Now starting @juanandres_gs at @ekoparty on cyber espionage in #latam. Studying espionage is very interesting: involves knowing the context, the culture, the economic factors. But, how much there really is? #ekoparty
We know hundreds of groups. Not all state-sponsored. The reality is that is not much on how much we know, but how much are we actually looking for. In Latin America we are not looking hard enough. We cannot longer say nothing is happening in #latam. #ekoparty
We are no looking hard enough in many regions. And there’s activity originating in some regions that are being ignored.
The money spent in one threat intelligence subscription in a first world country can create and fund a SOC in our #latam countries easily. There’s so much disparity and needs in every region, which sadly are not contemplated in some industries.
There’s a certain industry limitation. Like number of people doing threat intelligence, the attention of these people and teams, the motivation behind. If everyone was looking at the situation in Ukraine, who was tracking what North Korea, China and other countries were doing?
Crazy but true: no one is coming to rescue us (#latam).
Shoutout to @R3Dmx investigating the activities of #NSO and Pegasus in such a hostile environment and playing as locals.
We think countries in #latam do not have good economies; however they had purchasing power and resources to buy tools from hacking team, NSO and others. #ekoparty#EKO2022
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Apple airtags are small, low cost, and have three different technologies that allow for very precise location tracking. #EKO2022
Unfortunately #airtags are used for tracking people without their consent; mostly to track women. They can fit in many places, specially fitting well under vehicles.
The installation was very smooth, and the end result is neat. Don't try to run this with 4GB of memory, because is not gonna work. T-Pot requires at least 8GB (note to self: rtfm).
The number of attacks received always impresses me. Less than 45 minutes minutes after installation and the numbers are staggering.
👉🏿5,030 Dionaea attacks
👉🏿1,375 Cowrie attacks
How does the traffic of Flexnet looks like? The sample shared below is available on @apklabio along with a nice pcap capture 👉🏿 apklab.io/apk.html?hash=…
From Wireshark Protocol Hierarchy Statistics we can see that most of the traffic is TCP on IPv4. Few UDP. A nice amount of packets.
Next step for me is always look at the conversations. I want to get a feeling of how many things do we need to check and verify. In this case there are only 12 IPs to check (1 IP is local). Easy to discard a few things here knowing this is an Android phone.
Now on the Green Room at #VB2019, @eldracote@anshirokova will present "Geost botnet. The discovery story of a new Android banking trojan from an OpSec error", a work also done with @MaryJo_E !
The Geost botnet was found by investigating the traffic of a different botnet: #htbot also known as proxyback. This htbot botnet offers a proxy service for users in the underground.
The Geost operators were using htbot to access the command and control servers from Geost (thinking they were hiding themselves).