8 ms·

Not to mention the following paragraph: >“In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the

• radicalbyte 5y ago
  There was a big thread there of people trying to hack the EU-DCC using a leaked "signing key". The key was one of the example keys I've been giving non-technical people who are working on it and want to run the software locally. It was the blind leading the blind but a lot of fun to watch.
  • vmception 5y ago
    > It was the blind leading the blind but a lot of fun to watch. yeah, in places like that you get banned for offering alternate perspectives like telling them it doesn't have the significance they think it has better to just sell them infowars branded coffee mugs and move on.
• btown 5y ago
  I imagine a lot of people think that just because they've used a WHOIS anonymization service through their registrar, domain registration isn't traceable back to their account. On the contrary, registrars make this incredibly straightforward for law enforcement to do: for instance, see https://www.godaddy.com/legal/agreements/subpoena-policy https://www.godaddy.com/legal/agreements/subpoena-policy. It's a remarkably silly way to get busted.
  • omegacharlie 5y ago
    Some context for those that do not know. I believe some time ago raidforums.com was transferred from NameCheap to Cloudflare registrar (pre-seizure) and it was under data redaction with an address in the territory of Cyprus in Whois data. Some sort of attempt at P.O box or shell company voodoo is my guess. With Cloudflare registrar I would not be surprised if they were a cooperating party in this case.
    • btown 5y ago
      https://www.namecheap.com/legal/general/court-order-and-subpoena-policy/ https://www.namecheap.com/legal/general/court-order-and-subp... https://www.cloudflare.com/media/pdf/transparency-report.pdf https://www.cloudflare.com/media/pdf/transparency-report.pdf - and https://developers.cloudflare.com/registrar/why-choose-cloudflare/whois-redaction/ https://developers.cloudflare.com/registrar/why-choose-cloud... indicates Cloudflare retains "the registrant email on file for that domain." WHOIS redaction is extremely useful for shielding personal information from non-governmental entities! But US government entities have full access to any data the registrar has on file, regardless of whether they provide redaction services.
      • 2Gkashmiri 5y ago
        Why is everyone expected to put in real data into your who is domain data? Last time I bought a domain, I did "1,lol,NYC, Dubai,90210" and other nonsense in the four fields. Is it a compulsion to use real data and then rely on registrars promise to not disclose it?
        • Teandw 5y ago
          It's required for legal purposes. If legal notices are served on the domain, the registrars need to know where to send them. Using fake details are fine until you need to prove ownership for some reason or a legal notice is given. Easy way to get a domain seized is to have it not be responding to legal notices.
• xiphias2 5y ago
  I'm not so sure about it. Did you listen to the interview of Lex Fridman with Brett Johnson? He seems like an intelligent person who could easily get an infosec job and be extremely good at it from UX/social engineering point of view, but he was socialized from being a kid to disregard authority and steal from other people in every possible way. I'm sure he wouldn't let Coinbase get away with SMS 2nd factor authentication, something I can never forgive a company to do when there's big money on the line.
  • meowface 5y ago
    >I'm not so sure about it. Did you listen to the interview of Lex Fridman with Brett Johnson? I did. Excellent, captivating interview, but he repeatedly acknowledged he didn't know much about the tech stuff, and he said several incorrect technical things towards the end. I stand by my statement: I think it would've been difficult for him to get a (technical) infosec job at the time of his arrest, or now (assuming a world where he didn't have a criminal record). While listening to it, I actually thought he perfectly fit the archetype of cybercrime forum operators I'm used to coming across. He's certainly a great social engineer, and many other technically unskilled people in the cybercrime space also are. I'm definitely not discounting that ability. A lot of it comes down to brazenness; e.g. being confident and shameless enough to impersonate a law enforcement officer over the phone. There's still a lot of skill involved in being a con artist even then - you need affability and the gift of gab and all that - but it's not necessarily the kind of skill that's transferrable to technical expertise. There are many people with expertise in both areas, but also many who are exclusive to one.
  • PragmaticPulp 5y ago
    > I'm not so sure about it. Did you listen to the interview of Lex Fridman with Brett Johnson? He seems like an intelligent person who could easily get an infosec job and be extremely good at it from UX/social engineering point of view, but he was socialized from being a kid to disregard authority and steal from other people in every possible way. Be very careful about taking infosec celebrities at face value. Social engineering is and always has been a core feature of black hat activities. When these people graduate from criminal activities to being keynote speakers and consultants, they take their social engineering skills and use them to build a personal brand. In other words: You were getting socially engineered through that podcast. Building an aura around himself is his business now ( https://www.anglerphish.com/speaking-consulting https://www.anglerphish.com/speaking-consulting ). His story is interesting and you can't deny that he's become a great storyteller. But even he admitted that he wasn't the strongest on the technical side of things.
• krzyk 5y ago
  How is infosec job related to him? Legitimite employment might not give them the needed liberty to do what they see fit.
  • meowface 5y ago
    >Legitimite employment might not give them the needed liberty to do what they see fit. That's true; that's why I tried to qualify it with "generally". There certainly are some very intelligent, skilled people who are capable of finding legitimate employment and instead choose to immerse themselves in the criminal underworld, for various personal reasons. In practice, though, I've found them to be pretty rare. Even among the ones who do have a desire for ultimate liberty and who see themselves as above the law, most feel like the risks greatly outweigh the rewards. Some temporary liberty in exchange for likely many years of zero liberty in a prison cell isn't a great deal. Especially when it's so easy for them to get a comfortable, high-paying legitimate job. (Admittedly, this trade-off may differ in places outside the US, where good jobs may be scarce and criminal activity may pay very well and almost always go unpunished. Assuming one has no ethical compunction, at least. Or feels certain illegal actions are ethically justifiable, like how many hacktivists feel.)
• db65edfc7996 5y ago
  With all digital interactions recorded forever, it only takes a single idle mistake.
  • at-fates-hands 5y ago
    True. I always feel like the people who are involved in these illegal forums would have better OpsSec. The fact the feds got all of his electronic devices and within a few hours had plenty of damning information is always kind of shocking to me. I guess that's the difference between the real criminals who never get caught and others who get greedy or too lazy in covering their tracks.
    • PeterisP 5y ago
      Proper OpSec is a pain in the ass and requires constant vigilance as being correct 99% of the time is not good enough. If I got a magic gift of $10 million in crypto but I had to start doing proper OpSec to hide everything on my devices and digital life, that would be a huge downgrade in my quality of life; it's not worth it.
• sonicggg 5y ago
  They could find legitimate work, yes, but you're forgetting that they do it for the thrill. Just like people can be passionated for their careers, so can a black hat hacker or a scammer also find pleasure in his craft. Not saying it's the right thing, but I understand the appeal.
• baby 5y ago
  dude, opsec is really really hard, the slightest mistake and it's over.
  • sweetbitter 5y ago
    It's only that hard if the person in question is dumb enough to be using a pseudonym instead of opting for anonymity, since having a name opens up your attack surface and chance to fail. Hosting a site or some kind of infrastructure that you have to actively interface with also counts towards this.
    • baby 5y ago
      Anonimity is more than just using a pseudonym.
      • sweetbitter 5y ago
        No you don't seem to understand. I am saying that using a pseudonym is NOT helpful to anonymity. It only hurts your anonymity to use any common set of characteristics, like a name, timezone, linguistic quirks, etc. I am saying that even using a name like we do here on HN is bad for someone who is trying to be anonymous, because it ties multiple actions together under a particular identity, and could easily expose more attack surface than necessary, allowing adversaries to target you. Anyway, yes, I know there is more to it- considering who your adversary is, the limitations of your tools, and what configurations of tools are required to raise the cost of retroactive deanonymization above the capacity of your adversary. Every adversary that exists can be outwitted with some effort, if we're talking in terms of the internet and not physical security. Then there's the can of worm that is security. . .
    • slim 5y ago
      opsec is really really really hard. because you don't get used to it as time goes by, you get tired of it. you will discover that sooner or later
      • 5y ago
• tyingq 5y ago
  >These people tend not to be the brightest. Well, for those that are bright, you don't hear anything at all. So it's hard to characterize all of them. I hear something similar on shows like Dateline about how not-bright the murderers are. Yet only about half of homicides are solved in the US every year.
  • Firehawke 5y ago
    Yeah, absolutely this. There's a bias towards the low end of the skill/intelligence curve as those guys get caught doing really stupid shit and end up in the news as a result. I was looking over Wikipedia articles on software piracy groups of the 1980s/90s the other day and it was really interesting how many of them died to either a blatantly stupid move on the part of one of their members/leadership resulting in the whole group dropping like dominoes, or a political split when the leadership could not agree on policy (especially during a leadership changeover) It was particularly interesting to see at least one major group collapse due to leadership getting nailed on phreaking charges, which spilled over to the entire group getting nabbed on the piracy. A few of the brightest in the scene got out when they found an opportune time, then disappeared. At least one or two of them are CEOs in big business, if the articles are to be believed. I bet one or more are reading this now, even!
    • Gollapalli 5y ago
      We had one running for president just a couple years back. Sadly, I don't like him much, nor do many from his home state. But it's kind of cool that he went from hacker to political candidate.
      • octoberfranklin 5y ago
        Isn't he running for governor there now? People might like him better if he didn't keep making 180-degree changes to his stance on major constitutional questions. Whichever side of that issue you find yourself on, it's disturbing how easily he could his tune.
• PheonixPharts 5y ago
  > These people tend not to be the brightest. If they were, they'd generally find legitimate employment, A bit of survivorship bias at work here. Criminal activity is more so a function of risk tolerance than intelligence. However getting caught is certainly a function of intelligence. So your impression is that most criminals you read about being apprehended are people that seem to make many stupid mistakes. But this stupidity is heavily correlated with being caught, not necessarily with being a criminal. That said there's probably also a (negative) correlation between extreme tolerance for risk and intelligence.
  • hillsideduck 5y ago
    I'd further add to that, that in this case the criminal was only 21 years old. To be honest it is to be expected to mess up at some point with this much pressure at that age.
    • lordnacho 5y ago
      I think this is one of those "knowing what you don't know" problems. Most 21 year old kids will not know enough about opsec to understand that they don't know shit about opsec. If you know a little bit you might think "if I just do X, Y, and Z I'll be safe". I suspect once you learn a bit more about the area you will quite quickly decide that it's not actually possible to get away with this kind of thing once the cops are onto you.
      • y4mi 5y ago
        Proving the truth of the old adage again: it's luck not skill if you're getting out of an impossible situation - the skill is to never get into such a situation to begin with. Applying that to this scenario: evading/postponing arrest after the cops started to look into you is luck, never giving them reason to look for/into you is what could be considered skill. Or even more specific: it became luck as soon as it became clear that there was an admin. A lot of criminals that get caught want to be notorious however and build their "street creds".
• 4043D 5y ago
  having the ability to get an infosec job isnt = intelligence. tbh most of the people ive met in the last 5 years who were working corprate infosec / cyber are not particularly skilled or creative just good at filling out reports doing the greyface suit thing.
  • raxxorraxor 5y ago
    And these are the good ones. It is not that infosec hasn't its own snake oil problem.
  • meowface 5y ago
    Absolutely. I'm definitely not saying ability to get an infosec job implies intelligence. But what do you think is implied when someone (with a clean record) is unable to even get jobs like the ones you describe?
• icambron 5y ago
  I don’t exactly disagree with this point, but in mitigation, being constantly vigilant must be exhausting, and even bright people with strong executive function are going to slip up once in a while. It’s just too hard to keep your guard up 100% or the time. Most deceptions, even comically absurd ones like “dude who has two families in different cities” do not require perfect vigilance, whereas running a cybercrime forum does. I bet success at this stuff comes from having an unusually fastidious personality more than anything else. While you’d think bright people would be smart enough to recognize these risks and the comparatively safe, lucrative alternatives available to them, I know plenty of genuinely bright people who’ve made systematically poor decisions about how to run their lives or who have personality defects that otherwise impair their ability to succeed. And that’s even despite my social circles being heavily weighted toward people who went to good universities and hold down good jobs. I’m sure that the ability to make sound, rational, forward-thinking life choices is correlated with intelligence, but I’m not sure how strongly.
  • teraflop 5y ago
    Yeah, "never slipping up" is a high bar. But there's slipping up once, and then there's continuing to commit crimes using an account for at least two years after you've personally told the US federal government that it belongs to you.