EP 76 — Knaves Out

The episode examines the 2014 JPMorgan Chase breach and related intrusions into financial institutions, linking the stolen customer data to an international criminal enterprise involving stock manipulation, online gambling, payment processing, money laundering, and a hired hacker.

Topics: Credential dumps and stolen credentials, External cyber-threat intelligence, Financial-sector network breaches, Credential reuse, Spear phishing, Two-factor authentication, Persistence and privilege escalation, Backdoors and reverse shells, Brute-force attacks, Database discovery and data exfiltration, Log deletion and anti-forensics, Use of rented infrastructure and proxy servers, Botnets and DDoS attacks, Compromised WordPress sites, SEO abuse, Payment processing abuse, Cybercrime investigations and digital evidence

Official episode-page sources

Entities (48)

Claims (29)

JPMorgan Chase breach COMPROMISES JPMorgan Chase

The breach compromised JPMorgan Chase's network and customer databases.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“The biggest bank in America had been hacked and they never even knew it happened.”

Jack Rhysider · offsets 7456–7537

JPMorgan Chase breach COMPROMISES Corporate Challenge

The Corporate Challenge charity website was hacked and breached in connection with the JPMorgan investigation.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“Simmco Data dug around their network logs and confirmed that the Corporate Challenge website was hacked and breached.”

Jack Rhysider · offsets 6352–6469

JPMorgan Chase breach INVOLVES Simmco Data Systems

Simmco Data Systems was the hosting provider for the breached Corporate Challenge website and was itself reported as breached.

Explicit Confidence 98% · Jack Rhysider EP 76 Details

“It was hosted by a company called Simmco Data Systems. As it happened, Simmco Data Systems was also mentioned in the Hold Security report.”

Jack Rhysider · offsets 5839–5978

JPMorgan Chase breach INVOLVES FBI

JPMorgan Chase contacted the FBI, which investigated the breach.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“At this point, JPMorgan Chase contacted the FBI”

Jack Rhysider · offsets 7539–7586

JPMorgan Chase breach INITIAL_ACCESS_VIA Corporate Challenge

Jack presents access through the Corporate Challenge site, possibly through its hosting provider, as one theory for how the attackers entered the bank's network.

Uncertain Direction flagged Confidence 84% · Jack Rhysider EP 76 Details

“it’s possible that the hacker gained access to this Corporate Challenge charity site. How? Possibly by hacking through Simmco Data Systems”

Jack Rhysider · offsets 8215–8355

JPMorgan Chase breach INVOLVES password reuse

Password reuse is presented as a possible mechanism by which credentials from the Corporate Challenge site could have enabled access to JPMorgan's network.

Uncertain Confidence 92% · Jack Rhysider EP 76 Details

“Maybe some of those username and passwords were the same usernames and passwords used to log into JPMorgan Chase’s network.”

Jack Rhysider · offsets 8739–8862

JPMorgan Chase breach INVOLVES spear phishing

Targeting a JPMorgan IT administrator through spear phishing is presented as an alternative theory for gaining access.

Uncertain Confidence 94% · Jack Rhysider EP 76 Details

“The other is that this hacker crew might have targeted an IT admin at JPMorgan Chase through spear phishing”

Jack Rhysider · offsets 9127–9234

JPMorgan Chase breach INVOLVES two-factor authentication

The neglected employee-benefits server lacked two-factor authentication, which Jack says probably would have stopped the attackers from progressing.

Explicit Confidence 98% · Jack Rhysider EP 76 Details

“This is a perfect example of when two-factor authentication probably would have stopped these hackers from getting any further into the network.”

Jack Rhysider · offsets 10620–10764

JPMorgan Chase breach INVOLVES persistence

The hackers created a back door to maintain persistent access to the JPMorgan Chase network.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“The hackers created a back door into the JPMorgan Chase network.”

Jack Rhysider · offsets 11060–11124

JPMorgan Chase breach INVOLVES Data exfiltration

The attackers quietly accessed databases and exported data to their own servers for months.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“For months, these hackers had been creeping around, quietly accessing databases and exporting data to their own servers”

Jack Rhysider · offsets 11554–11673

JPMorgan Chase breach ATTRIBUTED_TO Andrei Tyurin

Andrei Tyurin later admitted to hacking eight US financial institutions, including JPMorgan Chase, as part of the broader scheme.

Explicit Confidence 98% · Jack Rhysider EP 76 Details

“Andrei admitted to conspiracy to commit computer hacking”

Jack Rhysider · offsets 83928–83984

“These include JPMorgan Chase, Fidelity, Dow Jones, E-Trade, and Scottrade.”

Jack Rhysider · offsets 84261–84335

JPMorgan Chase breach ASSOCIATED_WITH Gery Shalon

Federal investigators concluded that Gery Shalon was pulling the strings on the hacks, while the unidentified hacker carried them out.

Attributed Confidence 96% · Jack Rhysider EP 76 Details

“The feds had confirmed that it was Gery pulling the strings on all these hacks”

Jack Rhysider · offsets 62214–62292

Gery Shalon MEMBER_OF Webologic Ltd.

Gery Shalon managed Webologic Ltd. and was described as its head of operations and CEO.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“Gery was the manager of this company”

Jack Rhysider · offsets 27034–27070

“Gery was the head of operations and CEO of their company, Webologic.”

Jack Rhysider · offsets 38736–38804

Ziv Orenstein MEMBER_OF Webologic Ltd.

Ziv Orenstein was associated with the operation of Webologic and was described as the person really in charge despite not being listed officially.

Uncertain Confidence 91% · Jack Rhysider EP 76 Details

“Ziv wasn’t listed as being involved with Webologic, at least on the books. Still, the Wall Street Journal reported that there were thirty odd employees that worked there and they all knew Ziv was really the guy in charge.”

Jack Rhysider · offsets 27075–27297

Webologic Ltd. DEVELOPED_BY Gery Shalon

Gery helped establish Webologic Ltd. in 2009.

Explicit Confidence 96% · Jack Rhysider EP 76 Details

“in 2009 they established a web marketing company called Webologic Ltd. Gery was the manager of this company”

Jack Rhysider · offsets 26962–27070

Webologic Ltd. DEVELOPED_BY Ziv Orenstein

Ziv was one of the two men who established Webologic Ltd., although his formal involvement was not listed.

Explicit Confidence 90% · Jack Rhysider EP 76 Details

“in 2009 they established a web marketing company called Webologic Ltd.”

Jack Rhysider · offsets 26962–27032

IDPay DEVELOPED_BY Gery Shalon

Gery created the online payment-processing company IDPay in 2011.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“In 2011, the same year he started the pump-and-dump scams, Gery created two online payment processing companies called IDPay and Todur.”

Jack Rhysider · offsets 55255–55390

Todur DEVELOPED_BY Gery Shalon

Gery created the online payment-processing company Todur in 2011.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“Gery created two online payment processing companies called IDPay and Todur.”

Jack Rhysider · offsets 55314–55390

Affactive OPERATED_BY Netad Management

Affactive was described as part of a group of casinos owned and operated by Netad Management.

Explicit Confidence 97% · Jack Rhysider EP 76 Details

“These are actually groups of casinos owned and operated by companies called Netad Management and Milore Ltd”

Jack Rhysider · offsets 45145–45252

RevenueJet OPERATED_BY Milore Ltd

RevenueJet was described as part of a group of casinos owned and operated by Milore Ltd.

Explicit Confidence 97% · Jack Rhysider EP 76 Details

“These are actually groups of casinos owned and operated by companies called Netad Management and Milore Ltd”

Jack Rhysider · offsets 45145–45252

Affactive USES Rival

Affactive's casinos used Rival gambling software for their games.

Explicit Confidence 98% · Jack Rhysider EP 76 Details

“all these sites under Affactive and RevenueJet used gambling software called Rival and RTG for the games.”

Jack Rhysider · offsets 45694–45799

RevenueJet USES RTG

RevenueJet's casinos used RTG gambling software for their games.

Explicit Confidence 98% · Jack Rhysider EP 76 Details

“all these sites under Affactive and RevenueJet used gambling software called Rival and RTG for the games.”

Jack Rhysider · offsets 45694–45799

John Doe USES Brute-force attack

The unidentified hacker used a brute-force attack to access an E-Trade video teleconferencing server.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“the hacker breached E-Trade’s server using a brute force attack to gain access to a video teleconferencing server”

Jack Rhysider · offsets 66022–66135

John Doe USES Reverse shell

The unidentified hacker installed a reverse shell on an E-Trade server to maintain access and export data.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“he installed a reverse shell on it. Four days after that, he gained access to three more internal servers”

Jack Rhysider · offsets 67170–67263

John Doe USES distributed denial-of-service attack

Gery's hacker used a botnet to conduct denial-of-service attacks against competing gambling sites.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“The hacker would use a botnet to launch a huge denial-of-service attack on competitor casinos”

Jack Rhysider · offsets 71433–71526

John Doe USES SEO poisoning

The hacker compromised dormant gambling-related WordPress blogs and added links and posts to improve the ranking of Gery's casinos.

Explicit Confidence 98% · Jack Rhysider EP 76 Details

“The hacker exploited a lot of these old WordPress blogs and he created tons of links to the casinos’ websites.”

Jack Rhysider · offsets 70314–70424

John Doe ASSOCIATED_WITH Gery Shalon

The unidentified hacker worked for or with Gery Shalon, who supplied infrastructure, accounts, instructions, and payment for hacking work.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“Gery tells the hacker the plan to steal customer data from the databases and gives the hacker servers around the world to use”

Jack Rhysider · offsets 62956–63081

Kelihos DEVELOPED_BY Peter Levashov

Peter Levashov was identified as the person who built the Kelihos botnet.

Explicit Confidence 99% · Jack Rhysider EP 76 Details

“Peter was from St. Petersburg and he’s the one who built the Kelihos botnet”

Jack Rhysider · offsets 77416–77491

Peter Levashov USES Kelihos

Peter Levashov operated the Kelihos botnet, which was used to send large volumes of spam email.

Explicit Confidence 97% · Jack Rhysider EP 76 Details

“He was accused of running the Kelihos botnet”

Jack Rhysider · offsets 77837–77881

EP 76 — Knaves Out

Official episode-page sources

Entities (48)

Claims (29)

Transcript references