[Infowarrior] - Hackers Impersonate Web Billing Firm's Staff To Spill 500, 000 Users' Passwords And Credit Cards

[Richard Forno]

Begin forwarded message:

> From: Duane 
> 
> http://www.forbes.com/sites/andygreenberg/2012/05/22/hackers-impersonate-web-billing-firms-staff-to-spill-500000-users-passwords-and-credit-cards/
> 
> Hackers Impersonate Web Billing Firm's Staff To Spill 500,000 Users' Passwords And Credit Cards
> Andy Greenberg, Forbes Staff
> 5/22/2012 @ 11:26AM
> 
> 
> British Web billing firm WHMCS is reeling from an attack that spilled its user accounts, deleted reams of data, temporarily took its site offline, and hijacked its Twitter feed–all seemingly the result of a smooth-talking hacker con.
> 
> A WHMCS spokesperson wrote in a statement Tuesday morning that hackers had successfully impersonated him to fool the company’s Web host into giving them access to the company’s account details. “This means that there was no actual hacking of our server,” the spokesperson wrote. “They were ultimately given the access details.”
> 
> The intruders, a hacktivist group that calls itself UGNazi, ultimately leaked a 1.7 gigabyte trove of data from the British web hosting firm that includes 500,000 users accounts according to the UK tech news site the Register, including some number of credit card details. The company wrote in an earlier statement that the hackers accessed both users’ passwords and their payment details, and that both sets of data were encrypted, though company warned that the credit cards may nonetheless be at risk, and that users should change their passwords.
> 
> The stolen data was posted with little explanation to Pastebin, though the UGNazi hackers wrote in the firm’s own Twitter feed that it targeted WHMCS because the firm had provided billing to scam sites. “Many websites use WHMCS for scams,” reads a tweet in the firm’s own feed. “You ignored our warnings. We spoke louder. We are watching; and will continue to be watching.”
> 
> A few hours earlier, UGNazi apparently took down the website of pizza company Papa John’s with a denial of service attack, complaining that the company “took 2 hours longer than expected to deliver my food.” The group claims credit for previous attacks on Visa, MGM and CIA.gov.
> 
> WHMCS has said it has changed its web hosting setup and reported the attack to the FBI. As of Tuesday, however, the company’s twitter feed was still controlled by the hackers, who tweeted, “We laugh at your security.”
> 



---
Just because i'm near the punchbowl doesn't mean I'm also drinking from it.