A Closer Look at the Lapsus$ Data Extortion Group

The press is slowly starting to realise that harrassing a teenager might make them the baddies.

> The teen is so skilled at hacking -- and so fast-- that researchers initially thought the activity they were observing was automated, another person involved in the research said.

Thats when you know you are in the zone! I love the zone.

Microsoft, NVidia, Okta, EA all hacked by someone that’s not state sponsored and sophisticated.

Tell’s quite a bit about the snake oil that is the current cybersecurity industry and its counterparts sloppy software development and lazy pointy haired boss.

I had a problem with a very persistent hacker once. Constantly causing havoc to my systems. I would talk to him on IRC as he wanted to boast about his exploits. Made himself out to be a 24-year-old Russian living in London and had plenty of anecdotes which seemed authentic.

One day I was on IRC talking to him while at home in the evening. He said "Watch this." My wife's cellphone rang and someone screamed down the phone at her. That was the breaking point for me. I put it a €15,000 bounty out there for someone to ID him. A few weeks later I had leads and tracked him down to Germany.

I had German friends dig into it. They found he was a 15-year-old kid working at a video store. My friends called his boss first and gave him the details. Then they called his dear old mother at home and regaled her with the stories of her son's other life.

Never had any trouble from him again after that.

Wow. Typical HN crowd to diminish anything other than their own accomplishments or lack thereof. This thread also managed to give backhanded comments to NVIDIA and Microsoft.

There almost certainly are more competent hackers exploiting the same vulnerabilities, but we don't know about them because they're not stupid enough to brag about it online.

Not to detract from their achievements..., but we could also simplify it a bit:

> “After a few years his over 300BTC [appreciated] to $14 mil.”

Maybe he’s getting framed

I feel like companies have invested a lot in securing internal services from external actors, and the threat model has moved to compromise these organizations from the inside with underpaid disgruntled employees being promised riches. It should be important not only to punish those insiders involved, but also to have the least possible permissions for developers, support desk workers or anyone really.

I don’t think we got here, we’ve always been here: most of us don’t want to go to prison and risk aversion increases with age. Regardless of how (in)secure systems are, the abundance of bad actors will be those with a high risk tolerance.

When you're an adult, you lead the syndicates that nobody knows about. I doubt there are many minors in Equation Group

I think we should expect this kind of thing from teenagers: there's a certain level of out of the box thinking and risk to reward inversion that comes from youth. Brazen solicitation of associates / operatives on public forums is certainly unique, and not a tactic which most other actors would pursue due to the risk involved.

I also think that things aren't as bad as we think security wise. The attacker's lack of industry experience helps with marketing to media who also lack industry experience. Somehow "Lapsus$" are "the world's most dangerous hacking syndicate", but in reality they've fully compromised several Portuguese companies with poor information security to begin with, released a treasure trove of mostly only curiosity-interesting source code from some big names, and posted some screenshots of restricted-access customer support tools. Breathless excitement about each new discovery has whipped the media into a frenzy over disclosures which sound juicy but ultimately aren't altogether that impactful - another accidental benefit of youth, I think.

To me the scariest thing in "cyberspace security terms" probably isn't that a minor has done all this - that seems reasonable to me - but what happens when an adult is inspired to adopt the same approaches? IMO this is the leading edge of something, an innovative approach pioneered by an outsider, less so than it is the trailing edge of "even a teenager could do this."

I think the biggest insight here is the power of chat tools like Slack. These tools need much more robust controls than are currently present at most companies. At most large enterprise software companies I've seen, there is little-to-no role based or level based access control applied to chat, and a vast amount of information is accidentally available in messaging logs, even to employees like contractors or low-trust employee accounts which have been locked out and just "need to Slack someone to get back in." Chat apps need much more access control from both a role and trust level point of view.

oh dear, he's never seen Hackers

The threat of coercion or bribery by a state actor is absolutely real, and has already played out in the past month.

The threat of wilful cooperation by sympathetic employees with loyal ties to their homeland has also been a widely covered in several Chinese cases, less so by Russia. This isn’t isolated to those countries either - it’s almost certainly being done by the west too.

> imagine what a state-level actor can do

More like, imagine what a state-level actor has done already. Heck they don't even need to carry out hacks of this nature. It would be trivial for a government to embed an agent at any tech company at a way higher level than customer support. Do people really think a top CS graduate recruited to a coveted intelligence role can't pass a FAANG interview?

own all the physical infrastructure, including your cellphone, your computers, your watch, your car, all monitored and owned 24/7?

Have you heard about Snowden? No imagination required.

I imagine they meant the corporate victims. That is two separate pieces of evidence that they have some tie to Brazil: the recruits, and the selected corporate victims.

About the language part: I'm a native speaker of Portuguese. Their posts on Reddit[1], requesting paid insiders on some mobile networks, are very clearly machine translated. When they started out, hacking the Ministry of Health here in Brazil, the defacing text had a wrong plural, and was written in a way that a native speaker never would.

https://camas.github.io/reddit-search/#{%22author%22:%22okla...

And while you are at it, you are also f*cking innocent bystanders, like their employees and customers. That's awesome.

These are very bad people:

>"... prior to launching LAPSUS$, WhiteDoxbin was a founding member of a cybercriminal group... specialized in SIM swapping targets of interest and participating in “swatting” attacks, wherein fake bomb threats, hostage situations and other violent scenarios are phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address."

The "customer service" role itself is an invention for companies to absolve themselves of core responsibilities.

Company screws up, the only option available is "contact customer service." And actually getting in touch with customer service is made as difficult as possible by design.

If you do have the patience and persist, it turns out the customer service agent doesn't have the power to do anything either. In a lot of cases (as it was for the Okta incident) they don't even work for the company in question!

> that are exploited and paid like s__t

I wouldn't say that they are badly paid compared to local wages.

One of the FAANG's outsourced customer support accounts here start at $11,000 yearly.

It may not seem that much compared to U.S. wages, but that would easily place you in the highest 10% wages here.

did you read this bit?- "first surfaced....extortion demand on Brazil’s Ministry of Health" If you are still of the same opinion... Just saying that providing primary care by getting down there and using you skills to improve the situation would be preferable to simply extorting money because the bureaucracy running the care givers is flawed.