Hacker Who Sent Me Heroin Faces Charges in U.S

http://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/

by yitchelle • 11 years ago

124 87 11 years ago

That's the problem when you're being hunted; you can't slip up even once. The people chasing you can make all the mistakes they want; you have to make zero.

mring33621• 11 years ago

"I say to you againe, doe not call up Any that you can not put downe"

thaumasiotes4• 11 years ago

This sounds like advice never to begin farming.

wglb• 11 years ago

As a farm boy who grew up on a wheat farm, at the end of the season after harvesting the wheat that we had "brought up" in the spring or the previous winter, we would plow the remainder under, bringing it down again.

icehawk2192• 11 years ago

One thing I'm curious about with stuff like this is how some of the information gets given to the authorities and how it's allowed to be used in court. I imagine I can't just walk into my local police station, file a report, and go "so I have this illegal copy of a database that let me illegally access someones email account that contained illegally acquired information ...". Wouldn't that be inadmissible in court even if the police did accept it and act upon it? And doesn't it expose me to potential legal problems as well?

klodolph2• 11 years ago

This is a common misconception. The fourth amendment only limits the actions of the state, and case law establishes how evidence is excluded from trials. So, if I break into my neighbor's house and find child porn on his computer, that evidence is admissible in court. But if the police break into my neighbor's house without a warrant and search his computer, it isn't admissible, because it's a fourth amendment violation. But if they have a warrant to search the computer, it is admissible. If the judge who issued the warrant made a mistake and shouldn't have issued the warrant, the evidence is still admissible. This last situation also surprises people.

icehawk2192• 11 years ago

That makes surprisingly good sense. The more you know. :) Thanks.

x5n1• 11 years ago

Surprising that a judge doesn't make a mistake all the freaking time. The legal system is a religion, it has little basis in reason.

Jemmeh6• 11 years ago

Makes sense that it's admissible in that case.

Would you still be able to be held legally responsible for breaking the law to get the information though? In that case, the evidence would be admissible but wouldn't you be in trouble for breaking into your neighbor's house?

GPGPU• 11 years ago

People have been arrested when burglars stole their computer and claimed to have found "child porn" on it.

http://www.cnn.com/2011/10/06/us/california-robbery-porn-bus...

4th amendment or not, you'd think that the "rules of evidence" and the word of a burglar would lend credence to the explanation that the burglar planted it to make himself seem more respectable in the eyes of the court.

It's outrageous in this case, as reported by CNN, that the burglars were not arrested. It means you can commit any crime as long as you plant some illegal porn!

vox_mollis• 11 years ago

Seems quite the loophole. So a law enforcement agency could, in theory, be able to hire private contractors that then obtain admissible evidence that would otherwise be inadmissible if the LEA did it themselves? Do I understand this correctly?

Retric• 11 years ago

The only limitation is the government can't be responsible for gathering the information. AKA if a private eye breaks the law it's only an issue if they where directly or indirectly paid for by the government.

tptacek7• 11 years ago

Which makes sense, because the sole purpose of the exclusionary rule is to punish the state for actively cheating the Fourth Amendment.

biot• 11 years ago

Also "Not long after that, I secretly gained access to his forum" seems like a CFAA violation. Though law enforcement may not care to prosecute, I don't see how it's different from "I secretly gained access to an internal AT&T forum" which would likely see an average citizen facing years in prison.

steven2012• 11 years ago

OP seems a bit naive, but I can't believe it given everything he's written. Of course the Fly won't send threats over mail, he knows everything he writes is being watched. I would be worried, however, that he somehow gets word to someone to exact his revenge, since he really has nothing to lose at this point.

Nadya4• 11 years ago

I agree with you entirely.

Implied death threat (to him) sent to his wife from someone whom he has now gotten imprisoned who knows where he lives and confirmed it by sending a card... he seems awfully calm about all this and perhaps half-jokingly states he'll visit Fly in prison to meet him in person.

I'd be getting placed under a witness protection program (is this even applicable?) and relocate. Move somewhere that doesn't have risk of being burned down if Fly manages to contact anyone.

Anyone deep enough in the criminal scene has connections to people that can make bad things happen to other people for the right price. This isn't something I'd be posting about on a blog as if it's some sort of crime detective story... his life and his wife's life could potentially be in danger.

rubbingalcohol• 11 years ago

I doubt it, this isn't a drug cartel kingpin or mafia don we're talking about. He's just a troll.

Jemmeh6• 11 years ago

Krebs is a security investigative reporter. He has had many threats and written about them before. I am sure he is taking some precautions. That said, I don't envy him or the danger of his job--but that's something a lot of reporters just live with.

mmanfrin3• 11 years ago

  Payment information contained in those emails — including 
  shipping and other account information — put the happy 
  couple and their young son in Naples, Italy.

I am not at all surprised they found him in Naples. That city is a festering breeding ground for scammers, fraudsters, mafiosi, Camorra, and every kind and type of unscrupulous person. I have never hated a city I've visited so much as Naples.

Shebanator• 11 years ago

But they make great pizza there...

balls1872• 11 years ago

Not really.

mmanfrin3• 11 years ago

I agree with you there -- and the Naples Underground (old cisterns that became bomb shelters) are neat, and Pompeii is an hour away. Those, however, are the sole 3 reasons for going. I tell my friends who visit Italy that if they pass through Naples, you go to Da Michele and get 2 pizzas, check out the underground, take a daytrip to Pompeii, and then get the away from Naples asap.

anotherhostname• 11 years ago

they invented pizza there...

busyant• 11 years ago

I was born in the US...Not to stereotype a whole city or region...but my parents grew up near Naples. A lot of their world view (and that of their napolitani immigrant friends) seems governed by a philosophy of "the world is out to scam you. Be very careful about the people you put your tust in"

Ive always found it difficult to reconcile the general optimism of American culture with their ever present wariness.

balls1872• 11 years ago

Season world traveler, and the only place I have been scammed was Naples. The waiter pulled the "show you the receipt then take it away."

I think I was out an extra 40 euro before I realized what happened.

Edit to explain the scam:

The waiter brings you the bill, and the price looks "reasonable" at first (maybe because humans are bad at money estimation). The waiter takes the bill away before you can inspect each charge and inquire. You pay and leave before realizing you were overcharged, and only as an afterthought do you realize.

spacehome• 11 years ago

What is the "show you the receipt" scam?

ufmace• 11 years ago

How does that work exactly?

jstanley• 11 years ago

Is the scam that they've added extra charges to the bill, and therefore don't want to give you time to read it?

pjc50• 11 years ago

I recently read the extraordinary Naples 44, the diary of a British intelligence officer assigned to the place after its capture by the Allies. He talks about all of those things and more, including the theft of food from the army on a massive scale. Counterintuitively he loved the place.

carlob4• 11 years ago

Well is it really surprising that people were stealing food from the US army during WWII? I would have done it if I had trouble supporting my family.

carlob4• 11 years ago

Yeah, it's a bit dangerous, but it's one of the most beautiful cities I've been to. I guess it's easy to be scammed as a foreigner, but I've spent quite some time in Naples and I've never been bothered by anyone. On the other hand that's not something I can say of a supersafe place like Paris.

rufugee• 11 years ago

so I began looking through databases of hacked carding and cybercrime forums

Where does one acquire these databases? Genuinely curious...

Jemmeh6• 11 years ago

Credit card data is stolen all the time. Card skimmers, cell phones, cameras, just writing it down while working somewhere, pulled out of compromised email accounts, etc etc the list goes on. Criminals then upload them and sell that data online.

comrh2• 11 years ago

Read through Kreb's archive, he has screenshots and more info. If I remember correctly one was on the clearnet but required some sort of verification before you got access.

data_spy• 11 years ago

I've been a fan of Krebs for a while. He get's a lot of access and information from other hackers (that were pissed at another hacker) or security analysts. Gotta give him props though, he taught himself a lot, including learning Russian

mhurron• 11 years ago

Brian Krebs has done this once or twice, so he's built a collection of resources already making it a lot easier for him.

A simple answer would be there is more to onion sites and 'the dark web' than just the Silk Road.

imperialdrive• 11 years ago

I've had to decide to face down evil before... I went forward and it landed people in prison. I know I did the 'right' thing, but I didn't sleep well until moving away and wiping my online identity. I salute your work and wish you the best.

pierrec2• 11 years ago

It's interesting to see the moral ambiguity in this, in the comments and in the article itself. Perhaps the comment with the rarest insight of empathy is the one by Matthew B.:

"The people who conduct this type of crime often think of it as justified. After all, Americans are rich aren’t they? How could it hurt them to lose some money? We are poor, if they won’t share, we’ll just take it. We will make them share!

They think of it as a game. A lucrative game in which they get to win over and over again. Even those of them who may be kind to their friends and even generous with those they love, don’t really see their victims as people. Not being a member of their group makes the rest of us not quite human.

This type of tribal thinking isn’t as uncommon as you might want to believe. I’ve seen it here in the US over and over during my lifetime. Most people who suffer from it don’t consider themselves evil. They just consider the rest of us their lawful prey.

We tend to feel otherwise. Thanks for the great work Brian."

What I find a bit crass is the sensationalistic complete disclosure of identity employed - going all the way to the classical mugshot. All of this will certainly not help for Fly's later reinsertion, say, when he decides to get a job in IT. And I'm not playing devil's advocate here, it just seems to me that the author is pushing aside his inner moral voice in order to write a more viral article. Justice is taking care of prosecuting the criminal, but let's push him further down if it can attract some pageviews. I suppose I'm simply being bitter about journalism, though.

tptacek7• 11 years ago

You are complaining that Krebs doxxed a credit card scammer who tried to frame him for dealing heroin?

pierrec2• 11 years ago

Framing someone for dealing heroin is criminal and morally terrible. The guy's certainly paying and going to prison for it, and for his other crimes. This is justice doing its job.

The question that I'm trying to ask is whether public shaming, especially to such a large audience, is really a civilized response. The consequences are also devastating, and reduce the possibilities of getting a second chance at life, something that I strongly believe in.

ceejayoz• 11 years ago

All of this will certainly not help for Fly's later reinsertion, say, when he decides to get a job in IT.

Maybe he should find a career that's less likely to offer tempting access to other peoples' private information next time?

fsloth• 11 years ago

Theoretically, that shipment of heroin could have ruined his and his wifes life for good.

dec0dedab0de• 11 years ago

I dunno, he picked a fight and lost, and besides that carders are just generally scummy. If it were some kid who was only guilty of breaking into corporate/government systems for the heck of it, then I could see your point.

gtrubetskoy• 11 years ago

'(“cc” is a reference to credit cards)' - CC (and MUXACC1) is not a reference to credit cards, it's a reference to the Tsetse Fly https://en.wikipedia.org/wiki/Tsetse_fly which spreads Sleeping Sickness - https://en.wikipedia.org/wiki/African_trypanosomiasis - for whatever reason it's part of the Russian folklore used as a metaphor for something particularly nasty.

Edit: (thanks rnovak!) apparently "cc" in thecc[dot]bz _is_ credit cards, though the CC in MUXACC1 is definitely a reference to Tsetse.

rnovak• 11 years ago

Uh, he's referring to thecc[dot]bz which is a carding forum, which literally refers to credit cards (and is extremely common[1][2]). That excerpt is also nowhere near the MUXACC1 reference.

[1] http://www.acronymfinder.com/Credit-Card-(CC).html

[2] https://books.google.com/books?id=lGC2AgAAQBAJ&pg=PT48&lpg=P...

fjordames• 11 years ago

Not to simplistically vilify an entire city but Naples is a horrible, horrible place.

hackuser• 11 years ago

This statement has very serious implications:

    According to a trusted source in the security community, that
    email account was somehow compromised in 2013. The source said
    the account was full of emailed reports from a keylogging
    device ...

If I understand "security community" to mean law enforcement or intelligence agencies, that means they are sharing data from surveillance of private individuals with journalists.

This suggests that assurances about the security of that data and the integrity of their processes are not reliable. Who else is given this data? You may like Krebs and think it's justified, but who decides whose private data is ok to leak? What about your private data?

jcrawfordor• 11 years ago

I'm not sure that I agree with your policework there. The "security community" here almost certainly refers to a private security researcher or firm. I can't see why it would have been a government source.

In general direct information sharing is one of the most important things in information security, but the government has its hands tied in this area in a way that private companies do not.

tonyarkles• 11 years ago

A really interesting thing that isn't mentioned in the article, and I don't know that I've got all the facts right: is he being extradited to the U.S. for these crimes, while having never set foot in the country? Does that freak anyone else out?

Hacker Who Sent Me Heroin Faces Charges in U.S

Related Stories