Finland’s most-wanted hacker nabbed in France

https://krebsonsecurity.com/2023/02/finlands-most-wanted-hacker-nabbed-in-france/

by impish9208 • 3 years ago

258 169 3 years ago

Context on his most notorious hack: https://en.wikipedia.org/wiki/Vastaamo_data_breach

IMHO Zeekill represents the very worst kind of hacker: a greedy troll script kiddie who knows just enough to cause damage, and doesn't give a shit about the very real human cost.

fsckboy3• 3 years ago

the very worst kind of hacker: a greedy troll script kiddie who knows just enough

I know it feels good to make fun of and denigrate him, but frankly a worse kind of hacker is one who really knows what he is doing

rippercushions2• 3 years ago

At least we'd have a possibility of learning something new then.

MuffinFlavored• 3 years ago

I’m out of the loop but can you explain how he was able to get documents to therapy patients just by being a script kiddie?

like script kiddie to me, is trying to DDOS somebody with ping

jacquesm14• 3 years ago

Unsecured DB on internet facing server with default password/uid combo.

Ekaros• 3 years ago

That is the lowest skill level. Next one up which still qualifies as script kiddie is one that uses ready made attacks and libraries and so on in spray and pray style. Trying them in every possible place and finding those setup with utter incompetence.

boeingUH60• 3 years ago

Security experts soon discovered Ransom Man had mistakenly included an entire copy of their home folder, where investigators found many clues pointing to Kivimäki’s involvement.

The bane of every criminal. You only have to make one mistake to get caught and there are many chances to make that mistake.

Many criminals on the run assume they’re smart, but luck plays a big role in getting caught or not…I mean, this guy got caught because of an unrelated case of domestic violence.

ChuckNorris89• 3 years ago

Indeed, a lot of criminals think they're smart and that they'll never get caught while they do stupid shit.

An acquaintance of mine tried to dodge his mandatory military service by moving to the neighboring country and would (foolishly) drive to his family across the border every now and then thinking that because Schengen has no borders he would never get caught.

And it worked for a couple of years, until one day when a police car stopped him for a busted tail light and handed him over to the military police.

If you're gonna break the law, you at least gotta be smart and careful about it.

ghaff• 3 years ago

Some variation of not breaking ties with (supposed) friends and family generally is a pretty common theme in people getting their cover blown.

capableweb2• 3 years ago

And it worked for a couple of years, until one day when a police car stopped him for a busted tail light and handed him over to the military police.

Hence the always-true adage: If you're gonna break the law, only break one law at a time, not multiple.

netsharc• 3 years ago

Some Schengen borders have cameras that scan license plates...

namaria5• 3 years ago

You only hear about criminals that get caught...

GuB-422• 3 years ago

Even if criminals do no get caught, we know they exist when a crime has been committed and we don't know who done it. In fact, there are famous criminals who never got caught. Like the Zodiac killer.

Now, if you manage to hide your crime too...

ilovecurl• 3 years ago

The bane of every criminal. You only have to make one mistake to get caught and there are many chances to make that mistake.

There's a great scene from The Wire where this is discussed: https://www.youtube.com/watch?v=E2Fv-nJCfrk

pasiaj• 3 years ago

This was one nefarious operation by the hacker:

- He hacked the patient files of a psychotherapy center Vastaamo. This included therapy notes for more than 22.000 patients.

- First the hacker blackmailed the therapy center.

- Next he started blackmailing individual patients.

- Finally he released the files online revealing very private information on thousands of patients.

I can only imagine the horror felt by the people whose therapy notes were made public.

jnsie• 3 years ago

Absolutely heinous

tough• 3 years ago

and exactly why a paranoid person like me might abstain from ever seeking counsel from a therapist.

Not worth it

momeunier• 3 years ago

I thought the problem with Vastaamo was that the CEO was in charge of the mysql database and he was basically a hobbyist that didn't care much for security. (yeah zero proper sources for that... my level of Finnish is terrible) And then Murphy's law kicked it. A vilain nabs the data for free and does his thing.

Hamuko2• 3 years ago

MySQL server was without any kind of firewall protection for about 1.5 years, and the root account had no password.

https://www.iltalehti.fi/digiuutiset/a/69314f2e-bb1c-4ea0-8a...

to11mtm• 3 years ago

I can only imagine the horror felt by the people whose therapy notes were made public.

I might be in the minority here, but frankly I'd be -happy- to actually be able to see a therapist's notes on me. At least in my region, one of the first things you sign before any therapy begins usually contains a paragraph that such notes are 'IP' of the therapist/provider and thus something you as a patient are never allowed to see.

MidnightBullet2• 3 years ago

Sounds like something that would break GDPR

closewith2• 3 years ago

In the EU, at least, you have a right to all information that a healthcare provider holds about you, so either an administrative request or data subject access request will get you that data for free, and without the possibility of it being used against you by third parties.

this_steve_j• 3 years ago

There appears to be an excluded middle scenario that you are in fact describing, wherein a patient would be happy to peer behind the curtain at the doctor’s notepad for their own session (but not everyone else’s).

Fewer patients would be happy to see the doctor’s notes for all other patients including themselves.

Fewer still would appreciate having everyone, including non-patients, see not only their notes but all of the other patients in that practice.

cvalka• 3 years ago

In what universe would any client agree to this predatory arrangement?

Sharlin4• 3 years ago

Where I’m from we don’t even have to sign anything before therapy begins… much less some weird IP clause. And as another commenter said, such a clause would be invalid anyway.

closewith2• 3 years ago

Does Finland have a legal doctrine that makes evidence inadmissible in court if it was illegally obtained? I wonder could law enforcement use admissions of criminal activity in the released notes as evidence against patients?

vesinisa3• 3 years ago

There is no blanket provision to make unlawfully obtained evidence inadmissible but the judge must still forbid using any document that was i.a. obtained through a "gross" violation of the person's legal rights. So in this specific case the evidence would probably be inadmissible.

mikkohypponen• 3 years ago

Chapter from my book, about Case Vastaamo: https://ifitssmartitsvulnerable.com/s/vastaamo_excerpt.pdf

jacquesm14• 3 years ago

So, you get to add another set of paragraphs. Excellent writing by the way.

moremetadata• 3 years ago

And you seriously think the State hasnt done this for years, in plain sight, starting the day you born? You have a lot to learn.

h0p3• 3 years ago

So, how concerned are you with government use, either directly or indirectly, of machine learning?

capableweb2• 3 years ago

That was truly horrible, despicable.

But I personally relate more to the horror the hacker put himself through:

security experts soon discovered Ransom Man had mistakenly included an entire copy of their home folder
“It was a huge opsec [operational security] fail, because they had a lot of stuff in there — including the user’s private SSH folder, and a lot of known hosts that we could take a very good look at,”

What a huge flop! I can recall feelings myself publishing things I shouldn't, but the entire home directory, including private keys and everything? I'd die of shame.

Still, really terrible behavior from him, he deserves whatever punishment is coming for him.

iepathos• 3 years ago

Thought the same. Ransom Man aka Incompetence Man.

bawolff3• 3 years ago

I wish we would stop calling these types of people hackers and just call them extortionists. The fact a computer was used to commit the crime really changes nothing about the crime.

If he physically broke in we wouldn't call him a nortorious lockpicker.

grugagag4• 3 years ago

Hacker turned extortionist sounds like a better description of this guy.

labrador• 3 years ago

I think "cyber-criminal" is the term in common usage

amelius• 3 years ago

Well, it would make people think about spending money on better locks.

bungle2• 3 years ago

But on the other hand he is suspect, until convicted (probabilities, who cares, system does not work by probabilities).

Manuel_D• 3 years ago

The two are not mutually exclusive: A hacker that steals people's banking info and drains their funds is a hacker and a financial fraudster. Hackers conducting ransomware attacks are hackers and extortionists. The fact that a computer was used to commit the crime is just a detail of how the extortion was carried out.

pfoof• 3 years ago

For real, someone who has OpSec of his level (pack home directory to dark web) does not deserve to be named a hacker

verisimi• 3 years ago

But then, if you only criminalised the crime, you wouldn't be able to justify all the intrusion and tracking of people's online lives!

If you want to pass legislation to eliminate peoples privacy and justify the fascist governance structure (government + corporations working together) in deanonymising individuals, you have to show that it is special. This is what is really going on - its not actually some special new type of crime that the law hadn't catered for - that's just what its sold as.

So, because 'online is the problem' is actually a sales job, the more one heightens the risk of 'online', 'hackers', etc the easier it is to take everyone's privacy away on account of the perceived thread and the purported fix. People will be happy someone is doing something, given a terrible event (crime) occurred!

The reality is that crimes will always occur; the threats to safety are overblown and already covered by the law; the fix does not materialise as indicated. But if you were sold on the idea (as most are) and thought it would make a difference you will sign up (to less online freedom). It doesn't even matter that this is happened in Finland, or whether it even happened at all - as long as people think handing over more control to the governance structure is the solution.

The truth is that you bought into the ostensible excuses. No need to keep making that mistake though!

gala8y• 3 years ago

Yeah, to quote: "Don't Panic! A 'hacker' is different from a 'cracker'"

It's important to keep hammering it.

pyuser5832• 3 years ago

So were these files somehow scrubbed from the Internet? Or is peoples private info still out there?

It seems the Internet does have a delete button. Has it been used again?

jacquesm14• 3 years ago

No, you can't get rid of those files, they were uploaded in their entirety to anonymous file sharing services. It's absolutely horrible, and the damage to these people's lives is huge. The degree of lack of empathy that you'd need to have to blackmail the customers of an institution like that is one I have trouble comprehending.

agumonkey• 3 years ago

that's one of the lowest target crowd i could ever think of.. really rotten creativity from this dude.

neither_color• 3 years ago

Sometimes I understand hackers from developing countries(not Finland!) in bad circumstances who have a chip on their shoulder against corporations... but this is just as scummy as it gets. This is worse than getting into people's bank account IMO. Taking advantage of people who shared their deepest darkest secrets and vulnerabilities with a trusted authority is beyond cruel, it could trigger someone into self-harm or worse. These same hundreds of people will be afraid to open up to their psychologists again. I hope this psychopath is never allowed near a computer again.

Slighted2• 3 years ago

Thank you for stating the obvious that anyone in this thread would've known had they read the linked article for even just a minute.

tomalpha• 3 years ago

Such a summary can be very helpful to disambiguate the subject matter and save me (and I’m guessing many other folks too) the time of reading every article to find out whether it’s interesting/relevant to me.

helsinkiandrew2• 3 years ago

Actually it was 33000 patients. 22000 have so far made statements to the police:

https://yle.fi/a/3-12543823

The owner of the company tried to sell it a few months later without declaring the data breach to the new owners and has been forced to pay €8M compensation: https://yle.fi/a/3-12479562

lostlogin• 3 years ago

22,000 police statement were made?!

x98asfd2• 3 years ago

I don't care what encryption we are using. Therapy notes should always be in paper and locked in therapist office. Medical info should have NEVER being digitized.

sofixa2• 3 years ago

Vehemently disagree. Stifling progress because of the risks involved isn't worth it, the risks need to be assessed, acknowledged and accounted for.

Digitising medical info is brilliant and extremely useful for anyone involved. Handoff between practitioners is seamless, and no more of the redundant "are you allergic to anything? any priors? are you taking any meds?", because the practitioner knows everything they need to (e.g. your dentist doesn't need to have access to your therapy notes, but should probably know all meds you're taking and all previous dentistry work done on you, wherever and wherever that happened). It would also allow for country-wide anonymous statistical analysis. Oh, everyone taking pill X is also having Y? Is there a problem there? A lot of people getting operated for A used to do Z, C, so maybe we need a better educational campaign so people know the risks? The possibilities - life saving, medical system improving, etc. are enormous.

It just needs to be handled with extreme care, because the risks are enormous. Security should be top notch, with strict access controls, anonymisation where needed, etc.

watwut3• 3 years ago

That ship has sailed years ago.

spyremeown2• 3 years ago

Definition of a script kiddie with too much time on their hands... I hate people like him. Could've done something good with his life (like getting into info/cybersec!).

boomskats• 3 years ago

like getting into info/cybersec!

I'd argue that's exactly what he did. He's just gone for the Mitnick method.

spyremeown2• 3 years ago

Mitnick was (is) great at social engineering. This dude is just an a-hole.

KMag3• 3 years ago

I have some sympathy for Mitnick. My understanding is that most of the damage he caused was due to opportunity cost and direct costs of catching him, at a time when a direct path into a security career was less obvious.

bawolff3• 3 years ago

Tbf the average infosec job is writing lots of policies, checking to see if people follow them, writing reports, nagging teams to update their outdated dependencies, etc. Of course there are many types of infosec professionals and not all infosec jobs are like this, but i kind of doubt someone like this would be all that happy in an entry level infosec job.

GuB-422• 3 years ago

That's why despite having some knowledge about infosec, I don't want to make it my job. Pentesting looks like fun, but the real job seems to be about writing reports, applying policies you know don't make sense and not applying policies you know make sense, and if you block something, you get yelled at because you blocked it, allow it and you get yelled at because you allowed it. This is the kind of job where you are given a list of a thousand software and dependencies, get asked about vulnerabilities, find thousands of them, look how relevant each one of them is, write a report about what needs to be fixed/updated, get told it is too expensive and that you should find a cheaper solution and half ass something that you know is both too little and too much just to fit the allocated budget.

watwut3• 3 years ago

Could've done something good with his life (like getting into info/cybersec!).

Very likely no, he could not. Being able to harm people does not imply ability to secure systems. Nor ability to learn advance tech while we are at it. Nor ability to obey contractual limits if you are red team.

And it would be pretty idea to employ person with such a bad judgement in any of those positions anyway.

joemazerino• 3 years ago

Blackhats are notorious for bad opsec.

namaria5• 3 years ago

Blackhats that get caught get notorious...

lefstathiou• 3 years ago

It’s a losing proposition eventually even for the ones that don’t. They are competing against significantly more people with significantly greater resources and access. It’s like those hackers that held up the energy company a few years ago and woke up one day to find their anonymous crypto wallets empty. Was supposed to be impossible but that doesn’t account for America literally owning the internet back bone. Cause enough trouble and they’ll show up at your door. The only protection is state sponsorship (ie Russian and Chinese hackers on government payroll).

seb1204• 3 years ago

Came here to ask why he is called a hacker when he is clearly lacking in the responsibility and do no harm side. Cracker, Blackhat or script kid...

m00dy• 3 years ago

>> “It was a huge opsec [operational security] fail, because they had a lot of stuff in there — including the user’s private SSH folder, ..."

no shit sherlock

dang• 3 years ago

Can you please stop posting unsubstantive and/or flamebait comments? You've been doing it repeatedly, unfortunately, and we eventually have to ban such accounts.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

hnthrowaway03152• 3 years ago

I don't get the logic here. If I had the ability to pull off a sophisticated hack, why shouldn't I sell my skill to say a corporation or intelligence agency but instead tried to grab quick dough and got caught? Am I stupid enough to believe that I can be out of the radar of state power?

Hamuko2• 3 years ago

Nothing about this was sophisticated.

hnthrowaway03152• 3 years ago

I mean the fact it got carried out successfully might say something. I don't know about the tech details though...

Slighted2• 3 years ago

People have varying motivations for committing crimes. Highly skilled (or just simply lucky) black hat hackers can potentially make millions, which is far more than governments and corporations will hand over for equivalent activities.

jacquesm14• 3 years ago

They don't 'make millions' they steal millions. Just like a bankrobber can get their hands on more money than a typical bank will pay to their tellers.

maeln• 3 years ago

He managed to put his entire /home folder in the leak, which lead to his identification. I am not sure I would like someone like him to work for my intelligence agency.

Anonasty• 3 years ago

It was not a sophisticated hack. He just happened to find MySQL server which was left on DMZ/public internet with root and no password. Then he just dumped the database to his computer. Basically script kiddie who thought he was lucky.

ed25519FUUU• 3 years ago

Fitting that the criminal blackmailing people with their own personal information accidentally uploaded his home folder, including his SSH keys and known_hosts file.

grugagag4• 3 years ago

Sounds like kharma caught up with him swiftly

orwin• 3 years ago

I don't know if this is ridiculous or sad...

The guy obviously need psychiatric advice and "hacked" then blackmail a psychiatric institute.

But good job by the Courbevoie police. If it was any city north of Asniere i would have been more than impressed by the changes of our police force, but still, responding quickly to domestic violence even in a rich city is an improvement compared to five years ago. Still nowhere close to Spain, but baby steps.

kzrdude• 3 years ago

He's got a real named reddit account, that's an interesting choice.

grugagag4• 3 years ago

He could’ve used that as decoy while posting bad stuff with a different account.

costco2• 3 years ago

These are his from a long time ago:

https://camas.unddit.com/#{%22author%22:%22uhx%22,%22resultS...

https://camas.unddit.com/#{%22author%22:%22uhxuhxuhx%22,%22r...

A bunch of IRC logs too:

https://google.com/?q=%22zeekill%22+site%3Apastebin.com

Including one where he basically extorts one the founders of ImageShack.

He has left quite the trail.

sourcecodeplz2• 3 years ago

Why would the records be in a database in the first place? That seems like such a sensitive type of info, at least don't attach real names to them geeZ.

VWWHFSfQ• 3 years ago

where else should they put them

sourcecodeplz2• 3 years ago

On paper I imagine but I wouldn't know.

lalopalota• 3 years ago

filing cabinet

Sharlin4• 3 years ago

Where do you think records were stored before computers were invented?

gruez• 3 years ago

It's pretty common: https://en.wikipedia.org/wiki/Electronic_health_record

potrebitel• 3 years ago

"Finnish police said Kivimäki also used the nicknames “Ryan”, “RyanC” and “Ryan Cleary”"

There used to be a user on HN, going by the nickname "ryanlol" [0] who seemed to have (had) good hacking knowledge. Could be the same person, could be not. But they had good comments here and there, was fun to read back then.

[0] https://news.ycombinator.com/user?id=ryanlol

jacquesm14• 3 years ago

He got warned by his buddy nachash (loldoxbin) that he should unplug his internet connection if he didn't want to spend time in jail again.

https://news.ycombinator.com/threads?id=nachash

He didn't take that advice.

He's been on HN under a large number of accounts, in particular giving people advice on obtaining alternate identification papers (Romania was mentioned in particular).

https://news.ycombinator.com/item?id=34156119

So much for that I guess.

rdl• 3 years ago

I assumed that was the "real" Ryan Cleary (LulzSec), not the Finland guy who was impersonating him.

jacquesm14• 3 years ago

https://stylometry.net/user?username=ryanlol

The first 10 are afaik accurate, the last stopped posting 3 days ago so that's a point of evidence.

nibbleshifter3• 3 years ago

The "real" Ryan Cleary hasn't really been online in any capacity as "himself" since his arrest over ten years ago.

costco2• 3 years ago

That was him: https://news.ycombinator.com/item?id=10846051. He's been posting under various alts since, see the stylometry.net link below. Reading his comment history, unless he was just lying for HN e-cred it seems he was very wealthy. Probably an early BTC user?

zoover2020• 3 years ago

Shame their talent couldn't be used to do good indeed.

Although posts about relatively young hackers who went the rogue black hat route always intrigue me.

I used to be a super curious script kiddy but fortunately found my solace in programming (relatively unharmful) scripts for games and private servers that'd only affect virtual economies.

But I also used to stroll gray/black hat forums out of curiosity and always wonder where I would've eventually end up if I did go down that path.

Fortunately, I'm in FANG now and make good bucks to never have to consider black hat again.

It's just in the back of my mind: what if ...?

dry_soup• 3 years ago

There wasn't much talent involved in this hack. The CEO and solo self-taught developer of the psychotherapy place left a test server running on the public internet with the username and password root / root.

riskpreneurship• 3 years ago

You would probably make more money if you were any good at gray/black hat stuff. Further, if you were less blatantly evil than this individual, you'd probably be able to finagle a slap on the wrist followed by a stable career in civilian street if/when you got busted.

One of the things that you learn as you grow older is that you can't be successful and have a conscience at the same time in this world. Software developers are fortunate enough to be able to scrape out a comfortable existence without stooping too far, but don't kid yourself: the large TechCos that sign our paychecks and buy our startups are not paragons of virtue.

jacquesm14• 3 years ago

Slight problem though: a slap on the wrist is still a criminal record, and if you're unlucky your 'slap on the wrist' may end up being a much harsher sentence and if you piss off the wrong person other kinds of retribution.

Large TechCos can - for now - not be jailed but you can and you will, see TFA.

Less blatantly evil doesn't mean you're going to walk away free, besides, you'll be a blackmail target for life.

Oh, and it is quite possible to both be successful and to have a working conscience.

bilekas• 3 years ago

Kivimäki was ultimately convicted of orchestrating more than 50,000 cybercrimes. But largely because he was still a minor at the time (17) , he was given a 2-year suspended sentence and ordered to forfeit EUR 6,558.

When crimes perpetuated online can effect so many people, can we stop treating them like regular crimes. That's ridiculous.

I might aswel defraud as many people as possible before 18 years and basically get away with it.

jacquesm14• 3 years ago

Well, he got away with it so far. But note the 'suspended' bit. That may well come back to bite him now.

rendall• 3 years ago

Kivimäki, a 25 year-old... involvement in cybercrime dates back to at least 2008

Whoa. Just 11 years old he started.

Got busted after a domestic violence call, after a night out. Just, a pathetic life.

qwerty456127• 3 years ago

We should stop arresting hackers. We should pay them instead. Not just in officially declared bounty programs with specific conditions but anytime they break something and tell us what and how. This is the only way we can build a reasonably secure digital ecosystem. If we don't, most of us will have their sensitive data leaked sooner or later.

npteljes• 3 years ago

The largest problem with this is that when you pay someone for blackmail, there's nothing stopping them from blackmailing you again. Same with extortion, and frankly, same with this guy right in this case. Governments also don't negotiate with terrorists, you might have heard that before. https://en.wikipedia.org/wiki/Government_negotiation_with_te...

except when they do of course.

nurettin• 3 years ago

A lot of talented people get paid for white hatting. This guy just really really wanted to earn money as a criminal.

You can also argue that he could have gone the bug bounty route if he could, but didn't have the skills.

m000• 3 years ago

We should stop arresting hackers. We should pay them instead.

This like advocating, "We should stop arresting people for gun violence. We should pay them instead."

The vast majority of these "hackers" just happen to be more handy with the digital equivalent of a gun and have more propensity for crime than your average Joe. Their "tell us what and how" would hardly worth your time, nevermind paying.

jcq3• 3 years ago

"Kivimäki’s apparent indifference to hiding his tracks" how come

nibbleshifter3• 3 years ago

He was a literal child/teenager for most of his criminal career.

sylware2• 3 years ago

did not know scandinavia could have such trash.

namaria5• 3 years ago

That's racist. Scandinavia (and Baltic countries, which is where this guys is from btw) has plenty of trash.

KMag3• 3 years ago

It could be nationalist/originist instead of racist, depending on if they literally thought Scandanavia didn't have such people, or if they intended to convey that they didn't think ethnic Scandanavians could act in such a way.

KMag3• 3 years ago

There are really terrible people everywhere, luckily in low percentages.

Finland’s most-wanted hacker nabbed in France

Related Stories