UGNazi
UGNazi, also known as the Underground Nazi Hacktivist Group, is a computer hacker group that has claimed responsibility for several attacks conducted over the Internet. They are perhaps best known for their "Tango Down" DDoS attacks on United States government websites[1] and for leaking the personal information of government officials.[citation needed]
Attacks
UGNazi discovered a flaw within the Google Apps account recovery system that Google then fixed. They managed to bypass the Google 2-step verification system via a flaw in Google's account recovery process that ended up disabling the 2-step verification feature. Matthew Prince, the current CEO of CloudFlare[2] had his Gmail account hacked by UGNazi with the aforementioned exploit.[3]
Opposition to SOPA
In January 2012, the UGNazi attacked the Ultimate Fighting Championship's website in protest of the UFC's support for the Stop Online Piracy Act proposed by the United States at the time.[4] They later hacked Coach's website for the same reason.[5]
Washington Military Department leaks
After compromising a database belonging to the Washington Military Department, UGNazi leaked sensitive DNS information used by the US state of Washington. They also leaked the account details of about 16 users, consisting of usernames and password hashes, including those of the website's administrator. "This is just a continuation of our attack against wa.gov, but other than that, like we said we're not done with the government or anyone to be exact. We're going to come after every dirtbag we can get our hands on. Freedom is a right not a privilege but the US government makes it seems like it's a privilege that we have the 'freedom'," a group member told Softpedia.[6]
WHMCS leak
In May 2012, UGNazi claimed responsibility for hacking the web server of the web host billing software developer WHMCS in an apparent social engineering attack.[7] A member of the group called WHMCS's hosting provider impersonating a senior employee.[8] They were subsequently granted root access to WHMCS's web server after providing information for identity verification. UGNazi later leaked publicly WHMCS's SQL database, website files, and cPanel configuration.[9] The leaked database contains about 500,000 stored credit card numbers.[7] The Federal Bureau of Investigation has since been involved in the ongoing investigation.[8][10]
UGNazi member Cosmo claimed that the group targeted WHMCS in response to their tolerance for fraudulent websites' licensed use of their software.[8] Days later, Cosmo released a statement claiming that WHMCS was attacked to demonstrate the vulnerability of their customers' credit card numbers, which were stored on a web server managed by HostGator.[11][12]
MyBB
In May 2012, UGNazi targeted the open source forum software, MyBB. UGNazi's Twitter account claims the attack was because the largest hacking forum on the Internet, HackForums, uses the MyBB software.[citation needed] The attack appears to have been done by DNS poisoning. The mybb.com domain had been edited to point toward the UGNazi website. At this time, there has been no evidence of server or data breaches.[13]
4chan
In June 2012, UGNazi targeted the well-known imageboard 4chan.[14] They are reported to have hacked CloudFlare's database.[citation needed] The attacks on 4chan were notoriously short, lasting about 20 minutes. During that 20 minutes anyone trying to access 4chan would be redirected to UGNazi's Twitter page.[citation needed]
Wounded Warrior Project
In June 2012, UGNazi attacked the non-profit organization Wounded Warrior Project. The Project's database was released on June 6, 2012.[15][16]
HostGator
In June 2012, UGNazi attacked one of the world's biggest hosting companies, HostGator, leaving the website unavailable for almost 4 hours.[17]
WePay
On June 6, 2012, UGNazi attacked the payment processor known as WePay, leaving the website unavailable for 17 hours.[18] People claim the attack on the WePay website may have resulted in a data breach, but whether it has actually occurred is currently unknown.[citation needed]
Wawa
On June 8, 2012 UGNazi hacked the website of Wawa, a chain of convenience stores. They defaced the webpage, and have made statements that they have remote access to all of Wawa's gas station terminals. UGNazi has said that the reason for hacking Wawa was to lower gas prices. The Wawa website has since been secured.[19][20][21][22]
Six Flags
On June 17, 2012 UGNazi hacked the website of Six Flags Entertainment Corporation and left the page defaced for over 6 hours.
On June 21, 2012 UGNazi took popular social media website Twitter down via a Denial of Service Attack. Twitter was down for 2 hours and it was the worst crash Twitter had faced in 8 months. [23]
On December 17, 2012 UGNazi hacked into the Twitter account of Shirley Phelps-Roper in protest of the Westboro Baptist Church's planned protest following the Sandy Hook Elementary School shootings. The account displays a tribute called 'Pray For Newtown', lending support to those affected by the tragedy.
Law enforcement action
Mir Islam, allegedly UGNazi member JoshTheGod, was arrested on 26 June 2012 in Manhattan as part of Operation Card Shop, a Federal Bureau of Investigation investigation into identity theft and credit card fraud, after allegedly attempting to withdraw money using a stolen ATM card.[25]
Cosmo, another alleged UGNazi member, was also arrested on June 26, 2012 in Long Beach, California as part of Operation Card Shop. In the FBI's press release regarding Operation Card Shop, it states "In addition, two minors, whose names will not be made public, were arrested by local authorities in Long Beach and Sacramento, California". 2 days later, Cosmo was released from a Juvenile Detention Center in Los Angeles and posted on Twitter, which was Cosmo's final tweet. [26][27]
Sentencing
On November 7th, 2012 the 15-year-old UGNazi hacker known as Cosmo* or Cosmo the God was sentenced in juvenile court on Wednesday in Long Beach, California. Cosmo plead guilty to multiple felonies in exchange for a probation, encompassing all the charges brought against him, which included charges based on credit card fraud, identity theft, bomb threats, and online impersonation, the terms of the plea place him on probation until his 21st birthday. During that time, he cannot use the internet without prior consent from his parole officer. Nor will he be allowed to use the Internet in an unsupervised manner, or for any purposes other than education-related ones. He is required to hand over all of his account logins and passwords. He must disclose in writing any devices that he has access to that have the capability to connect to a network. He is prohibited from having contact with any members or associates of UGNazi or Anonymous, along with a specified list of other individuals. He had to forfeit all the computers and other items seized in the raid on his home, violating any of these terms will result in a three-year prison term.
References
- ^ http://www.occupylv.org/news/ugnazi-targets-cia-website-protest-cispa
- ^ List of CloudFlare employees from official website.
- ^ http://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app
- ^ "The UFC finally issues a statement about UGNazi, the group that hacked UFC.com". http://middleeasy.com/index.php?option=com_content&view=article&id=7002%3Athe-ufc-finally-issues-a-statement-about-ugnazi-the-group-that-hacked-ufccom&catid=34%3Aorganizations&Itemid=106. MiddleEasy. Retrieved 20 May 2012.
{{cite web}}: External link in|work= - ^ http://techie-buzz.com/tech-news/coach-ufc-coachfactory-hacked-ugnazi.html
- ^ Kovacs, Eduard. "UGNazi Hackers Leak Data from Washington Military Department". http://news.softpedia.com/news/UGNazi-Hackers-Leak-Data-from-Washington-Military-Department-269244.shtml. Softpedia. Retrieved 20 May 2012.
{{cite web}}: External link in|work= - ^ a b http://news.softpedia.com/news/UGNazi-Leaks-1-7-GB-of-Data-from-WHMCS-Servers-270914.shtml
- ^ a b c http://www.forbes.com/sites/andygreenberg/2012/05/22/hackers-impersonate-web-billing-firms-staff-to-spill-500000-users-passwords-and-credit-cards/
- ^ http://paste.re/409.html
- ^ http://www.theregister.co.uk/2012/05/22/whmcs_breach/
- ^ http://pastebin.com/iDgfV8RM
- ^ https://twitter.com/#!/UG/status/205229104268718082
- ^ Serial Velocity
- ^ https://twitter.com/CosmoTheGod/status/208656791708508160
- ^ http://news.softpedia.com/news/UGNazi-Attacks-Wounded-Warrior-Project-to-Spite-The-Jester-273163.shtml
- ^ https://twitter.com/UG/status/208625109311819776
- ^ http://twitter.com/JoshTheGod/status/210194654925295616
- ^ http://twitter.com/UG/status/210204612534353920
- ^ http://twitter.com/UG/status/211220216074616833
- ^ http://www.courierpostonline.com/article/20120608/NEWS01/120608009/Wawa-s-website-hacked
- ^ http://digg.com/news/world_news/ugnazi_claims_to_hacked_defaced_and_be_in_control_of_wawa_servers
- ^ http://www.philly.com/philly/news/20120608_Hackers_hit_Wawa_website.html
- ^ http://gizmodo.com/5963952/the-final-words-of-a-15+year+old-hacker-banned-from-the-internet?utm_source=gizmodo.com&utm_medium=recirculation&utm_campaign=recirculation
- ^ Pepitone, Julianne (June 21, 2012). "Twitter crashes hard, Internet freaks out".
- ^ Zetter, Kim (26 June 2012). "Feds Arrest 24 in Global Carding Ring Bust". Wired. Condé Nast Publications. Archived from the original on 8 July 2012. Retrieved 8 July 2012.
- ^ http://www.fbi.gov/newyork/press-releases/2012/manhattan-u.s.-attorney-and-fbi-assistant-director-in-charge-announce-24-arrests-in-eight-countries-as-part-of-international-cyber-crime-takedown
- ^ https://twitter.com/CosmoTheGod/status/218255934068244481
- ^ Honan, Mat. "Teenage Hacker 'Cosmo the God' Sentenced by California Court".
You can find more information about Cosmo's arrest: here