5 ms·

Just to clarify - why the hell didn't the FBI task someone to do what Brian was doing? > So, each day for several years my morning routine went as follows: Mak

by munk-a 7y ago

Just to clarify - why the hell didn't the FBI task someone to do what Brian was doing? > So, each day for several years my morning routine went as follows: Make a pot of coffee; shuffle over to the computer and view the messages Aqua and his co-conspirators had sent to their money mules over the previous 12-24 hours; look up the victim company names in Google; pick up the phone to warn each that they were in the process of being robbed by the Russian Cyber Mob. Just assigning an agent to that seems like a dead simple way to really quickly curtail that operation.

dopamean 7y ago
Law enforcement does not seem interested in looking for victims, even if it's easy. It seems that they are optimized for responding to complaints. Anything more proactive gets reserved for perpetrators.
- loa_in_ 7y ago
  That's because every time the police force would call a potential victim to warn them, and it would turn out to be a false positive eventually some business owner would think: "we lost some money today, must have been because of that false warning, police is do incompetent". And then proceed to take the force to the court for "damages".
  - nradov 7y ago
    It would be impossible to establish damages for that in civil court.
  - dopamean 7y ago
    I don't believe for a second that the primary reason police departments don't look for potential victims is because they're worried about getting sued. The way they handle police brutality cases is enough proof that that's not true.
- gav 7y ago
  They don't really seem to care much for complaints a lot of the time either. Somebody attempted to cash some fraudulent checks for a company I worked for, luckily this was caught by our bank before we lost any money. The NYPD had no interest in doing any more than taking a report and were extremely happy when the perpetrator attempted to cash a third check, taking the total above $100k and into FBI justification. The FBI took the report and nothing happened even though our bank was able to provide details which should have led to an arrest.
  - toomanybeersies 7y ago
    I'm not overly familiar with American police, but at least in Australia and New Zealand, the police are poorly equipped and resourced for dealing with financial crimes and other "information" crimes, they're heavily biased towards solving violent and property crimes. They deal primarily with physical evidence.
    - P_I_Staker 7y ago
      This is certainly an issue in the USA, I can't speak to how it compares. Someone I knew was trying to raise an issue about a caretaker skimming money. She was taking out the maximum amount of money every day and spending excessively on a credit card. They basically told him to get lost, and it was a civil matter It's also the case with more serious financial crimes, eg. Ponzi Schemes. The crazy thing is some of these things are completely illegal operations, yet publicized, with brick and mortar locations. This can go on for years. Sometimes there are complaints. Sometimes it's one determined victim or would-be victim that blows the lid on the whole thing. Even then it can take time; months to years. It's an area where people have been able to get away with it, often for a good chunk of their adult lives.
netcan 7y ago
Organisations (and individual people) are semi-constitutionally capable and incapable of different things. A lot of time, complete outsiders find very high "value" tasks that they can do, seem trivial, but the organisation seems unable to "task" to someone. A classic example is "watchdog" regulators that are supposed to police an industry. Regardless of mandate, they nearly always operate entirely via well organized, documented complaints. They don't do "outbound" policing, even if it's deeming easy & productive. The @patio11 recently did a great post on his dealings with CROs, and such regulators make an apoearance.
- ljm 7y ago
  My personal belief is that you can put all of this down to bike-shedding, or more formally Parkinson's Law of Triviality. Add a little risk/reward to the mix and an overarching system that impractically punishes failure to convict or prosecute, leading to risk-averse approaches, and you get a nice system that is happy to prosecute the low-level weed peddlers instead of the real players. Those people land on your desk or you get them from a traffic stop. Try to go further and you might lose your job or your pension. And, of course as a prosecutor or AG, make sure you plea-bargain everyone to boost your incarceration stats. Lots of easy wins to cook the books without really touching on the real problem. So you've got Too Big To Fail in the black markets and the criminal world too. (I hasten to avoid saying 'criminal-underworld' because our righteous overworld tends to be just as bad, if not worse in some cases.)
mzs 7y ago
two paragraphs down: >In many instances, my call would come in just minutes or hours before an unauthorized payroll batch was processed by the victim company’s bank, and some of those notifications prevented what otherwise would have been enormous losses — often several times the amount of the organization’s normal weekly payroll. At some point I stopped counting how many tens of thousands of dollars those calls saved victims, but over several years it was probably in the millions. Because Mr. Krebs was doing so with good effect and as a private individual he did not face the legal firewalls in place to prevent LEOs taking such actions for corrupt or ill intent or blow investigations.
- panarky 7y ago
  > Each of these mule recruitment sites had the same security weakness: Anyone could register, and after logging in any user could view messages sent to and from all other users simply by changing a number in the browser’s address bar. As a result, it was trivial to automate the retrieval of messages sent to every money mule registered across dozens of these fake company sites. Law enforcement already masquerades online as underage girls and boys, potential terrorists searching for bomb-making materials, etc. What "legal firewalls" would prevent them from walking a URL to see what companies are about to get robbed? And forget about law enforcement, why wouldn't banks and payroll services do the same thing to protect their customers? It's beyond ridiculous that our only line of defense is Brian Krebs.
  - mzs 7y ago
    > What "legal firewalls" would prevent them from walking a URL to see what companies are about to get robbed? None there, but the moment they have a bank freeze a company's account…
    - joe_the_user 7y ago
      Krebs didn't freeze any business' account and any FBI agent doing similar work to Krebs would not have had to either. Apparently, the companies themselves called their banks to prevent the transactions. Banks do engage in effort to protect their customers and already flag questionable actions.
nitwit005 7y ago
The FBI has struggled to get a workable computer systems for their own internal use. Presumably, even some fairly modest technical problems may be beyond their capabilities. They also have a heavy focus on counterterrorism these days, which likely makes everything else lower priority by default.
commandlinefan 7y ago
> why the hell didn't the FBI task someone Probably they were using Scrum.
Sophistifunk 7y ago
Unfortunately they're all busy radicalising people on twitter and supplying them with evidence to later make a big show of arresting them and saving the day.
yoloClin 7y ago
And if not the FBI, surely this would be in large bank / financial institutions best interest as well?
krebsonsecurity 7y ago
I can attest that the FBI has in fact been tracking these guys for more than a decade, and some of them were indicted previously. What I can't understand is why it took so long for this latest, more broad action, and why there is such a huge time gap between the victims referenced in the indictments. There are victims listed from 2010 and 2011 and then some this year (2019), but hardly any in between. That said, the FBI is not in the pre-crime business (with few exceptions), so they're not really set up to warn businesses like I did for so many years.
- lvs 7y ago
  > the FBI is not in the pre-crime business This seems like a bit of a systemic defect, if you can watch a financial (etc.) crime in progress but not have the jurisdiction (or allocation) to intercede. p.s. Shouldn't some of this fall into USSS jurisdiction?
- bryanrasmussen 7y ago
  >the FBI is not in the pre-crime business (with few exceptions), I guess those pre-crime exceptions are the ones were the agent convinces the malcontents they're embedded with to try a little terrorism?
  - Melting_Harps 7y ago
    > I guess those pre-crime exceptions are the ones were the agent convinces the malcontents they're embedded with to try a little terrorism? That's the exception, you have to justify your job and budget somehow. And nothing loosens purse-strings like the 'T-word' post 9/11. Although to be fair, the first attempt to bomb the WTC was a failed FBI Sting: https://www.nytimes.com/1993/10/28/nyregion/tapes-depict-proposal-to-thwart-bomb-used-in-trade-center-blast.html https://www.nytimes.com/1993/10/28/nyregion/tapes-depict-pro...
- nzealand 7y ago
  Sounds like Trump wants some wins related to the Elder Abuse Prevention and Prosecution Act (EAPPA): [“Protecting our senior citizens from criminals who target them is one of the Trump Administration’s highest priorities”](https://www.justice.gov/opa/pr/justice-department-announces-landmark-money-mule-initiative https://www.justice.gov/opa/pr/justice-department-announces-...) Sadly, the FBI is apparently not in the business of going after the king pin either. They are prosecuting the low level money mules, who are either unwilling or unable to comprehend the need to cease and desist after a letter from the FBI.
ComodoHacker 7y ago
Considering Evil Corp's ties to the Russian FSB, perhaps there was some other TLA involved in a long game to reach their adversaries. The cost was some more businesses being robbed, but... the end justifies the means, you know.

by munk-a 7y ago

dopamean 7y ago

Law enforcement does not seem interested in looking for victims, even if it's easy. It seems that they are optimized for responding to complaints. Anything more proactive gets reserved for perpetrators.

loa_in_ 7y ago
That's because every time the police force would call a potential victim to warn them, and it would turn out to be a false positive eventually some business owner would think: "we lost some money today, must have been because of that false warning, police is do incompetent". And then proceed to take the force to the court for "damages".
- nradov 7y ago
  It would be impossible to establish damages for that in civil court.
- dopamean 7y ago
  I don't believe for a second that the primary reason police departments don't look for potential victims is because they're worried about getting sued. The way they handle police brutality cases is enough proof that that's not true.
gav 7y ago
They don't really seem to care much for complaints a lot of the time either. Somebody attempted to cash some fraudulent checks for a company I worked for, luckily this was caught by our bank before we lost any money. The NYPD had no interest in doing any more than taking a report and were extremely happy when the perpetrator attempted to cash a third check, taking the total above $100k and into FBI justification. The FBI took the report and nothing happened even though our bank was able to provide details which should have led to an arrest.
- toomanybeersies 7y ago
  I'm not overly familiar with American police, but at least in Australia and New Zealand, the police are poorly equipped and resourced for dealing with financial crimes and other "information" crimes, they're heavily biased towards solving violent and property crimes. They deal primarily with physical evidence.
  - P_I_Staker 7y ago
    This is certainly an issue in the USA, I can't speak to how it compares. Someone I knew was trying to raise an issue about a caretaker skimming money. She was taking out the maximum amount of money every day and spending excessively on a credit card. They basically told him to get lost, and it was a civil matter It's also the case with more serious financial crimes, eg. Ponzi Schemes. The crazy thing is some of these things are completely illegal operations, yet publicized, with brick and mortar locations. This can go on for years. Sometimes there are complaints. Sometimes it's one determined victim or would-be victim that blows the lid on the whole thing. Even then it can take time; months to years. It's an area where people have been able to get away with it, often for a good chunk of their adult lives.

netcan 7y ago

Organisations (and individual people) are semi-constitutionally capable and incapable of different things. A lot of time, complete outsiders find very high "value" tasks that they can do, seem trivial, but the organisation seems unable to "task" to someone. A classic example is "watchdog" regulators that are supposed to police an industry. Regardless of mandate, they nearly always operate entirely via well organized, documented complaints. They don't do "outbound" policing, even if it's deeming easy & productive. The @patio11 recently did a great post on his dealings with CROs, and such regulators make an apoearance.

ljm 7y ago
My personal belief is that you can put all of this down to bike-shedding, or more formally Parkinson's Law of Triviality. Add a little risk/reward to the mix and an overarching system that impractically punishes failure to convict or prosecute, leading to risk-averse approaches, and you get a nice system that is happy to prosecute the low-level weed peddlers instead of the real players. Those people land on your desk or you get them from a traffic stop. Try to go further and you might lose your job or your pension. And, of course as a prosecutor or AG, make sure you plea-bargain everyone to boost your incarceration stats. Lots of easy wins to cook the books without really touching on the real problem. So you've got Too Big To Fail in the black markets and the criminal world too. (I hasten to avoid saying 'criminal-underworld' because our righteous overworld tends to be just as bad, if not worse in some cases.)

mzs 7y ago

two paragraphs down: >In many instances, my call would come in just minutes or hours before an unauthorized payroll batch was processed by the victim company’s bank, and some of those notifications prevented what otherwise would have been enormous losses — often several times the amount of the organization’s normal weekly payroll. At some point I stopped counting how many tens of thousands of dollars those calls saved victims, but over several years it was probably in the millions. Because Mr. Krebs was doing so with good effect and as a private individual he did not face the legal firewalls in place to prevent LEOs taking such actions for corrupt or ill intent or blow investigations.

panarky 7y ago
> Each of these mule recruitment sites had the same security weakness: Anyone could register, and after logging in any user could view messages sent to and from all other users simply by changing a number in the browser’s address bar. As a result, it was trivial to automate the retrieval of messages sent to every money mule registered across dozens of these fake company sites. Law enforcement already masquerades online as underage girls and boys, potential terrorists searching for bomb-making materials, etc. What "legal firewalls" would prevent them from walking a URL to see what companies are about to get robbed? And forget about law enforcement, why wouldn't banks and payroll services do the same thing to protect their customers? It's beyond ridiculous that our only line of defense is Brian Krebs.
- mzs 7y ago
  > What "legal firewalls" would prevent them from walking a URL to see what companies are about to get robbed? None there, but the moment they have a bank freeze a company's account…
  - joe_the_user 7y ago
    Krebs didn't freeze any business' account and any FBI agent doing similar work to Krebs would not have had to either. Apparently, the companies themselves called their banks to prevent the transactions. Banks do engage in effort to protect their customers and already flag questionable actions.

nitwit005 7y ago

The FBI has struggled to get a workable computer systems for their own internal use. Presumably, even some fairly modest technical problems may be beyond their capabilities. They also have a heavy focus on counterterrorism these days, which likely makes everything else lower priority by default.

commandlinefan 7y ago

> why the hell didn't the FBI task someone Probably they were using Scrum.

Sophistifunk 7y ago

Unfortunately they're all busy radicalising people on twitter and supplying them with evidence to later make a big show of arresting them and saving the day.

yoloClin 7y ago

And if not the FBI, surely this would be in large bank / financial institutions best interest as well?

krebsonsecurity 7y ago

I can attest that the FBI has in fact been tracking these guys for more than a decade, and some of them were indicted previously. What I can't understand is why it took so long for this latest, more broad action, and why there is such a huge time gap between the victims referenced in the indictments. There are victims listed from 2010 and 2011 and then some this year (2019), but hardly any in between. That said, the FBI is not in the pre-crime business (with few exceptions), so they're not really set up to warn businesses like I did for so many years.

lvs 7y ago
> the FBI is not in the pre-crime business This seems like a bit of a systemic defect, if you can watch a financial (etc.) crime in progress but not have the jurisdiction (or allocation) to intercede. p.s. Shouldn't some of this fall into USSS jurisdiction?
bryanrasmussen 7y ago
>the FBI is not in the pre-crime business (with few exceptions), I guess those pre-crime exceptions are the ones were the agent convinces the malcontents they're embedded with to try a little terrorism?
- Melting_Harps 7y ago
  > I guess those pre-crime exceptions are the ones were the agent convinces the malcontents they're embedded with to try a little terrorism? That's the exception, you have to justify your job and budget somehow. And nothing loosens purse-strings like the 'T-word' post 9/11. Although to be fair, the first attempt to bomb the WTC was a failed FBI Sting: https://www.nytimes.com/1993/10/28/nyregion/tapes-depict-proposal-to-thwart-bomb-used-in-trade-center-blast.html https://www.nytimes.com/1993/10/28/nyregion/tapes-depict-pro...
nzealand 7y ago
Sounds like Trump wants some wins related to the Elder Abuse Prevention and Prosecution Act (EAPPA): [“Protecting our senior citizens from criminals who target them is one of the Trump Administration’s highest priorities”](https://www.justice.gov/opa/pr/justice-department-announces-landmark-money-mule-initiative https://www.justice.gov/opa/pr/justice-department-announces-...) Sadly, the FBI is apparently not in the business of going after the king pin either. They are prosecuting the low level money mules, who are either unwilling or unable to comprehend the need to cease and desist after a letter from the FBI.

ComodoHacker 7y ago

Considering Evil Corp's ties to the Russian FSB, perhaps there was some other TLA involved in a long game to reach their adversaries. The cost was some more businesses being robbed, but... the end justifies the means, you know.