Regarding Zoom Conference call

In case you didn't get the last email. Pay attention now.
You have used Zoom recently. And I have very unfortunate news for you.
I'll give you some background on what happened.

There was a zero day security vulnerability on Zoom app, that allowed me a full time access to your camera and some other metadata on your account.
Basically, you were hacked.
And as you can imagine in your worst dreams, I have made a footage with you as a main actor.
Where you work on yourself (perform sex act to be clear). Having fun is ok with me, but is not ok with your reputation.

Please dont blame me or yourself for this. You couldn't know that the camera was working.
I'm sure you don't want to be the next Jeffrey Toobin and get embarrassed in front of all your friends, family and colleagues.
You should get this very clear, I will send this video to all your contacts if I dont get paid.
Are you wondering how I got your contacts and emails? Through the same exploit, zoom app allowed me to extract all sensitive info from your device.

So here is what we will do. You pay me $2000 in bitcoin, and nothing of this will happen. You have 2 days to make the payment.
After I get the money, I will delete the footage and information about you. The amount is not negotiable.
Send 0.11 Bitcoin (less than 2k USD at the current exchange rate) to my wallet 15AKuZPGMkdrpTGJwb87tnaqSyp91JSeeB
Having trouble with buying bitcoin? Just google on how to buy it, it's very easy to use and anonymous.
P.S. Don't try to report this to the police, I use TOR and bitcoin can't be traced. Do not email me back. If you do something stupid, I will distribute the video.
Good luck. Don’t stress.

Commercial offer

Hi!

Unfortunately, I have some bad news for you.
Several months ago, I got access to the device you are using to browse the internet.
Since that time, I have been monitoring your internet activity.

Being a regular visitor of adult websites, I can confirm that it is you who is responsible for this.
To keep it simple, the websites you visited provided me with access to your data.

I've uploaded a Trojan horse on the driver basis that updates its signature several times per day, to make it impossible for antivirus to detect it. Additionally, it gives me access to your camera and microphone.
Moreover, I have backed-up all the data, including photos, social media, chats and contacts.

Just recently, I came up with an awesome idea to create the video where you cum in one part of the screen, while the video was simultaneously playing on another screen. That was fun!

Rest assured that I can easily send this video to all your contacts with a few clicks, and I assume that you would like to prevent this scenario.

With that in mind, here is my proposal:
Transfer the amount equivalent to 1350 USD to my Bitcoin wallet, and I will forget about the entire thing. I will also delete all data and videos permanently.

In my opinion, this is a somewhat modest price for my work.
You can figure out how to purchase Bitcoins using search engines like Google or Bing, seeing that it's not very difficult.

My Bitcoin wallet (BTC): 14X4HmqJKQWCrNY9gthXVyPRa6KZhEkkmT

You have 48 hours to reply and you should also bear the following in mind:

It makes no sense to reply me - the address has been generated automatically.
It makes no sense to complain either, since the letter along with my Bitcoin wallet cannot be tracked.
Everything has been orchestrated precisely.

If I ever detect that you mentioned anything about this letter to anyone - the video will be immediately shared, and your contacts will be the first to receive it. Following that, the video will be posted on the web!

P.S. The time will start once you open this letter. (This program has a built-in timer).

Good luck and take it easy! It was just bad luck, next time please be careful.

Re:(4) The base of businessmen from all over the world. / База бизнесменов со всего Мира.

Only for you [uxpvn]
And only we have only a few days![zrojszt]
A unique base of businessmen from 170 countries of the world[eliwdo]
at a symbolic price of only $500 + bonus.[hjiohgx]
The database contains 300million e-mail addresses.[qmuqqtrp]
Write to us. We agree. email.business.group@gmail.com [hozwtmng]
With respect to you.[lwvyz]
Business groups. [qdqra]
[cqpzcl]
[zpyxm]
Только для Вас [hwwxrpwp]
И только у нас и только несколько дней![wwvrr]
Уникальная база бизнесменов со 170 стран Мира[psmnjoq]
по символической цене всего за $500 + bonus.[luzyyu]
База содержит 300миллионов e-mail адресов.[wzmmn]
Пишите нам. Договоримся. email.business.group@gmail.com [uqspor]
С уважением к Вам.[pllmzrvm]
Бизнес групп.7753191 [zyruprur]

Regarding Zoom Conference call

Hi. You will find this important.
You have used Zoom some time ago. And I have very unfortunate news for you.
I'll give you some background on what happened.

There was a zero day security vulnerability on Zoom app, that allowed me a full time access to your camera and some other metadata on your account.
I had access to your camera ALL the time, even when Zoom app was closed. Basically, your device was hacked and remotely controlled.
And as you can imagine in your worst dreams, I have made a footage with you as a leading actor.
In the video you can be seen performing sexual act.
Having fun is ok with me, but is not ok with your reputation.

Please dont blame me or yourself for this. You couldn't know that the camera was working.
I'm sure you don't want to be the next Jeffrey Toobin and get embarrassed in front of all your friends, family and colleagues.
You should get this very clear, I will send this video to all your contacts if I dont get paid.
Are you wondering how I got your contacts and emails? Through the same exploit, zoom app allowed me to extract all sensitive info from your device.

So here is what we will do. You pay me $2000 in bitcoin, and nothing of this will happen. You have 2 days to make the payment.
After I get the money, I will delete the footage and information about you. The amount is not negotiable.
Send 0.13 Bitcoin (less than 2k USD at the current exchange rate) to my wallet 1KJ3ZrhrkXBVjGyAU635sapjLpLSFgpqYe
Having trouble with buying bitcoin? Just google on how to buy it, it's very easy to use and anonymous.
P.S. Don't try to report this to the police, I use TOR and bitcoin can't be traced. Do not email me back. If you do something stupid, I will distribute the video.
Good luck. Don’t stress.

Commercial offer

Hi!

Unfortunately, I have some bad news for you.
Several months ago, I got access to the device you are using to browse the internet.
Since that time, I have been monitoring your internet activity.

Being a regular visitor of adult websites, I can confirm that it is you who is responsible for this.
To keep it simple, the websites you visited provided me with access to your data.

I've uploaded a Trojan horse on the driver basis that updates its signature several times per day, to make it impossible for antivirus to detect it. Additionally, it gives me access to your camera and microphone.
Moreover, I have backed-up all the data, including photos, social media, chats and contacts.

Just recently, I came up with an awesome idea to create the video where you cum in one part of the screen, while the video was simultaneously playing on another screen. That was fun!

Rest assured that I can easily send this video to all your contacts with a few clicks, and I assume that you would like to prevent this scenario.

With that in mind, here is my proposal:
Transfer the amount equivalent to 1500 USD to my Bitcoin wallet, and I will forget about the entire thing. I will also delete all data and videos permanently.

In my opinion, this is a somewhat modest price for my work.
You can figure out how to purchase Bitcoins using search engines like Google or Bing, seeing that it's not very difficult.

My Bitcoin wallet (BTC): 16EuKQaCEEeba1Us68P9RwKjc8HTT4zWRR

You have 48 hours to reply and you should also bear the following in mind:

It makes no sense to reply me - the address has been generated automatically.
It makes no sense to complain either, since the letter along with my Bitcoin wallet cannot be tracked.
Everything has been orchestrated precisely.

If I ever detect that you mentioned anything about this letter to anyone - the video will be immediately shared, and your contacts will be the first to receive it. Following that, the video will be posted on the web!

P.S. The time will start once you open this letter. (This program has a built-in timer).

Good luck and take it easy! It was just bad luck, next time please be careful.

Save Your Cloud: DoS On VMs In OpenNebula 4.6.1

This is a post about an old vulnerability that I finally found the time to blog about. It dates back to 2014, but from a technical point of view it is nevertheless interesting: An XML parser that tries to fix structural errors in a document caused a DoS problem.

All previous posts of this series focused on XSS. This time, we present a vulnerability which is connected another Cloud Management Platform: OpenNebula. This Infrastructure-as-a-Service platform started as a research project in 2005. It is used by information technology companies like IBM, Dell and Akamai as well as academic institutions and the European Space Administrations (ESA). By relying on standard Linux tools as far as possible, OpenNebula reaches a high level of customizability and flexibility in hypervisors, storage systems, and network infrastructures. OpenNebula is distributed using the Apache-2 license.


OpenNebula offers a broad variety of interfaces to control a cloud. This post focuses on Sunstone, OpenNebula's web interface (see Figure 1).

Figure 1: OpenNebula's Sunstone Interface displaying a VM's control interface

Before OpenNebula 4.6.2, Sunstone had no Cross-Site Request Forgery (CSRF) protection. This is a severe problem. Consider an attacker who lures a victim into clicking on a malicious link while being logged in at a private cloud. This enables the attacker to send arbitrary requests to the private cloud through the victims browser. However, we could find other bugs in OpenNebula that allowed us to perform much more sophisticated attacks.

Denial-of-Service on OpenNebula-VM

At its backend, OpenNebula manages VMs with XML documents. A sample for such an XML document looks like this:

<VM>
   <ID>0</ID>
   <NAME>My VM</NAME>
   <PERMISSIONS>...</PERMISSIONS>
   <MEMORY>512</MEMORY>
   <CPU>1</CPU>
   ...
</VM>

OpenNebula 4.6.1 contains a bug in the sanitization of input for these XML documents: Whenever a VM's name contains an opening XML tag (but no corresponding closing one), an XML generator at the backend automatically inserts the corresponding closing tag to ensure well-formedness of the resulting document. However, the generator outputs an XML document that does not comply with the XML schema OpenNebula expects. The listing below shows the structure that is created after renaming the VM to 'My <x> VM':

<VM>
   <ID>0</ID>
   <NAME>My <x> VM</x>
      <PERMISSIONS>...</PERMISSIONS>
      <MEMORY>512</MEMORY>
      <CPU>1</CPU>
      ...
   </NAME>
</VM>

The generator closes the <x> tag, but not the <NAME> tag. At the end of the document, the generator closes all opened tags including <NAME>.

OpenNebula saves the incorrectly generated XML document in a database. The next time the OpenNebula core retrieves information about that particular VM from the database the XML parser is mixed up and runs into an error because it only expects a string as name, not an XML tree. As a result, Sunstone cannot be used to control the VM anymore. The Denial-of-Service attack can only be reverted from the command line interface of OpenNebula.

This bug can be triggered by a CSRF-attack, which means that it is a valid attack against a private cloud: By luring a victim onto a maliciously crafted website while logged in into Sunstone, an attacker can make all the victim's VMs uncontrollable via Sunstone. A video of the attack can be seen here: