6 ms·

I've learned to be skeptical when I see law enforcement praising the l337 skillz of their targets. > “This guy is in another league, he’s like Rafa Nadal

by neilk 8y ago

I've learned to be skeptical when I see law enforcement praising the l337 skillz of their targets. > “This guy is in another league, he’s like Rafa Nadal > playing tennis,” Yuste says. “There are few people in > the world capable of doing what he did.” It sounds really cool (and budget-justifying) to be chasing some mastermind, and a journalist is likely to pump up that aspect of the story too. Because they know we're reading it to be entertained, for there to be suspense, to enjoy the frisson of a "victimless" crime requiring ingenuity, like Ocean's 11. Then you find out later it's just a python script probing for default passwords, or someone who learned some of nmap's command-line switches.

jtms 8y ago
The fact they supposedly recovered 15k Bitcoins tells me he wasn't sophisticated enough to secure his private key sufficiently. If he had memorized a BIP39 mnemonic for his private key we wouldn't be reading about $162 million dollars worth getting seized. Brain wallets are pretty tough to crack.
- magnetic 8y ago
  A wrench is all you need apparently. https://xkcd.com/538/ https://xkcd.com/538/
_bxg1 8y ago
Yeah; I also have the general impression (admittedly without much data to support it) that IT security at banks and other gargantuan, long-lived institutions is pretty crappy? I would think it's easy to get in, and hard to not get caught. Anecdotally, I have a friend who briefly worked at a company which exclusively makes software for financial institutions. Their product was a web app that only worked in a version of Internet Explorer so old, it didn't support Ajax. Asynchronous requests were made by changing the src attribute of a 1px <iframe>. This was in 2015.
- dsfyu404ed 8y ago
  >I would think it's easy to get in, and hard to not get caught. Imagine you're an new employee at a big old company with a lot of legacy tech that's had mediocre maintenance and documentation over the years as is typical. You are going to leave footprints everywhere just learning to do your job. Imagine how many footprints you leave when you're an outsider who has to learn it all from scratch without documentation or assistance from other employees with historical knowledge. Now try getting anything done in that system without leaving tracks or triggering alerts when you hit some API that even the employees don't knows exists. The reason nobody ever gets caught is because insurance doesn't usually require a conviction before paying out and the effort required to determine who broke in is much higher than figuring out the exact sequence of events because you'd have to do the same investigation on every compromised system they used along the way.
  - kolpa 8y ago
    At some point, if the attacks got too frequent or severe, insurance rates would climb to the point where attacks would be better defended or retaliated against.
- chaostheory 8y ago
  The door code for one of the US's top banks' offices used to be 0000. I wonder if they finally changed it? EA QAs their games better than a lot of financial institutions as well
  - bpchaps 8y ago
    EA is largely hosted and managed by rackspace, who, for years, had default passwords on their iLOs - with public IPs. ;)
    - Scoundreller 8y ago
      FYI to those like me: > Integrated Lights-Out, or iLO, is a proprietary embedded server management technology by Hewlett-Packard which provides out-of-band management facilities. The physical connection is an Ethernet port that can be found on most Proliant servers and microservers[1] of the 300 and above series.
cgh 8y ago
That particular quote concerned Katana's ability to move money between banks, not his "hacking" prowess. In fact, the article even refers to their methods as "class spear-phishing", implying there wasn't anything special behind their methods.
pembrook 8y ago
This is a problem with pretty much all media stories. There's money to made making things seem dramatic and spectacular and out of the ordinary...when most things just aren't.
MR4D 8y ago
I wonder if anyone accused of these things has ever thought to bring in HN users as expert witnesses. I'm sure even a random sample would cause a huge reduction in these inflated "master hacker" claims. It seems that if you can have a few people rationally explain to a jury what the accused did, the crimes would seem much less diabolical.
- deleted 8y ago
  [deleted]
- kolpa 8y ago
  Generally, defendants don't need to defend against bombastic statements in the media. In fact, such statements can help the defendant, as they can prejudice and disqualify jurors, leading to mistrial.
  - MR4D 8y ago
    Sorry if I wasn't clear - my comment was directed at overly aggressive prosecutors.
_wmd 8y ago
It's valid concern, but I'm not so sure in this case. Spear phishing is a skilled art, and requires relatively significant knowledge of the target and their domain. Sure the rest is a essentially a stackoverflow post away, but it requires real determination to research this kind of attack and real skill to carry it out and see it through to millions in cash popping from ATMs in foreign countries. Just the people management alone is impressive And finally, I don't think stackoverflow cover ATM maintenance procedures yet. These guys weren't kiddies
- neilk 8y ago
  I'm not saying they are script kiddies. I make no claim about their skills. I have no idea what it takes to pull of a conspiracy like this. I'm just saying I don't believe sensationalizing journalists or law enforcement. Pretty much every time when I've known anything about the case, there have been wild exaggerations.
- greedo 8y ago
  People management is a challenge, but spear-fishing? It's one of the easiest methods of penetrating a company.

by neilk 8y ago

jtms 8y ago

The fact they supposedly recovered 15k Bitcoins tells me he wasn't sophisticated enough to secure his private key sufficiently. If he had memorized a BIP39 mnemonic for his private key we wouldn't be reading about $162 million dollars worth getting seized. Brain wallets are pretty tough to crack.

magnetic 8y ago
A wrench is all you need apparently. https://xkcd.com/538/ https://xkcd.com/538/

_bxg1 8y ago

Yeah; I also have the general impression (admittedly without much data to support it) that IT security at banks and other gargantuan, long-lived institutions is pretty crappy? I would think it's easy to get in, and hard to not get caught. Anecdotally, I have a friend who briefly worked at a company which exclusively makes software for financial institutions. Their product was a web app that only worked in a version of Internet Explorer so old, it didn't support Ajax. Asynchronous requests were made by changing the src attribute of a 1px <iframe>. This was in 2015.

dsfyu404ed 8y ago
>I would think it's easy to get in, and hard to not get caught. Imagine you're an new employee at a big old company with a lot of legacy tech that's had mediocre maintenance and documentation over the years as is typical. You are going to leave footprints everywhere just learning to do your job. Imagine how many footprints you leave when you're an outsider who has to learn it all from scratch without documentation or assistance from other employees with historical knowledge. Now try getting anything done in that system without leaving tracks or triggering alerts when you hit some API that even the employees don't knows exists. The reason nobody ever gets caught is because insurance doesn't usually require a conviction before paying out and the effort required to determine who broke in is much higher than figuring out the exact sequence of events because you'd have to do the same investigation on every compromised system they used along the way.
- kolpa 8y ago
  At some point, if the attacks got too frequent or severe, insurance rates would climb to the point where attacks would be better defended or retaliated against.
chaostheory 8y ago
The door code for one of the US's top banks' offices used to be 0000. I wonder if they finally changed it? EA QAs their games better than a lot of financial institutions as well
- bpchaps 8y ago
  EA is largely hosted and managed by rackspace, who, for years, had default passwords on their iLOs - with public IPs. ;)
  - Scoundreller 8y ago
    FYI to those like me: > Integrated Lights-Out, or iLO, is a proprietary embedded server management technology by Hewlett-Packard which provides out-of-band management facilities. The physical connection is an Ethernet port that can be found on most Proliant servers and microservers[1] of the 300 and above series.

cgh 8y ago

That particular quote concerned Katana's ability to move money between banks, not his "hacking" prowess. In fact, the article even refers to their methods as "class spear-phishing", implying there wasn't anything special behind their methods.

pembrook 8y ago

This is a problem with pretty much all media stories. There's money to made making things seem dramatic and spectacular and out of the ordinary...when most things just aren't.

MR4D 8y ago

I wonder if anyone accused of these things has ever thought to bring in HN users as expert witnesses. I'm sure even a random sample would cause a huge reduction in these inflated "master hacker" claims. It seems that if you can have a few people rationally explain to a jury what the accused did, the crimes would seem much less diabolical.

deleted 8y ago
[deleted]
kolpa 8y ago
Generally, defendants don't need to defend against bombastic statements in the media. In fact, such statements can help the defendant, as they can prejudice and disqualify jurors, leading to mistrial.
- MR4D 8y ago
  Sorry if I wasn't clear - my comment was directed at overly aggressive prosecutors.

_wmd 8y ago

It's valid concern, but I'm not so sure in this case. Spear phishing is a skilled art, and requires relatively significant knowledge of the target and their domain. Sure the rest is a essentially a stackoverflow post away, but it requires real determination to research this kind of attack and real skill to carry it out and see it through to millions in cash popping from ATMs in foreign countries. Just the people management alone is impressive And finally, I don't think stackoverflow cover ATM maintenance procedures yet. These guys weren't kiddies

neilk 8y ago
I'm not saying they are script kiddies. I make no claim about their skills. I have no idea what it takes to pull of a conspiracy like this. I'm just saying I don't believe sensationalizing journalists or law enforcement. Pretty much every time when I've known anything about the case, there have been wild exaggerations.
greedo 8y ago
People management is a challenge, but spear-fishing? It's one of the easiest methods of penetrating a company.