40 Million Wishbone Users’ Information for Sale on Dark Web

The social quiz platform Wishbone has been breached for the second time in three years. A new breach broker using the alias “Megadimarus” is offering a database of over 40 million users for sale on a hacking forum. In addition to the Wishbone breach, this actor is selling breach dumps that include sensitive information related to over 2,000,000,000 compromised accounts.

Recommendations

Enable two-factor authentication for all of your organization’s accounts to help prevent phishing and credential stuffing attacks.
Monitor your assets on your network and shut down any internet-facing services that aren’t required to be public-facing.
ZeroFOX customers are advised to closely monitor their compromised credentials, network scanning, and entity-based alerts for illegitimate activity.

Details

ZeroFOX Alpha Team identified an actor who is allegedly selling a database of over 40,000,000 users of the social media app, Wishbone.io. This actor has posted the details for sale on a popular cybercrime and breach forum:

Figure 1: Wishbone breach dump sale ad.

This isn’t the first time Wishbone has experienced a major breach. In 2017, the site exposed 2.2 million email addresses and 287,000 cell phone numbers. A mere three years later, Wishbone is targeted again. Except, the 2020 breach has almost 20 times the amount of exposed accounts.

The threat actor claims that today’s breach is separate from 2017’s breach, and that the data was obtained this year. For data on 40,000,000 Wishbone user profiles, the actor is asking for $8,000 USD. The data inside includes email addresses, names, usernames, phone numbers, geographic locations, genders, social media profiles and SHA1 hashed passwords.

Megadimarus’ Impact Goes Beyond the Wishbone Breach

The Wishbone breach is just one of many breach dumps offered for sale by this actor. As of May 20, 2020, the user has made 55 “for sale” posts since May 1, 2020. The profile is selling some older breaches, but the Wishbone breach and several others appear to be new datasets.

In total, these 55 breach sale posts include over 2,000,000,000 compromised accounts. These include older breaches and potential combolists. Some users have noted that not all of these sales are private, and may not be unique to this particular seller.

Figure 2: A forum user notes that the Tokopedia breach was offered for sale earlier in the month by the ShinyHunters group.

Conclusion

Without verification from the breached company, it is hard to accurately identify the legitimacy of the data. Large data breaches can be effective tools for cybercriminals, however.

The breached data contains SHA-1 hashed passwords. SHA-1 is a known insecure cryptographic hashing algorithm, where the search space of a hash can be attacked and reduced, undermining the security of the algorithm. Secondly, SHA-1 can be dangerous due to its inherent speed of generating output hashes. Crackers use a combination of techniques to effectively reverse these hashes into passwords at a much higher rate than other, safer cryptographic hashing algorithms.

Cracked passwords from these breaches can then be used for credential stuffing and targeted attacks. Other data inside the breach can be used for spamming, whether via email or SMS, and traded, repackaged and used for phishing and malware attacks.