Slashdot Mirror
Dutch Developer Added Backdoor To Websites He Built, Phished Over 20,000 Users (bleepingcomputer.com)
An anonymous reader quotes a report from BleepingComputer: A Dutch developer illegally accessed the accounts of over 20,000 users after he allegedly collected their login information via backdoors installed on websites he built. According to an official statement, Dutch police officials are now in the process of notifying these victims about the crook's actions. The hacker, yet to be named by Dutch authorities, was arrested on July 11, 2016, at a hotel in Zwolle, the Netherlands, and police proceeded to raid two houses the crook owned, in Leeuwarden and Sneek. According to Dutch police, the 35-years-old suspect was hired to build e-commerce sites for various companies. After doing his job, the developer also left backdoors in those websites, which he used to install various scripts that allowed him to collect information on the site's users. Police say that it's impossible to determine the full breadth of his hacking campaign, but evidence found on his laptop revealed he gained access to over 20,000 email accounts. Authorities say the hacker used his access to these accounts to read people's private email conversations, access their social media profiles, sign-up for gambling sites with the victim's credentials, and access online shopping sites to make purchases for himself using the victim's funds.
There are two kinds of people in this world I hate.
Those that are intolerant of other people's cultures and the Dutch.
He's been in custody for over 6 months and is not a minor so why keep his name a secret?
Pain is merely failure leaving the body
https://xkcd.com/792/
Should have just added a line to the EULA that he would be able to gain access to your account(s) if you register. Nobody reads the EULA, and there'd be no case against him because it would be in the EULA.
This should also set the precedent that the government can be arrested if they put backdoors into things... of coursehttps://yro.slashdot.org/story/17/01/18/0527225/dutch-developer-added-backdoor-to-websites-he-built-phished-over-20000-users#, that will never happen. Nothing is illegal if the Government is doing it.
Because doctors, lawyers, accountants, engineers and other trusted professionals are less prone than software developers to do shady or outright illegal things when exercising their profession? I don't have any specific data about that, but members of any of the above categories pop up in the relevant sections on the news now and then. If you are a crook you're crook, and no regulating body neither an insurance will change that.
As far as TFS goes, none of of his customers have paid him to siphon their customer's data. If he wasn't happy with what his customers were willing to pay he could simply have not accepted the jobs.
OTOH there are many examples of software projects - some of them are mentioned on this site now and then - that were badly handled although absurdly high amounts of money have been paid.
He is a Sneak Thief from Sneek.
Anyone know how he got the information out of the sites he'd created? How did he 'install some scripts'? And even then, how did he get the data out?
I realise that if you're hiring someone like this you might not be so-inclined to watch logs and whatnot, but there must be some sort of trail left by his accesses.
There is an interesting talk by Robert C. Martin on a similar topic: http://developeronfire.com/pod...! The registration will probably lead to more bureaucracy to the point where we will have "regulation bodies" who exist for their own sake.
sudo rm -r -f --no-preserve-root /
What I don't understand is why he needed "back doors".
During the course of work (obviously depending on scope) you may need access to sensitive information: admin passwords, internet utility bills, access to admin e-mail accounts (postmaster, webmaster), employee rosters, internal topology information, router passwords, the list goes on. All of this stuff is usually handed over without a second thought.
I have known these details and more for many local companies in my course of work. I have never abused that trust (I actually go out of my way to try to not remember passwords and other sensitive information), but I can certainly see how it could be abused without ever having to install any malware.
My eyes reflect the stars and a smile lights up my face.
Hello Mr. victim. It is me, Steffen van der Hast-Gracht of the Amsterdam police. Wiz my partner and also I am very happy to say my lover Ronald. I am terribly sorry to inform you zat you haf bin vukked ofer ze Internet by some ferry dubious person stemming from Ze Nezerlands. Vee haf already prepared ze forms for you to fill in so zat you can claim insurance, psychological help and absent time from yor wurk. Vee also made petition on ze Internet for you to arrange a silent march over ze canals. You ken bye flowers from my nephew but if you don't want or you don't like also from any other shop. Yes. End may I infite you for a romantic evening with you, your partners, our dogs and a few convicted drug dealers zat reely reely promise to take ze right path very soon.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
Dude, if you start dressing as a woman in a male prison, you better be serious about it...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why do they continue to call these people hackers?
I hear Xanax is now being prescribed for Pedantic Anxiety Syndrome. Ask your Doctor if Xanax is right for you!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
He's a suspect. He will only become guilty when the judge has ruled so.
"Trump!!", the new Godwin.
Could have just left a couple vulnerabilities sprinkled in odd places and used poor hashing practices. He'd have complete deniability as it looks just like 90% of websites out there.
Cwm, fjord-bank glyphs vext quiz
It is obvious to them, but on the other hand there are the re-election contributions from lobbying prison-organisations that stand to gain from more prisoners.
"Trump!!", the new Godwin.
He was using the accounts of the USERS of the websites, not the OWNERS. Putting in a backdoor would mean that even when the admin passwords are changed, he would still have access to the data. Also, a backdoor likely also gives a level of plausible deniability to deflect suspicion should a 'hack' ever be spotted internally - "it can't have been me. I never had access to the live server. I just gave you the code to deploy yourself".
My doctor prescribed me Xanax and I feel great.!..!.!;$:)/);&;@:):63$;@/@/);),6$3@/@dhshxhfkkchehdud
Whoa, sorry I just blacked out and fell asleep with my head on the keyboard. What was I saying? I can't remember.
You were saying "Life is damn good!" 8^)
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
I think he's my doppleganger because a lot of women say his name when they meet me.
"That's the way to do it" - Punch
I'm not even sure how one would go about "dressing up" as a woman in prison. It's not like prison uniforms come a wide variety of fashion styles that prisoners get to pick.
"Oh, like, this orange jumpsuit is so, tacky. I'll try the black and white stripes, it is so slimming and fabulous, like, oh, I can add this red belt as an accessory, that would be like, so rad."
"That's the way to do it" - Punch
you see one there must be hundreds. There has to be other developers who have installed backdoor into the web sites they built. You should have your web site source code checked for a backdoor..
The original meaning? Which of them? That some people are hacks?
Words can have multiple meanings and commonly do. Words also change meaning (or accumulate more meanings). There is no problem accepting people can be hacks, that there are many elegant hardware hacks, that some people are excellent hackers and that some people are hacking into other peoples computers. Not for me anyway, YMMV.
You can probably add Slashdot to that list. They are collecting all our opinions about Trump, AI being real, and the slashvertisement of the day and are going to use that information against us.
"That's the way to do it" - Punch
This proves the importance of using different passwords for every online service you use.
WTB [sig], PST!!!
People think I am weird if I don't like to create an account if I can help it and often don't use a service if it forces the issue for some nebulous reason.
Then stuff like this happens. Again. And even more services force account creation.
Even if you don't create an account, the company still has your name, email and mailing address, and credit card info if you actually bought anything. That is why I only use virtual credit cards on websites, or PayPal.
WTB [sig], PST!!!