Independent Investigation into the 773 Million Records - "Collection #1"

On 17 January 2019, media reports concerning an article posted by Troy Hunt where a huge trove of data with nearly 773 million records were exposed in a giant 87GB archive. On the same day, Brian Krebs posted an article stating that the 773 million password "Megabreach" were most likely to be old data.

So on the night of 18 January, I started to conduct my own research and investigation to find out more about this Megabreach. Using the screenshot of the database trove posted on Troy Hunt's website, I decided to start digging...

Screenshot of the 'archive' posted on Troyhunt.com

Taking some of the texts in the screenshot, I found a link that many of the domains (listed in the screenshot) were also listed in a list called "dumplist.txt" posted on 28 September 2018.

Thousands of 'hacked DBs' dumps. No data - just the names of the dumps.

According to Troy Hunt, he was directed to a post in a well known hacking forum - that was where the screenshot was taken from. I was able to find the forum and i believed this was the forum Troy Hunt was referring/redirected to.

Posted on a forum known for hacking, cracking and even advertising hacked DBs

Upon further inspection of the screenshot/post, I noticed the naming convention was quite interesting and realized that this was most likely copied and pasted from the dumplist.txt. Two samples of similarities are highlighted below:

Same naming convention and structure

Troy Hunt also posted the list of "allegedly hacked databases" amounting to over 2000 'DBs' on Pastebin: https://pastebin.com/UsxU4gXA

While I was cross-referencing Troy Hunt's list to dumplist.txt and confirming my view that some (or most) of the hacked DBs were listed in that dumplist.txt using the exact naming convention, mirrored word by word, i also identified a Pastebin content which has most of these DBs listed in its content.

Posted on 29 August 2018

A total of 8301 presumable hacked DBs

This list, not only has the same naming convention, but also contains over 8000 allegedly hacked DBs. This list however was posted on 29 August 2018!

According to Troy Hunt and Brian Krebs, these data from Collection #1 are all a collection or compilation of previous data breaches and advertised as a 'new' database for sale. I took the liberty to research some of the samples 'hacked' DBs to identify if these DBs were indeed not new. To achieve this, I cross reference a hacked DB from the latest Pastebin content posted (by Troy Hunt), then looked at the contents from 2018 posts.

Using kabarindonesia[.]com as a sample

For this particular example, the hacked DB allegedly belonging to kabarindonesia[.]com was present in all the lists. Additionally, this was further confirmed from Breach Aware that kabarindonesia[.]com was one of the victims involved in the data breach of early 2018.

kabarindonesia[.]com pointed as one of the victims of a past data breach

Now further investigation reveals that the screenshot on the hacking forum posted on Troy Hunt's website was not the ground zero. I was able to identify a forum post (a different forum from the one in Troy Hunt's website) that was selling databases similar to the ones in Collection #1.

A typical advertisement in hacking forums

The list of databases for sale in this advertisement

Upon closer inspection of the data advertised, there seems to be a similar offering to the contents of Collection #1. I assess (with medium confidence) that the data advertised in the forum is also possibly included in the bigger data in Collection #1 (right).

Possibly same data, different seller and databases

Now according to Brian Krebs, his interaction with the seller known as "Sanixer" on Telegram reveals that Collection #1 (87GB) was just the beginning of the bigger 993.36GB (almost 1TB) data dump. This was being sold for just $45!

The Telegram User Sanixer (below right)

While Sanixer was offering/advertising the 1TB data for $45, I spotted a forum post who was actually giving this away for free!!! Apparently the forum user was unhappy claiming that Sanixer was sharing his "Infinity Black Combo" in that storage. As an act of retaliation, he posted links to all the 1TB data that can be accessed for free!!

Links to the 1 TB data! 

And to make things worse, other forum users were spotted posting links to these data as well. The post below was posted on 9 January and another 19 January.

Another set of links to the 1 TB data

Another post from a different forum 

Due to ethics, I did not download any of these content, however I took screenshots of these content to show what was being offered.

Screenshot of Collection 1

Screenshot of Collection 2

Screenshot of Collection 3

Screenshot of Collection 4

Screenshot of Collection 5

Screenshot of Antipublic 1

Screenshot of Antipublic 2

In conclusion, I believe that most (if not all) of these data are not new but could be either bought or downloaded from existing databases in the deep web. While some researchers or journalists published this 'breach' as the biggest or largest breach, allow me to recollect your memory to the 1.4 Billion credentials leak of 2017 - reported by 4iQ and the Exploit[.]in compilation of over 592 Million accounts (leaked databases) in the same year. I have a feeling that this 1 TB of data advertised in the underground community is merely a compilation of previous and past years breaches until mid 2018.

Leaks, Databases, Dumps in the Deep Web and it's only January!

“The Deep Web is vast. Thousands of times larger than the visible internet what's called the surface web. But the deep web is not a place, it simply accounts for all the unindexed content online - banking data, administrative code for governments, corporations and universities. It's like looking under the hood of the internet.” – Neo

In the previous month (January 2016), we have seen several reported cases involving the Dark Web, how cybercriminals are utilizing it to trade, sell and expose data. Below are some of the reported news that you may have come across: (see link below)

Read it here on LinkedIn: https://www.linkedin.com/pulse/leaks-databases-dumps-deep-web-its-only-january-fadli-b-sidek

2014 - Year of the Privacy?

2012 was a year known famously for the amount of security breaches made. From Sony to Yahoo to Google have inadvertently had their personal data being leaked out. Most breaches were done from the server side.

Source: http://venturebeat.com/2012/09/17/2012-security-breaches/

Source: http://venturebeat.files.wordpress.com/2012/09/securitybreaches_25.png

2013 on the other hand was labelled as the year of the hack. As early as March 2013, companies from Apple, to Facebook and Twitter got hacked and this does not include the hacking incidents in Singapore.

Source: http://www.transfirst.com/blog/extensive-hacking-incidents-label-2013-the-year-of-the-hack

For Singapore, 2013 is seen as the year with a record of hacking incidents. Hacking related incidents such as the hack on Kong Hee's wife website to Anonymous threats to Singapore Government, the XSS attack on PMO and ISTANA website, the web defacement to Singapore schools websites, Singapore's Museum website and personal information got leaked and recently, the bank statements of Standard Chartered high profile clients got stolen.

Kong Hee's Wife Website Hacked

Source: http://www.straitstimes.com/the-big-story/chc-funds-case/story/city-harvest-church-leader-kong-hee-condemns-hacking-his-wifes-we

AMK Town Council Website Hacked

Source: http://sg.news.yahoo.com/ang-mo-kio-town-council-website-hacked-102124881.html

Anonymous Threats and Hacks in Singapore

Source: http://www.straitstimes.com/breaking-news/singapore/story/government-agencies-alert-after-hackers-threaten-attacks-20131101

Source: http://singapore.coconuts.co/2013/10/31/video-anonymous-hacktivists-warns-singapore-government

Source: http://sg.news.yahoo.com/singapore-newspaper-straits-times-hacked-020043975.html

Singapore Art Museum Website Hacked

Source: http://www.straitstimes.com/breaking-news/singapore/story/sam-website-hacked-second-cyber-intrusion-within-month-20131129

Singapore Schools Websites Hacked

Source: http://www.straitstimes.com/breaking-news/singapore/story/twelve-13-school-websites-hacked-wednesday-still-down-9am-thursday-201

Standard Chartered Clients Statements Stolen

Source: http://www.todayonline.com/singapore/standard-chartered-clients-monthly-bank-statement-stolen

With such a record number of hacking incidents in Singapore, 2013 will be known as the year Singapore got hacked the most. The year many security professionals from private organizations to governments, were placed on high alert and standby. It was indeed a tough year for security professionals in Singapore.

So what will 2014 be? 

A preview of whats going to happen were shown throughout 2013. Privacy has been another hot topic besides hacking. The case of Edward Snowden leaking out files from the NSA which tackles the US government spying on its citizens, the security of encryption keys, the spying of Malaysia by Singapore, the spying of Indonesia by Australia, the privacy of consumers against telemarketers

The Serious Leaks by Snowden

Source: http://www.theage.com.au/comment/snowden-revelations-only-the-beginning-20131229-301j6.html

The Allegations against Encryption Companies

Source: http://www.theguardian.com/world/2013/dec/20/nsa-internet-security-rsa-secret-10m-encryption

The Spying of Indonesia by Australia

Source: http://www.presstv.com/detail/2013/12/06/338456/australia-will-still-spy-on-indonesia/

The Spying Report of Malaysia by Singapore

Source: http://www.reuters.com/article/2013/11/26/us-malaysia-singapore-spying-idUSBRE9AP03P20131126

PDPC Backfires on Consumer's Privacy

Source: http://sg.news.yahoo.com/exemptions-provided-for-do-not-call-registry-033938964.html

All of these are previews of what may happen and will be the hot topic of discussion for 2014. While hacking will not stop, i predict that 2014 will be the year of privacy. The year of consumers questioning the privacy of their data and personal information. The year where companies will start concerning themselves with the security of their clients data. The year security vendors will get the most calls about privacy concerns and solutions. 

Even the Security Rockstar Bruce Schneier in his interview with 'Motherboard' said the following related to the security of our data:

"I'm worried about governments, the US and other governments. I'm worried about how they are using our data, how they're storing our data, and what happens to it. I'm less worried about the criminals. I think we've kinda got cyber-crime under control, it's not zero but it never will be. I'm much more worried about the powerful abusing us than the un-powerful abusing us."

Source: http://motherboard.vice.com/blog/an-interview-with-bruce-schneier

So in summary:

2012: the year of Security Breaches

2013: the year of the Hack

2014: the year of Privacy (just a prediction)