Hello, World!
A database containing millions of private messages belonging to cyber criminals has
been stolen, and is now up for sale… this - is one hell of a juicy data leak, and will
no doubt expose the secretive operations of thousands of hackers.
The database was stolen from breachforums - a site where cyber miscreants share knowledge,
sell blackhat tools, and post hacked databases.
But today it’s the database of breachforums itself that’s up for grabs, but - not the
version of the site that currently exists, but rather the previous version that was run
by the infamous hacker Pompompurin, before he was arrested at the hands of the FBI earlier
this year.
The database on sale contains over 1.6 million private messages sent between the forums’
200 thousand members - but before we get to the juicy details, how do we know the database
is even genuine?
Well - there’s a bit of a story behind that.
A few days ago the internet’s favourite breach notification site, ‘haveibeenpwned.com’
added breachforums’ database to their collection.
In a tweet, or X - whatever you want to call it - they said the data dump includes “email
and IP [addresses], usernames, private messages and … [password] hashes’.
And they link to the Twitter account which submitted the database to them - a brand new
account with zero tweets.
But then, literally 30 minutes after ‘haveibeenpwned’s tweet - the newly created account announced
the database was for sale and posted their contact information.
So it looks like ‘haveibeenpwned’ unknowingly acted as a kind of verification service for
the seller.
I mean - these guys guys are well trusted, if they say a database is genuine then that’s
the best kind of vouch you can get.
The database itself contains quite a bit.
But the real value of course lies in the database of private messages.
This contains every private message sent between breachforums’ users, and as you might imagine,
on a forum dedicated to cyber crime, a lot of those private messages will be rather incriminating.
Let’s not forget, a leaked database containing private messages is exactly how the owner
of breachforums - Pompompurin was taken down.
Years before his arrest, on breachforums’ predecessor ‘raidforums’, Pompompurin
sent a message to a fellow user which referenced an email address containing his real name
‘conor fitzpatrick’.
Despite the fact that at the time, the recipient of the message didn’t realise it… years
later when the feds managed to grab raidforums’ database, they did realise Pompompurin’s
mistake - which helped them identify him irl, and well, the rest is history.
But as for the latest leak, in addition to private messages, it also includes the forums’
database of payments, as in the details of users who bought a rank on the forum using
cryptocurrency.
The payment addresses are all here - which could lead to the unmasking of quite a few
users - as there’s tonnes of cases of cyber bad guys with awful opsec, buying or cashing
out crypto using a coinbase account registered in the real name.
I managed to get an interview with the seller of the data dump - whilst he didn’t want
me to show direct screenshots of our conversation, he did say he’d received offers in excess
of $50 thousand dollars for the data dump, but the reason he gives for not having yet
sold it is because he’s worried about potential buyers eventually leaking it publicly.
Which he really doesn’t want to happen... he explained that he’s been a part of the
community for ages, and doesn’t want to totally destroy it.
Which I suppose, is a somewhat of a possibility if the leak did become public, if you think
about it, it’s not just the incriminating messages in the database that would cause
some drama, but the messages could expose betrayals between forum members, secret grudges
within the community, and users conspiring to scam each other, and so on, the fallout
from all that being made public could cause some some fireworks.
As for the obvious question, how the database ended up in his hands - well that’s not
something he wanted to discuss.
He did say that Pompompurin’s private messages actually reveal his involvement in certain
illegal activities, knowledge of which isn’t currently public - but I haven’t seen those
raw private messages, because well I didn’t buy the database, so I reckon it would be
a bad idea for me to reiterate allegations I just haven’t seen evidence for.
Speaking of Pompompurin, since he was arrested and unmasked by the FBI earlier this year
for his role in operating breachforums we haven’t had much of an update on the guy.
That all changed a couple weeks back when Pompompurin, AKA ‘Conor Brian Fitzpatrick’
pled guilty to an array of offences, most of which are what you’d expect, like operating
breachforums, trafficking in ‘unauthorised access devices’ - a term which basically
refers to stolen credentials.
He also admitted to running a middleman service for cyber criminals wanting to buy and sell
stolen databases.
None of these admissions really surprised anyone, however, there is a darker side to
Pompompurin that was only uncovered after his arrest.
In addition to the cyber crime related charges, there is a section in the court documents
relating to his possession of well - see pee.
I won’t go into the grisly details, but in short the guy’s computer was full of
the stuff.
And by the way, this document isn’t a list of accusations - it’s basically a confession.
Signed by ‘Conor Brian Fitzpatrick’ himself.
This has unsurprisingly decimated Conor’s reputation, which up until now was rather
positive in the cyber crime community - I mean, in the early hours of his arrest he
was pre-emptively banned on breachforums with the reason “Legend”, but now, the admin
of breachforums 2.0 “Baphomet” published a post, essentially denouncing Conor - someone
he’s been friends with for years, saying he wants nothing to do with him anymore.
One forum member said “I LIKE POM, BUT NOT FITZPATRICK” - which I think perfectly sums
up the general feeling in the community.
Pompompurin was their guy, railing against the machine, he hacked the FBI, ran a massive
cyber crime forum - and probably made a decent bit of money in the process.
But now his legacy is forever tainted, with forum admins even going so far as to remove
pompompurin related emotes from the site.
Any chance of Conor bouncing back after serving his prison time, and becoming some kind of
a reformed blackhat that gets to go on TV and speak at conferences - seems to be out
the window.
The guy will be sentenced in November, and faces a maximum of 40 years in prison.
As for the database, it’s yet to be sold - and if you’re wondering whether the FBI
might want to get their hands on it - well, there’s no need for that.
Because after breachforums 1.0 was shutdown in March the FBI obtained a copy of the database
for themselves - and their version is a lot juicier, because it’s a snapshot of the
site as it existed when the site was shutdown as opposed to the leak for sale which is a
snapshot from last November.
If you want to see more of the breachforums drama, I’ve created a playlist with all
my breachforums related videos, which I’ll link in the description.
As always if you enjoyed this video, let me know by hitting the bell icon, and I’ll
see you in the next one, have a good one.