How Hard Would It Really Be to Hack the FBI?

THIS ARTICLE IS FOR EDUCATIONAL PURPOSES ONLY AND INTENDS NO HARM OR CRITICISM TO THE BUREAU OR ANY INDIVIDUAL. ALL OF THE CODE AND CONTEXT BELOW IS INTENDED TO EDUCATE AND NOT HARM ANY ORGANIZATION OR INDIVIDUAL AND IS NO THREAT TO ANY ORGANIZATION. RUN AND TEST THE CODE IN THIS ARTICLE AT YOUR OWN RISK. ALL RIGHTS RESERVED.

People think cybersecurity is all about computers. It isn't. Computers don't make mistakes. People do. Every firewall, every encrypted database, every biometric scanner exists because someone believes it will stop the next big attack. But security has never been about building an impenetrable wall. It's about making the cost of breaking through so high that people rarely try. The strongest government organizations in the world don't survive because they're impossible to compromise; they survive because they've spent decades assuming someone will try. That's the difference between an ordinary network and one entrusted with protecting national security and the data of billions of civilians.

The most sophisticated cyber operations aren't built on brilliance. They're built on patience. On observation. On understanding that every system, no matter how advanced, is ultimately designed by humans. And humans have always been the weakest link.

Now comes the real question: how do we actually hack one of the most secure organizations in the entire world, and how hard is it?

Destroy All Backups

The FBI has all of its backup data stored in its HVAC Systems. An HVAC system does not hold items the way a storage unit does; instead, it stores and circulates thermal energy, air, fluids (freon and preon), and electrical energy. Even a change in temperature in the room where the HVAC systems are stored can damage the data they carry. Hypothetically, even a small device like the Raspberry Pi can be used to turn up the temperature in the storage facility high enough to render the backups unusable.

With the tapes unusable, you can then destroy the data on the FBI servers without being traced. As you know by now (hopefully), deleting all the files on the servers will not permanently remove the data. Deleting the data isn't possible, and trying anything else is useless. In this scenario, the best choice you can have is to encrypt the data with AES instead. In this way, the data will still be there but indecipherable to the FBI.

Using Chimera as an Example

Recently, a new type of ransomware called Chimera was found in Germany. It has been used to attack businesses in Germany, rather than consumers, as much of the previous ransomware targeted. Since most ransomware works similarly, let's use it as a model for how you can "destroy" or render useless data on the FBI's hard drives.

In this analysis, I will summarise how Chimera works, leaving out some steps for the sake of brevity. If you would like a copy of Chimera to conduct your own detailed analysis, I have attached the link here (Credits to CYBER WEAPONS LAB).

Step 1: Delivering the Malware

Like much of the ransomware that has appeared in recent years, Chimera is delivered by email, likely with a social engineering component to get someone to click on a link or a file. It is written in .NET.

In this first stage, Chimera initially delivers an executable stub, whose job is to call, decrypt, and decode the second payload to the victim.

Step 2: The AES Algorithm

The second stage is the encrypted and encoded payload that contains a method that is clearly an AES encryption algorithm. We can use this or something very similar to encrypt the FBI's data. Likely, that would have it run in multiple threads to speed up the process. Considering the fact that the FBI has petabytes of data, encrypting all of it will take some time.

Step 3: Mapping to Memory

In the next stage, Chimera then manually maps its processes to memory. This is very likely to bypass ASLR and DEP protections that are built into Windows and other operating systems. These protections randomise where a process will likely be in memory, making it more difficult to implement a buffer overflow as the malware cannot predict the location of the pointer. By manually mapping the process to memory, it makes it more likely that the malware will function as expected.

Step 4: Find a 32-Bit Process to Host

Next, Chimera goes through every window process, looking for a 32-bit process that can host its payload and then open it.

Step 5: Finding the Local IP

Next, this ransomware goes out and finds the pubic IP of the machine it has infected by using whatsmyipaddress.com. It then stores that value in a variable.

Step 6: Call Back to Command and Control Servers

Once Chimera has the IP of the infected host, it then calls out to its command and control servers. In this case, those servers are at 95.168.168 and 158.222.211.81.

Chimera uses Bitmessage to communicate via a P2P protocol on ports 8844 and 8080. Bitmessage is a secure, encrypted P2P messaging system that enables a single person to send out messages to one or many recipients. You can see in the screenshot below that Chimera calls the Bitmessage client PyBitmessage.

Step 7: Browse and Find Hard Drives, Then Files

Next, the malware must find the hard drives where the data is stored. It needs to browse each of the logical drives and then store these locations in a variable for later use in the encryption process.

Step 8: Get Random Key

Now taht CHimera has successfully taken over a 32-bit process, mapped itself to memory to avoid ASLR, and enumerated the hard drives, it needs to call back to its command and control server to get a random key with which to encrypt the files.

Once the random key has been obtained from the command and control server, Chimera calls the function from Step 2 above, the AES encryption algorithm and begins to encrypt critical files. Before it starts encryption, look for the following file types:

.jpg, .jpeg, .xml, .xsl, .wps, .cmf, .vbs, .accdb, .ini, .cdr, .svg, .conf, .config, .wb2, .msg, .azw, .azw1, .azw3, .azw4, .lit, .apnx, .mobi, .p12, .p7b, .p7c, .pfx, .pem, .cer, .key, .der, .mdb, .htm, .html, .class, .java, .asp, .aspx, .cgi, .php, .jsp, .bak, .dat, .pst,

.eml, .xps, .sqllite, .sql, .jar, .wpd, .crt, .csv, .prf, .cnf, .indd, .number, .pages, .x3f, .srw, .pef, .raf, .rf, .nrw, .nef, .mrw, .mef, .kdc, .dcr, .crw, .eip, .fff, .iiq, .k25, .crwl, .bay, .sr2, .ari, .srf, .arw, .cr2, .raw, .rwl, .rw2, .r3d, .3fr, .eps, .pdd, .dng, .dxf, .dwg,

.psd, .png, .jpe, .bmp, .gif, .tiff, .gfx, .jge, .tga, .jfif, .emf, .3dm, .3ds, .max, .obj, .a2c, .dds, .pspimage, .yuv, .3g2, .3gp, .asf, .asx, .mpg, .mpeg, .avi, .mov, .flv, .wma, .wmv, .ogg, .swf, .ptx, .ape, .aif, .av, .ram, .m3u, .movie, .mp1, .mp2, .mp3, .mp4,

.mp4v, .mpa, .mpe, .mpv2, .rpf, .vlc, .m4a, .aac, .aa3, .amr, .mkv, .dvd, .mts, .vob, .3ga, .m4v, .srt, .aepx, .camproj, .dash, .zip, .rar, .gzip, ., mdk, .mdf, .iso, .bin, .cue, .dbf, .erf, .dmg, .toast, .vcd, .ccd, .disc, .nrg, .nri, .cdi

These file types are likely critical to the business operation. These are graphics files, spreadsheets, database files, backup files, email files, Java files, audio files, movie files, and encyrprion keys. Wihthout them, the business is crippled.

Final Step: Ransom Request

Finally, CHimera makes a ransom request to the business owner. Noe that the browser and its associated files are exempt from the encryption to enavle the browser request and recive the payment of the ransom.

That will be all for today! Keep coming back my fellow hackers.

Thank you for shopping with this Substack. Hack the Gibson…and remember…hugs are worth more than handshakes.