Interview with the Guy Who Tried to Frame Me for Heroin Possession

https://krebsonsecurity.com/2019/09/interview-with-the-guy-who-tried-to-frame-me-for-heroin-possession/

by snowy • 7 years ago

374 84 7 years ago

yardie4• 7 years ago

I wonder how much of his personal information was gleaned from "respectable" American companies like Lexis-Nexis, Equifax, and Transperian? I'm sure they gave everything and medical history for the price of a few coins. I have no respect for companies that don't respect my privacy. And I make it a habit of giving them as much useless, inaccurate information as possible.

chisleu• 7 years ago

Who do you mean by "his"?

Also, Krebs is a hell of a guy.

yardie4• 7 years ago

Vovnenko first came onto my radar after his alter ego Fly published a blog entry that led with an image of my bloodied, severed head and included my credit report, copies of identification documents, pictures of our front door, information about family members, and so on.

kerkeslager4• 7 years ago

And I make it a habit of giving them as much useless, inaccurate information as possible.

How do you do this? (Specifically, with the companies you mentioned.)

oyebenny• 7 years ago

I would like to know this as well.

ryanlol8• 7 years ago

Well, they were specifically posting a branded Accurint report for Krebs in the lampeduza (IIRC) thread.

staticautomatic• 7 years ago

Those vendors' reports cost $10-$20 and contain no medical records.

Breza2• 7 years ago

I'm currently working on a batch of information requests about myself to different data brokers and alternative credit reporting firms. I send a copy of my drivers license and a recent utility bill and they send me my records for free. It's shocking what I found the last time I did this.

deogeo• 7 years ago

Dig up the personal information of their owners, board members, and major shareholders, and publish or sell it - an eye for an eye.

brodsky2• 7 years ago

I'm not sure it's possible to "give" inaccurate information to Equifax.

brodsky2• 7 years ago

this was meant as a reply to yardie's comment, but my HN client won't let me edit or delete it.

creditReport1• 7 years ago

I work at one of the big 3 credit bureaus so thought I’d chime in -

It is entirely possible to report inaccurate information to the bureaus. Although more often than not it’s on accident, not malicious. Additionally bureaus collect a lot of information from other sources. Some public some private. It’s possible for these datasets to be error prone themselves.

There are however official procedures for disputing/correcting errors in reporting and in my experience they do a pretty good job of validating everything (as that’s literally the business they’re in)

yardie4• 7 years ago

Our son (10 yo) had a delinquent medical bill for reasons we don't understand. The creditor can't tell us who sent the bill because we aren't the named party and I'll be damned if I put him on the phone with them, because he is a minor. So, we're at an impasse and no one can tell us anything.

Someone managed to get his name and address and did not realize he was a minor. Brilliant system you have!

burnte• 7 years ago

There are however official procedures for disputing/correcting errors in reporting and in my experience they do a pretty good job of validating everything (as that’s literally the business they’re in)

I'd disagree with that. The three agencies have a couple of names I've never gone by (I go by my middle name, so I expect "Middle Last" and "First Last" but I never went by "First Mother's-Maiden-Name"), and a couple addresses I've never lived at on my records for 20 years. They refuse to remove them.

shakna• 7 years ago

There are however official procedures for disputing/correcting errors in reporting and in my experience they do a pretty good job of validating everything (as that’s literally the business they’re in)

Anecdotally, I can't agree with this.

I'm six months in to trying to convince Equifax that I exist. Apparently they accidentally registered me as dead in their system, which has caused background checks on me, like when I registered my ABN, to fail. Turns out there are a number of government systems that have been outsourced to them.

They have twice manually intervened, and twice their automated processes have "corrected" their information and relisted me as deceased. And getting a manual intervention is a lot of complaints, and a lot of escalations.

darkwater2• 7 years ago

Ouch, Poggioreale is not a nice place to be in.

cpach• 7 years ago

Why?

darkwater2• 7 years ago

Beside living side by side with people from the camorra ("camorristi"). This is a letter to an italian newspaper about living in Poggioreale (in italian) https://www.corriere.it/cronache/13_luglio_28/detenuto-poggi...

coldcode• 7 years ago

It's interesting that the "hacker" himself was caught via hackery. When I worked on anti-cheating stuff for a game company, I was able to stop the seller of the cheat because their cheat had been stolen and resold so they had to put anti cheating tech in their cheating tech and it opened a hole I was able to exploit to detect them.

cloverich• 7 years ago

Would you consider writing this up? Sounds fascinating.

metalliqaz• 7 years ago

sounds more like they had to put anti-piracy tech in their cheating tech

reificator• 7 years ago

Imagine you're selling a tool that lets players win every game.

Then imagine someone else starts selling another tool. Anyone who buys that other tool is now able to beat the players you promised a win to, AND they're not giving you any money for it. This damages your reputation, which in an underground market is probably your most valuable resource. So not only are they not paying you, but they're robbing you of future sales by damaging your rep.

Wouldn't you put in something to prevent users of your newest cheat from being cheated themselves?

TazeTSchnitzel• 7 years ago

Suggests something about honour among thieves.

burtonator• 7 years ago

Live by the sword, die by the sword. I low how they cheat steal and are upset when other people cheat and steal.

mirimir2• 7 years ago

Damn. It does seem that stupid mistakes took him down. Revealing too much about himself on his forum. I mean, if he'd been careful, compromise of that forum would have revealed nothing about him. And for Dog's sake, using the same password on low- and high-security accounts!

Of course, the real story could be hidden through parallel construction. But on it's face, this does support the argument that it's stupid mistakes that take people down. Krebs' blog is full of them.

Edit: And just to be clear, I'm not even suggesting support for that Ukrainian dickhead. It's just that criminal takedowns are well reported, and so provide cautionary lessons for the rest of us.

xoa• 7 years ago

Damn. It does seem that stupid mistakes took him down.

One possibility on the "cautionary lessons for the rest of us" front is a classic bit of wisdom about asymmetric adversarial situations: the other party only needs to get lucky once. There is a fundamental challenge of scale and time for any entity or individual that tries to run something dealing with persistent antagonists over long time periods, it just plain becomes hard to keep track of it all without further infrastructure systems in place. And its also hard for any single human to stay in the zone persistently, we're not really wired that way, hence the need for non-human support structures.

And that in turn is the same challenge for any business dealing with significant organic growth, criminal or not, it's the classic "that TOTALLY TEMPORARY one-off excel spreadsheet someone made 15 years ago now runs hundreds of millions of dollars" issue. It's hard to know ahead what will be important and sticky or not, even if experience helps. And it's hard to decide how to allocate limited resources too. Infrastructure you build helps you scale properly in the future, but it doesn't do anything for you right now, you might not even know you could need it. And overbuilding upfront might mean there is no tomorrow to worry about anyway.

It's a tough nut, though fortunately it's one area that is probably worse on the black side of things since there is less room for recovery from mistakes. Maybe it's one of the structural forces that can help encourage law abiding behavior, legit companies can mess up badly but still potentially recover if there is enough meat to them, whereas a total opsec break for criminals can mean the end of the enterprise.

mirimir2• 7 years ago

Yes. And I was thinking more of activists in repressive places. Who, notwithstanding what we might think of them, are criminals in the eyes of their governments.

celim307• 7 years ago

So this guy picked OP completely at random? I wonder why he was initially targeted

yellowarchangel• 7 years ago

The most important and missing information at the start of the article is _why_ the OP had their information posted on the forum, why they were getting sent this package.

dotancohen• 7 years ago

OP is a very well known security researcher. Here is his self-bio:

https://krebsonsecurity.com/about/

sedachv• 7 years ago

Here is a link to the original interview, since neither Krebs nor the people that made the translation seem to believe in citing their sources:

https://krober.biz/?p=3200#more-3200

JetSpiegel• 7 years ago

https://krebsonsecurity.com/wp-content/uploads/2019/09/Inter...

Here's the translated PDF. Either the original Russian was hacked up already, or this translation is very iffy.

kspacewalk2• 7 years ago

The original is full of barely comprehensible jargon, obscure code-speak, intentional spelling mistakes, etc.

Interview with the Guy Who Tried to Frame Me for Heroin Possession

Related Stories