Irony Strikes As Hacking Site Hacked

A major website used by hackers to exchange stolen data has itself been hacked. The breach has exposed hundreds of thousands of user accounts.

The site called "Nulled" hosted discussion forums for users to exchange tips on how to hack into websites. It also included a section for buying and selling data such as stolen account information. Ironically, given the new development, the site had the slogan "Expect the unexpected." At the time of writing, the site was offline for "temporary unscheduled maintenance," with its database leaked onto other websites for download.

It appears that whoever attacked the site took advantage of a flaw either in the message board software or "plugins" that can be added to the software for special features such as financial transactions.

Entire Forum Database Breached

The Risk Based Security website reports that the attackers stole a 9.45 gigabyte database file that appears to be the complete database of the message board. That includes personal details such as user names, email addresses and the IP address of the computer each user connected from when they signed up. (Source: riskbasedsecurity.com)

The database also includes each user's chosen password for accessing the site, though this was stored in encrypted form. This has been described as a weak hashing encryption, meaning the attackers may well be able to decrypt the passwords, but would take some time to do so.

Also in the file is a complete copy of every post made on the site, including those in a VIP section only available to paid subscribers, along with private messages sent between users. As Risk Based Security points out, the exposure of the VIP section content means its highly unlikely anyone would ever think it worthwhile paying for access on the site again, which may destroy the site's business model.

Cybercrime Cops Will Relish Revelations

The data from the section for financial transactions does include some account details such as the email addresses used for PayPal payments, though not enough information to allow these accounts to be used without authorization.

It's likely the user registration details that will be the most serious breach for users. Law enforcement that have tried to previously track down 'hacker suspects' may be able to use the database to find proof that particular individuals have effectively admitted to illegal activity. (Source: bbc.co.uk)

What's Your Opinion?

Do you have any sympathy for the users of the hacked hacking site? Can the attack be justified or do two wrongs never make a right? Were the users naive to talk about hacking in a forum that ran using vulnerable software?