10 ms·
A Closer Look at the Lapsus$ Data Extortion Group
- lnxg33k1 5y agoI kinda love it, you take some people working for these big corps doing customers service, that are exploited and paid like shit, and give them money to f*ck their exploiters, that's awesome
- diggernet 5y agoAnd while you are at it, you are also f*cking innocent bystanders, like their employees and customers. That's awesome.
- zorpner 5y agoThe people who provide the funding and the labor which perpetuate the existence of employers who exploit workers aren't innocent -- simply complicit. Or, at best, negligent.
- nickff 5y agoThese are very bad people: >"... prior to launching LAPSUS$, WhiteDoxbin was a founding member of a cybercriminal group... specialized in SIM swapping targets of interest and participating in “swatting” attacks, wherein fake bomb threats, hostage situations and other violent scenarios are phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address."
- emerged 5y agoPeople live such incredibly dark lives. I really can’t even comprehend wanting that. I’d rather kill myself.
- senectus1 5y agoI'm not a communist, but this is a modern democratic capitalist disease. I don't have the answer, but grinding subsections of society into the dust is not the answer.
- lnxg33k1 5y agoI said I like the concept of people paying exploited unfairly paid people, to knee their exploiters, then that was it, like just avoid traveling with the brain and go to unexplored lands where I said oh I like bomb threats and hostage situations
- nickff 5y agoTo be clear, WhiteDoxBin is bribing individuals to commit crimes, for which they may later go to prison. Also, WhiteDoxBin is a horrible person in other ways. I don't see anything to like or love.
- lnxg33k1 5y agoThe world is full of horrible people who are worshipped just because they poison the society either corrupting politicians or by operating in the grey areas of the law. I am by vocation against companies and corporations, whatever people do to make them suffer, I like. So he’s paying some individuals to commit crimes doesn’t make him a horrible person by default, in my opinion, the law is just there to protect the wealthy, is not something that defines what is just, correct or fair. There is nothing intrinsically noble in respecting the law and there is nothing intrinsically horrible in not respecting it
- forum_ghost 5y ago...what is your vocation...? That's by default against corporations and companies?
- deleted 5y ago[deleted]
- hef19898 5y agoSo, you're ok with exploiting already exploited people even more? Just this time for purely criminal endeavors? If you do things like that you are horrible person, period.
- paxys 5y agoThe "customer service" role itself is an invention for companies to absolve themselves of core responsibilities. Company screws up, the only option available is "contact customer service." And actually getting in touch with customer service is made as difficult as possible by design. If you do have the patience and persist, it turns out the customer service agent doesn't have the power to do anything either. In a lot of cases (as it was for the Okta incident) they don't even work for the company in question!
- haswell 5y agoFirst, let me acknowledge that some companies do truly have terrible customer service. But some have great customer service. Both types of companies exist. However... > The "customer service" role itself is an invention for companies to absolve themselves of core responsibilities. This seems like a pretty extreme take. Are you saying that customer service shouldn't exist? I could easily reframe this to say "Companies employ customer service departments to fulfill their responsibilities which they otherwise could not scale without a department dedicated to it". Even if software is perfect and has no bugs, most software that has a customer service department behind it is also sufficiently complex that at some point, support is going to need to get involved. This is especially true in the enterprise software space where Okta plays. What is the alternative?
- paxys 5y agoI don't mean the job title itself, but the fact that companies employ (or mostly outsource) a team of people who it treats as second class citizens and does not give the necessary tools to fulfill these responsibilities you mention. These agents are paid mostly to be a sounding board for customer abuse.
- haswell 5y agoThat is a very broad generalization of customer service/support organizations. That is certainly not the case for organizations I've personally worked for, and that includes time I spent as a phone tech early in my career. > the fact that companies employ ... a team of people who it treats as second class citizens and does not give the necessary tools to fulfill these responsibilities Again, I acknowledge that there are orgs that do exactly what you describe, and sure, call out the bad where it exists, but it's also not fair to generalize this to "companies".
- el-salvador 5y ago> that are exploited and paid like s__t I wouldn't say that they are badly paid compared to local wages. One of the FAANG's outsourced customer support accounts here start at $11,000 yearly. It may not seem that much compared to U.S. wages, but that would easily place you in the highest 10% wages here.
- forum_ghost 5y ago11k puts you in the top 10% el salvadorian wages?
- el-salvador 5y agoHi! I'm updating my parent post with more accurate data: * $11K/year would place you in the top 16% wages * $14K/year would place you in the top 10% wages. This stats don't include commissions (like the ones sales teams get), people who are self employed, informal sector or business owners that don't receive a wage.
- Kostchei 5y agodid you read this bit?- "first surfaced....extortion demand on Brazil’s Ministry of Health" If you are still of the same opinion... Just saying that providing primary care by getting down there and using you skills to improve the situation would be preferable to simply extorting money because the bureaucracy running the care givers is flawed.
- swamp_cypress 5y agoIf this group can bribe insiders so easily, imagine what a state-level actor can do.
- greggsy 5y agoThe threat of coercion or bribery by a state actor is absolutely real, and has already played out in the past month. The threat of wilful cooperation by sympathetic employees with loyal ties to their homeland has also been a widely covered in several Chinese cases, less so by Russia. This isn’t isolated to those countries either - it’s almost certainly being done by the west too.
- hoseja 5y agoYou don't see many western nationals embedded in critical Chinese infrastructure. Not a very multicultural society, them.
- paxys 5y ago> imagine what a state-level actor can do More like, imagine what a state-level actor has done already. Heck they don't even need to carry out hacks of this nature. It would be trivial for a government to embed an agent at any tech company at a way higher level than customer support. Do people really think a top CS graduate recruited to a coveted intelligence role can't pass a FAANG interview?
- deleted 5y ago[deleted]
- Consultant32452 5y agoThe H1-B program was practically designed to give foreign agents an easy way into our infrastructure. Think of our top political enemies and consider which direction the Visas go.
- mrgill 5y ago
- bri3d 5y agoUnsurprised it's teenager(s) - a lot of their escalation and traversal attempts as well as their bragging made it seem as though they had not worked in industry. It's scary to think what someone with actual knowledge of common practice could do with the same kind of approaches.
- miohtama 5y agoMicrosoft, NVidia, Okta, EA all hacked by someone that’s not state sponsored and sophisticated. Tell’s quite a bit about the snake oil that is the current cybersecurity industry and its counterparts sloppy software development and lazy pointy haired boss.
- ziml77 5y agoIt's all been social engineering. Are you saying the software developers should have programmed all the humans in these organizations better?
- chockchocschoir 5y agomiohtama is not blaming one party in their comment, they are blaming three: - "cybersecurity industry" - "sloppy software development" - "lazy pointy haired boss" Combine the three, and you end up with breaches like these, although I agree that "sloppy software development" is probably the least likely source of these issues. Thinking that security is just checklists that have to be checked (thinking done by party #1 and party #3) probably carries most of the blame here.
- sobkas 5y ago> It's all been social engineering. Are you saying the software developers should have programmed all the humans in these organizations better? They should have used login mechanism that didn't failed so spectacularly as passwords. Anything that forces server to prove its identity to client, should be a good start.
- 5y ago
- f38zf5vdt 5y agoThe leader of the world's most dangerous hacking syndicate is a minor? How did we get here exactly, in cyberspace security terms?
- davikr 5y agoI feel like companies have invested a lot in securing internal services from external actors, and the threat model has moved to compromise these organizations from the inside with underpaid disgruntled employees being promised riches. It should be important not only to punish those insiders involved, but also to have the least possible permissions for developers, support desk workers or anyone really.
- chockchocschoir 5y ago> but also to have the least possible permissions for developers, support desk workers or anyone really. Considering that Okta say they already do "Zero Trust security" and giving people least possible authorization (and also that they were never breached in the first place, still), I don't have a lot of fate in the industry realizing anything from this breach.
- dboreham 5y agoA single low paid employee shouldn't have the access rights to do serious damage. For example Okta probably has rate-limits on how many users a CSR can reset the password for.
- phphphphp 5y agoI don’t think we got here, we’ve always been here: most of us don’t want to go to prison and risk aversion increases with age. Regardless of how (in)secure systems are, the abundance of bad actors will be those with a high risk tolerance.
- donkarma 5y agoWhen you're an adult, you lead the syndicates that nobody knows about. I doubt there are many minors in Equation Group
- amazd 5y agoDamn.. > “[He] slowly began making money to further expand his exploit collection,” reads his Doxbin entry. “After a few years his net worth accumulated to well over 300BTC (close to $14 mil).” > KrebsOnSecurity is not publishing WhiteDoxbin’s alleged real name because he is a minor (currently aged 17)
- bowmessage 5y agoNot to detract from their achievements..., but we could also simplify it a bit: > “After a few years his over 300BTC [appreciated] to $14 mil.”
- gigaflop 5y agoIf they're 17 years old, there's no way they bought into BTC recently. 5 years ago, BTC popped up to around $20k, and then fell down to near $3k. It took until December of 2020 to get back up to 20k. If they were on Tor, they would have known about BTC, and if they were interested in black-hatting, BTC would have probably been the most accessible financial instrument for them to use in that pursuit. I'm 99% sure someone like that would have had a stash kicking around somewhere. Think anyone paid the group for work? That'd be a good way to fill the coffers.
- dang 5y agoRecent and related: Okta’s Investigation of the January 2022 Compromise - https://news.ycombinator.com/item?id=30775180 https://news.ycombinator.com/item?id=30775180 - March 2022 (112 comments) New Updated Okta Statement on Lapsus$ - https://news.ycombinator.com/item?id=30774193 https://news.ycombinator.com/item?id=30774193 - March 2022 (24 comments) Updated Okta Statement on Lapsus$ - https://news.ycombinator.com/item?id=30769537 https://news.ycombinator.com/item?id=30769537 - March 2022 (220 comments) Also: DEV-0537 (LAPSUS$) Criminal actor targeting organizations - https://news.ycombinator.com/item?id=30774406 https://news.ycombinator.com/item?id=30774406 - March 2022 (0 comments) Lapsus$ hackers leak 37GB of Microsoft's alleged source code - https://news.ycombinator.com/item?id=30763623 https://news.ycombinator.com/item?id=30763623 - March 2022 (117 comments)
- bagels 5y ago"Many of LAPSUS$’s recruitment ads are written in both English and Portuguese. According to cyber intelligence firm Flashpoint, the bulk of the group’s victims (15 of them) have been in Latin America and Portugal." Are they victims or co-conspirators? These people were paid to provide access.
- tyingq 5y agoI imagine they meant the corporate victims. That is two separate pieces of evidence that they have some tie to Brazil: the recruits, and the selected corporate victims.
- spyremeown 5y agoAbout the language part: I'm a native speaker of Portuguese. Their posts on Reddit[1], requesting paid insiders on some mobile networks, are very clearly machine translated. When they started out, hacking the Ministry of Health here in Brazil, the defacing text had a wrong plural, and was written in a way that a native speaker never would. https://camas.github.io/reddit-search/#{%22author%22:%22oklaqq%22,%22searchFor%22:1,%22resultSize%22:100} https://camas.github.io/reddit-search/#{%22author%22:%22okla...
- rbanffy 5y agoIf I wanted to be hard to detect, I'd run my messages through a couple machine translators so any metrics you may want to collect would be distorted enough it wouldn't be easy to tie them to your own messaging. And that target is what made me first think of one or more government agents infiltrating and financing the group.
- etcet 5y agoHe bought and sold a doxing site and leaked all the doxers private dox so they super-doxed him in retaliation. After this, he didn't bother to change his username?
- TechBro8615 5y agoMaybe he’s getting framed
- rbanffy 5y agoI find that more than likely.
- sorenjan 5y ago> At an address listed in the leaked materials as the teen’s home near Oxford, a woman who identified herself as the boy’s mother talked with a Bloomberg reporter for about 10 minutes through a doorbell intercom system. The home is a modest terraced house on a quiet side street about five miles from Oxford University. > The woman said she was unaware of the allegations against her son or the leaked materials. She said she was disturbed that videos and pictures of her home and the teen’s father’s home were included. The mother said the teenager lives at that address and had been harassed by others, but many of the other leaked details couldn’t be confirmed. > She declined to discuss her son in any way or make him available for an interview, and said the issue was a matter for law enforcement and that she was contacting the police. https://www.bloomberg.com/news/articles/2022-03-23/teen-suspected-by-cyber-researchers-of-being-lapsus-mastermind https://www.bloomberg.com/news/articles/2022-03-23/teen-susp...
- bertil 5y agoThe press is slowly starting to realise that harrassing a teenager might make them the baddies.
- Terry_Roll 5y ago> The teen is so skilled at hacking -- and so fast-- that researchers initially thought the activity they were observing was automated, another person involved in the research said. Thats when you know you are in the zone! I love the zone.
- rbanffy 5y agoI find it hard to swallow this group is not state-sponsored or, at least, wasn't hired by some state agent at some point.
- pelagicAustral 5y agoPhishing-resistant 2FA is the way I reckon. I think this was included in the Zero Trust Architecture being pushed hard by the US Government post-colonial pipeline debacle.