Uber's 2022 Security Breach: A Deep Dive into the Teenager Hacker's Tactics and Uber's Defense Failure

The flickering neon of the city bled into the sterile glow of my monitor. Another night, another ghost in the machine. This time, the ghost had a name, or rather, a handle: a teenager. And their playground? Uber's vast, interconnected network. This wasn't just a breach; it was a masterclass in social engineering and privilege escalation, served on a platter of insecure configurations. We're not here to cheer for the kid, but to dissect the anatomy of their success, to understand where enterprise-grade security faltered, and more importantly, how to build defenses that learn from such costly mistakes.

This incident, reported in September 2022, wasn't a brute-force assault or a sophisticated zero-day exploit. It was far more insidious, a testament to the human element as the weakest link. The attacker, reportedly a young individual, managed to gain extensive access to Uber's internal systems, including sensitive data and administrative tools. Let's break down the breach, not as a headline, but as a case study in defense.

Table of Contents

• I. Overview: The Ghost in the Machine
• II. Anatomy of the Breach: Social Engineering and Privilege Escalation
• III. Uber's Response: Damage Control and Lessons Learned
• IV. The Psychology of an Embarrassing Hack
• V. Mitigation Strategies: Fortifying the Perimeter
• VI. Arsenal of the Defender: Tools and Knowledge
• VII. Frequently Asked Questions
• VIII. The Contract: Your Defensive Challenge

I. Overview: The Ghost in the Machine

The reports painted a stark picture: a security researcher, later identified as a teenager, leveraged social engineering to bypass Uber's security measures. This wasn't about cracking complex encryption or finding obscure zero-days. It involved manipulating an employee to gain access, a classic tactic that, when executed effectively, bypasses many technical controls. The attacker then exploited this initial access to escalate privileges, moving laterally within Uber's network and gaining access to a significant amount of data. The sheer audacity and success of the attack on a company of Uber's scale and apparent security investment immediately raised eyebrows across the cybersecurity community.

II. Anatomy of the Breach: Social Engineering and Privilege Escalation

The initial vector of attack reportedly involved a convincing social engineering effort targeting an Uber employee. The attacker posed as a member of Uber's IT department, convincing the employee to share credentials or perform an action that granted access. This is often achieved through phishing emails, spear-phishing, or increasingly, by impersonating trusted entities via direct messaging platforms. Once inside, the attacker's focus shifted to privilege escalation and lateral movement. This typically involves:

• Credential Dumping: Searching for cached credentials, password hashes, or configuration files containing sensitive information on the compromised system. Tools like Mimikatz are infamous for this, though any skilled attacker can find ways to extract credentials.
• Exploiting Misconfigurations: Cloud environments and complex internal networks are rife with misconfigurations. A common oversight is overly permissive IAM roles, weak access controls, or exposed management interfaces that, once accessed, can provide deeper access.
• Lateral Movement: Using harvested credentials or other exploits to access other machines or services on the network. Techniques like Pass-the-Hash, Pass-the-Ticket, or leveraging vulnerabilities in network services (like SMB, RDP) are common.
• Accessing Sensitive Data: The ultimate goal for many attackers. In Uber's case, this reportedly included access to systems containing driver PII (Personally Identifiable Information), trip details, and potentially internal databases.

The specific tools and techniques used by the teenager are still debated, but the core principles remain consistent with many high-profile breaches: exploit human trust, then exploit technical weaknesses.

III. Uber's Response: Damage Control and Lessons Learned

Uber's public response, primarily through their communications team on Twitter, confirmed the breach and stated they were investigating. They also highlighted that no critical systems were accessed and that their "security team is working with the authorities to bring this attacker to justice." From a blue team perspective, the response to any breach involves several critical steps:

• Containment: Immediately isolating compromised systems to prevent further spread. This might involve network segmentation, disabling affected accounts, or taking systems offline.
• Eradication: Removing the threat actor's presence and any malicious tools or backdoors.
• Recovery: Restoring systems to a clean state, often from backups, and verifying their integrity.
• Post-Mortem and Hardening: A thorough analysis to understand how the breach occurred, identify all affected assets, and implement new controls or revise existing ones to prevent recurrence. This is where the real value lies.

Uber's statement suggested that critical systems were not compromised, which is a positive sign. However, any access to sensitive PII is a serious matter requiring robust investigation and remediation. The incident undoubtedly triggered a review of their access control policies, employee training programs, and security monitoring capabilities.

IV. The Psychology of an Embarrassing Hack

Why is an attack by a teenager on a company like Uber particularly "embarrassing" for the victim?

• Perception of Skill Gap: It suggests that the defenses, likely built by experienced security professionals, were outmaneuvered by someone with less formal experience but perhaps more ingenuity or a different perspective.
• Public Trust: Companies handling vast amounts of personal data rely on public trust for their business model. A breach, especially one that appears to be a result of basic security failures, erodes this trust.
• Cost of Remediation: Beyond the immediate incident response, such breaches lead to extensive investigations, potential regulatory fines, lawsuits, and significant investment in bolstering defenses, all of which are costly.
• Reputational Damage: The narrative of a "teenager pwned Uber" is catchy and memorable, often overshadowing more technical details and focusing on the victim's vulnerability.

While age and experience are factors, it's crucial to remember that exploitability is often a matter of opportunity and specific vulnerabilities, not just the attacker's seniority.

V. Mitigation Strategies: Fortifying the Perimeter

Defending against social engineering and privilege escalation requires a multi-layered approach, focusing on both technical controls and human factors.

1. Strengthening the Human Firewall: Security Awareness Training

• Simulated Phishing: Regularly conduct realistic phishing simulations to test employee response. Crucially, follow up with targeted training for those who click or fall victim.
• Phishing Recognition Training: Educate employees on common phishing tactics (urgency, impersonation, suspicious links/attachments, poor grammar) and establish a clear reporting mechanism.
• Social Engineering Awareness: Train staff to be skeptical of unsolicited requests for information or credentials, especially those demanding immediate action or originating from seemingly internal sources without proper verification. Implement a strict verification process for sensitive requests.

2. Technical Controls for Privilege Escalation and Lateral Movement

• Principle of Least Privilege: Ensure users and service accounts only have the minimum permissions necessary to perform their job functions. Regularly review and audit these permissions.
• Multi-Factor Authentication (MFA): Implement MFA for all access, especially for administrative accounts, remote access (VPN), and critical applications. This is a non-negotiable defense against credential compromise.
• Network Segmentation: Divide your network into smaller, isolated segments. If one segment is compromised, it limits the attacker's ability to move laterally to other critical areas.
• Endpoint Detection and Response (EDR): Deploy EDR solutions that can detect suspicious behaviors indicative of credential dumping or lateral movement, not just known malware signatures.
• Zero Trust Architecture: Assume no user or device can be trusted by default, regardless of location. Authenticate and authorize access for every resource request.
• Regular Vulnerability Scanning and Patch Management: Aggressively scan your environment for known vulnerabilities and patch them swiftly. Attackers often pivot to exploiting unpatched systems.
• Secure Configuration Management: Implement and enforce secure configuration baselines for all systems, especially cloud environments, to prevent common misconfigurations that can lead to unauthorized access.

3. Enhanced Monitoring and Incident Response

• Robust Logging: Ensure comprehensive logging across all critical systems, networks, and applications.
• Security Information and Event Management (SIEM): Utilize a SIEM to aggregate and analyze logs for anomalous activity that might indicate a compromise. Develop correlation rules to detect patterns of malicious behavior.
• Threat Hunting: Proactively search for threats that may have bypassed automated defenses, using threat intelligence and hypothesis-driven investigations.

VI. Arsenal of the Defender: Tools and Knowledge

To effectively combat threats like the one faced by Uber requires a well-equipped arsenal and continuous learning. While the specific tools depend on the environment, these are foundational:

• For Threat Hunting & Analysis:
  • SIEM Solutions: Splunk, ELK Stack (Elasticsearch, Logstash, Kibana), Microsoft Sentinel.
  • EDR Platforms: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne.
  • Log Analysis Tools: grep, AWK, Python with Pandas.
  • Network Traffic Analysis: Wireshark, tcpdump, Zeek (formerly Bro).
• For Vulnerability Management:
  • Network Scanners: Nessus, Qualys, OpenVAS.
  • Web Application Scanners: Burp Suite Professional (essential for web app pentesting and analysis), OWASP ZAP.
• For Incident Response:
  • Memory Forensics: Volatility Framework.
  • Disk Forensics: Autopsy, FTK Imager.
  • Forensic Suites: PlexTrac (for managing security findings and workflows).
• Knowledge & Certifications:
  • Books: "The Web Application Hacker's Handbook" (for understanding web exploits), "Practical Threat Hunting" (for proactive defense), "The Art of Memory Analysis" (for deep-dive investigations).
  • Certifications: OSCP (Offensive Security Certified Professional) for understanding attacker methodologies, CISSP (Certified Information Systems Security Professional) for broad security knowledge, GIAC certifications (e.g., GCIH, GCFA) for specialized Incident Handling and Forensics.

Investing in these tools and knowledge equips your security team to not only react to incidents but to proactively hunt for and prevent them. For comprehensive case management and reporting, platforms like PlexTrac offer significant value in streamlining security operations and vulnerability tracking.

VII. Frequently Asked Questions

What specific data was compromised in the Uber breach?

While Uber stated no critical systems were compromised, reports indicated that sensitive information from around 50,000 data records was accessed, including employee PII and potentially driver-related information.

Was the teenager caught and prosecuted?

Reports indicated that the attacker was identified and that law enforcement was involved. Given their age, legal proceedings would likely be complex and potentially focus on rehabilitation rather than severe punishment, depending on jurisdiction and the extent of damage.

How can companies prevent social engineering attacks?

A combination of robust technical controls (like MFA and least privilege) and continuous, engaging security awareness training for employees is crucial. Employees must be empowered and trained to recognize and report suspicious activities without fear of reprisal.

Does a breach by a young hacker mean security is easy?

Not at all. It highlights that regardless of the attacker's age or experience level, social engineering remains a potent vector when technical and human defenses are not adequately integrated and maintained. It underscores the importance of a defense-in-depth strategy.

VIII. The Contract: Your Defensive Challenge

The Uber breach serves as a stark reminder: the digital fortress is only as strong as its weakest point, and often, that weakness lies in human trust and overlooked configurations. Your challenge is to move beyond reactive security measured by breach containment. Your Contract: Conduct a mini-audit of your own digital footprint. Identify one critical system or application you manage. Now, play both roles:

1. The Attacker: How would you attempt to gain initial access to this system, assuming you know nothing about its specific defenses but know you want its data? Document the 3 most plausible social engineering or minimal-access entry points.
2. The Defender: For each of those entry points, outline one specific technical control and one specific policy/training measure that would effectively block or significantly hinder that attack vector.

Document your findings. If your defenses are robust, you'll sleep better. If not, it's time to pay your dues to Sectemple by fortifying your perimeter. The network is unforgiving.

The digital realm is a battlefield, and sometimes the most effective weapons aren't forged in code, but mailed in plain sight. We're dissecting a low-cost ($10) phishing payload, a stark reminder of how physical mail can be weaponized for social engineering. This isn't about teaching you to craft such tools, but to understand their mechanics, identify their tell-tale signs, and harden your defenses against this subtle, yet potent, attack vector. Think of this as an autopsy of a digital ghost, revealing its methods so we can better guard the gate.

In the dark corners of the internet, where low-budget offensives can yield massive returns, the ingenuity behind a well-placed phishing attack is often underestimated. This particular method, revealed by Alex Lynd, leverages an inexpensive setup – roughly $10 – to deliver a potent blow. It’s a testament to the principle that sophisticated attacks don't always require sophisticated budgets, but rather clever exploitation of human psychology and readily available technology. Our goal here is not to replicate this, but to meticulously deconstruct it, understanding each component as a potential entry point for an adversary, and more importantly, a point of detection for the defender.

Understanding "WarShipping": The Physical Vector

The technique dubbed "WarShipping" bridges the physical and digital worlds. It involves sending a seemingly innocuous package, which contains the seed of a digital compromise. This bypasses traditional network perimeter defenses and directly targets end-users, exploiting their trust in physical mail and the allure of a "free" or "special" item.

The $10 Payload: Components and Analysis

At its core, this attack relies on extremely low-cost hardware and a basic understanding of how to trigger execution. The charm lies in its simplicity and the low financial barrier to entry.

Essential Tools for the Adversary (and your Detection Radar)

• Microcontroller/SBC: A cheap, programmable device capable of emulating USB input devices. Think tiny, disposable computing power.
• Power Source: Often a small LiPo battery or even USB power if the delivery method allows.
• Storage: Minimal, perhaps just enough to hold the script or payload.
• Enclosure: Whatever allows it to be disguised as something else – a pen, a USB drive, a small accessory.

For the defender, recognizing these components, or the *potential* for them to be hidden within seemingly ordinary objects, is paramount. It’s about developing a healthy skepticism towards unsolicited physical shipments, especially those with an unclear origin or an unusual weight/shape.

Payload Features: What to Watch For

The "magic" happens when the device is activated, typically by:

• Physical Connection: Plugging the device into a USB port.
• Power Activation: Simply connecting the battery.

Once active, the device can emulate a keyboard and rapidly type commands or execute pre-programmed scripts. This can range from stealing credentials to downloading more sophisticated malware. The key takeaway here is that a physical device brought into your environment can act as a direct conduit for digital compromise.

Code Overview: The Adversary's Script

While specific implementations vary, the underlying scripts often perform actions such as:

• Executing commands to download and run further stages of malware.
• Injecting malicious scripts into the browser.
• Exfiltrating sensitive data stored locally.
• Establishing a reverse shell back to the attacker's command-and-control (C2) server.

Understanding the *types* of commands that can be executed by such devices is crucial for threat hunting. Look for unusual outbound network connections, unexpected file creations, or processes launched without user interaction.

Project Setup and Build Parameters

The low cost implies using readily available development boards and open-source tools. The "build parameters" are less about complex compilation and more about configuring the device's firmware and the script it will execute. This includes defining the keyboard inputs, the timing of operations, and the target execution environment.

Testing the Payload: The Adversary's Validation

Testing involves ensuring the payload executes as intended on a target system. This might involve setting up a virtual machine mimicking a corporate laptop or a home PC. A successful test means the device can, for instance, open a browser to a malicious URL, execute a command-line tool, or exfiltrate data without obvious user intervention.

The Phishing Page: The Bait

Often, the payload's first action is to open a web browser to a convincing phishing page. This page mimics legitimate login portals (e.g., Microsoft 365, Google Workspace, internal company portals) designed to harvest credentials. The page itself is a critical component of the social engineering effort.

Reconnaissance and Data Exfiltration

The ultimate goal is data. The payload, once active, can be configured to:

• Scan for sensitive documents.
• Capture keystrokes (if a keylogger is deployed).
• Harvest stored credentials from browsers.
• Open a communication channel (reverse shell) for the attacker to perform deeper reconnaissance and lateral movement within the network.

Potential Improvements for the Attacker (and Threats to Anticipate)

While basic, this attack vector can be enhanced:

• Stealthier Enclosures: Disguising the device more effectively.
• Advanced Evasion: Incorporating techniques to bypass antivirus or endpoint detection.
• Pre-computation: Having payloads ready for specific target environments.
• Targeted Reconnaissance: Using minimal initial access to gather more specific intel for subsequent attacks.

Defensive Strategies: Fortifying Your Perimeter and Your People

The $10 phishing payload is a potent reminder that security is a multi-layered affair. Network firewalls and endpoint protection are vital, but human awareness and physical security protocols are equally critical.

Arsenal of the Operator/Analyst

• Hardware Analysis Tools: USB analyzers, logic analyzers for deep inspection of device behavior.
• Endpoint Detection & Response (EDR): Advanced solutions capable of detecting anomalous USB activity or script execution.
• Security Awareness Training Platforms: Tools to educate users about social engineering, including physical threats.
• Network Monitoring Tools: To detect suspicious outbound connections indicative of a reverse shell or data exfiltration.
• Physical Security Audits: Regular checks for unauthorized devices within secure areas.
• Threat Intelligence Feeds: Staying updated on emerging physical and digital attack vectors.

Taller Práctico: Fortaleciendo la Detección de Dispositivos USB Anómalos

1. Implementar Políticas de Control de Dispositivos USB

   Configura tu sistema operativo (Windows, macOS, Linux) para restringir o auditar el uso de dispositivos USB no autorizados. En Windows, esto puede hacerse mediante políticas de grupo (Group Policy) o herramientas de administración de endpoints.

   # Ejemplo conceptual para Windows Group Policy:
   # Computer Configuration -> Administrative Templates -> System -> Device Installation ->
   # Device Installation Restrictions -> Prevent installation of devices that match any of these IDs
   # Añadir IDs de dispositivos USB genéricos o desconocidos.
   

2. Configurar Monitoreo de Logs de Eventos USB

   Asegúrate de que los logs de eventos del sistema operativo que registran la conexión y desconexión de dispositivos USB estén habilitados y se envíen a un sistema centralizado de gestión de logs (SIEM).

   # Ejemplo conceptual para SIEM (KQL):
   DeviceEvents
   | where ActionType == "USBDeviceConnected" or ActionType == "USBDeviceDisconnected"
   | extend DeviceName = todynamic(DeviceDetails).Name, DeviceManufacturer = todynamic(DeviceDetails).Manufacturer
   | project Timestamp, DeviceName, DeviceManufacturer, AccountName, Computer
   | where DeviceManufacturer == "Unknown" or DeviceName startswith "Generic USB" or DeviceName startswith "Mass Storage Device" 
   

3. Implementar Bloqueo de Ejecución de Scripts Desconocidos

   Utiliza AppLocker (Windows) o mecanismos similares en otros sistemas operativos para prevenir la ejecución de scripts o ejecutables no autorizados que podrían ser desplegados por un payload USB.

   # Ejemplo conceptual de política de AppLocker para scripts:
   # Configurar reglas para permitir solo scripts firmados o de fuentes confiables.
   

4. Realizar Auditorías Físicas Regulares

   Incorpora la inspección física de áreas de trabajo, salas de reuniones y zonas de recepción como parte de tus rutinas de seguridad. Busca objetos extraños, especialmente aquellos conectados a puertos USB o que parezcan fuera de lugar.

Veredicto del Ingeniero: Un Recordatorio Siempre Necesario

This $10 payload strategy is less about the technical sophistication of the device itself and more about exploiting the human element and the physical security blind spots. It’s a stark, low-cost demonstration of how easily physical access can translate into digital compromise. For organizations, it underscores the need for robust security awareness training, strict control over physical access, and vigilant endpoint monitoring. It's a cheap attack with a potentially devastating payoff, making it a threat vector that cannot be ignored, regardless of budget.

Preguntas Frecuentes

¿Es legal crear este tipo de payloads?

Crear este tipo de dispositivos para uso personal en tus propios sistemas con fines educativos es generalmente legal. Sin embargo, usarlo en sistemas o redes sin autorización explícita constituye un delito grave, con severas consecuencias legales y profesionales.

¿Cómo puedo entrenar a mis empleados para reconocer estas amenazas?

La formación debe incluir ejemplos de ataques de ingeniería social, tanto digitales como físicos, enfatizando la importancia de verificar la fuente de dispositivos y correos electrónicos inesperados, y de reportar cualquier actividad sospechosa.

¿Qué tan efectivas son las defensas basadas en software contra estos ataques?

Las defensas de software, como el control de dispositivos USB y los EDR, son cruciales para detectar y prevenir la ejecución. Sin embargo, la conciencia del usuario sigue siendo la primera línea de defensa contra la ingeniería social.

¿Existen alternativas más seguras que los dispositivos USB para la transferencia de datos?

Para la transferencia de datos corporativos, se deben utilizar soluciones aprobadas y gestionadas centralmente, como sistemas de almacenamiento en red seguros, herramientas de transferencia de archivos cifradas, o servicios en la nube con controles de seguridad robustos.

El Contrato: Asegura tu Entorno Físico y Digital

Now that you've dissected the anatomy of this low-cost, mail-delivered phishing threat, the challenge is clear: translate this knowledge into actionable defense. Can you identify potential physical insertion points for malicious devices within your organization? Draft a brief internal policy (bullet points are fine) outlining steps for handling unsolicited physical items that might contain electronic components. How would you audit your office for such devices?

```

Anatomy of a $10 Phishing Payload: Defense Against Mail-Based Social Engineering

The digital realm is a battlefield, and sometimes the most effective weapons aren't forged in code, but mailed in plain sight. We're dissecting a low-cost ($10) phishing payload, a stark reminder of how physical mail can be weaponized for social engineering. This isn't about teaching you to craft such tools, but to understand their mechanics, identify their tell-tale signs, and harden your defenses against this subtle, yet potent, attack vector. Think of this as an autopsy of a digital ghost, revealing its methods so we can better guard the gate.

In the dark corners of the internet, where low-budget offensives can yield massive returns, the ingenuity behind a well-placed phishing attack is often underestimated. This particular method, revealed by Alex Lynd, leverages an inexpensive setup – roughly $10 – to deliver a potent blow. It’s a testament to the principle that sophisticated attacks don't always require sophisticated budgets, but rather clever exploitation of human psychology and readily available technology. Our goal here is not to replicate this, but to meticulously deconstruct it, understanding each component as a potential entry point for an adversary, and more importantly, a point of detection for the defender.

Understanding "WarShipping": The Physical Vector

The technique dubbed "WarShipping" bridges the physical and digital worlds. It involves sending a seemingly innocuous package, which contains the seed of a digital compromise. This bypasses traditional network perimeter defenses and directly targets end-users, exploiting their trust in physical mail and the allure of a "free" or "special" item.

The $10 Payload: Components and Analysis

At its core, this attack relies on extremely low-cost hardware and a basic understanding of how to trigger execution. The charm lies in its simplicity and the low financial barrier to entry.

Essential Tools for the Adversary (and your Detection Radar)

• Microcontroller/SBC: A cheap, programmable device capable of emulating USB input devices. Think tiny, disposable computing power.
• Power Source: Often a small LiPo battery or even USB power if the delivery method allows.
• Storage: Minimal, perhaps just enough to hold the script or payload.
• Enclosure: Whatever allows it to be disguised as something else – a pen, a USB drive, a small accessory.

For the defender, recognizing these components, or the *potential* for them to be hidden within seemingly ordinary objects, is paramount. It’s about developing a healthy skepticism towards unsolicited physical shipments, especially those with an unclear origin or an unusual weight/shape.

Payload Features: What to Watch For

The "magic" happens when the device is activated, typically by:

• Physical Connection: Plugging the device into a USB port.
• Power Activation: Simply connecting the battery.

Once active, the device can emulate a keyboard and rapidly type commands or execute pre-programmed scripts. This can range from stealing credentials to downloading more sophisticated malware. The key takeaway here is that a physical device brought into your environment can act as a direct conduit for digital compromise.

Code Overview: The Adversary's Script

While specific implementations vary, the underlying scripts often perform actions such as:

• Executing commands to download and run further stages of malware.
• Injecting malicious scripts into the browser.
• Exfiltrating sensitive data stored locally.
• Establishing a reverse shell back to the attacker's command-and-control (C2) server.

Understanding the *types* of commands that can be executed by such devices is crucial for threat hunting. Look for unusual outbound network connections, unexpected file creations, or processes launched without user interaction.

Project Setup and Build Parameters

The low cost implies using readily available development boards and open-source tools. The "build parameters" are less about complex compilation and more about configuring the device's firmware and the script it will execute. This includes defining the keyboard inputs, the timing of operations, and the target execution environment.

Testing the Payload: The Adversary's Validation

Testing involves ensuring the payload executes as intended on a target system. This might involve setting up a virtual machine mimicking a corporate laptop or a home PC. A successful test means the device can, for instance, open a browser to a malicious URL, execute a command-line tool, or exfiltrate data without obvious user intervention.

The Phishing Page: The Bait

Often, the payload's first action is to open a web browser to a convincing phishing page. This page mimics legitimate login portals (e.g., Microsoft 365, Google Workspace, internal company portals) designed to harvest credentials. The page itself is a critical component of the social engineering effort.

Reconnaissance and Data Exfiltration

The ultimate goal is data. The payload, once active, can be configured to:

• Scan for sensitive documents.
• Capture keystrokes (if a keylogger is deployed).
• Harvest stored credentials from browsers.
• Open a communication channel (reverse shell) for the attacker to perform deeper reconnaissance and lateral movement within the network.

Potential Improvements for the Attacker (and Threats to Anticipate)

While basic, this attack vector can be enhanced:

• Stealthier Enclosures: Disguising the device more effectively.
• Advanced Evasion: Incorporating techniques to bypass antivirus or endpoint detection.
• Pre-computation: Having payloads ready for specific target environments.
• Targeted Reconnaissance: Using minimal initial access to gather more specific intel for subsequent attacks.

Defensive Strategies: Fortifying Your Perimeter and Your People

The $10 phishing payload is a potent reminder that security is a multi-layered affair. Network firewalls and endpoint protection are vital, but human awareness and physical security protocols are equally critical.

Arsenal of the Operator/Analyst

• Hardware Analysis Tools: USB analyzers, logic analyzers for deep inspection of device behavior.
• Endpoint Detection & Response (EDR): Advanced solutions capable of detecting anomalous USB activity or script execution.
• Security Awareness Training Platforms: Tools to educate users about social engineering, including physical threats.
• Network Monitoring Tools: To detect suspicious outbound connections indicative of a reverse shell or data exfiltration.
• Physical Security Audits: Regular checks for unauthorized devices within secure areas.
• Threat Intelligence Feeds: Staying updated on emerging physical and digital attack vectors.

Practical Workshop: Strengthening Detection of Anomalous USB Devices

1. Implement USB Device Control Policies

   Configure your operating system (Windows, macOS, Linux) to restrict or audit the use of unauthorized USB devices. In Windows, this can be achieved through Group Policy or endpoint management tools.

   # Conceptual example for Windows Group Policy:
   # Computer Configuration -> Administrative Templates -> System -> Device Installation ->
   # Device Installation Restrictions -> Prevent installation of devices that match any of these IDs
   # Add IDs of generic or unknown USB devices.
   

2. Configure USB Event Log Monitoring

   Ensure that operating system event logs recording USB device connections and disconnections are enabled and forwarded to a centralized log management system (SIEM).

   # Conceptual example for SIEM (KQL):
   DeviceEvents
   | where ActionType == "USBDeviceConnected" or ActionType == "USBDeviceDisconnected"
   | extend DeviceName = todynamic(DeviceDetails).Name, DeviceManufacturer = todynamic(DeviceDetails).Manufacturer
   | project Timestamp, DeviceName, DeviceManufacturer, AccountName, Computer
   | where DeviceManufacturer == "Unknown" or DeviceName startswith "Generic USB" or DeviceName startswith "Mass Storage Device" 
   

3. Implement Unknown Script Execution Blocking

   Utilize AppLocker (Windows) or similar mechanisms on other operating systems to prevent the execution of unauthorized scripts or executables that could be deployed by a USB payload.

   # Conceptual example of AppLocker policy for scripts:
   # Configure rules to allow only signed scripts or scripts from trusted sources.
   

4. Conduct Regular Physical Audits

   Incorporate physical inspection of workspaces, meeting rooms, and reception areas as part of your security routines. Look for foreign objects, especially those connected to USB ports or appearing out of place.

Engineer's Verdict: A Necessary Reminder

This $10 payload strategy is less about the technical sophistication of the device itself and more about exploiting the human element and the physical security blind spots. It’s a stark, low-cost demonstration of how easily physical access can translate into digital compromise. For organizations, it underscores the need for robust security awareness training, strict control over physical access, and vigilant endpoint monitoring. It's a cheap attack with a potentially devastating payoff, making it a threat vector that cannot be ignored, regardless of budget.

Frequently Asked Questions

Is it legal to create these types of payloads?

Creating these types of devices for personal use on your own systems for educational purposes is generally legal. However, using them on systems or networks without explicit authorization constitutes a serious offense with severe legal and professional repercussions.

How can I train my employees to recognize these threats?

Training should include examples of social engineering attacks, both digital and physical, emphasizing the importance of verifying the source of unexpected devices or emails and reporting any suspicious activity.

How effective are software-based defenses against these attacks?

Software defenses, such as USB device control and EDR solutions, are critical for detecting and preventing execution. However, user awareness remains the first line of defense against social engineering.

Are there safer alternatives to USB devices for data transfer?

For corporate data transfer, approved and centrally managed solutions should be used, such as secure network storage, encrypted file transfer tools, or cloud services with robust security controls.

The Contract: Secure Your Physical and Digital Environment

Now that you've dissected the anatomy of this low-cost, mail-delivered phishing threat, the challenge is clear: translate this knowledge into actionable defense. Can you identify potential physical insertion points for malicious devices within your organization? Draft a brief internal policy (bullet points are fine) outlining steps for handling unsolicited physical items that might contain electronic components. How would you audit your office for such devices?

Anatomy of the Love Bug: Understanding and Defending Against Mass-Spreading Malware

Published: October 20, 2021

The digital world hums with whispers, some of promise, others of peril. On October 20, 2021, a particularly infamous ghost from the past resurfaced in the narrative around malware: the "I Love You" virus. This isn't a tale of creation, but of dissection. We're not here to build the phantom, but to understand its spectral signature and fortify our defenses against its modern kin.

The digital landscape is a battleground, and understanding the enemy's tactics is paramount for survival. For years, researchers and defenders have studied the 'I Love You' virus, a piece of code that, despite its seemingly innocuous name, wreaked havoc on millions of computers. This email worm, also known as Love Bug or Love Letter, exploited social engineering and a fundamental trust in shared information to propagate at an unprecedented scale. Its success wasn't just in its technical execution, but in its mastery of human psychology.

The 'Love Bug' Phenomenon: A Historical Perspective

Emerging in May 2000, the 'I Love You' virus arrived disguised as a love letter, attached to an email with the subject line "ILOVEYOU". The attachment, a Visual Basic script (`.vbs`), was designed to execute when opened. Its payload was twofold: it would overwrite various file types on the victim's system, rendering them unrecoverable, and then, its most potent weapon, it would use the victim's Microsoft Outlook address book to email itself to all their contacts. This viral spread, amplified by the human desire to connect and share, overwhelmed mail servers and disrupted businesses worldwide. It was a stark lesson in how a simple social engineering trick, combined with an efficient propagation mechanism, could cause global chaos.

Anatomy of an Exploit: How the 'Love Bug' Worked

The 'I Love You' virus was a masterclass in deceptive simplicity. Its core components were:

• Social Engineering: The email's subject and attachment name appealed to a basic human emotion, overcoming caution. The perceived legitimacy of receiving a love letter from a friend or acquaintance bypassed many security awareness protocols prevalent at the time.
• Visual Basic Script (VBS): VBS was a scripting language commonly used within Windows. Its execution was often enabled by default in older versions of Windows and Internet Explorer, making it an easy vector for malicious code.
• File Overwriting Payload: Upon execution, the script searched for specific file types (like .doc, .txt, .jpg, .jpeg, .bmp, .gif, .mp3) and overwrote them with a copy of itself. This was the destructive component, causing immediate data loss.
• Worm Capabilities: The true genius, and terror, of the 'Love Bug' lay in its self-propagation. It accessed the user's Outlook address book and sent copies of the malicious email to every contact. This exponential growth, leveraging the trust within networks, was its defining characteristic.

Defensive Posture: Lessons Learned and Modern Mitigations

While the 'Love Bug' is a relic of the early 2000s, its principles are echoed in countless modern phishing and malware attacks. The techniques of social engineering and rapid, automated propagation remain prevalent. To defend against such threats today, a multi-layered approach is essential:

1. Fortifying the Human Element: Security Awareness Training

The most effective malware often exploits human trust. Regular and comprehensive security awareness training is critical. Employees must be educated on:

• Recognizing phishing attempts: Unusual sender addresses, urgent or suspicious requests, poor grammar, and unexpected attachments.
• The dangers of opening unsolicited attachments or clicking on suspicious links.
• The importance of verifying information through alternative channels.

Veredicto del Ingeniero: User vigilance is your first and often last line of defense. If a user can spot a fake, the attack often dies before it even begins.

2. Implementing Technical Controls: A Robust Security Stack

Technology plays a vital role in filtering out threats before they reach the user:

• Email Filtering: Advanced email security gateways can detect and block malicious attachments, suspicious links, and phishing attempts based on reputation, content analysis, and behavioral patterns.
• Antivirus/Anti-Malware Software: Ensure all endpoints and servers have up-to-date antivirus and anti-malware solutions with real-time scanning enabled. These can detect known malware signatures and some heuristic behaviors.
• Endpoint Detection and Response (EDR)/Extended Detection and Response (XDR): For more advanced threats, EDR/XDR solutions provide continuous monitoring, threat hunting capabilities, and automated response actions on endpoints.
• Application Whitelisting: By only allowing approved applications to run, you can prevent unknown or malicious scripts from executing, including VBS files.
• Principle of Least Privilege: Users should only have the permissions necessary to perform their job functions. This limits the damage an attacker can do if an account is compromised or malware is executed.

3. Patch Management and System Hardening

While 'Love Bug' exploited older vulnerabilities, the principle of keeping systems patched is timeless. Regularly update operating systems, applications, and firmware to fix known security flaws that malware could exploit.

4. Network Segmentation

Segmenting your network can help contain the spread of malware. If one segment is compromised, network segmentation can prevent the threat from easily moving to other critical areas of your infrastructure.

Taller Práctico: Simulating and Detecting Worm Behavior

While we will not replicate the 'Love Bug' itself due to its destructive nature, we can simulate and detect worm-like propagation within a controlled, isolated lab environment. This exercise is for educational purposes only and must be performed on systems you own and have explicit permission to test.

1. Setup Isolated Lab: Create a virtual network (e.g., using VirtualBox or VMware) with several virtual machines (e.g., Windows 7, Windows 10). Ensure these VMs are NOT connected to your host machine's network or the internet.
2. Develop a Simple Dropper Script (Hypothetical): Imagine a script that, once executed on VM A, attempts to copy itself to a shared folder accessible by VM B and then triggers a simulated execution on VM B. In a real scenario, this could involve network shares, scheduled tasks, or exploiting network services.
3. Deploy Network Monitoring: Use network analysis tools within your isolated lab (e.g., Wireshark) to capture traffic between VMs. Look for unusual traffic patterns, such as a VM attempting to connect to multiple other machines on uncharacteristic ports or attempting to access file shares.
4. Configure Log Analysis: On each VM, ensure logging is enabled for process execution and network connections.
5. Simulate Execution and Monitor: Run the hypothetical dropper script on VM A. Observe the network traffic and logs on VM B and other VMs.
6. Detection Strategy: In a real environment, you would look for abnormal outbound connections from workstations, creation of suspicious scheduled tasks, mass file modifications, and unexpected email relay activity. EDR solutions are designed to detect these behaviors.

Disclaimer: This practical exercise is purely for understanding the *mechanisms* of worm propagation and detection. Never execute unknown scripts or attempt to replicate malware behavior on live systems. Always use isolated, controlled environments for security research.

Arsenal del Operador/Analista

To effectively defend against modern threats, equipping yourself with the right tools and knowledge is non-negotiable. Consider these essential components for your security arsenal:

• Email Security Gateway: Solutions like Proofpoint, Mimecast, or Microsoft Defender for Office 365 are crucial for filtering malicious emails.
• Endpoint Detection and Response (EDR): SentinelOne, CrowdStrike Falcon, or Microsoft Defender for Endpoint offer advanced threat detection and response capabilities.
• Security Information and Event Management (SIEM): Splunk, ELK Stack (Elasticsearch, Logstash, Kibana), or QRadar for centralized logging and analysis.
• Network Traffic Analysis (NTA): Tools like Zeek (formerly Bro) or Suricata can help monitor and analyze network traffic for anomalies.
• Security Awareness Training Platforms: KnowBe4, Cofense, or Proofpoint Security Awareness Training provide resources to educate users.
• Books: "The Art of Memory Forensics" by Michael Hale Ligh, Andrew Case, Jamie Levy, and James (Jim) Foster for in-depth analysis; "Applied Network Security Monitoring" by Chris Sanders and Jason Smith for practical network defense.
• Certifications: CompTIA Security+, GIAC Certified Incident Handler (GCIH), or Certified Information Systems Security Professional (CISSP) provide foundational and advanced knowledge.

Preguntas Frecuentes

Q1: Was the 'I Love You' virus capable of stealing data?

A1: The primary destructive payload of the original 'I Love You' virus was overwriting files. While subsequent variants evolved, the original was focused on propagation and data destruction, not direct data exfiltration.

Q2: Can modern antivirus software detect the 'I Love You' virus?

A2: Yes, the original 'I Love You' virus (and its known variants) are signatured by virtually all reputable antivirus and anti-malware solutions. However, the *techniques* it employed are still relevant for new, unknown malware.

Q3: How did the 'I Love You' virus spread so quickly?

A3: It exploited the trust inherent in email communication and address books. By sending itself to all contacts of an infected user, and appealing to human curiosity, it achieved exponential growth.

Q4: What is the most important lesson from the 'I Love You' virus for today's security?

A4: The enduring power of social engineering and the critical need for user awareness training, alongside robust technical defenses, cannot be overstated. Malware evolves, but exploiting human psychology remains a constant threat.

El Contrato: Fortaleciendo Tu Resiliencia Digital

The 'I Love You' virus serves as a potent reminder that our digital defenses are only as strong as our weakest link. While we can implement firewalls, intrusion detection systems, and sophisticated anti-malware, the human element remains a critical vulnerability, and a vital asset. Your contract with security is a perpetual one. Today, your challenge is to analyze your organization's current security awareness training program.

Your Task: Consider a scenario where a new, highly convincing phishing email appears, mimicking internal HR communications and urging employees to click a link to update their details. How would your current training program prepare your users to identify and report such an attack? What specific training modules or simulations would you implement or enhance to counter this persistent threat vector, ensuring your organization resists the siren call of deceptive malware?

The Insider Threat: Anatomy of Your Most Dangerous Vulnerability

The flickering cursor on the terminal screen was my only companion, reflecting the cold dread that settled in my gut. A log entry, anomalous and insidious, whispered from the depths of the server. It wasn't a random intrusion; this was a phantom in the machine, born from within. Today, we're not patching a system; we're dissecting the most potent threat any organization can face: the insider.

In the shadowy corners of the digital realm, where data flows like a dark river, vigilance is paramount. But what happens when the threat isn't lurking outside the firewall, but already inside, sipping coffee at the water cooler? This isn't about shadowy hackers; it's about the employees, the trusted individuals who, intentionally or not, can wield catastrophic power. This report peels back the layers of the insider threat, revealing its anatomy and, more importantly, how to build defenses against it.

This analysis is for informational and educational purposes only. We do not promote, encourage, support, or condone any malicious activity.

For those seeking to deepen their understanding of cybersecurity and the latest threat landscapes, the International Institute of Cyber Security offers invaluable resources. Visit their official website for comprehensive insights and subscribe to their newsletter for real-time updates. Don't get caught in the dark; stay informed.

Table of Contents

• Understanding the Insider Threat: More Than Just Code
• Types of Insider Threats: The Spectrum of Malice
• Reconnaissance and Access: The Attacker's Playbook
• Data Exfiltration and Impact: The Fallout
• Defensive Strategies: Building Fortifications
• Detection and Response: The Blue Team's Arsenal
• Arsenal of the Operator/Analyst
• FAQ: Insider Threats
• The Contract: Securing the Perimeter

Understanding the Insider Threat: More Than Just Code

The digital perimeter is a myth. While firewalls, intrusion detection systems, and endpoint protection are crucial, they are often circumvented by those who possess legitimate access. The insider threat is the silent killer, the vulnerability that keeps seasoned security professionals awake at night. It can manifest from a disgruntled employee seeking revenge, a careless individual making a critical error, or a compromised account used by an external adversary.

Understanding the motivations and methods behind insider threats is the first step in building a robust defense. It requires a shift in perspective—from solely focusing on external adversaries to also scrutinizing the internal landscape. Are your access controls merely a suggestion, or are they enforced with the rigor of a disciplined operator?

Types of Insider Threats: The Spectrum of Malice

Insider threats aren't monolithic. They exist on a spectrum, each with distinct characteristics and implications:

• Malicious Insiders: These individuals intentionally seek to harm the organization. Their motives can range from financial gain, espionage, revenge, or ideology. They leverage their authorized access for nefarious purposes, often planning their actions meticulously.
• Negligent Insiders: This is perhaps the most common and often overlooked category. These employees are not malicious but pose a significant risk due to carelessness, lack of security awareness, or human error. Examples include falling for phishing scams, mishandling sensitive data, or misconfiguring systems.
• Compromised Insiders: In this scenario, an employee's credentials or access are hijacked by an external attacker. While the employee may be unaware, their account becomes the vector for an attack. This blurs the line between external and internal threats and highlights the critical importance of robust identity and access management.

Each type demands a tailored approach to detection and mitigation. A one-size-fits-all strategy will inevitably leave gaps that adversaries, both internal and external, will exploit.

Reconnaissance and Access: The Attacker's Playbook

Even with legitimate access, an insider threat actor typically follows a pattern similar to external attackers: reconnaissance, gaining elevated privileges, and then executing their objective. They might start by mapping network shares, identifying critical databases, or observing user activity to understand security protocols. This internal reconnaissance can be far more effective than external OSINT, as it's conducted from a trusted position.

"The most effective way to destroy a system is from within." - A fundamental principle whispered in secure operations centers worldwide.

For malicious insiders, understanding the network topology and data locations is paramount. They might use existing tools and scripts already present on the network, making their activities harder to distinguish from normal operations. For negligent insiders, this phase is often accidental – clicking a malicious link that initiates unauthorized downloads or grants access to malware.

The key for defenders is to monitor for anomalous access patterns. Are users accessing files they don't typically interact with? Are they downloading large volumes of data outside of normal business hours? These are the subtle whispers that can betray intent or negligence.

Data Exfiltration and Impact: The Fallout

Once access is established and objectives are identified, the next phase is data exfiltration or system disruption. This can involve copying sensitive intellectual property, customer databases, PII, or financial records. The impact of such an act can be devastating, leading to:

• Financial Losses: Direct theft of funds, regulatory fines, legal fees, and remediation costs.
• Reputational Damage: Loss of customer trust, negative media attention, and a tarnished brand image that can take years to repair.
• Operational Disruption: Sabotage of critical systems, downtime, and a halt to business operations.
• Loss of Competitive Advantage: Theft of trade secrets, research, and development plans.

The fallout from an insider threat can be far more damaging than a typical external breach because the trust has been broken. The adversary already knows the layout, the protocols, and the sensitive points of the organization.

Defensive Strategies: Building Fortifications

Defending against insider threats requires a multi-layered approach that combines technical controls with robust policies and a strong security-aware culture.

1. Principle of Least Privilege: Grant users only the minimum access necessary to perform their job functions. Regularly review and revoke unnecessary permissions.
2. Access Control and Monitoring: Implement strong authentication mechanisms (MFA is non-negotiable). Log all access to sensitive data and systems, and actively monitor these logs for suspicious activity.
3. Data Loss Prevention (DLP) Solutions: Deploy DLP tools to monitor, detect, and block unauthorized attempts to transfer sensitive data outside the organization via email, cloud storage, or USB drives.
4. Security Awareness Training: Regular, engaging training for all employees on identifying phishing attempts, understanding data handling policies, and recognizing social engineering tactics is crucial, especially for mitigating negligent insider threats.
5. Behavioral Analytics: Utilize User and Entity Behavior Analytics (UEBA) tools to establish baseline user behavior and flag anomalies that could indicate malicious or compromised activity.
6. Background Checks and Vetting: Implement thorough background checks for employees in sensitive positions.
7. Incident Response Plan: Have a well-defined incident response plan specifically addressing insider threats, outlining steps for investigation, containment, and remediation.

Your security posture is only as strong as its weakest link, and often, that link is human. Investing in training and establishing clear, enforced policies are prerequisites for any effective technical control.

Detection and Response: The Blue Team's Arsenal

When an insider threat is suspected or detected, the blue team must act swiftly and methodically. The goal is to contain the damage, preserve evidence for potential legal action, and understand the full scope of the compromise.

Detection: Whispers in the Logs

Detection often relies on correlating various data points:

• Access Logs: Monitoring for unusual login times, locations, or failed access attempts on sensitive resources.
• File Access Logs: Tracking access to critical files, especially large downloads or mass deletions.
• Network Traffic Analysis: Identifying unusual data outbound traffic patterns, especially to unknown or suspicious destinations.
• Endpoint Monitoring: Detecting the installation of unauthorized software, execution of suspicious scripts, or the use of removable media on critical systems.
• DLP Alerts: Investigating alerts generated by DLP systems flagging policy violations.

Response: Containing the Phantom

1. Immediate Containment: If a malicious insider is confirmed, revoke their access immediately. This might involve disabling accounts, revoking VPN access, and confiscating company assets.
2. Evidence Preservation: Secure all relevant logs, system images, and network traffic captures. Ensure the chain of custody is maintained for forensic analysis.
3. Forensic Investigation: Conduct a thorough forensic analysis to understand the extent of the breach, identify the specific data compromised, and determine the perpetrator's methods.
4. Remediation: Based on the investigation, implement necessary security improvements, patch vulnerabilities, and update policies and training.
5. Legal and HR Involvement: Engage legal counsel and HR departments throughout the process, especially if disciplinary action or legal proceedings are anticipated.

The response must be decisive, guided by policy, and focused on minimizing further damage while gathering actionable intelligence.

Arsenal of the Operator/Analyst

To effectively combat insider threats, operators and analysts need a specialized set of tools and knowledge. While no single tool can solve the problem, this arsenal enhances detection, investigation, and mitigation capabilities:

• SIEM (Security Information and Event Management) Systems: Splunk, ELK Stack (Elasticsearch, Logstash, Kibana), QRadar. Essential for aggregating and analyzing logs from various sources.
• DLP Solutions: Symantec DLP, Forcepoint DLP, Microsoft Purview. To monitor and control data movement.
• UEBA Tools: Exabeam, Securonix, Gurucul. For baseline behavior analysis and anomaly detection.
• Endpoint Detection and Response (EDR): CrowdStrike Falcon, Carbon Black, Microsoft Defender for Endpoint. For deep visibility into endpoint activities.
• Forensic Tools: FTK Imager, Autopsy, Volatility Framework (for memory analysis). Critical for evidence preservation and investigation.
• Network Traffic Analysis (NTA): Wireshark, Zeek (Bro). To inspect network communications.
• Certifications: GIAC Certified Incident Handler (GCIH), Certified Information Systems Security Professional (CISSP), CompTIA Security+. These provide the foundational knowledge and demonstrate expertise.
• Key Literature: "Insider Threats: The Corporate Risk" by Joanna McLane, "The Art of Network Tracing" by Michael Lachance.

Investing in the right tools and continuous professional development is not an expense; it's a critical investment in your organization's survival. For advanced training in threat hunting and incident response, consider exploring comprehensive programs like the one that can be found through advanced OSCP training guides, refining your ability to dissect complex security incidents.

FAQ: Insider Threats

Q1: What is the most common type of insider threat?

A1: Negligent insiders, often due to human error or lack of security awareness, pose the most frequent risk.

Q2: How can an organization prevent insider threats?

A2: A combination of strong access controls, continuous monitoring, robust data loss prevention, regular security awareness training, and fostering a positive security culture is key to prevention.

Q3: Can insider threats be detected by traditional security tools?

A3: To some extent, yes. Traditional tools can detect anomalies, but specialized solutions like UEBA provide deeper insights into user behavior that are critical for detecting sophisticated insider threats.

Q4: Is it possible to completely eliminate insider threats?

A4: No, complete elimination is extremely difficult. The focus should be on minimizing the risk through proactive measures, swift detection, and effective response.

The Contract: Securing the Perimeter

The digital fortress you've painstakingly built is only as strong as your weakest entry point. While external fortresses are constantly under siege, the most dangerous breach often comes from within. You've seen the anatomy of the insider threat: the motivations, the methods, and the devastating impact. Now, the contract is yours to fulfill.

Your Challenge: Imagine you are the CISO of a financial institution. A recent audit flagged unusual access patterns to sensitive customer data by a long-term employee in the finance department. While no data exfiltration has been definitively proven, the activity is highly anomalous. Outline a prioritized three-step response plan to investigate this potential insider threat, focusing on detection, evidence preservation, and containment. Justify each step with a clear rationale, referencing the principles discussed in this report. Detail what specific logs and system events you would immediately seek to collect and analyze.

The clock is ticking. The integrity of your data, the trust of your clients, and the very survival of your organization depend on your ability to act decisively and intelligently. Show me your plan.

For more hacking info and tutorials visit: https://ift.tt/O8QB7uL

Follow us on our social networks:

• Twitter: https://twitter.com/iicsorg/
• Facebook: https://ift.tt/X2SrcVj
• Instagram: https://ift.tt/b96tBis

Alternate Channel: https://www.youtube.com/channel/UCZAyWudV5Rss01d8MjXbG7Q

NFT Store: https://mintable.app/u/cha0smagick

Follow us on our social networks:

• Twitter: https://twitter.com/freakbizarro
• Facebook: https://web.facebook.com/sectempleblogspotcom/
• Discord: https://discord.gg/5SmaP39rdM

Visit other blogs in our network:

• https://elantroposofista.blogspot.com/
• https://gamingspeedrun.blogspot.com/
• https://skatemutante.blogspot.com/
• https://budoyartesmarciales.blogspot.com/
• https://elrinconparanormal.blogspot.com/
• https://freaktvseries.blogspot.com/