Connect with us

Traffic & Transport

‘Keys to the kingdom’: hackers who gained access to heart of London transport network jailed | Cybercrime

Published

on


The data of millions of commuters was stolen, Londoners were left out of pocket and 27,000 Transport for London staff were forced to reset their passwords.

Over four days in 2024 a pair of teenage hackers had London’s transport network at their mercy. Thalha Jubair and Owen Flowers had burrowed into the heart of Transport for London’s IT systems and held the “keys to the kingdom”.

While the main tube and bus networks were not directly affected, the dial-a-ride service for disabled passengers was unable to process bookings for a period. The head of TfL, Andy Lord – a veteran of British Airways – said the attack was the worst incident he had faced in his career.

TfL said the attack, which occurred between 31 August and 3 September 2024, could have caused “catastrophic damage” to its technology systems and could have led to “significant and extended transport service degradation and disruption”.

In the end, the duo were only stopped when TfL in effect “pulled the plug” on its systems.

They pleaded guilty in June, and on Thursday Jubair was sentenced to five and a half years for the attack, and Flowers to five and a half years for the TfL crime as well as for hacking two US healthcare providers.

Thalha Jubair, left, and Owen Flowers had accrued millions of dollars in cryptocurrency through their hacking activities. Composite: PA/National Crime Agency

At one point, according to prosecutors in the case, Jubair and Flowers “could have shut out and shut down TfL completely” having hacked their way to the “highest privileged access” in the system and creating a “domain admin” account described in court as “the keys to the kingdom”. They even searched through TfL’s customer database for celebrities.

Owen Flowers and Thalha Jubair arrested for hacking into TfL systems in 2024 – video

The two hackers had led apparently closeted, online lives which nonetheless had a disproportionate impact on the outside world.

Jubair, 20, lived with his parents in a council flat in Bow, east London, and Flowers, 19, lived with his grandmother and uncle in a three-bedroom property in Walsall, in the West Midlands. They had communicated with each other throughout the hack using the Telegram messaging service, and Flowers recorded a livestream of the attack that Jubair broadcast while he carried out the multi-day crime.

Both were key figures within a loose collective of English-speaking hackers known as Scattered Spider, which is suspected of numerous hacks in recent years. The pair’s activities had made them wealthy, accruing millions of dollars in cryptocurrency.

The Scattered Spider name was conferred on these hackers by cybersecurity researchers who create monikers for the groups they monitor. Jubair and Flowers embraced it, exchanging messages citing Scattered Spider during the attack. Flowers warned his counterpart that his “scattered spider lvl 5 pass will be revoked” as he appeared to complain about Jubair’s slow progress. In a later group chat Jubair wrote: “SCATTERED SPIDER IS CREATING WEBS ON THE UNDERGRND.”

Flowers was known to have spent most of his time in his bedroom playing video games – a typical pathway for hackers – and using chat forums. Jubair also started out in the gaming world and would disrupt other players by stealing their usernames, before he moved into criminal activity.

Jubair, whose father is a care worker and whose mother had given up her job to act as a full-time carer for her son, was a hacker from a young age. He went to school locally, passed a number of GCSEs and had attempted to enrol at colleges. But he had always been interested in computing and gaming.

A two-day sentencing hearing at Woolwich crown court this week heard that Jubair was shown how to use a smartphone at the age of four, had a laptop and was gaming from the age of six or seven, was writing his own computer programs by the age of 10, and at 13 was introduced to hacking by older hackers.

Before the TfL conviction, Jubair had been convicted of 22 offences as a teenager, including 13 counts of fraud, two of unauthorised access to a computer, one of obtaining access to a computer, and one of blackmail. He had also been convicted in a youth court of stalking two young women and hacking into a City of London police server. Jubair was 18 when he carried out the TfL hack.

skip past newsletter promotion


Both defendants have been diagnosed with autism, and Jubair has depression and a severe mood disorder. Woolwich crown court heard that Jubair had tried to kill himself and that from a young age he was “isolated and bullied at school”. On behalf of Flowers, who was 17 when he carried out the hack, Adam Davis KC described his client as an “immature child trying to show off online”, who had been through an “unsettled childhood” that included contact with children’s services a year after he was born. Davis said Flowers had experienced “significant” isolation throughout his childhood and struggled with social relationships.

Flowers, too, had been active before the TfL cyber-attack. He was previously known to police and came into contact with them after turning 16. He had been subject to a cease-and-desist notice issued by West Midlands police in October 2023. Flowers was offered training to guide him away from cybercrime, which he turned down, and was given advice over computer misuse offences.

The TfL hack was not a “ransomware” attack, whereby IT systems are encrypted and data is stolen, allowing hackers to demand a ransom in cryptocurrency for decryption and return of the data.

Nonetheless, Jubair and Flowers have come into contact with vast sums of money. A previous hearing was told that $10m (£7.5m) was moved from Jubair’s crypto wallets after he was released from custody in March last year and $200m vworth of crypto had also moved through accounts belonging to him. An earlier hearing was also told that Flowers held $7.1m, including crypto, in accounts he controlled, despite having no source of income.

Neither appeared to have a lavish lifestyle. Flowers’s crypto account had been used to pay for food deliveries, while US authorities were able to trace Jubair because he paid for food deliveries using gift cards bought with crypto from an account that allegedly stored ransomware payments. Experts point to evidence that Scattered Spider attacks are often driven more by a desire for bragging rights and notoriety than financial gain.

The court heard that the TfL attack prevented live tube arrival information from appearing on the TfL Go app and the TfL website, while TfL was also unable to process any payments on the Oyster and contactless apps or to register Oyster cards to customer accounts. The attack cost TfL £39m, comprised of £29m in damage caused to IT systems and £10m in loss of income. The data of about 7 million people was also stolen.

The court heard that Jubair and Flowers got into TfL’s systems via an unnamed co-conspirator who called the TfL help desk and pretended to be an employee struggling to access the network remotely. A call handler was tricked into resetting the authentication process to a device in control of Jubair and Flowers, who then set about escalating their access.

Paul Foster, the head of the National Crime Agency’s national cyber crime unit, said the convictions had severely affected the Scattered Spider group. “Their activities and their impact have now been severely degraded as a result of this action.”

At one point during the attack, Flowers unwittingly foretold the consequences of their actions. Messaging Jubair, he said: “u won’t be laughing when ur sat in prison.”



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Traffic & Transport

Uber driver takes TfL to court over ‘pain‘ caused by licence renewal delay | TfL

Published

on


An Uber driver who got into thousands of pounds of debt and feared losing his home due to delays in Transport for London renewing his licence to pick up passengers is taking on the organisation in the high court in the first challenge of its kind.

Julius Mugabo, 55, has been an Uber driver licensed by TfL since 2016. Under the Private Hire Vehicles (London) Act 1998, all minicab drivers cannot work lawfully unless TfL has carried out checks on them and issued or renewed their licences. These licences must be renewed every three years.

There are approximately 100,000 private hire drivers in London working through apps such as Uber and Bolt. According to freedom of information data obtained by the Conservatives, almost 18,000 of them have received “goodwill” payments of between £300 and £500 due to delays in renewing their licences.

“Because of all the pain I have been through, I am bringing this legal challenge to help other drivers,” Mugabo told the Guardian.

Julius Mugabo, who has launched a landmark case against Transport for London. Photograph: Supplied

Mugabo had not experienced any problems until he made a routine renewal application at the end of last year. TfL repeatedly delayed processing his renewal application, asking him to provide supporting documentation he said he had already provided.

“Even if TfL delay renewing licences, drivers like me still have to eat and pay bills. My licence expired at the end of March 2026. I only received my renewed licence recently after I started the legal action against TfL,” he said.

“Because of their delays everything in my life was a mess. I owed HMRC £3,000 in tax but because I couldn’t pay my tax bill on time the bill has gone up to £20,000 because of the interest. We didn’t lose our home but I was under so much stress and pressure. The landlord threatened to evict us because I struggled to pay the rent.”

The high court action against TfL alleges that the transport authority breached its legal duties by failing to process private hire vehicle licence renewals on time.

In a ruling granting a full judicial review hearing, Mr Justice Sweeting said the delay “caused immediate and serious consequences for [Mugabo] and his family”.

He added: “TfL accepts that the processing of the claimant’s application did not meet its usual standards.”

The Independent Workers’ Union of Great Britain (IWGB), which represents private hire drivers on apps such as Uber and Bolt, said it had many members affected by the TfL licence processing delays, and that some of drivers had fallen into debt, had lost their cars and faced eviction. It is supporting the high court challenge.

Alex Marshall, the president of the IWGB, said: “As they celebrate this ruling bringing them closer to justice, the minicab drivers who keep London moving are sending TfL a clear message: they will not be taken for a ride.

“The suffering TfL inflicted on its predominantly migrant private hire driver workforce speaks volumes about who this public institution values, and who it takes for granted. TfL could easily have acted at the earliest sign of crisis, as the first drivers lost their incomes through no fault of their own. Instead, it watched at least 17,000 others suffer the same fate.

“By the time TfL finally acted, drivers had burned through their savings, lost their houses and fallen into debts they are still working longer hours to repay. Now, thanks to drivers’ tireless fighting and campaigning, TfL will have to answer for its failures in court. We will not stop until TfL has been forced to fix this broken system for good.”

Ahmed Aydeed, of Deighton Pierce Glynn solicitors, who is representing Mugabo, said: “TfL regularly strips drivers of their livelihoods, by failing to provide renewal licences before the expiry of the previous licence. Any driver who continues to work while waiting for their renewal licence is liable for criminal prosecution.

“No one should be stripped of their ability to feed their families and pay their bills, especially during this cost of living crisis. Any public authority that does this to working-class people is not fit for purpose,” he said.

A TfL spokesperson said: “We are aware of the judicial review claim, which has been brought by one driver regarding the processing of his licence. We are awaiting the date of the hearing.”



Source link

Continue Reading

Traffic & Transport

Making the British countryside more accessible and inviting to all | Walking

Published

on


What a joy to read John Harris’s piece on the cultural changes taking place in rural areas (Walking the Peak District, I discovered a wonderful rejection of the right’s monotone vision of England, 23 August. My husband and I have walked many miles in the Peak District and we would comment on the monocultural nature of other walkers. As a headteacher, I also took groups of children to stay in Hartington Hall, where Harris stayed with his own children, and other school groups also appeared to be monocultural. We knew nothing about Black Girls Hike or Steppers UK that Harris mentions, but hope that these movements will support positive change.
Nina Young
Collingham, Nottinghamshire

John Harris rightly highlights the cost of gastropubs and boutique Airbnbs replacing budget alternatives as an issue, but overlooked another. The replacement of basic (cheap) campsites with (expensive) glamping yurts and fully serviced campervan pitches is threatening dirt-cheap summer holidays spent backpacking around the country and learning to appreciate new landscapes and peoples, from which many of us oldies benefited greatly.
Mike Coogan
Abbeystead, Lancashire

John Harris omits one critical issue that impacts participation. Public transport outside cities and towns is often poor. To places like Bellever on Dartmoor, the location of one of his favourite hostels, buses are very limited indeed.
Les Bright
Exeter

Have an opinion on anything you’ve read in the Guardian today? Please email us your letter and it will be considered for publication in our letters section.



Source link

Continue Reading

Traffic & Transport

‘Without us, no wheel would turn’: the unsung heroes keeping England’s transport moving | Business

Published

on


Not many people get to park their car here – bang in the middle of Heathrow airport, on the taxiway just a stretch of grass away from where a line of passenger planes is coming in to land.

It’s close enough to see the shimmering air and smoke as nose tyres hit the tarmac. “An A380 will put down as much rubber as a car’s entire tyre,” Jack Quantick-Thorne says. He knows – part of his job is to ensure the runway team scrapes it off and patches things up overnight. And it is all recycled, he adds.

The airfield operations officer is not in the limelight much, but is one of a host of unsung workers keeping transport moving. And some jobs far from the public eye turn out to be not only essential, but surprisingly challenging.

Jack Quantick-Thorne, airfield operations officer, Heathrow

Passengers might only catch a glimpse of Quantick-Thorne from a window seat on landing, if he grabs the paddles to marshal a plane into the exact designated spot at the stand. “People just think you’re that person with the table tennis bats,” he grimaces slightly, as the Guardian requests a demonstration. “That’s like 5% of my job.”

In fact, most planes are now brought to the stand via laser-guided electronic displays. But human marshalling remains a crucial backup. Brandishing the paddles, Quantick-Thorne beckons in a taxiing British Airways arrival, the pilot peering down from the cockpit and steering 50 tonnes of plane straight towards him. The nosewheel travels bang on the guideline, stopping exactly in position for the airbridge to swing in and allow passengers to disembark.

Nerve-racking? “No. When you’ve got a really big plane, an A380, you need a second marshal right by the wheel to check it’s stopped in the right place,” he says.

Back in the car, the job continues: “I’m patrolling, I’m looking around, scanning everything – is the refueller doing his job properly, has the aircraft got chocks under its wheels?”

That includes monitoring the road system under Heathrow’s airfields, recognising every vehicle and checking any infringement: drivers here can also clock up points on their licence, if he spots them.

Officers also need to look out for wildlife – particularly birds, a serious danger for jet planes (and vice versa). How does he deal with them? We’ve got methods of dispersal,” says the airfield operations officer.

These, marvellously, turn out to be speakers on the roof of the van, which play a range of bird sounds: “If I saw a flock of starlings, if I played a starling noise, the starling would think, ‘Oh, maybe there’s a predator nearby,’ and they fly off.”

And, he demonstrates, “I’ve got common gull. Black-headed gull. I’ve got a falcon”.

Are there falcons? “No,” he explains patiently. “So you think about it from a bird’s point of view. If there’s a pigeon over there, best play a falcon so it will fly off.”

Jack Quantick-Thorne at work. Last year he had to tow the Concorde that still stands at the edge of the airfield across for an exhibition. Photograph: Graeme Robertson/The Guardian

If he now knows birds, it’s the planes that drew him here. He was previously at Nats, the air traffic control centre in Swanwick, managing the planes, but never up close. There is more to it than the paddles – but, he confesses, he takes every opportunity to use them, and records each plane that he has marshalled, including every aircraft in BA’s short-haul fleet.

Being a pilot is the dream, he admits, but the prohibitive training costs – £100,000 or more – put it out of reach. For an enthusiast, he reckons the job is the next best thing. Last year he had to tow the Concorde that still stands at the edge of the airfield across for an exhibition: “It was the first time one had moved in years – incredible to see in the rear-view mirror.”

Chris Thackaberry, network traffic controller, Transport for London

The day starts in Victoria Station House overlooking the bus terminus, a grand old building that looks considerably less so inside, where Chris’s desk is surrounded by hundreds of cardboard diversion signs.

About 500 of the capital’s 19,000 bus stops are on his patch in Westminster – home to some of Britain’s most congested streets, where dozens of bus routes cross. Roadworks are the bane of the bus and Thackaberry’s job is to keep them moving – armed with a van, pliers and zip ties.

Sometimes he can plan for roadworks months ahead. But other days are less predictable, when life suddenly blocks a route: “It could be a broken-down vehicle or a burst water main, but I’ve had windows falling out of buildings, I’ve had a collapsed horse on a bridge. I had an upside down Lamborghini in Piccadilly … I don’t know if it was sticking to the 20mph limit.”

Christopher Thackaberry, a network traffic controller with TfL, in his van. Photograph: Linda Nylind/The Guardian

His incident response van contains an orderly standing desk area and even a printer to rustle up more signs if needed, as well as spill dry sacks, ready to suck up any diesel or oil leaked over the road.

It also has two cylinders affixed to the wall containing “spit kits” – swabs to pick up any saliva aimed at staff, with clear bags to seal, ready to take the evidence to the police. “It’s just part and parcel of when you’re working in London, for anyone in uniform.”

In a sweltering Trafalgar Square, as he hunts in the midst of four lanes of traffic to hitch his cardboard signs to any available piece of spare street furniture, the complexity of the puzzle becomes clearer.

“There’s so many routes go through here, we’re fighting with ourselves for space.”

skip past newsletter promotion


Sarah, railway signaller, York

Gone are most of the signal boxes of old: these days, Britain’s railway is mostly controlled from one of 12 remote centres. From a windowless room in York, trains right down the East Coast mainline are guided on their way.

“In the old days, it was lever pulling,” says Sarah. “Now it’s a click of the mouse instead. Like a computer game scenario, but it’s real track, real trains, real people. We have to manually click, signal to signal, for every train that comes through our patch.”

Signallers have five screens at eye level showing the railway, and five above with timetables and traffic management information.

“When you first start the job, it feels so far removed. There’s no windows, it’s like a black hole in the middle of the building, but you are signalling trains from York all the way into King’s Cross. I remember thinking: ‘How many hundreds of people are on that train we’re signalling?’”

Anything from a circuit failure to a trespasser to a sick passenger on a train can hold up the lines. “Our job initially in any incident is to make the area safe – that’s first and foremost. And then we look for a workaround, to keep trains moving. The days when there are serious incidents are few and far between. But every day there’s something.”

Jamie *, public service vehicle engineer, Manchester

At Jamie’s bus depot, servicing the Bee Network, the first shift starts at 5am and the last ends at 1am, but engineers might stay through the night with a breakdown.

“In the daytime it’s routine: vehicles are inspected by law on a monthly basis,” he says. “But engineers have bus driving licences too, if a bus was to break down, often we’d take another one out to the driver to keep the service running.”

With city buses that stop and start frequently, there is typically more treatment and maintenance. And newer vehicles don’t necessarily mean less work, he says: “They bring a lot of new issues and we’re constantly learning, going back to college on courses to learn the tech.

“Electric buses haven’t made the job easier – but they and the new diesel engines are clean. Working back in the day, it was a hell of a lot dirtier, especially in depots indoors or undercover,” says the vehicle engineer.

He will check each bus’s brakes, emissions tests and inspect the nuts and bolts everywhere from the underside to the driver’s cab. “We see a lot in the press about the conditions in the cab, but we’re cleaning those buses: it’s like a greenhouse, and the heat from the engines also comes into our workshop.

“Even the drivers don’t understand what engineers do – I always say we are the forgotten people. But without us, no wheel would turn.”

Frankie *, baggage handler, Gatwick

The thing people don’t understand, explains Frankie, is that the placement of bags in the hold is not random. “It’s all done on weight distribution. You have to put baggage where you’re told – it is a very specific job, you do not deviate.”

At many airports, larger aircraft such as long-haul planes are loaded with bags already in large crates, lifted into position by machine. But short-haul flights at Gatwick are loaded manually. “An average bag is about 20kg and the average load is 90 bags off, 90 on, for three or four people. If you do eight turns a day, that’s nearly 30 tonnes your team is lifting. You get fitter – it’s like going to the gym, you end up lifting heavier and heavier bags.”

Passengers who fear for their luggage often make the job harder: “The worst thing is shrink-wrapped bags. It’s slippery, harder to hold on to, and less grip for the belt to pull up. And those straps around bags, they can get jammed in the belts and break them.

“People don’t realise how damaging it can be – and pointless. If you’re on a flight where customs do spot checks, they go for the bags that are wrapped. And there is so much CCTV and security. If I get caught opening a bag, I’d lose my job – why would I risk that?”

There are, says Frankie, more women doing the job now: “It’s getting more female-friendly. A lot of people choose this type of job to get into aviation: they want to be pilots or crew eventually, and just want to be around planes any way they can.”

* Names have been changed



Source link

Continue Reading

Trending