Three Top Russian Cybercrime Forums Hacked (krebsonsecurity.com) 26
tsu doh nimh shares a report: Over the past few weeks, three of the longest running and most venerated Russian-language online forums serving thousands of experienced cybercriminals have been hacked. In two of the intrusions, the attackers made off with the forums' user databases, including email and Internet addresses and hashed passwords. Members of all three forums are worried the incidents could serve as a virtual Rosetta Stone for connecting the real-life identities of the same users across multiple crime forums. On Tuesday, someone dumped thousands of usernames, email addresses and obfuscated passwords on the dark web apparently pilfered from Mazafaka (a.k.a. "Maza," "MFclub"), an exclusive crime forum that has for more than a decade played host to some of the most experienced and infamous Russian cyberthieves.
At the top of a 35-page PDF leaked online is a private encryption key allegedly used by Maza administrators. The database also includes ICQ numbers for many users. ICQ, also known as "I seek you," was an instant message platform trusted by countless early denizens of these older crime forums before its use fell out of fashion in favor of more private networks, such as Jabber and Telegram. This is notable because ICQ numbers tied to specific accounts often are a reliable data point that security researchers can use to connect multiple accounts to the same user across many forums and different nicknames over time. Cyber intelligence firm Intel 471 assesses that the leaked Maza database is legitimate.
At the top of a 35-page PDF leaked online is a private encryption key allegedly used by Maza administrators. The database also includes ICQ numbers for many users. ICQ, also known as "I seek you," was an instant message platform trusted by countless early denizens of these older crime forums before its use fell out of fashion in favor of more private networks, such as Jabber and Telegram. This is notable because ICQ numbers tied to specific accounts often are a reliable data point that security researchers can use to connect multiple accounts to the same user across many forums and different nicknames over time. Cyber intelligence firm Intel 471 assesses that the leaked Maza database is legitimate.
Where (Score:1)
Re: (Score:3)
I can't be sure but it seems like the kind of people who have the skillset to really understand a file like that... already know where to find it.
Re: (Score:2)
Shhhh, I bet if you tell him its behind the chair that he will go look.
Re: Where (Score:1)
Yes, but why waste the time? Humans are the easiest line in the chain, so why not just be efficient and ask, until you come off the pooper and get back to the proper PC? ;)
Re: (Score:2)
Re: Where (Score:1)
What's the point in chasing after the clueless script kiddies and junkies that stumbled on something bigger than themselves?
That's embarassing. (Score:2)
Hacking unsuspecting victims is one thing but taking down a target that knows it's going to be attacked so thoroughly has to hurt their pride a bit. If nothing else, this exposes people who really wanted to stay hidden.
Re: (Score:2)
Re: (Score:2)
why would anyone actually present their real world information on a forum thats the equivalent to a thieves den or pirate cove?
Who said they would? IP addresses and email/password combos provide ways of identifying people.
Re: (Score:2)
Re: (Score:2)
They might usually but even nation-state hackers slip up on occasion.
Re: That's embarassing. (Score:2)
Only newbies use TOR thougj. 90% of the nodes are state spying agencies nowadays, so if they can ever not trace you, it's only because they are trampling on each other's feet.
Usually, pros would have their own botnet, and use that as non-logging private onion-routed mix. (And you would not trust the zombies to not be hackes by enemies either.)
Re: That's embarassing. (Score:2)
Uum, first of all, this is a site with nothing but hackers. What do you think, they weren't the site with the most hacking attacks in the history of the Internet? It was only a question of time.
And it was also completely expected by everyone in there, from day one.
So all your hacked data will be entirely useless. User names, passwords and adresses used nowhere else, and logs of connections by zombie proxies, postinf stuff that anyone of the admins and mostly all users could already see.
The news is just for
knock knock... (Score:5, Funny)
karma's at the door
Re: (Score:2)
Commander Murdock said it best...
https://www.youtube.com/watch?... [youtube.com]
Amazed that fiction hasn't been here yet (Score:2)
We are inundated with TV shows about spies, and spy-like contractors, with whole fictional worlds where assassins live like kings on their huge assassin income.
(Very depressing for murder-groupies to discover that actual Russian assassins live with Mom in a small apartment, that most Mexican murders go for a few hundred bucks.)
Where the heck is our Blacklist/Blindspot/MI/Alias/Covert-Affairs show about hunting down cybercriminals?
Granted it wouldn't be very heroic, shooting these people on the way in to the
Re: (Score:3)
Re: (Score:2)
Re: (Score:3, Informative)
Pictures of people hunched over a keyboard aren't very exciting. To make it more exciting, you would have to depict the hack being done from a moving car to a flying airplane. The pilot passing a CAT5 cable to the passenger who plugs it into her laptop and debugs the planes software
Hacker Airplane Scene from Scorpion (TV-Show) [youtube.com]
And there is more where this came from :) (Score:2)
Hey Sergei, this more where this came from. Buckle up!
So was this part of the Biden sanction? (Score:2)
Re: So was this part of the Biden sanction? (Score:1)
You betcha.
The US TLAs haven't been bragging about wanting to be the bestestestestest in the world for nothing.
We alway only hear of their attacks, and almost never of ours. And vice versa. But you can bet money that there's a war out there. And just like the "cold war", it only looks cold.
All I wonder, is if the Mossad plays Brave Little Taylor here. ;))
Nothing to worry about for them. (Score:1)
Anyone with half a brain will have used separate users/passwords/adresses/IPs for each site. Apart from probably a self-made onion routing mix of zombie proxies, for the high stakes ones.
And given the nature of the site, that's true for everyone but the n00bs that just stumbled in.
So this is rather meaningless in practice.
Russians hack own Forum ? (Score:1)
Re: (Score:2)
It must have been the Russians :]
That was my first thought. All this was another group showing off their leet e-peen.