BalCCon2k19 - Chris Kubecka - The Road to Hell is Paved with Bad Passwords

### Overview In this keynote address at BalCCon2k19, Chris Kubecka recounts an incident response investigation originating in 2014 at the Royal Saudi Arabian Embassy in The Hague. What began as a seemingly small email compromise escalated into a multi-million-dollar extortion scheme, physical and electronic surveillance, landmark bomb threats, and international diplomatic friction. Kubecka illustrates how a trivial digital security failure—an embassy email account secured by the password `123456`—can intersect with volatile geopolitical rivalries and escalate to threaten human lives.

### Key Topics - **The Initial Breach and Infrastructure Flaws:** When called in to assist, Kubecka discovered that the official business email account had been secured with `123456`. The embassy relied on an outdated residential internet modem, lacked basic digital hygiene, used discontinued security software (Microsoft Essentials), and had all business emails transmitted in cleartext without encryption. Furthermore, physical security was lacking, with server racks located in open hallways and security cameras pointing away. - **Escalation and Extortion Demands:** The threat actor initiated extortion with a $200 demand directed at an individual requesting a visa, attempting to leverage MoneyGram and framing the ambassador's secretary. The attacker subsequently claimed affiliation with ISIS and expanded extortion demands to $25,000 sent to GCC nations and Turkey, eventually escalating demands to $35 million and then $50 million. - **Operational Pitfalls and Diplomatic Complications:** When Dutch diplomatic police attempted to alert regional embassies, they inadvertently CC'd instead of BCC'd the back-channel distribution list, allowing the attacker—who still retained network access—to reply-all and further taunt officials. The attacker also breached the personal Gmail account of the ambassador's secretary. - **Physical Threats and Landmark Bomb Threat:** The extortion culminated in a threat to detonate explosives at the Kurhaus in Scheveningen during a Saudi National Day celebration attended by more than 400 dignitaries, ambassadors, staff, and Dutch royalty. This triggered direct intervention by the Netherlands counter-terrorism and special intervention units. - **Geopolitical Backdrop and Espionage:** The speaker details concurrent hostile actions in The Hague, including suspected state-sponsored surveillance by the neighboring Yemeni embassy (which had been purchased in cash, allegedly with Iranian backing). Incidents included surveillance drones, attempts to physically access and bend fiber optic cabling, cafeteria infiltration, and approaches by Turkish cultural attachés acting as intelligence operatives.

### Technical Details - **Access Persistence & Malware:** The initial investigation identified a commercial off-the-shelf rootkit on the embassy's business network, assessed as chosen for plausible deniability. Even after the primary password was reset, the attacker maintained persistent access through backend email forwarding rules on the compromised account. - **Network Separation:** The embassy maintained separate networks for general business and intelligence gathering. Kubecka noted the intelligence network was isolated with distinct connections, which investigators had to avoid probing to respect Saudi intelligence jurisdiction. - **Attribution and Hops:** After obtaining permission to analyze an embassy laptop offsite, investigators mapped communication hops through non-Dutch external accounts (including Yandex). Coordinating diplomatically with international computer emergency response teams, investigators traced hops to pinpoint a residential neighborhood in The Hague. - **Insider Threat Identification:** The physical and digital evidence pointed to an educated embassy insider holding diplomatic immunity from an influential family. Because standard prosecution or simple deportation was politically complex, the individual was reassigned abroad to a high-risk area, where he was subsequently killed by a car bomb.

### Takeaways - **Digital Security vs. Day-to-Day IT:** Basic IT administration is not equivalent to digital defense; embassies and high-profile organizations must conduct formal risk assessments, patch management, and enforce physical network controls. - **Human Impact of Weak Passwords:** Trivial configuration flaws like default or weak credentials (`123456`) can cascade into critical geopolitical emergencies, mass death threats, and physical loss of life. - **Operational Composure:** During high-stakes crisis response involving potential kidnapping lists or personal threats, responders must avoid panic, follow structured playbooks, maintain meticulous documentation, and stay grounded.