HackMD
Fractal.id breach; Facts from the hacker
An exclusive interview with the hacker of fractal, @unicornlover67, gave facts on the reality behind the sensitive breach of fractal.id
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
–
Passports are a headache. A single piece of document can create a series of migraines when parties outside of your control abuse your documents. A whole array of risks is involved in getting your sensitive information leaked: Identity theft, financial fraud, phishing, and social engineering attacks, to name the most common ones. It gets even worse when we're talking about KYC documents from financial institutes; any brute would love to know where someone lives with plenty of money and show up with their machetes.
You would assume that organisations taking custody of your sensitive details care about their users more than they care about their own reputation and branding. You would also expect a certain level of transparency rather than masquerading their mistake. Instead of owning up, fractal.id seems to focus more on hiding even more information. Maybe that's something they should have done initially with their user data, preferably before it gets offered for sale on the black-market.
Even more preferably, if they have the option to buy it back, making it a gray hack bounty approach, actually starting the communications with the hacker in question. If they care so much about their reputation to hide facts, they would at least be willing to protect their customers by purchasing their sensitive data back. Especially as some of their affected customers can't afford to simply buy out the data themselves.
"We were later contacted by a party who claimed responsibility over the attack. They requested a ransom from us. We didn’t engage and reported them to the authorities." - Fractal (source)
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
How did it happen;
Per unicornlover67;
"i managed to breach effortless due to a worker with admin privs being on botnet logs"
"simple as some subdomain recon on kyc providers"
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
"they had the aws key in the headers of there pretty much open backoffice"
"then i pivoted with an s3 tag exposed on the panel"
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
"this login could access the entire panel"
"no 2fa"
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
"i hacked 4 of them in 1 day the same way"
"embarrassing"
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
passwords are displayed as per fractal these should be now disabled: "We disabled every account in this system before bringing it back up and limited the access to few senior core Fractal ID employees." (source)
Facts;
At least 35314 accounts were breached
Claim by Fractal.id:
"An operator account access credentials were compromised, allowing the attacker to exfiltrate data for ~0.5% of our user base. We regret what happened, and we will do our best to protect affected users."
source
Proof of reality:
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
Verification File
https://tan-musical-dragonfly-486.mypinata.cloud/ipfs/QmVvD7MeJGnvQ2XFrJ6goNhbDEqysBc2UajWxcNvP7vu68
Not all partners that were breached have been publiced
Fractal claims that only a "few" partners have been affected. here are the names of ALL partners present in the breach (it is unknown to myself how many users per partner, as we do not have the individual user data.);
It's important you know if your data is at risk; check the file below to verify if you used any of their partners KYC
Proof of Reality
(excerpt of a few)
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
Verification File
https://tan-musical-dragonfly-486.mypinata.cloud/ipfs/QmVBk4AJz4z7RqSYsWttmgdRyVs2uCRxe3xsFGLPsK5sZR
What's next
@unicornlover67 tried to reachout to anyone within fractal, although they had no ears to award the grayhat bounty. Instead they claimed to push it of as blackmailing.
There's still a chance for users to safe their data. Either through a collective approach and buying their own data together (constitution dao variation). Or for Fractal to own up, pay the grayhat bounty.
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
As you can see in the above image, UnicornLover67 even told them directly on how they can avoid this pitfall, not abusing the power situation they were in. Although Fractal is very happy to make him see the "criminal", while them keeping an ex-employee login still in the system
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
Interview written by mf ; https://x.com/0x_m_f
