I was quite unsure if writing this article or not, but after all, this is a cybercrime archive and frauds based on the Internet are still cyber-crimes. Being Zone-H.org visited by a very large amount of daily visitors, including police forces and journalists I though that perhaps by posting my personal experience with the Lightinthebox Chinese dropshipper/wholesaler on this website might help others to avoid the same troubles I experienced.

Everything started December 2nd when, after looking in the local Chinatown shops I realized that the item I wanted to give as a Xmas gift to my son (and maybe to myself too) a cool cellphone watch, was already sold out. So I decided to buy it online from one of the many Chinese wholesalers, specifically from www.lightinthebox.com. I checked before on the Internet about comments or fraud reports regarding that company and, as I expected, I found out several comments stating mixed feelings as you can expect when we are talking about online commerce (negative comments might be also posted by your angry competitors)...

The phantomatic Higgs boson still has no face, as the Cern's LHC (Large Hadron Collider) didn't produce yet the planned protons collisions. Meanwhile Cern's website lost his own face, due to a Greek group of defacers called GST (Greek Security Team).

The defacers left a homepage message in Greek language. While when we learned about the CERN defacement everybody here was thinking about a politically, ethically or scientifically motivated attack, once translated, the message left by the defacers embraces the usual topics so much loved by true script kiddies: we are the best, you are the worst, we are leet, you are lame, we are 2600 (I wonder if these guys actually know what 2600 means in the hacker world...), irc wars.... blah blah blah.

... continue

If you still didn't have vacations, maybe it is worth to wait until the end of the October and visit the Hack In The Box conference in Malaysia. Let's take a look on some of the speakers and their topics.

Probably one of the most interesting topics will be introduced by Kris Kaspersky, he will talk about the Intel CPU bugs that lead to remote code execution regardless to the operating system used and show attacks based on JavaScript or just TCP/IP packets against Intel based machine.

The official Malaysian Kaspersky Antivirus's website has been hacked yesterday by a Turkish cracker going by the handle of "m0sted".

Along with it, the same cracker hacked also the official Kaspersky S.E.S. online shop and its several other subdomains. 

The attacker reported "patriotism" as the reason behind the attack and "SQL Injection" as the technical way the intrusion was performed.

Both websites  has been home page defaced as well as several other secondary pages.  The incident, though appearing a simple website defacement, might carry along big risks for end-users because from both the websites, evaluation copies of the Kaspersky Antivirus are distributed to the public. In theory, the attacker could have uploaded trojanized versions of the antivirus, infecting in this way the unaware users attempting a download from a trusted Kaspersky's file repository (remember the trojan in the Debian file repository?).