4 ms·

> Each of these mule recruitment sites had the same security weakness: Anyone could register, and after logging in any user could view messages sent to and from

> Each of these mule recruitment sites had the same security weakness: Anyone could register, and after logging in any user could view messages sent to and from all other users simply by changing a number in the browser’s address bar. As a result, it was trivial to automate the retrieval of messages sent to every money mule registered across dozens of these fake company sites. Law enforcement already masquerades online as underage girls and boys, potential terrorists searching for bomb-making materials, etc. What "legal firewalls" would prevent them from walking a URL to see what companies are about to get robbed? And forget about law enforcement, why wouldn't banks and payroll services do the same thing to protect their customers? It's beyond ridiculous that our only line of defense is Brian Krebs.

mzs 7y ago
> What "legal firewalls" would prevent them from walking a URL to see what companies are about to get robbed? None there, but the moment they have a bank freeze a company's account…
- joe_the_user 7y ago
  Krebs didn't freeze any business' account and any FBI agent doing similar work to Krebs would not have had to either. Apparently, the companies themselves called their banks to prevent the transactions. Banks do engage in effort to protect their customers and already flag questionable actions.
  - mzs 7y ago
    Contacting the company is strongly discouraged as well and for good reasons: * You do not want to create an environment where some enjoy the protection of the FBI and others do not. * You do not want to jeopardize an ongoing investigation or later trial.
    - celticninja 7y ago
      That's bullshit. The police will often contact organisations in these situations.
      - judge2020 7y ago
        I imagine the criminal org. could perform a transaction with one of their own shell corporations every so often to see if the FBI are on to them.
        joe_the_user 7y ago
        The thing about the situation actually described was everything happened on a fairly large scale but it was far from given - a lot of transactions failed for various reasons not necessarily implying the FBI was making a systematic effort to stop them. Indeed, Krebs was making a systematically effort to stop them and they just kept going.
        munk-a 7y ago
        That'll still hurt the margins - a lot of these cyber crimes are only cost effective at scale and only hitting a few people successfully can deter folks to easier revenue streams - they care about margins as much as anyone else.
        panarky 7y ago
        I'm curious what you think the margin is for this endeavor. Is it like the food wholesale business which retains a 2% net margin after all expenses? Or is it like Google with net margins of 18% or thereabouts? Costs consist of writing and updating the malware itself, maintaining C&C servers and hiring mules to cash out the proceeds with an 8% commission. Maybe there are kickbacks to government authorities, though I understand kickbacks are often payments in kind, by sharing exploits with intelligence agencies.
        munk-a 7y ago
        I mean, logically, the take home has to be pretty decent, but it's not approaching the take homes that drug cartel's tend to get, so they probably lose big big chunks of profit to local corruption. Otherwise you'd see the same thing you see in central america - the immense profit potential slowly militarizes the entire industry and you've got private armies tooling about. From what we've seen out of Russia, the militarization of hacking hasn't yet evolved to private armies - so either it's all being controlled by an existing (maybe the government) or early emergent (maybe a shiny new oligarch) player or the profit margins just aren't enough to justify violence. As soon as you can make 200k by robbing a criminal you'll see it happen though.
    - deleted 7y ago
      [deleted]
hinkley 7y ago
If one had watched too many Hollywood movies (where single points of failure are exploited ruthlessly by the Bad Guys), one might conclude that Krebs is far better off if more people are involved in this project, and that he should delegate at his earliest possible convenience (and maybe this is it?)
graylights 7y ago
The messages are private communications, would probably require a warrant.

mzs 7y ago

> What "legal firewalls" would prevent them from walking a URL to see what companies are about to get robbed? None there, but the moment they have a bank freeze a company's account…

joe_the_user 7y ago
Krebs didn't freeze any business' account and any FBI agent doing similar work to Krebs would not have had to either. Apparently, the companies themselves called their banks to prevent the transactions. Banks do engage in effort to protect their customers and already flag questionable actions.
- mzs 7y ago
  Contacting the company is strongly discouraged as well and for good reasons: * You do not want to create an environment where some enjoy the protection of the FBI and others do not. * You do not want to jeopardize an ongoing investigation or later trial.
  - celticninja 7y ago
    That's bullshit. The police will often contact organisations in these situations.
    - judge2020 7y ago
      I imagine the criminal org. could perform a transaction with one of their own shell corporations every so often to see if the FBI are on to them.
      - joe_the_user 7y ago
        The thing about the situation actually described was everything happened on a fairly large scale but it was far from given - a lot of transactions failed for various reasons not necessarily implying the FBI was making a systematic effort to stop them. Indeed, Krebs was making a systematically effort to stop them and they just kept going.
      - munk-a 7y ago
        That'll still hurt the margins - a lot of these cyber crimes are only cost effective at scale and only hitting a few people successfully can deter folks to easier revenue streams - they care about margins as much as anyone else.
        panarky 7y ago
        I'm curious what you think the margin is for this endeavor. Is it like the food wholesale business which retains a 2% net margin after all expenses? Or is it like Google with net margins of 18% or thereabouts? Costs consist of writing and updating the malware itself, maintaining C&C servers and hiring mules to cash out the proceeds with an 8% commission. Maybe there are kickbacks to government authorities, though I understand kickbacks are often payments in kind, by sharing exploits with intelligence agencies.
        munk-a 7y ago
        I mean, logically, the take home has to be pretty decent, but it's not approaching the take homes that drug cartel's tend to get, so they probably lose big big chunks of profit to local corruption. Otherwise you'd see the same thing you see in central america - the immense profit potential slowly militarizes the entire industry and you've got private armies tooling about. From what we've seen out of Russia, the militarization of hacking hasn't yet evolved to private armies - so either it's all being controlled by an existing (maybe the government) or early emergent (maybe a shiny new oligarch) player or the profit margins just aren't enough to justify violence. As soon as you can make 200k by robbing a criminal you'll see it happen though.
  - deleted 7y ago
    [deleted]

hinkley 7y ago

If one had watched too many Hollywood movies (where single points of failure are exploited ruthlessly by the Bad Guys), one might conclude that Krebs is far better off if more people are involved in this project, and that he should delegate at his earliest possible convenience (and maybe this is it?)

graylights 7y ago

The messages are private communications, would probably require a warrant.