Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Crime Privacy Communications Network Networking Security Social Networks The Internet Technology

Dutch Developer Added Backdoor To Websites He Built, Phished Over 20,000 Users (bleepingcomputer.com) 123

Posted by BeauHD from the bolting-to-the-door dept.
An anonymous reader quotes a report from BleepingComputer: A Dutch developer illegally accessed the accounts of over 20,000 users after he allegedly collected their login information via backdoors installed on websites he built. According to an official statement, Dutch police officials are now in the process of notifying these victims about the crook's actions. The hacker, yet to be named by Dutch authorities, was arrested on July 11, 2016, at a hotel in Zwolle, the Netherlands, and police proceeded to raid two houses the crook owned, in Leeuwarden and Sneek. According to Dutch police, the 35-years-old suspect was hired to build e-commerce sites for various companies. After doing his job, the developer also left backdoors in those websites, which he used to install various scripts that allowed him to collect information on the site's users. Police say that it's impossible to determine the full breadth of his hacking campaign, but evidence found on his laptop revealed he gained access to over 20,000 email accounts. Authorities say the hacker used his access to these accounts to read people's private email conversations, access their social media profiles, sign-up for gambling sites with the victim's credentials, and access online shopping sites to make purchases for himself using the victim's funds.
This discussion has been archived. No new comments can be posted.

Dutch Developer Added Backdoor To Websites He Built, Phished Over 20,000 Users More

Dutch Developer Added Backdoor To Websites He Built, Phished Over 20,000 Users

Comments Filter:

  • I knew it! (Score:4, Funny)

    by Anonymous Coward on Wednesday January 18, 2017 @08:04AM (#53688501)

    There are two kinds of people in this world I hate.

    Those that are intolerant of other people's cultures and the Dutch.

    • There are two kinds of people in this world I hate.

      Those that are intolerant of other people's cultures and the Dutch.

      How about people who don't know what "phishing" means?

      • Re: (Score:2)

        by gnick ( 1211984 )

        Obviously, phishing means hacking and hacking means "stealing with a computer." What other definitions could there possibly be? Duh.

    • Re: (Score:2)

      by gweihir ( 88907 )

      I get it! You mean to say in a circumspect way that you are Dutch! Nice!

    • There are two kinds of people in this world I hate.

      Those that are intolerant of other people's cultures and the Dutch.

      I met a drunk Dutch guy in Seattle last week. He was quite the bore.

  • Why not name him? (Score:4, Interesting)

    by haruchai ( 17472 ) on Wednesday January 18, 2017 @08:14AM (#53688535)

    He's been in custody for over 6 months and is not a minor so why keep his name a secret?

    • Re:Why not name him? (Score:5, Informative)

      by Anonymous Coward on Wednesday January 18, 2017 @08:23AM (#53688557)

      The Dutch never reveal the names of the accused, even after they are found guilty after trial, has to do with the privacy laws.

    • Re: Why not name him? (Score:2, Interesting)

      by Anonymous Coward

      Because he's not yet been found guilty, and some cultures take a more enlightened approach than others when it comes to destroying potentially innocent lives via the judicial system.

      Think he'd ever find work again, if found not guilty, but named all over Google anyway?

      • Re: (Score:1)

        by Anonymous Coward

        I also like keeping guilty people anonymous simply because it seems like in todays celebrity driven culture there's some portion of the population who will do anything to become famous, including doing some quite heinous crimes. Lets not turn criminals into minor celebrities and make them look as cool as possible. I remember looking at the front page of CNN thinking "is it really appropriate to be using the ISIS glamour shots on the front page? Are you trying to make them look as cool and bad ass as poss

        • I remember back in the 1980s, as soon as the press stopped naming people in public who committed suicide, the amount of public suicide pacts and other items went down. What bothered me about the press wasn't the fact that a mass murderer was named. A few years ago, there was a mass shooting at UCSB. The shooter was not just named, but his writings and his YouTube videos were published, and the press spent most of the holiday going through his life like a biography of a hero. What the press should have d
        • He's a suspect. He will only become guilty when the judge has ruled so.
    • Because nobody here can pronounce it.

      • Because nobody here can pronounce it.

        Hmmm, not sure if +1 funny, or +1 insightful........

      • Dutch is easy- it's just German looking words pronounced as if they were English words. Dutch to me always sounded like "fake German" being spoken by an English speaker.

    • Re: (Score:3)

      by mwvdlee ( 775178 )

      You're asking the wrong question.
      Why ever release his name at all?

    • Comment removed based on user account deletion

    • Re: (Score:2)

      by gweihir ( 88907 )

      Because it is not the US and civilized countries have laws that protect the identities of people that are not yet convicted?

  • Oh that is just textbook xkcd... (Score:5, Funny)

    by teslar ( 706653 ) on Wednesday January 18, 2017 @08:41AM (#53688649)
    https://xkcd.com/792/ [xkcd.com]

    • Re: (Score:2)

      by Holi ( 250190 )
      Comic from 2010, gotta wonder if that is where the idea originated.

    • Re: (Score:2)

      by chihowa ( 366380 )

      Why is xkcd (through fastly) still using a cert signed by a revoked intermediate CA? Isn't three months [globalsign.com] long enough to sort that out?

      • Re: (Score:2)

        by chihowa ( 366380 )

        OK, it looks like the fix for them accidentally revoking their certificate was just to un-revoke it and pretend that it never happened. Clearing my OCSP cache [globalsign.com] "resolved" the issue. That whole affair really reinforces my faith in the CA system.

    • Re: (Score:2)

      by Quirkz ( 1206400 )

      "Since March of 1997 I don't really believe in anything." That's oddly specific. Curious if he's referencing a specific thing/event, or if that's a callback to a personal moment of truth, or just a weirdly detailed joke?

      • Re: (Score:3)

        by ChoGGi ( 522069 )

        However, he reveals that "since March of 1997" he doesn't really believe in anything. This could possibly refer to the March 26, 1997 incident in San Diego, California, where 39 Heaven's Gate cultists committed mass suicide at their compound. It is a plausible explanation, since one of them was the brother of Nichelle Nichols (a Star Trek actress), so the event got a big resonance in nerd circles (and Randall often refers to Star Trek in xkcd). However, given Black Hat's strange behavior, it could be anything, even Bill Clinton banning federal funding for human cloning research.

        https://www.explainxkcd.com/wi... [explainxkcd.com]

  • Should have just added a line to the EULA that he would be able to gain access to your account(s) if you register. Nobody reads the EULA, and there'd be no case against him because it would be in the EULA.

    This should also set the precedent that the government can be arrested if they put backdoors into things... of coursehttps://yro.slashdot.org/story/17/01/18/0527225/dutch-developer-added-backdoor-to-websites-he-built-phished-over-20000-users#, that will never happen. Nothing is illegal if the Government
  • He is a Sneak Thief from Sneek.

  • Anyone know how he got the information out of the sites he'd created? How did he 'install some scripts'? And even then, how did he get the data out?

    I realise that if you're hiring someone like this you might not be so-inclined to watch logs and whatnot, but there must be some sort of trail left by his accesses.

    • My guess is that he had the credentials to legitimately log in to the web hosts and make whatever changes he wanted.

      In the tradition of: "you touched it last, it's yours", many professional web dev outfits will also just take the role of web server maintainers (even if they typically suck at that job) or, at the very least, hang on to the web host credentials in case the client comes back to them with problems or changes.

      If you are the web dev, you could very easily, for example, e-mail yourself in addition

    • Clearly you are not a developer. All you would have to do is create webpage which when you pass it a certain variable pops up a form to upload something and run it on the server. The webpage does a legitimate task (registration for instance) but if you access it with webpage.php?action=registers instead of webpage.php?action=register it jumps to a separate section and allows you to upload a file etc. Even if someone were to give the site a once over it would be hard to pick up. To make it even more secu

      • You're right - I'm a devops, so I know a lot about sysadmin, and a bit about dev. I know he *could* do all those things, but I was looking to find out what he did do, and how he covered his tracks (if at all). I doubt most of the site owners would be checking /var/log/audit logs or /var/log/nginx/access.log or whatever, but if they had been, would they have been able to see something going on?

        It my impression that most criminals aren't nearly clever enough. He *could* have written scripts to snaffle the dat

        • Re: (Score:2)

          by swb ( 14022 )

          It my impression that most criminals aren't nearly clever enough.

          Maybe small-time criminals like home burglars or armed robbery people aren't clever enough, but someone capable of delivering a working e-commerce site? I'm assuming there that all the cleverness required to pull it off is built-in.

          My question is -- they caught THIS guy, but how many have done the same thing and not gotten caught? There's possibly millions of e-commerce sites out there written by people with nobody looking over their shoulder and not enough resources for someone to check for something lik

        • The clever ones are not criminals, they get away with it. There are some scary smart people working on the trojans etc. out there. Some of the stuff is hand coded in assembler, which they structure in such a way that the usual debuggers get confused and either crash or start following the wrong path, all just to make it more difficult for the white hats to figure out how to shut down the botnet.
  • Hello Mr. victim. It is me, Steffen van der Hast-Gracht of the Amsterdam police. Wiz my partner and also I am very happy to say my lover Ronald. I am terribly sorry to inform you zat you haf bin vukked ofer ze Internet by some ferry dubious person stemming from Ze Nezerlands. Vee haf already prepared ze forms for you to fill in so zat you can claim insurance, psychological help and absent time from yor wurk. Vee also made petition on ze Internet for you to arrange a silent march over ze canals. You ken bye

  • Could have just left a couple vulnerabilities sprinkled in odd places and used poor hashing practices. He'd have complete deniability as it looks just like 90% of websites out there.

  • you see one there must be hundreds. There has to be other developers who have installed backdoor into the web sites they built. You should have your web site source code checked for a backdoor..

Slashdot Top Deals

A committee takes root and grows, it flowers, wilts and dies, scattering the seed from which other committees will bloom. -- Parkinson

Close