Teen TalkTalk hacker ordered to pay £400k after hijacking popular Instagram account

My guess was that he socially engineered his way into some Telstra customer e-mail accounts and used the Instagram password recovery feature

Re: hmm

It is a bit odd, as I remember it, it doesnt do a particularly secure wipe, Spybot S&D on the other hand, used to have a VERY secure wipe option (not sure about the current version - which is a bit useless).

One of the first things asked when I was arrested after a faked up kiddi-rape accusation, was if I had a shredder program.

"Yes, part of Spybot, but I dont recall ever using it" was my reply.

Released after 3 hours of questioning, by which time they had finally realised I was in hospital 12-14 miles away at the time of the alleged rape.

Cleared entirely after 3 days, albeit after a LOT of prevaricating (trying out different dates I might have committed the rape).

Had the wrecked remains of my PCs and laptop returned 12 months later - along with my car keys - £1,000+ of missing or broken stuff.

The apology and/or action against the malicious complainant - 12 years and counting.

Re: why was CCleaner the trigger?

The searches were done by un-skilled PC's, who will have just had a list of banned items to watch out for.

Find something on the list and call in the Techs.

Re: dodgy images

but if they have sexual mages of themselves at that age (under 18) then its illegal child pr0n.

That used to be the case, but for a while now there has been a specific exception for married couples, civil partners and cohabiting couples.

Spoiler: not us.

Re: Ok...are people listening...

Strangely I see some valid points, the red mist however does it no justice.

Yes, they have skills and yes, gameful employment is a good path.

Yes ISO 27001 is only as good as the implementor(s).

However in any post, you need to take your audience with you...a rant rarely helps your case :)

"You need a raving lunatic [...] foaming at the mouth"

This is a racist stereotype - I met a lot of very skilled pen testers that are quite far from your description. And anyway when you let someone attack your systems, you want someone responsible - not one that behind your backs sells what it finds on the black market.

Re: Ok...are people listening...

And who will indemnify the company against anything done by the loose cannon while on the clock which might be -- shall we say...? -- slightly outside the bounds of propriety? Because people who think the rules don't apply to them when they are on their own aren't likely to be any more circumspect after being told "We hired you to think outside the box and go beyond expectations!"

There's a REASON that companies don't like to hire loose cannon types; it's called "limiting liability".

...deluded by the belief they are "pretty secure" according to some paper pusher.

"Reads to me as Talk-Talk and Telstra are a steaming piles of insecurity."

Oh, indeed - and an astute judge could make hay by dint of simply pointing out that the only reason they're not facing massive charges and fines themselves is because noone's thought to prosecute them yet.

If a social-engineering skript kiddie can crash into someone's IG account by sweet talking telco employees, then the privacy bodies in all countries affected should be going in boot-and-all for maximum fines.

Yes he's a criminal scumbag, but they still broke a bunch of laws (and GDPR liabilities apply for TalkTalk) by handing over the data. Right now they can blame the 'evil hacker' instead of being made to sweat a few million, have some explaining to do to the shareholders and fix their broken processes so it doesn't happen again (What was the Talktalk record? 3 almost identical bull-in-a-china-shop hacks in as many months where they tried to play it down as "sophisticated and subtle" and "we've fixed our security" - fines should be tripled when that kind of bare faced lie is publicly shown up for what it is.)

Re: only in the uk

I wonder how many visits there were before it was found ha ha.

Re: only in the uk

CCleaner is not illegal in the UK.

People under an SHPO must not erase their browsing histories under the terms of the order. If they breach those terms they will be back in court.

This is to allow any untrained police to carry out visits and checks without having to use IT forensic guys.

Of course there are a 1000 ways around this, but they have to work with the resources they have.

But feel free to have a good old scoff.

Re: only in the uk

But by relying on the criminal to not clean his devices but knowing full well that he will even if he's behaving himself, it gives the plod a wonderful pretext to nick him again any time they want.

"Wondering if putting your browser in perma private mode"

From the previous article:

A normal condition of SHPOs is that they ban the offender from using private browsing mode, deleting browser history or doing anything else that prevents unskilled police employees on home visits from trawling through an offender's internet activities.

"Our unit does not have specialist software for home visits and we have to rely on the honesty of the offender," said DC Hollis, as reported by the Eastern Daily Press. "It would be impossible for us to know if he has deleted any history."

So it's something alike "show us we can trust you" - as they can, as happened, to decide to perform a deeper analysis if suspicious - without deploying a far more intrusive surveillance.

Anyway, luckily many criminals are stupid, as in this case. You know you're under surveillance and then act against yourself? At least a real hacker would have been able to write his own cleaning utility, instead of using one with a bad reputation.

Re: only in the uk

It's not the use of that specific tool that's the problem, he was under and order where he was not permitted to clear information relating to his activity - that's not something which is limited to the UK,.