Dutch-Russian cyber crime case reveals how the police tap the internet

http://electrospaces.blogspot.com/2017/06/dutch-russian-cyber-crime-case-reveals.html

by j_s • 9 years ago

88 10 9 years ago

electrospaces.blogspot.com

msh• 9 years ago

I don't understand why the ICQ traffic would go through the servers. Were they running ICQ on the servers for some strange reason?

nopcode• 9 years ago

Leaseweb is known to be a quite 'hands-off' provider, often the source of ddos attacks, torrent sites, etc.

Figures that Leaseweb, who doesn't do much (any?) self-policing ends up being a honeypot.

tinco• 9 years ago

Perhaps ICQ comms servers or proxies are located at Leaseweb? The AMS-IX is I think the largest connection between Europe and the US, it makes sense as a central location for a messaging service, or as pass through for messages between Russia and the U.S. (not sure what the lines are like the other way around the world).

raarts• 9 years ago

AMS-IX is the largest connection between Europe and the US

An IX (Internet eXchange) is not a connection, but is more like a giant switch, where internet access providers send local traffic, so they don't have to send it through their bandwidth providers, to cut bandwidth costs.

The AMS-IX is more or less the largest internet exchange in the world.

twiss• 9 years ago

The background article [1] in Dutch somewhat vaguely states that: (emphasis mine)

It's hard to do anything against this type of crime: the [ZeuS] virus is particularly effective and the owners are hiding behind anonymous internet browsers. And often they use the servers of the Dutch provider Leaseweb. In 2008, 27 percent of European data traffic went via the servers of this company from Haarlemmermeer. The police have an explanation for this. 'This is likely due to the combination of high-speed internet access, a relatively inexpensive product offering and a high degree of freedom and anonymity when setting up the leased facilities,' says an internal note.

[1] http://www.volkskrant.nl/kijkverder/2017/hacker/

nl• 9 years ago

Maybe the criminals were running a VPN server on the leaseweb servers, so incoming ICQ was encrypted but outgoing (to the ICQ servers) was unencrypted?

It isn't too clear.

zzzcpan• 9 years ago

Running a messaging client on a server, like centericq or irssi, was not uncommon, especially for someone from Russia, since all of their internet communications are openly surveilled.

Asdfbla• 9 years ago

"during a meeting with FBI and FSB, a Russian official came to a member of the Dutch police team, pointed at someone from the FBI and said "he is copying your data". An investigator went looking and saw that indeed the American had a thumb drive in a police laptop and was copying Dutch information"

Funny, but slightly depressing too. I wonder how it's like for security professionals working internationally when you always have to consider that your international partners are likely looking to stab you in the back. Would probably be too frustrating for me.

heyalexej• 9 years ago

Private Interne Acceess¹ uses Leaseweb quite a bit. I wonder if people using their services got intercepted, too.

[1] https://www.privateinternetaccess.com

bitxbitxbitcoin• 9 years ago

https://www.privateinternetaccess.com/forum/discussion/24134...

Dutch-Russian cyber crime case reveals how the police tap the internet

Related Stories