6 ms·

Who Is the Network Access Broker ‘Wazawaka?’

69 points by feross 5y ago

BoiledCabbage 5y ago
I never realized it was that involved. Ie that there are specialty roles in ransomware where people simply provide the access for a fee, and sell that to someone else to actually do the ransoming. The other question of course is - can this be considered Russian sponsored if they choose not to ever prosecute? How does this end? It becomes a major career in Russia?
- mistrial9 5y ago
  To me it sounds gullible and one-dimensional to use the name of some far-away place with a different language system, to blame for every criminal or autocratic problem. Mafia in the USA runs health care and show girls -- poor idiots far away sell hijack tools. There are smart people in every country, of every color and language.
  - actusual 5y ago
    I'm curious now...got any source for you "Mafia in the USA runs health care and show girls" statement?
- Nextgrid 5y ago
  I wouldn't be surprised if devices typically become compromised via automation - the ones responsible may not have the expertise & manpower needed to develop & deploy viable ransomware payloads, negotiating ransoms, providing "tech support" to "customers" who choose to pay the ransom and need help decrypting, etc. So they'd rather resell the access for a flat fee and leave it to others to milk out the actual targets for potentially more money. The low but steady stream of money they get might also be easier to launder than ransoms worth hundreds of thousands. I doubt this is limited to ransomware - I bet customers of a "network access broker" would involve conventional malware such as spam/DoS bots, ad fraud, etc as well.
- kgeist 5y ago
  >The other question of course is - can this be considered Russian sponsored if they choose not to ever prosecute? Here Russian police is lazy - if no one files a complaint, they won't do anything. Since he avoids targetting Russian organizations, law enforcement is probably completely unaware of him. Something can happen if American law enforcement contacts Russian law enforcement directly but it looks there's little cooperation there because of the mutual political animosity between USA & Russia (US/Russian embassies getting closed, ties being cut etc) I wonder what will happen if Interpol gets involved
  - bellyfullofbac 5y ago
    I wonder if he's ever stolen from a powerful drug dealer, who could afford to send someone to Russia to get revenge - not necessarily show up at the hacker's door, but to rent some locals who'd do that
  - IAmGraydon 5y ago
    Russia is an Interpol nation, so they should be able to operate there. It's amazing to me that someone this high profile and careless hasn't already been arrested, though. Perhaps there is some kind of protection in place.
    - kgeist 5y ago
      >It's amazing to me that someone this high profile and careless hasn't already been arrested A decade ago my town used to have a gang which operated the largest mail order bride scam in the country, all victims in US and Europe, too (i.e. none in Russia), for the same reasons. Many people in the town knew what they did and who they were (I personally knew 1 guy from there) but no one reported them to police because no one would benefit from fighting them and being labeled a snitch, and the general attitude (excuse) was that Americans and Europeans are supposedly very rich (at least, by Russian standards) so them losing $1000 here or there wasn't considered a serious problem or some moral dilemma. Police didn't care because formally no one filed an official complaint. However, there was some foreign victim who really valued his lost money. He somehow managed to contact Russian police and thanks to his efforts the gang was eventually busted red-handed, I remember there was a TV report about the raid. As it turned out, basically it was 20-30 students spread across several rented commieblock appartments full of PC's. They made many mistakes leaving traces of their real identities (just like the guy in the OP), the one guy I knew from there was also ~18 yo, a pretty inexperienced kid, even before the raid I had suspected it's not a serious mafia cell protected by the government or anything, just a bunch of opportunistic scumbags who abuse the inertia of our police and the legal/political/linguistic barriers between our countries. To scam people or spread ransomware, all you need is programming/social engineering skills and a PC. If you are lucky and/or determined, you can earn a lot of money by just having that, no government sponsorship is required. The fact that the hacker in the OP's post also lives in Siberia in a provincial town reminds me of that student gang from my town; you wouldn't expect high-profile hackers sponsored by the federal government to use the same password for all sites they visit. I think we can see if they are protected by authorities if Interpol requests will be flat-out rejected.
ivan_gammel 5y ago
This publication seems to be a major violation of privacy in several jurisdictions. Regardless of whether this guy is a criminal and whether his relative is complicit, their personal details should not be published in any form that is not an arrest order by law enforcement. Now not only their private information is disclosed, but they also can become targets for other criminals (he is probably a rich person and unless he is a member of some offline syndicate, e.g. FSB, he can be a subject for kidnapping and extortion). If the purpose of the publication is to put him in the spotlight, I do not see how those cybersecurity researchers are different from him.
- antihero 5y ago
  Also there’s the fact that if you were going to do some serious cybercrime, it would make sense to leave a bunch of hard to find but still findable trails to a real person that isn’t you, so it could be a frame up!
  - bellyfullofbac 5y ago
    For extra clever points, make it a person who already does protect their privacy by e.g. encrypting everything on local storage, doesn't like the cloud, and not being all over social media. If the cops bust them and can't find any evidence, they'll accuse them of hiding things, if they comply and decrypts their stuff and there's still nothing, the cops will still insist it was this person and they're still hiding something. If there's other incriminating stuff in the encrypted disks, boom the cops will bust them for that instead and will still think they got the master hacker...
- bennyp101 5y ago
  That was my first thought when he mentioned the Skype handle being a relative, "perhaps even his sister" - that seems like it crosses the line. If he has been stealing money from drug dealers etc, then outing his (potential) family - or worse, someone being fitted up - could have very bad repercussions.
- renewiltord 5y ago
  Live by the sword, die by the sword.
tryauuum 5y ago
I wonder if author can speak Russian. If not and he is armed only with google translate then it's an even more impressive investigation.
- alwayseasy 5y ago
  He learned to speak Russian just for his job. Couldn't infiltrate those forums otherwise.
YarickR2 5y ago
Well, something doesn't add up. "The phone number tied to that Vkontakte account — 7617467845 — was assigned by the Russian telephony provider MegaFon to a resident in Khakassia, situated in the southwestern part of Eastern Siberia." This number looks bogus, mobile phone numbers in Russia are +7(three digit provider code)(seven digits of actual number); given number is one digit short. We could assume this number is (three digit provider code)(seven digits of actual number) , but there's no provider with code 761 in Russia.
- notreallyserio 5y ago
  Seems like typical doxing behavior, posting inaccurate information for the mob. This Krebs guy sounds like a pos.
- orthoxerox 5y ago
  The provider code should start with a 9 for mobile phones. So 7-961-746 and so on
- homo_nullius 5y ago
  Looks like a simple typo (missing a 9 after the first 7). Later in the article the full number is listed.
sour-taste 5y ago
Is Krebs trying to claim the $5 million bounty on information leading to darkside affiliates arrest that he mentions in the post?
- pelagicAustral 5y ago
  Yeah, all they need to do now is send an inception team to convince Putin to extradite him to the states.
  - Muromec 5y ago
    Which is prohibited by constitution.
jeroenhd 5y ago
Here we go again. Hopefully the person Krebs is doxxing is actually the real culprit this time.
deleted 5y ago
[deleted]

69 points by feross 5y ago

I never realized it was that involved. Ie that there are specialty roles in ransomware where people simply provide the access for a fee, and sell that to someone else to actually do the ransoming. The other question of course is - can this be considered Russian sponsored if they choose not to ever prosecute? How does this end? It becomes a major career in Russia?

mistrial9 5y ago
To me it sounds gullible and one-dimensional to use the name of some far-away place with a different language system, to blame for every criminal or autocratic problem. Mafia in the USA runs health care and show girls -- poor idiots far away sell hijack tools. There are smart people in every country, of every color and language.
- actusual 5y ago
  I'm curious now...got any source for you "Mafia in the USA runs health care and show girls" statement?
Nextgrid 5y ago
I wouldn't be surprised if devices typically become compromised via automation - the ones responsible may not have the expertise & manpower needed to develop & deploy viable ransomware payloads, negotiating ransoms, providing "tech support" to "customers" who choose to pay the ransom and need help decrypting, etc. So they'd rather resell the access for a flat fee and leave it to others to milk out the actual targets for potentially more money. The low but steady stream of money they get might also be easier to launder than ransoms worth hundreds of thousands. I doubt this is limited to ransomware - I bet customers of a "network access broker" would involve conventional malware such as spam/DoS bots, ad fraud, etc as well.
kgeist 5y ago
>The other question of course is - can this be considered Russian sponsored if they choose not to ever prosecute? Here Russian police is lazy - if no one files a complaint, they won't do anything. Since he avoids targetting Russian organizations, law enforcement is probably completely unaware of him. Something can happen if American law enforcement contacts Russian law enforcement directly but it looks there's little cooperation there because of the mutual political animosity between USA & Russia (US/Russian embassies getting closed, ties being cut etc) I wonder what will happen if Interpol gets involved
- bellyfullofbac 5y ago
  I wonder if he's ever stolen from a powerful drug dealer, who could afford to send someone to Russia to get revenge - not necessarily show up at the hacker's door, but to rent some locals who'd do that
- IAmGraydon 5y ago
  Russia is an Interpol nation, so they should be able to operate there. It's amazing to me that someone this high profile and careless hasn't already been arrested, though. Perhaps there is some kind of protection in place.
  - kgeist 5y ago
    >It's amazing to me that someone this high profile and careless hasn't already been arrested A decade ago my town used to have a gang which operated the largest mail order bride scam in the country, all victims in US and Europe, too (i.e. none in Russia), for the same reasons. Many people in the town knew what they did and who they were (I personally knew 1 guy from there) but no one reported them to police because no one would benefit from fighting them and being labeled a snitch, and the general attitude (excuse) was that Americans and Europeans are supposedly very rich (at least, by Russian standards) so them losing $1000 here or there wasn't considered a serious problem or some moral dilemma. Police didn't care because formally no one filed an official complaint. However, there was some foreign victim who really valued his lost money. He somehow managed to contact Russian police and thanks to his efforts the gang was eventually busted red-handed, I remember there was a TV report about the raid. As it turned out, basically it was 20-30 students spread across several rented commieblock appartments full of PC's. They made many mistakes leaving traces of their real identities (just like the guy in the OP), the one guy I knew from there was also ~18 yo, a pretty inexperienced kid, even before the raid I had suspected it's not a serious mafia cell protected by the government or anything, just a bunch of opportunistic scumbags who abuse the inertia of our police and the legal/political/linguistic barriers between our countries. To scam people or spread ransomware, all you need is programming/social engineering skills and a PC. If you are lucky and/or determined, you can earn a lot of money by just having that, no government sponsorship is required. The fact that the hacker in the OP's post also lives in Siberia in a provincial town reminds me of that student gang from my town; you wouldn't expect high-profile hackers sponsored by the federal government to use the same password for all sites they visit. I think we can see if they are protected by authorities if Interpol requests will be flat-out rejected.

ivan_gammel 5y ago

This publication seems to be a major violation of privacy in several jurisdictions. Regardless of whether this guy is a criminal and whether his relative is complicit, their personal details should not be published in any form that is not an arrest order by law enforcement. Now not only their private information is disclosed, but they also can become targets for other criminals (he is probably a rich person and unless he is a member of some offline syndicate, e.g. FSB, he can be a subject for kidnapping and extortion). If the purpose of the publication is to put him in the spotlight, I do not see how those cybersecurity researchers are different from him.

antihero 5y ago
Also there’s the fact that if you were going to do some serious cybercrime, it would make sense to leave a bunch of hard to find but still findable trails to a real person that isn’t you, so it could be a frame up!
- bellyfullofbac 5y ago
  For extra clever points, make it a person who already does protect their privacy by e.g. encrypting everything on local storage, doesn't like the cloud, and not being all over social media. If the cops bust them and can't find any evidence, they'll accuse them of hiding things, if they comply and decrypts their stuff and there's still nothing, the cops will still insist it was this person and they're still hiding something. If there's other incriminating stuff in the encrypted disks, boom the cops will bust them for that instead and will still think they got the master hacker...
bennyp101 5y ago
That was my first thought when he mentioned the Skype handle being a relative, "perhaps even his sister" - that seems like it crosses the line. If he has been stealing money from drug dealers etc, then outing his (potential) family - or worse, someone being fitted up - could have very bad repercussions.
renewiltord 5y ago
Live by the sword, die by the sword.

tryauuum 5y ago

I wonder if author can speak Russian. If not and he is armed only with google translate then it's an even more impressive investigation.

alwayseasy 5y ago
He learned to speak Russian just for his job. Couldn't infiltrate those forums otherwise.

YarickR2 5y ago

Well, something doesn't add up. "The phone number tied to that Vkontakte account — 7617467845 — was assigned by the Russian telephony provider MegaFon to a resident in Khakassia, situated in the southwestern part of Eastern Siberia." This number looks bogus, mobile phone numbers in Russia are +7(three digit provider code)(seven digits of actual number); given number is one digit short. We could assume this number is (three digit provider code)(seven digits of actual number) , but there's no provider with code 761 in Russia.

notreallyserio 5y ago
Seems like typical doxing behavior, posting inaccurate information for the mob. This Krebs guy sounds like a pos.
orthoxerox 5y ago
The provider code should start with a 9 for mobile phones. So 7-961-746 and so on
homo_nullius 5y ago
Looks like a simple typo (missing a 9 after the first 7). Later in the article the full number is listed.

sour-taste 5y ago

Is Krebs trying to claim the $5 million bounty on information leading to darkside affiliates arrest that he mentions in the post?

pelagicAustral 5y ago
Yeah, all they need to do now is send an inception team to convince Putin to extradite him to the states.
- Muromec 5y ago
  Which is prohibited by constitution.

jeroenhd 5y ago

Here we go again. Hopefully the person Krebs is doxxing is actually the real culprit this time.

deleted 5y ago

[deleted]