Stay on target
Last week a hacker broke into the payment systems for San Francisco’s MUNI system, and now that same attacker, known by the alias Cryptom, is holding personal data on employees and customers if he doesn’t get a ransom.
In a ransom note obtained by The Verge, he said,”I hope the company tries to fix it correctly and we can advise them… But if they don’t, we will publish 30G databases and documents include [sic] contracts, employees data, LLD Plans, customers.”
It’s common practice for hackers, particularly those employed by companies and governments, to press and probe the security of different digital systems. Others are freelancers and will find vulnerabilities in exchange for huge sums of money — sometimes in the millions of dollars for something ubiquitous like an iPhone. So it comes as no surprise that this attacker is trying to get some cash from the high-profile attack.
According to the cyber security news site, CSO, the hacker is demanding 100 Bitcoins (approximately $73,000), but no transfers to his Bitcoin accounts have yet been made.
MUNI has confirmed that the attack was real, but didn’t believe that any information on the customers’ personal information. As of Monday, the faregates were back to working normally, though the attack is still being investigated.
In the meantime, an anonymous hacker broke into Cryptom’s email. The vigilante then leaked the contents of the account to security reporter Brian Krebs. Krebs said a review of the information he found showed that Cryptom wasn’t a first-timer. He’s been linked to attacks on several different businesses across the world. Typically, he’ll scan for vulnerabilities, breach a system, and then threaten to either permanently delete any data obtained, or raise the ransom each day he isn’t paid. While the nationality of the attacker isn’t known yet, Krebs suspects that Cryptom is Iranian.
The full text of the message Cryptom sent to MUNI appears below:
San Francisco People ride for free two days ! welcome!
But if ugly hacker’s attack to Operational Railways System’s, whats’ happen to You?
Anyone See Something like that in Hollywood Movies But it’s Completely Possible in Real World!
It’s Show to You and Proof of Concept; Company don’t pay Attention to Your Safety!
They give Your Money and everyday Rich more! But they don’t Pay for IT Security and using very old system’s!
We Hacked 2000 server/pc in SFMTA including all payment kiosk and internal Automation and Email and …!
We Gain Access Completely Random and Our Virus Working Automatically! We Don’t Have Targeted Attack to them! It’s wonderful!
If some Hacker Try to Hack Your Transportation Infrastructure Target-Based, it’s Have More Impact!
We Don’t live in USA, but I hope Company Try to Fix it Correctly and We Can Advise Them But if they Don’t, We Will Publish 30G Databases and Documents include contracts, employees data, LLD Plans, customers and … to Have More Impact to Company To Force Them to do Right Job!