Slashdot Mirror
Dutch Developer Added Backdoor To Websites He Built, Phished Over 20,000 Users (bleepingcomputer.com)
An anonymous reader quotes a report from BleepingComputer: A Dutch developer illegally accessed the accounts of over 20,000 users after he allegedly collected their login information via backdoors installed on websites he built. According to an official statement, Dutch police officials are now in the process of notifying these victims about the crook's actions. The hacker, yet to be named by Dutch authorities, was arrested on July 11, 2016, at a hotel in Zwolle, the Netherlands, and police proceeded to raid two houses the crook owned, in Leeuwarden and Sneek. According to Dutch police, the 35-years-old suspect was hired to build e-commerce sites for various companies. After doing his job, the developer also left backdoors in those websites, which he used to install various scripts that allowed him to collect information on the site's users. Police say that it's impossible to determine the full breadth of his hacking campaign, but evidence found on his laptop revealed he gained access to over 20,000 email accounts. Authorities say the hacker used his access to these accounts to read people's private email conversations, access their social media profiles, sign-up for gambling sites with the victim's credentials, and access online shopping sites to make purchases for himself using the victim's funds.
What
There are two kinds of people in this world I hate.
Those that are intolerant of other people's cultures and the Dutch.
...yet no strong encryption on his laptop. And the word of the day is hubris.
(It's not criminals in general that are dumb - just most of the ones that get caught.)
People think I am weird if I don't like to create an account if I can help it and often don't use a service if it forces the issue for some nebulous reason.
Then stuff like this happens. Again. And even more services force account creation.
He's been in custody for over 6 months and is not a minor so why keep his name a secret?
Pain is merely failure leaving the body
When software developers are registered to regulating bodies, have insurance and are paid like doctors, lawyers, accountants, engineers and other trusted professionals this type of behaviour will become more prolific. But of course nobody wants to pay for that, so they get what they pay for.
This makes me wonder about how many more websites have been developed by folks with nefarious intent. Are there hundreds, thousands, or even worse, somewhere in the millions? How many developers are like this guy, and not only collect credentials, but install some sort of virus? I'm afraid that the answer is that we will never know. Kudos to whomever discovered this, and tracked it right back to the developer.
Why do they continue to call these people hackers?
Coding a backdoor doesn't make you a hacker.
Finding a bug in somebody else's program and gaining access makes you a hacker.
Well...at least that's how I feel about it.
"Hackatons" and other programming events with the word "hack" don't change this one bit.
I really hope Zwolle, Sneek, and Leeuwarden look as magical and fantastic as their names imply.
https://xkcd.com/792/
Should have just added a line to the EULA that he would be able to gain access to your account(s) if you register. Nobody reads the EULA, and there'd be no case against him because it would be in the EULA.
This should also set the precedent that the government can be arrested if they put backdoors into things... of coursehttps://yro.slashdot.org/story/17/01/18/0527225/dutch-developer-added-backdoor-to-websites-he-built-phished-over-20000-users#, that will never happen. Nothing is illegal if the Government is doing it.
If he starts dressing like a woman.
He's called a crook and then a suspect in the blurb. So which is it? You do know, don't you, that calling him a crook can make you the subject of a lawsuit?
He is a Sneak Thief from Sneek.
Anyone know how he got the information out of the sites he'd created? How did he 'install some scripts'? And even then, how did he get the data out?
I realise that if you're hiring someone like this you might not be so-inclined to watch logs and whatnot, but there must be some sort of trail left by his accesses.
Hello Mr. victim. It is me, Steffen van der Hast-Gracht of the Amsterdam police. Wiz my partner and also I am very happy to say my lover Ronald. I am terribly sorry to inform you zat you haf bin vukked ofer ze Internet by some ferry dubious person stemming from Ze Nezerlands. Vee haf already prepared ze forms for you to fill in so zat you can claim insurance, psychological help and absent time from yor wurk. Vee also made petition on ze Internet for you to arrange a silent march over ze canals. You ken bye flowers from my nephew but if you don't want or you don't like also from any other shop. Yes. End may I infite you for a romantic evening with you, your partners, our dogs and a few convicted drug dealers zat reely reely promise to take ze right path very soon.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
He's a suspect. He will only become guilty when the judge has ruled so.
"Trump!!", the new Godwin.
Could have just left a couple vulnerabilities sprinkled in odd places and used poor hashing practices. He'd have complete deniability as it looks just like 90% of websites out there.
Cwm, fjord-bank glyphs vext quiz
It is obvious to them, but on the other hand there are the re-election contributions from lobbying prison-organisations that stand to gain from more prisoners.
"Trump!!", the new Godwin.
you see one there must be hundreds. There has to be other developers who have installed backdoor into the web sites they built. You should have your web site source code checked for a backdoor..