코믹한 해커의 실수: 사이버 범죄 실수가 주는 교훈

### 해커들의 코믹한 실수: 실수로부터 배우기
* 😅 사이버 범죄의 세계에서는 아무리 숙련된 해커라도 **몰락으로 이어지는 중대한 실수**를 저지를 수 있으며, 이는 "우리는 모두 인간"이라는 사실을 상기시켜 줍니다.
* 🔍 주목할 만한 사례로는 소셜 미디어를 통해 민감한 정보를 유출하고 온라인 페르소나를 실제 신원과 연결한 후 적발되어 체포된 **루안 B**가 있습니다.
* 🎭 악명 높은 헥터 몬수르(일명 사부)는 **적절한 익명화 조치 없이 IRC 채팅에 잘못 참여**했다가 체포되어 보안 관행에 안일하게 대처할 경우의 위험성을 보여주었습니다.
* 📉 브라질 연방 경찰 **659명의 주소와 비밀번호와 같은 개인 데이터가 노출**된 사건은 부주의한 정보 취급이 얼마나 심각한 결과를 초래하는지 잘 보여줍니다.
* 💻 비밀번호 재사용은 해커를 추적하는 지문으로 등장했으며, **미국 국방부라는 사용자와 연결된 87,000명의 미국 정부 인사 정보가 유출**되는 중대한 침해 사고가 발생하기도 했습니다.
* 💰 **2억 4,300만 달러의 암호화폐를 강탈**한 밀란 임은 자금을 이체하고 자신의 부를 과시하는 모습을 녹화했다가 결국 체포되어 부실한 운영 보안(Opsec)의 위험성을 보여줬습니다.
* 🔒 많은 해커들이 **IP 주소를 유출하거나 VPN을 사용하지 않아 쉽게 신원이 노출**되는 등 익명성을 유지하지 못해 적발되었습니다.
* 🔑 궁극적으로 이러한 실수로부터 얻은 교훈은 사이버 영역에서 활동하는 모든 사람에게 **깨끗한 디지털 발자국과 강력한 보안 관행**을 유지하는 것이 중요하다는 사실을 일깨워줍니다.

해커는 종종 자신의 실수로 인해 붙잡혀 몰락하는 경우가 많습니다.

On December 10th of 2022, a user by the name of US DOD published a post on the breached cybercrime market forum titled infrguard.org full database 2022 XS Edition. Included inside these posts are sample data sets of US Government Personnel, claiming a total of 87,000 full user details of US government employees, high-value individuals, and the FBI. At this point, the employee information leaked, and now this employee information leaked. Now fast forward approximately a year and a half later to July 21st of 2024. A database file of more than 4 terabytes of data had been released on a prolific cybercrime community breach forum, claiming to have more than 2.9 billion records of national publicdata.com or NPD data, one of the largest data breaches of all time if that claim was true. Now the poster of this forum post, US DOD, flashback to January 22nd of 2022. A post on a thread in the once-popular raid forums had been populated. The email

address and passwords of 659 members of the Brazilian federal police had been offered, and of course, the poster is being us DOD. As you might see, there is a pattern here: issuing personal information, sensitive records, database files for sale on various cyber crime market forms for this individual's hustle, selling to the highest bidder, and hopefully making a profit along the way. The issue is selling this momentous amount of personal information on what claimed to be 35% of the total population of the world. If that really was true, and exposing high-value powerful government employees and officials, well, it puts you on the spotlight. It puts you on the purview of people who actually have power and resources to track you down. I got to erase a lot of stuff if you're going to run this high-stakes hustle. One must ensure that our affairs are in order, digital footprint clean and concise, opsc optimized, and the real-life identity is separated from your digital identity. And that's exactly what Luan BG didn't do or us DOD suspected cyber criminal Luan BG.

took the gamble not only leaking large amounts of public information on government employees but also exposing a 100,000 indicator of compromise or IOC list from one of the largest service secured companies in the world, CrowdStrike, a company that has the global footprint and threat intelligence to at least track or hone in on individuals. So how did Luan B get caught? Well, it was evidence collected by CrowdStrike, and they were able to link US DOD's true identity between his online personas and his social media accounts. They issued this report to the government employees, and they were able to take that and arrest him. So, too many high-profile targets, too little optimization on the ENT end, and well, for as many stealthy hackers as we have, there's a much larger pool of wannabe or bad hackers, AKA script kitties, one maybe could even say myself. And so for today's video, we're going to be looking at some of the worst hacker mistakes of all time, specifically five examples. These are almost just like comical examples. Let's

talk about boastfulness for a moment. So, we all like to share accomplishments, maybe perhaps how successful we are, what job we got, how much material possessions we have, money, stuff like that. I've talked about this often in the past. The number one way that cyber criminals and hackers get caught is through their opsec blunders. Take a most recent comical example, Milan Yim and the $243 million crypto heist. The dude records himself actively transferring the funds to a compromised wallet, posing as a Google Gemini support employee, and then, you know, for a boastful moment, records that, shares it to his friends, says that we're in, and one month later, arrested because he not only was doing recordings of himself but also living this high-class lifestyle, spending $500,000 a night. Could you call this individual a hacker or somebody who perhaps just got lucky, maybe a little bit of both? So, your opsec matters, and this is a general one, but you see these mistakes time and time again on uh

various different news outlets speaking of OPC. What better way to get authorized access into luxury goods than to hack a fingerprint scanner system, delete the authorized fingerprints, and then add in your own fingerprints in hopes of, you know, maybe getting that physical access to those luxury goods. This is exactly what a hacker did in 2018 to a luxury goods retail provider. The security firm Dark Trac had tracked this threat actor who had broken into the fingerprints scanner software, and this scanner software was acting differently than the other nine respective ones. Gave that fingerprint over to the authorities and were able to subsequently rust the individual. Yikes. The WHOIS database is quite useful. In fact, as a security practitioner myself working for a large-scale organization, I often probe the WHOIS to see if we own an internal or external domain. It's nice for domain attribution. Most often, WHOIS records document or record who manages and owns a particular domain name, and oftentimes these are behind privacy-preserving services that the hosting providers provide, which masks their own individual identities so that they're

not getting spam mail or phone calls now. It's quite surprising to actually find how many individuals hackers use their personal information linked to specific domains. Oftentimes, this is through a transitive list of email addresses and online user aliases, connecting all of the different domains together. Hackers can often be tracked to identify their personal domain through old and stale DNS records, as well as a transitive association. Brian Krebs from Krebs on Security does a great job explaining his investigation in terms of attempting to find an individual's real-life identity using the passive DNS, DNS records, WHOIS records, and really trying to chain this all together. And you'd be surprised how often he actually does this through his reports, so check out his blog if you're interested in that kind of investigation. Most of us know that password reuse is a bad practice, even if we're lazy. Most of us know we shouldn't do that. But what if you could use reused passwords as a fingerprint for tracking hacker identities? This is exactly what happened.

to hackers who had, uh, happened to reuse their passwords on Hanza and Alpha Bay. These were prolific dark web marketplaces in the late 2010s. Now, authorities were able to actually capture the credentials and take down these two web marketplaces. This other dark market web place called Dream Market kind of fulfilling that need as those two went down. Um, well, what happened was authorities were able to use some of those captured credentials and break into various vendor accounts on the dark market web marketplace. So, they were able to actually capture the, uh, attacker identities from that by using their old passwords on their, um, old web marketplace accounts. IP addresses can serve as pseudo unique identifiers to hone in on individuals semi. Now, there are numerous examples. You'll see these often in security articles where an individual leaks their IP address online. Perhaps it's not connecting through a VPN or logging onto a forum with a real-life IP address or perhaps just connecting to applications. There are many, many blunders in this, and as an example, uh, the prolific leader of

lutc back in the 2010s. Hector Monsour, if I could say that night, AKA Sabu, got caught by accidentally connecting to an IRC chat without first using anonymizing services. And this was just like one or two times he did this out of the thousand times he was doing this. Now, lsy was a prolific hacking group at the time, responsible for some very large-scale attacks or compromises, specifically the PlayStation Network, as well as taking the CIA website offline. Now, after getting caught, Hector cooperated with authorities, leading to other high-profile hacker arrests and takedowns, which then leads to another mistake which kind of blends in with obsc, which is if you get too close to a group and you trust one another but then you get caught, one of your members gets caught, the likelihood that the others end up riding each other out is probably a little bit more higher chances if that lessens your sentence. And that's exactly what happened in this case. So, yet another thing to think about.

a fun little video compilation of a few mistakes made by maybe some pseudo or script kitty-like hackers. Now, we're all humans. I mean, we make mistakes, right? And if you are an individual who is performing cyber crime, it works in both ways, as in, you know, it only takes one way to get into a business or into your own personal account. It's the same way it works both ways. So, when you have to control and create this alias, uh, this online personal identity, and you're doing bad things, and then oftentimes maybe you're in a place of vulnerability, well, one mistake can lead to your downfall. So, uh, it works both ways. Hopefully, you found this video entertaining, a bit informative, and until the next time, you know what it is, have a good day.

the dumbest hackers of all time.

Grant Collins

사이버 범죄에서 자랑스러움의 위험성

2억 4,300만 달러의 암호화폐를 훔친 후 이를 친구들과 공유하여 체포된 밀란 임의 사례에서 볼 수 있듯이, 자랑스러움은 심각한 보안 실수로 이어질 수 있습니다.

한자나 알파 베이와 같은 다크 웹 마켓플레이스가 폐쇄된 사례에서 알 수 있듯이 사이버 범죄자들은 비밀번호를 재사용하는 경우가 많으며, 이는 곧 범죄자들의 체포로 이어집니다.

IP 주소 유출과 VPN 미사용은 개인의 신원을 노출하고 몰락으로 이어질 수 있는 흔한 실수입니다.

명품 해킹: 2018년 지문 스캐너 사건

2018년 한 해커가 지문 스캐너 시스템을 조작하여 명품 소매업체에 무단으로 접근한 사건이 발생했습니다.

보안 회사인 다크트랙은 위협 행위자를 추적하여 지문 데이터를 당국에 제공했고, 그 결과 해커가 체포될 수 있었습니다.

WHOIS 데이터베이스는 도메인 소유권을 파악하고 내부 또는 외부 도메인을 관리하는 데 도움이 되는 보안 실무자에게 유용한 도구입니다.

사이버 범죄에서 개인정보가 미치는 영향

해커는 이메일 주소와 사용자 별칭의 전이 목록을 통해 특정 도메인에 연결된 개인 정보를 사용합니다.

브라이언 크렙스는 패시브 DNS, DNS 레코드, WHOIS 레코드를 사용하여 해커의 신원을 조사합니다.

2022년에 8만 7천 명의 미국 공무원 기록이 유출된 중대한 데이터 유출 사고가 발생한 데 이어 2024년에는 역대 최대 규모인 29억 개 이상의 기록이 유출되는 사건이 발생했습니다.

헥터 몬수르(일명 사부)는 익명화 서비스를 사용하지 않고 IRC 채팅에 접속했다가 적발되어 당국에 협조하고 다른 유명 해커들을 체포하는 데 기여했습니다.

브라질 연방 경찰이 659명의 개인 정보와 민감한 기록을 판매한 혐의로 사이버 범죄 용의자인 루안 BG가 주목을 받았습니다.

개인 정보 판매라는 고액 거래로 인해 고위 공무원들이 노출되어 추적될 위험이 높아졌습니다.

해커들이 저지르는 코믹한 실수들

이 동영상은 의사 해커 또는 스크립트 키티와 같은 해커들이 흔히 저지르는 실수를 강조하며 누구나 실수를 저지른다는 점을 강조합니다.

한 해커인 루안 B는 민감한 정보를 유출했다가 CrowdStrike에 의해 자신의 정체가 탄로난 후 붙잡혔습니다.

이 동영상은 최악의 해커 실수에 대해 시청자들에게 재미와 정보를 제공하는 것을 목표로 하며, 5가지 코믹한 사례를 보여줍니다.