7 ms·

I wonder how he tracks them down? And if he can find two so easily (on his own?) how had they not be outed already?

by codyb 12y ago

sp332 12y ago
He probably found them because they did something stupid. Maybe not all of them have screwed up (yet). They certainly don't look very careful. Krebs figures the first two will turn over the rest as part of a plea deal, and that will be the end of it. https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/ https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail...
hysterix 12y ago
Well quite frankly if you've been in the scene for a while, you'd be able to tell using other clues, speech patterns, and reused nicks. Julius Kivimäki aka zee, aka Zeekill (https://encyclopediadramatica.se/Zeekill https://encyclopediadramatica.se/Zeekill) has an extensive history, he actually has been dox'd and outed numerous times prior to this. I knew lizard squad was zee by zee's idiotic behaviour. He constantly used the moniker "Ryan" or "Ryan Clearly" the name of another unrelated hacker. Well sure enough he gave an interview to someone using that moniker. Having even the tiniest bit of inside knowledge it was easy to piece together 1 + 1 = 2 and lizard squad is zee, aka julius. There are other clues too, believe it or not, not too many entities are capable of massing as large a ddos as they were. Those that have the technical capability, normally don't advertise as such. Zee was a "special" case, in that he had the capability, and advertised it as such, I was astounded the boy hadn't been jailed years prior. As I mentioned earlier he has an extensive history, and was involved in many of the large site take downs and ddos's that have made public news.
- rudolf0 12y ago
  Zee/"ryanc" has indeed been involved in things like these for many years. HTP (Linode + much more) is just a small part of it. I'm also very surprised it's taken this long for him to be arrested. He's completely brazen and has committed countless crimes despite knowing full well the general public and law enforcement know exactly who he is. And if he truly was/is involved in carding, he probably won't get out for a while. I can hold some respect for blackhat groups, and hell, even a tiny, miniscule bit of respect for script kiddies like Lizard Squad, but once they get into financial fraud and theft my sympathy is gone.
  - tacojuan 12y ago
    The HTP dudes actually seemed sophisticated. Lizardsquad is just some dudes with a botnet.
    - rudolf0 12y ago
      Zee was apparently involved with both groups. He was likely the only skilled member of Lizard Squad.
      - tacojuan 12y ago
        Anywhere I can get more info on the HTP group? I was pretty fascinated by their zines at the time...
        ryanlol 12y ago
        Unless there's ever any public court records, I doubt you'll find much (if any) good information.
  - deleted 12y ago
    [deleted]
  - ryanlol 12y ago
    Just because someone knows who I am does not mean that'll matter when it comes to proving things in court, which in real life isn't as easy as one might imagine. >he probably won't get out for a while If only I'd get sentenced in the first place.
    - meowface 12y ago
      If you get extradited, you're not going to have a fun time...
      - ryanlol 12y ago
        Well, I live in a country that will not extradite it's own citizens. And even if I somehow did manage to get extradited the US has a legal system where you'd actually have to prove a persons guilt, not just speculate it based on some IRC log of dubious origin.
- bobcostas55 12y ago
  How the hell do these little kids get control of big botnets?
  - ef4 12y ago
    The bar is pretty low. When there are tens of millions of unpatched machines floating around on the internet, and hundreds of weaponized exploits already written by other people, all it takes is patience and lack of good judgement.
  - hysterix 12y ago
    The reply to your question is already on point. There is a sickening amount of open systems on the net. I know zee used tends of thousands of routers as only some of his ddos tools. I also know of dudes who wrote custom scripts specifically for zee's ddosing, would scan for incoming connections matching whatever signature identified at the time, automatically connect to the router using whatever exploit to get in, change the root pass and restart it. Zee got his net taken away from him numerous times hitting the wrong people. But yes in a nutshell, the digital world is mostly unprotected open and unlocked houses, with little pockets of protected castles here and there, and some locked houses too.
    - meowface 12y ago
      By incoming connections, do you mean web visitors who fell victim to CSRF/XSS exploits in their router management web panels? Or was he hijacking routers another way?
      - hysterix 12y ago
        I don't know if zee gained any skill over time, but I believe he simply used public exploits. So for example remote command injection vulns: http://en.1337day.com/exploit/description/20598 http://en.1337day.com/exploit/description/20598 http://en.1337day.com/exploit/description/20602 http://en.1337day.com/exploit/description/20602 http://en.1337day.com/exploit/description/20671 http://en.1337day.com/exploit/description/20671 Then it is just a matter of figuring out where these routers are, and then writing a few scripts to exploit and command them in mass. I don't think CSRF/XSS would net him the vast numbers he'd need to make a significant ddos. And to more specifically answer your question, by "incoming connections", I mean like monitoring the ddos via netstat on a box zee was actively attacking.
mikeryan 12y ago
He's got a few articles up on that touch on this. http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/ http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/ http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/ http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-...
- zo1 12y ago
  Both those links are currently unavailable for me. However, their content is still available on the main page if you scroll further down to the relevant blog posts.
neotek 12y ago
Krebs is really well connected to the underworld, plenty of people pass him information confidentally, just like any other journalist. He also understands this field far better than most people, so although he probably did find them "easily", it probably wasn't "on his own" and it almost certainly wouldn't have been anywhere near as easy for you or me to do it.

I wonder how he tracks them down? And if he can find two so easily (on his own?) how had they not be outed already?

by codyb 12y ago

I wonder how he tracks them down? And if he can find two so easily (on his own?) how had they not be outed already?

sp332 12y ago

He probably found them because they did something stupid. Maybe not all of them have screwed up (yet). They certainly don't look very careful. Krebs figures the first two will turn over the rest as part of a plea deal, and that will be the end of it. https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/ https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail...

hysterix 12y ago

Well quite frankly if you've been in the scene for a while, you'd be able to tell using other clues, speech patterns, and reused nicks. Julius Kivimäki aka zee, aka Zeekill (https://encyclopediadramatica.se/Zeekill https://encyclopediadramatica.se/Zeekill) has an extensive history, he actually has been dox'd and outed numerous times prior to this. I knew lizard squad was zee by zee's idiotic behaviour. He constantly used the moniker "Ryan" or "Ryan Clearly" the name of another unrelated hacker. Well sure enough he gave an interview to someone using that moniker. Having even the tiniest bit of inside knowledge it was easy to piece together 1 + 1 = 2 and lizard squad is zee, aka julius. There are other clues too, believe it or not, not too many entities are capable of massing as large a ddos as they were. Those that have the technical capability, normally don't advertise as such. Zee was a "special" case, in that he had the capability, and advertised it as such, I was astounded the boy hadn't been jailed years prior. As I mentioned earlier he has an extensive history, and was involved in many of the large site take downs and ddos's that have made public news.

rudolf0 12y ago
Zee/"ryanc" has indeed been involved in things like these for many years. HTP (Linode + much more) is just a small part of it. I'm also very surprised it's taken this long for him to be arrested. He's completely brazen and has committed countless crimes despite knowing full well the general public and law enforcement know exactly who he is. And if he truly was/is involved in carding, he probably won't get out for a while. I can hold some respect for blackhat groups, and hell, even a tiny, miniscule bit of respect for script kiddies like Lizard Squad, but once they get into financial fraud and theft my sympathy is gone.
- tacojuan 12y ago
  The HTP dudes actually seemed sophisticated. Lizardsquad is just some dudes with a botnet.
  - rudolf0 12y ago
    Zee was apparently involved with both groups. He was likely the only skilled member of Lizard Squad.
    - tacojuan 12y ago
      Anywhere I can get more info on the HTP group? I was pretty fascinated by their zines at the time...
      - ryanlol 12y ago
        Unless there's ever any public court records, I doubt you'll find much (if any) good information.
- deleted 12y ago
  [deleted]
- ryanlol 12y ago
  Just because someone knows who I am does not mean that'll matter when it comes to proving things in court, which in real life isn't as easy as one might imagine. >he probably won't get out for a while If only I'd get sentenced in the first place.
  - meowface 12y ago
    If you get extradited, you're not going to have a fun time...
    - ryanlol 12y ago
      Well, I live in a country that will not extradite it's own citizens. And even if I somehow did manage to get extradited the US has a legal system where you'd actually have to prove a persons guilt, not just speculate it based on some IRC log of dubious origin.
bobcostas55 12y ago
How the hell do these little kids get control of big botnets?
- ef4 12y ago
  The bar is pretty low. When there are tens of millions of unpatched machines floating around on the internet, and hundreds of weaponized exploits already written by other people, all it takes is patience and lack of good judgement.
- hysterix 12y ago
  The reply to your question is already on point. There is a sickening amount of open systems on the net. I know zee used tends of thousands of routers as only some of his ddos tools. I also know of dudes who wrote custom scripts specifically for zee's ddosing, would scan for incoming connections matching whatever signature identified at the time, automatically connect to the router using whatever exploit to get in, change the root pass and restart it. Zee got his net taken away from him numerous times hitting the wrong people. But yes in a nutshell, the digital world is mostly unprotected open and unlocked houses, with little pockets of protected castles here and there, and some locked houses too.
  - meowface 12y ago
    By incoming connections, do you mean web visitors who fell victim to CSRF/XSS exploits in their router management web panels? Or was he hijacking routers another way?
    - hysterix 12y ago
      I don't know if zee gained any skill over time, but I believe he simply used public exploits. So for example remote command injection vulns: http://en.1337day.com/exploit/description/20598 http://en.1337day.com/exploit/description/20598 http://en.1337day.com/exploit/description/20602 http://en.1337day.com/exploit/description/20602 http://en.1337day.com/exploit/description/20671 http://en.1337day.com/exploit/description/20671 Then it is just a matter of figuring out where these routers are, and then writing a few scripts to exploit and command them in mass. I don't think CSRF/XSS would net him the vast numbers he'd need to make a significant ddos. And to more specifically answer your question, by "incoming connections", I mean like monitoring the ddos via netstat on a box zee was actively attacking.

mikeryan 12y ago

He's got a few articles up on that touch on this. http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/ http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/ http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/ http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-...

zo1 12y ago
Both those links are currently unavailable for me. However, their content is still available on the main page if you scroll further down to the relevant blog posts.

neotek 12y ago

Krebs is really well connected to the underworld, plenty of people pass him information confidentally, just like any other journalist. He also understands this field far better than most people, so although he probably did find them "easily", it probably wasn't "on his own" and it almost certainly wouldn't have been anywhere near as easy for you or me to do it.