Feeds

Manila AT&T hackers linked to Mumbai terror attack - cops

Four alleged line-jackers cuffed with aid from FBI

Protecting against web application threats using SSL

Police in the Philippines have arrested a group of four suspected hackers accused of funnelling profits from attacking corporate telephone networks to an Islamic terrorist group blamed for the attacks on Mumbai three years ago.

The four suspects allegedly targeted PBX systems maintained by AT&T and gained access to corporate phone lines that they resold at a profit to call centres. The low-level scam resulted in estimated losses of $2m and ran between at least October 2005 and December 2008, and possibly earlier.

The operation was allegedly financed by Jemaah Islamiyah, a proscribed Pakistani terrorist organisation blamed for the terrorist attack in Mumbai, India, in November 2008.

"Revenues derived from the hacking activities of the Filipino-based hackers were diverted to the account of the terrorists, who paid the Filipino hackers on a commission basis via local banks," according to a statement on the arrests by the Philippine National Police's Criminal Investigation and Detection Group (CIDG), which added that the type of scam involved had been running since 1999.

Members of the CIDG’s Anti-Transnational and Cyber-Crime Division (ATCCD) and FBI agents raided the homes of the suspects, who all live in Greater Manila, seizing computer and telecoms equipment. The agents made four arrests on Wednesday, 23 November. The suspects were named as: Macnell Gracilla, 31, a resident of Quezon City; Francisco Manalac, 25, and his live-in partner Regina Balura, 21, of Calooocan City, and Paul Michael Kwan, 29, who also lives Caloocan City.

Kwan was previously arrested four years ago in 2007 on suspicion of helping to finance terrorist activities* but was apparently released only to - allegedly - resume his involvement in the long-running phone phreaking scam. He and his alleged cohorts continued to act as commission-only hacking contractors, albeit for a different boss.

Following the arrest of Pakistani Jemaah Islamiyah member Muhammad Zamir in Italy, also in 2007, an unnamed Saudi Jihadist took control of running the phone phreaking scam. Banking records linked the Philippines hackers to their alleged Saudi terrorist funding boss.

"FBI agents who have been investigating incessant hacking of telecommunication companies in the US since 1999 uncovered paper trail of various bank transactions linking the local hackers to the Saudi-based cell whose activities include financing terrorist activities," according to CIDG.

The FBI requested the assistance of Philippines authorities in March 2011 but arrests were only made last week, some eight months after the request for help.

The scam involved was almost certainly neither technically complicated nor lucrative. $2m-worth of calls, most probably fenced for much less, is a drop in the ocean compared to the hundreds of millions of dollars scareware vendors rake in every year. In addition there must be some doubt whether the alleged hackers knew they were working for a terrorist funding mastermind or were doing low paid work who whoever bankrolled them on a no-questions-asked basis. ®

Bootnote

Kwan's 2007 indictment here only talks about a phone phreaking plot run through Italian and Spanish call centres. It makes no mention of terrorist implications unless the source of some named payments, referred to only as J.I., is actually Jemaah Islamiyah.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.