The last couple of weeks have been fairly slow on the hacker front which is probably a good thing but this has changed today for over 90,000 users of a domain and blog registration service for .pe based domains. The companies that got hacked was punto.pe and hundreds of other website administration, payment and personal credentials have been leaked in a compressed rar file which was uploaded to anonfiles. The attack was carried out by long time anonymous based hacker @LulzSecPeru and was announced via their twitter account. > Lulz Security Peru @LulzSecPeru ALL .PE Domains Owned by #Lulzsecperu #THNhttps://pastebin.com/bjHVrr4n @TheHackersNews @EduardKovacs@Cyber_War_News #leak #fuckdivindat
As of the 19th Punto claimed that they currently have over 64,472 active domains registered with them so its any wonder just how many sites are about to be effected from this large breach. At time of publishing the punto.pe website was showing its maintenance page and no statements appear to of been made from them as yet. The leak was posted to pastebin with the below message which was originally in spanish.
All domains of Peru Owned by # Lulzsecperu # fuckdivindat All Peruvian. Owned PE domains. Among the users are domain accounts of all banks of Peru and computer security companies as well as universities recognized instuons government and national security system. We clarify that we have no malicious purposes, only prove that the security of India is void and should be corrected. Greetings to the computer crimes division of the National Police of Peru from March 2012 is nil activity and fail or be close to where we are now ASBANC for trying.
Original
Todos los dominios del Peru Owned by #Lulzsecperu #fuckdivindat All Peruvian .PE domains owned. Dentro de los users hay accounts de los dominios de todos los bancos del Peru y empresas de seguridad informatica ademas de universidades reconocidas ,instuciones del Gobierno y sistema de seguridad nacional. Aclaramos que no tenemos fines malicioso , solo probar que la seguridad del Peru es nula y debe corregirse. Saludos a la division de delitos informaticos de la Policia Nacional del Perú que desde Marzo del 2012 su actividad es nula y no logran ni estar cerca de donde estamos y a ASBANC por el intento.
The leaked accounts come in a .rar file which is 11MB compressed and contains a 17mb .SQL file with a raw database that contains well over 120,000 accounts many of which are duplicated for one reason or another. So once again another web service is affected by a massive breach clearly due to the lack of security they imposed within the services they offer. This will also raise many questions where the "punto.pe secure domain" is indeed secure… The leaked data is being processed by ozdc.net and should be ready for easy search in about 12hrs. https://ozdc.net/archives.php?aid=3669 https://pastebin.com/bjHVrr4n