Archive | January, 2010

Groundspeed 1.1 – Web Application Security Add-on For Firefox

Find your website's Achilles' Heel


Groundspeed is an open-source Firefox extension for web application security testers presented at the OWASP AppSec DC 2009. It allows you to manipulate the web application’s user interface to eliminate annoying limitations and client-side controls that interfere with the web application penetration test.

What can I do with Groundspeed?

Groundspeed allows you to modify the forms and form elements loaded in the page. Some practical uses include:

  • Changing the types of form fields, for example you can change hidden fields into text fields so you can easily edit their contents.
  • Quickly removing size and length limitations on text fields so you have more space to type your attack strings.
  • Changing form target so the form submits in another tab.
  • Removing or editing the JavaScript event handlers to bypass client side validation.

You can install Groundspeed here:

https://addons.mozilla.org/en-US/firefox/addon/46698/

Or read more here.


Posted in: Hacking Tools, Network Hacking, Web Hacking

Tags: , , , , , , , , , ,

Posted in: Hacking Tools, Network Hacking, Web Hacking | Add a Comment
Recent in Hacking Tools:
- PowerOPS – PowerShell Runspace Portable Post Exploitation Tool
- Shadow Brokers NSA Hack Leaks 0-day Vulnerabilities
- UFONet – Open Redirect DDoS Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,987,445 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,457,706 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 684,293 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Playstation 3 (PS3) Finally Hacked & Exploit Released

Your website & network are Hackable


Ah finally some proof of the mythical Playstation 3 exploit released publicly. Sadly as always the lack of sales on the PS3 can be partially attributed to the lack of a homebrew scene (aka ability to pirate games).

There have been rumours and some speculation about the PS3 finally being exploited with news breaking earlier this week about notorious iPhone hacker geohot (George Hotz) finally breaking the protection on the PS3.

I personally don’t own a PS3 so it’s not really news to me, but for some people it seems to have been a reason for them not to buy a PS3 yet.

On Monday, when we reported that the prolific hacker geohot had successfully penetrated the previously impervious PlayStation 3 gaming console, readers were understandably skeptical.

After all, the 20-year-old readily admitted his hack wasn’t reliable, and he provided no evidence he was able to do some of the things modders love to do most, such as run arbitrary code or peel open the device’s synergistic processing elements to take a peak at its most prized internal elements.

On Tuesday afternoon, geohot finally released his exploit so the world could see for itself exactly what the hack does and doesn’t accomplish

If you’re interested in the extremely technical explanation of how geohot achieved this you can check it out here, I’d imagine to understand it properly though you’d need to be fairly familiar with the inner workings of the PS3 and how it manages memory allocation.

The hack isn’t really reliable but it does work to some degree and some of the time and this is enough for others to get started on breaking the PS3 further.

There’s another good write-up here explaining the ins and outs of the system and what repercussions this has:

PS3: Hacked

According to the instructions, it involves compiling and running the kernel module and then pulsing a memory bus on the PS3’s motherboard.

“Try this multiple times,” his instructions state. “I rigged an FPGA button to send the pulse. Sometimes it kernel panics, sometimes it lv1 panics, but sometimes you get the exploit!! If the module exits, you are now exploited.”

While the idea is sound, this hack is clearly not for the faint of heart.

From there, PS3 users get full memory access, including ring 0 access from OtherOS, geohot, whose real name is George Hotz, said here. He’s now turning follow-on work to the PS3 community, directing members to report their findings to the psDevWiki.

His instructions conclude: “The PS3 is hacked, its your job to figure out something useful to do with it.”

It’ll be interesting to watch how this develops over the next 2-3 months and see if anyone is able to successfully modify the OS or even install a new one.

If you are so inclined you can keep up with what is happening on the psDevWiki.

I’d imagine we should be seeing some homebrew code based on this exploit by the middle of year and of course Sony scrambling to come out with a new firmware that blocks this.

Source: The Register


Posted in: Exploits/Vulnerabilities, Hardware Hacking

Tags: , , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Hardware Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- Shadow Brokers NSA Hack Leaks 0-day Vulnerabilities
- Pompem – Exploit & Vulnerability Finder
- Bug Bounties Reaching $500,000 For iOS Exploits

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 235,446 views
- AJAX: Is your application secure enough? - 120,207 views
- eEye Launches 0-Day Exploit Tracker - 85,650 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Browser Fuzzer 3 (bf3) – Comprehensive Web Browser Fuzzing Tool

Find your website's Achilles' Heel


Browser Fuzzer 3, or bf3, is a comprehensive web browser fuzzer. Browser Fuzzer 3 is designed as a hybrid framework/standalone fuzzer; the modules it uses are extensible but also highly integrated into the core. bf3 can be used via command line to set all necessary flags for each fuzzing operation.

After initialization, bf3 creates test cases in a numbered system. Fuzzing is automated through the browser using the refresh method. If error is detected, server logs can provide insight to the offending test case.

Features

  • Fuzzes CSS, DOM, HTML, JavaScript and XML
  • Attended and Unattended Fuzzing Modes
  • 7th Generation Fuzzing Oracle
  • Random Data Generator
  • Mutation Fuzzing Engine

You can download Browser Fuzzer 3 here:

bf3.tar.gz

Or read more here.


Posted in: Exploits/Vulnerabilities, Hacking Tools, Programming

Tags: , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Hacking Tools, Programming | Add a Comment
Recent in Exploits/Vulnerabilities:
- Shadow Brokers NSA Hack Leaks 0-day Vulnerabilities
- Pompem – Exploit & Vulnerability Finder
- Bug Bounties Reaching $500,000 For iOS Exploits

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 235,446 views
- AJAX: Is your application secure enough? - 120,207 views
- eEye Launches 0-Day Exploit Tracker - 85,650 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Websense Offers Facebook Users Free ‘Firewall’ Service

Find your website's Achilles' Heel


There have been quite a few security concerns with Facebook, especially with the amount of personal information it collects on it’s users.

Of course there is Koobface and it’s many variants which have been propagating all kinds of spam through Facebook wall posts and messages.

I’m glad someone is offering a solution for free, yes they benefit from it too by being able to gather data on Facebook activity and the quantity of malicious posts occurring on Facebook.

Security vendor Websense if offering Facebook users and businesses a new free ‘firewall’ service that monitors their pages for malicious posts, links and spam.

Defensio 2.0 checks all posts to Facebook in real time against Websense’s ThreatSeeker Network, a database of problem URLs, before deciding whether to categorise a post as malicious or unwanted. This also draws from data gathered by US ISP Radialpoint and URL shortening service bit.ly before performing further heuristic analysis as a final check.

If a bad post is detected, the system logs and informs the user who makes the final decision. As with the original Defensio system – acquired a year ago when Websense bought the company of the same name – it can also monitor web pages for rogue posting, pre-emptively blocking those it deems unwanted.

“We are seeing real threats to Facebook such as Koobface,” said Websense senior research manager, Carl Leonard.

It seems to work on a ‘moderation’ model so if the software detects any suspicious automated messages/links or other dodgy activity it will block the post/message and allow the user to approve/deny the request.

But then it’s only going to be effective if take-up is good amongst the non-tech savvy users where the problems tend to be a lot more common.

Sadly this seems highly unlikely as only people who read sites like this will know about it, unless it get’s heavily promoted on Facebook..but then you have to contend with ad-blindness problems.

According to Leonard, an advantage of Web 2.0 monitoring was that it gave security companies a way of following criminals inside the otherwise closed world of social media, something that many security vendors can’t yet do. “We can have visibility into threats on these social networks, and have a fantastic feed of information that can benefit all our customers,” he said.

Leonard was not able to say when or if the monitoring might be available other social media sites or feeds such as twitter, where rogue behaviour can be difficult to spot.

The service is free for anyone with fewer than 50,000 posts per month, and for companies with 15 employees of less. For professional sites or sites with larger volumes of posts, the service starts at $5 (£3) per month, per site.

It’s free for most people, I’d imagine very few companies are making 1500 posts per day! Even if you need to pay it’s pretty cheap.

I hope to see more initiatives from companies like this, and ideally someone working with Facebook themselves to increase pro-active security measures on the site.

Obviously that’s not their first priority and with the recent brouhaha about their new privacy terms and default settings..you should be concerned about what information of yours they intend to utilise.

Source: Network World


Posted in: Countermeasures, Malware, Security Software, Web Hacking

Tags: , , , , , , , , , , , , , ,

Posted in: Countermeasures, Malware, Security Software, Web Hacking | Add a Comment
Recent in Countermeasures:
- An Introduction To Web Application Security Systems
- OpenIOC – Sharing Threat Intelligence
- Cuckoo Sandbox – Automated Malware Analysis System

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,207 views
- Password Hasher Firefox Extension - 117,857 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,743 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Burp Suite v1.3 Released – Integrated Platform For Attacking Web Applications

Find your website's Achilles' Heel


Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, persistence, authentication, upstream proxies, logging, alerting and extensibility.

Burp Suite allows you to combine manual and automated techniques to enumerate, analyse, scan, attack and exploit web applications. The various Burp tools work together effectively to share information and allow findings identified within one tool to form the basis of an attack using another.

It’s been quite a while since the release of Burp Suite v1.2 back in December 2008.

This is a major upgrade with a host of new features, including:

  • A new message editor/viewer optimised for HTTP requests and responses, with colourised syntax, mouse-over decoding, and quick conversion functions.
  • Facility to add comments and highlights to the proxy history and site map.
  • Support for viewing and editing AMF-encoded messages.
  • Improved handling of SSL server certificates, to eliminate browser SSL warnings and connection problems with thick clients.
  • Copy to file / paste from file to facilitate working with binary content.
  • New display filters.
  • Greatly enhanced extensibility.
  • Configurable DNS resolution, to override your computer’s own resolution, facilitating work with non-proxy-aware clients.
  • Fine-grained upstream proxy rules.
  • Exporting of HTTP messages and metadata in XML format.

Burp Suite is a Java application, and runs on any platform for which a Java Runtime Environment is available. It requires version 1.5 or later. The JRE can be obtained for free from java.sun.com.

Full release details can be found here.

You can download Burp Suite v1.3 here:

burpsuite_v1.3.zip

Or read more here.


Posted in: Hacking Tools, Web Hacking

Tags: , , , , , , , , , ,

Posted in: Hacking Tools, Web Hacking | Add a Comment
Recent in Hacking Tools:
- PowerOPS – PowerShell Runspace Portable Post Exploitation Tool
- Shadow Brokers NSA Hack Leaks 0-day Vulnerabilities
- UFONet – Open Redirect DDoS Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,987,445 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,457,706 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 684,293 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Microsoft Releases Out-Of-Band Patch For IE 0-Day Vulnerability

Your website & network are Hackable


Ah Microsoft is treating this one seriously after France and Germany advised users to avoid IE.

The current strain being exploited only targets IE6 users, but one security company has developed an exploit for IE8 which also bypasses DEP (Data Execution Prevention).

It was rumoured this was the exploit used last week to compromise Google and various other high profile networks. Although I am skeptical as to why anyone was using IE inside Google? Perhaps doing cross browser testing for development, who knows.

Microsoft will release an out-of-band patch Jan. 21 to fix the Internet Explorer vulnerability at the center of recent attacks on Google and other enterprises.

According to Microsoft, the patch is slated to be ready around 1 p.m. EST. If all goes according to plan, the patch will close a hole that has prompted France and Germany to advise users to avoid IE and the U.S. State Department to demand answers from China. Attackers have used the vulnerability to hit IE 6. Microsoft so far has said it has only seen limited, targeted attacks using the vulnerability.

Meanwhile, security researchers have continued to uncover information about the origin of the attack. Joe Stewart, director of malware research for SecureWorks’ Counter Threat Unit, said his analysis of the code for the main Trojan involved in the attacks shows a more direct link to China.

It’s very rare for them to push an out-of-band patch for anything but I guess there are still a LOT of IE users out there and this is a serious flaw.

It does seem to originate from China with the only discussions about the technical parts of the flaw and implementation being discussed on Chinese language sites.

As can be seen by a Google search here (“crc_ta[16]”), after the first few English news sites reporting the flaw the rest of the results are in Chinese.

According to Stewart, the code includes a CRC (cyclic redundancy check) algorithm implementation released as part of a Chinese-language paper on optimizing CRC algorithms for use in microcontrollers.

“This CRC -16 implementation seems to be virtually unknown outside of China, as shown by a Google search for one of the key variables, ‘crc_ta[16],'” Stewart noted in a SecureWorks blog post Jan. 20. “At the time of this writing, almost every page with meaningful content concerning the algorithm is Chinese.”

Up until this finding, Stewart told eWEEK, the factors leading people to point to China were patterns similar to previous Chinese malware.

“Unfortunately, when investigating malware, nothing is conclusive because digital evidence can be forged,” he said. “However, I believe the use of the Chinese algorithm certainly gives more credence to the attack code being Chinese in origin.”

They really have no choice but to release this patch when faced with government pressure, you should see it hitting your Windows Update sometime today (Jan 21st).

Let’s hope this patch has been tested properly and doesn’t subject users to another black screen of death.

It’s good to see some proactive initiatives by Microsoft, I hope they continue through 2010.

Source: eWeek


Posted in: General Hacking

Tags: , , , , , , , , , , , , , , , , , ,

Posted in: General Hacking | Add a Comment
Recent in General Hacking:
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?
- Dradis – Reporting Platform For IT Security Professionals
- Kid Gets Arrested For Building A Clock – World Goes NUTS

Related Posts:

Most Read in General Hacking:
- 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) - 1,170,921 views
- Hack Tools/Exploits - 628,964 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 435,536 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


BackTrack Final 4 Released – Linux Security Distribution

Find your website's Achilles' Heel


BackTrack is a Linux-based penetration testing arsenal that aids security professionals in the ability to perform assessments in a purely native environment dedicated to hacking.

Regardless if you’re making BackTrack your primary operating system, booting from a LiveDVD, or using your favorite thumbdrive, BackTrack has been customized down to every package, kernel configuration, script and patch solely for the purpose of the penetration tester.

BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tool collection to-date.

I’m sure many of you have been using the BackTrack 4 Pre Release which was pushed out in June last year, finally BackTrack Final 4 is available for download!


New in BackTrack Final 4

This release includes a new kernel, a larger and expanded toolset repository, custom tools that you can only find on BackTrack, and more importantly, fixes to most major bugs that were known of.

You can download BackTrack Final 4 here:

http://www.backtrack-linux.org/downloads/

Due to massive demand and lack of capacity I would suggest download the Torrent version.

Or read more here.


Posted in: Hacking Tools, Linux Hacking, Network Hacking

Tags: , , , , , , , , , , , ,

Posted in: Hacking Tools, Linux Hacking, Network Hacking | Add a Comment
Recent in Hacking Tools:
- PowerOPS – PowerShell Runspace Portable Post Exploitation Tool
- Shadow Brokers NSA Hack Leaks 0-day Vulnerabilities
- UFONet – Open Redirect DDoS Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,987,445 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,457,706 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 684,293 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


IETF Completes Vulnerability Fix For SSL Renegotiation Bug

Find your website's Achilles' Heel


You should remember the SSL Renegotiation bug from last year that was used to successfully attack twitter.

Finally IETF have come out with a fix for the issue, it’s natural it has taken some time as it’s a flaw in the actual protocol itself not in any specific implementation (which is usually the case).

The bug was fairly serious as demonstrated by the Twitter-jacking that took place exploiting the flaw. The bug basically allowed an attacker to conduct a man-in-the-middle attack and insert some malicious data at the beginning of a vulnerable SSL/TLS connection.

A fix that addresses a security vulnerability that could threaten SSL-protected Websites has been given the greenlight. The Internet Engineering Task Force (IETF) has finished work on a fix to a vulnerability in the Secure Sockets Layer protocol security researchers uncovered last August.

The vulnerability partially invalidates the SSL lock and allows attackers to compromise sites that use SSL for security—including banking sites and back-office systems that use Web services-based protocols. The issue was uncovered by Steve Dispensa and Marsh Ray, who work for two-factor authentication provider PhoneFactor.

“The bug allows a man-in-the-middle to insert some malicious data at the beginning of a vulnerable SSL/TLS connection, but does not allow him to directly read the data sent by the legitimate parties,” explained Ray. “This capability is referred to as a ‘blind plaintext injection attack.’ Initially, it was hoped that this limited capability would offer some mitigation. Unfortunately, it seems that HTTPS is particularly strongly affected because of its design, and an effective attack on the Twitter HTTPS API was demonstrated shortly after the vulnerability was publicly disclosed.”

Some of the open source providers of SSL implementations have fixed the bug in their software and released publicly available patches. These however are not officially merged with the main development trees as they were waiting for the official fix from the IETF.

It will take a while for all the major vendors to roll this into their software I guess, I’d hope to see everyone rolling out fixes by the end of January latest.

Who knows how many sites/apps are quietly being owned out there due to this bug.

A copy of the IETF draft can be found here. After incorporating feedback from the TLS community, the proposed fix was approved by the IESG on Jan. 7, 2010. The IESG is responsible for the technical management of IETF activities and the Internet standards process. The decision means customers can now begin to deliver patches that implement IETF’s change.

“Because of the large number and variety of systems affected, substantial interoperability testing [for the SSL extension] will be conducted by many vendors before they feel comfortable releasing a patch,” Ray said. “Some interoperability testing has already been done with preliminary versions of the patch, but another round of testing is occurring now that the details of the fix have been finalized by the IETF.

“Some of the open-source TLS implementations (OpenSSL, GnuTLS) have fixes in their publicly visible repositories, but have not released a formal patch as of right now,” he added. “Most of the larger vendors (open source and otherwise) have been given several months’ head start on implementing the fix, so they should not be starting from zero at this point.”

I’m glad to see something has been done about this issue and it has been treated seriously, imagine what would have happened if this was an issue with a Microsoft product?

They’d point fingers and create some FUD story claiming it wasn’t critical and only effected a small amount of systems under very specific circumstances.

Source: eWeek


Posted in: Exploits/Vulnerabilities, Programming

Tags: , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Programming | Add a Comment
Recent in Exploits/Vulnerabilities:
- Shadow Brokers NSA Hack Leaks 0-day Vulnerabilities
- Pompem – Exploit & Vulnerability Finder
- Bug Bounties Reaching $500,000 For iOS Exploits

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 235,446 views
- AJAX: Is your application secure enough? - 120,207 views
- eEye Launches 0-Day Exploit Tracker - 85,650 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Microsoft SQL Server Fingerprint Tool – BETA4

Your website & network are Hackable


This is a tool that performs version fingerprinting on Microsoft SQL Server 2000, 2005 and 2008, using well known techniques based on several public tools that identifies the SQL Version. The strength of this tool is that it uses probabilistic algorithm to identify the version of the Microsoft SQL Server.

The “Microsoft SQL Server Fingerprint Tool” can also be used to identify vulnerable versions of Microsoft SQL Server – it is based on some techniques used by Exploit Next GenerationTM to perform automated penetration test.

This is a very new tool and is in the BETA stage, so please do download it, try it out and give some feedback to the author.

You can download mssqlfp here:

mssqlfp-BETA4.exe

Or read more here.


Posted in: Database Hacking, Hacking Tools, Network Hacking

Tags: , , , , , , , , , , , , ,

Posted in: Database Hacking, Hacking Tools, Network Hacking | Add a Comment
Recent in Database Hacking:
- Onapsis Bizploit v1.50 – SAP Penetration Testing Framework
- OAT – Oracle Auditing Tools For Database Security
- ODAT (Oracle Database Attacking Tool) – Test Oracle Database Security

Related Posts:

Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 76,937 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 54,485 views
- SQLBrute – SQL Injection Brute Force Tool - 41,280 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Former Dark Market Admin Faces 10 Year Jail Sentence

Find your website's Achilles' Heel


You may remember a while back in 2008 it was uncovered (at least publically) that DarkMarket was actually an FBI Sting Operation.

Insiders had apparently known since 2006 that one of the admins was actually an undercover FBI agent. Countless cases have gone to court with the evidence and contacts gathered in the DarkMarket forums. One example would be the Turk named Cagatay Evyapan (nickname Cha0) who got busted.

The latest news is one of the previous admins Renukanth Subramaniam (nickname JiLsi) has pleaded guilty to conspiracy to defraud and admitted his involvement with the site.

A former London pizza delivery man faces a 10-year prison sentence after admitting he helped found the notorious DarkMarket forum for computer crime, several news sites reported.

Renukanth Subramaniam, a 33-year-old Sri Lanka-born man from North London, pleaded guilty at Blackfriars Crown Court in London to conspiracy to defraud and furnishing false information. Authorities say he joined DarkMarket on its first day of operation in late 2005 and helped build it into an online resource for payment card fraud, with a thriving exchange for buying and selling stolen data and its own secure payment system.

DarkMarket operated for three years and had about 2,500 members at its peak. To be accepted, candidates had to provide details of 100 compromised cards to reviewers, who would then verify their validity. Members were required to adhere to a strict code of conduct that forbid foul language and pornography and demanded a kind of honor among thieves.

Subramaniam was one of the earliest members on DarkMarket joining back in 2005 on its first day of operation and becoming an admin soon after that.

He’s facing a maximum sentence of 10 years, I’d imagine the sentence will come out to 2-3 years and with good behaviour he’ll be out of the cushy white-collar prison in 18 months or less.

So much for clamping down on crime eh? I shall reserve further judgment until we actually find out the real sentence.

Subramaniam worked as a site administrator until October 2006, when he was forcibly demoted over allegations of poor security hygiene. He continued as a reviewer until June 2007 and was arrested the following month when he turned himself in to police in Wembley.

DarkMarket was shuttered in September 2008 following the arrest of another site admin who called himself Cha0. According to news reports, the Turkish hacker was known as a supplier of high-quality skimmers for payment card fraud and was eventually accused of kidnapping and torturing a Turkish police informant.

A month later, another DarkMarket admin with the handle Master Splynter was outted as senior cybercrime agent J Keith Mularski of the FBI. The website, it turned out, had been secretly run from an FBI facility in Pittsburgh, Pennsylvania.

Also on Thursday, a second DarkMarket associate pleaded guilty to conspiracy to defraud. John McHugh, 69, of Doncaster, South Yorkshire, was alleged to be an experienced payment card fraudster who went by the online moniker Devilman.

It seems like a lot of the main players in the carding scene are getting shut down, at least those that show a public face.

Of course the underground will always continue to tick on, making money and hiding in the shadows.

So, just be careful where you shop online and always check the ATM for skimming devices!

Source: The Register


Posted in: Legal Issues, Spammers & Scammers

Tags: , , , , , , , , , , , , , ,

Posted in: Legal Issues, Spammers & Scammers | Add a Comment
Recent in Legal Issues:
- The Panama Papers Leak – What You Need To Know
- FBI Backed Off Apple In iPhone Cracking Case
- TalkTalk Hack – Breach WAS Serious & Disclosed Bank Details

Related Posts:

Most Read in Legal Issues:
- Class President Hacks School Grades - 80,715 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,651 views
- One Of The World’s Most Prolific Music Piracy Groups Busted - 43,629 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95