15 ms·

>“Users based in the UK will be contacted by the National Crime Agency or police and warned about engaging in cyber crime." Do people really give they actual c

>“Users based in the UK will be contacted by the National Crime Agency or police and warned about engaging in cyber crime." Do people really give they actual contact details to do crimey activities ? I'm not a cybercriminal so I don't know about these sites. But if I had to do something illegal, I wouldn't use my actual name. It seems more like how you set someone up. And they release the news about this site just days before the 1st of April. Why ?

psychphysic 4y ago
The websites will offer PayPal and then email people who apply. This is why we need a robust crypto system. So that you can pay for whatever you want without worrying about giving away who you are.
- mlyle 4y ago
  > This is why we need a robust crypto system. I don't think the need to be able to buy DDoS without getting caught is the most compelling argument. Do you think being able to packet people is a social good?
  - autoexec 4y ago
    It's been used by hacktivists before, although people can already pay with bitcoin or other anonymous forms of payment anyway, so even if you accept the DoS as a valid form of protest (and I'm not sold on that personally) we don't really need any new crypto system
    - GauntletWizard 4y ago
      Organic, home-grown DDOS attacks with dozens to thousands of people using home-internet grade connection, such as the infamous 4-chan LOIC, can reasonably be compared to a form of protest. Loudly blocking the way into a business is pretty common among strikers. For profit DDOS attacks using significantly stolen bandwidth from compromised machines are clearly a different thing entirely. Where you draw the line between them is a discussion topic.
      - KyeRussell 4y ago
        God. LOIC. I haven’t heard that in a while.
    - jkepler 4y ago
      Bitcoin isn't anonymous, its pseudonymous. Unless one is extremely careful and takes a number of secondary steps, bitcoin won't protect your identity.
  - psychphysic 4y ago
    I don't want my personal morals to control what others can pay for. The current system of thought is to make it harder for Peter to buy a coffee in the morning to try and stop Paul from paying for DDOS traffic. Decouple it the way that WhatsApp decoupled itself from the problem of three letter agencies wanting to know message contents with E2EE. As it stands, if some hedge fund doesn't like your product it can pressure VISA to stop letting people to buy it. And that's it game over. It doesn't need to be legally wrong, or even morally wrong. Just don't what some rich dude wants going on.
    - himinlomax 4y ago
      > I don't want my personal morals to control what others can pay for. You don't want your personal morals to prevent others from paying for child prostitutes, hitmen, nerve gas, fissile material or smallpox samples?
      - psychphysic 4y ago
        Unless you're planning to personally oversee every transaction in cash, gold, diamonds, sea shells. It's a false equivalency. Major banks have been found to actively facilitate all those things. So why not have a convenient currency in crypto and just use law enforcement to enforce the law!
- medellin 4y ago
  Almost all crypto at this point can be linked back to a person since it’s mostly bought through a few large exchanges that the government has complete insight into. The only way for it to not be traced outside of monero and maybe a few others that have no adoption is buy in cash in person and transfer it to a never before used address. Mine it yourself and never mix it with your other funds.
- NikolaNovak 4y ago
  I mean... I applaud your honesty and pragmatism as to what are the main reasons why we'd want a working crypto currency system. It's refreshing :)
  - jkepler 4y ago
    Dropping your cynical take, and for reasons other than buying illegal services, bitcoin plus strong privacy tools provides a path towards eventually separating money payments from identity. Money is a form of speech, in that it communicates values. Sometimes freedom of speech requires strong anonymity. I see no reason money shouldn't have the same characteristics. The alternative---that governments and other entities get to surveil all our monetary speech/actions---will only have further chilling effects on freedom and civil society. We need monetary privacy to preserve ordered freedom in society, not to buy criminal services. I'm glad police are trying to reduce DDoS crimes.
    - blitzar 4y ago
      Bitcoin is neither private nor anonymous.
    - NikolaNovak 4y ago
      That is a fair point; I think many people will agree on "statement of problem" - pornography is a quick example which is a perfectly legal activity but a) may be privacy-demanding and b) payment methods are being denied based on... not legal requirements :). Cash was nice - fairly anonymous. Digital anonymity seems to be harder. Currently, Crypto to the best of my understanding is not necessarily the solution - it is extremely trackable inside the system, and vulnerable at the edges of the system.
- KyeRussell 4y ago
  God you libertarians need to pick your battles. This is embarrassing.
yelling_cat 4y ago
They won't be snagging professionals with this, and in this specific case I think that's fine. I expect most of the people who'd fall for it are young or immature people, trying to get back at someone who beat them in a game or argued with them on social media. For whatever reason many of these folks see DDoSing, sending death threats and even swatting as "pranks" instead of crimes. A friendly reminder that doing this stuff can get them in serious trouble could nip that behavior in the bud before something tragic happens.
- vlovich123 4y ago
  Assuming the legal system uses it as a teaching exercise. For some reason I feel like it's going to be used to throw the book at people who would be better served by guidance / opportunities instead.
  - _Wintermute 4y ago
    From what I've heard on DarkNet Diaries, the UK courts seem quite good at picking up intelligent youngsters involved in hacking and giving them a chance to move into cybersecurity.
    - moremetadata 4y ago
      [dead]
    - g_p 4y ago
      The UK has a few pretty good schemes (e.g. Cyber Prevent) that try to intervene and stop young people before they get landed with a criminal record for (lower level) cyber crime - at one point the average age at time of arrest was 17.
- mulmen 4y ago
  But the same systemic weakness that enables Swatting can be exploited here. Specifically that the government assumes good faith. Instead of sending a SWAT team to your house I can sign up for a DDoS in your name.
bragr 4y ago
I remember reading about a guy who set up a fake hitman for hire site and got people all the time contacting him to whack their spouses or whatever, and would provide all the needed details. If the people persisted, he'd pass them onto the police. Edit: found it: RentAHitman.com https://boingboing.net/2022/01/11/how-rentahitman-com-went-from-a-legitimate-business-venture-to-a-weird-honeypot.html https://boingboing.net/2022/01/11/how-rentahitman-com-went-f... https://www.reddit.com/r/AMA/comments/v5422p/i_operate_a_fake_hitman_for_hire_website_that_has/ https://www.reddit.com/r/AMA/comments/v5422p/i_operate_a_fak...
- kube-system 4y ago
  > Despite the claims made by founder Guido Fanelli, RentAHitman.com does not actually comply with the privacy laws as sort forth in the Hitman Information Privacy & Protection Act of 1964 (also known as HIPPA). That is hilarious. I’ve always wondered what HIPPA was, now I know. ;)
autoexec 4y ago
> Do people really give they actual contact details to do crimey activities ? You'd hope not, but lots of people do when it comes to piracy. Private trackers often require accounts and interviews which can cause someone to leave a pretty extensive digital trail if they aren't careful including a clear record of everything they uploaded and when.
rdtsc 4y ago
> Do people really give they actual contact details to do crimey activities ? On one hand we could say that anything helps: if they catch the stupid ones, that's still great. One the other hand, that may be all they're after, if they're compensated or promoted based on cases solved. "Last quarter we caught 120 criminals in our clever snare". That looks very nice on a report so it maybe be that's all they're happy doing.
- rapind 4y ago
  I feel like catching the dumb ones is like using antibiotics. The smarter survivors share information and procreate (forums etc.).
  - kevviiinn 4y ago
    Well police are generally also dumb, so it's far easier for them. It takes a lot of resources to get the ones who are better at hiding
mrguyorama 4y ago
A lot of times the users of these services are very dumb people trying to get very dumb revenge on something they perceive as a very dumb slight
robotnikman 4y ago
You would be surprised, a lot of people have bad opsec when it comes to doing stuff online. When it comes to booting it usually also usually involves kids and teens doing stuff like trying to take down minecraft servers, and a lot of them don't consider such details.
jabroni_salad 4y ago
Cheaters always seem to think they are in the right with what they are doing. I don't see why booters (kicking people off of p2p multiplayer games) would even realize that they are doing a crime, much less doing something wrong. It's just another variety of cheating.
a13n 4y ago
Could be based on IP address too, not just given contact info.
- ipaddr 4y ago
  Spoof an ip address? Unheard of.
  - KyeRussell 4y ago
    With an established TCP connection? Yes? It is. That’s not really spoofing, it’s proxying. For starters, it’s more effort than the majority of these DDoS kiddies are going to. And let’s not be the perfect be the enemy of the good. When the cops rock up and tell Mum that little Johnny has been running amuck online, he’s going to shit his britches and fess up immediately. I trust that law enforcement knows the pattern with this one.
- InCityDreams 4y ago
  There are six of us using my connection. Only one of us is not using a vpn. Sorry, James - someone's gotta go to jail.
unethical_ban 4y ago
I heard a story from a cybersecurity pro that their former spouse worked for US intelligence. The spouse signed up for a message board for people who were trying to land a job at the CIA. The spouse had to use a credit card to sign up. The site was a honeypot by the CIA.
- l33t233372 4y ago
  A site to get a job at $place was set up by $place? What an elaborate honeypot!
  - BLKNSLVR 4y ago
    I've fallen for that scam four times now, and had to work for a few years each time before I felt like attempting to fall victim to the same scam again. The pay is barely satisfactory, but sets a decent precedent for a scam at least. Admittedly, however, I never needed to give out credit card details, just bank account.
layer8 4y ago
I'm pretty sure the identification will be by IP and possibly email address, similar to how bittorrent seeders are identified for copyright infringement.
deleted 4y ago
[deleted]
throwawaydn1729 4y ago
(TFOR -- throwaway for obvious reasons...) Yes, the "genpop" indulging in casual crimey activities are shockingly lax about basic opsec. I did some work consulting for the NCA a few years back (they're a very weird mix of some extremely tech-competent folks, and some parts total luddite) scraping "dark web" forums looking for high-value law enforcement targets -- and it was ludicrously simple to identify "retail" participants who were, for example, trying to buy credit card/bank info dumps, FWIW unless there was some sort of big metrics-driven or politically motivated push, these retail-type small fry were generally ignored in favour of trying to identify and trace down more organised efforts.

psychphysic 4y ago

The websites will offer PayPal and then email people who apply. This is why we need a robust crypto system. So that you can pay for whatever you want without worrying about giving away who you are.

mlyle 4y ago
> This is why we need a robust crypto system. I don't think the need to be able to buy DDoS without getting caught is the most compelling argument. Do you think being able to packet people is a social good?
- autoexec 4y ago
  It's been used by hacktivists before, although people can already pay with bitcoin or other anonymous forms of payment anyway, so even if you accept the DoS as a valid form of protest (and I'm not sold on that personally) we don't really need any new crypto system
  - GauntletWizard 4y ago
    Organic, home-grown DDOS attacks with dozens to thousands of people using home-internet grade connection, such as the infamous 4-chan LOIC, can reasonably be compared to a form of protest. Loudly blocking the way into a business is pretty common among strikers. For profit DDOS attacks using significantly stolen bandwidth from compromised machines are clearly a different thing entirely. Where you draw the line between them is a discussion topic.
    - KyeRussell 4y ago
      God. LOIC. I haven’t heard that in a while.
  - jkepler 4y ago
    Bitcoin isn't anonymous, its pseudonymous. Unless one is extremely careful and takes a number of secondary steps, bitcoin won't protect your identity.
- psychphysic 4y ago
  I don't want my personal morals to control what others can pay for. The current system of thought is to make it harder for Peter to buy a coffee in the morning to try and stop Paul from paying for DDOS traffic. Decouple it the way that WhatsApp decoupled itself from the problem of three letter agencies wanting to know message contents with E2EE. As it stands, if some hedge fund doesn't like your product it can pressure VISA to stop letting people to buy it. And that's it game over. It doesn't need to be legally wrong, or even morally wrong. Just don't what some rich dude wants going on.
  - himinlomax 4y ago
    > I don't want my personal morals to control what others can pay for. You don't want your personal morals to prevent others from paying for child prostitutes, hitmen, nerve gas, fissile material or smallpox samples?
    - psychphysic 4y ago
      Unless you're planning to personally oversee every transaction in cash, gold, diamonds, sea shells. It's a false equivalency. Major banks have been found to actively facilitate all those things. So why not have a convenient currency in crypto and just use law enforcement to enforce the law!
medellin 4y ago
Almost all crypto at this point can be linked back to a person since it’s mostly bought through a few large exchanges that the government has complete insight into. The only way for it to not be traced outside of monero and maybe a few others that have no adoption is buy in cash in person and transfer it to a never before used address. Mine it yourself and never mix it with your other funds.
NikolaNovak 4y ago
I mean... I applaud your honesty and pragmatism as to what are the main reasons why we'd want a working crypto currency system. It's refreshing :)
- jkepler 4y ago
  Dropping your cynical take, and for reasons other than buying illegal services, bitcoin plus strong privacy tools provides a path towards eventually separating money payments from identity. Money is a form of speech, in that it communicates values. Sometimes freedom of speech requires strong anonymity. I see no reason money shouldn't have the same characteristics. The alternative---that governments and other entities get to surveil all our monetary speech/actions---will only have further chilling effects on freedom and civil society. We need monetary privacy to preserve ordered freedom in society, not to buy criminal services. I'm glad police are trying to reduce DDoS crimes.
  - blitzar 4y ago
    Bitcoin is neither private nor anonymous.
  - NikolaNovak 4y ago
    That is a fair point; I think many people will agree on "statement of problem" - pornography is a quick example which is a perfectly legal activity but a) may be privacy-demanding and b) payment methods are being denied based on... not legal requirements :). Cash was nice - fairly anonymous. Digital anonymity seems to be harder. Currently, Crypto to the best of my understanding is not necessarily the solution - it is extremely trackable inside the system, and vulnerable at the edges of the system.
KyeRussell 4y ago
God you libertarians need to pick your battles. This is embarrassing.

yelling_cat 4y ago

They won't be snagging professionals with this, and in this specific case I think that's fine. I expect most of the people who'd fall for it are young or immature people, trying to get back at someone who beat them in a game or argued with them on social media. For whatever reason many of these folks see DDoSing, sending death threats and even swatting as "pranks" instead of crimes. A friendly reminder that doing this stuff can get them in serious trouble could nip that behavior in the bud before something tragic happens.

vlovich123 4y ago
Assuming the legal system uses it as a teaching exercise. For some reason I feel like it's going to be used to throw the book at people who would be better served by guidance / opportunities instead.
- _Wintermute 4y ago
  From what I've heard on DarkNet Diaries, the UK courts seem quite good at picking up intelligent youngsters involved in hacking and giving them a chance to move into cybersecurity.
  - moremetadata 4y ago
    [dead]
  - g_p 4y ago
    The UK has a few pretty good schemes (e.g. Cyber Prevent) that try to intervene and stop young people before they get landed with a criminal record for (lower level) cyber crime - at one point the average age at time of arrest was 17.
mulmen 4y ago
But the same systemic weakness that enables Swatting can be exploited here. Specifically that the government assumes good faith. Instead of sending a SWAT team to your house I can sign up for a DDoS in your name.

bragr 4y ago

I remember reading about a guy who set up a fake hitman for hire site and got people all the time contacting him to whack their spouses or whatever, and would provide all the needed details. If the people persisted, he'd pass them onto the police. Edit: found it: RentAHitman.com https://boingboing.net/2022/01/11/how-rentahitman-com-went-from-a-legitimate-business-venture-to-a-weird-honeypot.html https://boingboing.net/2022/01/11/how-rentahitman-com-went-f... https://www.reddit.com/r/AMA/comments/v5422p/i_operate_a_fake_hitman_for_hire_website_that_has/ https://www.reddit.com/r/AMA/comments/v5422p/i_operate_a_fak...

kube-system 4y ago
> Despite the claims made by founder Guido Fanelli, RentAHitman.com does not actually comply with the privacy laws as sort forth in the Hitman Information Privacy & Protection Act of 1964 (also known as HIPPA). That is hilarious. I’ve always wondered what HIPPA was, now I know. ;)

autoexec 4y ago

> Do people really give they actual contact details to do crimey activities ? You'd hope not, but lots of people do when it comes to piracy. Private trackers often require accounts and interviews which can cause someone to leave a pretty extensive digital trail if they aren't careful including a clear record of everything they uploaded and when.

rdtsc 4y ago

> Do people really give they actual contact details to do crimey activities ? On one hand we could say that anything helps: if they catch the stupid ones, that's still great. One the other hand, that may be all they're after, if they're compensated or promoted based on cases solved. "Last quarter we caught 120 criminals in our clever snare". That looks very nice on a report so it maybe be that's all they're happy doing.

rapind 4y ago
I feel like catching the dumb ones is like using antibiotics. The smarter survivors share information and procreate (forums etc.).
- kevviiinn 4y ago
  Well police are generally also dumb, so it's far easier for them. It takes a lot of resources to get the ones who are better at hiding

mrguyorama 4y ago

A lot of times the users of these services are very dumb people trying to get very dumb revenge on something they perceive as a very dumb slight

robotnikman 4y ago

You would be surprised, a lot of people have bad opsec when it comes to doing stuff online. When it comes to booting it usually also usually involves kids and teens doing stuff like trying to take down minecraft servers, and a lot of them don't consider such details.

jabroni_salad 4y ago

Cheaters always seem to think they are in the right with what they are doing. I don't see why booters (kicking people off of p2p multiplayer games) would even realize that they are doing a crime, much less doing something wrong. It's just another variety of cheating.

a13n 4y ago

Could be based on IP address too, not just given contact info.

ipaddr 4y ago
Spoof an ip address? Unheard of.
- KyeRussell 4y ago
  With an established TCP connection? Yes? It is. That’s not really spoofing, it’s proxying. For starters, it’s more effort than the majority of these DDoS kiddies are going to. And let’s not be the perfect be the enemy of the good. When the cops rock up and tell Mum that little Johnny has been running amuck online, he’s going to shit his britches and fess up immediately. I trust that law enforcement knows the pattern with this one.
InCityDreams 4y ago
There are six of us using my connection. Only one of us is not using a vpn. Sorry, James - someone's gotta go to jail.

unethical_ban 4y ago

I heard a story from a cybersecurity pro that their former spouse worked for US intelligence. The spouse signed up for a message board for people who were trying to land a job at the CIA. The spouse had to use a credit card to sign up. The site was a honeypot by the CIA.

l33t233372 4y ago
A site to get a job at $place was set up by $place? What an elaborate honeypot!
- BLKNSLVR 4y ago
  I've fallen for that scam four times now, and had to work for a few years each time before I felt like attempting to fall victim to the same scam again. The pay is barely satisfactory, but sets a decent precedent for a scam at least. Admittedly, however, I never needed to give out credit card details, just bank account.

layer8 4y ago

I'm pretty sure the identification will be by IP and possibly email address, similar to how bittorrent seeders are identified for copyright infringement.

deleted 4y ago

[deleted]

throwawaydn1729 4y ago

(TFOR -- throwaway for obvious reasons...) Yes, the "genpop" indulging in casual crimey activities are shockingly lax about basic opsec. I did some work consulting for the NCA a few years back (they're a very weird mix of some extremely tech-competent folks, and some parts total luddite) scraping "dark web" forums looking for high-value law enforcement targets -- and it was ludicrously simple to identify "retail" participants who were, for example, trying to buy credit card/bank info dumps, FWIW unless there was some sort of big metrics-driven or politically motivated push, these retail-type small fry were generally ignored in favour of trying to identify and trace down more organised efforts.