (ShellShock), making hardware and data unrecoverable for “OPSEC,” and using removable media to plant malware on someone’s computer. They skipped a step in the password cracking attempt, but it’s not a big deal considering the attention to detail put into everything else.