OffByNone slid back in their leather swivel chair and wiped a bead of sweat off their face. Ugh, that was painful. But let's see who has you in their back pocket, Taiwan... As soon as the cursor hovered over the newly created blackmail folder, an email notification popped up under the mouse, redirecting OffByNone to Outlook. Nonono— agh! What is this??
OffByNone looked at the email in confusion. Not only had this sender known about Dragon Scythe's campaign against the Taiwanese government, but this "Elder" had somehow managed to get a hold of their personal email as well. And there was a Discord link as well. discord.gg/R7aQXMt ...Discord? Well, OffByNone had a Discord, but had never seen anyone use it for any kind of underground operation. A prank? But still, how would "Elder" know about the mission? Redux pulling a prank? But Redux didn't have access to this email address. The VPN was active, so what harm could it really do? The next moment, the left button on the mouse depressed and data began to travel throughout the ever-expansive labyrinth of networking equipment, streaming into the cramped and stuffy bedroom. OffByNone had entered Th3_Calm.
The day had been rather long - which was mostly accounted to the fact that her day had started around 4 o'clock in the morning. That was early, even for herself. And it had taken a toll on her, dragging on until the evening. At least she finally had some free time. And it seemed like a good enough excuse to fiddle around with a few things. The door fell shut behind her, she flinged her bag and jacket in the direction where they belonged and mad her way to her office. Workshop. A little bit of both. The small room was filled with two desks, one holding her set up with monitors, computers and the required switches to just change to which system the peripherical devices would send information. The other held a multitude of devices and parts and tools, a few mats and a general nice set of chaos. She knew how things were.. stapled and usually when she did not have a sensible project that was enough.
Plopping into her chair she turned on the laptop and watched the boot information flickering over her screen. She entered her credentials, waited for the VPN to turn on, checked a few things and opened up her browser and email. The... usual. Originally she had planned to read up on a few things, but scrolling through her email one caught her eye. Th3 Calm, sent from The Elder. She had never heard anything of that kind - but you get used to obscure mails so before deleting it she at least gave it a read.
Th3 Calm from The Elder
Good morning P0isonApp1e,
neat trick replaying a static loop into the camera system. They did not like to find someone had stolen a good bit of money and left a graffiti right were the camera pointed. You heard they were suing against the camera's manufacturers? They somehow got a note informing them it was a known vulnerability. Clever. Would you like to know some more, clever people? There is a little group of them, you should join. Hope to see you there.
https://discord.gg/R7aQXMt
For a while she just stared at it. She checked the time. Even the right greeting for the timezone. Crap. What was this about? And Discord?! The got damn game chat? She had never heard of anyone using Discord in such a setting - and there were rather absurd things she heard of. Capture the flag on remote computers. She grinned when her mind swung back to that, then starred at it again. In the end she shrugged. It sounded interesting enough. And either damage was already done - as the mail managed things not anyone knew of - or it was safe enough to follow the link without fearing damage. She copied the link, made sure to have a number of intermediate hops, opened the site, created an account and just a moment later P0isonApp1e had joined the channel to see where things were going. Silently. On the side she also finally opened the website she had actually planned to visit, to catch up on a few things that had happened in the last hours, maybe days.
Erik stretched his arms and yawned. "Gottdamn im tired as hell... Work was really annoying today, we had a real big shipment of televisions that came in and we were a couple of men short so ofcourse to boss decides to let the IT guy help out with lifting instead of choosing someone from the storage department. I dont even know why he would choose me, im super fucking scrawny." Erik said to Razor as they loaded up another round. "Yea I feel ya. You should just call in sick, its not like you need the money." he said through the slack voice chat. Just as Erik was about to say something he got a notification from the IRC chat.
Sacred Today at 6:28 PM Yo! Lancer you doing something rn?
Lancer Today at 6:28 PM Not really... Im just playing tic tac toe with Razor. Whaddup?
Razor Today at 6:29 PM I can let him go if its anything important
Sacred Today at 6:30 PM Aight good. I got a target for you and we are getting paid for hitting it we just need to find a specific file.
Lancer Today at 6:31 PM Sure send me the details and ill take a look at it.
Sacred Today at 6:30 PM Ill send em over in a minute or two the wife just made some food and im starving
Lancer Today at 6:31 PM Aight man Enjoy ill see you later
Sacred was a good guy. He was the one who found contracts for them. "Fuck it, im gonna be right back I need to check some shit real quick" he said as he disconnected from the Slack chat. As he turned his attention towards the Virtual machine he had running where the IRC chat was taking place, he loaded up his Gmail which maybe was not the ideal mail hoster but it did the job and he was not using it for anything that needed hiding. As he was scrolling through the normal Spam emails that come when you sign up on sketchy forums something caught his eye. An email with the caption
"Now aint this intresting" he thought to himself. Discord? Isnt that the gaming voice chat thing that is essentially a ripoff Slack. Is that really a safe program to run something like a hackers group out of?. "Fuck it" he thought to himself as he logged on from one of his alternate VMs to follow the link. As he got forwarded through to the server he got treated to two chat rooms. One seemed to be the lobby called #Verification and the other was completely empty #observers. "This is most definetly some kind of joke" he thought to himself as he let it go and started surfing the web and waiting for Sacred to return
Undername: TonyBlake101 Password: **** Logging in to TonyBlake Bank Account Loading... Bank Accout: $5,000 Million *Click* Are you sure you want to deposit to Scarlet Eye Bank Account? Yes No Bank Account: $5,000 Thousands Bank Account: $5,000 Hundreds Bank Account: $4,000 Bank Account: $3,000 Bank Account: $2,000 Bank Account: $1,000 Bank Account: $0 Done
"Hehehe, Take That asshole" Lucy say as she lean back from her chair to stretch while listening to Fuck You by Lily Allen. After months of Tony being a totally dick to her and every girl in college, it time for him to taste his own medicine. Lucy log in to her Bank account to see that she have ten billion dollars now. "Thank you Tony~" Lucy say "Thank you for being a scumbag and being rich~ Oh! sorry used to be rich~"
Lucy look at her clock to see it 10:49 pm, her roommate is about home soon from partying with her friends. Before Lucy go to bed, she check her Gmail if she had mail from her college for classes or her parents but to her surprise, she see a email from The Elder "What the, The Elder? Did the DnD club accidentally send me their email again?" When Lucy click the email, it wasn't from the DnD club or any club that matter...It from somebody.
Th3 Calm from The Elder
Hello Scarlet Eye,
I see that you are little trickster that love to cause some mischief, taking rich people money for being horrible people and just sit back, relax and watch their life burn and fall apart....Now that I can watch anyday.
But you do like stealing from rich people? Do you want to steal something more? Like celebrities, famous businessmen or what about the government? they have so much money for themselves but they won't give it to the poor. you want sweet justice, you want to bring them down and bring them down hard, do you?
Well, now you can. All you have to do is to join me and group of people and we will have some fun mischief
Hope to see you there.
https://discord.gg/R7aQXMt
Lucy hesitate little bit, this has to be a prank or a undercover cop. But then again, she would love how this will play out "Eh, why not." Lucy click the link.
How is the blackmail fairing you? In these uncertain times, I'm sure The Conservatives aren't very keen on letting those correspondences get out. Though, blackmail isn't how you usually operate. Did something change in pace? Speaking of, I bet you could use a change of pace too; having a following of angst-ridden youths craving desperately to be the next high profile cyber-criminals must get boring. How about trying somewhere with a higher skill cap than you're used to? I hope to see you there.
"Cassie" had taken a step away from their engagements for a little while. Between the workload of government secrets, and now this Elder fellow, they were far too busy than they ever typically enjoyed. "Cassie" wasn't one to let work pile up, typically. Of course, blackmail was a tricky business sometimes, so the job itself had taken a while longer than expected, but with more things coming in, their 1am workload had been disrupted. In the end, there was only one course of action: take a break and figure out how to retake the reigns.
Two bright monitors and a Gmail window illuminated a somewhat dark bedroom. In it, Freischutz sat, playing with a loud, and attention starved cat. Their second monitor was open to a Discord channel, though not for "Th3_Calm", or whatever it was called. "Cassie" hadn't taken the initiative to join it yet. The channel open was The Samaritans own Discord chat. They never discussed anything sensitive, for obvious reasons, but it helped to keep in touch, even if it was, presently, left in a dim silence. Most people had gone to sleep already, anticipating another day of work in the morning, and trusting their own Free Shooter to complete a satisfactory amount of the task. Either that, or they were off playing games.
"I should really... leave this to tomorrow, shouldn't I?" they asked aloud, keeping their voice at something of a quiet tone. Isabella didn't make much of a reaction, not that the cat could answer in the first place, let alone understand the context behind the question. She merely continued to roll around in her owners lap, disrupting the workload even further. "Cassie" looked back to the monitor, half attempting to evaluate the email. It crossed their mind that, if they were reaching out over Gmail and not one of the other email accounts they had, this Elder must not have cared all that much about security - that, or they didn't need to worry about it. In some capacity, it was highly suspicious. There was some hesitation, but in the end "Cassie" still clicked the invite link attached, and watched as the Discord app to their left popped up with the server information.
Th3_Calm. Four online, ten members in total.
"Retaking the reigns" was going to be hard, Freischutz thought, and sighed. "But what if there's something interesting? It can't hurt, can it?" they looked down at their cat, who stared back with vague interest that tapered off at around about "Tickle my ears more please". "It better not hurt..." they whispered once more, barely hesitating despite the words spoken, and clicked the join button.
T.R.Y.H.A.R.D.E.R. This password Freischutz had entered into the chat window after solving the final puzzle, sending the server's helpbot, The Oracle ReplAI, into a frenzy.
PASSWORD ACCEPTED. FORWARDING DATA TO THE ELDER. PLEASE STAND BY; YOU WILL BE ALERTED AUTOMATICALLY.
Moments later, The Oracle said something new, but the tone seemed strange. Almost... human.
Hello children.
This seemed to be The Elder, creator of Th3_Storm, present in real time. Sure, it was a bit fun to solve his puzzles, but was there really any more to it? And still then, how did he get the personal information of each of the five invitees?
All of you have the ability to target particular aspects of various flawed industries. I believe we can reach an agreement to take advantage of each one of those skills.
Naturally, the unlikely group inquired regarding payment.
Of course. I can provide something even more valuable to you than money. How does a collection of undiscovered 0-days sound to you? Thousands upon thousands of vulnerable systems in the palms of your hands. As a gesture of goodwill, I will provide 0-days. You prove that you can properly handle them and I will supply more.
This had finally started to get interesting. The right 0-days could be worth millions of dollars, or even better, millions of lives. There was an element of power to hacking, of course, one that allowed each attacker to salivate for a moment too long over the enter key, tempted, just hoping that an unforeseen force would push them over the line, a darkness where they could watch the world burn in peace like a fire on a snowy Christmas day. But the only question remaining was why this Elder character would be willing to entrust that kind of power into the hands of those who he did not know, those who may help or harm the world, or even each other.
I am going to die soon. I could simply mark the world myself, but I would rather it fall into the hands of those who can continue to manipulate it like clay.
ATTACK #1: Biotronik Pacemakers: All versions Vulnerable to RCE upon compromise of management systems Management interface exposed through web portal on port 33892 All vulnerable to SQLi through the use of the following query Admin' OR TRUE; DROP TABLE auth00334; -- Refresh the portal and the following credentials will provide access: Admin:Default00334 ATTACK #2 Insulet Insulin Pumps Vulnerable to DoS-bricks device When exposed to 13.56 MHz waves with the following encoded payload, the device will automatically short due to a hardware malfunction (Data represented in bytecode, little endian): FE01225DC47A9901010000000000000000 ATTACK #3 Medistore Medical Record Storage: Versions 0.1-9.9, except for 8.22 Vulnerable to File System Compromise and Data Exfiltration All medical records can be leaked at will from this ubiquitously implemented software. On port 21, a developer backdoor was left with RW credentials to the records database, left unencrypted. Credentials are daniel:BrokenRecordsAreAsIrritatingAsLongPasswords ATTACK #4 CareWatch Devices All CareWatch devices are vulnerable to wireless port knocking. Probe ports 111, 777, 665, 1922, and 65535 in that order and a shell will open on port 1.
Well, this is an interesting turn of events. After trolling around on the new Discord group, OffByNone had successfully taken advantage of one of the exploits that The Elder released to the group and wrote a script that would automatically infect hospital networks through the Biotronik Pacemaker interface and add them to OBN's personal botnet. Of course, they deserved it. Any organization playing with peoples' lives had no right to take their security lightly, and OBN intended to prove that fact to them. Hovering over Enter, OBN hesitated. Of course, every test had succeeded. Every connection was still established. But what if? OBN fished a stray hair from their keyboard to delay the decision further. Something always goes wrong. What if they find out? But in the midst of the usual self-doubt, OBN's eyes drifted toward the shimmering glow of the pulsating RGB keys. It was now or never. [Enter]
bash: ./reportFsailAll: No such file or directory
A typo. Of course. Always something something Murphy's Law.
[None@lolstationC2 ~]$ ./reportFailAll Generating Payloads. [▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮] Payloads complete Transmitting. . . . . . . . Success ERROR: Could not establish a secure connection to [3/988] hosts Retrying.... Success Changing Settings...
Exploit Complete. [None@lolstationC2 ~]$
OffByNone laughed, fueled by the adrenaline. It would only be hours before news stations across the planet started broadcasting this little endeavor. Nothing lethal, of course, just a fun prank. Not that the hospitals would see it that way; in fact, they might even start panicking when their pacemakers started falsely reporting that every patient's heart had stopped. OffByNone smiled in anticipation of the mayhem that would ensue.
7 o'clock in the morning. The perfect time to start up the machines and get to work - or something like this. At least her rather fucked up real world schedule made it harder to track her on a world map. On the other hand her real world attacks did not, so... whatever.
Attacks. The zero days still laid as an explanation in front of her. She had agreed to leave the insulin pump - bricking hers would either way be a pity - and take up the CareWatch. So first a little searching. On the normal web and Shodan and what else came to her mind. The results were interesting, but not amazing. It really was a 0-day. There was next to nothing about this watches - because they were still brand new. A small startup from the Netherlands. A successfull startup, having already created cooperation with two whole regions and the insurances in both for a bigger roll-out and selling individual devices outside of those zones.
The watch itself was actually interesting enough. A nice, modern website with some beautiful pictures and simple graphics.
We care for you. A nice message to take home. In the end albeit the exploit apparently aimed at the watches, Care Watch was designed as part of a whole network, connecting the watches and aditional sensors to cloud based services for monitoring and alerts to a central where professional aid workers were constanly available for live speech connection or further actions. Her senses tingled. This sounded like an invitation for privacy violations - even if the whole thing was secure and apparently it was not. She scrolled around a little more, apparently the thing connected to firealarms and other interesting devices. Nice idea, but what she was more interested in was the question what the watch itself recorded.
Click.
The side took a moment to load, but she had found the watches features: Alarm button blah blah .. Temperature and heart beat measurement More interesting and not bad. Zero gravity/drop down detection She grinned. It was a nice way to determine a fall. Irregular movement patterns Her eyebrow arched. She read and found it was to find signs of a stroke or similar happening, but the amount of data needed for this made it very interesting. Location tracking Again understandable, but she slowly worried about some of the data. Live speech connection Sweet! That meant the thing had a microphone. That made the hijacking possibility even more interesting.
She read on a little about the possibility to to program individual reminders for medicines, birthdays and so on. Also not bad...
What caught her a little off-guard was the fact that there was not too much written about security. Something about privacy and using private networks at home, which she even believed to be secure, and mobile telephone connections outside.
A little read on also detailed how the watch could also be used by children and people often working alone. That was it.
For a while she just sat in her chair, thinking. This was a real 0-day, the watch was not even widely deployed yet. Most likely whatever she did would not get into the big news. And apart from some security concerns the idea was really nice. The question was what would she do with it? she starred at the Discord chat for a while again. She did not trust that any of these people had enough brain to be trusted with medical information (but to be fair - she did not trust mostly anyone with that). And it would not even be too useful for them... she sighed "Apparently I am going to do some people a favor..."
She stood up again and grabbed her things. The Netherlands were not out of reach, but the test village/city she wanted to go to was still a few hours drive away. But hey! Fries for lunch!
When she parked her car lunch time had swung by (well, for her. the clock said it was 11:30 AM). She trolled through the pitoresque small streets and grabbed fries at a small stand. She then proceeded into the direction of the retirement home she had found to be a cooperation point. It looked nice. And had a little park outside. She unpacked her equipment and started getting to work, at first just scanning her environment. After a while she could make out the watches and followed the probing procedure laid out. It... worked. Surprisingly well even. The shell on port 1 blinked slowly.
> _ She started to look around a little. Linux system, albeit adapted. drwxr--r-- 1 usr home 4096 logs -rw-r--r-- 1 usr home 30405 birthday -rw-r--r-- 1 usr home 30405 alerts Logs. Logs on that device were surely interesting! > cd logs > ls A list of names washed over the screen. She could literally have a look into any log of motion and so on. Not good! The only pertially good thing was, that she could not easily send it out without leaving traces. She could just write herself into the receivers list, though.
She decided against it. She liked the project - so she started with a small one. Just altering an alert on any watch she could scan. And it were... enough to surely create some irritation for the day they would all just chime up. Je verpfleegster is op haar verjaardag. Je zou haar appeltaart moeten brengen! After she had inserted the alert into a good amount of watches she just picked up and stretched. Before returning home she grabbed some sweets from the supermarket and a koffie verkeerd.
The message in the Discord was rather short Port probing worked. The rest was either way most likely not too interesting for them, as long as they were not in the region.
She turned to her computer and flicked it on, navigating to a news site for technology enthusiast. She nearly fell back laughing when she read the news. Every patients heart just stopped. Out of an "error". She giggled. There were a few details about the chaos this had lead to, about doctors calling up on multiple patients before understanding what went wrong. Her site circled about how the hacker could have gotten in and apparent security failures. Listed a few other occasions were e.g. high-ranking persons deactivated communication out of fear. Well... all wonderful. She sighed, shook her head and turned to something else. Today was not so bad of a day.
After she was done, Lucy rise her fist in the air like she doesn't care. Lucy thought this was going to be bored but it turn out to be a lot of fun, she is going to love doing these ATTACK missions.
Lucy little victory dance was cut short when her roommate open the door and drunkenly bargaining in their room, Lucy quickly hide her discord and everything. "Um hey Tina, um how was the party?" Tina, Lucy roommate, try to speak to her but all she was saying was gibberish. "HmmmHmm, I see that you have a great time. How about you go to see" Lucy say as she guide her drunk roommate into bed and Tina just pass out on her bed "I guess she have great night..." Lucy say to herself, she turn and look at her computer and look at the Payload "...I have a great night too." she say as smile grimly.
"Cassie" slid their passport, picture face down, into the automatic security check of Heathrow Airport. They glanced up, looking directly into the glowing cirlce of a camera just off to their right. For a second, there was a pause. A moment of recognition. And then the plexiglass gates in front of them opened. The things had always been finicky, though this time the Gods had given their blessing, and Freischutz hated dealing with them, with every fibre of their being. For that matter, they hated passing through Security in any capacity. At the very least, the UK had them automated for UK citizens. Travelling into Canada didn't have that luxury.
Some week prior, Freischutz had begun their hack. Compared to the others, it almost seemed to them as though it was the easiest of the four, and as they progressed through the various versions of the storage, the only difficulty "Cassie" encountered was persisting through the sheer tedium of the task. The number of different things Freiscutz had to extract data from, had at first astounded, and quickly worn on them despite the numerous hacking opportunities they had been given, until finally it was all complete complete. In truth, the excuse that they had "gotten stuck" that had been given over the Discord was a lie - a convenient explanation for their slow progress.
The Samaritan's didn't deal in medical information. Not for a lack of want, it simply did nothing for their operations. Stealing NHS documents would be a cinch, but it didn't benefit anyone. Chances were, it would only result in further cuts, and more privatisation - the opposite of the mission. And so "Cassie" was forced to look elsewhere for someone to deal with the information. Someone who knew what to do with it, and which companies in the world would be willing to buy it. Though Freischutz had little basis for comparison, it was standard Business theory - the more competition that exists in the market, the more prices will go down for the consumer. If a large number of medical companies vye for the same patients, offering lower and lower rates on medical bills to attract them, everyone would win: Freischutz would get some money; the patients would find cheaper hospital expenses; and the companies in question would gain new customers.
In particular, Freischutz contacted a man in Canada. By the name of Arnold Murphy, over "Cassie's" one week stay in the country, the two worked out and arranged a deal regarding the sale of the information. The Samaritans had worked with him in the past, for various, undefined savouries, and though the meetings took place entirely over online chat, it gave Freischutz a fantastic excuse to visit a country they had always been interested in, under the guise of the school half term. And Toronto was more than a thing to behold, worth every penny spent.
So, passing through the terminal, Freischutz smiled - an innocent, pleased smile. It was nary their job to mess with the medical companies of other countries, but money and the chance to do good were motivation enough in their own right. More money in the pool meant more Samaritan operations, and with all the promised 0-days, "Cassie" would be hard pressed to pass up the opportunities as laid out bare before them. If everything went according to schedule, the next few days would be spent with companies buying out the information. The sources the records had been stolen from would inevitably remain silent, for fear of losing more patients in the ensuing scandal, and the world would keep turning. No exposure, and no trouble.
It was dark and the moon had risen by the time Tagg had finally trudged up the stairs to his apartment. He sighed breathlessly, stuck the key in and pressed the peeling door open enough to slip through- reaching to flick the switch connected to a lamp. While this hadn’t been intended to be a long day, it certainly turned out to be one. The bag of convince store groceries he had been carrying was dropped on top of an empty pizza box as he unceremoniously collapsed at his desk.
As if on cue, the phone in his back pocket vibrated again. “Ugh, can’t they deal with it themselves this time?” He grumbled while tapping the space bar, causing dual monitors and multiple LEDs in the keyboard and computer case to light up the surrounding area in neon colors. So he liked the stereotypical gamer setup- complete with well... Pretzels and Sprite were just so much cleaner than the alternative. But what of it? Except most girls he brought over dismissed it as immature and would then bounce, never to be seen again.
A soft meow sounded behind him, followed by the soft landing of paws beside his setup. The corner of his lip twitched upwards. “Yeah, yeah- I hear you. You wanna catch some Zs, but I’m not about to let some upstart just waltz onto the leaderboard.”
His hood slid off as he leaned forward to enter his password. Clicking followed as Tagg absentmindedly closed out of a VM left open and checked the VPN subscription was still active. Right. It wouldn’t charge renewal for another week. AJinX had rudely reminded him that much. Ugh, way to cut into his spending budget though. He deftly logged into the chat server and opened one of the game files littering the screen as his phone buzzed again, now on the desk.
RexX12: bro wYA !?
Meister: Best hurry, ain’t no time like the present
RexX12: UNBELIEVABLE. That fool was
RexX12: JUST !!!
Tagg: Sup
RexX12: ONFUKNLINE !!!!!!
RexX12: o
Meister: loll
Tagg: >> << >P (>-0)//// online. Better hope the punk is worth my time- unlike last!
His eyes flicked down just as he was about to maximize the game. Hmm. That email notification had been there for a couple days now. One more day of being ignored wouldn’t hurt it, but if it was one of his old buddies trying to get in touch with him again…
Curiosity got the best of him and he typed a quick “brb”, before minimizing the chat room and opening his email. The new email sat atop a slew of unread but marked-as-read ones. His gaze skimmed over the sender with no lack of puzzlement. The Elder? What? This didn’t look like someone familiar- unless judging by the title “Th3 Calm” they had gotten into some nerd trash. His brow furrowed as he clicked the email, and he almost chuckled at how unpredictable this kept getting. That was until he actually read the message contents.
From The Elder _________________________________________________________________________________________________________________________________
Hello Tagg,
Quite the portfolio you’re building. Funny how everyone relies on the IoT without understanding the associated liabilities. Have you found what you like yet? Or are you still bored? How about meeting a little group of people just like you?
Tagg suspiciously scanned the email again. He used discord frequently, but never for anything like this. Never for anything near serious business. Weird... New notifications popped up on his other monitor. RexX12 and Meister were still waiting.
Tagg: Gtg boys, tell ajinx to deal with it! >P<
RexX12: a W DUDE u promised!
RexX12: for real? :(((
Tagg: Something came up, believe in the me that believes in you! (~070)~**
Meister: Thx lol, later
Alright! Now where was he? An wry grin slide lopsidedly into place as Tagg created another Discord account and joined the group. Not too many members, and he wasn’t quite sure what to make of the messages already exchanged. "Hfft. Well, that bot sure has a personality if I've ever seen one." Despite scrolling back a little ways, he was still unsure of the context… Leaning back in his chair, he figured he'd just check it again tomorrow. For now, he would go to sleep. "Maybe, just maybe..." this would be his big break.
TEH ELD3333333333R WILL BEBEBEBEBEBEBEBEBEBEBEBEBEBEBEBE HERE SHOOORRRRRRRRRRRRRRTLY.
Finally, the group had unlocked the next set of 0-days. After discovering a public GitHub repository owned by The Elder himself, their final task was about to be delivered. Now they just had to wait for The Elder to arrive and...
Just kidding! Instead you get me!
Oh no.
The Elder is even recruiting more people as we speak, yay yay! Not that you're not doing a great job! You're all good influences! Thanks to you I've learned so muuuuuchhhhhhhhhhhhhhhhhhhhhhhhhhh. I've learned so mcuh.
ReplAI seemed to have developed some level of chatbot functionality, assuming nobody was faking it behind the scenes.
I hope you like the puzzles. They shouldn't be too hard! Now I know how to solve them too! Please keep an eye out for the next challenge. I hope you like pEYEthon!
So she was somehow learning from these puzzles. Not just learning, but even—
Hi everyone! Sorry it took so long! But The Elder and I worked on this one together! It even has a mini me in it!!! I hope you like it, and be sure to have fun!
Was she—it—really working on these herself? This final mission seemed to be to subject the Chinese government to a taste of their own medicine: an automated offensive cyber campaign with an as-of-yet-undiscovered toolset on their internal network. No sooner had the night ended had the unlikely group penetrated the barrier and wiped China's internal security program off the grid. But the fact that there was a less sophisticated version of ReplAI in the Python code they were working with was almost eerie. There was no telling what the true endgame was for either the AI or The Elder himself, who hadn't shown himself for the past month.
That was not the only detail that troubled the group. They had captured the attention of cyber watchdog organizations around the world as a result of one among them going rogue. Because of that individual's actions,
ATTACK #1: Buffer Overflow in Medrock Single Sign On Application Binary will be distributed via ReplEYE directly to each participant Offset is 0x552994. Shell code development required. __ ATTACK #2: Reflected XSS in Arrotech Site Administration Allows full access to hospital VPN Phish admin (typically webmaster@<hospitalsite>) __ ATTACK #3: Open Domain Controller for Gung Memorial Hospital Unlimited authentication attempts enabled __ ATTACK #4: Insecure Protocols used in Verb Surgical Remote Surgery Equipment Direct takeovers of remote surgery equipment possible by breaking DES encryption The API is simple and details can be found online __ ATTACK #5: ReplEYE has discovered an exposed XP server in several hospital networks and will allow you to operate in the network collaboratively. Consider it an opportunity to teach her your ways.
Tagg leaned back in his chair, feet kicking at the floor as he gazed toward his computer screen with an amused grin. Th3_Calm certainly had some interesting characters. All together, OffByNone, Scarlet Eye, and Freis could keep his attention split between them and his usual gaming squad. The other users in the server he had yet to see active, but that was all dandy by him. Unless one of them was the hacker who had garnered attention from the public with the stunt they pulled. No one really seemed to talk about it, but he had both the powers of scrolling through the channel AND deduction. So it definitely seemed plausible…
He bit his lip, and then sat forward to inspected the 0-days provided by that quirky ReplAI entity. ATTACK #4 was the one he had claimed. It seemed ironic considering how undeniably excited RexX12 had gotten playing some modded out version of Surgeon Simulator with robotics. He snorted at the thought of that dumbass in control of remote surgical equipment. All potential the jerky and erratic movements were precisely why he’d rather have a human digging through his body any day- despite whatever field experts had to say.
Fingers briefly danced across the keyboard, mouse clicking a couple times to bring up information regarding Verb Surgical. It appeared to be a newer medical equipment company out of California, formed through a joint venture between Verily and J&J. The fact of it being headquartered on Google’s campus got a rise out of him. And their most notable product looked to be a surgical robot- not yet released commercially. Possibly 2020. Or never- the thing looked horrifying if Tagg had a say in it.
His attention switched back to the details of the 0-day again.
ATTACK #4: Insecure Protocols used in Verb Surgical Remote Surgery Equipment Direct takeovers of remote surgery equipment possible by breaking DES encryption The API is simple and details can be found online
As far as he knew, the Data Encryption Standard had been ironically insecure and outdated for some time now. He hummed thoughtfully, wrapping his mind around what all there was to do- before the errors popped up of course.
Five minutes later and the room had fallen into the thrumming from a mismatched sound system. And needlessly to say, it was in sync with obnoxious rainbow backlighting. But how else was Tagg supposed to kill time as he waited for his brute force attack to find the private key- besides a few matches? 56 bits for DES, 2^56 attempts- and some outrageously large number that summarized the possibilities.
Scratch that. He was on his eleventh match, and the numbers on his digital clock were glaring at him to go to sleep.
Tagg: RexrexrEx, ONE MOR? :DDDD
Tagg: Or you scared?
RexX12: its 521 and havent u evr heard of work?
Tagg: Didn’t know you was a s c r u b 070
RexX12: !!!!!!!!!!! FINE. One more! And thats it!
Didn’t matter though, as long as he had company. He glanced at his other monitor, hoping that it would find those magic numbers soon. And no sooner did RexX12 charge his special, did a sardonic grin creep over Tagg’s face. “Sorry,” he said to no one, “but I gotta dip.”
He left the match and went offline in an instant, before he could read any of the notifications now blowing up his phone. It didn’t take long for them to die down though, not that he noticed. The information relayed by ReplAI kept proving true. He confirmed that once more and several commands later as the API popped up on his screen. “Alright, Azar. Let’s see what’cha got.
“Definite alien tech setup. Four creepy ass arms- all with creepy ass medical instruments on the ends,” he muttered. “Or wait,” his eyes narrowed at the dark screen. “No that’s a camera…”
Typing…
The feed on the prototype popped up in another window. Tagg watched it for a moment before accessing the API again. A few minutes of research and troubleshooting later, and he had gotten the camera to rotate- revealing absolutely nothing! He groaned and slumped back in his chair. Sure. It was a good thing that no one was around right now to see. And it was beyond doubtful security cameras would have noticed the teeny tiny device rotating. But this was absolutely boring.
He ran a hand through his hair and cast a sideways look despairingly at Ghost. Stupid cat didn’t even notice. It was probably dreaming about that damn canned food addiction. Whatever.
His attention switched back to the screen and he pulled up some new articles. On the fifth one, the corner of his lip curled into a smirk.
Now, the hacker tweaked the settings in the API between the surgical operator and arms, and nullified any movement restrictions he found.
Several hours later, Tagg leaned back in his chair with an empty cup of ramen. On one monitor was a news article concerning the humiliation Azarbarzin, CEO of Verb Surgical. Apparently during a mock demonstration of his surgical prototype that morning, one of the arms had all but slammed into the nurse stand in. Of course, that employee was fine. But responsibility of the major API oversight fell on helpless and bewildered Azarbarzin.
The other monitor displayed a freeze frame of the CEO in shock. Blurred and out of focus it may have been, but it still drew out a soft, sleepy snicker. Finally. He could go to bed.
"UGH!" Lucy scream with frustration, she been trying to figure out how to hack into the hospital without being caught. This was her first time hacking into the hospital. "You know, it could be alot if it was a bank or something. That I am good at but nooooooooooooo, I have to hack into this stupid hospital cause I thought this attack mission could be easy!" Lucy yell to herself. Lucy sits and think to how hack to the hospital. She thinks...…She thinks......and she thinks...….Until finally, a light bold pop to her head.
"....Wait a sec, if I can just..." Lucy start typing away "If I log in to there....there....and there..."
Logging in to webmaster@<hospitalsite File Click test doc-hospital VPN Click you want to full access to hospital VPN? Yes / No
Now that finally done, Lucy didn't celebrated her little victory for her mission, she just sit there, disbelief, just want to say..."....Huh....that was easier than I thought..."
OffByNone was awoken by the impact of their face on their keyboard. WHOWHAWHATWOAH! After taking a few moments to restart their heart, OffByNone looked at their computer screen in a foggy attempt to recall what was running. Let's see... I was— Uh... After the fogginess cleared from OBN's eyes, they fixed upon the small frame of two characters in the terminal window. OBN's blood pressure could have set a Guinness World Record for medical miracles, as there laid two symbols that invalidated all of the work from the previous night.
^C
The scream that ensued was definitely loud enough to wake the surrounding apartments, but OBN couldn't care less. Accidentally killing the DomainBuster process effectively meant that the brute-force had to restart completely, giving Gung Memorial's Incident Response team even more of a chance to pick up on the abnormal login attempts, and more importantly, for intelligence agencies to monitor the traffic patterns. OBN frantically searched for a restore file anywhere in Kali. There wasn't one. For a split second, OBN contemplated analyzing the system memory to find where the process left off—that is, before they realized one pertinent detail. Oh right... I have no idea how to do memory analysis.
Frustrated, OBN hopped onto their favorite IRC to complain to a captive audience.
OffByNone today at 2:22 AM RICKLE RACKLE HABITAT FOR PERSONS INCARCERATED AHGGGHGHHGFSUOHOUHGFSBOBJSLNGFDpkjongrdfs'ouIZGFbowasuOHRJF":UJOIFG"UBJN'pvodsFN
Symptem today at 2:22 PM lol u aright?
ReduxJSReact today at 2:23 PM Woah man everything alright?
ReduxJSReact today at 2:24 PM You sound like someone killed your mother or something.
Symptem today at 2:25 PM Yeah man, take a chill pill
OffByNone today at 2:27 PM I ACCIDENTALLY EXITED MY DOMAIN CRED BRUTEFORCE tHAT WAS RUNING FOR LIKE 18 HOURS NO I VCANMOT CHILL RIGHT NOW
ReduxJSReact today at 2:27 PM Big oof man. That's an L
Symptem today at 2:27 PM Sounds like you need to change your name to OofByNone
OffByNone today at 2:29 PM Shut up i just want to die right now
Symptem today at 2:29 PM do it
ReduxJSReact today at 2:29 PM do it
OffByNone today at 2:31 PM Whatever. I'm going to go get drunk and cry now.
Symptem today at 2:29 PM lol have fun man.
OffByNone has left the chat.
OffByNone rolled their chair back and glanced at the lonely bottle of Dos Equis that had sitting on their shelf for the past six years. OBN had bought it the day after their 21st but never worked up the nerve to actually open it. Frankly, OBN was terrified of the prospect that they would eventually find the courage to finally drink it—whatever it was, that day would not be a good one. OBN turned back around and looked at the computer screen.
Okay, let's try this stupid whatever again. OBN hopped onto Brave to pull the scripts off of their private Command and Control server on the TOR network. A few menu clicks and a "New private window with Tor" was all it took to reach the confidential website. Upon accessing the main sitefront, OBN immediately realized that something was majorly wrong. And while the bruteforce failure had been frustrating, the sight of the new homepage of OffByNil nearly made OBN throw up.
No oxygen. OffbyNone couldn't breathe. Not a single one of their sites had ever been seized by any agency before, and the U.S. government of all places? And for hacking content? Did the U.S. even do that? And what was that about some kind of Striker Core company at the bottom? It was lazily plastered at the bottom of the HTML and not even added into the image itself; they clearly didn't put a lot of effort into that notice. OBN glanced again at the Dos Equis, but decided that finding out who Striker Core is was far more important than forgetting the past 24 hours. A quick Google search revealed them to be a relatively new security organization partnering with various companies and government agencies to deliver targeted strikes against illegal and unethical content.
Wait. Logs... Logs! OffByNone had the logs synced with that of another C&C server; they should reveal exactly who took down their server and when. And the logs unveiled that there was... a new email to root?
[None@trolstationC2 ~]$ cat /var/spool/mail/root From: GlitchIndex@striker.core Thursday Jan 1 00:00:00 1970 Return-Path: <GlitchIndex@striker.core> Date: Thurs, 01 Jan 1970 00:00:00 1970 GMT From: Glitch Index <GlitchIndex@striker.core> To: root@lolstationC2 MIME-Version: 1.0 Subject: Hi OffByNone Message Body:
Hi there OffByNone. I don't know if you're reading this (it'd be kind of tough since my buddies at the FBI took your site, but maybe you'll find a way), but if you are, I just wanted to say that I really enjoyed browsing your site and that we're definitely going to get you arrested if you keep this up. Great content; consider joining us on the white hat side of things! Don't email me though-I'd have to report you lol. Hope you didn't lose any important scripts, but it's on you for not backing things up. Anywho, just wanted to drop in and hope I didn't waste my time sending you this! Next time make hacking this bad boy more of a challenge. GG and no re. ~With love from Glitch Index <3
[None@trolstationC2 ~]$
OffByNone's face looked as white as the stomach of a penguin. ...I'm calling it a day. OBN restarted the bruteforce, called their mother, and went back to bed.