Of the man who got access to Liquid customers’ accounts and stole their data, allegedly

I remember a time when people could use Econet data for free. I may or may not have partaked. Some claim they can still use NetOne data for free today. The hacks that allowed/(allow?) for that involve tricking Econet/NetOne systems into believing one has an active bundle.

So, when I heard that some guy had been charged with hacking Liquid Intelligent Technologies Zimbabwe, I thought he had done a similar thing. Turns out, his was a different hack.

First things first, here is what is being reported:

Nyadziso Chiyangwa, a 27-year-old man from Chitungwiza, has been charged with hacking Liquid Intelligent Technologies and fraudulently transferring 1070 gigabytes of data valued at US$2 942.

He is also accused of fraudulently opening Fibre on the Go accounts and illegally connecting 82 users to the internet without the consent of Liquid Intelligent Technologies. Chiyangwa allegedly received US$10 from each of his clients on a monthly basis.

Siphoning 1070GB

The first thing that caught my eye was that 1TB of data is valued at $2,942 by Liquid. That’s about $2.73 per GB, which is a lot for fixed internet. I hate to bring Starlink into this but $24 gets you an uncapped package there, just saying.

Anyway, Liquid allows customers on capped packages to transfer data to friends. Let’s say you have a 150GB bundle in your Fibroniks account, you can transfer 50GB of it to someone else who has a Fibroniks account.

You go to My Account > My Transfers > Select the type of data transfer you want to make, enter the amount of data you’d like to transfer and then select the service you’d like to transfer to.

When you click PROCEED, a One-time password (OTP) will be sent to your registered email and/or mobile phone via SMS. You will need to enter the OTP to confirm the transaction.

You can see how someone with access to your account could transfer data out to whoever they want to. Hence Liquid keeps reminding you not to give your your account details to anyone.

What about the one-time password sent to your phone or email? – you ask. That should stop someone from finding your computer while you’re logged into your Liquid Home account and gifting themselves data, right?

If someone gains access to your Liquid Home account, they can edit your profile and change your phone number. Liquid will then send the one-time password (OTP) to the new number, which the person can use to confirm the transfer of data to their own account. Liquid should change this and send the confirmation code to the old number or to your email address before making the change.

Nyadziso’s hack

From the above, you can see how Nyadziso was able to fraudulently transfer data. He got access to the accounts of 117 Liquid customers and transferred their data to other Liquid customers, for a fee of course.

What is not clear is how he got people’s login details to be able to do this. Did he hack Liquid’s databases and peep that information or did he use social engineering to get it? I think it’s the latter – he is charged with stealing customers’ data and not hacking Liquid according to the reports.

Fibre on the Go

Nyadziso had another zhet. He exploited another useful feature that Liquid has. Liquid allows its customers to use their data away from home with their On-The-Go service. FibroniX on the Go allows you to use your FibroniX bandwidth at any Liquid Home Wi-Fi zone.

To use your fixed internet away from home, simply add the devices you want to be able to use your data in WiFi zones. This way, you’ll be able to connect your devices to the internet through WiFi hotspots, just like you would at home.

Nyadziso would simply add devices to the Liquid Home On-The-Go service of unsuspecting Liquid customers without their knowledge. These devices would need to be used at Liquid Home Wi-Fi zones, but Nyadziso’s clients likely did not mind because they were only paying $10 per month to use other people’s data without limit.

Seeing as Nyadziso had connected 82 people in this way, he was making about $820 per month from this. If we add whatever he charged for the data transfers then he was easily making a grand a month.

Data Protection Act

Nyadziso is accused of contravening the Data Protection Act. He was remanded out of custody for which he paid bail of $400.

We talked about the Act a lot and you can go back and see what it has to say:

• Here’s your citizen’s guide to the Cyber Security & Data Protection Act
• POTRAZ invites your input on data protection regulations, you might want to participate

The reports say Nyadziso’s victims have not recovered their data. I am not even sure they know that they were victims. They could have been told via email and so if that’s you, let us know in the comments section.

I rushed to check my own Fibroniks On The Go devices and thought I was a victim for a second. I’d forgotten about an old device and so thought some MAC address I saw there was one of Nyadziso’s.

I don’t condone what Nyadziso allegedly did, some people out there thought Liquid was playing games as they watched their data deplete at rates that didn’t make sense. Nyadziso stole from his fellow Zimbos who are struggling out here. It’s easy to not think of this as theft but it is. If you were a victim you would easily understand how this is thievery.

However, I’m still fascinated by his entrepreneurial spirit. I wonder how he was caught in the end.

Also read:

Stop lying Zimbos, there’s no way half of you carefully read cookie policies as Potraz survey shows

POTRAZ has started monitoring your calls. Here’s what you need to know