12 ms·
Finland’s most-wanted hacker nabbed in France
- deleted 4y ago[deleted]
- rippercushions 4y agoContext on his most notorious hack: https://en.wikipedia.org/wiki/Vastaamo_data_breach https://en.wikipedia.org/wiki/Vastaamo_data_breach IMHO Zeekill represents the very worst kind of hacker: a greedy troll script kiddie who knows just enough to cause damage, and doesn't give a shit about the very real human cost.
- fsckboy 4y ago> the very worst kind of hacker: a greedy troll script kiddie who knows just enough I know it feels good to make fun of and denigrate him, but frankly a worse kind of hacker is one who really knows what he is doing
- rippercushions 4y agoAt least we'd have a possibility of learning something new then.
- MuffinFlavored 4y agoI’m out of the loop but can you explain how he was able to get documents to therapy patients just by being a script kiddie? like script kiddie to me, is trying to DDOS somebody with ping
- jacquesm 4y agoUnsecured DB on internet facing server with default password/uid combo.
- Ekaros 4y agoThat is the lowest skill level. Next one up which still qualifies as script kiddie is one that uses ready made attacks and libraries and so on in spray and pray style. Trying them in every possible place and finding those setup with utter incompetence.
- boeingUH60 4y ago> Security experts soon discovered Ransom Man had mistakenly included an entire copy of their home folder, where investigators found many clues pointing to Kivimäki’s involvement. The bane of every criminal. You only have to make one mistake to get caught and there are many chances to make that mistake. Many criminals on the run assume they’re smart, but luck plays a big role in getting caught or not…I mean, this guy got caught because of an unrelated case of domestic violence.
- ChuckNorris89 4y agoIndeed, a lot of criminals think they're smart and that they'll never get caught while they do stupid shit. An acquaintance of mine tried to dodge his mandatory military service by moving to the neighboring country and would (foolishly) drive to his family across the border every now and then thinking that because Schengen has no borders he would never get caught. And it worked for a couple of years, until one day when a police car stopped him for a busted tail light and handed him over to the military police. If you're gonna break the law, you at least gotta be smart and careful about it.
- ghaff 4y agoSome variation of not breaking ties with (supposed) friends and family generally is a pretty common theme in people getting their cover blown.
- capableweb 4y ago> And it worked for a couple of years, until one day when a police car stopped him for a busted tail light and handed him over to the military police. Hence the always-true adage: If you're gonna break the law, only break one law at a time, not multiple.
- netsharc 4y agoSome Schengen borders have cameras that scan license plates...
- 4y ago
- pasiaj 4y agoThis was one nefarious operation by the hacker: - He hacked the patient files of a psychotherapy center Vastaamo. This included therapy notes for more than 22.000 patients. - First the hacker blackmailed the therapy center. - Next he started blackmailing individual patients. - Finally he released the files online revealing very private information on thousands of patients. I can only imagine the horror felt by the people whose therapy notes were made public.
- jnsie 4y agoAbsolutely heinous
- tough 4y agoand exactly why a paranoid person like me might abstain from ever seeking counsel from a therapist. Not worth it
- threatofrain 4y agoI don’t know if it would work but you might ask the therapist to have in writing that they will never take records of your sessions except for the bare minimum required by accounting.
- Sakos 4y agoThis depends on where you live and what the facility is like, no? At least in Germany, patient records like therapy notes are only hard copy. I don't see why they should ever be digitalized and I'd never go to a therapist or a facility that did have notes in digital form. I'm not particularly paranoid either, I'm just aware of how common it is for companies to be hacked and how rarely they face any consequences for not sufficiently investing in IT security.
- Tycho 4y agoEven if something only exists as hard copy today, who knows if it will stay that way. Some new regulation might come along requiring practices to digitise all their records.
- pasiaj 4y ago[dupe]
- Hamuko 4y ago>hacked the patient files By accessing a publicly available database server with default authentication details.
- joemazerino 4y agoBlackhats are notorious for bad opsec.
- namaria 4y agoBlackhats that get caught get notorious...
- lefstathiou 4y agoIt’s a losing proposition eventually even for the ones that don’t. They are competing against significantly more people with significantly greater resources and access. It’s like those hackers that held up the energy company a few years ago and woke up one day to find their anonymous crypto wallets empty. Was supposed to be impossible but that doesn’t account for America literally owning the internet back bone. Cause enough trouble and they’ll show up at your door. The only protection is state sponsorship (ie Russian and Chinese hackers on government payroll).
- namaria 4y agoLimiting scope of activity is opsec
- seb1204 4y agoCame here to ask why he is called a hacker when he is clearly lacking in the responsibility and do no harm side. Cracker, Blackhat or script kid...
- spyremeown 4y agoDefinition of a script kiddie with too much time on their hands... I hate people like him. Could've done something good with his life (like getting into info/cybersec!).
- boomskats 4y ago> like getting into info/cybersec! I'd argue that's exactly what he did. He's just gone for the Mitnick method.
- spyremeown 4y agoMitnick was (is) great at social engineering. This dude is just an a-hole.
- watwut 4y agoMitnick was asshole too.
- KMag 4y agoI have some sympathy for Mitnick. My understanding is that most of the damage he caused was due to opportunity cost and direct costs of catching him, at a time when a direct path into a security career was less obvious.
- bawolff 4y agoTbf the average infosec job is writing lots of policies, checking to see if people follow them, writing reports, nagging teams to update their outdated dependencies, etc. Of course there are many types of infosec professionals and not all infosec jobs are like this, but i kind of doubt someone like this would be all that happy in an entry level infosec job.
- GuB-42 4y agoThat's why despite having some knowledge about infosec, I don't want to make it my job. Pentesting looks like fun, but the real job seems to be about writing reports, applying policies you know don't make sense and not applying policies you know make sense, and if you block something, you get yelled at because you blocked it, allow it and you get yelled at because you allowed it. This is the kind of job where you are given a list of a thousand software and dependencies, get asked about vulnerabilities, find thousands of them, look how relevant each one of them is, write a report about what needs to be fixed/updated, get told it is too expensive and that you should find a cheaper solution and half ass something that you know is both too little and too much just to fit the allocated budget.
- m00dy 4y ago>>> “It was a huge opsec [operational security] fail, because they had a lot of stuff in there — including the user’s private SSH folder, ..." no shit sherlock
- dang 4y agoCan you please stop posting unsubstantive and/or flamebait comments? You've been doing it repeatedly, unfortunately, and we eventually have to ban such accounts. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- hnthrowaway0315 4y agoI don't get the logic here. If I had the ability to pull off a sophisticated hack, why shouldn't I sell my skill to say a corporation or intelligence agency but instead tried to grab quick dough and got caught? Am I stupid enough to believe that I can be out of the radar of state power?
- deleted 4y ago[deleted]
- Hamuko 4y agoNothing about this was sophisticated.
- hnthrowaway0315 4y agoI mean the fact it got carried out successfully might say something. I don't know about the tech details though...
- jacquesm 4y agoInternet exposed DB on a server with default credentials... not much of a hack, no less damaging for that though.
- xwolfi 4y ago[flagged]
- jacquesm 4y agoI don't think that's fair to autists.
- Slighted 4y agoPeople have varying motivations for committing crimes. Highly skilled (or just simply lucky) black hat hackers can potentially make millions, which is far more than governments and corporations will hand over for equivalent activities.
- ed25519FUUU 4y agoFitting that the criminal blackmailing people with their own personal information accidentally uploaded his home folder, including his SSH keys and known_hosts file.
- grugagag 4y agoSounds like kharma caught up with him swiftly
- orwin 4y agoI don't know if this is ridiculous or sad... The guy obviously need psychiatric advice and "hacked" then blackmail a psychiatric institute. But good job by the Courbevoie police. If it was any city north of Asniere i would have been more than impressed by the changes of our police force, but still, responding quickly to domestic violence even in a rich city is an improvement compared to five years ago. Still nowhere close to Spain, but baby steps.
- kzrdude 4y agoHe's got a real named reddit account, that's an interesting choice.
- grugagag 4y agoHe could’ve used that as decoy while posting bad stuff with a different account.
- costco 4y agoThese are his from a long time ago: https://camas.unddit.com/#{%22author%22:%22uhx%22,%22resultSize%22:100} https://camas.unddit.com/#{%22author%22:%22uhx%22,%22resultS... https://camas.unddit.com/#{%22author%22:%22uhxuhxuhx%22,%22resultSize%22:100} https://camas.unddit.com/#{%22author%22:%22uhxuhxuhx%22,%22r... A bunch of IRC logs too: https://google.com/?q=%22zeekill%22+site%3Apastebin.com https://google.com/?q=%22zeekill%22+site%3Apastebin.com Including one where he basically extorts one the founders of ImageShack. He has left quite the trail.
- sourcecodeplz 4y agoWhy would the records be in a database in the first place? That seems like such a sensitive type of info, at least don't attach real names to them geeZ.
- VWWHFSfQ 4y agowhere else should they put them
- sourcecodeplz 4y agoOn paper I imagine but I wouldn't know.
- lalopalota 4y agofiling cabinet
- grugagag 4y agoI was wondring too what’s the need of overdigiting everything in psychiatry. Sure, stuff becomes searchable and is easy to archive but the the risks don’t compare with locked down file cabinets.
- LarryMullins 4y agoTherapists exist in a society where everything is digitized so they don't even think twice about digitizing these records. They aren't tech workers, much less security experts, so they really do this without a second thought.
- Sharlin 4y agoI don’t think so. Many if not most therapists would likely much prefer only having notes on paper.
- Sharlin 4y ago
- potrebitel 4y ago> "Finnish police said Kivimäki also used the nicknames “Ryan”, “RyanC” and “Ryan Cleary”" There used to be a user on HN, going by the nickname "ryanlol" [0] who seemed to have (had) good hacking knowledge. Could be the same person, could be not. But they had good comments here and there, was fun to read back then. [0] : https://news.ycombinator.com/user?id=ryanlol https://news.ycombinator.com/user?id=ryanlol
- jacquesm 4y agoHe got warned by his buddy nachash (loldoxbin) that he should unplug his internet connection if he didn't want to spend time in jail again. https://news.ycombinator.com/threads?id=nachash https://news.ycombinator.com/threads?id=nachash He didn't take that advice. He's been on HN under a large number of accounts, in particular giving people advice on obtaining alternate identification papers (Romania was mentioned in particular). https://news.ycombinator.com/item?id=34156119 https://news.ycombinator.com/item?id=34156119 So much for that I guess.
- rdl 4y agoI assumed that was the "real" Ryan Cleary (LulzSec), not the Finland guy who was impersonating him.
- jacquesm 4y agohttps://stylometry.net/user?username=ryanlol https://stylometry.net/user?username=ryanlol The first 10 are afaik accurate, the last stopped posting 3 days ago so that's a point of evidence.
- nibbleshifter 4y agoThe "real" Ryan Cleary hasn't really been online in any capacity as "himself" since his arrest over ten years ago.
- costco 4y agoThat was him: https://news.ycombinator.com/item?id=10846051 https://news.ycombinator.com/item?id=10846051. He's been posting under various alts since, see the stylometry.net link below. Reading his comment history, unless he was just lying for HN e-cred it seems he was very wealthy. Probably an early BTC user?
- zoover2020 4y agoShame their talent couldn't be used to do good indeed. Although posts about relatively young hackers who went the rogue black hat route always intrigue me. I used to be a super curious script kiddy but fortunately found my solace in programming (relatively unharmful) scripts for games and private servers that'd only affect virtual economies. But I also used to stroll gray/black hat forums out of curiosity and always wonder where I would've eventually end up if I did go down that path. Fortunately, I'm in FANG now and make good bucks to never have to consider black hat again. It's just in the back of my mind: what if ...?
- dry_soup 4y agoThere wasn't much talent involved in this hack. The CEO and solo self-taught developer of the psychotherapy place left a test server running on the public internet with the username and password root / root.
- riskpreneurship 4y agoYou would probably make more money if you were any good at gray/black hat stuff. Further, if you were less blatantly evil than this individual, you'd probably be able to finagle a slap on the wrist followed by a stable career in civilian street if/when you got busted. One of the things that you learn as you grow older is that you can't be successful and have a conscience at the same time in this world. Software developers are fortunate enough to be able to scrape out a comfortable existence without stooping too far, but don't kid yourself: the large TechCos that sign our paychecks and buy our startups are not paragons of virtue.
- jacquesm 4y agoSlight problem though: a slap on the wrist is still a criminal record, and if you're unlucky your 'slap on the wrist' may end up being a much harsher sentence and if you piss off the wrong person other kinds of retribution. Large TechCos can - for now - not be jailed but you can and you will, see TFA. Less blatantly evil doesn't mean you're going to walk away free, besides, you'll be a blackmail target for life. Oh, and it is quite possible to both be successful and to have a working conscience.
- bilekas 4y ago> Kivimäki was ultimately convicted of orchestrating more than 50,000 cybercrimes. But largely because he was still a minor at the time (17) , he was given a 2-year suspended sentence and ordered to forfeit EUR 6,558. When crimes perpetuated online can effect so many people, can we stop treating them like regular crimes. That's ridiculous. I might aswel defraud as many people as possible before 18 years and basically get away with it.
- jacquesm 4y agoWell, he got away with it so far. But note the 'suspended' bit. That may well come back to bite him now.
- rendall 4y ago> Kivimäki, a 25 year-old... involvement in cybercrime dates back to at least 2008 Whoa. Just 11 years old he started. Got busted after a domestic violence call, after a night out. Just, a pathetic life.
- qwerty456127 4y agoWe should stop arresting hackers. We should pay them instead. Not just in officially declared bounty programs with specific conditions but anytime they break something and tell us what and how. This is the only way we can build a reasonably secure digital ecosystem. If we don't, most of us will have their sensitive data leaked sooner or later.
- npteljes 4y agoThe largest problem with this is that when you pay someone for blackmail, there's nothing stopping them from blackmailing you again. Same with extortion, and frankly, same with this guy right in this case. Governments also don't negotiate with terrorists, you might have heard that before. https://en.wikipedia.org/wiki/Government_negotiation_with_terrorists https://en.wikipedia.org/wiki/Government_negotiation_with_te... except when they do of course.
- nurettin 4y agoA lot of talented people get paid for white hatting. This guy just really really wanted to earn money as a criminal. You can also argue that he could have gone the bug bounty route if he could, but didn't have the skills.
- m000 4y ago> We should stop arresting hackers. We should pay them instead. This like advocating, "We should stop arresting people for gun violence. We should pay them instead." The vast majority of these "hackers" just happen to be more handy with the digital equivalent of a gun and have more propensity for crime than your average Joe. Their "tell us what and how" would hardly worth your time, nevermind paying.
- jcq3 4y ago"Kivimäki’s apparent indifference to hiding his tracks" how come
- nibbleshifter 4y agoHe was a literal child/teenager for most of his criminal career.
- sylware 4y agodid not know scandinavia could have such trash.
- namaria 4y agoThat's racist. Scandinavia (and Baltic countries, which is where this guys is from btw) has plenty of trash.
- KMag 4y agoIt could be nationalist/originist instead of racist, depending on if they literally thought Scandanavia didn't have such people, or if they intended to convey that they didn't think ethnic Scandanavians could act in such a way.
- sylware 4y agoNot even ethnic: "culture", the scandinavian _CULTURE_. People seeing race/ethnic stuff here are severely mistaken.
- namaria 4y agoSure let's pretend now it's not about the ugly thing now that I shine a light on it. Thankfully, enough reasonable doubt was left in the wording. I'm sure OP meant geographically for some reason. Maybe they thought you need more sun to become trashy.
- KMag 4y agoThere are really terrible people everywhere, luckily in low percentages.