Breach Disclosure: Slickwraps

On February 21st, Slickwraps experienced a data breach due to a database containing customer data being exploited and accessed by an unauthorized party. The information contained names, emails, and addresses for around 858,000 users, however, no passwords or financial data were contained in the breach.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The database contained 858,000 unique email addresses, and also included names, addresses, phone numbers and purchase history for users. Slickwraps stated that if users checked out as guests, this information would not have been available.

A user by the name of Lynx0x00 posted on Medium about how he hacked Slickwraps on February 21st. The user explains how they saw Slickwraps engaging in deceptive advertising and how they were possibly involved in "unscrupulous business activities". The attacker was able to achieve remote-code execution through a phone customization section on their website, which allowed the attacker to upload a .htaccess file enabling access to resumes of current and past Slickwrap employees as well as 9GB of personal customer photos used for phone skins.

From there, the attacker obtained credentials for a 17GB MySQL database which included:

All SlickWraps admin account details, including password hashes
All current and historical SlickWraps customer billing addresses
All current and historical SlickWraps customer shipping addresses
All current and historical SlickWraps customer email addresses
All current and historical SlickWraps customer phone numbers
All current and historical SlickWraps customer transaction history
Current SlickWraps API credentials for MadMimi
Current SlickWraps API credentials for PayPal Payments Pro
Current SlickWraps API credentials for Braintree
Current SlickWraps API credentials for ShipHero
Current SlickWraps API credentials for Zendesk
Current SlickWraps API credentials for Facebook
Current SlickWraps API credentials for Twitter
Current SlickWraps API credentials for Instagram

The attacker then was able to access their Slack team as well as account balances and transaction logs for their payment gateways. Lastly, the attacker gained access to their Content Management System (CMS) and "...could have deleted their entire company".

The attacker attempted several times to make contact with Slickwraps, however, these messages were ignored and resulted in the attacker going public with the data. The attacker claimed that Slickwraps reset passwords, attempted to remove the remote shells they created, changed API keys, and reinstalled their Magento eCommerce platform.

Throughout the entire process, the attacker repeated attempts to make contact with Slickwraps, however all their requests were ignored or met with limited answers, which resulted in the attacker disclosing all this information and contacting HaveIBeenPwned to provide the breached data.