4 ms·

Why do these infamous master criminal hackers always reuse passwords/handles and leave traces? It's relatively simple to use random credentials everywhere and

Why do these infamous master criminal hackers always reuse passwords/handles and leave traces? It's relatively simple to use random credentials everywhere and to completely disconnect your hacker persona from RL. Or is it that we only hear about those that do this...

reidjs 3y ago
Criminals are just as lazy, if not lazier, than "regular" people.
- Lacerda69 3y ago
  ok sure, but that is the one thing they should not be lazy about. Not that I'm complaining, just curious.
  - baq 3y ago
    Only some criminals (just like only some people in general) have any awareness about IT opsec.
  - lamontcg 3y ago
    Their adversaries change over time, and their early success breeds complacency. For the first decade of their career they're really only facing people who will bust them if they're totally stupid and deliver themselves to the authorities practically gift wrapped. Because the flip side of most criminals being lazy is that most police are lazy. But then after a decade they wind up with someone at least mildly competent getting interested in them and they've left traces all over the place.
bparsons 3y ago
One thing I learned from a brief stint at a criminal law firm: criminals are usually pretty dumb. In TV and movies, they are usually depicted as clever, but the opposite is usually true. These are people that put themselves at huge legal and physical risk to make a similar amount of money to what they could get in a normal job.
- sodality2 3y ago
  https://commons.m.wikimedia.org/wiki/File:Survivorship-bias.svg https://commons.m.wikimedia.org/wiki/File:Survivorship-bias.... You only defend the ones who get caught! By definition you never defend one who hasn’t been caught doing something suspicious.
krebsonsecurity 3y ago
Some of the exposure in these cases is due to the fact that you have cybercriminals who've been doing the same things for more than a decade. That is a very long time in which to make just a few key opsec mistakes, and also most RU cybercriminals back then did not take as much care to cover their tracks as they do today.
jliptzin 3y ago
There are a lot of criminals out there, these are just the ones that get caught.
devit 3y ago
1. You learn about those and not the ones who successfully hide and keep a low profile 2. Proper security takes time and effort, so there is less time to devote to actual business, which means they are less likely to be successful at a scale that makes them widely known
nicwolff 3y ago
Confirmation bias – we don't catch the smart ones.
oh_sigh 3y ago
We do hear about the ones with good opsec too, sometimes. For example, Alphabay(darknet drug dealing site) got rolled up, the #1 was going to jail for a long time before committing suicide, but the #2 - DeSnake, remained anonymous and free. Then, a few years later, he relaunched Alphabay and I'm fairly certain law enforcement still has no idea who or where he is.
- fragmede 3y ago
  the biggest ebook archive operator Anna is another. somehow she's managed to avoid capture despite being very wanted by the powers that be. and she posts on HN!
  - mschuster91 3y ago
    And Alexandra Elbakyan, the creator of Sci Hub, is also being in the crosshairs of the US government [1]. [1] https://en.wikipedia.org/wiki/Alexandra_Elbakyan https://en.wikipedia.org/wiki/Alexandra_Elbakyan
- Lacerda69 3y ago
  that's impressive! gonna read up on that story
  - oh_sigh 3y ago
    An interview he did with Wired is a good start: https://www.wired.com/story/alphabay-desnake-dark-web-interview/ https://www.wired.com/story/alphabay-desnake-dark-web-interv...
libraryatnight 3y ago
I have a few ideas. 1. We've entered the full on "Oh shit, you don't need to be a hacker to do computer crime" phase of computer crime. Smash and grabs, just pay some disgruntled employee for their credentials, hire people to do the tech bits you need done - you don't have to be a 1337 hacker to get involved with this stuff. So they may not care or even be aware of much forum opsec. 2. Does Russia care about Russians ripping off other countries? How hard do you have to try to hide it if you just dump the username and move on when you're found out because there's not any repercussions from local law? I don't think anybody is going to go to Russia and get them any time soon.
- rightbyte 3y ago
  If you are doing illegal stuff on the interwebs it might be benifital if your trails ends in North Korea or whatever. I've always thought all these "hacker in X" are scams from security consultants to get their face in media. I mean how can they possibly know.
  - Lacerda69 3y ago
    yea hack "attribution" is mostly bs
JCharante 3y ago
because that's not their intention from the start. They act in a grey area and leave breadcrumbs and then don't create a new persona to continue because they want to continue using the reputation/connections they previously have or they slip up.
denton-scratch 3y ago
> infamous master criminal hackers If they're already infamous, it's too late for them. This dude seems to have been a real amateur; he not only re-uses passwords, he re-uses usernames in his passwords. He puts his birthdate in a password. He doesn't have a clue. He seems to be a low-grade criminal who should have stuck to fencing stolen goods from a lockup garage, but stepped out of his league.
- ceautery 3y ago
  > He puts his birthdate in a password I imagine that date is in a lot of Russian passwords. That was the day of the '91 coup attempt against Gorbachev.
ogurechny 3y ago
Often these aren't hackers, these are organizers of the process, or, simply put, “businessmen”. Stolen credentials and residential proxies come from one crowd, local resellers come from another crowd, etc. Also, you've believed in “traces” found by clever detectives only because it was hinted at. I suppose that most of the data comes from snitches, arrested users, and hacks, then gets washed and presented as “found” by some “service”. What Krebs is suspiciously silent about is who provided (il)legal protection for the service. I guess this type of dirt on Russian officials is collected to a different folder inaccessible without clearance. Hence the framing of the lone Robin Hood story.

reidjs 3y ago

Criminals are just as lazy, if not lazier, than "regular" people.

Lacerda69 3y ago
ok sure, but that is the one thing they should not be lazy about. Not that I'm complaining, just curious.
- baq 3y ago
  Only some criminals (just like only some people in general) have any awareness about IT opsec.
- lamontcg 3y ago
  Their adversaries change over time, and their early success breeds complacency. For the first decade of their career they're really only facing people who will bust them if they're totally stupid and deliver themselves to the authorities practically gift wrapped. Because the flip side of most criminals being lazy is that most police are lazy. But then after a decade they wind up with someone at least mildly competent getting interested in them and they've left traces all over the place.

bparsons 3y ago

One thing I learned from a brief stint at a criminal law firm: criminals are usually pretty dumb. In TV and movies, they are usually depicted as clever, but the opposite is usually true. These are people that put themselves at huge legal and physical risk to make a similar amount of money to what they could get in a normal job.

sodality2 3y ago
https://commons.m.wikimedia.org/wiki/File:Survivorship-bias.svg https://commons.m.wikimedia.org/wiki/File:Survivorship-bias.... You only defend the ones who get caught! By definition you never defend one who hasn’t been caught doing something suspicious.

krebsonsecurity 3y ago

Some of the exposure in these cases is due to the fact that you have cybercriminals who've been doing the same things for more than a decade. That is a very long time in which to make just a few key opsec mistakes, and also most RU cybercriminals back then did not take as much care to cover their tracks as they do today.

jliptzin 3y ago

There are a lot of criminals out there, these are just the ones that get caught.

devit 3y ago

1. You learn about those and not the ones who successfully hide and keep a low profile 2. Proper security takes time and effort, so there is less time to devote to actual business, which means they are less likely to be successful at a scale that makes them widely known

nicwolff 3y ago

Confirmation bias – we don't catch the smart ones.

oh_sigh 3y ago

We do hear about the ones with good opsec too, sometimes. For example, Alphabay(darknet drug dealing site) got rolled up, the #1 was going to jail for a long time before committing suicide, but the #2 - DeSnake, remained anonymous and free. Then, a few years later, he relaunched Alphabay and I'm fairly certain law enforcement still has no idea who or where he is.

fragmede 3y ago
the biggest ebook archive operator Anna is another. somehow she's managed to avoid capture despite being very wanted by the powers that be. and she posts on HN!
- mschuster91 3y ago
  And Alexandra Elbakyan, the creator of Sci Hub, is also being in the crosshairs of the US government [1]. [1] https://en.wikipedia.org/wiki/Alexandra_Elbakyan https://en.wikipedia.org/wiki/Alexandra_Elbakyan
Lacerda69 3y ago
that's impressive! gonna read up on that story
- oh_sigh 3y ago
  An interview he did with Wired is a good start: https://www.wired.com/story/alphabay-desnake-dark-web-interview/ https://www.wired.com/story/alphabay-desnake-dark-web-interv...

libraryatnight 3y ago

I have a few ideas. 1. We've entered the full on "Oh shit, you don't need to be a hacker to do computer crime" phase of computer crime. Smash and grabs, just pay some disgruntled employee for their credentials, hire people to do the tech bits you need done - you don't have to be a 1337 hacker to get involved with this stuff. So they may not care or even be aware of much forum opsec. 2. Does Russia care about Russians ripping off other countries? How hard do you have to try to hide it if you just dump the username and move on when you're found out because there's not any repercussions from local law? I don't think anybody is going to go to Russia and get them any time soon.

rightbyte 3y ago
If you are doing illegal stuff on the interwebs it might be benifital if your trails ends in North Korea or whatever. I've always thought all these "hacker in X" are scams from security consultants to get their face in media. I mean how can they possibly know.
- Lacerda69 3y ago
  yea hack "attribution" is mostly bs

JCharante 3y ago

because that's not their intention from the start. They act in a grey area and leave breadcrumbs and then don't create a new persona to continue because they want to continue using the reputation/connections they previously have or they slip up.

denton-scratch 3y ago

> infamous master criminal hackers If they're already infamous, it's too late for them. This dude seems to have been a real amateur; he not only re-uses passwords, he re-uses usernames in his passwords. He puts his birthdate in a password. He doesn't have a clue. He seems to be a low-grade criminal who should have stuck to fencing stolen goods from a lockup garage, but stepped out of his league.

ceautery 3y ago
> He puts his birthdate in a password I imagine that date is in a lot of Russian passwords. That was the day of the '91 coup attempt against Gorbachev.

ogurechny 3y ago

Often these aren't hackers, these are organizers of the process, or, simply put, “businessmen”. Stolen credentials and residential proxies come from one crowd, local resellers come from another crowd, etc. Also, you've believed in “traces” found by clever detectives only because it was hinted at. I suppose that most of the data comes from snitches, arrested users, and hacks, then gets washed and presented as “found” by some “service”. What Krebs is suspiciously silent about is who provided (il)legal protection for the service. I guess this type of dirt on Russian officials is collected to a different folder inaccessible without clearance. Hence the framing of the lone Robin Hood story.