Alpha Team Research: OGUsers and Account Takeover Case Study

In May 2019, infamous SIM swapping and account takeover forum OGUsers was compromised. A rival site, RaidForums, published the full contents of OGUser's database on their database downloads page. The forum focused heavily on services, products and tutorials on stealing cryptocurrency, hijacking social media accounts and SIM swapping attacks. ZeroFOX Alpha Team conducted a detailed exploration on the OGUser’s forum, which was breached earlier this year. Our findings demonstrate the average user of an account takeover forum does not show the technical prowess of a typical cybercriminal “hacker” or a nation-state actor, but rather they follow an easier path and focus heavily on social engineering techniques and purchasing accounts with their own funds to achieve their objectives.

Recommendations

Consider enabling the cyber attack chatter rule to monitor hacking forums such at this one, for chatter related to your organization

Details

SIM Swap attacks are account compromises where a cybercriminal takes over a phone number of a victim via swapping out the SIM card in order to circumvent account protections set by the victim. The ZeroFOX Alpha Team obtained the database; subsequent examination showed that users of this website did not necessarily have good operational security and that although the users of the forum “specialized” in account takeover, many of them trusted the forum to keep their data safe and private.

OG User disclosure

Out of the 112,719 accounts that were in OGUsers, only 199 of them had two-factor authentication enabled, a staggeringly low .0017%. Users were from 169 countries, with English speaking countries accounting for 54% of the registered accounts. ⅓ of them had email addresses that were part of other breaches - so if they signed up with an email address [email protected], these users also had the same email in other breaches ‘other-than-OGUsers (341 unique breaches to be exact). 89% of the users on OGUsers linked a social site to their profile, making attribution easier and reducing their operational security posture. Some notable profile-linked sites include: Instagram, Kik, XBOX Live, Snapchat, Twitter, Youtube, Twitch and Facebook. The forum was concerned about discussion of competitors, and actively censored the forum. Some of these were other account takeover sites, like Ogflip and Doxagram, while there were larger cybercriminal hacking forums with account takeover subforums, like Leakforums and RaidForums.

Although this was a forum dedicated to cybercrime, users themselves were ineffective at operational security. There was also a sense of community and connectedness in this forum - most users had some social site linked to their profile. For a paranoid security person, this would represent a high likelihood of attribution - which is good for those battling cybercrime, but not for the cyber criminals. Eventually, one would expect the evidence to add up and for the prying eyes of law enforcement to fall on the forum. However, this seemed not to be a concern for most users of the forum given their poor operational security. Users also seemed to trust the site, exchanging their own payment credentials in private messages, despite that forum admins can access these records at any time.