15 ms·

RaidForums gets raided, alleged admin arrested

319 points by picture 5y ago

jacquesm 5y ago
"Coelho landed on the radar of U.S. authorities in June 2018, when he tried to enter the United States at the Hartsfield-Jackson International Airport in Atlanta. The government obtained a warrant to search the electronic devices Coelho had in his luggage and found text messages, files and emails showing he was the RaidForums administrator Omnipotent." Not really the sharpest knife in the drawer, to do things like this and then to go holidaying in the USA with incriminating stuff on your person... Story time: A guy I met who did stuff that may have come to the attention of US authorities was on a plane that got diverted to the USA for a medical emergency. The guy obviously got very upset and needed to go to the bathroom, urgently, on the way there he spotted a mate of his. They didn't like each other much but got to talk for a while and they both agreed that this was the end of the line. They both expected to be arrested upon landing because the passenger manifest was shared with the US authorities because of the overflight. The one remarked to the other: 'spending the rest of my life in jail is bad enough, but now I'm going to have to spend it with you and that is so much worse'. The person who had the medical emergency was taken off the plane to go to hospital, the flight continued on its way, no disembarkation, no checks, nothing.
- meowface 5y ago
  Not to mention the following paragraph: >“In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the email address unrivalled@pm.me to email the agent,” the government’s affidavit states. Investigators found this same address was used to register rf.ws and raid.lol, which Omnipotent announced on the forum would serve as alternative domain names for RaidForums in case the site’s primary domain was seized. I'm not surprised at all, though. These people tend not to be the brightest. If they were, they'd generally find legitimate employment, where they can still make very good money while also not constantly fearing arrest and imprisonment. Most of the people who operate and use these sites often don't have the ability to get even an entry-level infosec job.
  - radicalbyte 5y ago
    There was a big thread there of people trying to hack the EU-DCC using a leaked "signing key". The key was one of the example keys I've been giving non-technical people who are working on it and want to run the software locally. It was the blind leading the blind but a lot of fun to watch.
    - vmception 5y ago
      > It was the blind leading the blind but a lot of fun to watch. yeah, in places like that you get banned for offering alternate perspectives like telling them it doesn't have the significance they think it has better to just sell them infowars branded coffee mugs and move on.
  - btown 5y ago
    I imagine a lot of people think that just because they've used a WHOIS anonymization service through their registrar, domain registration isn't traceable back to their account. On the contrary, registrars make this incredibly straightforward for law enforcement to do: for instance, see https://www.godaddy.com/legal/agreements/subpoena-policy https://www.godaddy.com/legal/agreements/subpoena-policy. It's a remarkably silly way to get busted.
    - omegacharlie 5y ago
      Some context for those that do not know. I believe some time ago raidforums.com was transferred from NameCheap to Cloudflare registrar (pre-seizure) and it was under data redaction with an address in the territory of Cyprus in Whois data. Some sort of attempt at P.O box or shell company voodoo is my guess. With Cloudflare registrar I would not be surprised if they were a cooperating party in this case.
      - btown 5y ago
        https://www.namecheap.com/legal/general/court-order-and-subpoena-policy/ https://www.namecheap.com/legal/general/court-order-and-subp... https://www.cloudflare.com/media/pdf/transparency-report.pdf https://www.cloudflare.com/media/pdf/transparency-report.pdf - and https://developers.cloudflare.com/registrar/why-choose-cloudflare/whois-redaction/ https://developers.cloudflare.com/registrar/why-choose-cloud... indicates Cloudflare retains "the registrant email on file for that domain." WHOIS redaction is extremely useful for shielding personal information from non-governmental entities! But US government entities have full access to any data the registrar has on file, regardless of whether they provide redaction services.
- ribosometronome 5y ago
  Sounds like he was already on their radar if they were able/desired to obtain a warrant to search his devices.
  - rossdavidh 5y ago
    ...or even just spent the time to do it. But, not too surprising that they don't want to divulge everything that led them to him.
    - joshcryer 5y ago
      According to another article they arrested / detained several other people during this bust. I am guessing an inside agent got them to meet up. Only Coelho was stupid enough to have his devices unlocked / easily scoured. Using his admin email didn't help. Who even does that? Even my 75 year old mom knew to use her trash email for signing up for crap.
  - sofixa 5y ago
    So they even need a warrant? I was under the impression that no US constitutional protections apply to foreigners, and when entering the country you need a visa or equivalent preauthorisation, and there you certainly agree they can do whatever they want with you.
    - lexpar 5y ago
      That sounds mostly right to me. I think many constitutional protections do apply in case the USA is prosecuting an individual, eg even as a non American you could take the 5th if an American court was trying to convict you. However, when you're asking to enter the country as a non US citizen your options are essentially to do whatever the border services agents ask you to do or turn around and go home.
- oh_sigh 5y ago
  I think that's because these people are on the business side of exploits, not the technical side. So really the most important quality to have is a lack of scruples, not any kind of insane technical talent which might inform proper infosec.
- rosndo 5y ago
  This guy was under the impression that what he was doing wasn’t illegal. IANAL but the fact that he is being charged with access device fraud might suggest that DOJ had to engage in some mental gymnastics in order to charge this. E: I’ll take that back since I actually read the indictment now, besides the usual raidforums fare he was also selling credit card data which would very much tend to attract access device fraud charges.
  - jacquesm 5y ago
    I already said he wasn't the sharpest knife in the drawer.
    - rosndo 5y ago
      What he was doing might very well have been legal had he just avoided payment information and stuck to stolen databases containing emails, phone numbers, passwords. That was the bulk of the trade on raidforums anyway. But yeah, definitely not the sharpest knife in the drawer.
      - jacquesm 5y ago
        > might very well have been legal had he just avoided payment information and stuck to stolen databases containing emails, phone numbers, passwords I suspect that you are wrong about this. https://en.wikipedia.org/wiki/Accessory_(legal_term) https://en.wikipedia.org/wiki/Accessory_(legal_term) "Count 1: Conspiracy to Commit Access Device Fraud (18 U.S.C. §§ 1029(b)(2)and 3559(g)(1)) Count 2: Access Device Fraud — Using or Trafficking in an Unauthorized Access Device (18 U.S.C. §§ 1029(a)(2)and 2) Count 3: Access Device Fraud — Possession of Fifteen or More Unauthorized Access Devices (18 U.S.C. §§ 1029(a)(3)and 2) Counts 4-5: Access Device Fraud — Unauthorized Solicitation (18 U.S.C. §§ 1029(a)(6)and 2) Count 6: Aggravated Identity Theft (18 U.S.C. §§ 1028A(a)(l)and 2)" If this sticks he will be gone for a long, long time, and, crucially, he handed over the the evidence himself so no amount of 'it wasn't me' is going to help here.
        5y ago
- PaywallBuster 5y ago
  for background: he's only 21, and he started the website at 14
  - jacquesm 5y ago
    Indeed. But that doesn't really matter in the eyes of the law, he's no longer a minor. If he had been a bit more clever he would have stopped doing any of that the day he turned 18.
    - FerociousTimes 5y ago
      It is not about law enforcement either. It's about debating whether he's the sharpest tool in the shed or not. I contend that running such a criminal enterprise is no easy feat for a teenager despite the rookie mistakes he committed.
      - jacquesm 5y ago
        It's not easy: that's why he got caught. And he got caught primarily because he started a criminal enterprise, which makes him not the sharpest tool in the shed, if he would have been he would have turned his talents to something both more lucrative and legal.
        PaywallBuster 5y ago
        in a poor country where the average person makes < 1000 EUR per month, how do you come up with 0.5M at 21?
        jacquesm 5y ago
        You probably won't. But 0.5 M at 21 through illegal means is easy: just rob a money transport and call it a day, after all: who cares if you are going to be a criminal anyway. How you are going to legally come up with money is the question and there are no real shortcuts there other than to get lucky. But with his skills properly applied he would have a much better chance at a nice life than he has today. Money doesn't really matter much if you're in a jail cell.
- RajT88 5y ago
  I am always surprised at how often people who know each other randomly run into each other in an airport. I mean, what are the odds? I only had it happen once, but it was nuts. A guy from my previous company I ran into randomly in Frankfurt while I was on my way to India. He lives in California, I live in Chicago. We were on the same flight to Bangalore. Our trips had nothing to do with each other, other than we both work in tech and were visiting tech companies. Neither of us traveled internationally all that often. I knew a half dozen folks with crazy "what are the odds" stories like that.
  - layer8 5y ago
    It’s probably just a symptom of humans being very bad at estimating odds.
    - Sirened 5y ago
      teenagers even less so. He's _twenty one_ and has been running the site since he was thirteen years old.
  - morsch 5y ago
    Seems like a variation of the birthday paradox.
    - layer8 5y ago
      Not exactly, because the scenario isn’t “any two people on the plane” but “me and another person on the plane”.
      - paxys 5y ago
        It is still not another specific person, but anyone you know, which is a pretty large set.
        layer8 5y ago
        The birthday paradox is a paradox due to the quadratic odds. If you fix one person (yourself), the odds are only linear.
- vmception 5y ago
  > Not really the sharpest knife in the drawer, to do things like this and then to go holidaying in the USA with incriminating stuff on your person... The US could have gone after him any time it wanted in nearly any country, including his home in Portugal. They actually arrested him in the UK. This issue with the warrant when he entered was a procedural thing that appeared out of convenience. They could have cooperated with Portugal to get the equivalent done there. They just saw this low hanging fruit flagged on a flight manifest and was like "sure why not".
  - jacquesm 5y ago
    I don't care about the US perspective, I care about his perspective, and for the life of me I can't imagine someone so incredibly convinced of their own ability to hide their tracks that they'd be involved in a multi-year effort like that and think it's smart to go visit the United States. It's not like that would be the first time someone got arrested on entry. If it can happen to the CEO of a large multinational it can happen to Joe Random Hacker at least as easily. The interesting thing is they didn't arrest him on the spot, but they might well have.
    - Teandw 5y ago
      He was running one of the most 'successful' illegal forums for what 7 years? When you get away with something for so long, especially in an 'industry' where you know every law enforcement in the world is after you, I can see why you would easily think you're invincible and never getting caught. He was incredibly convinced of his own ability to hide his tracks because technically up to that point, his ability to hide his tracks was good. A self fulfilling prophecy of sorts.
      - jacquesm 5y ago
        Either that or he was spotted long ago, judged to be untouchable because he was still a minor and they let it go until they could charge him as an adult. The indictment documents a pretty lengthy sting operation.
  - 5y ago
- TacticalCoder 5y ago
  > Coelho landed on the radar of U.S. authorities in June 2018, when he tried to enter the United States at the Hartsfield-Jackson International Airport in Atlanta. The government obtained a warrant to search the electronic devices Coelho had in his luggage and found text messages, files and emails showing he was the RaidForums administrator Omnipotent I called complete, total and utter bullshit. That's a parallel construction if I ever saw one. Very few people get their devices searched (I know maybe one in 100) and, oh-the-coincidence, this guy happens to be that "Omnipotent" admin of a cybercrime forum? Yeah. I've got a bridge to sell you too.
  - jacquesm 5y ago
    There is a chance of that.
    - ev1 5y ago
      e: yeah, that makes sense I guess
      - jacquesm 5y ago
        But that's the whole beauty of parallel construction: you don't know if they found that out before or after...
  - throwmeariver1 5y ago
    I bet he thought the exact same thing ;0)
  - rosndo 5y ago
    > Very few people get their devices searched (I know maybe one in 100) and, oh-the-coincidence, this guy happens to be that "Omnipotent" admin of a cybercrime forum? That’s not what the text really suggests. It very clearly states: > The government obtained a warrant Which obviously means that he wasn’t randomly searched at the border, but the government knew who he was. It’s not parallel construction, just poor wording by Krebs.
  - 5y ago
- deleted 5y ago
  [deleted]
- zionic 5y ago
  > Not really the sharpest knife in the drawer Not uncommon with these types. Some former lulzsec dude got into EVE then very publicly threatened my corp with hacking/claimed he’d hacked us. Of course, he was on some kind of probation IRL that banned him even using computers/the internet. Our IT lead called the FBI and he got picked up again.
karmicthreat 5y ago
I wish the DOJ had a better designer for their domain seizure graphics.
- mindcrime 5y ago
  Somebody should seize the DOJ website and replace it with a cDc logo or something... Or a redirect to phrack.org.
  - jacquesm 5y ago
    It sounds like the 'somebody' would be angling for an extended stay in a room without a view as well.
- sydthrowaway 5y ago
  It's meant to be as garish as possible. It's the modern day equivalent of a branding iron. You got pwned!
  - kodah 5y ago
    Actually, you're spot on. They started doing these style of splash pages a few years after hacking groups did.
    - sva_ 5y ago
      I'd make a guess that they simply just hired those people (semi-voluntarily)
      - cellis 5y ago
        Quite a few former cyber criminals are on probation with three letter orgs…
        sydthrowaway 5y ago
        Hector?
skilled 5y ago
Interesting tweet here[0] saying the site was used to phish credentials since late February this year. Also, who was hosting these guys? I remember in early 2000s (back when milw0rm was a thing) - a lot of sites like this struggled to stay online because nobody wanted to host them. Anyways, that's a pretty stupid way to go out. And, not just because he is at fault or whatever, it sounds like they turned that site into a capitalist enterprise and that's going to hurt more than the fact that he engaged in illegal activity in the first place. [0]: https://twitter.com/NatSecGeek/status/1513875386395987968 https://twitter.com/NatSecGeek/status/1513875386395987968
- twelventy 5y ago
  > who was hosting these guys? Epik?
- toyg 5y ago
  I reckon the move to automated deployments in the cloud, must have made it relatively easy to cycle through accounts. Any mid-size hosting companies these days has an api, so you write scripts to deploy your (pretty simple) services on Host A with account A, and when the ban happens, move to Host B with account A, then back to Host A with account B, then host B with account B, then host A with account C, etc etc.
deleted 5y ago
[deleted]
sq_ 5y ago
> Please delete this post as this means I am in big trouble. Interesting comment on Krebs' article... Probably a joke, but doesn't imply great intelligence among the people involved with RaidForums if not.
frontman1988 5y ago
Amazing how the perp started the website at 14 and gradually turned it into the top data leaks site in the world. To be able to build a multi million dollar illegal marketplace and not get caught for 7 years was quite an achievement in itself. Alas you just have to slip once and the party's over.
- paulpauper 5y ago
  not really. unless it involves contraband, terrorism, or kid porn, the feds will not care that much. they will get to it eventually but it is not a top priority. Also they need many years to built an airtight case.
  - joe_the_user 5y ago
    This is pure speculation but if I were the Feds, I'd let insecure, incompetently run forums to keep operating and shut down any secure, tightly run forums. The insecure forum can simply be hacked and basically become honeypots.
    - zionic 5y ago
      That’s freenet in a nutshell
      - shaky-carrousel 5y ago
        Freenet is technically safe. It doesn't allow JavaScript, unlike onion sites.
        zionic 5y ago
        Freenet is very much not safe. Accessing any kind of dissident/illegal content is a quick way to get a visit from the FBI/FSB party van.
        shaky-carrousel 5y ago
deleted 5y ago
[deleted]
lettergram 5y ago
> an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. The DOJ also charged the alleged administrator of RaidForums — 21-year-old Diogo Santos Coelho, of Portugal — with six criminal counts, including conspiracy, access device fraud and aggravated identity theft. Some thing doesn’t add up
- Teandw 5y ago
  What doesn't add up?
  - lettergram 5y ago
    This admin would have been 14 when this was started. Why now and why him?
    - AceJohnny2 5y ago
      1. now he's major and can be tried as such 2. they've had a long time to build a solid case against him (and probably get info on others involved on the site) 3. he actually walked into their hands
    - swarnie 5y ago
      Is US justice known for being swift and efficient?
BlueTemplar 5y ago
Did he at least get swatted ?
ourmandave 5y ago
According to the DOJ, that early activity included ‘raiding‘... — and ‘swatting,’ the practice of making false reports to public safety agencies of situations that would necessitate a significant, and immediate armed law enforcement response.” If he did swatting they need to lock him up for attempted murder. People die from that "prank".
thrownaway89865 5y ago
What are the legal implications of having registered on this forum once with a personal email account but not having ever engaged in any transaction or downloading any leaked data, just lurking a few threads of nothing interesting at most. Asking for a friend, of course...
- jacquesm 5y ago
  Your name will end up on a list. Such lists can be queried by those that are properly connected, typically LE/three (and in some countries four) letter agencies if your name ever turns up in some other context and then it might be given some weight, but other than that I wouldn't expect anything to come of it assuming that you are telling the truth. Such inter-service requests for information on particular individuals are pretty regular but someone first has to ask for you by name, and in a country with proper privacy protections typically a judge would have to sign off on such a broad request, but these mechanisms are not always perfect. Reading threads isn't a crime, but hanging out in places where lots of criminals hang out doesn't help you in the association department.
  - dannyw 5y ago
    Unless you have some reason to be there, eg negotiating with someone who hacked your service.
- ianhawes 5y ago
  Hard to say, but rest assured that countless "white hat" infosec companies have also signed up and probably purchased stolen databases in furtherance of their own business activities.
ohcomments 5y ago
Guess the rabbit got caught by the turtle again due to showing off instead of just leading the damn race...
paulpauper 5y ago
Funny how there are so many logos on the seizure notice . they should have put a McDonald's logo too or maybe a service where a company can pay to have their logo put on there given how much traffic the sized domain probably got
- bonestamp2 5y ago
  Cyber Security companies might pay to be on there as a sponsor.
  - kibwen 5y ago
    This takedown is brought to you by Raid: Shadow Legends.
- Jamie9912 5y ago
  including an anime girl in skimpy clothing
  - Sirened 5y ago
    don't want people to get it confused with the other raidforums which is represented by a very chastely dressed anime girl
ceva 5y ago
Am just curious how hackforums is still around?
- Jamie9912 5y ago
  They don't allow anything illegal
- Sirened 5y ago
  I swear Hackforums is an FBI honeypot for especially stupid criminals. Nothing happens there (remember back in the day someone was talking about stealing from a gamestop and a bunch of people called the store to warn them lol), and anyways anyone who does anything remotely illegal immediately gets arrested.
  - yellow_lead 5y ago
    It is and at one point the owner even redirected people interested in more illegal things to a site that ended up being an FBI sting lol. https://hackforums.net/printthread.php?tid=5656430 https://hackforums.net/printthread.php?tid=5656430
TobyTheDog123 5y ago
Infinitely hysterical that they couldn't find a version of the RaidForums logo without a scantily clad anime girl lying on top of it
- danuker 5y ago
  Right next to all those law enforcement agencies' logos :D
cwkoss 5y ago
This is pretty funny, imo: --- Not all of those undercover buys went as planned. One incident described in an affidavit by prosecutors (PDF) appears related to the sale of tens of millions of consumer records stolen last year from T-Mobile, although the government refers to the victim only as a major telecommunications company and wireless network operator in the United States. [...] The government says the victim firm hired a third-party to purchase the database and prevent it from being sold to cybercriminals. That third-party ultimately paid approximately $200,000 worth of bitcoin to the seller, with the agreement that the data would be destroyed after sale. “However, it appears the co-conspirators continued to attempt to sell the databases after the third-party’s purchase,” the affidavit alleges. --- T-mobile paid 200k and got precisely nothing from it.
- cm2187 5y ago
  With the added benefit of poisoning the well for the next hacker who tries to sell the data back to the company.
- jrumbut 5y ago
  It's likely posturing for the inevitable lawsuits plus a lottery ticket on a great outcome.
- denton-scratch 5y ago
  Isn't T-Mobile the real "blunt knife" in this story?
cosmiccatnap 5y ago
Hey you can't collect an sell American information, that's OUR job!
langsoul-com 5y ago
yellow_lead 5y ago
This forum kinda reminds me of HackForums[1], but the owner of that forum co-operates with law enforcement and makes good money while staying above board on things. At one point, he even directed members interested in certain blackhat activities (carding, mainly) to a site that later ended up to be an FBI setup. [1] https://hackforums.net/ https://hackforums.net/ [2] https://krebsonsecurity.com/2012/06/carderprofit-forum-sting-nets-26-arrests/ https://krebsonsecurity.com/2012/06/carderprofit-forum-sting...
rdevsrex 5y ago
Stories like this make me wonder how well full disk encryption really holds up. Maybe LUKS is good, but I don't have 100% confidence that FileVault or BitWarden aren't backdoored. Of course in the UK, refusing to give the password is a crime, so some jurisdictions have you either way. Also, in this day of the internet, why would you need to travel with your laptop if you store the compromising data on a secure server, and then download it on a fresh computer when you get where you are going.

319 points by picture 5y ago

"Coelho landed on the radar of U.S. authorities in June 2018, when he tried to enter the United States at the Hartsfield-Jackson International Airport in Atlanta. The government obtained a warrant to search the electronic devices Coelho had in his luggage and found text messages, files and emails showing he was the RaidForums administrator Omnipotent." Not really the sharpest knife in the drawer, to do things like this and then to go holidaying in the USA with incriminating stuff on your person... Story time: A guy I met who did stuff that may have come to the attention of US authorities was on a plane that got diverted to the USA for a medical emergency. The guy obviously got very upset and needed to go to the bathroom, urgently, on the way there he spotted a mate of his. They didn't like each other much but got to talk for a while and they both agreed that this was the end of the line. They both expected to be arrested upon landing because the passenger manifest was shared with the US authorities because of the overflight. The one remarked to the other: 'spending the rest of my life in jail is bad enough, but now I'm going to have to spend it with you and that is so much worse'. The person who had the medical emergency was taken off the plane to go to hospital, the flight continued on its way, no disembarkation, no checks, nothing.

meowface 5y ago
Not to mention the following paragraph: >“In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the email address unrivalled@pm.me to email the agent,” the government’s affidavit states. Investigators found this same address was used to register rf.ws and raid.lol, which Omnipotent announced on the forum would serve as alternative domain names for RaidForums in case the site’s primary domain was seized. I'm not surprised at all, though. These people tend not to be the brightest. If they were, they'd generally find legitimate employment, where they can still make very good money while also not constantly fearing arrest and imprisonment. Most of the people who operate and use these sites often don't have the ability to get even an entry-level infosec job.
- radicalbyte 5y ago
  There was a big thread there of people trying to hack the EU-DCC using a leaked "signing key". The key was one of the example keys I've been giving non-technical people who are working on it and want to run the software locally. It was the blind leading the blind but a lot of fun to watch.
  - vmception 5y ago
    > It was the blind leading the blind but a lot of fun to watch. yeah, in places like that you get banned for offering alternate perspectives like telling them it doesn't have the significance they think it has better to just sell them infowars branded coffee mugs and move on.
- btown 5y ago
  I imagine a lot of people think that just because they've used a WHOIS anonymization service through their registrar, domain registration isn't traceable back to their account. On the contrary, registrars make this incredibly straightforward for law enforcement to do: for instance, see https://www.godaddy.com/legal/agreements/subpoena-policy https://www.godaddy.com/legal/agreements/subpoena-policy. It's a remarkably silly way to get busted.
  - omegacharlie 5y ago
    Some context for those that do not know. I believe some time ago raidforums.com was transferred from NameCheap to Cloudflare registrar (pre-seizure) and it was under data redaction with an address in the territory of Cyprus in Whois data. Some sort of attempt at P.O box or shell company voodoo is my guess. With Cloudflare registrar I would not be surprised if they were a cooperating party in this case.
    - btown 5y ago
      https://www.namecheap.com/legal/general/court-order-and-subpoena-policy/ https://www.namecheap.com/legal/general/court-order-and-subp... https://www.cloudflare.com/media/pdf/transparency-report.pdf https://www.cloudflare.com/media/pdf/transparency-report.pdf - and https://developers.cloudflare.com/registrar/why-choose-cloudflare/whois-redaction/ https://developers.cloudflare.com/registrar/why-choose-cloud... indicates Cloudflare retains "the registrant email on file for that domain." WHOIS redaction is extremely useful for shielding personal information from non-governmental entities! But US government entities have full access to any data the registrar has on file, regardless of whether they provide redaction services.
ribosometronome 5y ago
Sounds like he was already on their radar if they were able/desired to obtain a warrant to search his devices.
- rossdavidh 5y ago
  ...or even just spent the time to do it. But, not too surprising that they don't want to divulge everything that led them to him.
  - joshcryer 5y ago
    According to another article they arrested / detained several other people during this bust. I am guessing an inside agent got them to meet up. Only Coelho was stupid enough to have his devices unlocked / easily scoured. Using his admin email didn't help. Who even does that? Even my 75 year old mom knew to use her trash email for signing up for crap.
- sofixa 5y ago
  So they even need a warrant? I was under the impression that no US constitutional protections apply to foreigners, and when entering the country you need a visa or equivalent preauthorisation, and there you certainly agree they can do whatever they want with you.
  - lexpar 5y ago
    That sounds mostly right to me. I think many constitutional protections do apply in case the USA is prosecuting an individual, eg even as a non American you could take the 5th if an American court was trying to convict you. However, when you're asking to enter the country as a non US citizen your options are essentially to do whatever the border services agents ask you to do or turn around and go home.
oh_sigh 5y ago
I think that's because these people are on the business side of exploits, not the technical side. So really the most important quality to have is a lack of scruples, not any kind of insane technical talent which might inform proper infosec.
rosndo 5y ago
This guy was under the impression that what he was doing wasn’t illegal. IANAL but the fact that he is being charged with access device fraud might suggest that DOJ had to engage in some mental gymnastics in order to charge this. E: I’ll take that back since I actually read the indictment now, besides the usual raidforums fare he was also selling credit card data which would very much tend to attract access device fraud charges.
- jacquesm 5y ago
  I already said he wasn't the sharpest knife in the drawer.
  - rosndo 5y ago
    What he was doing might very well have been legal had he just avoided payment information and stuck to stolen databases containing emails, phone numbers, passwords. That was the bulk of the trade on raidforums anyway. But yeah, definitely not the sharpest knife in the drawer.
    - jacquesm 5y ago
      > might very well have been legal had he just avoided payment information and stuck to stolen databases containing emails, phone numbers, passwords I suspect that you are wrong about this. https://en.wikipedia.org/wiki/Accessory_(legal_term) https://en.wikipedia.org/wiki/Accessory_(legal_term) "Count 1: Conspiracy to Commit Access Device Fraud (18 U.S.C. §§ 1029(b)(2)and 3559(g)(1)) Count 2: Access Device Fraud — Using or Trafficking in an Unauthorized Access Device (18 U.S.C. §§ 1029(a)(2)and 2) Count 3: Access Device Fraud — Possession of Fifteen or More Unauthorized Access Devices (18 U.S.C. §§ 1029(a)(3)and 2) Counts 4-5: Access Device Fraud — Unauthorized Solicitation (18 U.S.C. §§ 1029(a)(6)and 2) Count 6: Aggravated Identity Theft (18 U.S.C. §§ 1028A(a)(l)and 2)" If this sticks he will be gone for a long, long time, and, crucially, he handed over the the evidence himself so no amount of 'it wasn't me' is going to help here.
      - 5y ago
PaywallBuster 5y ago
for background: he's only 21, and he started the website at 14
- jacquesm 5y ago
  Indeed. But that doesn't really matter in the eyes of the law, he's no longer a minor. If he had been a bit more clever he would have stopped doing any of that the day he turned 18.
  - FerociousTimes 5y ago
    It is not about law enforcement either. It's about debating whether he's the sharpest tool in the shed or not. I contend that running such a criminal enterprise is no easy feat for a teenager despite the rookie mistakes he committed.
    - jacquesm 5y ago
      It's not easy: that's why he got caught. And he got caught primarily because he started a criminal enterprise, which makes him not the sharpest tool in the shed, if he would have been he would have turned his talents to something both more lucrative and legal.
      - PaywallBuster 5y ago
        in a poor country where the average person makes < 1000 EUR per month, how do you come up with 0.5M at 21?
        jacquesm 5y ago
        You probably won't. But 0.5 M at 21 through illegal means is easy: just rob a money transport and call it a day, after all: who cares if you are going to be a criminal anyway. How you are going to legally come up with money is the question and there are no real shortcuts there other than to get lucky. But with his skills properly applied he would have a much better chance at a nice life than he has today. Money doesn't really matter much if you're in a jail cell.
RajT88 5y ago
I am always surprised at how often people who know each other randomly run into each other in an airport. I mean, what are the odds? I only had it happen once, but it was nuts. A guy from my previous company I ran into randomly in Frankfurt while I was on my way to India. He lives in California, I live in Chicago. We were on the same flight to Bangalore. Our trips had nothing to do with each other, other than we both work in tech and were visiting tech companies. Neither of us traveled internationally all that often. I knew a half dozen folks with crazy "what are the odds" stories like that.
- layer8 5y ago
  It’s probably just a symptom of humans being very bad at estimating odds.
  - Sirened 5y ago
    teenagers even less so. He's _twenty one_ and has been running the site since he was thirteen years old.
- morsch 5y ago
  Seems like a variation of the birthday paradox.
  - layer8 5y ago
    Not exactly, because the scenario isn’t “any two people on the plane” but “me and another person on the plane”.
    - paxys 5y ago
      It is still not another specific person, but anyone you know, which is a pretty large set.
      - layer8 5y ago
        The birthday paradox is a paradox due to the quadratic odds. If you fix one person (yourself), the odds are only linear.
vmception 5y ago
> Not really the sharpest knife in the drawer, to do things like this and then to go holidaying in the USA with incriminating stuff on your person... The US could have gone after him any time it wanted in nearly any country, including his home in Portugal. They actually arrested him in the UK. This issue with the warrant when he entered was a procedural thing that appeared out of convenience. They could have cooperated with Portugal to get the equivalent done there. They just saw this low hanging fruit flagged on a flight manifest and was like "sure why not".
- jacquesm 5y ago
  I don't care about the US perspective, I care about his perspective, and for the life of me I can't imagine someone so incredibly convinced of their own ability to hide their tracks that they'd be involved in a multi-year effort like that and think it's smart to go visit the United States. It's not like that would be the first time someone got arrested on entry. If it can happen to the CEO of a large multinational it can happen to Joe Random Hacker at least as easily. The interesting thing is they didn't arrest him on the spot, but they might well have.
  - Teandw 5y ago
    He was running one of the most 'successful' illegal forums for what 7 years? When you get away with something for so long, especially in an 'industry' where you know every law enforcement in the world is after you, I can see why you would easily think you're invincible and never getting caught. He was incredibly convinced of his own ability to hide his tracks because technically up to that point, his ability to hide his tracks was good. A self fulfilling prophecy of sorts.
    - jacquesm 5y ago
      Either that or he was spotted long ago, judged to be untouchable because he was still a minor and they let it go until they could charge him as an adult. The indictment documents a pretty lengthy sting operation.
- 5y ago
TacticalCoder 5y ago
> Coelho landed on the radar of U.S. authorities in June 2018, when he tried to enter the United States at the Hartsfield-Jackson International Airport in Atlanta. The government obtained a warrant to search the electronic devices Coelho had in his luggage and found text messages, files and emails showing he was the RaidForums administrator Omnipotent I called complete, total and utter bullshit. That's a parallel construction if I ever saw one. Very few people get their devices searched (I know maybe one in 100) and, oh-the-coincidence, this guy happens to be that "Omnipotent" admin of a cybercrime forum? Yeah. I've got a bridge to sell you too.
- jacquesm 5y ago
  There is a chance of that.
  - ev1 5y ago
    e: yeah, that makes sense I guess
    - jacquesm 5y ago
      But that's the whole beauty of parallel construction: you don't know if they found that out before or after...
- throwmeariver1 5y ago
  I bet he thought the exact same thing ;0)
- rosndo 5y ago
  > Very few people get their devices searched (I know maybe one in 100) and, oh-the-coincidence, this guy happens to be that "Omnipotent" admin of a cybercrime forum? That’s not what the text really suggests. It very clearly states: > The government obtained a warrant Which obviously means that he wasn’t randomly searched at the border, but the government knew who he was. It’s not parallel construction, just poor wording by Krebs.
- 5y ago
deleted 5y ago
[deleted]
zionic 5y ago
> Not really the sharpest knife in the drawer Not uncommon with these types. Some former lulzsec dude got into EVE then very publicly threatened my corp with hacking/claimed he’d hacked us. Of course, he was on some kind of probation IRL that banned him even using computers/the internet. Our IT lead called the FBI and he got picked up again.

karmicthreat 5y ago

I wish the DOJ had a better designer for their domain seizure graphics.

mindcrime 5y ago
Somebody should seize the DOJ website and replace it with a cDc logo or something... Or a redirect to phrack.org.
- jacquesm 5y ago
  It sounds like the 'somebody' would be angling for an extended stay in a room without a view as well.
sydthrowaway 5y ago
It's meant to be as garish as possible. It's the modern day equivalent of a branding iron. You got pwned!
- kodah 5y ago
  Actually, you're spot on. They started doing these style of splash pages a few years after hacking groups did.
  - sva_ 5y ago
    I'd make a guess that they simply just hired those people (semi-voluntarily)
    - cellis 5y ago
      Quite a few former cyber criminals are on probation with three letter orgs…
      - sydthrowaway 5y ago
        Hector?

skilled 5y ago

Interesting tweet here[0] saying the site was used to phish credentials since late February this year. Also, who was hosting these guys? I remember in early 2000s (back when milw0rm was a thing) - a lot of sites like this struggled to stay online because nobody wanted to host them. Anyways, that's a pretty stupid way to go out. And, not just because he is at fault or whatever, it sounds like they turned that site into a capitalist enterprise and that's going to hurt more than the fact that he engaged in illegal activity in the first place. [0]: https://twitter.com/NatSecGeek/status/1513875386395987968 https://twitter.com/NatSecGeek/status/1513875386395987968

twelventy 5y ago
> who was hosting these guys? Epik?
toyg 5y ago
I reckon the move to automated deployments in the cloud, must have made it relatively easy to cycle through accounts. Any mid-size hosting companies these days has an api, so you write scripts to deploy your (pretty simple) services on Host A with account A, and when the ban happens, move to Host B with account A, then back to Host A with account B, then host B with account B, then host A with account C, etc etc.

deleted 5y ago

[deleted]

sq_ 5y ago

> Please delete this post as this means I am in big trouble. Interesting comment on Krebs' article... Probably a joke, but doesn't imply great intelligence among the people involved with RaidForums if not.

frontman1988 5y ago

Amazing how the perp started the website at 14 and gradually turned it into the top data leaks site in the world. To be able to build a multi million dollar illegal marketplace and not get caught for 7 years was quite an achievement in itself. Alas you just have to slip once and the party's over.

paulpauper 5y ago
not really. unless it involves contraband, terrorism, or kid porn, the feds will not care that much. they will get to it eventually but it is not a top priority. Also they need many years to built an airtight case.
- joe_the_user 5y ago
  This is pure speculation but if I were the Feds, I'd let insecure, incompetently run forums to keep operating and shut down any secure, tightly run forums. The insecure forum can simply be hacked and basically become honeypots.
  - zionic 5y ago
    That’s freenet in a nutshell
    - shaky-carrousel 5y ago
      Freenet is technically safe. It doesn't allow JavaScript, unlike onion sites.
      - zionic 5y ago
        Freenet is very much not safe. Accessing any kind of dissident/illegal content is a quick way to get a visit from the FBI/FSB party van.
        shaky-carrousel 5y ago

deleted 5y ago

[deleted]

lettergram 5y ago

> an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. The DOJ also charged the alleged administrator of RaidForums — 21-year-old Diogo Santos Coelho, of Portugal — with six criminal counts, including conspiracy, access device fraud and aggravated identity theft. Some thing doesn’t add up

Teandw 5y ago
What doesn't add up?
- lettergram 5y ago
  This admin would have been 14 when this was started. Why now and why him?
  - AceJohnny2 5y ago
    1. now he's major and can be tried as such 2. they've had a long time to build a solid case against him (and probably get info on others involved on the site) 3. he actually walked into their hands
  - swarnie 5y ago
    Is US justice known for being swift and efficient?

BlueTemplar 5y ago

Did he at least get swatted ?

ourmandave 5y ago

According to the DOJ, that early activity included ‘raiding‘... — and ‘swatting,’ the practice of making false reports to public safety agencies of situations that would necessitate a significant, and immediate armed law enforcement response.” If he did swatting they need to lock him up for attempted murder. People die from that "prank".

thrownaway89865 5y ago

What are the legal implications of having registered on this forum once with a personal email account but not having ever engaged in any transaction or downloading any leaked data, just lurking a few threads of nothing interesting at most. Asking for a friend, of course...

jacquesm 5y ago
Your name will end up on a list. Such lists can be queried by those that are properly connected, typically LE/three (and in some countries four) letter agencies if your name ever turns up in some other context and then it might be given some weight, but other than that I wouldn't expect anything to come of it assuming that you are telling the truth. Such inter-service requests for information on particular individuals are pretty regular but someone first has to ask for you by name, and in a country with proper privacy protections typically a judge would have to sign off on such a broad request, but these mechanisms are not always perfect. Reading threads isn't a crime, but hanging out in places where lots of criminals hang out doesn't help you in the association department.
- dannyw 5y ago
  Unless you have some reason to be there, eg negotiating with someone who hacked your service.
ianhawes 5y ago
Hard to say, but rest assured that countless "white hat" infosec companies have also signed up and probably purchased stolen databases in furtherance of their own business activities.

ohcomments 5y ago

Guess the rabbit got caught by the turtle again due to showing off instead of just leading the damn race...

paulpauper 5y ago

Funny how there are so many logos on the seizure notice . they should have put a McDonald's logo too or maybe a service where a company can pay to have their logo put on there given how much traffic the sized domain probably got

bonestamp2 5y ago
Cyber Security companies might pay to be on there as a sponsor.
- kibwen 5y ago
  This takedown is brought to you by Raid: Shadow Legends.
Jamie9912 5y ago
including an anime girl in skimpy clothing
- Sirened 5y ago
  don't want people to get it confused with the other raidforums which is represented by a very chastely dressed anime girl

ceva 5y ago

Am just curious how hackforums is still around?

Jamie9912 5y ago
They don't allow anything illegal
Sirened 5y ago
I swear Hackforums is an FBI honeypot for especially stupid criminals. Nothing happens there (remember back in the day someone was talking about stealing from a gamestop and a bunch of people called the store to warn them lol), and anyways anyone who does anything remotely illegal immediately gets arrested.
- yellow_lead 5y ago
  It is and at one point the owner even redirected people interested in more illegal things to a site that ended up being an FBI sting lol. https://hackforums.net/printthread.php?tid=5656430 https://hackforums.net/printthread.php?tid=5656430

TobyTheDog123 5y ago

Infinitely hysterical that they couldn't find a version of the RaidForums logo without a scantily clad anime girl lying on top of it

danuker 5y ago
Right next to all those law enforcement agencies' logos :D

cwkoss 5y ago

This is pretty funny, imo: --- Not all of those undercover buys went as planned. One incident described in an affidavit by prosecutors (PDF) appears related to the sale of tens of millions of consumer records stolen last year from T-Mobile, although the government refers to the victim only as a major telecommunications company and wireless network operator in the United States. [...] The government says the victim firm hired a third-party to purchase the database and prevent it from being sold to cybercriminals. That third-party ultimately paid approximately $200,000 worth of bitcoin to the seller, with the agreement that the data would be destroyed after sale. “However, it appears the co-conspirators continued to attempt to sell the databases after the third-party’s purchase,” the affidavit alleges. --- T-mobile paid 200k and got precisely nothing from it.

cm2187 5y ago
With the added benefit of poisoning the well for the next hacker who tries to sell the data back to the company.
jrumbut 5y ago
It's likely posturing for the inevitable lawsuits plus a lottery ticket on a great outcome.
denton-scratch 5y ago
Isn't T-Mobile the real "blunt knife" in this story?

cosmiccatnap 5y ago

Hey you can't collect an sell American information, that's OUR job!

langsoul-com 5y ago

yellow_lead 5y ago

This forum kinda reminds me of HackForums[1], but the owner of that forum co-operates with law enforcement and makes good money while staying above board on things. At one point, he even directed members interested in certain blackhat activities (carding, mainly) to a site that later ended up to be an FBI setup. [1] https://hackforums.net/ https://hackforums.net/ [2] https://krebsonsecurity.com/2012/06/carderprofit-forum-sting-nets-26-arrests/ https://krebsonsecurity.com/2012/06/carderprofit-forum-sting...

rdevsrex 5y ago

Stories like this make me wonder how well full disk encryption really holds up. Maybe LUKS is good, but I don't have 100% confidence that FileVault or BitWarden aren't backdoored. Of course in the UK, refusing to give the password is a crime, so some jurisdictions have you either way. Also, in this day of the internet, why would you need to travel with your laptop if you store the compromising data on a secure server, and then download it on a fresh computer when you get where you are going.