6 ms·

If 15-21yo skiddies can buy their way in and carry out acts like these via Discord and Telegram, imagine what the real state-sponsored threat actors are doing t

by branon 4y ago

If 15-21yo skiddies can buy their way in and carry out acts like these via Discord and Telegram, imagine what the real state-sponsored threat actors are doing that we never even hear about. These guys have got to just be clowns, media fodder, right? State actors aren't using Discord and storing their loot on AWS.

boomboomsubban 4y ago
>State actors aren't storing their loot on AWS https://www.datacenterdynamics.com/en/news/cia-awards-multibillion-c2e-cloud-contract-aws-microsoft-google-oracle-and-ibm/ https://www.datacenterdynamics.com/en/news/cia-awards-multib...
reaperducer 4y ago
If 15-21yo skiddies can buy their way in I think it's interesting that they're buying their way in. Do those accounts not sell for very much? Also, now that I know they just buy stolen credentials, and don't even have the talent to actually hack their way into the systems, I'm underwhelmed by their achievements.
- ushakov 4y ago
  keep in mind that the lapsus guys aren't your average schoolkids they have collected about $14 million dollars in crypto from various cyber-crime activities and ventures they were offering up to $20k for intel/credentials publicly on their Telegram source: https://www.bbc.com/news/technology-60864283 https://www.bbc.com/news/technology-60864283
  - rosndo 4y ago
- tredre3 4y ago
  > Also, now that I know they just buy stolen credentials, and don't even have the talent to actually hack their way into the systems, I'm underwhelmed by their achievements. It seems to be a common sentiment on hacker news, that they're script kiddies and what they did "doesn't count" as real hacking. But doesn't that just makes things worse? It means anybody can break into anything, given basic social and computing skills. There is clearly a very big complacency problem in our industry and maybe we should do something about it.
cronix 4y ago
Maybe not on discord, but here's 100GB of stuff someone found on AWS that NSA left public...discovered in 2017 but created in 2013. > 29 Nov 2017 > The NSA has been hit by yet another data leak, as over 100GB of sensitive, classified data was exposed through shoddy security practises. > The leak came from a virtual copy of a hard drive belonging to US Intelligence and Security Command (INSCOM), an intelligence organisation operating within both the US Army and the NSA. > The virtual disk image was discovered by UpGuard cyber risk research director Chris Vickery on an unprotected public Amazon S3 server, meaning that anyone who knew the web address where the data was stored could freely access it. https://www.itpro.com/security/30060/100gb-of-secret-nsa-data-found-on-unsecured-aws-s3-bucket https://www.itpro.com/security/30060/100gb-of-secret-nsa-dat...

by branon 4y ago

boomboomsubban 4y ago

>State actors aren't storing their loot on AWS https://www.datacenterdynamics.com/en/news/cia-awards-multibillion-c2e-cloud-contract-aws-microsoft-google-oracle-and-ibm/ https://www.datacenterdynamics.com/en/news/cia-awards-multib...

reaperducer 4y ago

If 15-21yo skiddies can buy their way in I think it's interesting that they're buying their way in. Do those accounts not sell for very much? Also, now that I know they just buy stolen credentials, and don't even have the talent to actually hack their way into the systems, I'm underwhelmed by their achievements.

ushakov 4y ago
keep in mind that the lapsus guys aren't your average schoolkids they have collected about $14 million dollars in crypto from various cyber-crime activities and ventures they were offering up to $20k for intel/credentials publicly on their Telegram source: https://www.bbc.com/news/technology-60864283 https://www.bbc.com/news/technology-60864283
- rosndo 4y ago
tredre3 4y ago
> Also, now that I know they just buy stolen credentials, and don't even have the talent to actually hack their way into the systems, I'm underwhelmed by their achievements. It seems to be a common sentiment on hacker news, that they're script kiddies and what they did "doesn't count" as real hacking. But doesn't that just makes things worse? It means anybody can break into anything, given basic social and computing skills. There is clearly a very big complacency problem in our industry and maybe we should do something about it.

cronix 4y ago

Maybe not on discord, but here's 100GB of stuff someone found on AWS that NSA left public...discovered in 2017 but created in 2013. > 29 Nov 2017 > The NSA has been hit by yet another data leak, as over 100GB of sensitive, classified data was exposed through shoddy security practises. > The leak came from a virtual copy of a hard drive belonging to US Intelligence and Security Command (INSCOM), an intelligence organisation operating within both the US Army and the NSA. > The virtual disk image was discovered by UpGuard cyber risk research director Chris Vickery on an unprotected public Amazon S3 server, meaning that anyone who knew the web address where the data was stored could freely access it. https://www.itpro.com/security/30060/100gb-of-secret-nsa-data-found-on-unsecured-aws-s3-bucket https://www.itpro.com/security/30060/100gb-of-secret-nsa-dat...