This could be the stuff of comedy movies. An online hacking forum, Nulled website, just got breached. Nulled website prides itself as one of the world’s top website where all sorts of shady characters can come and do their thing without fear of exposure. Now, details of hundred of thousands of hackers, criminals and people who do business with them are now in the public domain.
This is massive because the Nulled data released include user names, passwords, emails exchanged between users, transactions carried out through the website; in fact, everything that hackers and criminals don’t want in the public domain has now being exposed.
Nulled, whose motto was ‘expect the unexpected’ must have being rudely and unexpectedly exposed as the harsh light of exposure fell on them. The hack which happened last week, released more than 1.3 gigabyte in compressed data exposing the A-Z of Nulled activities. And at the time of writing this report, the data remained freely available on a data-sharing site on the clear Web. The data hack was discovered and confirmed by Risk Based Security.
This is how the website reported the hacking of Nulled:
“Nulled.IO is a hacking based forum that, according to their website, appears to have 473,700 registered users who share, sell and buy leaked content, stolen credentials, nulled software and software cracks. Considering this forum promotes the sharing of these activities it makes this breach quite ironic. Nulled.IO was running the IP.Board community forum commonly known as IP.b or IPb. It appears that the forum was also running a IP.Nexus Setup for its market place as well as VIP forums among a few other IPb plugins. While we do not have confirmation as to how this breach occurred at this point, there has been over 4,500 vulnerabilities to date in 2016, and with 185 total vulnerabilities in IP.Board (92 of them do not have a CVE by the way!) it is not hard to make a guess! The last user to login to the forum was on 2016-05-06 10:12:49, providing a very good time frame of when the breach occurred, but it still does not give any idea who was behind this attack.”
Nulled Website, What Next?
So what does this mean to users of Nulled? They must be running scared by now. Because the leaked data is a treasure trove of information on the illegal activities of thousands of individuals. Though, real names are hardly used on the forum, it is just a matter of time before keened-eyed detectives figure out who is who from bits and pieces of information.
For curious members of the public, the information is an expose’ on how the online criminal network operate. Surprisingly though, communications between criminals is not in arcane codes and/secret words and symbols. The exchanges about crimes are just the way we might exchange messages with a friend or a business partner. I guess, the users of Nulled felt secured in the knowledge that it was virtually impossible to hack into the site.
In one of private discussions between two members gleaned from the hacked data, one of the party is looking for software and technical guidance on how to install a keylogger on the lab of a university that is unfortunately not named in the conversation. In a different private exchange , two users discuss how to trade stolen Bitcoin and PayPal accounts. They even discuss the profit they hoped to make on each transaction. In all these exchanges, the data also show the IP addresses of the the parties involved. If proxies were not used, then it would be easy to trace the person behind each IP. But for a forum like the Nulled website, using proxies is common.
One lesson to be learnt from the Nulled website data breach is that no website can claim to be unhackable. Given enough time and concerted effort, hackers could breach any website. Nobody has yet claimed responsibility for this breach. But I won’t be surprised if the hack were the handiwork of a rival hack group. You can call it a digital war for supremacy. The online version of a turf war to be the number one hacking community in the world.
Meanwhile, Nulled website has being offline since the incident happened. The message on the website reads that it is undergoing ‘Temporary unscheduled maintenance.’
In the coming days or weeks, it is expected that security agencies around the world would start hunting down identified criminals. For the users of the Nulled website, ‘expect the unexpected’ hit them where they least expect it.
photo credit: metro.co.uk