Full transcript
0:00A gentle reminder for you.
0:02Authentication check will soon become a
0:04mandatory part of Trezor. You know, at
0:07Trezor, of course, protecting your
0:08digital assets is our highest priority.
0:11As part of an ongoing commitment to your
0:13security and alignment with global
0:15cryptocurrency regulations, we're
0:17introducing authentication check, a new
0:20security feature designed to provide
0:22greater confidence in the safety of your
0:24crypto transactions. So, if you're on
0:27these devices, what you got to do is
0:29scan the QR code to prevent any
0:31disruption to your Trezor Suite access
0:34by February 15th. If you don't, your
0:38access to Trezor may be limited. Maybe
0:40some things are unavailable or you have
0:42limited functionality. So, hey, you take
0:44out your phone and you try to scan this
0:46QR code here. But, if you do try to scan
0:49that QR code as of right now, the
0:51website that it redirects you to can't
0:53be reached.
0:54trezor.authentication-check.io
0:59is unavailable. And you know, that's a
1:01good thing because if you weren't able
1:03to tell, this is a scam. It's a lie.
1:06It's a fish. It's some social
1:07engineering. But, a clever cutsey tidbit
1:10is that this was a physical mail,
1:12literally snail mail, sent through
1:14postage, a physical envelope and letter
1:17sent in the mail. Now, I know, you
1:19probably get spam in the mail all the
1:21time, right? Like fake car insurance
1:23warranty crap. But, this I thought was
1:25just a little neat because it's
1:27literally like a digital fishing social
1:30engineering attempt to get your
1:31cryptocurrency wallet sent via pigeon.
1:35Not literal pigeon, but you know, like
1:37real-world mail as opposed to where we
1:39usually see fishing in your email inbox.
1:42Funniest thing is, you might have saw
1:43it, it had a signature from the Ledger
1:45CEO, not Trezor. But, I was a little
1:48curious, okay, where did this QR code
1:50lead? What was on or present or shown in
1:53that scam website? Since the site is
1:56down, I was taking a look at the Wayback
1:58Machine, but unfortunately, I did not
2:00see any results. It does not have that
2:03captured. But, of course, some of my
2:05friends were talking about this thing,
2:06too. You know, Flare, they are a huge
2:08supporter of the channel and the sponsor
2:09of this video, so I wanted to be sure to
2:11give them some love. But, scammers are
2:13targeting crypto users through the mail.
2:16And they caught wind of this while it
2:17was still hot. I'll admit, I am a little
2:20bit late, but big shout out to Dimitri
2:22for sharing this thing. They include the
2:24picture that was shared on Twitter. They
2:26talk a little bit about the letter, but
2:27then they get to the site. So, this is
2:30the landing page.
2:31trezor.authentication-check.io/block
2:35is where it puts you, and this looks
2:38dumb.
2:39Like, this just looks stupid. Okay,
2:40complete the authentication setup by
2:42February 15th, so add a little bit of
2:43urgency, add a timeline to it if you
2:46purchase these cold wallets. It's got
2:48some bogus down at the bottom to try to
2:50add some credibility, but the submit
2:53page, where they actually bring you into
2:54this, you have to enter your recovery
2:57phrase. Which should sound off so many
3:00alarms and, you know, sirens and red
3:03bells ringing in your head. No, do not
3:05enter your wallet recovery phase to
3:07verify device ownership and enable
3:09authentication check. That is the scam.
3:12That is the social engineering. That is
3:14the phish. And a couple other folks are
3:16chiming in, "Hey, it's not only Trezor
3:18that you're seeing some of these strange
3:19mail and in the real-world physical sent
3:22letters to." Another one from Ledger.
3:24"The Ledger one is using a similar, oh,
3:26just subdomain based off of any generic
3:29domain to add Ledger or Trezor at the
3:31very start." That domain and website, of
3:33course, has been taken down, as well.
3:35You can see Google Chrome added the
3:37usual dangerous site banner, but if you
3:39were to fall for this, right, if you
3:40were to enter your wallet recovery
3:43phase, that's the master key to your
3:45whole crypto wallet. So, then the threat
3:47actor, hacker, and attacker, adversary
3:49would drain the wallet and steal all the
3:51money in that crypto account. Alarm
3:54bells, sirens, you don't give out your
3:56secret recovery key phrase. I was
3:58looking through the comments on this
4:00post and it was pretty cool to see
4:01Trezor out and about like, "Hey, stay
4:03safe everybody. We don't do that. We'll
4:05never contact you first. Don't share
4:07your wallet back up with anyone. Uh
4:09don't just trust but verify." Big
4:10hearts, dig that for sure. Appreciate
4:12it. Now, I think there's more of a story
4:14to tell here other than this individual
4:16incident because you got to wonder and
4:18ask, "Okay, how do you get the customer
4:20physical home address locations to send
4:23legitimate real mail, right?" I'm over
4:25on BreachForums, one of the well-known
4:28cybercrime forums, organized cybercrime.
4:30And granted, this is a post from
4:32yesterday. So, the timeline doesn't
4:33really line up, but I know that this is
4:35sort of ongoing. A user posts a thread,
4:37"I'm putting up for sale a fresh
4:39database of Ledger customers obtained
4:41via a breach of the global e-payment
4:44gateway on January 5th. Whatever 100,000
4:47plus unique entries, 68 K, and a little
4:51bit of a Costco free sample for you to
4:52see oh, some of the data that's included
4:54there. Obviously, that includes a
4:57physical home address. That's the damage
4:59of a data breach, right? Your customer
5:01data, personal identifying information
5:03published out to the world, available
5:05for then sale and resale. Now, I tracked
5:07this down with Flare, the threat
5:08exposure management platform and
5:10solution that you know, I'm a huge
5:11fanboy of. They have incredible, super
5:13cool research and insight. I was taking
5:15a look at what some of the threat
5:16actors, hackers, and cybercriminals are
5:17up to, how they're chatting about this
5:19over on the dark web or those Tor onion
5:22links. Again, this post is very recent,
5:24so not in the exact timeline before the
5:26letters would have been sent out by
5:27physical mail. But look at this,
5:29someone's saying, "Hey, cold storage
5:30private databases are needed for my
5:32campaign. Ledger, Trezor." But trying to
5:35track that one down, you know, go to the
5:36source, look at that on exploit.in. That
5:39is a pay-to-play forum, but I've got an
5:41account and unfortunately, hey, that one
5:43doesn't have the item. Post is not
5:45found. You saw the BreachForums post
5:47where the user was selling a database,
5:49but here was one a bit further back,
5:50February 19th, over on exploit.in, and
5:53that link should actually come through
5:55for us. Yeah, crypto database for sale
5:58posted on January 20th, best crypto
6:01database available for sale. Message me
6:03with money. And people are like, "Yo,
6:05these are literally public, dude. Stop
6:07selling this crap." Oh, usual cybercrime
6:10high school drama. Hey, that is some of
6:12the sweet awesome advantage that you get
6:14with Flare, a threat exposure management
6:16with seriously incredible visibility
6:18into the dark web underground cybercrime
6:21infostealer malware ransomware leak
6:23sites, and your exposed attack surface
6:25for your organization. So, so cool. Link
6:28below in the video description. Huge
6:29thanks to Flare for sponsoring this
6:30video and their continued support of the
6:32channel. But, there are more nerd
6:34nuggets here. Take a look. I wanted to
6:36showcase uh big thanks to Jeremy. Give
6:38him a shout-out. I'll have a link below
6:40to his blog because after this
6:43real-world physical mail letter envelope
6:45snail mail, get the news, right? You can
6:48see BleepingComputer covered it also in
6:50their own article. Jeremy writes this
6:51blog called disrupting a cryptocurrency
6:54phishing scam abusing Telegram bots. He
6:58says, "Hey, while scrolling Twitter, he
6:59saw a little repost recycle from the
7:01crazy cat guy with an active phishing
7:04campaign targeting Trezor users with
7:06physical mail." He got to dig into this,
7:09and then he noticed that the website,
7:10while it was up, was actually sending
7:12the data right to Telegram. Oh, a
7:15classic. We could have expected this. It
7:17submitted the data directly to the
7:19Telegram bot API without proxying it
7:21through a back-end, which meant the
7:23token, the bot token, was public to
7:25anyone who knew how to F12 Missouri
7:27hacking read the source. It included the
7:30bot token in the URL with the payload of
7:32ooh, new authentication check, someone
7:35just fell for the bait, included their
7:37recovery phrase and their token and the
7:39current time. Then Telegram would
7:41respond with this info. Now, I'm going
7:42to break out the JSON into a text
7:44editor, Sublime Text, so we have a
7:45little bit better syntax highlighting
7:47and you can see that more clearly. But,
7:48here's our bot, Fur Merger Merger, also
7:51known as T5 Bot, a little bit easier to
7:53say. That immediately revealed some
7:54information about our attacker,
7:56including the bot's username and the
7:57chat group that was used to exfiltrate
7:59the information. Then he queries the
8:00bot's get me endpoint, and this gives
8:02some of the metadata, some more of the
8:04privileges and permissions that might be
8:06configured here. Since the bot had the
8:08admin role, could delete messages,
8:09invite users, and manage the overall
8:11chat, he exported the invite link to
8:13himself to export chat invite link. And
8:16that let him see the other operators, or
8:18potentially the threat actors, in the
8:21exfiltration dumping ground. What Jeremy
8:23is building up to, which is super cool,
8:25is using some of the Telegram API to be
8:28able to listen in on the bot and see the
8:30messages that might have been sent back
8:31and forth, and then ultimately take down
8:34the Telegram bot. Now, we've showcased
8:36some of that process before on this
8:37channel, couple other cool videos that
8:39show a little bit of that process more
8:41behind the scenes, but Jeremy was able
8:43to pull out one of the potential actors,
8:45right? We don't know, a first name Flexi
8:48and a username Flexi6T.
8:50And for the sake of Jeremy's blog post,
8:52and I will comply, he redacted a good
8:55many details here, just in case that uh
8:58hypothesis is wrong, right? He was able
9:00to get all this information, but that
9:01does leave the question mark. We don't
9:03know, maybe maybe not, is that
9:05individual the bad actor, the threat
9:07actor, the adversary. But, because it
9:09can join groups, well, he could forward
9:12all the messages and see each and every
9:14one of the actual victim information
9:17that was provided. With that, he was
9:19able to see really when the campaign
9:20started, how many folks fell for the
9:22fish, and he was even able to find a
9:24second bot token. Part of me wonders if
9:26that would have been for Ledger as
9:28opposed to Trezor or any of the others
9:30that are trying to roll through with
9:31this campaign, but he walks through the
9:34process here. Web browsers are adding
9:36the appropriate deceptive site ahead,
9:38but the website was still accessible
9:40even with that warning. So, Jeremy went
9:42ahead and well, he thought, "You know
9:44what? Okay, I could disrupt the
9:46operations here and inconvenience the
9:48operators by telling that API bot to
9:51leave." Now, the buttons that used to
9:54exfiltrate your data, your secret key,
9:56your Bitcoin recovery or crypto wallet
9:58secret phrase, now no longer could exfil
10:01out. Cool. Little good Samaritan
10:04neighborhood cybercrime watch for threat
10:07actor sending real snail mail for
10:10fishing scams of crypto users. So,
10:13perhaps an extra exercise for the
10:15reader, maybe we wanted to track down
10:17what that Flexi Telegram account might
10:19be up to. You could use Flare. In fact,
10:21you could track down any of the sort of
10:23cybercrime, hacker, threat actor antics
10:25all across Telegram group chats,
10:27ransomware leak sites, just incredible
10:29threat intelligence and deep dark dark
10:32web research with Flare. Big thanks to
10:34them for sponsoring this video and their
10:36support of the channel. Please do show
10:37them some love. Link below in the video
10:38description. Thanks so much for watching
10:40and I'll see you in the next video.