Slashdot Mirror
Hacker Who Stole 620 Million Records Strikes Again, Stealing 127 Million More (techcrunch.com)
An anonymous reader quotes a report from TechCrunch: A hacker who stole close to 620 million user records from 16 websites has stolen another 127 million records from eight more websites, TechCrunch has learned. The hacker, whose listing was the previously disclosed data for about $20,000 in bitcoin on a dark web marketplace, stole the data last year from several major sites -- some that had already been disclosed, like more than 151 million records from MyFitnessPal and 25 million records from Animoto. But several other hacked sites on the marketplace listing didn't know or hadn't disclosed yet -- such as 500px and Coffee Meets Bagel. The Register, which first reported the story, said the data included names, email addresses and scrambled passwords, and in some cases other login and account data -- though no financial data was included. Now the same hacker has eight additional marketplace entries after their original listings were pulled offline, including:
- 18 million records from travel booking site Ixigo
- Live-video streaming site YouNow had 40 million records stolen
- Houzz, which recently disclosed a data breach, is listed with 57 million records stolen
- Ge.tt had 1.8 million accounts stolen
- 450,000 records from cryptocurrency site Coinmama.
- Roll20, a gaming site, had 4 million records listed
- Stronghold Kingdoms, a multiplayer online game, had 5 million records listed
- 1 million records from pet care delivery service PetFlow
- 18 million records from travel booking site Ixigo
- Live-video streaming site YouNow had 40 million records stolen
- Houzz, which recently disclosed a data breach, is listed with 57 million records stolen
- Ge.tt had 1.8 million accounts stolen
- 450,000 records from cryptocurrency site Coinmama.
- Roll20, a gaming site, had 4 million records listed
- Stronghold Kingdoms, a multiplayer online game, had 5 million records listed
- 1 million records from pet care delivery service PetFlow
- 1 million records from pet care delivery service PetFlow
Well, I know what flows from pets and if somebody wants to hack to get that kind of stuff... Power to them.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
If you know enough scripting/IT to hack major websites without being caught, why not write a little software tool that does something legit, sell it on website, and make a living with that? Why not make a powerful website security boosting tool instead of HACKING websites? Would that be worth far less than putting happless people's credit card info and other details on the Dark Web? Unless of course these "hackers" are GOVERNMENT people. Perhaps Russian government people. Hacking Western companies not for itty-bitty money on the Dark Web, but simply to damage and inconvenience Westerners. Seriously, who is so good at hacking, and so poor at legit coding that they cannot make similar money writing something that has a legitimate use? Who are these "lone superhackers" who can go undetected by Western security agencies and just throw struff on the Dark Web? I smell Putin in these supposed "lone hacks".
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
It...don't...fucking....matter!
It's all being given away for free, and the only way to keep it from being given away for free is to not use the internet.
That is all.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
He did a lot of work to accomplish almost nothing.
He could have probably made more money just writing an app and at least he might have something to show for it instead of a bunch of work that he put into a criminal event that he can't really brag about and that didn't really accomplish much or generate much money.
I believe it's because the skills required to hack a lot of websites are actually quite low end and it's mostly just a matter of nobody's trying and nobody's auditing their own network security.
In theory he best part of hacking is that you Force the world to take data security seriously. In practice these guys release a lot of data that mostly just sits there and has no use to anybody except perhaps the company that piled it up in the first place.
With the Advent of multi-factor authentication a lot of that data isn't worth much because it doesn't represent a long-term ability to hack people over time like it used to. There used to be a lot of value in piling up logins and passwords, but as soon as someone turns two-factor authentication on that value significantly declines and if they have two-factor on their main email account a lot of times they can pretty easily recover everything.
then you have the simple fact that most people don't actually have any kind of interesting data and when you release data on millions and millions of people it mostly just becomes a pile of worthless data. It might be a good smoke screen in some instances, but that seems like a stupid way to make a pretty small amount of money.
if I was a hacker for hire I would be far more interested in precision hacking where I'm not releasing piles of data and then acknowledging the hacksaw the date of loses value and then essentially having so much data at once that I have no idea what to do with it nor does the total combined hacking community. I mean you can't turn lead into gold and you can't turn that 90% of useless data into anything useful unless you really really really care about profiling someone very accurately, which is exceptionally uncommon.
Perhaps Canadian government people, Swiss, German, Thai, Somalian, Iraq, Argentina, Colombia, USA...
Literally any government why single out Russia
Because they will produce an amazing tool. Then spend the rest of their lives supporting morons trying to use it. Prison would be better than that hell. :)
First law of people: People are generally stupid.
I can only conclude that you listen to a lot of western propaganda; wherein everything you just can't wrap your head around means >Russia
The USA's own NSA has a long history of planting code , and at time hacking enemies and allies.
Gee, I don't know. Maybe it's the constant stream of hacking attempts literally everyone running anything attached to the Internet sees daily from Russia and China.
a series of hacks which will not provide me with another year of "credit monitoring" I think I have enough banked so 2 generations after me will have it available. /s
Password management is only as good as a sites ability to protect your information.
Increasingly bad design choices seem to be made by developers regarding the protection of your personal information.
I once read that the money spent on enterprise spam email filtering is an order of magnitude greater than the amount lost from spam emails.
Perhaps the hacker doen't live in an ecosystem where opportunities abound. Also, the hacking skill set may not be broad enough to extend to all of the talents required to hold an affluent job.
In any case, the hacker has established a business model that seems to be working.
It little behooves the best of us to comment on the rest of us.
Making something secure means thinking about security on day one. What is it that I want to have secure and who wants to get it. It means keeping things simple. I can write 15 lines of code that are secure as long as they don't call any other functions. After that things start getting risky. Frameworks build on other frameworks, multiple data bases, parsing any strings, it's all extra complexity. You really have to look at it and try and minimize what you want to keep secure. Make everything else fancy, make your email web page requires 1.1GB in memory (looking a you gmail), but let's keep the actual login tiny so one person can understand it.
Seriously, think first and then remember simple and minimal is your friend in security
I've never heard of a single one of the websites that got hacked. I'm guessing said websites are shoestring operations who's business model is get in, maximize your $$$, get out.
That this type of thing just does not matter. The odds of any one person getting scammed or identity stolen by one of these hacks is about the odds of getting hit by lightning. Billions of records and nothing to show for it except small time scams. Finally security by obscurity works.
Whats the latest 2019 thinking on pw and crypto that works while offering normal user web GUI?
Domestic spying is now "Benign Information Gathering"
20 years ago, I met a lose confederation of young, skilled, poorer, under-opportunitied Russian hackers in a non-descript encrypted IRC server who would were paid (used for sustenance) to make tools for more powerful Russian gangs of oligarch kids and wannabe crackers to make money criminally and build their reputation around other gangs.
LPs or 45s?
That hacker could have saved some storage space by stealing cassette tapes instead.
Have gnu, will travel.
but when will you have enough records mr hacker??
You're confusing "the hackers" with "the scripts ran by the script kiddies". They are different animals altogether.
My guess is they're involved in this kind of criminal behavior because of the same personality characteristics that would make it impossible to:
1) provide any kind of "customer support" in a self-employment situation, or
2) get a degree and/or be part of a typical workplace
I swear, if any of my shadowrun players show up with 200 karma that fell off a back of a truck...
Bank Secretary : So, people hire you to break into their places... to make sure no one can break into their places?
Martin Bishop : It's a living.
Bank Secretary : Not a very good one.