Checkout.com hacked, refuses ransom payment, donates to security labs

https://www.checkout.com/blog/protecting-our-merchants-standing-up-to-extortion

by StrangeSound • 8 months ago

622 265 8 months ago

throwaway20372• 8 months ago

I love this part (no trolling from me):

    > We are sorry. We regret that this incident has caused worry for our partners and people. We have begun the process to identify and contact those impacted and are working closely with law enforcement and the relevant regulators. We are fully committed to maintaining your trust.

I know there will by a bunch of cynics who say that an LLM or a PR crisis team wrote this post... but if they did, hats off. It is powerful and moving. This guys really falls on his sword / takes it on the chin.

M4v3R• 8 months ago

Words are cheap, but "We are sorry." is a surprisingly rare thing for a company to say (they will usually sugarcoat it, shift blame, add qualifiers, use weasel words, etc.), so it's refreshing to hear that.

sunaookami• 8 months ago

This is a classic example of a fake apology: "We regret that this incident has caused worry for our partners and people" they are not really "sorry" that data was stolen but only "regret" that their partners are worried. No word on how they will prevent this in the future and how it even happened. Instead it gets downplayed ("legacy third-party","less than 25% were affected" (which is a huge number), no word on what data exactly).

sigmoid102• 8 months ago

I'll never not think of that South Park scene where they mocked BP's "We're so sorry" statement whenever I see one of those. I don't care if you're sorry or if you realize how much you betrayed your customers. Tell me how you investigated the root causes of the incident and how the results will prevent this scenario from ever happening again. Like, how many other deprecated third party systems were identified handling a significant portion of your customer data after this hack? Who declined to allocate the necessary budget to keep systems updated? That's the only way I will even consider giving some trust back. If you really want to apologise, start handing out cash or whatever to the people you betrayed. But mere words like these are absolutely meaningless in today's world. People are right to dismiss them.

YetAnotherNick• 8 months ago

Right. Transparency doesn't mean telling about the attack that already happened. It means telling us about their issues and ways this could happen again. And they didn't even mention the investment amount for the security labs.

jacquesm7• 8 months ago

I wouldn't be so quick. Everybody gets hacked, sooner or later. Whether they'll own up to it or not is what makes the difference and I've seen far, far worse than this response by Checkout.com, it seems to be one of the better responses to such an event that I've seen to date.

Like, how many other deprecated third party systems were identified handling a significant portion of your customer data after this hack?

The problem with that is that you'll never know. Because you'd have to audit each and every service provider and I think only Ebay does that. And they're not exactly a paragon of virtue either.

Who declined to allocate the necessary budget to keep systems updated?

See: prevention paradox. Until this sinks in it will happen over and over again.

But mere words like these are absolutely meaningless in today's world. People are right to dismiss them.

Again, yes, but: they are at least attempting to use the right words. Now they need to follow them up with the right actions.

pembrook• 8 months ago

In attacks on software systems specifically though, I always find this aggressive stance toward the victimized business odd, especially when otherwise reasonable security standards have been met. You simply cannot plug all holes.

As AI tools accelerate hacking capabilities, at what point do we seriously start going after the attackers across borders and stop blaming the victimized businesses?

We solved this in the past. Let’s say you ran a brick-and-mortar business, and even though you secured your sensitive customer paperwork in a locked safe (which most probably didn’t), someone broke into the building and cracked the safe with industrial-grade drilling equipment.

You would rightly focus your ire and efforts on the perpetrators, and not say ”gahhh what an evil dumb business, you didn’t think to install a safe of at least 1 meter thick titanium to protect against industrial grade drilling!????”

If we want to have nice things going forward, the solution is going to have to involve much more aggressive cybercrime enforcement globally. If 100,000 North Koreans landed on the shores of Los Angeles and began looting en masse, the solution would not be to have everybody build medieval stone fortresses around their homes.

josfredo• 8 months ago

No trolling on my side, I think having people who think just like you is a triumph for humanity. As we approach times far darker and manipulation takes smarter shapes, a cynical mind is worth many trophies.

ema• 8 months ago

prevent this scenario from ever happening again.

Every additional nine of not getting hacked takes effort. Getting to 100% takes infinite effort i.e. is impossible. Trying to achieve the impossible will make you spin on the spot chasing ever more obscure solutions.

As soon as you understand a potential solution enough to implement it you also understand that it cannot achieve the impossible. If you keep insisting on achieving the impossible you have to abandon this potential solution and pin your hope on something you don't understand yet. And so the cycle repeats.

It is good to hold people accountable but only demand the impossible from those you want to go crazy.

bargainbin• 8 months ago

The intent of the South Park sketch was to lampoon that BP were (/are) willingly doing awful things and then give corpo apology statements when caught.

Here, Checkout has been the victim of a crime, just as much as their impacted customers. It’s a loss for everyone involved except the perpetrators. Using words like “betrayed” as if Checkout wilfully mislead its customers, is a heavy accusation to level.

At a point, all you can do is apologise, offer compensation if possible, and plot out how you’re going to prevent it going forward.

gosub100• 8 months ago

What you request is for them to divulge internal details of their architecture that could lead to additional compromise as well as admission of fault that could make it easier for them to be sued. All for some intangible moral notion. No business leader would ever do those things.

saulpw• 8 months ago

They are donating the entire ransom amount to two universities for security research. I don't care about the words themselves, but assuming they're not outright lying about this, that meant a lot to me. They are putting their (corporate!) money where their mouth is.

renewiltord• 8 months ago

Haha, yes, this is entirely what I expected. I was actually pleasantly surprised by the GP because internet commentators always find a reason that some statement is imperfect.

Indeed, an apology is bad and no apology is also bad. In fact, all things are bad. Haha! Absolutely prime.

stronglikedan• 8 months ago

Can't please everybody all the time, so best to focus on the majority.

blitzar4• 8 months ago

We are fully committed to maintaining your trust.

We are fully committed to rebuilding your trust.

mannanj• 8 months ago

I like you like this. For me it’s close but fails in the word selection in the last sentence: “maintaining” trust is not what I would say their job is at this point, it’s “restoring” it.

One places the company at the center as the important point of reference, avoiding some responsibility. The other places the customer at the center, taking responsibility.

udev40963• 8 months ago

Since when did owning up to a data breach become such a noteworthy event? Less than 25% sounds more like exactly 25% of impacted customers

tippa123• 8 months ago

Refreshing to not see "due to an abundance of caution". Kudos to the response in general, they pretty much ticked all boxes.

Animats• 8 months ago

The hard line:

"We will pay $500,000 to anyone who can provide information leading to the arrest and conviction of the perpetrators. If the perpetrators can be clearly identified but are not in a country which extradites to or from the United States, we will pay $500,000 for their heads."

gpm• 8 months ago

You're not allowed to sponsor the murder of people in other countries just because they won't extradite to your country. If you did this from within the US, the federal government and probably whatever state you live in would rightfully consider this murder for hire.

Your recourse within US law is to petition the government to do something about it. Negotiate extradition. Go to war. Etc.

lexlambda• 8 months ago

The donation is more or less virtue signaling rather than actual insight.

The problem can not be helped by research research against cybercrime. Proper practices for protections are well established and known, they just need to be implemented.

The amount donated should've rather be invested into better protections / hiring a person responsible in the company.

(Context: The hack happened on a not properly decomissioned legacy system.)

varispeed• 8 months ago

There is not much to research. If companies want security, they should pay for security.

dspillett2• 8 months ago

If companies want security, they should pay for security.

Or just properly follow best-practise, and their own procedures, internally.⁰

That was the failing here, which in an unusual act of honesty they are taking responsibility for in this matter.

--------

[0] That might be considered paying for security, indirectly, as it means having the resources available to make sure these things are done, and tracked so it can be proven they are done making slips difficult to happen and easy to track & hopefully rectify when they inevitably still do.

rollcat3• 8 months ago

Security is an arms race. Don't expect a leap; do your part to stay ahead.

walletdrainer26• 8 months ago

It is virtue signaling, especially considering the fact that doing the hard to swallow thing of paying the ransom would probably be the best outcome from a customer perspective.

Yes there are negative externalities in funding ransomware operations, not paying is still much more likely to hurt your customers than paying.

saberience7• 8 months ago

Paying ransomware fines is never the smart move to do unless you happen to trust what cyber criminals tell you.

You send them the payment, they tell you they deleted the data, but they also sell the data to 10 other customers over the dark-web.

Why would you ever trust people who are inherently trustworthy and who are trying to screw you? While also encouraging further ransomware crimes in the future.

whimsicalism6• 8 months ago

Doing the positive externality thing at expense of your bottom line is to be praised. It is not ‘virtue signaling’ - it is actually doing a virtuous thing.

satisfice• 8 months ago

What is the problem with virtue signaling? By all means signal virtue! Perhaps you are concerned by cheap virtue signals, which have little significance.

The point here is that this is an expensive virtue signal. Although, it would be more effective if we knew how expensive it was.

pjc50• 8 months ago

At the stage we're at, I would far prefer virtue signalling to the more widespread vice signalling.

dspillett2• 8 months ago

The donation is more or less virtue signalling rather than actual insight.

I see it more as a middle finger to the perps: “look, we can afford to pay, here, see us pay that amount elsewhere, but you aren't getting it”. It isn't signalling virtue as much as it is signalling “fuck you and your ransom demands” in the hope that this will mark them as not an easy target for that sort of thing in future.

bonesss• 8 months ago

It also serves as a proxy for a punishment. They are, from one perspective, paying a voluntary fine based on their own assessment of their security failings.

For customers it signals sincerity and may help dampen outrage in their follow up dealings.

AlienRobot• 8 months ago

I don't know what virtue signaling means. I think you mean they just did it out of spite.

TacticalCoder• 8 months ago

Refusing to pay a ransom and instead giving the money to the "ennemies" of the attackers isn't "virtue signaling" (as someone already commented: it's a "fuck you" to the attackers).

In french we call that a "pied de nez". "Turning the table" / "Poetic justice" / "Adding insult to injury" would all be more correct than "virtue signalling".

If there was no attacker and the company gave half a mil out of nowhere to a security company (or a charity) and boasted publicly about it, that would be virtue signalling.

But refusing to pay the ransom and giving the exact same amount to security researchers is just a big, giant, middle finger.

And a middle finger ain't no virtue signalling.

blitzar4• 8 months ago

They should have watched Ransom (1996).

https://www.youtube.com/watch?v=xllIU0lPgqs

technion• 8 months ago

I was just thinking of this scene as I read their report.

Timpy• 8 months ago

Yes but I think it's a good virtue to signal considering the circumstances. If they paid the ransom that would signal that ransoming this company works, incentivizing more ransoms. If they refuse to pay the ransom it might signal that they care more about money than they do integrity. Taking the financial hit of the ransom, but paying it to something that signals their values, is about the best move I can imagine.

marcosdumay• 8 months ago

Proper practices for protections are well established and known

Endpoint security is a well known open problem for what no sufficient practices and protections exist.

dominicrose• 8 months ago

Virtue signaling is an insult that you can for example use against greenwashing or against someone who pledged to donate a lot of money to some charity but actually donated none or much less. Hypocrisy is also a form of virtue signaling.

It's also a term you can use against political opponents because it's much easier to speak well than to actually do good.

Refusing to negociate with criminals and help fund security seems like the proper long-term reaction for everyone.

whimsicalism6• 8 months ago

Requiring everyone to implement proper practices is one way of addressing the problem, I might call it Sisyphean & impossible.

Making it illegal to pay ransom is likely a much easier to implement and more effective solution.

And this isn’t virtue signaling - they literally did the virtuous thing that is better for society at the expense of their bottom line. That is just virtue.

make3• 8 months ago

Sidenote, it's interesting how the term "virtue signaling" is arguably objectively an individualistic right-wing dog whistle these days.

I would argue that it is being used all over the media to complain about anyone showing any signs of not being purely individualistic, as if individualism is the only true thing people actually honestly feel. This is obviously incorrect, empathy, professionalism, a desire for a sense of purpose, are all things that people objectively feel in the real world, everyday, everywhere.

I would argue that the expression "virtue signaling" is used systematically in individualistic right wing media by the right about anyone who say, for example, that they care about minorities or less fortunate people or to take action to support them, as if it was false. I would argue that this is harmful.

People do care a good fraction of the time, and they should be recognized for their positive actions, and encouraged. I would argue that we should definitely strive for a culture where individualism is not seen as the only true emotion that people can feel.

So, knowing the negative political and philosophical baggage, I would not use that expression, especially if you don't have actual proof that they don't care about security, professionalism, etc.

pm2222• 8 months ago

Could this be aws s3?

dave1999x• 8 months ago

yeh, I am skeptical about "third party"

thedougd• 8 months ago

I’m thinking a SFTP or file sharing gateway. Think MoveIT, GoAnywhere, ShareFile, etc.

IMO, these aren’t safe to use anymore.

saberience7• 8 months ago

I was guessing it's a OneDrive, Google Drive, DropBox or something.

Probably someone was phished and they still had access to an old shared drive which still had this data. Total guess but reading between the lines it could be something like this.

prodigycorp2• 8 months ago

If i was a customer id be pissed off, but this is as good as a response you can have to an incident like this.

- timely response

- initial disclosure by company and not third party

- actual expression of shame and remorse

- a decent explanation of target/scope

i could imagine being cyclical about the statement, but look at other companies who have gotten breached in the past. very few of them do well on all points

walletdrainer26• 8 months ago

as good as a response you can have to an incident like this.

From customer perspective “in an effort to reduce the likelihood of this data becoming widely available, we’ve paid the ransom” is probably better, even if some people will not like it.

Also to really be transparent it’d be good to post a detailed postmortem along with audit results detailing other problems they (most likely) discovered.

croemer• 8 months ago

Depends. Not paying ransom decreases the likelihood of being attacked in the future.

jacquesm7• 8 months ago

No, that would not help me as a customer. Because I would never believe that that party would keep their word, besides, it can't be verified. You'll have that shadow hanging around for ever. The good thing is that those assholes now have less budget to go after the next party. The herd is safe from wolves by standing together, not by trying to see which of their number should be sacrificed next.

tobyhinloopen• 8 months ago

I strongly disagree. Paying the ransom will put everyone in danger.

rollcat3• 8 months ago

Never pay the ransom.

The extortionist knows they cannot prove they destroyed the data, so they will eventually sell it anyway.

They will maybe hold off for a bit to prove their "reputation" or "legitimacy". Just don't pay.

weird-eye-issue3• 8 months ago

Ah yes let's fund literal criminal groups so they have an incentive to keep hacking people

gchamonlive4• 8 months ago

You mean as a customer you'd feel better if the company victim of ransom would help fund the very group that put the business and your data in jeopardy?

embedding-shape2• 8 months ago

- timely response

Timely in what way? Seems they didn't discover the hack themselves, didn't discover it until the hackers themselves reached out last week, and today we're seeing them acknowledging it. I'm not sure anything here could be described as "timely".

prodigycorp2• 8 months ago

I have been doing a self Have I Been Pwned audit and, reading many company blog posts, and it wasn't uncommon to see disclosure months after incidents.

elAhmo2• 8 months ago

If we just let the companies go away with 'we are sorry' and say that is as good as it gets, then this industry is up for far more catastrophic situations in the future. Criminal liability, refunds to customers, requirements from regulators might move things in the right direction, but letting companies have shitty practices by hoarding data they don't need and putting customers at risk is definitely something that should be looked at with more scrutiny.

troyvit2• 8 months ago

It depends on the crime though right? This was all legacy data and from the description the worst thing they got was contact information that's five years older or more ("internal operational documents and merchant onboarding materials at that time.").

For that level of breach their response seems about right to me, especially waving the money in ShinyHunters' face before giving it away to their enemies.

dmoreno• 8 months ago

When they say "The episode occurred when threat actors gained access to this third party legacy system which was not decommissioned properly. " for me it sounds like a not properly wiped disk that got into the the bad guys hands. It would be interesting to know more to be prepared for proper decommissioning of hardware.

actionfromafar2• 8 months ago

Or a cloud server which was never turned off.

nektro• 8 months ago

sounds like an S3 bucket that wasn't deleted

arbll• 8 months ago

The attackers gained access to a legacy, third-party cloud file storage system.

I think the answer is ok but the "third-party" bit reads like trying to deflect part of the blame on the cloud storage provider.

zwnow3• 8 months ago

The whole codebase & tools at whatever company I ever worked at was using 99% legacy stuff. Its wild...

Often times it would have been easier to rebuild the whole project over trying to upgrade 5-6 year old dependencies.

Ultimately the companies do not care about these kinda incidents. They say sorry, everyone laughs at them for a week and then after its business as usual, with that one thing fixed and still rolling legacy stuff for everything else.

weird-eye-issue3• 8 months ago

Often times it would have been easier to rebuild the whole project

Sure buddy, sure

bearjaws• 8 months ago

All stuff is legacy the moment you deploy it.

All work created by a company decays, it's legacy code within months.

ryukoposting• 8 months ago

For all their boasting, I can't help but wonder how their response would have been different if the attackers actually had gotten their hands on sensitive data.

nashashmi• 8 months ago

Sometimes cyber insurance will come to the rescue. That’s why companies Don’t pay.

saberience7• 8 months ago

So, I used to work in the fintech world and it looks to me like what was hacked was merchant KYB documents. I.e. when a merchant signs up for a PSP they have to provide various documentation about the business so the PSP can underwrite the risk of taking on this business. I.e. some PSPs won't deal with porn companies or travel companies or companies from certain regions etc.

This sort of data is generally treated very differently to the actual PANs and payment information (which are highly encrypted using HSMs).

So it's obviously shitty to get hacked, but if it was just KYB (or KYC) type information, it's not harming any individuals. A lot of KYB information is public (depending on country).

Fair play on them for being open about this.

globalise833• 8 months ago

It's not just business data though - usually it will include ultimate beneficial owner and directors' passports, tax ID, etc. So there is a risk of identity theft there of potentially some very wealthy individuals.

globalise833• 8 months ago

"The system was used for internal operational documents and merchant onboarding materials at that time"

To me it seems most likely that this is data collected during the KYC process during onboarding, meaning company documents, director passport or ID card scans, those kind of things. So the risk here for at least a few more years until all identity documents have expired is identity theft possibilities (e.g. fraudsters registering their company with another PSP using the stolen documents and then processing fraudulent payments until they get shut down, or signing up for bank accounts using their info and tax id).

saberience7• 8 months ago

Passport or ID card scans would never be be stored alongside general KYB information, e.g. the standard forms PSPs use.

If you read between the lines of the verbiage here, it looks like a general archived dropbox of stuff like PDF documents which the onboarding team used.

Since GDPR etc, items like passports, driving license data etc, has been kept in far more secure areas that low-level staff (e.g. people doing merchant onboarding) won't have easy access to.

I could be wrong but I would be fairly surprised if JPGs of passports were kept alongside docx files of merchant onboarding questionnaires.

globalise833• 8 months ago

docx files of merchant onboarding questionnaires

Why would merchants fill out docx files? They would submit an online form with their business, director and UBO details, that data would be stored in the Checkout.com merchants database, and any supporting documents like passport scans would be stored in a cloud storage system, just like the one that got hacked.

If it was just some internal PDFs used by the onboarding team, probably they wouldn't make such a big announcement.

nebezb• 8 months ago

Passport or ID card scans would never be be stored alongside general KYB information

How do you qualify this statement? Did you mean “should never”? Even then, you’re likely overstating things. Nothing prevents co-locating KYC/KYB information. On the contrary, most businesses conducting KYB are required to conduct UBO and they’re trained to combine them both. Register as a director/officer with any FSI in North America and you’ll see.

walletdrainer26• 8 months ago

So the risk here for at least a few more years until all identity documents have expired is identity theft possibilities

Essentially nobody checks the validity of document numbers, there’s rarely any automated mechanism to do this. You could just photoshop the expiry dates on the documents and use them for years and years, even if document designs changed you could just transplant the info from the old document into a new template.

So no, documents expiring does mostly nothing to alleviate identity theft risks in most of the world.

And anyway, targeted phishing attacks are of much much higher severity than identity theft. From this data you can probably gather everything you’d need to perform rather high quality phishing attacks against the bank accounts of checkout.com clients, easily causing tens or hundreds of millions of losses that would never be recovered.

lateforwork• 8 months ago

This should be law. Any company that is hacked should be required by law to make a sizeable investment in a third-party security research company.

yreg4• 8 months ago

Security reasearch lab during the day day, ransomware org at night conspiracy coming soon.

blitzar4• 8 months ago

"Firefighter arson is a persistent phenomenon involving a very small minority of firefighters who are also active arsonists ... It has been reported that roughly 100 U.S. firefighters are convicted of arson each year."

squigz• 8 months ago

It wouldn't require a conspiracy for these companies to 'invest' in security companies they have ties to. Throw in tax incentives and loopholes and whatnot and it turns out not to hurt the original company at all.

walletdrainer26• 8 months ago

https://news.risky.biz/risky-bulletin-us-indicts-two-rogue-c...

US indicts two rogue cybersecurity employees for ransomware attacks

amelius2• 8 months ago

Isn't it illegal in many countries to pay a ransom?

(If not, why not?)

(Imho, it would make sense if only the state can pay ransoms)

vntok2• 8 months ago

Typically, companies wouldn't really pay an actual ransom like unmarked bills stacked in a paper bag and thrown out from a bridge onto a passing barge.

Instead, you would pay (exhorbitant) consulting fees to a foreign-based "offensive security" entity, and most of the time get some sort of security report that says if you'd simply plug this and that holes, your systems would now be reasonably safe.

amelius2• 8 months ago

Typically, companies wouldn't really pay an actual ransom like unmarked bills stacked in a paper bag and thrown out from a bridge onto a passing barge.

Yes, that's why cryptocurrencies are a gift from heaven for these hacker groups.

Therefore, even if paying ransom money (somehow) must be legal, maybe it should be illegal to use crypto for it. You don't want to make it too easy to run this type of criminal business.

walletdrainer26• 8 months ago

Instead, you would pay (exhorbitant) consulting fees to a foreign-based "offensive security" entity

Lots of US based incident response companies handling ransomware payments, this isn’t the domain of some sketchy foreign offsec joints.

walletdrainer26• 8 months ago

It is generally not illegal. I’ve been following this for a while and can not think of any place where it would be.

Why not? Legislators haven’t caught up yet, and banning ransom payments would likely cause some very uncomfortable situations.

This of course raises some pretty uncomfortable questions, should ransom payments in kidnapping cases be banned too? That would presumably cost actual human lives.

A more pressing issue is that banning ransom payments might dissuade ransomware, but wouldn’t affect the main problem of financially motivated hacking. The costs of these attacks are so low that a ransomware payments ban would probably not have stopped checkout.com from being hacked and having their customer data stolen, the criminals will still do crime even if they have to do slightly different crime that pays less.

The group responsible in this case was just selling data stolen from their victims for a long time before they pivoted to much more profitable ransom operations.

dizhn• 8 months ago

Giving me MBA vibes. Will they close up shop and go when it's the remaining 75% of their infrastructure next time?

nalekberov• 8 months ago

At this point I think we all understand that we will never be able to trust any company in this world with our data.

In most cases they can get away with "We are sorry" and "Trust me, bro" attitude.

vntok2• 8 months ago

Checkout.com hacked, refuses ransom payment, donates to security labs

This submission's edited title reads like the "target headline" from The Office (US):

Scranton Area Paper Company - Dunder Mifflin - Apologizes - to Valued Client - Some Companies - Still Know - How - Business - is - Done

betimd• 8 months ago

I have checkout.me domain, and it is for sale. email me if you want to get it.

system25• 8 months ago

How much do you want for it?

zetanor• 8 months ago

They're "sorry", they want to be "transparent" and "accountable", they want your "trust", but not enough to publicly explain what happened or what kind of data got taken (is a full CRM backup from 6 years ago considered "legacy" "internal operational documents"?). There's not even a promise to produce more information about their mistake.

Jimmy, where did the cookies go?
Something that was on the counter is gone! I don't know how! It might not even be my fault! But I'm sorry!

What kind of an apology is that? It's not. It's marketing for the public while they contact the "less than 25% of [their] current merchant base" whose (presumably sensitive) information was somehow in "internal operational documents".

Oh but also took some of what they charge their customers and gave that (undisclosed?) sum away to a university. They must be really sorry.

antonyh2• 8 months ago

I don't think they meant OXCIS, that seems to be a centre for Islamic Studies https://en.wikipedia.org/wiki/Oxford_Centre_for_Islamic_Stud...

I can't quite work out who they donated to - it seems there are a number of Oxford Uni cybersec/infosec units. Any idea which one?

saberience7• 8 months ago

I guess it just means this: https://www.cybersecurity.ox.ac.uk/

"Cyber Security Oxford is a community of researchers and experts working under the umbrella of the University of Oxford’s Academic Centre of Excellence in Cyber Security Research (ACE-CSR)."

antonyh2• 8 months ago

Probably, I'm not sure it's not https://gcscc.ox.ac.uk/

I don't think it's https://www.infosec.ox.ac.uk/

There's also this AI security research lab, https://lasr.plexal.com/

It looks like Oxford are quite busy in this space.

joshmn2• 8 months ago

It’s notable that there were ShinyHunters members arrested by the FBI a few years ago. I was in prison with Sebastian Raoult, one of them. We talked quite a bit.

The level of persistence these guys went through to phish at scale is astounding—which is how they gained most of their access. They’d otherwise look up API endpoints on GitHub and see if there were any leaked keys (he wasn’t fond of GitHub's automated scanner).

https://www.justice.gov/usao-wdwa/pr/member-notorious-intern...

ants_everywhere• 8 months ago

(he wasn’t fond of GitHub's automated scanner

Do you mean they thought the scanner was effective and weren't fond of it because it disrupted their business? Or do you mean they had a low opinion of the scanner because it was ineffective?

joshmn2• 8 months ago

He would complain that it disrupted their business, and that it doesn't catch all keys—it catches the big ones that he certainly found to be very valuable.

rkozik1989• 8 months ago

Generally speaking, humans are more often than not the weakest link the chain when it comes to cyber security, so the fact that most of their access comes from social engineering isn't the least bit surprising.

They themselves are likely to some extent the victims of social engineering as well. After all who benefits from creating exploits for online games and getting children to become script kiddies? Its easier (and probably safer) to make money off of cyber crime if your role isn't committing the crimes yourself. It isn't illegal to create premium software that could in theory be use for crime if you don't market it that way.

Thorrez7• 8 months ago

It isn't illegal to create premium software that could in theory be use for crime if you don't market it that way.

Who is making money off of selling premium software, that's not marketed as for cybercrime, to non-governmental attackers? Wouldn't the attackers just pirate it?

stingraycharles• 8 months ago

Reminds me of a co-founder of an adtech company I know. They are a platform that buys inventory using automated trading, mostly mobile, and they realized that most of their customers were all clickfraud / scammers / etc. He didn’t want to go into too much detail.

But he shrugged it off.

I bet there are quite a few shops online that may sell gift cards that are used in money laundering schemes. Bonus points if they accept bitcoin.

But those are all quite implicitly used by cybercrime. I can imagine there are quite a few tools at their disposal that are much more explicit.

aeternum2• 8 months ago

I'm not sure this is very fair because humans are often not given the right tools to make a good decision. For example:

To gift to a 529 regardless of the financial institution, you go to some random ugift529.com site and put in a code plus all your financial info. This is considered the gold standard.

To get a payout from a class-action lawsuit that leaked your data, you must go to some other random site (usually some random domain name loosely related to the settlement recently registered by kroll) and enter basically more PII than was leaked in the first place.

To pay your fed taxes with a credit card, you must verify your identity with some 3rd party site, then go to yet another 3rd party site to enter your CC info.

This is insane and forces/trains people to perform actions that in many other scenarios lead to a phishing attack.

jcims• 8 months ago

I worked at a $xxxB company that had an internal red team. They ran almost as a separate company but were housed in one of our offices.

I was involved in probably 15 operations with them while I was there. They would usually get C&C within six hours, every single time it was phishing lol.

brotherloops• 8 months ago

Insofar as every security mechanism was made by a human, yes.

But if we're holding users accountable because 1 out of every 100 clicks a link in a phishing email like clockwork, we're bad at both statistics and security.

red-iron-pine3• 8 months ago

The level of persistence these guys went through to phish at scale is astounding—which is how they gained most of their access.

explain

edm0nd5• 8 months ago

damn that sucks they threw you in fed prison for running a sports streaming website.

did you have bulletproof hosting and they caught you through other means like going after your payment providers or you made opsec mistakes or how exactly?

was it a website like Sportsurge where it simply linked to streams or did it actually host the streams?

WhereIsTheTruth• 8 months ago

They are downplaying the severity of the data theft, which most likely includes user identification documents, the most dangerous type of breach, since it directly enables identity theft

Reading between the lines reveals the severity they're obfuscating, with contradictions:

This incident has not impacted our payment processing platform. The threat actors do not have, and never had, access to merchant funds or card numbers.
The system was used for internal operational documents and merchant onboarding materials at that time.
We have begun the process to identify and contact those impacted and are working closely with law enforcement and the relevant regulators

They stress that "merchant funds or card numbers" weren't accessed, yet acknowledge contacting "impacted" users, this begs the question: how can users be meaningfully "impacted" by mere onboarding paperwork?

thrdbndndn• 8 months ago

Yeah, they keep repeating what wasn't accessed but never say what actually was.

system25• 8 months ago

They are pro at misdirection, that's for sure.

another_twist• 8 months ago

I dont understand some of the cynicism in this thread. This is a bold move and I support. It is impossible to not have incidents like this and until theres a proper post mortem we wont really know how much of it can be attributed to carelessness. They could have just kept is hush hush but I appreciate that they came forward with it and also donated money to academia. The research will be open and everybody benefits.

whimsicalism6• 8 months ago

It’s hacker news, people feel that cynicism elevates them in some way.

system25• 8 months ago

Cynicism? The post they published is blaming the 3rd party and "legacy" bs. They are talking about "credit cards are safe," but 25 god damn percent of their merchants' data have been leaked. This is messed u, and they play it cool by saying "we donated money because the issue wasn't o big deal". I read that posts as a professional deflection.

begueradj• 8 months ago

If everyone refuses to pay, such incidents would largely reduce.

skeeter20203• 8 months ago

Interesting spin for a core infrastructure provider who deals with the most sensitive part of most businesses, tries to bury the lede of getting hacked with a tale of their virtuous refusal to pay a ransom; is this supposed to make them attractive or just have people skip the motivating events? Swing and a miss in my books.

JohnMakin• 8 months ago

While a nice gesture, I'm not so certain that if I were one of their "less than 25%" of customers impacted that I'd be so pleased. Why not compensate them instead?

whimsicalism6• 8 months ago

Bravo - I find this incredibly courageous and will consider being their customer in the future.

system25• 8 months ago

What is courageous about having a crappy infrastructure and blaming a 3rd party with fancy words like "legacy"? They got hacked and leaked 25% of their merchants' very critical onboarding data. What do you find courageous about this?

whimsicalism6• 8 months ago

Most people pay ransom payments.

yieldcrv2• 8 months ago

The threat actors do not have, and never had, access to merchant funds or card numbers.
The system was used for internal operational documents and merchant onboarding materials at that time.

Ah so just all of your KYC for founders, key personnel, and the corporation to impersonate business accounts

We estimate that this would affect less than 25% of our current merchant base.

Yikes, this affects 25% of their current merchant base.

amatecha• 8 months ago

"Checkout.com hacked" -> links to checkout.com lol

tsoukase• 8 months ago

I wish they disclose the donated amount and if the target departments will help the company in any way in reverse.

user3939382• 8 months ago

When you build a computing stack thats inside out and architecturally makes no sense you get fun stories like these.

more_corn• 8 months ago

Someone should make a bounty market for hunting and destroying ransomware organizations.

Checkout.com hacked, refuses ransom payment, donates to security labs

Related Stories