9 ms·
Malware and Hacking Forum Darkode Is Shut Down; Dozens Arrested
- deleted 11y ago[deleted]
- fixxer 11y agoThey should have just sold that stuff to the Feds and helped keep America safe /s
- thrill 11y agoAs someone who has crushed a hornet's nest in his hand (when he was about 10), and well remembers the 36 stings afterwards (something of a record in these parts) while running away bravely, I'm not sure that's the analogy they should have chosen.
- ChuckMcM 11y agoI was thinking exactly the same thing.
- dizzyviolet 11y agoUnfortunately, it might end up being the most appropriate analogy. Hopefully, any that aren't already arrested are caught before they retaliate.
- PhantomGremlin 11y agoHopefully, any that aren't already arrested are caught before they retaliate Certainly they might try to retaliate, but that would be very foolish. Many decades ago Don Lancaster said "don't fuck with the eagle". This was because the Federal government's resources are vast compared to any individual. The government has the resources to pay 100 people full-time just to take down a forum. That's probably what they just did with Darkode. Many of those Federal agents are just 9-to-5 guys, probably not too bright, quite content to make a good middle class living. But there are also undoubtedly a number of smart, ambitious people, who are being paid quite well to pursue, capture, and convict the Darkode actors. So, lets see, you can either roll over and beg for mercy, like one of Ross Ulbrict's henchmen, and get less than 2 years in jail, or you can be a delusional arrogant twit like "mastermind" Ross and get life in Federal prison, without parole. The choice is simple.
- bpodgursky 11y ago> Many of those Federal agents are just 9-to-5 guys, probably not too bright, quite content to make a good middle class living. I'm sure there are also a lot of very bright 9-to-5 guys as well. Just saying...
- pc86 11y agoRead the very next sentence after the one you quoted.
- bpodgursky 11y agoThat's my point. Lumping 9-5 in with "not too bright" gives the false association of "working normal hours" with "not being productive". There are plenty of ambitious, bright workers who manage to get it done in normal hours.
- smaili 11y agoThat's an amazing story. I thought hornets were poisonous?
- hellbanner 11y agoThey are, that's why their stings "sting"
- lazugod 11y agoApparently it differs between species of hornet.
- mtrimpe 11y agoThe 36 stings was a record because he survived ;)
- arpa 11y agoThey are not. They are venomous though. (http://insects.about.com/od/insects101/f/venomous-or-poisonous.htm http://insects.about.com/od/insects101/f/venomous-or-poisono...)
- wernercd 11y ago> "The FBI has effectively smashed the hornets' nest," said U.S. Attorney David J. Hickton, "and we are in the process of rounding up and charging the hornets." They didn't smash it "in the hand". They smashed it. With a hammer. Flame thrower. ICBM. MOAB. Smoke generator and nets. I could imagine a hundred ways to smash a hornets nest that won't get me hurt in any shape or form... and I could imagine a few that would definitely bite back (like, say, crushing it in the hand without gloves). Once you get past the imagined "hand" part, it's not a bad analogy since they do have to worry about what part of the "swarm" got away...
- fyrabanks 11y agoOverly pedantic, maybe. And it's an awful analogy because he awkwardly abandons it halfway through. Nobody's ever arrested or tried a hornet in a court of law.
- randomfool 11y agoNot clear that the value of closing this outweighs the value of being able to track exploits. I assume that the Android rootkit mentioned uses known exploits- the companies not pushing out fixes bear some responsibility as well.
- joe_the_user 11y agoNothing guarantees that they weren't monitoring this from the start. Nothing guarantees they haven't set-up the successor to this board already themselves. We know the FBI actually engages in systematic lying about how they gain information about criminals - see "parallel construction". We know that in efforts to end drug cartels, the DEA will enter into long term alliances with one cartel to eliminate others.[1] We know the US tolerates the rule of the drug-track caste in Afghanistan for the pursuit of "higher ideals". Just in general, the paradox of mafias, cartels and so-forth is that it easier to use state power to take over such operations than to root them out. Moreover, taking them over has many appealing aspects. The problem is that the more the state moves into simply managing rackets, the greater the temptation to corruption gets, for both the high policy makers and for the low level operatives (you remember the FBI agent engaging in his own embezzlement etc during the Silk Road investigation). But this problem has been around for a long, the state by now are probably at a "steady state" in their corruption. So it seems very possible that the FBI already knows what comes next but can only tip it's hand when the next raid comes in another two years. [1]http://www.businessinsider.com/the-us-government-and-the-sinaloa-cartel-2014-1 http://www.businessinsider.com/the-us-government-and-the-sin...
- Lawtonfogle 11y ago>The problem is that the more the state moves into simply managing rackets, the greater the temptation to corruption gets, for both the high policy makers and for the low level operatives Well, that is if you ignore the far larger elephant in the room of the government running an illegal operation. It reminds me of the times I hear of the FBI taking over some TOR server hosting abusive images and continuing to host it as a honeypot. By their own admission, looking at, hosting, sharing, etc. those images constitutes concrete abuse of a child, yet they directly engage in such. It would be like if the FBI busted up a brothel with children and kept running it to catch more criminals. The ends in no way justify the means.
- stephengillie 11y ago> Investigators say that while the forum's existence was widely known, they hadn't been able to penetrate it until recently. Darkode operated under password protections and required referrals to join. On Wednesday, the site consisted of an image saying that it had been seized by authorities. > The arrests come after a two-year FBI undercover operation that infiltrated the forum, said FBI Special Agent in Charge Scott S. Smith. Wednesday's announcement reflects work in countries that range from Brazil and Costa Rica to Latvia and Macedonia, the Justice Department says. For various meanings of the term "Recently". So they've been trying to get in for 2 years and only just now got in, by pretending to be from Latvia?
- wernercd 11y agoWhere did you read they pretended to be from Latvia? They worked in multiple countries, including Latvia.
- stephengillie 11y agoIn lieu of details, I assumed this from the article details. Are you saying that they also pretended to be Macedonians?
- nyolfen 11y agothey probably had a partner agency bust someone in one or more of those countries and flipped them
- stephengillie 11y agoSo you're saying that they couldn't even get in on their own? They had to find someone with what I'll call a "legitimate reason" for connecting to the darkforum, and had to sneak in that way?
- celticninja 11y agoYes it would seem that way. Check out the top comment, it has a quite where it looks like they turned someone in January and someone else in June. So the first was the person who got them onto the board, probably just a user\low level carder, the second was likely an admin with more privileges, perhaps even access to PMs. Once they had the admin they were able to close it all down.
- nblavoie 11y agoWhat strikes me is the fact that they are tracking visitors with the following Google Analytics code: UA-51054600-7.
- gcmartinelli 11y agoAh... these hackers just don't understand that hacking, invading people's privacy and stealing their money is a government monopoly.
- hellbanner 11y ago"Those indicted include Johan Anders Gudmunds, identified by federal documents as an administrator of Darkode who created a large botnet of hacked computers that stole private information "on approximately 200,000,000 occasions."" And on such a paltry amount of private information events compared to what the NSA captures!
- joeyspn 11y agoThis could be an arrest-hire... who knows
- mindcrime 11y ago"Work for us, or spend the rest of your life in the salt-mines". Yeah, I can see how that would be a compelling argument. I wouldn't put it past various government agencies to think of exactly something like that.
- emodendroket 11y agoI'd say it would be pretty stupid to entrust people working under duress with sensitive information but what do I know?
- sliverstorm 11y agoMaybe, maybe not? I'd bet it depends on the people, depends on the job. Are you an anarchist assigned government drudgework? Bad news. Are you a chaotic neutral "forced" into fascinating meaningful government work? Might be great for everyone even if you wouldn't have taken the job normally.
- gcmartinelli 11y ago
- liviu- 11y agoOne of the arrested ones is 20, and he allegedly created Dendroid — a malware that can take remote control of an Android device. He designed, developed and deployed this software (bypassing Google Play's malware detection system) which seems to be quite complex and capable [0]. This proves that he possess a certain set of marketable skills that are quite south after in the industry. So I'm wondering - is this really bad news for them, or will it just bring them enough spotlight to be contacted for some security roles that pay better than what they were earning prior to the arrest? [0] https://blog.lookout.com/blog/2014/03/06/dendroid/ https://blog.lookout.com/blog/2014/03/06/dendroid/
- contingencies 11y agoI guess if people have that level of knowledge, the market dangles money, and they are still willing to take risks to do something different, it could be seen as evidence about how damn boring writing normal code for phones is!
- Cyph0n 11y agoGreat article. It's quite amazing what malware devs pull off with each new toolkit. The first comment on the post is however... not so great.
- dsacco 11y agoMany former criminals do lead successful careers, so it's quite possible. However it should be noted that circumventing the Google Play store malware detections is not particularly hard - it's definitely a start, and maybe even a conference talk, but for real notoriety in the security industry you'd want to be consistently discovering novel vulnerabilities in Android, not just figuring out how to sneak malware onto the operating system. Now, all that said, if you are a competent reverse engineer and can reliably circumvent DRM/license protection, develop binary exploits for high-severity vulnerabilities or perform advanced malware analysis, you can easily earn north of half a million dollars a year in this industry. It is an extremely lucrative time to be working in security. You don't need to start out as a criminal though. If you want to do things like this then work through CTFs like Microcorruption and OverTheWire and learn how to develop privilege escalation and sandbox escape exploits on very widely used software and operating systems.
- TTPrograms 11y agoIs the current state of the law such that possession of these tools themselves is illegal? I would have thought that possession of most "hacking" tools would be legal i.e. for penetration testing and defense - usage against a non-consenting entity would then be the illegal act. I guess I could see some of the cell phone hacking stuff being illegal via FCC regulations...
- dikaiosune 11y agoNote that most of the convictions are for conspiracy to commit crimes or for selling tools expressly to commit them. Spam botnets, selling malware (probably advertised as a criminal tool), etc. While I didn't exhaustively read every charge, it looks like they're arresting people who either used said tools or profited from their criminal use. Didn't see anything related to "possession."
- daveloyall 11y agoMaybe, since April 1?? https://www.eff.org/deeplinks/2015/04/whitehouses-new-executive-order-cyber-crime-unfortunately-no-joke https://www.eff.org/deeplinks/2015/04/whitehouses-new-execut... IANAL...
- tptacek 11y agoExecutive orders cannot create new prosecutable crimes. In this case, the EO exercises rulemaking delegated the President through the IEEPA, and is confined by the powers defined in the IEEPA, which governs foreign transactions.
- tptacek 11y agoI don't think so, no. I think they also need overt acts in furtherance of a conspiracy to use the tools. It's probably not as cut and dry as "you have to actually use the tools to break into someone". It's a bit of a tightrope, though, because if you're a predecessor on the graph of people involved in an actual crime, sharing tools can drag you into a prosecution. So far as I know (this is sort of my profession), there's no federal "burglars tools" law regarding malware.
- frozenport 11y agoWhy not keep this website in China or Russia, beyond the reach of the law?
- liviu- 11y agoThe website was important only for facilitating the illegal activities. Keeping the website alive while being under surveillance by FBI wouldn't be of much benefit to the members of the community.
- junto 11y agoThe really interesting part is the last paragraph: In a related case, Aleksandr Andreevich Panin, aka Gribodemon, 26, of Tver, Russia; and Hamza Bendelladj, aka Bx1, 27, of Tizi Ouzou, Algeria, pleaded guilty on Jan. 28, 2014, and June 26, 2015, respectively, in the Northern District of Georgia in connection with developing, distributing and controlling SpyEye, a malicious banking trojan designed to steal unsuspecting victims' financial and personally identifiable information. Bendelladj and Panin advertised SpyEye to other members on Darkode. Note that they were arrested in Georgia. Do they mean the country of Georgia, enemy of the Russians and friend of the US? Or do they mean the state of Georgia in the US? Either way, the US has them in custody, which suggests an arrest on US soil (come visit the US trap style) or a foreign arrest and extradition. I'm guessing by the tone of that last paragraph that this is how the FBI got in. They flipped them and offered them a pkea bargain. We'll find out at sentencing.
- crazypyro 11y agoI'd assume they mean the state Georgia, based on the fact that they specifically refer to the "Northern District of Georgia" and the press release came from the DoJ. http://www.gand.uscourts.gov/ http://www.gand.uscourts.gov/
- berberous 11y ago"Panin was arrested by U.S. authorities on July 1, 2013, when he flew through Hartsfield-Jackson Atlanta International Airport." Source: https://www.fbi.gov/atlanta/press-releases/2014/cyber-criminal-pleads-guilty-to-developing-and-distributing-notorious-spyeye-malware https://www.fbi.gov/atlanta/press-releases/2014/cyber-crimin...
- deleted 11y ago[deleted]
- sliverstorm 11y agothey pled guilty in The Northern District of Georgia: http://www.gand.uscourts.gov/ http://www.gand.uscourts.gov/
- amouat 11y ago"...used his botnet to steal data from the users of those computers on approximately 200,000,000 occasions" Must have some fast fingers to use nearly anything 200 million times...
- serve_yay 11y agoI always wonder about these sort of sites, exploit marketplaces, etc. Of course since I'm nowhere near being in the loop on such matters (I don't even know where the loop is or what it looks like), I probably would never even see one before it's shut down and moved elsewhere.
- BrandonMarc 11y agoBecause of the embarrassing back of the Office of Management and Budget, the feds needed a high-profile "win" to give the voting public the appearance of competence. That's the story.