4 ms·

"Criminal hackers have been known to hack each other, but is that what is happening here?" After years of researching computer security and cybercrime I think

"Criminal hackers have been known to hack each other, but is that what is happening here?" After years of researching computer security and cybercrime I think this is most likely the case with this one. "KrebsOnSecurity reports that the intruder subsequently dumped the stolen data on the dark web." If Law Enforcement people are after them they wouldn't do this they would simply seize the website and put notification on website's front page so it seems like rival group hacked them or simply whitehat hackers. Some of this cybercrime forums are running for more than a decade so no wonder they have attention and problems with Law and cyber criminals alike.

hollander 6y ago
It could very well be law enforcement doing this, just to encite a war between different groups. Didn't they do this with drug gangs in Colombia?
- mrkramer 6y ago
  They don't do it when they prosecute cyber criminals. You don't dump data and information you seize in investigation because you can use it in further operations or because you will need to use it in court.
  - meowface 6y ago
    But this wouldn't be a typical law enforcement action. (If it is actually a government that's responsible, here. I think it's unlikely, but we can just assume it for the sake of argument.) The likely culprits would be FIVEEYES law enforcement and/or intelligence. But the main people of interest on these forums likely all reside in Russia and perhaps some neighboring countries. An indictment against any of them is purely symbolic; these people know never to travel to a Western country and risk arrest. So, if you're FBI/CIA/NSA or similar, and you want to mitigate and disrupt all this fraud and theft and malware and PII harvesting from semi-organized Eastern European cybercrime, you're going to have to use some unconventional tactics. If I were a US "cyber commander" I think I'd consider trying to breach and expose their infrastructure and account info, and perhaps also plant some false flags so they think a rival was responsible. All of that helps encourage confusion, infighting, and decreased trade and communication. Keep doing it over and over and soon enough certain types of activities might become less lucrative, since more things have to be pushed even deeper underground and are less able to depend on semi-public advertisements for vending illicit goods and services. I could also imagine the US government considering it "fair game" from a geopolitical perspective. The current administration probably would be more likely to feel that way compared to the previous one, at least. Especially since there's evidence the Russia security services do sometimes team up with cybercriminals for certain things and turn a blind eye to them as long as they aren't targeting other Russian citizens.
- deleted 6y ago
  [deleted]
newsclues 6y ago
If LEO gets data/evidence illegally and they are unable to use it for prosecution, leaking it is the modern anonymous phone call equivalent.
- mrkramer 6y ago
  > If LEO gets data/evidence illegally and they are unable to use it for prosecution Law Enforcement Agencies work in cooperation with DOJ and they obtain evidence with the use of warrant[1] which is issued by court. Speaking of obtaining illegal evidence you can search for numerous court cases where judges turned blind eye on questionable methods of obtaining evidence using hacking techniques. Some of those cases were seizure of Dark Web websites and their servers. Courts will always protect government agencies because they want to be cohesive and in synergy. [1] https://en.wikipedia.org/wiki/Warrant_(law) https://en.wikipedia.org/wiki/Warrant_(law)
  - alsetmusic 6y ago
    True, there are judges who are massively corrupt who fail to observe the Fruit of the poisonous tree doctrine[0]. But I’ve certainly read accounts of judges doing the right thing and tossing ill-gotten evidence. It’s just so unusual that I can’t find examples in the limited time that I’m willing to search the web. So… that kinda says something. But the point being that it’s not universal that judges will facilitate such methods. [0] https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree
- wernercd 6y ago
  This gives a weird sort of incentive to "report" stuff anonymously... "reports on the web say" can often be used to get court ordered investigations - no matter the validity of the anonymous info. So "illegally obtained info" can spawn "legal" routes to investigate the same...
  - galaxyLogic 6y ago
    Right, hack it, leak it, it becomes public, can be used in court. But my guess is this is Biden telling Putin we can do it too.
heavyset_go 6y ago
Law enforcement isn't a cohesive entity, it's made up of thousands of groups with different intentions, and different levels and sources of funding. In general, most of those organizations want convictions, and will do what you said in regard to seizures and warrants. Some organizations, or people, might be playing a different game, and might see it advantageous to themselves or their governments if certain criminal entities are disrupted, but not convicted. And then you have other organizations that have carte blanche to do whatever they want, from smuggling drugs[1] to funding paramilitary groups and terrorism abroad, who might be interfering with criminals simply because they got in their way. [1] https://en.wikipedia.org/wiki/CIA_involvement_in_Contra_cocaine_trafficking https://en.wikipedia.org/wiki/CIA_involvement_in_Contra_coca...
- hutzlibu 6y ago
  "who might be interfering with criminals simply because they got in their way." Or, that some russian intelligence service is linked to the forum (it would be unlikely for them to not at least use some of the potential) and it was part of a bigger play, to disrupt their activity.
thisguygox 6y ago
“ If Law Enforcement people are after them they wouldn't do this they would simply seize the website and put notification on website's front page so it seems like rival group hacked them or simply whitehat hackers.” False. These forums are hosted in places that US law enforcement have no power to seize.
- mrkramer 6y ago
  I know that these forums are hosted in Russia but no way you would dump cybercrime's forum database no law enforcement agency would do this. When US seized the servers of Liberty Reserve their used its database to further investigate and arrest cyber criminals, hackers and spammers not to like someone said "dump it and encite a war between different groups." Btw the most wanted hacker in the world was identified when his Jabber server was hosted in USA not in Russia. US used this opsec mistake and seized the server. Russian cyber criminals often travel to Europe to countries like Czech Republic and Spain or to neighboring East Europe that's where they get arrested.
  - thisguygox 6y ago
    Law enforcement agency may not. Three letter agency would. Russia uses black hats for many of its cyber attacks. They turn a blind eye to their blackhat activities in return. Why would a three letter agency want to attack Russian hacker forums? To strike them where it hurts, where they earn their money.
  - mrkramer 6y ago
    they used* typo

hollander 6y ago

It could very well be law enforcement doing this, just to encite a war between different groups. Didn't they do this with drug gangs in Colombia?

mrkramer 6y ago
They don't do it when they prosecute cyber criminals. You don't dump data and information you seize in investigation because you can use it in further operations or because you will need to use it in court.
- meowface 6y ago
  But this wouldn't be a typical law enforcement action. (If it is actually a government that's responsible, here. I think it's unlikely, but we can just assume it for the sake of argument.) The likely culprits would be FIVEEYES law enforcement and/or intelligence. But the main people of interest on these forums likely all reside in Russia and perhaps some neighboring countries. An indictment against any of them is purely symbolic; these people know never to travel to a Western country and risk arrest. So, if you're FBI/CIA/NSA or similar, and you want to mitigate and disrupt all this fraud and theft and malware and PII harvesting from semi-organized Eastern European cybercrime, you're going to have to use some unconventional tactics. If I were a US "cyber commander" I think I'd consider trying to breach and expose their infrastructure and account info, and perhaps also plant some false flags so they think a rival was responsible. All of that helps encourage confusion, infighting, and decreased trade and communication. Keep doing it over and over and soon enough certain types of activities might become less lucrative, since more things have to be pushed even deeper underground and are less able to depend on semi-public advertisements for vending illicit goods and services. I could also imagine the US government considering it "fair game" from a geopolitical perspective. The current administration probably would be more likely to feel that way compared to the previous one, at least. Especially since there's evidence the Russia security services do sometimes team up with cybercriminals for certain things and turn a blind eye to them as long as they aren't targeting other Russian citizens.
deleted 6y ago
[deleted]

newsclues 6y ago

If LEO gets data/evidence illegally and they are unable to use it for prosecution, leaking it is the modern anonymous phone call equivalent.

mrkramer 6y ago
> If LEO gets data/evidence illegally and they are unable to use it for prosecution Law Enforcement Agencies work in cooperation with DOJ and they obtain evidence with the use of warrant[1] which is issued by court. Speaking of obtaining illegal evidence you can search for numerous court cases where judges turned blind eye on questionable methods of obtaining evidence using hacking techniques. Some of those cases were seizure of Dark Web websites and their servers. Courts will always protect government agencies because they want to be cohesive and in synergy. [1] https://en.wikipedia.org/wiki/Warrant_(law) https://en.wikipedia.org/wiki/Warrant_(law)
- alsetmusic 6y ago
  True, there are judges who are massively corrupt who fail to observe the Fruit of the poisonous tree doctrine[0]. But I’ve certainly read accounts of judges doing the right thing and tossing ill-gotten evidence. It’s just so unusual that I can’t find examples in the limited time that I’m willing to search the web. So… that kinda says something. But the point being that it’s not universal that judges will facilitate such methods. [0] https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree
wernercd 6y ago
This gives a weird sort of incentive to "report" stuff anonymously... "reports on the web say" can often be used to get court ordered investigations - no matter the validity of the anonymous info. So "illegally obtained info" can spawn "legal" routes to investigate the same...
- galaxyLogic 6y ago
  Right, hack it, leak it, it becomes public, can be used in court. But my guess is this is Biden telling Putin we can do it too.

heavyset_go 6y ago

Law enforcement isn't a cohesive entity, it's made up of thousands of groups with different intentions, and different levels and sources of funding. In general, most of those organizations want convictions, and will do what you said in regard to seizures and warrants. Some organizations, or people, might be playing a different game, and might see it advantageous to themselves or their governments if certain criminal entities are disrupted, but not convicted. And then you have other organizations that have carte blanche to do whatever they want, from smuggling drugs[1] to funding paramilitary groups and terrorism abroad, who might be interfering with criminals simply because they got in their way. [1] https://en.wikipedia.org/wiki/CIA_involvement_in_Contra_cocaine_trafficking https://en.wikipedia.org/wiki/CIA_involvement_in_Contra_coca...

hutzlibu 6y ago
"who might be interfering with criminals simply because they got in their way." Or, that some russian intelligence service is linked to the forum (it would be unlikely for them to not at least use some of the potential) and it was part of a bigger play, to disrupt their activity.

thisguygox 6y ago

“ If Law Enforcement people are after them they wouldn't do this they would simply seize the website and put notification on website's front page so it seems like rival group hacked them or simply whitehat hackers.” False. These forums are hosted in places that US law enforcement have no power to seize.

mrkramer 6y ago
I know that these forums are hosted in Russia but no way you would dump cybercrime's forum database no law enforcement agency would do this. When US seized the servers of Liberty Reserve their used its database to further investigate and arrest cyber criminals, hackers and spammers not to like someone said "dump it and encite a war between different groups." Btw the most wanted hacker in the world was identified when his Jabber server was hosted in USA not in Russia. US used this opsec mistake and seized the server. Russian cyber criminals often travel to Europe to countries like Czech Republic and Spain or to neighboring East Europe that's where they get arrested.
- thisguygox 6y ago
  Law enforcement agency may not. Three letter agency would. Russia uses black hats for many of its cyber attacks. They turn a blind eye to their blackhat activities in return. Why would a three letter agency want to attack Russian hacker forums? To strike them where it hurts, where they earn their money.
- mrkramer 6y ago
  they used* typo