On December 14, I became aware of a data dump from a hack of SpecialForces.com, a business that caters to those seeking military gear. As is our now informal policy, I waited a bit to post it to DataLossDB.org so that the firm would have a chance to get their customers’ data removed from the web. I finally posted it this week after checking back to determine that the paste had been removed. Then yesterday, I saw this tidbit in a press release from #AntiSec:
But wait! That’s not all folks. 0h hell n0. Tomorrow, we will be dropping another enormous dump on our next target: the entire customer database from an online military and law enforcement supply store. Bring the pain? Shit, we brought the motherfuckin’ ruckus. You really trying to step this this? (sic)
I tweeted my suspicion that the dump would be SpecialForces.com. Dan Kaplan of SC Magazine kindly pointed me to a copy of the breach notification letter SpecialForces.com sent on December 14. That letter refers to encrypted credit card data. The data dump I saw, posted by @Abhaxas on December 14, did not contain any credit card data, but a statement from #AntiSec today affirms that credit card data were acquired and were now being revealed:
We had to contain our laughter when we saw these two “hacker proof” logos plastered on the SpecialForces.com website: “Scanned by GoDaddy.com: secured website” and “McAfee SECURE sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses, and online scams.” Despite the almighty powers of GoDaddy and McAfee’s logos and some reassuring words, SpecialForces.com was just no match for our hella wicked black hat voodoo. We have just one question before we continue: You mad, officer?
To be fair, at least SpecialForces.com DID store their customers’ credit card information using blowfish encryption (unlike the global intelligence and security industry “professionals” at Stratfor, who apparently remain confused as to whether their customers’ information was even encrypted or not). Nevertheless, our voodoo prevailed and we were quickly able to break back into the military supplier’s server and steal their encryption keys. We then wrote a few simple functions to recover the cleartext passwords, credit card numbers, and expiration dates to all their customers’ cards. That’s how we roll.
In reality, for the past few months, we have been in possession of approximately 14,000 passwords and 8000 credit cards from SpecialForces.com. Unfortunately a former comrade leaked the password list early, and the full story on this owning will be told in our upcoming zine. Until then, feast upon one hell of a juicy text file.