How Hacker PomPomPurin Got Caught (Bad OPSEC)

How the Hacker Known as Pom Pom Purin Got Caught

This transcript discusses how the hacker known as Pom Pom Purin was caught by the FBI. It provides insights into his mistakes and what he could have done better to avoid getting arrested.

Background on Breach Forums

• Pom created Breach Forums after Raid Forums, another place where hackers could sell their databases, was seized by the FBI.

• The feds managed to get full access to the database of this forum after they compromised it.

• They were able to see all of the information that members used when they signed up, including their names, email addresses, every post that they made on the Forum, as well as all of their DMS on the Forum.

Opsec Mistakes Made by Pom

Direct Conversations with Omnipotent

• Palm had direct conversations with omnipotent, founder and owner of Raid Forums.

• In a conversation about a recent data breach of AI DOT type app's 31 million users' data being leaked to public due to developer mistake, Palm revealed his real email address (Connor Fitzpatrick O2 gmail.com).

• He also showed how he searched for data breaches using grep command on his local computer.

Personal Google Pay Account Linked to Real Email Address

• Connor Fitzpatrick O2 gmail.com is pom pom's real email address.

• This email address was connected to his personal Google pay account which also had his personal Visa card listed on there.

Using Breach Forums for Transactions

• Palm acted as a middleman for transactions involving hacked databases sold through Breach Forums.

• He used credits in order to purchase these data breaches.

Conclusion

Pom made several opsec mistakes that led to him being caught by the FBI. These included revealing his real email address, linking his personal Google pay account to it, and using Breach Forums for transactions involving hacked databases. By avoiding these mistakes, he could have avoided getting arrested.

Connor Fitzpatrick's Unbreakable Chain

This section discusses how the FBI was able to link Connor Fitzpatrick's personal life to his hacker persona through various pieces of evidence.

Evidence linking Connor Fitzpatrick to his hacker persona

• Connor created a new email address, which he linked to his Google Pay account that had his full name and home address. He also tied this account to two of his personal cell phones.

• IP records show that Connor used these phones at least nine times to access his pom pom purrin account on raid forums in 2021.

• The recovery email for Connor's new email address was used to register another account on raid forums with the name "a a."

• When the feds traced the registration of this "a a" account back to the IP address, they found that it was registered to a customer with the last name Fitzpatrick at the union premises with a telephone number ending in 2956. However, this wasn't actually Connor Fitzpatrick but rather his father.

• Records received from Google concerning Connor's Gmail account showed logins from numerous virtual private network provider companies from at least September 20th, 2021 through May 12th, 2022.

How VPN usage led to discovery

• It appears that towards the end of 2021, Connor finally figured out what a VPN was and started using them. However, when he used the same IP address for both his personal Gmail and hackerman accounts, it made it easy for authorities to trace him.

• On or about March 7th, 2022 records received from Google show that Connor's Gmail account was accessed from IP address 89.187.181.117, which was owned by datacamp limited. However, a query of this IP address on spur.us revealed that it was actually used by the VPN provider ivpn at the time.

• According to records from Zoom, that same IP address was used the following day on or about March 8th, 2022 to log into a zoom account under the name of pom pom purrin.

Conclusion

• The evidence presented in this section shows how Connor Fitzpatrick's personal life and hacker persona were linked through various pieces of evidence such as his email addresses, cell phones, and VPN usage.

Hackers' Opsec Mistakes

The speaker discusses how hackers make the same opsec mistakes as street criminals, citing examples of gangsters in the Bronx who were caught on camera and bragged about their crimes on social media.

Opsec Mistakes of Street Criminals

• Hackers make similar opsec mistakes as street criminals.

• Gangsters in the Bronx were caught on camera and bragged about their crimes on social media.

• They were seen wearing unreleased Jordans that they had stolen.

• There are more cameras in New York than there are street lights.

Opsec Mistakes of Hackers

• Palm's personal opsec was garbage, which led to his arrest by the feds.

• He failed to keep his real life and business completely separated, using the same phone for all his activities.

• The FBI had access to Breach Forums SQL database, which confirmed a link between Connor's real identity and his hacker persona.

• Other hackers with similarly bad opsec may also be arrested in the coming months and years.

Baphomet Takes Over Breach Forums

The speaker discusses how Baphomet took over Breach Forums after Palm's arrest and how this could lead to other hackers being arrested due to poor opsec.

Baphomet Takes Over Breach Forums

• Baphomet took over Breach Forums after Palm's arrest.

• He is taking his time with redeploying the community or something similar.

Poor Opsec Could Lead to More Arrests

• Breach Forums was a clone of Raid Forums in terms of its look and feel.

• Databases containing DMS and other information could lead the feds to hackers' apartments.

• Baphomet may be worried about his own opsec being compromised.