4 ms·

Great article. Krebs serves the story with a dose of judgement: > these nitwits still fail spectacularly at hiding their illegal activities Seems to me that p

Great article. Krebs serves the story with a dose of judgement: > these nitwits still fail spectacularly at hiding their illegal activities Seems to me that part of what makes a global internet hazardous is the it is fully connected in a graph theory sense. Every clinical sociopath can reach every other person on earth.

lupire 3y ago
One person's nitwit is a other person's successful cybercriminal.
- tonnydourado 3y ago
  From the story, I wouldn't call them successful =P
  - andrewflnr 3y ago
    Successful enough to be at it for a long time, and to keep making money. Successful enough to keep causing harm.
  - bryanrasmussen 3y ago
    The problem with engaging in an ongoing criminal enterprise is that if you fuck up once you lose, whereas people can fuck up normal businesses for years at a time.
    - chris_wot 3y ago
      Some people (and one particularly prominent American) do these two things simultaneously.
      - bryanrasmussen 3y ago
        Trump's criminality is not of the same sort as someone running a drug dealing empire, or in this case a long term phishing scam. He has a long running business that can't help doing criminal things with every now and then that then get fines. As such the criminality is just part of the normal mismanagement.
jstarfish 3y ago
> part of what makes a global internet hazardous is the it is fully connected in a graph theory sense. Nah, the bigger problem is that you can reach victims, but the long arm of their law enforcement can't reach you. You don't need OPSEC when you're judgment-proof. You can operate in plain sight since nobody can do anything to you.
- RajT88 3y ago
  This. EuroPol/FBI have no jurisdiction in Pakistan. As long as they don't target victims in their own country, they are most likely able to act with impunity.
  - mikeyouse 3y ago
    Russia, China, and North Korea too -- at least two of those have tacit if not open approval to target Westerners. I get the sense that PRC is more constrained and less willing to suffer the consequences of hosting random hackers but Russia especially is just lawless as long as they're not targeting Russians.
    - mkatx 3y ago
      Apparently, it isn't illegal to scam people in Jamaica, so there are lots of scammers from Jamaica.
    - foverzar 3y ago
      This is such a propaganda bullshit. I live and work in Russia. Guess what country shines brightest in WAF logs? Guess where data encryption extorters operate from? Fucking US of A. There was even a case once, where I knew specifically the person who was harassing the service I supported and there was literally NOTHING I could legally do about that. So stop pretending (or pushing your ignorance) as if western countries are doing any better in that regard - they just as well don't care what their hackers do in other countries. All that exceptionalism is just sad. This happens because countries that aren't the best of friends simply don't cooperate with each other, and criminals don't shy to abuse it. So from the standpoint of the rest of the world, it's the western/nato/five-eyes countries who are "just lawless as long as they're not targeting their own". Except the rest of us just have deal with it rationally, while you pat yourselves on the back with your ignorant supremacist exceptionalism, using these situations as yet another way to brew hatered. How can you actually believe that you are the only ones who have problem with foreign hackers? This is insanely naive! It's a global issue and WE ALL HAVE TO DEAL WITH IT. The only chance to trigger any legal action here is to establish legal presence. And even then there are no guarantees if there is no damage done in their jurisdiction. At least that is the experience for someone in Russia trying to deal with Western hackers. And that was before 2022. Now it's just open cyberwafare with hacktivists attacking everything in Russia and vengeful CTOs striking back. And JFYI, proxies are also a thing. Shit load of foreign attacks are just your locals using a properly configured proxy. Push your politicians to actually cooperate, instead of enjoying the leeway it gives to intelligence agencies. Otherwise, enjoy the treatment you give to everyone else.
deleted 3y ago
[deleted]
MR4D 3y ago
Yeah, but it's an acyclic graph. :(
- Terr_ 3y ago
  Hmm, I'm not sure about "acyclic", since maybe victims can impose some kind of retaliation on a scammer/spammer, but the path back is either a much weaker link or involves more hops that lose strength. So maybe it's about comparing flow? Maybe the aggregate (sum? average) of flow along paths they can use to harm a victim are stronger than the reverse that a victim can use to fight back. Is there a discrete-math term for that? Delta of inversed maximum flow something something?
  - MR4D 3y ago
    The reverse flow is probably weaker by a million to 1. Tons of people are scammed each year, and there are very, very few retaliatory paths. I would suspect that the graph is acyclic for most people, but for people like, say, Krebs, that they have a different graph that most people don’t have. In other words, they’re on a different graph.

lupire 3y ago

One person's nitwit is a other person's successful cybercriminal.

tonnydourado 3y ago
From the story, I wouldn't call them successful =P
- andrewflnr 3y ago
  Successful enough to be at it for a long time, and to keep making money. Successful enough to keep causing harm.
- bryanrasmussen 3y ago
  The problem with engaging in an ongoing criminal enterprise is that if you fuck up once you lose, whereas people can fuck up normal businesses for years at a time.
  - chris_wot 3y ago
    Some people (and one particularly prominent American) do these two things simultaneously.
    - bryanrasmussen 3y ago
      Trump's criminality is not of the same sort as someone running a drug dealing empire, or in this case a long term phishing scam. He has a long running business that can't help doing criminal things with every now and then that then get fines. As such the criminality is just part of the normal mismanagement.

jstarfish 3y ago

> part of what makes a global internet hazardous is the it is fully connected in a graph theory sense. Nah, the bigger problem is that you can reach victims, but the long arm of their law enforcement can't reach you. You don't need OPSEC when you're judgment-proof. You can operate in plain sight since nobody can do anything to you.

RajT88 3y ago
This. EuroPol/FBI have no jurisdiction in Pakistan. As long as they don't target victims in their own country, they are most likely able to act with impunity.
- mikeyouse 3y ago
  Russia, China, and North Korea too -- at least two of those have tacit if not open approval to target Westerners. I get the sense that PRC is more constrained and less willing to suffer the consequences of hosting random hackers but Russia especially is just lawless as long as they're not targeting Russians.
  - mkatx 3y ago
    Apparently, it isn't illegal to scam people in Jamaica, so there are lots of scammers from Jamaica.
  - foverzar 3y ago
    This is such a propaganda bullshit. I live and work in Russia. Guess what country shines brightest in WAF logs? Guess where data encryption extorters operate from? Fucking US of A. There was even a case once, where I knew specifically the person who was harassing the service I supported and there was literally NOTHING I could legally do about that. So stop pretending (or pushing your ignorance) as if western countries are doing any better in that regard - they just as well don't care what their hackers do in other countries. All that exceptionalism is just sad. This happens because countries that aren't the best of friends simply don't cooperate with each other, and criminals don't shy to abuse it. So from the standpoint of the rest of the world, it's the western/nato/five-eyes countries who are "just lawless as long as they're not targeting their own". Except the rest of us just have deal with it rationally, while you pat yourselves on the back with your ignorant supremacist exceptionalism, using these situations as yet another way to brew hatered. How can you actually believe that you are the only ones who have problem with foreign hackers? This is insanely naive! It's a global issue and WE ALL HAVE TO DEAL WITH IT. The only chance to trigger any legal action here is to establish legal presence. And even then there are no guarantees if there is no damage done in their jurisdiction. At least that is the experience for someone in Russia trying to deal with Western hackers. And that was before 2022. Now it's just open cyberwafare with hacktivists attacking everything in Russia and vengeful CTOs striking back. And JFYI, proxies are also a thing. Shit load of foreign attacks are just your locals using a properly configured proxy. Push your politicians to actually cooperate, instead of enjoying the leeway it gives to intelligence agencies. Otherwise, enjoy the treatment you give to everyone else.

deleted 3y ago

[deleted]

MR4D 3y ago

Yeah, but it's an acyclic graph. :(

Terr_ 3y ago
Hmm, I'm not sure about "acyclic", since maybe victims can impose some kind of retaliation on a scammer/spammer, but the path back is either a much weaker link or involves more hops that lose strength. So maybe it's about comparing flow? Maybe the aggregate (sum? average) of flow along paths they can use to harm a victim are stronger than the reverse that a victim can use to fight back. Is there a discrete-math term for that? Delta of inversed maximum flow something something?
- MR4D 3y ago
  The reverse flow is probably weaker by a million to 1. Tons of people are scammed each year, and there are very, very few retaliatory paths. I would suspect that the graph is acyclic for most people, but for people like, say, Krebs, that they have a different graph that most people don’t have. In other words, they’re on a different graph.