Hack 4 Career E-Book 2023

mertsarica

Hack 4 Career E-Book 2023 Copyright © by Mert SARICA. All Rights Reserved.

This book was produced with Pressbooks.

Contents

Introduction

1. Exposing Pig Butchering Scam

2. Practical Data Leakage Analysis

3. Was Turkey's e-Government Hacked?

4. WhatsApp Scammers

5. Home Home Secure Home

6. How I Hacked my Smart Grill ?

7. How Do They Hack Turkish e-Government Accounts?

1

Introduction

In 2009, with the motto “Knowledge is power and grows as it is shared,” I created my blog aiming to increase awareness of information security by featuring numerous technical articles. As a result of the positive feedback I received from my readers over the years, I decided to compile my writings into e-books on a yearly basis and share them with cybersecurity enthusiasts.

With the hope that these articles, which I wrote after dedicating effort, time, and resources to research, would be beneficial for those looking to improve themselves in the field of cybersecurity.

Mert SARICA

https://www.hack4career.com

https://twitter.com/mertsarica

https://www.linkedin.com/in/mertsarica

CCISO, CISSP, SSCP, OSCP, CREA & CEREA

1

Exposing Pig Butchering Scam

Over the years, as I have been targeted sometimes directly (LinkedIn Scammers, Sponsored Scamming) and sometimes indirectly (Who Viewed My Profile?) by scammers, I have made it my duty to write about these attempts in blog posts and warn those around me about them. At times, I have even received messages about scams from my spouse, friends, and close ones and have tried to write about them (Instagram Scammers) whenever I get the chance. And now, I am here again with a new scam attempt to expose.

As I announced through my Twitter account in June 2022, this attempt started with a message from a protected Twitter account named Anna on June 14, 2022. In this message, Anna started the conversation by talking about how she hasn’t seen me in a long time. After learning my name (Mark *fake*), where I live (a Belgian living in Turkey *fake*), and what I do (CFO of a FinTech company *fake*), the topic shifted to where I invest my money and the loss of value of Bitcoin cryptocurrency at that time.

I took a break from the conversation and decided to find out who the photo on Anna’s profile really belonged to, as I suspected it was fake. To do this, I used the Visual Search feature of the Yandex search engine and discovered that the profile photo belonged to a Chinese person named Shasha Zhao. When I looked at the photos shared on Shasha’s profile, I found the exact photo on Anna’s profile.

Anna, who initially claimed to live in Singapore and founder of a garment import and export trading company, asked to continue the conversation on WhatsApp and shared a US phone number (+19295654212) with me. When I questioned her about using a US phone number, she changed her story, saying she lived in the US for business reasons. To pique my interest, she then claimed to have made a profit of around $715,000 from a crypto investment of $300,000. I informed her that I was considering investing $500,000 to see her tactics for quickly making a profit.

After sharing that I consider her to be a very good investor and want to invest with her, she told me that I need to enter the MonexCrypto platform for short-term investments. She also shared that I need to visit the https://app[.]monexcrypto[.]net address, download the mobile application, and register.

I went to the website to download the mobile application and when I looked at the source code of the webpage, I found out that there was both an Android (update.apk) and an iOS version of the app. After uploading the Android app to VirusTotal and Pithus, a mobile threat intelligence platform, and quickly checking the somewhat suspicious results, I decided to thoroughly examine the version developed for the iOS operating system.

After seeing that the mobileprovision file, which enables third-party applications to run on the iOS operating system, is stored on GitHub, I viewed the information about the developer/company (QuanLi Network Technology Co., Ltd. (SRD7J8LLBV)) registered in the Apple Developer Program.

I examined the app.mobileconfig XML file, consisting of payloads that load settings and authorization information onto Apple devices. When I ran the file in the Simulator application located in Xcode, I learned that it is a Web Clip (WebClip) that opens the https://www.monexcrypto.net web page and is signed by a developer named Gang Dai.

Web clips: A web clip is an icon on the device Home screen that links to a website or URL. Web clips can optionally launch full-screen web apps and can run offline using HTML5 local storage. Configuration profiles can include web clips that use a custom title and icon, and can optionally be nonremovable. Web clips can point students to specific websites for educational purposes. For more information about configuring web clips on a device, see WebClip profile page in Apple Developer documentation.

When I tried to register on the website, I was expected to enter an Organization Code in the registration form. The purpose of placing such a code in the form by scammers was probably to prevent cyber security researchers and/or cyber security vendors from detecting this page and collecting information, and they had been successful until now. Whenever I told Anna that I was having issues in the app installation, she kindly did everything she could to help me with screenshots. So I decided to ask Anna for help one more time in finding out the organization code. 🙂

When I asked her the organization code, she first wrote Chinese words (probably she was communicating with me using a Chinese-English translation service), then she shared with me the code (768919) that I needed to enter into the form.

When I successfully registered and started browsing the website with Web Clip, I saw pages and menus about real-time market tracking, depositing money into the wallet, withdrawal, etc.

Later, I visited the Recharge page, which I thought could be the ideal place for scammers to trap their victims, as the page for depositing and withdrawing cryptocurrency. Like other exchanges and platforms, when I visited, I was presented with the addresses of my cryptocurrency wallets.

On June 28, 2022, Anna realized she was very close to scamming me, began directing me on how to send cryptocurrency (USDT) via a cryptocurrency exchange named Binance to my wallet.

As I began to wonder which country Anna was really communicating with me from, I started to think about what I could do to find out Anna’s IP address. I guessed that Anna, who had never suspected me despite the éCyber Security Researcher” background image on my Twitter profile, continued to carry on her plan to trap me for 15 days, had no concern about Operations Security (OPSEC). For this reason, I decided to share the web addresses of the screenshots I hosted on my website with Anna by using the Bitly URL shortening service in order to obtain her IP address.

Because Anna did not hesitate to click on the three bit.ly addresses I shared, with the help of the SOCRadar’s IOC Radar I learned that she was communicating with me from the 45.204.66.140 IP address located in Hong Kong.

As I continued to browse the MonexCrypto website, I decided to check if the Bitcoin and Ethereum cryptocurrency wallet addresses were unique to me or same for everyone who joined the platform. If these wallet addresses belong to scammers and they show their own addresses as wallet addresses to each person who joins the platform (victim), they can easily steal the cryptocurrency from their victims with ease. Based on the research I conducted on this matter, I discovered that;

On June 28, 2022, when I checked my Bitcoin wallet address (3QX2Csna3FEbXD9PxhgEXL36qAfYXWSwQU) on the Blockchain.com website, it was seen that this wallet was created on June 6, 2022 and until September 29, 2022, $55,618.73 worth of Bitcoin was transferred to this wallet and then withdrawn. On the same date, when I checked my Ethereum wallet address (0xF88997e493C08874d9e0D485463386ABf0EBe6bf) at the same place, it was seen that this wallet was also created on June 26, 2022 and until November 23, 2022, ~$839.000 worth of Ethereum and USDT was transferred to this wallet. Again, on the same date, this time checking my USDC wallet address (0xcfddf006ec9f4af5bf34a6f71af41655fb7d4167), it was seen that this wallet was created on June 17, 2022 and until August 16, 2022, ~$46.000 worth of Ethereum and USDT was transferred to this wallet.

Disclaimer: I would like to remind that I am not an IRS agent or a Blockchain expert capable of tracing end-to-end cryptocurrency transfers as described in the book Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency in case of any errors. 🙂

From the date I registered on the MonexCrypto website, June 26, 2022, to January 29, 2023, I roughly checked my wallet addresses 5 times by logging into the MonexCrypto website, and I noticed that they changed every time. Based on this information, the wallet addresses were not individually produced, but were the scammers’ own wallet addresses, and they changed these addresses at certain intervals. When I listed and gathered the wallet addresses and the money transfers made to these wallets, I realized that the scammers had stolen approximately 3 million dollars worth of cryptocurrency, to the best of my estimation.

Of course, while I was trying to unmask Anna on July 18th, 2022, the FBI issued a warning against fraudulent attempts made through fake crypto exchanges/investment applications like MonexCrypto. According to this warning, approximately 42.7 million dollars worth of crypto had been stolen from 244 people worldwide. I had already learned how 3 million dollars were stolen. 🙂

In 2021, the FBI’s Internet Crime Complaint Center received more than 4,300 submissions related to pig butchering scams, totaling more than $429 million in losses. And at the end of November, the US Department of Justice announced that it had seized seven domain names used in pig butchering scams in 2022. (Source: Wired)

Anna, who exhausted all means of persuasion to deceive me from June 14th to July 6th, 2022, she started sending messages full of complaints on July 6th. I put an end to our conversation with the bad guy smile by informing Anna of the FBI’s warning on August 1st, 2022. 🙂

It seems that Anna continued to catch new victims in her web without slowing down in the following months and was successful, as some user passwords were also stolen when they entered the monexcrypto.net site on September 5th, 2022, according to information detected as stolen by a malicious software (Stealer) on the SOCRadar Cyber Threat Intelligence platform.

By October, the Monex Group issued a warning that two more websites, starting with the monexcrypto.net website, were using the group logos without permission.

As a result, we have learned in detail how Anna and her scammer friends carried out the Pig Butchering Scam, a well-designed fraudulent scheme, and how they made millions of dollars in loot, from the applications downloaded not only from 3rd party websites but also from the Apple App Store and Google Play Store.

Pig Butchering scam is named after the practice of fattening a pig for slaughter. In this case, scammers build a relationship with a victim online before convincing them to send money or invest in high yield crypto-currency accounts.

I strongly request you to share this article with your friends, loved ones to raise security awareness. Hope to see you in the following articles.

2

Practical Data Leakage Analysis

Conti, a Russian-backed cybercrime group that earned $180 million in revenue from ransomware attacks in 2021, reached a major turning point in 2022 with Russia’s invasion of Ukraine. The group publicly supported the Russian invasion, resulting in a rift among its international members. One member began leaking internal messages from 2020-2021 on a Twitter account (@ContiLeaks), including the source code for the ransomware they used in their cyberattacks. The group was considered one of the most notorious cybercrime groups in the world.

As a cybersecurity researcher, when data from such threat actors is leaked, one of the things that interests me the most is whether the data includes information about hacked organizations in Turkey, as well as non-Russian, English messages. If you ask me why, it’s because I can have the opportunity to learn how extensively Turkey is targeted by these threat actors and which nationalities are involved in such internationally organized crime groups. To find out, I decided to conduct cybersecurity research to provide insights to cybersecurity researchers who are also interested in this topic.

First, I downloaded the files that include the Conti group’s messages from the sharing area of the vx-underground website. When I extracted all the zip files, more than 11,000 files came out.

After learning that the messages are stored as readable text in JSON files (Example: 185.25.51.173-20220301.json), my first task was to use the following regex-supported GREP command to find and deduplicate all IP addresses in the files. I ended up with a total of 3819 IP addresses that match these two regex patterns, which I saved in a file named “ip.txt.”

grep -R -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" > ../ips.txt

grep -iRE "(\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}" ../ips.txt | grep -E -o '[1-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq -i > ../../ip.txt

When it came to finding out which of these IP addresses belong to Turkey, I found help in the IPinfo API and its Python library. By using this library with the IP2Geo Tool v2 that I developed, I queried all the IP addresses in my possession (ip.txt), and I learned that two of these IP addresses (31.210.111.142, 5.188.168.19) are located in Turkey.

To validate the results I obtained, I took a look at SOCRadar, Extended Cyber Threat Intelligence Platform that provides real-time notifications to organizations regarding data breaches. I found that the results aligned with what I discovered earlier, thus clarifying my initial curiosity. 🙂

When it came to my curiosity about the other topic, I decided to explore Python libraries capable of language detection from text. After a brief research, I came across several prominent libraries in this field, including fastText, langdetect and langid

While testing the libraries individually on the text from the leaked Conti data, I observed that each library made accurate language detections for some texts but produced incorrect results for others. As I pondered over which library to use, I decided to develop a tool that combines all three libraries and allows users to specify the confidence level parameter according to their needs and preferences. This approach would provide a more reliable way to determine the language in a customizable manner.

After merging the leaked Conti data into a single file using the command find . -type f -print -exec cat {} \; > ../logs.txt, I used the Language Identification tool I developed to check each line in the “logs.txt” file for Turkish language detection using the three libraries (with the confidence level set to “High”).

To use the Language Identification tool, you need to provide the following parameters.

The first parameter is the text file you want to analyze, specifying it line by line. The second parameter is the language code for the language you want to detect (e.g., “TR” for Turkish, “EN” for English). The optional third parameter determines the confidence level. If you set it to “High,” when all three libraries detect the language code you specified, it will indicate it on the screen.

Here’s an example command using the tool:

python3 lang_id.py logs.txt TR High

This command will analyze each line in the “logs.txt” file for Turkish language detection with a high confidence level.

Since there were no Turkish words or sentences used in the text files, there was no language detection indicating the usage of Turkish language by any of the three libraries. However, to test the tool’s functionality, I added three fake Turkish texts to the “logs.txt” file. As a result, I successfully observed that the program detected them correctly. Through this analysis, I learned from the leaked Conti data that there was no Turkish conversation among the group members, thereby clarifying my final curiosity.

I hope this method I have followed and the two tools I have developed will be beneficial for security researchers and experts in data leakage analysis. Hope to see you in the following articles.

3

Was Turkey's e-Government Hacked?

First of all, let me start by saying what I will say at the end: “No, it was not hacked!” So can you breathe a sigh of relief as a Turkish citizen in this situation ? Unfortunately no. You can read the reason for this in the rest of the article.

When you look at the origins of occasional news headlines such as “e-Government Hacked!”, “e-Government data stolen!”, “Identity information of 85 million citizens stolen!” (#1, #2), you can see that they are mostly caused by scammers, cybercrime organizations who share their advertisements on platforms like Telegram, ICQ, Discord, forums, trying to market their services.

When examining these advertisements, you can observe that cybercrime organizations provide access services or facilitate access to citizens’ data through websites, Telegram channels, and Discord rooms that they establish under the name of “Query Panel/Checker.” These services are sometimes offered in exchange for a fee, while at other times they are provided free of charge.

After seeing these, I can understand that the question “But how?” is troubling your mind with concern. To find an answer to this question, I have decided to make the most of the resources at my disposal as a professional working at SOCRadar Cyber Threat Intelligence company, which closely monitors the every move of cybercriminals, scammers, and threat actors, and warns its clients about them.

To begin, I embarked on a brief exploration of Telegram channels monitored by SOCRadar’s XTI platform.

During my search for query panels, I noticed that in some Telegram channels, files related to these panels were being shared by certain individuals.

I have learned that the increasing competition among scammers over the past 1.5 years has led some to withdraw from the market while others have fallen victim to hacking.

To learn how query panels function, I began closely examining the shared files (source codes). In some of these source codes, I noticed that scammers had implemented checks for Turkish Identification Number (TCKN) information, which I presumed to be related to acquaintances or relatives. For example, when someone attempted to query this TCKN information on the panel, no transaction would take place.

In some of the source codes, I discovered the presence of backdoors (web shell) that were embedded to allow scammers who downloaded these source codes to infiltrate websites at a later stage.

When I searched for the signatures (aliases/nicknames) of threat actors mentioned in the source codes within the SOCRadar XTI platform, I obtained the opportunity to identify which Telegram channels they were associated with and read the messages related to them. This is an incredible opportunity for cybersecurity professionals and law enforcement officials!

When it comes to understanding how access to citizens’ information was obtained through these query panels, my research on the source codes belonging to three different panels revealed two different methods.

In the first method, the queries made through the panel were forwarded to other systems, belonging to the same or different scammers, such as Web APIs. From there, it is highly likely that they were transmitted to websites (government, university, etc.) with authorized access using stolen account credentials (cookies). The responses were then relayed back to the users/persons who made the queries following the same path. To summarize the communication flow:

User -> Query Panel (Belonging to the scammer) -> API (Belonging to the scammer) -> Website (authorized access through stolen account cookies)

What is an API?
APIs are mechanisms that enable two software components to communicate with each other using a set of definitions and protocols. For example, the weather bureau’s software system contains daily weather data. The weather app on your phone “talks” to this system via APIs and shows you daily weather updates on your phone. (Reference: Amazon)

In the second method, queries made through the panel were again transmitted, this time without involving a Web API, to websites (government, university, etc.) with authorized access using stolen account credentials (cookies), just as in the previous method. The responses were then relayed back to the users/persons who made the queries following the same path. To summarize the communication flow:

User -> Query Panel (Belonging to the scammer) -> Website (authorized access through stolen account cookies)

The main reason for my strong assumption that stolen accounts are involved is that when I searched for these abused websites on SOCRadar’s cyber threat intelligence platform, I discovered that records containing access credentials (stealer logs: usernames, passwords, cookies, etc.) were being sold on the underground market. It is highly likely that certain threat actors hack into the systems of users who have access to these websites and sell the obtained information (stealer logs) to other threat actors and scammers. The statements mentioned in the video at the end of the article also support this notion.

Furthermore, in my research, I discovered that Web APIs also have a separate underground market, similar to query panels.

As I continued examining the source codes and took a look at the codes that indicated which information could be obtained through these panels using the Turkish Identification Number (TCKN), a rough overview of the information that could potentially be accessed through these panels emerged, resulting in the following table.

As I continued examining the source codes, independent of the previous topic, I came across approximately 131 individuals’ names and identity photos, which have been the subject of recent news and debates. When I compared them to images featured in past news, I discovered that they were associated with the cryptocurrency exchange Thodex, which was involved in the scam that affected thousands of people. It was revealed that these photos have been in the possession of scammers since 2021 and were being sold for 50 Turkish Lira (~$2).

To summarize the matter, even though Turkey’s e-Government has not been hacked, unfortunately, there is a concerning outcome for citizens. At this level of organized fraud, it is not feasible for citizens to individually ensure the security of their data and information or change and update the data they believe has been obtained (such as TCKN, mother’s name, father’s name, maiden name, etc.). Therefore,

It is a significant responsibility for the authorities to detect and intervene in these stolen and abused accounts, websites, APIs, and services through the utilization of cyber threat intelligence platforms and services.

While law enforcement agencies continue their operations against fraudsters and threat actors without slowing down, implementing security controls at the software and network levels in these types of websites, APIs, and services that carry the risk of misuse is crucial (such as implementing Captcha controls where possible, limiting the number of web requests to a page or service within a certain timeframe, suspending and investigating accounts in the case of multiple requests, cutting off network connections, subjecting them to additional verification steps, etc.). Strengthening system security (hardening) is also of great importance.

Hope to see you in the following articles.

One or more interactive elements has been excluded from this version of the text. You can view them online here: https://pressbooks.pub/hack4career/?p=175#oembed-1

4

WhatsApp Scammers

[powerkit_toc title=”Table of Contents” depth=”2″ min_count=”4″ min_characters=”1000″]

Introduction

I recently received my share of calls and messages from foreign cell phone numbers, disturbing almost everyone, especially in Turkey, who has used the WhatsApp application in recent days. Of course, as in my articles on other scams (Exposing Pig Butchering Scam, LinkedIn Scammers, Instagram Scammers), I rolled up my sleeves to investigate and write about this to raise awareness.

This story started on July 31, 2023, when I received a text message from a mobile phone number (+60 11-6436 2947) with a Malaysian country code not registered in my contacts. In this message, the suspicious person said she was conducting market research to help increase tourism data in Turkey and that I could earn 180 TL by answering 3 simple questions.

When I looked at this person’s profile, I learned that she had been using the WhatsApp application since July 3, 2023,. Also her profile photo had been used and shared on many different social media platform when I searched on the internet using the Visual Search feature of the Yandex search engine.

After answering all the scammer’s questions, she gave me a reward code and told me to contact a person named Nilu BALPANÇ with the username Rsp_Nilu on Telegram to pay me. When I contacted this person, who, according to Telegram Desktop, uploaded her profile photo on July 30, 2023, she told me that the bank account number I had provided was incorrect. After corresponding for a while and realizing that what she wanted an IBAN, not an account number, I gave her the information she was expecting, again incorrectly, at least in a way that she would not get an error. 🙂

Saying, “I defrauded the fraudster and got them to send money to my account,” or “I received the money from the fraudster and paid my electricity bill,” may mean that you are dealing with the money of an innocent citizen who has been defrauded, that is, with stolen money.

When an investigation is launched into these accounts, you may find yourself in the defendant’s seat, in defense of whether you have a relationship with fraudsters, so do not get involved in a financial relationship with fraudsters.

If the fraudsters transferred money to your account, contact your bank immediately.

When she shared that she had received an error with the account, a question immediately began to nag at the back of my mind. Did they send some money to their victim’s bank accounts to gain their trust? For this, when I inquired whether money was transferred to the IBAN I sent to the scammer, I learned that money was transferred!

After I told him I would not do the tasks without receiving the money and the corresponding bank statement, the scammer sent it to me and took me to a Telegram group called Part-Time Task Group, consisting of 64 people. He did not neglect to mention that I could earn 60 TL per task if I fulfill the tasks shared daily in the group.

When I asked the fraudster if the money transfer was from X bank, he said a third party made the payments. This time a new question began to puzzle me. Were the fraudsters using the accounts of victims they had lured through other methods as a front for this fraud operation, or did they own these accounts?

I quickly set out to find answers to these and other questions nagging at the back of my mind.

How and where did they get our cell phone numbers? How did they lure their victims? Who owned the accounts used to transfer money? From which country were they running this operation? Did the fraudsters speak Turkish, or did they use translation tools?

How and where did they get our cell phone numbers?

As in my article titled “Was Turkey’s e-Government Hacked?“, I do not think that in recent years, when our information has been passed from hand to hand in the underground world, threat actors and fraudsters have hacked somewhere by spending an extra effort to access our cell phone information and leaked this information from there.

When I searched for a sample mobile phone number on the SOCRadar XTI platform, which monitors threat actors and fraudsters step by step in the cyber world and provides instant cyber threat intelligence to its customers, I was able to see that these mobile phone numbers were included in the data leak files shared in the underground world. It is even possible to complete missing information about a person from a mobile phone number used in common in multiple leak files.

It is also important to remember that similar scams on WhatsApp are also carried out in other countries worldwide, so it would not be wrong to say that Turkish citizens are facing an international fraud network.

How did they lure their victims?

Shortly after joining a Telegram group called Part-Time Task Group, I found myself in an environment where tasks were being shared, screenshots, and correspondence were pouring in and I decided to watch what was happening on in the group.

After watching for a while, I noticed a discrepancy between the names, profile pictures, and language of the people in the group, including the administrators. When I searched a few profile pictures on the internet, as I did at the beginning of this article, I found that they belonged to entirely different people and were fake.

I realized that most people in the group were actually bots because of the spelling mistakes in the Turkish messages sent to the group, and the Turkish speakers sometimes used Chinese and English sentences.

The worst part was that the profile photos used by the bots appeared to be of innocent Turkish citizens.

The tasks, which started at 09:00 Turkey time, were renewed every 20 minutes and lasted until 20:30, involving subscribing to YouTube channels shared by the group administrator and sharing screenshots on the group or with the group administrators. It was promised that those who made these posts could also earn money from this work. You were also expected to do a merchant task to earn more money and join private rooms. For this, it was stated that you had to deposit the minimum amount of 500 TL and that you could make 650 TL in return.

Unfortunately, I did not have the chance to find out whether these YouTube channels shared during the mission were randomly selected by the scammers to convince the victims on the group, or whether they were channels of people who purchased services to gain followers from these scammers.

It would be useful for those who buy followers to remember that they may be inadvertently financing such scammers.

The bots that shared screenshots of their subscribers would also occasionally share bank statements of their earnings from their posts. When I looked at the bank statements, I could see that some of them were visibly manipulated. On the other hand, since I assumed that the scammers would not bother to change every single piece of information on the statements, I was immediately struck by the inconsistencies between the recipient/sender bank name and the bank code in the recipient/sender IBAN.

During the day, I saw scammers adding new victims to the group. Fortunately, those who realized the scam warned others and left the group immediately.

A careful examination of the screenshots shared in the group led me to conclude from various clues that some of them were from virtual phone software (Android Emulator, etc.), while others could be real, perhaps hacked, phones because they contained gsm operator names and also ran other applications at the background.

In some screenshots, I saw that they probably used a VPN to have an IP address from Turkey. I also noticed that the bots sometimes received an error from YouTube (Resource has been exhausted (e.g. check quota).). When I looked at the number of subscribers to the YouTube accounts that were asked to subscribe during, and after the start of the task, I saw that the number of subscribers increased by 2000. Based on this, I can say with a simple calculation that the scammers have an army of thousands of bots for this job.

At 20:30, the so-called bots said goodnight to each other and the group fell silent until 09:00 the next morning. Again, various questions started to come to my mind. Why were they going to sleep at 20:30 when money transfers can be made 24/7 in Turkey thanks to FAST? Was it because it was late at night in the location of the fraudster/operator managing the bots, so he had adjusted his shift and the bots according to this time? I left finding answers to these questions for later and continued my research from where I left off.

On August 4, 2023, I noticed that the Telegram group had been closed and contacted the scammer to ask him to let me back into the group. This time, when I entered the group, the list of group members was hidden. I watched the group for a while to learn the details of the scam attempt and after completing 4 tasks, I contacted the scammer to get me into a larger group and to deposit the money into my account.

Of course, the scammer stated that I had to complete 4 merchant tasks (pay 500 TL and earn 650 TL model). When I asked where and how to make the payment, she said I could make it to her bank account. In order to prevent fraudsters from victimizing more of our citizens, I had to quickly learn these bank accounts and forward them to the authorities of those banks for monitoring and blocking. Without wasting time, I told the fraudster that I wanted to make a payment.

After getting the first account information and informing the relevant bank official about it, I told the fraudster that my money transfer could not be realized and that there was a problem with their account. Then I tried to convince her to provide a second account information and I succeeded. 🙂

At the end of the day, I quickly shared the information of 5 different accounts used by fraudsters in 4 different banks with the authorities of these banks and we prevented more citizens from being victimized in a very short time. At this point, I would like to thank the banks whose names I cannot disclose and all the officials there for their quick actions.

In the light of all this information I have obtained, if I summarize the scam set up by fraudsters;

They contact the victim using a foreign number on WhatsApp and take them to a Telegram group. All of the correspondence and receipts shared by the bots in the Telegram group are an important part of the scam to impress and convince the victim. At first, the scammers gain trust by sending 180 TL to the victim’s account and try to convince the victim to pay for more. The scammers use accounts opened in more than one bank for money transfers. By getting the victim to subscribe to 26 YouTube accounts shared in the Telegram group during the day, they are likely to make either main or side profits – kill two birds with one stone!

Who owned the accounts used to transfer money?

As I received the misused account information from the fraudster one by one, different questions began to plague my mind again. When I searched the names and surnames of these account holders on the social network LinkedIn, I saw that most of them were either currently, or until recently university students, even if there was a possibility of name similarity. Were they young people in their 20s who knowingly and willingly cooperated with the fraudsters, or were they students who were exploited by fraudsters for the sake of earning income due to the difficult living conditions? Unfortunately, knowing that I would not have a chance to find an answer to this question, I continued to search for answers to other questions that puzzled me.

From which country were they running this operation?

Since I have experienced in my similar researches such as Exposing Pig Butchering Scam that scammers, whether local or foreign, mostly do not pay attention to Operations Security, I decided to try the same method to detect the IP address of this scammer.

For this, I used Bitly URL shortening service to share the address of the fake screenshot I uploaded to my website and tried to obtain the IP address.

At first, the scammer was hesitant to click on the link, but since there was revenue at stake and he didn’t know that I was on the other side of the keyboard, he decided to bite the bullet and clicked. When I searched the IP address I obtained from my website’s logs on SOCRadar IOC Radar, I found that the scammer was communicating with me through Thailand with the IP address 171.102.239.190.

When I found out that there is a 4 hour difference between Thailand and Turkey, I understood why the bots say good night to each other at 20:30 Turkey time and 00:30 Thailand time 🙂

Of course, from the records on my website, I not only learned about the scammer’s country of origin, but I also learned from 007scrm/4.58.8 in the User-Agent header that the scammer used an application called SCRM Windows to manage multiple social media accounts and communicate with his victims.

Did the fraudsters speak Turkish or did they use translation tools?

Looking at the screenshots, it was clear that both the bots on the group and the scammer/operator were using translation tools, but just to be sure, I decided to use Anatolian dialects and spelling mistakes that translation tools would fail 100% of the time, but that only those who know Turkish can understand. As you can see from the screenshot, translation programs fail against Anatolian dialects, so I was sure that they were using translation tools. 🙂

Conclusion

Before answering calls and messages from unknown sources against fraud attempts, you should always keep in mind that there might be a potential fraudster on the other end of the line, on the other end of the keyboard.

By muting calls from unknown numbers in WhatsApp (Settings -> Privacy -> Calls -> Silence unknown callers), you can prevent them from bothering you for at least a while.

If you can share this article with your spouse, friends, loved ones, and those around you in order to raise awareness against this fraud method, together we can prevent more citizens from being defrauded!

Hope to see you in the following articles.

5

Home Home Secure Home

Towards the end of 2022, when my spouse and I decided to settle in the United States, our first task was to find a place to live. Having lived in a house with 24/7 residential security guard services in Istanbul, Turkey, for many years, we had never been particularly concerned about security. However, when it came to living in a detached house and ensuring its physical security, it became my responsibility as a cybersecurity professional and DIY enthusiast. 🙂

Thanks to our realtor Ms. Arda AKBAŞ, even before setting foot in the United States, we managed to find a three-story, detached house in a low-crime area remotely.

As my first task, I started examining the exterior of the house using Google Maps. to roughly identify suitable locations for outdoor cameras.

When it came to finding a suitable alarm system, as a DIY enthusiast, Ring, Eufy, SimpliSafe, ADT Blue alarm systems caught my attention. After extensive research and evaluations, despite some negative news regarding privacy and vulnerabilities, I decided to choose the Ring alarm system due to its price, performance, and extensive ecosystem.

After moving into the house, my first task was to inspect each floor as if I were a burglar. As you might expect from American movies, I encountered many (27) sliding windows and 3 doors opening to the garden. The basement was a cute place, ideal for making a home gym, with 1 room, 2 windows, and a door opening to the garage, unlike in horror movies where it’s always the place where monsters and bad spirits reside.

According to the emerging needs, I first ordered the second-generation main alarm system from Ring, which consists of 14 pieces. In addition to that, I also ordered panic buttons that activate the siren when pressed for 3 seconds, detectors capable of detecting the sound of glass breaking, and motion detectors.

After securing the windows and doors with magnetic door contacts and ensuring the safety of specific areas with glass break and motion detectors, it was time to purchase indoor and outdoor cameras.

Since the garage had two doors accessible from the outside and one door from the inside, it was an important location to position an indoor camera. To avoid dealing with electrical wiring, I decided to go with battery-powered cameras and purchased the Ring Stick Up Cam for the garage. Next, I installed and set it up.

When it came to exterior cameras, my first priority was capturing footage of anyone approaching the front door, as well as having the ability to engage in two-way communication. Therefore, I purchased the Ring Video Doorbell 4, which allowed me to achieve these functionalities. Instead of drilling and mounting it on the wall, I chose to hang it on the door. Additionally, I purchased the DOORBELLBOA Anti-Theft Video Doorbell Door Mount as an additional accessory.

Two days after activating the smart bell, it caught its first uninvited guest. 🙂

One or more interactive elements has been excluded from this version of the text. You can view them online here: https://pressbooks.pub/hack4career/?p=48#oembed-1

Since the main entrance door of the garage was outside the camera’s field of view, I decided to install the Ring Spotlight Cam Pro on both the main entrance door and the back door of the house. To avoid frequently changing the batteries of the cameras (which typically last around 3 months depending on usage), I not only equipped each camera with two batteries but also purchased the second-generation Ring Solar Panel, a solar-powered panel, and connected it to the cameras. This way, the panels have relieved me of the hassle by charging the batteries on sunny days.

In the following days, we had another uninvited guest, but this time, he was caught in the backyard. 🙂

One or more interactive elements has been excluded from this version of the text. You can view them online here: https://pressbooks.pub/hack4career/?p=48#oembed-2

Just like in cybersecurity (CISSP Domain 3: Security Architecture and Engineering), deterrence is an important security control in physical security as well. Therefore, I made sure not to overlook placing 2 Ring Solar Security signs that are powered by solar energy and illuminate at night, at the entrance of the house and in the backyard. This serves as a deterrent to potential intruders.

For the business continuity, the main alarm system (Base Station) is equipped with a battery that can provide power for up to 15 minutes during short power outages, and it also has cellular connectivity support to handle internet outages. As someone who wants to ensure stability, I also purchased the APC BE600M1 and BE425M Battery Backup uninterruptible power supply units to support not only the router and alarm system but also other electronic devices I have.

After completing all the installations, I now have a smart alarm system provided by Ring mobile application, which allows me to monitor and receive notifications about activities happening in and around my home 24/7. To expand the monitoring beyond just myself, I have also started utilizing Ring’s Protect Pro 24/7 professional monitoring service.

Finally, I completed the setup with Alexa, Echo Show 10, an AI-supported voice assistant that can integrate with the Ring alarm system, transmit alarms generated by the system verbally, allow live viewing of cameras, make calls to the person ringing the doorbell, and most importantly, customize alarms according to your needs with Routines.

In conclusion, the Ring alarm system, along with all its components, cost us approximately $2000. While it cannot replace our beloved and loyal companion, North, in terms of being our family’s guardian, we believe the Ring alarm system provides a great opportunity for him to enjoy early retirement and long naps. 🙂

I assume this article will be useful for those who want to use a DIY alarm system like me. Hope to see you in the following articles.

6

How I Hacked my Smart Grill ?

The Russian Military Intelligence Department (GRU), targeting Mert SARICA, a high-ranking bureaucrat, assigned the notorious APT 28 hacker group, also known as Unit 26165, which has been operating since 2004, to infiltrate his home’s wireless network and retrieve Top Secret classified documents.

On April 10th, APT 28 group members entered the country with diplomatic passports. After placing their equipment, including a computer and various hardware for wireless network hacking, in the trunk of a rented Citroen C3, they set off towards the address of the house.

As they approached the house, they resorted to the Wardriving method to identify the SSID (Service Set Identifier) of the target wireless network. After passing by the house twice, they determined that the network with the highest signal strength belonged to Hack4Career.

To avoid arousing suspicion, the APT 28 group parked their cars at the beginning of the closest street to the house. They then turned their attention to trying to crack the 15-character alphanumeric password, which included special characters, protecting the wireless network using the WPA3 protocol.

After extensive efforts, the group concluded that they couldn’t break the password and decided to embark on reconnaissance around the house.

In today’s world, the Internet of Things (IoT) is prevalent in various areas, from kitchen appliances and cars to thermostats and smart home systems. Due to the vulnerabilities of these devices, the group searched for smart devices that could be easily exploited.

According to statistics, as of the year 2023, there are 8 billion people living on our planet, while the number of IoT devices has reached twice the human population, reaching 16 billion.

After a brief reconnaissance mission, the APT 28 group’s attention was drawn to the Wi-Fi and Bluetooth-enabled smart pellet grill on the terrace, which was plugged into an outlet. They remotely took a photo of the brand and model and decided to purchase one for vulnerability research.

After 8 hours of investigation, they managed to obtain the name and password of the associated wireless network remotely by sending a packet/command via Bluetooth to the grill, requiring only that it be plugged in.

With this information in hand, they wasted no time and quickly got into their cars, heading towards Mert SARICA’s house. After parking their vehicles in the same spot at the beginning of the street, they used a Parani-UD100 device connected to their computer’s USB port to send a packet/command to the smart grill via Bluetooth from a distance of 984 feet.

Upon receiving a response from the smart grill, they successfully obtained the Hack4Career wireless network name and its 15-character password. They then successfully connected to the wireless network, completing the first step of their operation.

The fictional story I described above may seem utopian to many for two reasons.

First, you might think that Russian hackers entering a country with ease and then attempting to infiltrate a wireless network is something you’d only encounter in movie scripts. For those who think this way, I recommend taking a look at this news article from 2018. I’m sure that some of the photos in the article will look familiar to you. 🙂

Second, you may believe that hacking a smart grill and infiltrating a home network wouldn’t be as easy in practice and would only happen in an episode of Mr. Robot. For those who think this way, I leave you with the following story where the main character and everything described are real. 🙂

With the approaching barbecue season, in April 2023, I started looking for a grill to use on my terrace. While considering whether to get a practical gas grill or deal with charcoal every time, I decided to purchase a smart, WiFi pellet grill even though I’ve been saying “Smart device means spy device” for years.

After the grill reached my hands, I downloaded and installed the mobile app mentioned in the grill’s user manual. After running the app, I followed the instructions and first added the grill via Bluetooth, then included it in my home WiFi network by entering the password.

After I cooked our first meal on the grill and enjoyed it, I decided to conduct a security research just like other IoT devices that I purchased before.

As a first step, I downloaded the mobile application from ApkPure and started examining the source code with the jadx tool. Since no obfuscation method was used during the compilation phase, I was able to easily examine the source code.

After navigating through the codes for a while, I noticed the init.js file that was passed as a parameter to the getFileContent() function. When I examined the getFileContent() function, I saw that it read the init.js file located in the operating system of the grill using the Fs.Get method.

Of course, when I saw this, lightning bolts struck in my mind and I had only one question in my mind: “If I send a file name other than init.js to the grill via Bluetooth, would I be able to see the content of that file in the response?

To find the answer to this question, just like in my blog post titled “Run Mert Run” I followed the steps in a response to a message from someone who was experiencing Bluetooth packet-related issues on Samsung’s support page to examine the Bluetooth communication between the mobile application and the grill.

When I started analyzing the btsnoop_hci.log file with Wireshark, I saw that at one point in the communication, the mobile application wrote the value 00000055 (WRITE REQUEST) to the handle 0x33 of the 5f6d4f53-5f52-5043-5f74-785f63746c5f (CHARACTERISTIC_BROIL_KING_WRITE_DATA_LENGTH) Bluetooth service.

In the next step, I saw that the command {“id”:999,”method”:”FS.Get”,”params”:{“filename”:”init.js”,”offset”: 0 , “len”:20}} was sent in pieces (WRITE REQUEST) to the handle 0x2e of the 5f6d4f53-5f52-5043-5f64-6174615f5f5f (CHARACTERISTIC_BROIL_KING_WRITE_COMMAND) service’s characteristic.

When I decoded the Base64-encoded data in the response (READ RESPONSE) received from the grill, which contained {“id”:999, “src”:”XXX-XXXXXXX”, “result”:{ “data”: “Ly9CS1B2MDQyLjQ1ICAgICAgICA=”, “left”: 35298}}, I found the string //BKPv042.45

When I searched for some keywords that caught my attention in the source code of the mobile application on Google search engine, I learned that the grill has an operating system called Mongoose OS.

After realizing that I had never seen or heard of this operating system before, I decided to take a look at the user guide on their website. When I visited the Device config page, the conf9.json file among the json files starting with conf caught my attention.

Since I thought this file containing user settings might have some noteworthy information, I created the following 88 characters long request/command to read the conf9.json file over Bluetooth connection using bluetoothctl tool instead of init.js, but I encountered an Invalid Offset error when I sent it to the grill through a Bash script.

{“id”:999,”method”:”FS.Get”,”params”:{“filename”:”conf9.json”,”offset”: 0 , “len”:20}}

After doing some research, I learned that the “invalid offset” error was triggered due to the size of command/payload. Later, I decided to equalize the size of the 85-character init.js request and the above 88-character conf9.json request. After removing 3 space characters, the request took the following form and became 85 characters in length.

{“id”:999,”method”:”FS.Get”,”params”:{“filename”:”conf9.json”,”offset”:0,”len”:20}}

After sending this request to the grill, I saw that I was able to successfully read the first 20 characters of the conf9.json file.

When I continued reading the file by incrementally increasing the optional parameter Offset, I discovered that with the following request, I was able to obtain the wireless network name and password I had entered during the setup of the grill application!

{“id”:999,”method”:”FS.Get”,”params”:{“filename”:”conf9.json”,”offset”:280,”len”:99}}

As a result of my security research, I uncovered this critical vulnerability. By exploiting it, I demonstrated that a malicious person could easily learn the wireless network name and password of this brand and model of grill from a distance of 98 to 984 feet by sending requests. What’s surprising is that for this vulnerability to be exploited, the grill only needed to be plugged in and didn’t even have to be in the “POWER ON” state.

While I may not know the exact number of households affected by this vulnerability, statistics show that as of the beginning of 2021, there were approximately 100 million households using grills in the United States. Considering that one in three households used more than one grill, it’s safe to say that the proliferation of such smart grills (IoT devices) poses significant security risks.

After discovering this significant vulnerability, instead of parting ways with my smart grill, I decided to move it to the Wi-Fi Guest Network along with my other IoT devices, ensuring that it wouldn’t spoil my appetite. Now I can continue to enjoy delicious meals without any worries. 🙂

As a precaution, I recommend not leaving your smart grill plugged in when you’re not using it until the manufacturer addresses this vulnerability.

Hope to see you in the following articles.

Note: I sent an email to the grill manufacturer about this vulnerability on April 1st. Unfortunately, I have not received a response yet.

7

How Do They Hack Turkish e-Government Accounts?

[powerkit_toc title=”Table of Contents” depth=”2″ min_count=”4″ min_characters=”1000″]

Introduction

On October 25, 2023, at 11:46, I learned that my Turkish e-Government Gateway account had been temporarily disabled for one hour due to multiple unsuccessful login attempts with the wrong password through the e-Government application and warnings sent to my email address.

Although the likelihood of a threat actor guessing my long and complex password was low, and I also use a two-step authentication method on the e-Government Gateway, as a security researcher, I decided to investigate how my account was temporarily disabled.

Having started my professional career in 2005 as an Ethical Hacker and Penetration Tester, conducting security tests for web applications for years, I began examining the e-Government Gateway login page as if I were a threat actor attempting to hack my account.

For a threat actor to access my account, they needed to have my TCKN (Turkish ID) information. Given that, as seen in my article “Was Turkey’s e-Government Hacked?“, many of our details circulate in the underground, obtained from various sources over the years, I didn’t need to dwell on where and how they found my TCKN information.

Could a threat actor with my TCKN information eventually determine my password through brute force attack and reach the two-step authentication stage? Did e-Government Gateway not have a series of security measures to prevent this attack technique, such as CAPTCHA or IP address blocking? To find answers to these questions, I attempted to log into my e-Government account with incorrect passwords. After two unsuccessful attempts, a CAPTCHA control appeared, as expected in a secure web application, and my account was not disabled. So, how did the attacker manage to temporarily disable my account?

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a type of security measure known as challenge-response authentication. CAPTCHA helps protect you from spam and password decryption by asking you to complete a simple test that proves you are human and not a computer trying to break into a password protected account. (Source: Google)

In an attempt to find an answer to this question, when I started making unsuccessful login attempts to my e-Government account from different IP addresses using a VPN, I observed that my account was temporarily disabled for one hour on the 5th attempt. This once again demonstrated a security control that should exist in a secure web application. It effectively prevents the detection of the password through a brute force attack, which might target the account through possibly hundreds or thousands of bots.

Who is the Target?

In recent months, due to my articles on WhatsApp Scammers and Cryptocurrency Scammers, I’ve been able to thwart the plans of scammers. In this cyber attack, I set out to determine whether the threat actors had specifically targeted my account or if they had coincidentally come across my account in a password spraying attack targeting broad accounts.

In a password spray attack, the bad guys try the most common passwords across many different accounts and services to gain access to any password protected assets they can find. Usually these span many different organizations and identity providers. For example, an attacker will use a commonly available toolkit like Mailsniper to enumerate all of the users in several organizations and then try “P@$$w0rd” and “Password1” against all of those accounts. (Source: Microsoft)

Image: Arkose Labs

To find an answer to this question, I conducted a Google search to see if there were other individuals like me whose e-Government accounts had been temporarily disabled. Through my search, I discovered that a significant number of people have been subjected to such attacks since 2020.

When I investigated the source of the IP addresses in these screenshots, I found that some of them were originating from a network called Tor, which is frequently used by cybercriminals for anonymous communication.

171.25.193.78 – Tor Exit Node
185.220.100.252 – Tor Exit Node
185.220.101.46 – Tor Exit Node
77.68.20.217 – Tor Exit Node
104.244.73.193 – Tor Exit Node

Considering that this situation has occurred to many individuals over the years, it is highly likely that it was not a targeted attack against me but rather a part of a password spraying attack. To further investigate the IP addresses that played a role in locking my account, I decided to broaden my research.

Technical Investigation

Attackers’ IP Addresses

When I accessed my e-Government account immediately after it was reopened, and began examining the History page, I quickly noticed that the unsuccessful login attempts were made using IPv6 addresses instead of IPv4.

IP Addresses Lookup

When I checked the WHOIS information of the IPv6 addresses through IPinfo, I found that all of them belonged to cloud service providers named Vultr and Linode.

2001:19f0:6001:20f:9a7f:d317:c645:37eb – Vultr
2001:19f0:6801:8dd:daab:291b:a4d6:dfc7 – Vultr
2001:19f0:8001:e5d:8404:4a87:e3cf:58cb – Vultr
2600:3c03:e000:b44:ec11:517f:1d99:7cbc – Linode
2001:19f0:8001:13a:f42d:4d56:deb9:c465 – Vultr
2600:3c06:e001:7ab:c6a6:9c89:949f:96f9 – Linode

Ports

When I scanned the IPv6 addresses for their most well-known open ports using the nmap tool, I found that only the 22nd port, associated with the SSH service, was open.

Journey from IPv6 to IPv4

When I used the nmap tool again (nmap -iL hosts.txt -6 -sV –script ssh-hostkey.nse –script-args ssh_hostkey=all) to search for the fingerprints of SSH services and queried Shodan, I easily found the IPv4 addresses of these servers to gather more information about them.

2001:19f0:6001:20f:9a7f:d317:c645:37eb
ssh-hostkey: b9:cb:48:39:52:d9:f2:83:d8:ba:12:e9:9f:1d:55:21

2001:19f0:6801:8dd:daab:291b:a4d6:dfc7
ssh-hostkey: 41:4f:6f:b8:3e:96:c0:6e:28:d8:7e:f0:81:e9:10:99

2001:19f0:8001:e5d:8404:4a87:e3cf:58cb
ssh-hostkey: 20:c1:8b:f9:06:9a:bc:e0:89:73:02:07:b3:71:b0:0b

2600:3c03:e000:b44:ec11:517f:1d99:7cbc
ssh-hostkey: 1b:c3:d3:43:b5:b1:9a:09:24:18:d3:d8:14:3f:34:fb

2001:19f0:8001:13a:f42d:4d56:deb9:c465
ssh-hostkey: 5d:2b:6d:11:c9:f5:e2:8f:99:bc:2a:30:19:63:90:3c

66.42.105.202 – b9:cb:48:39:52:d9:f2:83:d8:ba:12:e9:9f:1d:55:21
45.32.148.233 – 41:4f:6f:b8:3e:96:c0:6e:28:d8:7e:f0:81:e9:10:99
137.220.33.75 – 20:c1:8b:f9:06:9a:bc:e0:89:73:02:07:b3:71:b0:0b
143.42.185.244 – 1b:c3:d3:43:b5:b1:9a:09:24:18:d3:d8:14:3f:34:fb
104.207.158.196 – 5d:2b:6d:11:c9:f5:e2:8f:99:bc:2a:30:19:63:90:3c

Threat Research

The information gathered from the obtained IPv4 and IPv6 addresses, when searched on various platforms such as VirusTotal, SOCRadar XTI, AlienVault OTX, resulted in findings only on SOCRadar XTI.

According to the results, an end user system associated with the server having the IP address 45.32.148.233, used by the attacker, was compromised in May 2023. A malware named Racoon, used for stealing information, operated on this system. In 2022, another end user system associated with the same IP address was infected with another information-stealing malware called RedLine. All the stolen information was later put up for sale on the Russian underground market.

Examining the content of the files obtained by the SOCRadar Dark Web team, it became apparent that there was once a phpMyAdmin, a database management tool, on the server. In light of this information, threat actors might have had unauthorized access to this server for a long time and could have been using it in their attacks.

New Ports

When examining the IPv4 addresses on the search engine named Censys and scanning the ports using the nmap tool, I discovered that, unlike IPv6 scans, each server had nearly 2000 new ports, excluding port 22.

Having nearly 2000 open ports on a server is not a typical configuration, so I decided to inspect these ports.

Usually, encountering such a large number of open ports on a system is reminiscent of an open proxy server. Therefore, my initial suspicion was towards a proxy server. As I continued to examine the information about the IPv4 addresses used by the attacker on Censys, a line in the records related to the IPv4 address 45.32.148.233 (Proxy-Connection: close) immediately caught my attention, raising a new question in my mind. Could these be similar to the open proxy servers that were frequently encountered on the Internet in the early 2000s?

Anonymous proxy: This server reveals its identity as a proxy server but does not disclose the originating IP address of the client. Although this type of server can be discovered easily, it can be beneficial for some users as it hides the originating IP address. (Source: Wikipedia)

To find an answer to this question, I used the cURL tool to make a request to the https://ifconfig.me/all webpage, specifying the IPv4 address 45.32.148.233 and a random port (22939) listed as a proxy server on Censys. Upon making the request, I observed that the request from the proxy server to this webpage was sent using the IPv6 address 2001:19f0:6801:8dd:4995:dc24:1643:54d5. In short, the answer to the question was “Yes.” These were indeed open proxy servers, allowing me to make web requests to target web pages while hiding my own IPv4 address.

However, the proxy server with the IPv6 address 2001:19f0:6801:8dd:4995:dc24:1643:54d5, as shown in the screenshot above, was not one of those involved in the temporary closure of my e-Government account (2001:19f0:6801:8dd:daab:291b:a4d6:dfc7). To determine the relationship between this proxy server and the mentioned IPv6, I prepared a simple script that connects to the open 2000 ports of the IPv4 address 45.32.148.233 and sends a request to the https://ifconfig.me/ip webpage.

#!/bin/sh
for ((i=22000; i=24000; i++))
do
curl -x 45.32.148.233:$i -L -s -k https://ifconfig.me/ip >> ip_check_45.32.148.233.txt
echo '' >> ip_check_45.32.148.233.txt
sleep 1
done

In each response from the webpage, a different IPv6 address was present. According to this result, malicious individuals could perform a brute-force attack on a webpage using 2000 different IPv6 addresses. After the script ran for a while, I was able to identify the IPv6 address that was responsible for the attack on my e-Government account among these addresses.

Why are they using an IPv6 address?

While conducting all these investigations, I began to ponder why the attacker chose to use IPv6 addresses. After some time, I realized that the devil is in the details.

When you rent a server from service providers like DigitalOcean, Linode, Vultr, they allocate one IPv4 address to you, and you use this IP address for all your internet-related activities on that server.

Cybercriminals often rent servers from such service providers to carry out or camouflage their cyber attacks. Over time, the IPv4 addresses of servers used in their cyber attacks get detected, blocked, and added to global blacklists by security technologies. As the attempted attacks get thwarted, and their IPv4 addresses become unusable, and with accounts and servers rapidly getting shut down due to complaint notifications, they find themselves in the quest for new servers.

For instance, if we assume that they perform these cyber attacks from 100 servers, paying $6 per server, they would incur a total cost of $600. The longer they can carry out these attacks without being detected, the more cost-effective it becomes for them. Otherwise, as they get blacklisted, they repeatedly have to bear this cost as their accounts and servers are shut down.

Now, how does using IPv6 instead of IPv4 change the game? These service providers typically grant their customers using rented servers only one IPv4 address. However, when it comes to IPv6, they can produce and use thousands of them. This allows malicious actors to conduct their attacks using over a thousand IPv6 addresses by paying just $6. As they get blacklisted, they can generate and use new IPv6 addresses on the servers they employ, effectively avoiding significant consequences until complaints reach the service provider.

So, did the e-Government application, with its security controls and measures, truly make it difficult for attackers to use IPv4 instead of IPv6? Or did attackers prefer IPv6 to secure their operations? To investigate this, after my e-Government account was temporarily closed due to five incorrect login attempts, I tried to log in with the correct password to my wife’s account immediately afterward and successfully gained access.

According to this result, if, in the application or at the network level, an IPv4 account is not blacklisted or blocked when a brute-force attack is attempted on more than two accounts, attackers could carry out these attacks with a single IPv4 address on multiple accounts for an extended period. Otherwise, using IPv6 addresses becomes their only option.

Since I didn’t have the chance to test and confirm this on more than two e-Government accounts, and considering that attackers conducted these attacks through IPv6 systems, it is highly likely that e-Government security measures were effective against the IPv4 addresses used by attackers.

How Can I Protect My e-Government Account?

In conclusion, we can see that cyber attackers, over the years, have resorted to various methods to hack Turkish e-Government accounts, utilizing compromised systems forming bot networks, occasionally using their systems, employing proxy server software to hide their tracks and avoid detection, and purchasing servers from service providers with IPv6 support. In short, they have explored every avenue.

So how can you protect yourself from the attacks discussed in this article? The most crucial step you need to take is to use one of the two-factor authentication methods when logging into your e-Government account.

On this occasion, I wish you a happy new year and hope that 2024 brings health, happiness, and success to you and all your loved ones.

Hope to see you in the following articles.