Skip to content
Glock Enterprises
  • Welcome
  • Blog
  • Resources
  • Support

Presenting Virtually? Here’s How to Do it Right (RSAC Webinar)?

27th May 2020 peterglock

Read the original article here

Glock Takes Stock permalink

Post navigation

← Mercedes-Benz Data Leak Lesson: Lock Down Code Repositories
Report: ATM Skimmer Gang Had Protection from Mexican Attorney General’s Office →

Recent Posts

  • Supermicro, Pulse Secure release fixes for ‘TrickBoot’ attacks
  • Accellion zero-day claims a new victim in cybersecurity company Qualys
  • Microsoft reveals 3 new malware strains used by SolarWinds hackers
  • Hacked SendGrid accounts used in phishing attacks to steal logins
  • Three Top Russian Cybercrime Forums Hacked

Get in touch

Email: [email protected]


View Glock Enterprises Ltd profile on Ariba Discovery

Data Protection Register

Registered with the ICO: ZA494319

About

Glock Enterprises Ltd. Registered in England & Wales No. 11183883

VAT No: GB 361 2795 89

Glock Enterprises (Europe) OÜ
Registered in Estonia
No. 16149069

All content (c) Glock Enterprises Ltd 2021

Pages

  • Blog
  • Privacy Policy
  • Resources
    • Free Trial – Private Threat Intelligence
    • White Paper: Building a Business Case for Cybersecurity Asset Management
    • White Paper: Cyber Deception – Migrating to an alternative platform
    • White Paper: Hunting for Threats in Operational Technology
    • White Paper: Internet Connected Storage
    • Whitepaper: 5 Steps to Building a Threat Modelling Program for AWS
    • Whitepaper: Coping with a flood of Data Subject Access Requests
  • Services
  • Support
  • Welcome

The Latest from Facebook

Glock Enterprises Ltd

2 hours ago

Glock Enterprises Ltd
buff.ly/3c6kp1mThree Top Russian Cybercrime Forums HackedThe biter bit...The latest from Brian Krebs...:Over the past few weeks, three of the longest running and most venerated Russian-language online forums serving thousands of experienced cybercriminals have been hacked. In two of the intrusions, the attackers made off with the forums’ user databases, including email and Internet addresses and hashed passwords. Members of all three forums are worried the incidents could serve as a virtual Rosetta Stone for connecting the real-life identities of the same users across multiple crime forums.References to the leaked Mazafaka crime forum database were posted online in the past 48 hours.On Tuesday, someone dumped thousands of usernames, email addresses and obfuscated passwords on the dark web apparently pilfered from Mazafaka (a.k.a. “Maza,” “MFclub“), an exclusive crime forum that has for more than a decade played host to some of the most experienced and infamous Russian cyberthieves.At the top of a 35-page PDF leaked online is a private encryption key allegedly used by Maza administrators. The database also includes ICQ numbers for many users. ICQ, also known as “I seek you,” was an instant message platform trusted by countless early denizens of these older crime forums before its use fell out of fashion in favor of more private networks, such as Jabber and Telegram.This is notable because ICQ numbers tied to specific accounts often are a reliable data point that security researchers can use to connect multiple accounts to the same user across many forums and different nicknames over time.Cyber intelligence firm Intel 471 assesses that the leaked Maza database is legitimate.“The file comprised more than 3,000 rows, containing usernames, partially obfuscated password hashes, email addresses and other contact details,” Intel 471 found, noting that Maza forum visitors are now redirected to a breach announcement page. “Initial analysis of the leaked data pointed to its probable authenticity, as at least a portion of the leaked user records correlated with our own data holdings.”The attack on Maza comes just weeks after another major Russian crime forum got plundered. On Jan. 20, a longtime administrator of the Russian language forum Verified disclosed that the community’s domain registrar had been hacked, and that the site’s domain was redirected to an Internet server the attackers controlled.A note posted by a Verified forum administrator concerning the hack of its registrar in January.“Our [bitcoin] wallet has been cracked. Luckily, we did not keep large amounts in it, but this is an unpleasant incident anyway. Once the circumstances became clear, the admin assumed that THEORETICALLY, all the forum’s accounts could have been compromised (the probability is low, but it is there). In our business, it’s better to play safe. So, we’ve decided to reset everyone’s codes. This is not a big deal. Simply write them down and use them from now on.”A short time later, the administrator updated his post, saying:“We are getting messages that the forum’s databases were filched after all when the forum was hacked. Everyone’s account passwords were forcibly reset. Pass this information to people you know. The forum was hacked through the domain registrar. The registrar was hacked first, then domain name servers were changed, and traffic was sniffed.”On Feb. 15, the administrator posted a message purportedly sent on behalf of the intruders, who claimed they hacked Verified’s domain registrar between Jan. 16 and 20.“It should be clear by now that the forum administration did not do an acceptable job with the security of this whole thing,” the attacker explained. “Most likely just out of laziness or incompetence, they gave up the whole thing. But the main surprise for us was that they saved all the user data, including cookies, referrers, ip addresses of the first registrations, login analytics, and everything else.”Other sources indicate tens of thousands of private messages between Verified users were stolen, including information about bitcoin deposits and withdrawals and private Jabber contacts.The compromise of Maza and Verified — and possibly a third major forum — has many community members concerned that their real-life identities could be exposed. Exploit — perhaps the next-largest and most popular Russian forum after Verified, also experienced an apparent compromise this week.According to Intel 471, on March 1, 2021, the administrator of the Exploit cybercrime forum claimed that a proxy server the forum used for protection from distributed denial-of-service (DDoS) attacks might have been compromised by an unknown party. The administrator stated that on Feb. 27, 2021, a monitoring system detected unauthorized secure shell access to the server and an attempt to dump network traffic.Some forum lurkers have speculated that these recent … ... See MoreSee Less

Photo

View on Facebook
· Share

Share on Facebook Share on Twitter Share on Linked In Share by Email

Proudly powered by WordPress | Theme: Moesia by aThemes