https://krebsonsecurity.com/2021/03/weleakinfo-leaked-customer-payment-info/ Advertisement RSS Feed Subscribe to RSS Twitter Follow me on Twitter Facebook Join me on Facebook [4] Krebs on Security In-depth security news and investigation Brian Krebs About the Author Advertising/Speaking --------------------------------------------------------------------- 15 Mar 21 WeLeakInfo Leaked Customer Payment Info A little over a year ago, the FBI and law enforcement partners overseas seized WeLeakInfo[.]com, a wildly popular service that sold access to more than 12 billion usernames and passwords stolen from thousands of hacked websites. In an ironic turn of events, a lapsed domain registration tied to WeLeakInfo let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card. [wli-homepage] For several years, WeLeakInfo was the largest of several services selling access to hacked passwords. Prosecutors said it had indexed, searchable information from more than 10,000 data breaches containing over 12 billion indexed records -- including names, email addresses, usernames, phone numbers, and passwords for online accounts. For a small fee, you could enter an email address and see every password ever associated with that address in a previous breach. Or the reverse -- show me all the email accounts that ever used a specific password (see screenshot above). It was a fantastic tool for launching targeted attacks against people, and that's exactly how the service was viewed by many of its customers. Now, nearly 24,000 WeLeakInfo's customers are finding that the personal and payment data they shared with WeLeakInfo over its five-year-run has been leaked online. [wli-fees] WeLeakInfo's service fees. In a post on the database leaking forum Raidforums, a regular contributor using the handle "pompompurin" said he stole the WeLeakInfo payment logs and other data after noticing the domain wli [.]design was no longer listed as registered. "Long story short: FBI let one of weleakinfo's domains expire that they used for the emails/payments," pompompurin wrote. "I registered that domain, & was able to [password] reset the stripe.com account & get all the Data. [It's] only from people that used stripe.com to checkout. If you used paypal or [bitcoin] ur all good." Cyber threat intelligence firm Flashpoint obtained a copy of the data leaked by pompompurin, and said it includes partial credit card data, email addresses, full names, IP addresses, browser user agent string data, physical addresses, phone numbers, and amount paid. One forum member commented that they found their own payment data in the logs. [wli-stackup] How WeLeakInfo stacked up against its competitors (according to WLI). According to DomainTools [an advertiser on this site] Wli[.]design was registered on Aug. 24, 2016 with the domain registrar Dynadot. On March 12, the domain was moved to another registrar -- Namecheap. Pompompurin released several screenshots of himself logged in to the WeLeakInfo account at stripe.com, an online payment processor. Under "management and ownership" was listed a Gerald Murphy from Fintona, U.K. Shortly after WeLeakInfo's domain was seized by authorities in Jan. 2020, the U.K.'s National Crime Agency (NCA) arrested two individuals in connection with the service, including a 22-year-old from Fintona. [wli-murphyr] PLENTY OF TIME FOR OPSEC MISTAKES It's been a tough few months for denizens of various hacking forums, which are finding themselves on the defensive end of a great many attacks testing the security of their aliases and operational security lately. Over the past few weeks three of the longest running and most venerated Russian-language online forums serving thousands of experienced cybercriminals have been hacked. In two of the intrusions (against the Russian hacking forums "Mazafaka" and "Verified") -- the attackers made off with the forums' user databases, including email and Internet addresses and hashed passwords. "Members of all three forums are worried the incidents could serve as a virtual Rosetta Stone for connecting the real-life identities of the same users across multiple crime forums," a recent story here explained. An exposure of 15 years worth of user data from a forum like Mazafaka is a big risk for registrants because investigators often can use common registration details to connect specific individuals who might have used multiple hacker handles over the years. Many of the domains from the email addresses listed in the Maza dump date to the early 2000s, back when budding cybercriminals typically took fewer precautions to obfuscate or separate the myriad connections to their real-life identities online. The biggest potential gold mine for de-anonymizing Maza members is the leak of user numbers for ICQ, an instant messaging service formerly owned by AOL that was widely used by cybercrime forum members up until around 2010. That's about when AOL sold the platform in 2010 to Russian investor DST for $187.5 million. Back then, people often associated their ICQ numbers to different interests, pursuits and commerce tied to their real life identities. In many cases, these associations are on public, Russian language forums, such as discussion sites on topics like cars, music or programming. In a common inadvertent exposure, a cybercriminal happens to make an innocuous post 15 years ago to a now-defunct Russian-language automobile forum. That post, preserved in perpetuity by sites like archive.org, includes an ICQ number and says there's a guy named Sergey in Vladivostok who's selling his car. And the profile link on the auto forum leads to another now-defunct but still-archived personal site for Sergey. Interestingly, services like WeLeakInfo can just as easily be used against cybercriminals as by them. For example, it's likely that the database for the automobile forum where Sergey posted got compromised at some point and is for sale on sites like WeLeakInfo (there are active competitors). Ditto for any other forum where Sergey used the same email address or password. When researchers start finding password re-use across multiple email addresses that all follow a pattern, it becomes much easier to tie Sergey from Vladivostok to his cybercriminal and real-life identities. [92] Tags: fbi, Flashpoint, Gerald Murphy, Mazafaka, pompompurin, RaidForums, Verified, WeLeakInfo This entry was posted on Monday, March 15th, 2021 at 9:05 am and is filed under Breadcrumbs, Ne'er-Do-Well News. You can follow any comments to this entry through the RSS 2.0 feed. You can skip to the end and leave a comment. Pinging is currently not allowed. 4 comments 1. [4ff6] badhou3a March 15, 2021 at 12:09 pm Pizda Krebs Reply 2. [4642] Whatsdns March 15, 2021 at 1:12 pm When the Hunters become the Hunted. Reply 3. [880a] Andrew Rossetti March 15, 2021 at 1:58 pm Oh, sweet, sweet irony! Reply 4. [3979] fucked March 15, 2021 at 3:58 pm lol i am so screwed i was literally 12 when i made a wli account... any advice brian?? Reply Leave a comment Click here to cancel reply. Name (required)[ ] Email (required)[ ] Website[ ] Comment [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [Submit Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] Advertisement [1] * [ ] [search_mag] [97] * Mailing List Subscribe here * Recent Posts + WeLeakInfo Leaked Customer Payment Info + Microsoft Patch Tuesday, March 2021 Edition + Warning the World of a Ticking Time Bomb + A Basic Timeline of the Exchange Mass-Hack + At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft's Email Software * * All About Skimmers All About Skimmers Click image for my skimmer series. * Donate to Krebs On Security * Spam Nation Spam Nation A New York Times Bestseller! * * The Value of a Hacked PC valuehackedpc Badguy uses for your PC * Tools for a Safer PC Tools for a Safer PC Tools for a Safer PC * The Pharma Wars The Pharma Wars Spammers Duke it Out * Badguy Uses for Your Email Badguy Uses for Your Email Your email account may be worth far more than you imagine. * eBanking Best Practices eBanking Best Practices eBanking Best Practices for Businesses * Most Popular Posts + Sextortion Scam Uses Recipient's Hacked Passwords (1076) + Online Cheating Site AshleyMadison Hacked (798) + Sources: Target Investigating Data Breach (620) + Trump Fires Security Chief Christopher Krebs (534) + Cards Stolen in Target Breach Flood Underground Markets (445) + Reports: Liberty Reserve Founder Arrested, Site Shuttered (416) + Was the Ashley Madison Database Leaked? (376) + DDoS-Guard To Forfeit Internet Space Occupied by Parler (374) + True Goodbye: 'Using TrueCrypt Is Not Secure' (363) + Who Hacked Ashley Madison? (361) * Category: Web Fraud 2.0 Criminnovations Innovations from the Underground * [shreddedID-copy-285x189] ID Protection Services Examined * Is Antivirus Dead? Is Antivirus Dead? The reasons for its decline * The Growing Tax Fraud Menace The Growing Tax Fraud Menace File 'em Before the Bad Guys Can * Inside a Carding Shop Inside a Carding Shop A crash course in carding. * Beware Social Security Fraud Beware Social Security Fraud Sign up, or Be Signed Up! * How Was Your Card Stolen? How Was Your Card Stolen? Finding out is not so easy. * Krebs's 3 Rules... Krebs's 3 Rules... ...For Online Safety. --------------------------------------------------------------------- (c) 2021 Krebs on Security. Powered by WordPress. Privacy Policy