Telus source code, staff info for sale on dark web forum
- Reference: 1677285005
- News link: https://www.theregister.co.uk/2023/02/25/telus_source_code_github_repos/
- Source link:
"We are investigating claims that a small amount of data related to internal Telus source code and select Telus team members' information has appeared on the dark web," Telus spokesperson Richard Gilhooley told The Register . "We can confirm that to this point our investigation, which we launched as soon as we were made aware of the incident, has not identified any corporate or retail customer data."
A miscreant who goes by "Seize" claims to have exfiltrated the Telus data, and is offering it for sale on BreachForums, according to screen shots shared with The Register .
[1]
In one post, the crook offers 76,000 unique employee emails plus "internal information" linked to those staff scraped from Telus' API. The price on this dataset is listed as "negotiable," and will only be sold to one individual.
[2]
[3]
In another post, Seize offers an email database for $7,000 that includes every Telus employee's email, a payroll database for $6,000 with 770 staff records — including the Telus president's info — and finally, all of Telus' private source code and GitHub repositories including the SIM swap API, for $50,000.
It's "important to note that, at this point, we don't know whether the data is legit," Emsisoft threat analyst Brett Callow told The Register .
[4]
"From the perspective of Telus' customers, probably the biggest concern is what could be done with the repos — the SIM swap API, for example," he added.
A criminal could potentially use this code to transfer the victim's phone number to an attacker-controlled device, allowing the interception of one-time security codes to hijack the victim's other online accounts. In the past this has necessitated fooling or [5]bribing telco staff, but with open code out there some scumbag could steal with more ease.
[6]Crims steal data on 40 million T-Mobile US customers
[7]Dole production plants crippled by ransomware, stores run short
[8]JD Sports admits intruder accessed 10 million customers' data
[9]Accidental WhatsApp account takeovers? It's a thing
In 2020, another Telsus-owned company, Medisys Health Group, was the victim of a [10]ransomware attack during which crooks stole personal information belonging to about 60,000 clients.
That incident hit about 5 percent of the company's customers, and included names, contact information, provincial health numbers, and test results. Financial information and social insurance numbers were not stolen in the attack, the company said at the time.
And just last month another carrier, T-Mobile US, [11]admitted a data breach in which someone abused an API to download personal information belonging to 37 million subscribers. This was the network operator's sixth security snafu in five years. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y-mV8Xu43PsWbUUL7QRSRAAAAAk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y-mV8Xu43PsWbUUL7QRSRAAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y-mV8Xu43PsWbUUL7QRSRAAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y-mV8Xu43PsWbUUL7QRSRAAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/10/15/pinsky_terpin_sim_swap/
[6] https://www.theregister.com/2023/01/20/t_mobile_us_data_breach/
[7] https://www.theregister.com/2023/02/23/dole_ransomware_attack/
[8] https://www.theregister.com/2023/01/30/jd_sports_breach/
[9] https://www.theregister.com/2023/02/21/accidental_whatsapp_account_takeover/
[10] https://globalnews.ca/news/7367127/medisys-data-breach/
[11] https://www.theregister.com/2023/01/20/t_mobile_us_data_breach/
[12] https://whitepapers.theregister.com/
Wait, what?
"investigating whether crooks have stolen employee data and its source code, all of which is being offered for sale on a criminal forum."
Isn't that like investigating whether I've been robbed after I come home and all my stuff is gone?
Re: Wait, what?
“Robbed,” when somebody doesn’t physically take anything but instead makes a perfect copy of your whole household except in their own household.
Which reminds me of the time I asked the security guy at Iko Industries (shingle manufacturer in Calgary) how come he even has a job, it’s like, who gives a toss about the security of asphalt shingles. You could wander around the entire compound and maybe find one or two things worth your while to pick up, and they are empty apple juice containers outside the smoke doors.
“Well!” offers our hapless hero, in full conspiratorial mode. “This one time in the 1950s there was this whole gang of Japanese visitors visiting from deepest darkest Japan, and they all had their finest Nikon Canon Fuji Konica Kyocera Minolta cameras out and they toured the whole plant and they shot the whole place to smithereens (on film, that is) and then they left leaving nothing behind but footprints, and two months later they had their own Iko Industries asphalt shingle plant, perfectly replicated in every detail, and so that’s how come we have such tight security to this day.”
I was like, “are you joking me? Man it’s friggin shingles who gives a toss,” and just like that he was fired and the security shed burned down, and now I can sell photos of those apple juice jugs without getting hassled by some id-10-t who has nuttin better to do, for heaven’s sake !
Telus customer
On Telus fibre for internet and tv. After a power outage the internet comes back but the tv, which I think is built on Windows, can take nearly a week to resume. So I''m not surprised they were vulnerable.