A crude but effective online service that lets users deploy keystroke logging malware and then view the stolen data remotely was hacked recently. The information leaked from that service has revealed a network of several thousand Nigerian email scammers and offers a fascinating glimpse into an entire underground economy that is seldom explored.
The login page for the BestRecovery online keylog service.

The login page for the BestRecovery online keylog service.

At issue is a service named “BestRecovery” (recently renamed PrivateRecovery). Brain had a difficult time understanding why anyone would pay the $25 to $33 per month fee to use the service, which is visually quite amateurish.

But that was before he shared a link to the site with a grey hat hacker, who replied in short order with the entire username and password database of more than 3,000 paying customers.

Initially, Brian assumed his source had unearthed the data via an SQL injection attack or some other database weakness. As it happens, the entire list of users is recoverable from the site using little more than a Web browser.

The first thing he noticed upon viewing the user list was that a majority of this service’s customers had signed up with yahoo.com emails, and appeared to have African-sounding usernames or email addresses. Also, running a simple online search for some of the user emails (dittoswiss@yahoo.com, for example) turned up complaints related to a variety of lottery, dating, reshipping and confidence scams.

The site was so poorly locked down that it also exposed the keylog records that customers kept on the service. Logs were indexed and archived each month, and most customers used the service to keep tabs on multiple computers in several countries. A closer look at the logs revealed that a huge number of the users appear to be Nigerian 419 scammers using computers with Internet addresses in Nigeria.


check video here:
https://www.youtube.com/watch?v=fDRirwA9L3w&feature=player_embedded

More info: http://acestechsupport..com/2013/09/419-boys.html

Acknowledged to Brian