14 ms·
A Ukrainian Hacker Who Became the FBI’s Best Weapon and Worst Nightmare
- hauget 10y agoGreat story... but the amount of resources that webpage consumes is f-ing RIDICULOUS.
- digi_owl 10y agoThats what we get when we apply the app mentality to the web...
- wrong_variable 10y agoVery Well Written, How hard is it to program these types of systems ? Its sounds quite technically challenging to build an automated system that can easily steal information from Target etc.
- deleted 10y ago[deleted]
- unexistance 10y agotechnically, once you know the exact command / syntax, just code, compile & wrap nicely for easy usage... Just a typical programming / scripting routine
- altonzheng 10y agoI thought I was on a mobile page because of the lack of side bars and other distractions. Nice job wired!
- PeCaN 10y agoIt even works with JavaScript disabled... what is this sorcery?
- Avernar 10y agoIronic it works nice on desktop because it's glitchy on mobile. Had to reload several times before the wired banner would dock at the top of the screen. It would just float dead center of the screen the first few times.
- NicoJuicy 10y agoYeah indeed, very clean to read and no annoying popups... This is just a good story.. If i see more of this, this could become my first subscription ever online :p ( seriously)
- iamandoni 10y agoIf you liked that, you should also read Kevin Poulsen's Kingpin. Absolutely enticing story.
- mercer 10y agoCould you tell me more about it? It's a book, right? I rather liked his writing for Wired, but I've got a book list longer than my life to get through...
- kaosjester 10y agoGood thing this article names a bunch of people who wanted all of this history about them anonymous.
- miles 10y agoDon't miss Hilbert's response to the Wired article: Rogue FBI Agent Vindicated? https://www.linkedin.com/pulse/rogue-fbi-agent-vindicated-ernest-e-j-hilbert https://www.linkedin.com/pulse/rogue-fbi-agent-vindicated-er...
- hkmurakami 10y ago>The FBI did not screw me. The DOJ/OIG and the Boston based AUSA did. This being Steve Heyman? Edit: AUSA must mean "Assistant US Attorney"
- kragen 10y agoHeymann was the one that bullied AaronSw to death, right?
- hkmurakami 10y agocorrect (mentioned in the wired article as well)
- tehwebguy 10y agoYes, along with his boss Carmen Ortiz.
- rudolf0 10y agoInteresting. Sounds like Poulsen's account lines up pretty closely; it's just missing information. The big piece Poulsen apparently got wrong was that Hilbert was always aware Popov was involved in the original FBI and EMC hacks. Sounds like Hilbert was trying to juggle a lot of things at once. Protection of the FBI and their sources; justice for the companies being extorted; information on the people Popov was (half-)tricking; appropriate action against Popov for his ongoing crimes. All balanced against his personal relationship with Popov and gratitude for his help. He was always trying to do the right thing, but the only way to do the right thing for a particular point in time meant delaying justice for other issues. The article does, unfortunately, show that you can never fully trust people who have made a living off of theft, fraud, or other forms of deceit. Even if they promise to help you, even if they promise to change, even if they genuinely befriend you. When you're born into that lifestyle and spend your early years in it, it's really hard to get out.
- skilled 10y agoGood read. Gives perspective of how the security scene has shifted from public hacking, to the private sector. So much is going on behind the scenes, little scoops like this are nice reminders.
- trhway 10y ago>One thing Popov had always known about Eastern European hackers: All they really wanted was a job. how true. Making money/living using your [technical] brain. There were only limited possibility for it in Russia until mid-199x, and it only gradually became reality to the end of that decade. As far as i understand, Ukraine it took at least 10 years more.
- qaq 10y agoNah more like 5-6. Now adjusted for cost of living it's basically on par with US.
- nobodyshere 10y agoOften better. You can rent a flat for about $300 in most of Eastern Europe now. Internet is crazy fast for its price, taxes are probably smaller than in the US.
- qaq 10y agoIn Ukraine they use Private Entrepreneur structure which basically means you pay like 5%. So say for decent senior Java Dev you can get 60K/year after taxes.
- ryanlol 10y agoIt is worth noting that this is mostly no longer true, as the size of the "underground economy" (lol) has skyrocketed and the sums of money being discussed are far bigger. And contrary to what some may think, the risk reward ratio has certainly gone in the hackers favor. The article mentions some hacker selling 8 million credit cards for $200000, nowadays it'd be at least 10 times that. There simply does not exist many comparable "jobs" for those capable of pulling this off, where can you maintain such an income working couple of hours a day from a FS hotel in the Maldives?
- ChemicalWarfare 10y agoI worked for a couple of companies who outsourced some heavy lifting low-level dev tasks to Ukrainian-based teams. Hands down the best experience dealing with outsourced devs ever. Very strong technically, delivering on time with the highest quality I've ever seen from outsourced teams. Communication-wise always eager to jump on a Skype or Google Hangout call to talk sh*t over instead of emailing into the void and waiting for answers for days.
- reality_hacker 10y ago"Maksym Igor Popov" name sounds so fake.
- paganel 10y agoIt comes from a 7th century Christian Orthodox monk and theologian called Maximus the Confessor who has a good reputation among Christian Orthodox faithful. https://en.wikipedia.org/wiki/Maximus_the_Confessor https://en.wikipedia.org/wiki/Maximus_the_Confessor
- vsss 10y agoWhat a bs. Russians/Ukrainians do not have second names.
- venomsnake 10y agoVladimir Vladimirovich Putin will like to have a word with you. There are both surnames and hyphenated second names.
- reality_hacker 10y agoName from the article would sound like Maxim Igorovich Popov.
- vsss 10y agoVladimirovich is not a second name, it's patronymic (name of his father)
- ausvisaissues 10y agoUsually when Russians write their name, they write: Given Name + Patronymic Name + Surname Given name: Vladimir Patronymic name: Alexandrovich (son of Alexandr) Surname: Putin The patronymic name and surname changes between male and female. What is not clear is why Igor is not written as Igorevich. Perhaps a Russian/Ukrainian user can weight in?
- GigabyteCoin 10y agoGreat story. It's not often I find myself reading through to the end. >Hilbert arranged for the FBI to rent Popov an apartment near the beach and pay him a $1,000-a-month stipend to continue working on Ant City. Talk about cheap! They offered him ~$3,000/mo compensation for work that was saving the US potentially hundreds of millions of dollars per year in fraudulent credit card charges? >One victim was the Boston-based multinational EMC, where intruders had stolen the source code for the company’s ubiquitous virtualization software, VMware. If the code got out, hackers everywhere could plumb it for security holes. VMware’s purpose is to allow a single server to house multiple virtual computers, each walled off from the others. So in the worst-case scenario, a hacker might find a way to “escape” from a virtual machine and seize control of the underlying system. And this just screams of the need for more open source projects.
- cm3 10y agoIf VMware's security relies on it being closed source, then all bets are off. This is bad journalism.
- qb45 10y agoI think that doing security audits only when your source code leaks (not even when somebody threatens to leak it) is bad software development, not bad journalism.
- cm3 10y agoIt's bad development style, but it's also bad journalism to say the blueprints are out, now VMware is at risk. VMware is so widely used in critical situations that it's more than likely that many skilled infosec devs have tried their teeth at finding attack vectors. Sure, they may have an easier way to find some faults now, but like Windows, it's a piece of software that's in constant exploit hunt mode.
- qb45 10y agoWell, they pretty much described what actually happened, which is that VMware wasn't all that confident about their security and panicked when the source appeared. While I too would like the article to poke some fun at VMware's attitude ;) I have to say I really didn't find it particularly offensive as it stands. I understand the dislike for presenting closed source as "security", but in this case it seems to have been uninformed copy-paste from VMware's statements, not the author's agenda. I guess we can only expect so much from journalists who don't hang out at HN. Hopefully this whole myth will die natural death as open source OSs are becoming mainstream, especially on servers where security counts.
- maibaum 10y agoThis is the most painful longform reading experience I've ever had on a computer. I am 'reading' this from a 15" MBPR at 1440x900 - default resolution. First page load (default zoom), a single paragraph takes up the entire window. http://i.imgur.com/7gElCv9.png http://i.imgur.com/7gElCv9.png Next, I try 'zooming out' twice, aka cmd-. Turns out the text doesnt reflow to fit the window, it just shrinks. This is what it looks like. http://i.imgur.com/hr98Ryi.png http://i.imgur.com/hr98Ryi.png As a last effort, I switched on Reader View in Safari and it only displayed the first three paragraphs of the article. Sigh. I like Wired, and mobile is important - but not this important.
- rconti 10y ago1440x900, ouch. I'm using the exact same machine and it was great at my normal 1920x1200. You're right though, I tried the zoom-out you did, and had the same results.
- deleted 10y ago[deleted]
- mercer 10y agoWithout any particular opinion on the reading experience, I've been wondering about something. Why is it that quite a few pages that I use Safari's (otherwise excellent) Reader View on don't display the full article? Is it intentional? Some flawed parsing on Safari's part? In most cases adding the article to my instapaper list solves the issue, but even there I occasionally find missing content, in particular on wikipedia pages. Which is odd, because I'd expect Instapaper to find some way to handle those well.
- drops 10y agoI looked up the hacker's full name in russian - Maxim Igorevich Popov - and found a ukrainian news article dated as back as 2001, the year when this all started. So technically the Wired's article wasn't the first public mention of the incident, but the first big and full story. Here's the old article itself: http://fakty.ua/96374-grazhdaninu-ukrainy-kotorogo-fbr-obvinyaet-vo-vzlome-kompyuternoj-sistemy-banka-quot-vestern-yunion-quot-grozyat-20-let-tyurmy-i-polmilliona-dollarov-shtrafa http://fakty.ua/96374-grazhdaninu-ukrainy-kotorogo-fbr-obvin... It's in Russian and has some interesting stuff, like details from Popov's mom and dad (!), and it mostly covers the events that led to Popov's imprisonment. The article is quite long, but some stuff like Popov's background and stuff that's missing from Wired's article >Popov studied English and German languages in Kyiv National Linguistic University >He was already married by the time the shit went down >His parents didn't know he was a proficient hacker, they thought he was just a regular user
- alexroan 10y agoOne of the most interesting reads I've found on HN in the last few days. Felt like reading a crime thriller novel.
- TY 10y agoAnother fantastic piece from Kevin Poulsen. I really enjoyed his book "Kingpin" and this article continues the tradition. If anyone wonders, how an editor at Wired manages to get all the technical details right, this Wikipedia article will help [1]. TLDR: Kevin is a former black hat hacker - caught, sentenced, served time who has since become a great journalist and author. [1] https://en.wikipedia.org/wiki/Kevin_Poulsen https://en.wikipedia.org/wiki/Kevin_Poulsen
- mercer 10y agoPoulsen is one of the few journalist's names I recognize, and while I'm not entirely positive about Wired, I've liked what he's written for them.
- Tycho 10y agoWhere can I read more about this Eastern European hacking scene? A few months ago I listened to a talk by the CEO of Palantir who mentioned that in the Paypal days they unsuccessfully hired PhDs in a battle against the scammers, saying "it turns out you can't outsmart the Russan mob, they're very technical." (the solution was to hire lots of lower skill people and give them some tools to fight the battle)