Breach Disclosure: OGUsers (Again)

OGUsers, one of the most popular hacking forums on the Internet, has disclosed their second security breach of the last year. OGUsers’ administrator ACE, who notified the forum of the breach, stated that an unknown hacker was able to embed a shell in an avatar, upload this to the forum, and gain access to the OGUsers database. This incident exposed the website activity, usernames, emails, IP addresses, salted MD5-hashed passwords, website data and private messages of more than 200,000 registered users.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

OGUsers is a cybercrime marketplace known for selling hacked databases and compromised accounts. The site also shares hacking tutorials including how to conduct SIM Swapping attacks. The popularity of OGUsers has attracted a lot of unwanted attention from rival sites'. In May 2019, the first 'face-off' attack exposed details for the site’s 113,000 users. Additionally, attackers completely wiped the forum’s hard drives and dumped the stolen data on a rival hacking forum. A similar second breach took place on April 2nd, 2020. This breach exposed site activity, usernames, emails, IP addresses, salted MD5-hashed passwords, website data and private messages of more than 200,000 registered users. Before taking the site offline, OGUsers administrators force-reset passwords and urged users to enable two-factor authentication (2FA) for their accounts.

Soon after the breach, the database was uploaded to RaidForums. The RaidForums post suggests that this breach was conducted as an act of revenge against ‘corrupt’ OGUsers administrators.

Figure 1. OGUsers breach posting on rival hacking forum, RaidForums

MD5-hashed passwords are easily cracked to the plaintext equivalent. It is likely that many of these passwords will be recovered.