I received an email from a person in a foreign country; I am not free to identify the name of the informant or the country as I do not want the informant to be fired. I have deleted the names of the two university students who were investigated. Both have fewer than 100 twitter followers. Frankly, I find this level of scrutiny of individuals by a huge multinational corporation to be shocking.
The message reads as follows:
Diane I work for a company in XXXX that Pearson has retained to spy on students.
Find attached the text of the kind of surveillance in place – It’s run at Pearson by some guy called Marc Lueck – he’s an American living in the UK. He runs the Pearson threat team and that’s how he views these kids, as threats. He wants to spend more and more money monitoring the internet and has retained a number of comapnies around the world. We call him the childcatcher. You can see from the text that Pearson and this Marc guy are expending real money and resources to make sure no stones are unconvered. I have kids and what these guys are doing is wrong – I want to track down hackers and criminals not spy on kids. We state in the report that these kids pose no threat to Pearson but Pearson wants us to keep monitoring them.
I could lose my job for this, but I thought you should know. The document has pictures of the students from their Facebook profiles but I can only send you the text.
Pearson report:
Pearson’s book for sale in Hack Forums
Background
On 26.4.15 the user xxxx was looking in hackforums.net to gain access to Pearson Higher Ed
instructor site in order to get the following book:
http://ift.tt/1EZ80DL
bn=9780133807806&forced_logout=forced_logged_out
Xxxxx offered a 40 USD payment for anyone who’d help him to gain access to the website or
send him the requested book.
In response, the user yyyyy offered to sell the book in a PDF version. Yyyyy replied to xxxxc
that he has the book, and offered to discuss about that privately in the forum’s private messages system.
The abovementioned
discussion between xxxxx and yyyyy
http://ift.tt/1NJxjRm
xxxxx
The person who requested for Pearson’s book is nicknamed xxxxx.
Xxxxx has a very low reputation level in Hackforums although he’s already a member of the
forum for 6 years. Prestige and reputation scores can reach over 200, thus scores under 10 are
very low.
Xxxxxx user details in hackforums.net
Xxxxx uses Hackforums mainly for receiving assistance and advice from more experienced
hackers. A careful look into his latest posts shows that he also uses the forum for hiring people
to do his computer science assignments. It is fair to assume that he’s a computer science
student in a higher education institute.
Xxxxxx history of posts in hackforums.net
The nickname xxxxc is used in many other forums, blackhatworld.com is one of them. In
blackhatworld.com xxxxx has never published posts, yet he visited the website lately. It may
be inferred that xxxxx is a passive user in hacking forums and he mainly enjoys the knowledge
and skills of others rather than sharing his own. Note that we can’t tell for sure that xxxxx is the
same person in all the forums.
Xxxx user details in blackhatworld.com
Our research about the person behind the user led us to Jake Jak.
Xxxx is using Twitter under the nickname @xxxx, just like the user in Hack Forums. His
Twitter account shows that he’s from the US. Although the nickname xxxxx is not too common,
we can’t be certain that Xxxx is the person behind the user xxxxc in Hack Forums.
Xxxx profile in Twitter
Yyyyy
The person who replied xxxxc request is nicknamed yyyyy. Yyyyy also has a very low
reputation level in Hackforums.
Yyyyy user details in hackforums.net
“Yyyyy” stands for “fiasco” in Serbian, Croatian and Bosnian. This fact leads us to think the that
the user’s origin is one of former Yugoslavia’s republics. However, both the forum’s interface
and yyyyy posts are written in English, so this can’t be proven.
By analysing yyyyy activity in the forum, it seems that he has no more than a decent technical
knowledge rather than serious hacking skills. Yyyyy does take part in hacking related
discussions, however he doesn’t seem to provide any useful information besides minor tips and
recommendations about software \ websites.
Among Hack Forums , the user yyyyy also takes part in an Android developers forum
( xdadevelopers.com ). By examining yyyy’s activity in xdadevelopers.com , it is clear that his
discussions revolve over technical discussions. In addition, he doesn’t seem to be a highly rated
user among the forum members.
Yyyyyy user details in xdadevelopers.com
By searching social media we found both Twitter and Facebook under the name yyyyy.
It seems like the same person is behind the Twitter and Facebook accounts. However, These
account doesn’t show any indication of relation to the abovementioned
Yyyyy user. The Twitter
and Facebook accounts don’t have any hacking related posts, but mostly jokes and internet
memes. Both Facebook and Twitter pages haven’t been updated since February 1st.
Yyyyy Facebook page
Among these pages, we have found several other Twitter pages containing the word yyyyy in
the username and one Facebook user with the word yyyyy being used used as a user ID.
However, the vast majority of the pages containing yyyyy we have found were completely
blank. The rest were barely used and did not contain any hacking related posts.
l.User ID yyyyy on Facebook.
Conclusions
1. Xxxxx is a higher education student. We can’t tell for sure whether he’s a Pearson’s
student or not.
2. Both xxxxx and yyyyy probably don’t have serious hacking skills and thus do not
impose a cyberattack
threat upon Pearson. Furthermore, it doesn’t seem like the
discussion in Hack Forums led to any hacking activity.
3. It is likely that yyyyy’s origin is in the former Yugoslavia republic. However, we can’t tell
for sure that he lives there, he might be an immigrant from the former Yugoslavia who
lives in the UK or any other place in the world.
4. We can’t tell where yyyyy achieved Pearson’s book. Though it is important to note that
Pearson’s books are often offered for sale in blackmarkets
and in the DarkWeb as can
be seen in alert ID 55c31ff5729d014d7d63a8b6. It is possible that yyyyy got the book
from one of the blackmarkets
and perhaps from the source mentioned in alert ID
55c31ff5729d014d7d63a8b6.
5. Finally, we recommend to keep following xxxx and yyyy in Hackforums, and to
watch for new indications regarding their connection to Pearson./pub/marc-lueck
from novemoore http://ift.tt/1NJxlZq
No comments:
Post a Comment