San Francisco Rail System Hacker Hacked Link

I know many people that are fascinated by the hack of San Francisco’s MUNI. I’m far more fascinated by the white-hat battles against the hacker, which may have resulted in breaching the miscreant’s email accounts. From Brian Krebs:

On Monday, KrebsOnSecurity was contacted by a security researcher who said he hacked this very same cryptom27@yandex.com inbox after reading a news article about the SFMTA incident. The researcher, who has asked to remain anonymous, said he compromised the extortionist’s inbox by guessing the answer to his secret question, which then allowed him to reset the attacker’s email password. A screen shot of the user profile page for cryptom27@yandex.com shows that it was tied to a backup email address, cryptom2016@yandex.com, which also was protected by the same secret question and answer.