如果你注册了特朗普手机服务,你可能属于一个独特的俱乐部成员——勒索软件受害者名单。犯罪分子“BYOD”声称已入侵特朗普品牌的手机业务,并泄露了3615人的数据,包括姓名、电子邮件地址、电话号码、家庭地址和订单详情。BYOD是一种新兴的勒索软件即服务操作,特朗普手机是其数据泄露网站上仅有的第三家被公布的组织。
If you signed up for Trump Mobile, you may be part of an exclusive club of … ransomware victims. Criminals called BYOD claim to have broken into the Trump-branded mobile biz and leaked data belonging to 3,615 people, including names, email addresses, phone numbers, home addresses, and order details. BYOD is a new ransomware-as-a-service operation, and Trump Mobile is only the third organization posted on its data-leak site.
根据该团伙发布的声明,在告知特朗普手机遭到入侵后,这家无线服务提供商回复称:“我们没有团队处理这个问题”以及“任何黑客攻击他们的人都是恐怖分子。”泄露网站写道:“唉,不幸的是,他们所有的3615名客户及其个人身份信息,以及电信详情现在都摆在了你的面前。”“欢迎你自己查看,不要害羞,我们(以及他们)当然不会阻止你。”
According to the group’s posted claim, after telling Trump Mobile that it had been breached, the wireless provider replied: “We have no team to handle this" and “Anyone who hacks them are a terrorist.”“Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs,” the leak site says. “Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you.”
据报道,黑客告诉国际网络安全杂志,他们首先感染了一名自由移动员工的设备,然后通过MVNO访问了特朗普手机。BYOD声称仍然保持对特朗普手机系统的访问权限,并告诉该出版物称,两家无线服务提供商均未使用任何形式的多因素认证。特朗普集团和自由移动均未回应本报就此次入侵事宜的询问。据《Straight Arrow News》(该媒体首次报道了此次入侵并核实了部分客户信息)报道,这批数据泄露不包含美国总统唐纳德特朗普或其家人的任何信息。
The hackers reportedly told International Cyber Digest that they first infected a Liberty Mobile employee with an infostealer, and then accessed Trump Mobile via the MVNO. BYOD claims to still have access to Trump Mobile’s systems, and told the publication that neither wireless provider used any form of multi-factor authentication. Neither the Trump Organization nor Liberty Mobile responded to The’s questions about the breach. The data dump doesn’t include any details about US President Donald Trump or his family members, according to Straight Arrow News, which first reported the breach and verified some customers’ information.
这可能意味着特朗普家族不吃自己的狗食。然而,泄露的信息中确实包括特朗普集团副总裁兼首席信息官埃里克布伦内特的个人信息。
This could mean that the Trump family doesn’t eat its own dogfood. The leak does, however, include personal information about Eric Brunnett, vice president and chief information officer for the Trump Organization.
根据布鲁内特的领英资料，他负责“特朗普集团所有业务领域的信息技术与信息安全工作”。此外，Straight Arrow联系到的一名客户称，他去年为预订特朗普移动公司的旗舰智能手机T1支付了100美元定金，但始终未收到那部金色款手机。据安全专家多米尼克·阿尔维里介绍，另一个犯罪组织EndZone也声称入侵了特朗普移动公司，并在BYOD发布帖子的一周前泄露了一批窃取来的数据，这“很可能属于同一次数据泄露事件”。
Brunnett’s LinkedIn profile says he oversees “all Information Technology and Information Security for all aspects of the Trump Organization.”Additionally, one customer contacted by Straight Arrow said he paid a $100 pre-order deposit last year for Trump Mobile’s flagship smartphone, the T1, but never received a gold-colored device. Another criminal group, EndZone, also claimed to have breached Trump Mobile and leaked a stolen dataset a week before BYOD’s post in what “appears to be the same original breach,” according to security sleuth Dominic Alvieri.
这些远非这家初创手机公司遭遇的唯一安全问题。在这两次疑似数据泄露事件发生前，一名安全研究员曾在5月份声称发现了一个已被修复的网站漏洞，该漏洞会导致特朗普移动公司客户的个人信息外泄。这位化名为“路易斯”、自称“只是个闲得发慌的待业宅男”的研究员此前向媒体透露，只需发送一个简单的POST请求就能获取网站上的数据。
These aren’t the fledgling mobile phone company's only security snafus. Before these two apparent breaches, a security researcher in May claimed he discovered a now-plugged website vulnerability that leaked Trump Mobile customers’ details. The individual behind the discovery, who goes by "Louis" and described himself as "just a nerd between jobs with too much time on my hands," previously told The that the website’s data could be scooped up with a simple POST request.®