19 ms·

IAmA a malware coder and botnet operator, AMA

• slig 14y ago
  He's also been a coder for only one year... if he actually modifies stuff, that sounds very impressive.
• JWhiteaker 14y ago
  Magnetic stripes are the most hilarious thing ever, but still work almost everywhere on the globe. I am amazed that magnetic stripes are still the norm for credit cards in the US. Europe has managed to move all but completely to chip-based cards, but the US hasn't. Does the cost of fraud due to magnetic stripes outweigh the cost to upgrade the entire US system, or is the market just too fragmented to coordinate such a transition?
  • ajross 14y ago
    Credit card fraud is actually a fairly small problem in the US. Wikipedia tells me that the total cost of fraud is 0.07% of the transaction value. And I suspect (without evidence) that the bulk of this is made up of remote purchases, not swiped activity. Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat. No, they're probably not actually worth it in terms of the cost of upgrading all the infrastructure. A serious upgrade would need to look at things like two factor authentication, c.f. Google Wallet, etc...
    • raverbashing 14y ago
      "Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat" Absolutely not! In the US fraud may be small (but it's increasing). But magnetic stripes are very unsafe Chip'n'Pin may have some issues, but it's much safer to most common attacks such as - card stripers (very inconspicuous) - physical theft of the card (because it requires a pin) And, as someone that had a striped card, it's a pain (even if liabilities are $0)
      • ajross 14y ago
        You're missing the point entirely. I'm not saying that chip & pin has no value. I'm saying that the value it has is finite (i.e. it saves money equal to the amount of fraud it eliminates) and needs to be weight against the cost of replacing all the card reader infrastructure. And I argue that the fact the US has not upgraded is an existence proof that the upgrade cost[1] outweighs the savings. [1] Really the amortized upgrade cost. Remember that chips are dinosaur technology already, and have known problems. What's the point of doing an upgrade if you need to dump it all and start over in 6 years anyway?
        • raverbashing 14y ago
          "cost of replacing all the card reader infrastructure" I'm not sure how many PoS are already equipped to deal with chip cards. In the USA/Canada it's hit or miss (most misses), and in Europe it was the standard 10 years ago (but most readers take swipe cards). Replacing cards is cheap and they can be replaced as they expire What would be the upgrade cost for each PoS? $100? Some systems are more integrated than others (like card reader integrated with the register as one device) so this may cost more. Or maybe it's just a matter of issuing the cards to justify the stores to upgrade.
          • maxerickson 14y ago
            My previous U.S. card had a chip. The very recent replacement came without one. So they aren't really moving in the direction of issuing cards with chips. I never actually encountered a situation where I was aware I could use the chip, over 5 years or whatever it was.
          • chris24 14y ago
            I've found that most Canadian retailers seem to support chip cards now.
        • caf 14y ago
          The fact that the US has not upgraded is not an existence proof, it's simply one piece of supporting evidence. There are other possible reasons why the upgrade hasn't happened even if it makes overall economic sense - perhaps the cost of fraud and the cost of upgrades aren't borne by the same actors; perhaps there's some kind of game theoretic problem like a first mover disadvantage; perhaps the actors aren't acting entirely rationally. It seems like the upgrade of terminal equipment could be done quite cheaply if it was done as part of the regular cycle of equipment refresh, for example.
    • farnsworth 14y ago
      It's not fair to just look at it in terms of the cost of fraud vs. profit. Consumers whose CC info is stolen aren't liable for fraudulent charges but it can still be very expensive and time-consuming for them to correct everything, not to mention the affect it can have on a credit score. And obviously, the consumers don't get any say in whether the costs to upgrade the infrastructure are worth it.
      • computator 14y ago
        > Consumers whose CC info is stolen aren't liable for fraudulent charges That's only if the credit card company believes or accepts your story. I once reserved a flight by telephone using a credit card, but at the airport I paid for the flight with cash. Later I found that my credit card was charged for the flight. The airline said that they couldn't find any evidence that I had paid in cash, and even though their policy was to get a signature when paying by credit card, they could not produce my signature. But they still insisted that I had paid by credit card. I complained to the credit card issuer, but they took the airline's word (United Airlines, by the way) over mine. It's not enough that charges are fraudulent -- if the merchant is mistaken in their belief (or lying), you are on the hook!
    • mseebach 14y ago
      Try to find the value of all swiped CC transactions. Then take 0.07% of that number. I'm guessing you'll be hard pressed to call the result "fairly small".
  • corin_ 14y ago
    The whole chip and pin thing is pointless though, my company credit card gets used by plenty of people who don't know the PIN thanks to online/phone purchases, and in the past when I've forgotten a PIN, or just got a new card which I haven't yet received a PIN for, I've had no problem persuading shops to let me swipe them (magnetic strip) and sign for it instead.
  • Chrono 14y ago
    The US still uses checks, can't expect much...
• sakai 14y ago
  Well, clearly this guy's moral compass is a bit out of whack, but the IAmA does offer some fascinating insights into this world...
  • diminish 14y ago
    yea, the world is a weird place. seeing a lot of angry ethical reactions on reddit, i can't help but think: on one side, there are people like this guy in the comments who left marketing a health product due to false claims, or me refusing to code for certain clients based on "personal" ethical judgments and on the other side there are these "crackers" who steal the credit cards of random people and who even hate them. one thing i want to believe, you can't build a future on crime, or can you?
    • white_devil 14y ago
      What is this I don't even.. It sounds like you're considering a life of crime. Probably thinking about how you could be like that botnet guy on Reddit. Getting money without working is a nice thought, after all. You know, the "ethical reactions" stem from that guy doing evil things. He knows he's being evil but doesn't care. Some people find that appalling. For him, it's just an easy way to make money, and the fact that he produces no value to society at large is irrelevant. He even gets to work on challenging problems! In fact, what he's doing is quite similar to working for the financial industry, doing HFT or whatever. It's clearly wrong, and clearly harmful to mankind, but it's easy money, so ethics are thrown out the window. It is generally easier to make money by scamming/abusing people than by doing something valuable. That doesn't mean you should.
      • netrus 14y ago
        I do not claim to be a fan of HFT, but I wouldn't say it's on the same level as stealing CC data.
      • intended 14y ago
        Your point is well served without the analogy of heft and the financial industry being added. Matter of fact, I assume that it will likely be met with discussion that shifts the focus onto those examples which are irrelevant to the greater topic at hand. There have been several in depth discussions and posts on both hacker news and reddit which comprehensively make the case for both.
• citricsquid 14y ago
  Most of what he says is obvious stuff and the emphasis he puts on how much he modifies stuff makes me assume he's someone that just runs programs and doesn't have any unique insight, but he does make one interesting point: > Try to use "Verified-By-Visa" and "Mastercard-Securecode" as rarely as possible. If only your CVV2 code is getting sniffed, you are not liable for any damage, because the code is physicly printed and could have been stolen while you payed with your card at a store. Same applies if someone cloned your CC reading the magnetic stripe or sniffing RFID. Only losing your VBV or MCSC password can cause serious trouble. Does anyone know if this (using verified-by-visa, mastercard-securecode remove any payment protection if you get key-logged etc) is correct?
  • njs12345 14y ago
    I really wouldn't be surprised. The security group at my university do a lot of stuff on banking security, and from what I've heard, this was one of the main reasons behind the switch to chip-and-PIN in the UK --- the user is now liable when his card gets stolen and used.
    • DanBC 14y ago
      Richard Clayton (etc) have lots of interesting stuff about bank security (and the lack of) - they've attacked chip and pin, which means that if someone does manage to defraud the card the owner might have some chance of getting the cash back.
    • shabble 14y ago
      See, for example, Tetris on a ('secure hardware' platform) chip & pin machine[1] The same group (security research at cambridge) are also the ones who produced the 'chip and pin is a joke'[2] paper you might be referring to. [1] http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-terminal-playing-tetris/ http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-termi... [2] http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/ http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-i...
    • mibbitier 14y ago
      That's not really true. The user is liable if the card is stolen, and it is used to conduct fraud using the PIN code. If the card is stolen, and the fraudster simply uses it online, or via some place that doesn't ask for a PIN, then you are not liable for that fraud. I'm sure there are rare edge cases, but my experience with Barclays has always been very good in this regard.
• elorant 14y ago
  I don't understand how these people sleep at night. The whole notion I didn't make the game I just play the ball is just hilarious. Furthermore those guys don't understand that eventually they're hurting the web. All that will bring stricter legislation and governments will start enforcing rules like IP identification for just about anyone out there. I can understand organized crime exploiting the cyberspace. But for individuals its just plain stupid.
  • Monotoko 14y ago
    They are just like petty criminals in real life, you've seen what surveillance and legislation does in real life... virtually nothing. The smarter ones go into the cracks and the shadows (Tor) which just leaves us folk being monitored for no reason, but we're okay with it because "it's helping to stop crime" There is also the addition that you are just interacting with a computer, a keyboard, a mouse and a screen. I bet if you asked this guy if he would go out and mug someone he'd say no, because he'd be face to face with the person... he'd see the upset and pain he's caused. Not saying it's right, but there is certainly a bit of psychology involved here, gaining from the computer doesn't seem like a crime to those not in charge of their own compass.
    • intended 14y ago
      Well, those speed bumps increase the fitness requirements for a short time of hackers. So it's not a total loss/ black-white picture.
  • driverdan 14y ago
    This is a big part of a lot of the talks I give about my criminal past. It's not like you wake up one day and decide to start committing fraud. It's a gradual, slippery slope. Humans can, will, and need to rationalize everything they do. As you slide down the slope the rationalization becomes, well, less rational. But you don't see it that way. If you did you wouldn't be able to do it.
• mikemarotti 14y ago
  The fact that this guy even posted an AMA shows that it's either entirely fake (doesn't seem it), or he's way too cocky. I suspect some trouble may be coming his way soon. He seems to think that he's infallible and that he won't catch a charge for running a botnet.
  • deleted 14y ago
    [deleted]
  • corin_ 14y ago
    From what he says I agree that he seems either stupid or a liar, but I'm not sure about your premise, it's not hard to post an AMA that can't be linked to you.
    • Jach 14y ago
      For the average cyber-stalker, that's true. But I'd wager if some government agency actually wanted to track him down (he's probably too low-value of a target), he's revealed more than enough bits of information about his personal life for them to do so.
      • Iv 14y ago
        He is using Tor, which gets a lot of criticism for not being secure but actually defeats Syrian or Chinese governments. If the US can track a hidden service in Tor, they will probably not waste this trump by catching such a small fish.
        • Retric 14y ago
          You don't crack Tor you track people down based on info they released publicly, then confiscate their stuff to demonstrate they did it.
        • smsm42 14y ago
          You don't need to crack Tor for that. Get the list of Germans hanging out on Anonymous IRC. Choose only college students. Remove ones that don't have time to do this stuff due to actually working somewhere. Intersect with HBCI users in banks where there aren't many of those. Remove Mac users and Linux users (he mentions he only uses Windows). Remove families that use credit cards (he mentions his family does not). This would already probably end up in reasonably short list. Now amending this list with various other bits of info he left - such as which sites he frequents, which drinks he prefers, which software he uses, etc. I don't believe it should pose any major challenge for a law enforcement agency, even if part of the info is lies - they are used to legwork and assembling small pieces. But probably with his size nobody would bother unless he does something major (i.e. catching him generates a big press-release) or he just hands himself to law enforcement by doing something stupid like drinking too much and bragging about being elite haxor criminal to a female undercover officer. If he just does it for a year and then stops, he has good chances to get away with it, but not because of mighty Tor, but because the law enforcement would never notice him.
• 16s 14y ago
  The CVV2 is not recorded in the mag stripe.
  • vibrunazo 14y ago
    Ooohh.. so that's why those websites ask for it. Learn something new every day :S
    • 16s 14y ago
      They can't store the CVV2 either. Doing so, even encrypted, violates PCI-DSS.
      • bediger4000 14y ago
        So, if you don't care about violating the terms of PCI-DSS, you can store the CVV2/CVC/whatever. I bet lots of places do. In fact, I worked for a Visa Level-1 merchant that had a card processing system that used an Oracle DB table as a queue for outgoing authorization requests. The table held the CVV2/CVC/whatever for as long as it took to get an authorization or a timeout, whichever came first. We passed the PCI audit, even though the auditors knew about it. Given that there's only 1,000 CVV2 values (10,000 for Amex) isn't putting so much into CVV2 value a bit ridiculous? Someone who really wanted to could get a CVV2 value in only 500 auth attempts on average.
        • eli 14y ago
          How many failed CVV2 checks before your account is locked? Something tells me less than 500.
        • dangrossman 14y ago
          > Someone who really wanted to could get a CVV2 value in only 500 auth attempts on average. That's going to trip a fraud check at the bank and get the card frozen long before 500 attempts.
        • smackfu 14y ago
• tferris 14y ago
  WTF
  • deleted 14y ago
    [deleted]
• tuananh 14y ago
  * About 20% of the users have good graphic cards, but are not sophisticated enough to install drivers. * 30% of victims are Americans. * 80% have an antivirus installed. * An average income of $40 per day (bitcoin only). May vary up to $1,000.
  • rntksi 14y ago
    Thanks for the summary. People obviously think they're safe when they have an AV solution installed...
  • smsm42 14y ago
    $40 per day is weak. Less than California minimum wage. And the risks are considerable. Reminds of the work of Sudhir Venkatesh who found that average wage for drug dealing grunt is about $3.30/hr - not far from what we're seeing here, though at least bot herder doesn't risk being shot. He is right that this thing has no future for him.
  • computator 14y ago
    > About 20% of the users have good graphic cards, but are not sophisticated enough to install drivers, so my [Bitcoin] miner can't run. If he has root-level control of the systems, why doesn't he install the needed drivers himself? Somebody already asked him this question on reddit, but he didn't answer. Does anyone have any idea why he wouldn't/couldn't/shouldn't install drivers himself?
    • fromhet 14y ago
      Also, why not mine litecoins (cpu's are good at doing that, so no drivers needed and he can mine bitcoins at the same time) and sell them for bitcoins? They are worth enough that his profits would go up noticeably much.
• mikek 14y ago
  Great nugget: > a US credit card costs 2$ on the black market and a UK starts at 60$, americans are all in debt.
  • simonsarris 14y ago
    Well this could be because US credit cards are magnetic and UK ones are (much more secure) chip-and-pin cards.
    • farnsworth 14y ago
      Yeah, this has got to be it. Non-US CC info seems much more difficult to acquire, and thus more valuable. And just because Americans are in debt (obviously not all) doesn't mean their credit cards are maxed out.
      • jlgreco 14y ago
        There is however likely a difference in average credit limit on cards of citizens of countries with different economies.
    • blackman 14y ago
      I know that the criminals probably haven't caught up and this technology may not be widespread (so your argument holds) but... chip and pin is definitely broken (defcon presentation) http://www.youtube.com/watch?v=JABJlvrZWbY http://www.youtube.com/watch?v=JABJlvrZWbY
  • smackfu 14y ago
    I would also think Americans tend to have higher limits if they are in debt.
  • Retric 14y ago
    It's because you can't do a charge-back with a UK card and get your money back.
    • 14y ago
• CoffeeDregs 14y ago
  Great post. I forwarded it on to my family and friends in order to give them some awareness of the people who're looking at them from the other side of the internet. Rather than sending more strident "think before clicking" warnings, this post is a great way to get them to think like an attacker so that they can avoid the attacks better.
• diminish 14y ago
  Now, what has to be done not to get hacked ends up being answered as; AVs won't help, macs won't help, linux won't help, and use ipad? are we heading towards a world where average users will end up in managed computing behind walls, and only some hackers and crackers will use open computing? is computing doomed to be a the black and white world of tyrannic rule vs. mob rule?
  • azakai 14y ago
    > linux won't help ? He says Linux does help.
    • diminish 14y ago
      but he says, only because it is not much common, and different distros are too diverse to justify an "investment"
      • azakai 14y ago
        Yes, the reasons are not very impressive ones, but nonetheless.
        • da_n 14y ago
          http://en.wikipedia.org/wiki/Security_through_obscurity http://en.wikipedia.org/wiki/Security_through_obscurity
          • tetha 14y ago
            I don't see the relevance. Linux is no good target, because there are not many linux boxes compared to windows/mac and because 100 linux boxes might require 10 different ways to attack them, while 100 windows boxes might require 1 or 2. There is nothing obscure here, just diversity.
            • holri 14y ago
• skeptical 14y ago
  Each time I see such showing off I get more convinced that such reports are mostly fake and done by script kiddies. Personally I wouldn't go through the hassle of doing this. I mean, is this really more profitable than a a job as a developer, sysadmin, tester, etc? I wouldn't think so. But could anybody explain me this simple thing: How does he prevent being traced? Hiding behind Tor will basically do nothing, he will get traced in no time. So this still confuses me rather much.... so he sends out all sorts of tricks to capture zombies, how does he avoids hitting the wrong targets? (police, feds, etc)
• andr3w321 14y ago
  There's so many legal ways this guy could make just as much money with his skills. I never understood why someone is willing to put his freedom at risk when that is the case. I guess he's just lazy or thinks he's incapable of making as much as easily legally, maybe he likes the thrill and challenge of it all, maybe he thinks he's invincible and there's zero chance of him getting caught. Either way he's very foolish for continuing to do this especially if he has no endgame in sight.
  • K2h 14y ago
    I have read that in many criminal enterprises it is much like business, where grunts at the bottom have lower income and lots of hours, and most of the risk (exposure). I think this guy is a grunt, probably at the same level of structure of a 2 employee business. when i read through his comments i am struck with the impression that he has passivly attempted legit employment that use the skills he has learned but has not been sucessful yet. he probably has his initial goals set to high. if he starts at the bottom somewhere, given his supposed skill level he should be promoted quickly. just need to put in the time. if not patient enough, put that effort into consulting. given the real return on his enterprise, i agree with your assesment that he can probably make much more with a real legitimate job and just avoid that risk altogether.
• option_greek 14y ago
  It's fascinating to know all this stuff from his perspective but the moral attacks by others in the comments truly suck. What is the point of AMA if all they do is attack the one sharing information.
  • andypants 14y ago
    Especially downvoting his comments. Like he cares about karma points. All it does is push all his responses to the bottom or hide them. Then what's the point of an AMA?
• K2h 14y ago
  I very much enjoyed the reading of his comments - I pulled a few of his that others may find interesting. [polymorphism code - to hide virus signature] Randomness is your friend, make your own crypter and make it so fucking random on every compile, that AV reverse engineers kill themselfs (HINT: randomize the crypters sourcecode using perl scripts) [polymorphism code - to hide virus signature] I started coding about a year ago, hacking old malware sourcecodes and reading russian boards. Most botnet operators are dumb as fuck, who don't even care about their traces, the ones you see on TV, catched by Microsoft and Brian Krebs. If you have more knowledge you can automatize nearly everything, like creating scripts that rewrite your sourcecode for your crypters so your malware gets undetected again, saving you hard work. [finding infections on a computer] Use GMER (http://www.gmer.net/ http://www.gmer.net/) every now and then when your spider sense is tingling. Srsly, you can't fool GMER, it scans from the deepest possible point in your system, at ring0 and is impossible to fool, there is nothing deeper than ring0 on a usual PC where malware can hide stuff from. I always wondered why other AV vendors don't do it like GMER, it can detect all rootkits. But when a AV can detect everything, who will pay 30$ a year for signature updates...
  • rosstafarian 14y ago
    the statement about GMER is not true. I've seen GMER miss MANY rootkits/etc. As far as catching and removing rootkits that other most av's tend to misss i've had by far the most success with combofix(which includes a GMER scan). Nothing will catch 0day rootkits 100% of the time, once a system is compromised it's best to format and start from scratch (or restore from backup if you're positive it's clean, but make sure you replace the mbr too). Theres just no other way to be completely certain. I lost track of the times that I thought I got everything on a windows machine, then google for something like malwarebytes as a test only to be redirected.
    • VMG 14y ago
      He seems to think of himself as very skilled because most other people in his field can't program. While he certainly is pretty good at what he does, it is scary to think what somebody with real knowledge could do.
• reidmain 14y ago
  "Protip against driveby infections (the ones in the browsers): Disable addons in your browser and only activate the ones you need. Chromium and Chrome for example let you disable all additional content like flash, html5, pdf and java in the options, you will see a grey box instead of the content and can manually run it using right-click -> Run. Chrome options -> Content options -> Plug-Ins -> Disable all or Click-to-play. Chrome also allows you to whitelist sites you trust, like youtube. This will make you immune to driveby infections regardless of the version of your java or adobe reader, because you will only be able to click and run content, that is VISIBLE on the site. Malicious content is ALWAYS hidden in a 0pixel iframe! This also stops the nasty flash advertisements implying you can't aim precise enough to win an iPad3." This is one thing I've been trying to convince people to do for ages but, for some reason, that one extra click turns so many people off. The extra minute or two I probably spend a day clicking on plugins to activate them will pale in comparison to how much time I'll have to spend recovering from being infected.
  • sage_joch 14y ago
    I've actually stopped using Firefox because it re-enables plugins that I've disabled (maybe it's more accurate to say it allows 3rd-party software updates to re-enable them).
    • capnrefsmmat 14y ago
      This was fixed in Firefox 8, unless 3rd-party programs have gotten much more clever: https://blog.mozilla.org/addons/2011/08/11/strengthening-user-control-of-add-ons/ https://blog.mozilla.org/addons/2011/08/11/strengthening-use...
• darksaga 14y ago
  The thing that's scary is how easy it is for these people to get away with what they're doing. I wonder how much money is lost every year and how many hackers you never hear about going to jail for this stuff. I'm pretty sure this is the motivation to do a lot of this stuff. The risk/reward level is completely slanted. I see a LOT of stories on HN and other Tech sites about these kinds of attacks. Unfortunately, I rarely, if ever, hear about hackers getting arrested for this sort of activity.
• jacquesm 14y ago
  Let's play 33 bits on this guy, my guess is that he's German, Austrian or Swiss based on the settings for his IRC client, that should knock about 6 bits off, 27 to go.
  • deleted 14y ago
    [deleted]
  • zmj 14y ago
    By '33 bits', I understand that you're referring to the minimum amount of information to identify an arbitrary person on Earth? 2^33 ~= 8.5 billion. Interesting idiom. I hadn't heard it before, but the usage makes sense.
    • 0x006A 14y ago
      http://33bits.org/ http://33bits.org/
  • nikcub 14y ago
    oh I was doing that while reading the AMA. the giveaway is being the 4th customer of a bank that provides HBCI: > My bank had around 20,000 customers using smsTAN and 3 (I was the 4th lol) using HBCI. He is German, of college age and an early customer at one of 2 or 3 banks that provide HBCI. Consider him nailed. I also bet he has published security related work under his real name at some point, especially since he has been applying for jobs. Most people in the security industry applying for legit work who don't have qualifications pad out their resumes with online research (or speaking at conferences, etc.).
    • vibrunazo 14y ago
      I really hope I never make enemies with anyone around here.
      • Qua8zei3 14y ago
        I think Hackernews has 220000 registered users. You are one of them. You have 17 bits left. Use them wisely.
• pestaa 14y ago
  My favorite bit so far: if you know how your computer is beating inside, you are hard to fool
• yeah123 14y ago
  He says he doesn't like the security industry, specifically AV companies. And he makes some compelling arguments against them. Then when asked about his future, he says he plans to work for one! WTF?!
• hippo_crete 14y ago
  He says he has no respect for the security industry and AV companies. He makes compellling arguments against them. Then when asked about his future, he says he plans to work for an AV company! WTF?! He can see what's wrong, but he can't do what's right. And that, my friends, is the problem.
  • gbrindisi 14y ago
    If you want to do this for the rest of your life you have no choice than working for a security firm (AV included) or being a criminal. The problem is why he didn't get that job at Kaspersky. He is obviously skilled so what happened?