Between Two Nerds: The FBI and ShinyHunters are the same

0:03Tom Uren: Hello, everyone. This is Tom Uren. I'm here with The Grugq for another Between Two Nines. G'day, Grugq. How are you? G'day, Tom. Fine and yourself? I'm well. This week's episode is brought to you by Prowler, the open source cloud security company. Find them at prowler.com. So, Grugq, this week, I don't know, maybe the biggest national security disaster hack happened in the last couple of weeks the fbi looks like it's pretty certainly been hacked by a group of juvenile kids shiny hunters um and what struck me about it is that there's this kind of amazing symmetry in that both the fbi and the shiny hunters were were kind of operating under false assumptions i think so i'm going to lay out this theory to you so the story apparently as far as we can tell so far is that the fbi were running an oracle people soft server there was some sort of vulnerability in that shiny hunters is a group of young adults to older teens.

1:19Tom Uren: They're part of the young cyber criminal oeuvre. And they exploited that vulnerability, pivoted to AWS and extracted, they say two or three terabytes of data from the FBI. And then they approached a number of journalists and said, we've got data from the FBI. They gave samples out of, Some of it seemed to be from the FBI job site, but the Chinese hunters said they had access to other databases. And some of the data included names of personnel, addresses, spouse details, medical records, psychiatric records, sometimes the particular unit that they worked in. Like, this is all very bad, obviously.

2:16Tom Uren: including whether they were working against, you know, a Chinese counterintelligence target, a particular Chinese task force. Well, as long as the shiny hunters are keeping it secure from the Chinese, it's probably still safe. And they're like, well, I mean, funnily enough, I think the shiny hunters were going around telling people, look, we're not trying to leak this data. If it gets out, it's not because of us. We're just giving it to the media.

2:48Tom Uren: And the message they sent was the FBI wrote a report about shiny hunters a month or two ago. And the shiny hunters in their messages said the FBI got certain details in that report wrong. We want them to either retract that report or correct the details. This is not extortion. My name is spelled with two I's.

3:16Tom Uren: so first of all the first thing that struck me is i was totally unsurprised that the fbi got hacked in that way so back in june of this year last year sorry i i wrote this piece about the office of the inspector general at the department of justice wrote this report about what they call universal or ubiquitous technical surveillance the idea that we've spoken about many times that there's a whole lot of open source data that you can get and also that it's relatively easy to hack things like traffic cameras yeah and so the oig produced this report and my take was the fbi didn't really care about ubiquitous technical surveillance it there's a striking example of in the report how its operations were compromised by a Mexican drug cartel so a drug cartel like lots and lots of money there's lots of examples of them hiring hacker type people and also compromising police forces it's entirely believable that they would they could cobble together some quite sophisticated sophisticated capabilities so it says that in this particular case that was in that report the cartel were surveilling the fbi's legal attache in mexico city observed him going out in and out of the embassy got his phone number and pivoted off the phone number to then get his geolocation so they were able to track him around the city compromised cctv cameras to then see who the attache was meeting with according to the case agent the cartel used that information to intimidate and in some cases kill potential sources or cooperating witnesses.

5:10Tom Uren: So that's struck me at the time as a, like that seems entirely plausible for an organization of that capability. That doesn't surprise me actually, like the first AS400, so this is one of the like the big iron mainframes, like the old school mainframes. the first as 400 in colombia was owned by pablo escobar right and it was like he had people who were collecting all of the phone numbers that were going into the embassy and then they used that to try and find who was snitching they said like who was speaking to the authorities and calling the and all this stuff and yeah like i i think in a way like criminals have always been very like technology forward like they want to have an edge and surprisingly enough they're not afraid to like have hackers do criminal things for them yeah and i think it's particularly the phone network i think that is something that criminals understand because the idea of right like phone taps and all this stuff yeah yeah exactly it's just and so it's just sort of switching that around to your own purposes so that's one example the the kicker in the report is basically that the fbi just didn't care about it and right so they actually did some work internally at the fbi to figure out whether it was a problem so former director ray they actually said it was a tier one enterprise risk and ordered in a returnal and internal review back in 2023 and a red team produced a gap analysis document and this gap analysis document the gaps are literally less than a page and the report reproduces it in full so most of all of it's redacted except three questions and you know one is what redacted enhancements do we need to do and it's less than two lines or it is two lines what should we do well i mean anything at all would be an improvement So there's three questions of the policies we currently have sufficient.

7:25Tom Uren: Looks like a medium length paragraph. What enhancements do we need? Two lines. Are the trainings that we currently have sufficient? Looks like four or five lines. And so that... This strikes me as exactly what the FBI would like, because it's like policies. Is the paperwork policy and all that, is that appropriate? They're going to love that one. Like, yes, maybe we need to enact more policies. Maybe there's some paperwork thing we can do that will make us better. And then there's the like, what should we actually address? It's like, I don't know, maybe some technical thing. Get the nerds to figure it out.

7:59And then it's like, what about training? Like, yes, we could do more training. That sounds like fun, right? Like none of it.

8:04Tom Uren: So the real problem is that you've got less than a page. So that's the gap analysis. And then the mitigation plan is based on the gap analysis. And so when you're starting from less than a page to get a draft mitigation for ubiquitous technical surveillance, like I think that's doomed to failure. So the Inspector General's report, because the Red Team's subsequent draft mitigation plan was based on its gap analysis, we have corresponding concerns about that plan. We also have an independent concern About whether the draft mitigation plan Will result in any mechanism at the FBI That will better position it To respond to the evolving UTS threat So my take was the FBI It just doesn't care Yeah, it sounds like they're not taking it seriously Because they're like Yeah, and to me this breach And that it could be so bad Is a symptom of not really caring about security in the same way that an intelligence organization does.

9:11Tom Uren: Right. Well, I think what's going on here is like an intelligence organization knows that the enemy is another intelligence organization. They know that they're facing a copy of themselves, so they're very concerned. Right. Whereas the FBI is facing a bunch of criminals, and what are they going to do? Yeah, when I was working for defense, I heard all the time, you know if our a team could get into this that probably means that their a team could get into this so there was a lot of mirroring about the risks yeah it's it's it's like it's a thing we talk about a lot which is that you know you do in cyber you need the offense and the defense to be on the same team because the offense will come up with things and the defense will have to know what those things are so they can defend against them and when the defense comes up with a new way of blocking stuff, the offense needs to know about it so that they can figure out how to get around it.

10:04Like, they feed off each other. Like, if you have them isolated, they're both poorer for it. And I think that that makes sense in an intelligence agency where you do have that sense of, like, we have to defend things because there's us prime. Like, there's a copy of us out there who want it, right? And so we need to constantly... But if you're the FBI... There's evil gruck out there.

10:34Right. You understand the threat because you are the threat.

10:40Tom Uren: Right, yeah. But the FBI is not an intelligence organisation in the same way. Right. They're a counterintelligence organisation against the Russians and the Chinese. But I don't think that that's understood in the same way. Well, I think it's one of their purposes, right? Right, right. That's exactly what I think. I think that they have like the office that does that or like there's the group of people who are responsible for that. And it's like, oh, yeah, those losers who don't work bank heists, you know, or they're not on the fast track because they got stuck on counterintelligence or whatever it is, right?

11:18I mean, at some point, counterterrorism was the hot place to be. And I'm sure counterintelligence was just like, oh, we're fighting al-Qaeda, the number one threat, and you're fighting, what, the Russians? The guys that lost the Cold War? Right, yeah.

11:36Tom Uren: Yeah, I also get the feeling domestic intelligence or domestic counterintelligence agencies always think that they're top dog in their own domain. So in America, when it comes to counterintelligence, there is no one who is more powerful than the FBI. They can do lawful intercept. They've got powers to arrest people. They do surveillance. They catch people all the time. Yeah, so they're the main threat. I think they don't internalize that risk of out the outside in the same way. And they're not targeted in the same way, right, even though they actually are. Yes. Yeah, they don't feel like they are.

12:16Yeah, exactly.

12:18Tom Uren: Yeah, so that came across to me very strongly from that report. And to me, this breach is exactly downstream of that. I wouldn't necessarily call it a culture so much as, well, maybe it is a culture or an organizational blind spot. Yeah. Which is totally understandable given the kind of organization they are and what they do and who they're concerned about. Right. So I think it's very much a thing of like they know that if they go undercover in a drug cartel, they're at risk. But they're probably not going to get killed because that would escalate. They would turn the heat up so high against that particular cartel that like there's deterrence, right?

13:00Like they've established some level of deterrence and that if you screw with the FBI, you are going to find out that you live in a world of hurt. And that's a thing that they can do locally, domestically. That's a thing they can do domestically.

13:14Tom Uren: Yeah. I think their real world operations are probably quite good. So when they go undercover, they know what they're doing. And they have, I think that, I assume they take that seriously. Right. What struck me about the shiny hunters thing is that in a weird way, they are operating under the exactly the same delusion. They feel like they're invincible. so shiny hunters the timeline is that a shiny hunters member was arrested in the netherlands i think in the maybe the 16th something like that so brian krebs krebs on security wrote about that he'd been talking to this individual whose name is pepin van der snap I'm not sure.

14:03Tom Uren: Pepine? Pepin? Pep. I know Pep is short for it. Because the way I found out about this was a friend of mine contacted me. And he said, there's a guy with my name who just got arrested.

14:17Tom Uren: So Pep, not your friend, got arrested. Then somewhat less than a week later, shiny hunters hacked the FBI. Said they stole two to three terabytes. Yada yada. and then in the week after the FBI sent out an internal memo basically confirming that it was a hack and warned employees that some of their data may have been breached. And offering them 12 months of credit monitoring.

14:48Tom Uren: And then the news of this arrest came out. The FBI, so their assistant director for cyber, He sent out a message on the back of this arrest, said that Pep was one of the alleged leaders of shiny hunters. So Van der Staap does seem to have some actual proper cyber credentials in that he was the lead of an offensive cyber team in a particular Dutch company. and volunteered in the Dutch DIVD Information Vulnerability Disclosure. Yeah. Dutch Institute for Vulnerability Disclosure, a non-profit security research group. So he's got some, presumably got some technical chops. So the assistant director for the FBI cyber division, he talks about the arrest of Anders Starp.

15:45Tom Uren: But then he then directs a message specifically at Shiny Hunters. Now to the remaining members of Shiny Hunters. You've heard about the arrest of your colleague. We are confident you've seen or heard things in recent days that the public has not. Other groups believed anonymity or their friends would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is yours.

16:25That seems very much like lecturing a bunch of delinquents in detention at high school, right?

16:31Tom Uren: You guys need to shape up. You've got your whole lives ahead of you. You don't know what you're throwing away. What are you, 17? so fbi director cash patel uh he also posted on x blah blah blah blah we're not done fbi teams are working on new leads right now more arrests are on the table if you attack americans from behind a keyboard anywhere in the world we will find you i think you can be skeptical about how effective those things can be. I think probably the FBI does have some good chances of arresting people. So shiny hunters in recent days, they've messaged journalists again, several of them.

17:18Tom Uren: We understand why many... We got hacked and someone impersonating us used my email address. That might be the next one. We understand why many misinterpreted this as extortion. we again want to emphasize that this is not extortion it was never one to begin with nothing will happen we were just trying to show them about their security so they could fix it you know we stand corrected thank you so it seemed to me that the fbi was is trying to establish some level of deterrence here yes so the thing is right it's probably going to work against the guys who just had their friend arrested and who are suddenly like having a bit of the uh a a clench up moment of like oh no that could be me yep however the guys just you know six months younger than them right are going to be like look at those old idiots so van der step is 23 24 something like that so in the context of some of these um cyber crime youths like actually relatively old because many of them start when they're 13 14 15.

18:38i was going to say like it's one of those things where you you read about um like a unit in vietnam where like the 21 year old is called old man right like that's very much he's like oh yeah the 24 he's 24 man he's been doing this forever you know old man you know van der Staat yeah so i mean that was interesting

19:02Tom Uren: because many of the kids who've been arrested for being related to more scattered spider rather than this group which probably there's a lot of overlap have been people who just do social engineering and don't have the same technical skills so i thought it was interesting that this individual had some of those skills and hadn't been pulled back from the dark side so the the marae kids who wrote marae there was three of them and they all ended up working in cyber security because they all had technical skills and were all able to turn things around they just They didn't phone up a whole bunch of routers and convince them to DDoS people.

19:47Yeah, that's right.

19:48Tom Uren: So this seemed interesting in that he had some skills. It's unclear to me whether the rest of Shiny Hunters have any cybersecurity skills. I mean, I remember long ago, I made the comment of like, the problem is none of them have read the book on how to hack. And so they're doing it wrong. Like they do things like buy password lists of forums and then brute force VPNs with like all of these passwords. And it's like you're not supposed to do that. That's not the normal way of doing things. You're supposed to try and find like a vulnerability or maybe call someone up. You're not like this is you're cheating.

20:32You're doing it wrong. Like this is very embarrassing. I feel embarrassed for you because you're doing this so badly, even though it works. you know yeah like it does seem like he was actually competent and skilled or compared to what the rest of them are doing like it's i mean i gotta say you you to be fair kevin mitnick made a career out of like social engineering so i guess right we done but yeah so i guess one thing

20:59Tom Uren: is it seems very few people convert social engineering into a career after that it seems like mostly it's a not a marketable skill well i mean if you're good at lying to people there's so many things you could do for a career you don't need computers that's right that's true yeah i guess there's you don't need to be in the cyber security industry yeah for sure right point taken but i guess the world is your oyster yeah so i think like one of the things that struck me is that this, like the com, the environment that these guys are in, it reminds me a lot of the hacker's manifesto or the conscious of a hacker.

21:45And this is, I was just looking it up. This is from 1986. So 40 years ago. Right. Yep. Right. 40 years ago. And it's this guy writing this very angry teenager thing. And he's doing a whole, you know, damn kids, they're all alike. But his whole thing is very much like he's very, very bored at school. And then he finds this community of people where there's this like, you know, back then it was stealing phone access. But there's this like frisson of illicit transgressive activity. And it's like kind of cool. And you're hanging out with all these people who understand you and like have the same things going on.

22:29And, you know, back then that was kind of the end of it. Right. Like there was that like curiosity angle of like breaking into new places and learning things. But back then you would steal phone service. And these days you would steal two terabytes of data from the FBI. Times have changed.

22:51Tom Uren: Yeah, you sent that to me. And it does seem that maybe it's the emotional drivers are kind of the same. It's that sense community, like you said, doing different things. One way that I felt that the shiny hunters were like the FBI is that they both felt that they were invulnerable. Right. Both for different reasons, I think. And so for me, the shiny hunters, like there's an internal reason they feel invulnerable. And mostly it's just because they're young and dumb. Unlike the FBI, who should know better, they're just too inexperienced to know when they're being stupid. And the other part of the reason is that they continue to conduct crimes very successfully.

23:35Tom Uren: So Leatherman, who is the FBI assistant director, said something like 140 different incidents and$70 million in ransoms. So that's successful, I think. That's not bad, right? Yeah. And I think... I mean, sorry, that's bad. we're not condoning crime here but like i think 70 million is a reasonable amount of money to make as a 24 year old yeah so not necessarily that individual but the group but still like as a group i don't know how big it is no you only get a fraction of that you know you have to share it with three other people so it's not really and so i think that gives a sense of invulnerability and what i think is going on there is that they were never the fbi's top cyber priority do you think that's changed recently maybe and i think the that nothing happened made them feel like oh we must be doing something right we're invincible we'll never get caught we've done so much stuff and yet when i think about what the fbi's top cyber priority should be it sounds it the whole thing sounds exactly like when uh you're doing something dumb and you're a teenager and like one of your friends says, I've done it a thousand times before.

24:52You'll be fine. Nothing ever happens. Right. And that might be true, but it still doesn't mean that like jumping off the bridge is a smart idea. Right.

25:01Tom Uren: Yeah. Right. Yeah. So when I think about the FBI's top priorities, there's some really horrible, horrible stuff that is - From the same community, by the way. Yeah, that's right. Right. But I don't know if you would call it cybercrime, but it's like sextortion, trying to convince people to harm themselves. some of the extreme kind of both bullying but also trying to get people murdered, child exploitation. So those are the things that I think... Like absolutely vile stuff. Yeah, that's right. There's real harm to kids and real people. Yes, exactly. And if it's me... Organizations losing money is like, yeah, it's not great, but it's not a 12-year-old who's...

25:48We'll get to it when we get to it. Yeah.

25:50Tom Uren: Yeah, and the sad reality is there's so much of the other stuff that's worse. And also I think encrypting ransomware is worse because it causes impacts. Yeah, disruption to business operations, which is... People's jobs, stuff like that. So I think the harms they cause are greater. So I could understand shiny hunters being a middling priority despite being a very successful crime group. Right. and so it is i don't know if this is right but it is plausible to me that the output of the fbi's work on shiny hunters was that report a couple of months ago yeah and you know if we get a chance to arrest one of them yes let's do it but we're not going to bust a gut doing it yeah i mean it seems like they're not putting effort into it given how easy it is to identify these guys every time it comes up.

26:46Because, you know, as we've said, they're operating in a permissive environment where they don't have to take a lot of security precautions. And so what they end up doing is very ineffective. But it feels effective because, like, it's worked all the time so far, right? Like, why wouldn't it continue to work? And, I mean, the things that they do, to me, it looks this is going to sound a bit weird but it looks like the the opsec equivalent of like it's just like these bizarre wives tales that you have no idea how anyone could come up with it like oh yeah you need to like delete your discord account and create a new one or um you know you have to use a different email address that you don't use all the time or you know like use a slightly different name on your roblox and minecraft account than you use on like yeah so whenever one

27:38Tom Uren: of these individuals is arrested invariably within a day brian krebs comes out with uh you know a massive you can imagine a dossier that he's got of all these people's activity um i've heard alice nixon talk about it as well other people so she's a security researcher who focuses on these types of individuals and she says invariably they're known and so it's when they get to the top of the priority stack action can occur quite quickly so i suspect and given what the message was from shining hunters that this is what will happen here they've all of a sudden gone from a low to middling priority where they felt that they were invulnerable and this is the link to the fbi they felt they were invulnerable for all the wrong reasons right um and so i expect that they're going to get wrapped up it's it's it's sort of the um they they felt they were invulnerable and all the proof they had was no one ever paid enough attention to them.

28:37Tom Uren: Yes. Yeah. It's sort of like security by lack of priority. Security by, not obscurity, but. Security by mediocrity.

28:53It's not that big a deal. We'll get to them when we get to them. But yeah, like I think you're absolutely right in that. The mentality that they have of the like, what we've been doing has worked so far, so we're fine. I think the FBI has not lived in a world where they are exposed to threats because they are the apex predator domestically. And that's the world that they inhabit. They don't understand that there's just the open source stuff. Like they can legally requisition CCTV footage, but these guys can get hackers to hack that same footage. Right. And it'll be the same thing. Like all of this exists.

29:40And yeah, I think you're right. I don't think they comprehend that it includes them now in the threat. Right. Yeah.

29:46Tom Uren: So you were saying that you think the FBI can establish deterrence, but only amongst the particular shiny hunters, individuals that are involved right now. Yeah. So it feels to me that all of these kids are, this is going to make them sound more impressive, but they feel a bit like fighter pilots where every fighter pilot knows that he's the best. right like they can they can see other people and acknowledge that they're good but they know that they're better and having been a young person myself i very much remember thinking like okay like these other guys are pretty smart but right you know they might have put the fear of god into the people who have the shiny hunters hat right now yep but people who are in the same sort of community doing the same sort of thing, but not quite at that level, are going to look at this and be like, oh yeah, those idiots would have been fine if they'd never touched the FBI.

30:49Tom Uren: Right. Right. Or they would have been fine. They're going to maybe read the Krebs report and be like, oh, okay. He used his mother's email address. That was his one mistake. I won't do that. so there is the possibility that for these kind of random criminal groups the fbi will establish some sort of deterrence if right i'm kind of assuming they'll have some success rounding up some number of these people right in relatively short amount of time because i think there's a couple of things about these kinds of groups is that many of them are in countries that do cooperate with the FBI. Yeah, I don't think there's a lot of Pakistan.

31:31Tom Uren: Yeah, and so it's not like they're a Russian group, right? I still have my doubts because I think when you're 15 you just don't believe, right? Right, well it's, yeah, like this is the same bridge that kid died on last year when he jumped into the water, but he was an idiot. If we do it the right way... And it's more thrilling if you do it on the same. There's no point jumping off a safe bridge. Right, right. Yeah, now that would be real kudos if I could hack the FBI and get away with it. So I feel like it could establish some sort of short-term deterrence. But I'm wondering if the FBI is learning any other lessons.

32:14Tom Uren: Are they thinking we should... No. So it's... I mean, this is tea-read leaving. Tea-read leaving? Tea-leaf leaving. leave leaf teething at this point right because there's no it but the the vibes i'm getting uh it's it's very much like you're going to learn your lesson from coming after us and then no one else will ever come after us again right yeah right like that's that's the way i read it is they're going like look we got we got pants this one time so we're gonna smack the hell out of these people and then no one will ever dare to do it again yeah so one of the things that make me think the FBI won't necessarily take things on board is there being a bit so the story is that there's a top 10 list top 10 FBI's most wanted and it turns out that in the since director Kash Patel's been in charge they've been gaming the top 10 list so they'll put a criminal on the top 10 list and then they'll immediately arrest them.

33:21Tom Uren: So the top 10 list is not the top 10 most important. It's the top 10 we're most likely to arrest in the short term. So he's been able to say, for example, that we've arrested everyone on the top 10 list. It's not because they've arrested the top 10 most wanted. That's just that they've been rewriting the list to suit their arrest. You know, here's one we arrested earlier. I also think that there's just some groups that are undeterrable, like other states. So there was the FBI had a lawful intercept box, or some part of their lawful intercept machinery was breached, I think, earlier this year. And so that type of group is just not deterrable.

34:06Tom Uren: Right. But you can name and shame them, and that'll stop them. Yeah, well, yeah, exactly. Like, that's not going to achieve anything. you can't like none of these threats will make any difference and I feel like in this particular case levying those threats against this particular group is the right thing to do it will probably work for some amount of time there's nothing else you can do I guess the leverage shiny hunters have now is well we have this list do you want it to say secret or not I think you would try and play that card because it seems from their point of view because it's better than any, like, what else do you have?

34:48But can you imagine them saying, like, look, if we promise to delete the data, will you not arrest us?

34:54Tom Uren: No, I don't think it works. I think it's the thing that you think will work. As soon as you delete it, you've lost all your leverage anyway, so that doesn't work. That's right. It never works for anyone else, but it might work for us. Thanks a lot, Tom. Thanks, Scott.