Hello, World!
The infamous cyber crime forum, breach forums relaunched a few days ago, after the original
site was shut down thanks the FBI’s arrest of its owner ‘pompompurin’.
The launch of breachforums 2.0 was met with excitement within the cybercriminal community,
however…
barely a week after it came back online, breachforums has itself been breached.
The site’s entire user database was posted on a rival cybercrime forum called ‘onniforums’
by it’s admin ‘dkota’ - a new character we haven’t seen on this channel before.
And if you’re wondering why Onniforums would attack breachforums, well… in an interview
with ‘databreaches.net’ Onniforums admin ‘dkota’ basically explained that he just
wasn’t happy with BreachForums getting all the attention recently, he said he “felt
the media needed a little bit of a wake-up call, reality check so instead of them discussing
skid insecure forums, why not discuss actually good forums?” - and I suppose his methods
worked, because here we are, talking about Onniforums.
The owner of breachforums - ‘ShinyHunters’ wasn’t too happy, and was forced to post
an apology to his users, and accused ‘dkota’ of “clout [chasing]”.
As for that leaked database, it contains the email addresses of all breachforums’ 4000
users, and… it doesn’t look like breachforums 2.0 has learned the lessons of 1.0, because
the ip address that each user signed up with, as well as the last ip they used to access
the site, are all in here.
Let’s not forget, after the original breachforums was shutdown, the FBI harnessed its database
of logged ip’s to incriminate pompompurin.
You would’ve thought breachforums 2.0 would’ve learned lessons from this, and been a bit
more careful with its users opsec, but apparently not.
But ShinyHunters played down the breach saying those IPs are “mostly [just] VPN/Tor [ips]”,
and whilst that is technically correct - a cyber intel firm analysed the breach, showing
almost a third of breachforums users do actually connect via their original IP.
But in fairness, a good chunk of these people will only be visitng the site out of some
kind of dark curiosity, like me!
As for how the hack was perpetrated in the first place, ShinyHunters says this was down
to an “automatic … backup” of their forum software, which presumably somehow made
its way onto a publicly accessible portion of their servers.
However in the interview with Onniforums, its admin dkota claims to possess a MyBB zero
day - as in a currently private exploit, which he also used to hack yet another rival cyber
crime forum called “Exposed”.
Now, I struggle to believe someone would risk burning a zero day just to spite someone - but
that’s essentially what’s being claimed here - and regardless I do look forward to
seeing what comes next in the cybercrime forum wars.
Also, that alleged MyBB zero day is apparently on sale for $15 thousand dollars.
In retaliation for the hack of breachforums, its owner ‘ShinyHunters’ exposed the true
ip address of Onniforums, which would make it easier for someone to screw with them,
possibly in a DDoS attack, because typically cybercrime forums use a service like cloudflare
or DDoSGuard which obscures their true ip.
But in this case I’m not sure what ShinyHunters was hoping to achieve by posting their ip,
because Onniforums doesn’t use either of these services, and their real ip can be obtained
with a simple ping.
One of the main questions I asked in my recent video on the return of breachforums was whether
it was some kind of FBI honeypot.
And whilst that might sound a bit conspiratorial, it wouldn’t be the first time - let’s
not forget when raidforums was seized by law enforcement last year the forum didn’t immediately
get plastered with a seizure banner, instead every page on the site redirected to the login
page which authorities were using to scoop up the creds of its cyber miscreant user base.
And we pretty much know it was authorities doing this because the nameservers that the
domain started pointing to were identical to that of other seized domains, and just
a month or so later it eventually got plastered with a seizure banner itself.
So when BreachForums mysteriously rebooted with only a very short message from it’s
former admin - it was a bit sus, the whole thing just felt a bit clinical.
On top of that, the previous, original breachforums domain still hosted a message warning people
not to trust any new site claiming to be a recincarnation of breachforums, and that “BreachForums
will never return”.
But there’s been some developments on this front.
Breachforums admin ‘Baphomet’ made a post saying he “wanted to address some concerns
relating to the old Breached domains that are attempting to discredit [his] community.”,
“To make it clear for everyone, the old domains were taken pretty shortly after Pom's
arrest.”.
And, he essentially claims that the FBI or some other 3 letter agency put the warning
up as a kind of psyop to dissuade people from using Breachforums 2.0.
But, is this true?
Well - if we take a look at the wayback machine, we can see after breachforums shut down in
late March the site started returning errors and the whole domain eventually went dark.
Until the 4th of June which is when that warning mysteriously appeared.
At the same time, the domain started pointing to new infrastructure, an indication that
someone had somehow taken control of it.
Was it the FBI?
Well on June 20th, after the breach of breachforums, that warning message was updated to say the
“BreachForums clone has already been hacked” and it linked a download of the hacked database
itself, not something I can imagine the FBI doing.
And on top of that I found a bunch of unindexed pages on the domain containing well… pawn,
so yea this wasn’t the FBI.
I think it’s become clear that someone who isn’t too fond of breachforums new management
somehow gained control of the domain just to screw with them.
However as of a couple days ago, the domain was actually seized by law enforcement - with
it now hosting a seizure banner, and the FBI even went so far as to photoshop little handcuffs
onto pompompurin.
Make sure to subscribe so you don’t miss the next episode of cybercriminal forum wars.
And let me know in the comments what you make of these developments, at this point I think
it’s clear that BreachForums 2.0 is simply not some kind of 3 letter agency honeypot,
there’s just way too much typical hacker forum drama for that to be believable.
Bit if you want to see what a true FBI honeypot looks like, check out my video on the Anom
messaging app, I’ll make sure to link that down in the description.
And regardless of whether breachforums 2.0 a honeypot or not, it might as well be, because
as we’ve seen with raidforums and breachforums 1.0, the databases of both did eventually
fall into the hands of authorities.
But anyhow, I hope you enjoyed this little update and I’ll see you in the next video,
have a good one.