22 ms·
Hacker Publishes 2TB of Data from Cayman National Bank
- Miner49er 7y agoA news article on it with more info and the full HackBack: https://unicornriot.ninja/2019/massive-hack-strikes-offshore-cayman-national-bank-and-trust/ https://unicornriot.ninja/2019/massive-hack-strikes-offshore...
- chelmzy 7y agoPastebin with translated guide on how they hacked the bank: https://pastebin.com/8rXhtqgr https://pastebin.com/8rXhtqgr
- Miner49er 7y agoAlso contains some info on how they hacked Hacking Team and Gamma Group. Edit: Also a $100k bounty for future hacks on certain types of companies.
- Thriptic 7y agoShe also attacked the Barcelona police department, the Turkish government, and stole money from various Bitcoin wallets to donate to the Kurds iirc. Her write-ups are always really great reads and very enlightening.
- Sendotsh 7y agoIs there a collection of her write-ups somewhere?
- Thriptic 7y agoThese are the ones I am aware of: https://pastebin.com/0SNSvyjJ https://pastebin.com/0SNSvyjJ http://pastebin.com/raw.php?i=cRYvK4jb http://pastebin.com/raw.php?i=cRYvK4jb https://m.youtube.com/watch?v=oI_ZhFCS3AQ https://m.youtube.com/watch?v=oI_ZhFCS3AQ
- trenning 7y agoWhere can we find her blog or wherever she posts? I only see a link to a translated pastbin. Or was it in there? I was just skimming it a bit so far but can't really read it until tonight.
- Thriptic 7y agoPlease see the other child post
- justinjlynn 7y agoTheir pronouns are they/them. https://twitter.com/DDoSecrets/status/1196397044644163585 https://twitter.com/DDoSecrets/status/1196397044644163585
- Thriptic 7y agoSorry where are you seeing that from that link?
- justinjlynn 7y agoSorry, I posted the wrong link. :/ See sibling response to my post for the correct link: https://mobile.twitter.com/DDoSecrets/status/1196216685038129153 https://mobile.twitter.com/DDoSecrets/status/119621668503812...
- 52-6F-62 7y agoThis is a fascinating read... I hope it does make the news.
- badrabbit 7y agoIt doesn't tell you how they infiltrated to begin with so that they can sniff cookies and keystrokes. But my guess is they phished an employee. Edit: I missed that part,sorry.
- pvitz 7y agoHe explicitly mentions how he exploited it and that at the same time, somebody else tried to phish...
- bowmessage 7y agoShe!
- deleted 7y ago[deleted]
- cookie_monsta 7y agoThis is not a hill that I am willing to die on, but when was gender decided? Everything I've read up until now has kept it ambiguous: https://mobile.twitter.com/DDoSecrets/status/1196216685038129153 https://mobile.twitter.com/DDoSecrets/status/119621668503812...
- bowmessage 7y agoSorry, didn't mean to turn this into a hill at all :) It was called out in the pastebin in the comment originating this chain.
- Lyrex 7y agoIf my memory serves correctly then she said something along the lines "I'm just a girl" in the writeup pastebin.
- cocochanel 7y agoStated in the readme file, "I was a girl raised by the internet."
- newnewpdro 7y ago> Dell had setuid’d root on dos2unix, leaving the device easy to root. Yikes.
- m0zg 7y agoThis is going to be swept under the rug faster than Epstein, assuming it even surfaces in the mainstream press at all. Lots of rich people run their stuff through the Cayman Islands, probably more than through Panama. So far, as far as I can tell, no mention in the US. The entire front pages of major national newspapers (WaPo and NYTimes) are dedicated to their single-minded mission of telling everyone that orange man is bad.
- hurrdurr2 7y agoRegrettably the media needs to publish what gets the most clicks; unfortunately what gets the most clicks these days is partisan stories that gets readers riled up. That Panama leak story was also quickly "forgotten" by the MSM.
- m0zg 7y agoI'm sure the journalists would easily manage to make Panama very interesting if their owners didn't tell them to knock it off. Same as with Epstein. Scandal of the century, not discussed at all within 2 weeks, no follow up or investigative journalism of any kind.
- Miner49er 7y agoNot sure why you're being downvoted. "Epstein didn't kill himself" is still a meme. That proves there's a market for the Epstein news, IMO. The public absolutely cares. Plus, there's evidence it's being swept under the rug: https://www.buzzfeednews.com/article/amberjamieson/leaked-footage-abc-jeffrey-epstein https://www.buzzfeednews.com/article/amberjamieson/leaked-fo...
- 52-6F-62 7y agoI think because you easily provided the proof they were wrong, as evidenced by an article published by the media about how it's not being addressed publicly to the public's satisfaction. It's too common to treat the media as a homogeneous entity rather than a fractured and variable group.
- throwawaymanbot 7y agoIt takes a while to read all this stuff.. Its good to be out and about so many years from now... links can be made.
- buboard 7y agoOooh Cayman islands, that one must be juicy
- jokoon 7y agoAfter watching The laundromat, I think it's big news. Although I will always be curious why countries are letting those small, insignificant islands and countries manage all this wealth, and why they're trusted to do it. This can't be secure or safe. I'm curious about the diplomacy and the political implications of this. What if their office get robbed? What if the island gets attacked? What if one of those shady bank defaults? What if one of the people who manage it suddenly die? I mean apparently there is a long list of why it's risky, and I don't understand how this is even legal at all. How do you wire all this money to such a small place, and how can they trust so few people to hide so much money? I have so many questions.
- jbob2000 7y agoThe money isn't being kept there for safety, it's being kept there for anonymity and easy access. These countries don't ask any questions when you show up and ask to withdraw a million dollars. Maybe you're withdrawing that money to buy a yacht, maybe you're withdrawing it to buy drugs, maybe you're withdrawing it to pay for a seat on Epstein Air. Banks in developed countries ask questions, these banks in these countries ask 0 questions.
- amoshi 7y agoYep, and the moment someone starts asking questions or being "uncooperative" they are dealt with - as was Amine Halawi in [0]. [0] https://theintercept.com/2019/10/26/jho-low-1mbd-comoros-offshore-bank/ https://theintercept.com/2019/10/26/jho-low-1mbd-comoros-off...
- Aperocky 7y agoYou'd think it's the small island and countries managing those bank, but it's not. The banks are from the rich and for the rich, the country is just a ruse.
- Scoundreller 7y agoExactly. Any big bank in the world has.... suspicious... operations in these places and will let you bank through them as if it's an account you have at home.
- gruez 7y agomagnet of the torrent since the site seems to be overloaded: magnet:?xt=urn:btih:5b1b0092848d0b8e2f08d825111264c4818a2df3
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- xmly 7y agoWhere could I download!
- wyxuan 7y agoLink is on their website, just click though
- unnouinceput 7y agoSearch through twitter, there is a torrent as well.
- deleted 7y ago[deleted]
- badrabbit 7y agoFrom what I read the hack was not sophisticated at all. If they had decent endpoint protection this would not have happened. Maybe they disabled defender after the initial access and privesc because defender blocks Get-Keystrokes and other things in empire,even with significant modification. Anyway, I don't care about the hacktivism and propaganda (don't really get it -- tbh,rich people bad/corrupt?) But would very much be interested in any post-incident analysis of what happend. But here's what stands out to me: they're talking about using empire and hvnc. Empire is by design detectable,you could use the techniques in empire in your own malware though. Most rats and bots (take trickbot) let you sniff key strokes, run commands,etc... So I guess they used psexec or winrm to access the hosts(no vlan segmentation or firewall on endpoints!?). I ask all this because the specific MO is significantly different than what is seen with criminal actors and crimeware(like Carbank which She mentions). And to me, it does corroborate the story that this was likely an independent hacker motivated by hacktivism as opposed to a bigger conspiracy to burn some group and plant false records in the leak (which could still less likely be the case) Very exciting,righteous hack. I think overall, the bank cheaped out on IT and paid big time for it.
- georgeglue1 7y ago>> (don't really get it -- tbh,rich people bad/corrupt?) it's not so much that wealth is bad, but tax evasion and money laundering (from organized crime, corruption, etc.) is bad.
- joshypants 7y agoThe future of the species is literally imperiled right now because we've allowed rich people to hoard wealth, so that's a reason to care.
- badrabbit 7y agoReally? I thought governments had a lot more, like trillions more. I thought the quality of life for humanity has never been better than now? Do you mean climate change? If so how does rich people's greed fit in the picture. I don't think they should hoard cash, there should be a limit on that but net worth usually includea stock value, wealth in form of stocks is far from hoarding. I think cash wealth limits and a legal limit on pay gap would help but I still don't see the rich do anything they haven't done throughout history. If anything, democraric processes and institutions are failing the people.
- v4dok 7y agoIs there a forum/IM where someone has already found out any interesting parts? I am unable to download 2TB of data
- danaos 7y agoYou don't have to download the entire folder. Some parts are less than 10 GB.
- cookie_monsta 7y agoStrangely under-reported is that the same hacker is offering up to 100k to others who perform similar acts of hacktivism: https://www.vice.com/en_us/article/vb5agy/phineas-fisher-offers-dollar100000-bounty-for-hacks-against-banks-and-oil-companies https://www.vice.com/en_us/article/vb5agy/phineas-fisher-off...
- dmix 7y agoSo this activist has somehow profited from his “hacktivism” and he wants to spread his wealth to other activists?
- daveguy 7y agoOr possibly someone who became wealthy in the software/opsec industry who believes what they do is for the good of humanity. To a person with a net worth of 100MM+ 100k would not be significant. The funds didn't necessarily come from the hacktivism. Edit: Given the bounty is paid in bitcoin, somewhat more likely the funds are donations/fees from hacking. Not likely it came from funds deposited to an exchange (traceable account). Could also be someone who was mining in 2009 (and not from the hacking itself).
- Bombthecat 7y agoOr he bought bitcoin / etherum early on. On a side note: hope the identity of him stays a secret. Publishing stuff like that gets you killed..
- Maakuth 7y agoAlso there's likely a lot of bitcoin that's known to be connected with illegal activities, say drug business and ransomware. I suppose there's ways to launder them, but it's not necessarily cheap or easy. That sort of bitcoin might be easier to give away anonymously.
- marcusjt 7y agoOr possibly the payment is offered in bitcoin because that's how anyone "performing similar acts of hacktivism" would want to be paid?
- slovenlyrobot 7y agoI had a quick peak at the web server log, it's tiny. The typical legitimate egress from this network is likely somewhere well under 1gb/day, yet somehow these people managed to upload at least 2TB without being noticed In a well-maintained network an upload like this should have paged someone as it was happening, probably sometime in the first 5-10 minutes. Say your outbound pipe was 100mbit, if it is pegged for 15 minutes I can't see any reason why a small installation like this wouldn't want to know they've just spat out 11GB of data for some unknown reason Even divvying things up over 14 days (per the age of the data), its still around 6GB/day. This should have shown up in a monitoring graph somewhere, or triggered a page
- gingeruser206 7y agoOops.
- alexnewman 7y agoIf someone could tell me what country ownes the Tbills in the caymans (https://ticdata.treasury.gov/Publish/mfh.txt https://ticdata.treasury.gov/Publish/mfh.txt), i'd really appreciate it.
- deleted 7y ago[deleted]
- prirun 7y agoSo what? People with billions don't get in trouble, as evidenced by the 2008 financial scam, er, I mean "crisis". The kind of people who get in trouble is a mom stealing a pair of socks from Walmart. That, they will throw the book at. Hiding or stealing billions? No prob.
- 40four 7y agoYou know it's a good, firey HN debate when you have to scroll down about 3/4 of the page to find the 1st comment thats not a child, chained off the top comment! :)
- mikorym 7y agoTo these people [the very rich], taxes are costs. And costs are there to be reduced, ideally to zero. [1] [1] https://www.cumex-files.com/en/ https://www.cumex-files.com/en/
- oriettaxx 7y agoEnglish translation here https://pastebin.com/8rXhtqgr https://pastebin.com/8rXhtqgr really great content!
- Nextgrid 7y agoI’ve read the Pastebin and I wonder, where did they send the 200k to be able to cash them out without getting in trouble? I’ve always assumed that diverting electronic money is relatively easy, the hard part is to convert it to a physical or untraceable form without getting caught; I assume the receiving bank would have kept a record of the incoming transfer and what happened with that money afterwards.
- pearjuice 7y agoPlenty of people on the darkweb allow for flushing of bank transfers to untraceable crypto currencies. Typical scenario: use an unknown (homeless, hacked account whatever) person to register bank account, send money to bank account, withdraw in cash or use digital service to convert to cryptocurrency. Money is gone and owner of bank account might not even know and can probably not be held responsible. The reason the hacker got caught was because he made invalid SWIFT transactions to accounts in Mexico and someone found out the reported errors and checked other transactions.
- asymmetric 7y agoA .torrent file hosted by the Internet Archive, since DDOSecret is apparently being DDOSed: https://web.archive.org/web/*/https://data.ddosecrets.com/file/Sherwood/Sherwood.torrent https://web.archive.org/web/*/https://data.ddosecrets.com/fi...
- black_puppydog 7y agoThis size of dataset does seem to me like a good case of why the current torrent format is lacking. Many people might be interested in generally seeding for this torrent, and maybe pulling some of the files. But few are actually going to download the full 2TB. At the moment, I can select individual files to download and seed, ignoring the rest, but I cannot say "download what I want, and then seed random blocks up to a size of X GB." It's quite conceivable that in a few months, the bigger, less "popular" files will be very hard to come by. That's (maybe the) one thing I think IPFS gets really right: full availability of the whole dataset, regardless of the popularity of the individual blocks. There were some BEPs about that IIRC, but they never got anywhere. I always figured archive.org and similar collection hosters would be interested in this sort of thing, so that people can just "donate 1 TB to archive.org" or such.
- 22c 7y agoI agree with what you're saying, although there is not really a reason why this can't be done with BT client-side. It's just that, AFAIK, no torrent client supports this. BT will, by default, prefer to download the least popular blocks. Client-side just needs a setting to "stop downloading after X blocks", divide your 1TB by the block size, and that's how many blocks you need to download to get 1TB. I will add though, unfortunately with this torrent (at least the one that I am attempting to download), simply seeding a certain number of blocks is not very helpful. The files are mostly in a few giant zip files.
- gkochlam 7y agocosmohandmade.etsy.com
- tomohawk 7y agoConsider this holocaust survivor. https://www.telegraph.co.uk/news/2016/05/16/holocaust-survivor-was-not-a-tax-cheat-judge-rules/ https://www.telegraph.co.uk/news/2016/05/16/holocaust-surviv... His family is murdered by Nazis but he escapes to the UK. He sets up offshore funds in the event something like the holocaust happens again, but the tax authorities go after him. This is one of many reasons for people to set up offshore accounts that have nothing to do with illegal activities. How many people like this has this person hurt? Where does this belief in the infallibility of the tax man come from?
- IAmEveryone 7y agoPay your taxes and you can keep them as far away from any shore as you like. And I don't really see why you feel the need to invoke the Holocaust in this manner? You're just using it as a sympathetic reason to justify tax evasion. Could I also rob some banks with that justification?
- lm28469 7y ago> How many people like this has this person hurt? Could be for an holocaust fund, Bezos secret birthday party fund or for your new 4k TV it's all the same, pay your taxes, then do whatever you want with your money. It really isn't that complex.
- tomohawk 7y agoYou seem to be conflating people keeping money in offshore accounts with cheating on taxes. Some people who have offshore accounts probably cheat. Other people are not cheating. The referenced person was not cheating, and, not that he needed it, he had a very good reason for having the offshore accounts. Hacking in and publicizing peoples offshore account information hurts both groups. It's irresponsible. It hurts people who pay their taxes and are not doing anything wrong. If a government went in and, without any due process, started convicting people just because they had an offshore account, we would not be praising that government.
- Albertchrist 7y agoYes, I have been hearing now a days more about this leaking of bank and card details.
- ptah 7y agoThis will have as much of an effect as the panama papers: other than some journalists involved in reporting it getting killed, nothing will change.
- stef25 7y agoSupposedly the hacker distributed the money to various good causes.
- Shaddox 7y agoThe read up is very interesting but I don't understand the Sonic Wall VPN exploit and how they planted the keylogger in the first place. Was it an inside job?
- sillypuddy 7y agoOh good, I forgot my account number. Can someone DM it to me?
- smarri 7y agoLike a Mr Robot sub plot
- deleted 7y ago[deleted]
- Glosster 7y agoReading this, it all seems so doable. Banks must indeed be getting hacked on a daily basis, it's just that they hide it so well!