IAmA a malware coder and botnet operator, AMA

http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet_operator_ama/

by Devko • 14 years ago

459 191 14 years ago

JWhiteaker• 14 years ago

Magnetic stripes are the most hilarious thing ever, but still work almost everywhere on the globe.

I am amazed that magnetic stripes are still the norm for credit cards in the US. Europe has managed to move all but completely to chip-based cards, but the US hasn't.

Does the cost of fraud due to magnetic stripes outweigh the cost to upgrade the entire US system, or is the market just too fragmented to coordinate such a transition?

ajross2• 14 years ago

Credit card fraud is actually a fairly small problem in the US. Wikipedia tells me that the total cost of fraud is 0.07% of the transaction value. And I suspect (without evidence) that the bulk of this is made up of remote purchases, not swiped activity.

Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat. No, they're probably not actually worth it in terms of the cost of upgrading all the infrastructure.

A serious upgrade would need to look at things like two factor authentication, c.f. Google Wallet, etc...

raverbashing3• 14 years ago

"Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat"

Absolutely not!

In the US fraud may be small (but it's increasing). But magnetic stripes are very unsafe

Chip'n'Pin may have some issues, but it's much safer to most common attacks such as

- card stripers (very inconspicuous) - physical theft of the card (because it requires a pin)

And, as someone that had a striped card, it's a pain (even if liabilities are $0)

farnsworth2• 14 years ago

It's not fair to just look at it in terms of the cost of fraud vs. profit. Consumers whose CC info is stolen aren't liable for fraudulent charges but it can still be very expensive and time-consuming for them to correct everything, not to mention the affect it can have on a credit score. And obviously, the consumers don't get any say in whether the costs to upgrade the infrastructure are worth it.

mseebach• 14 years ago

Try to find the value of all swiped CC transactions. Then take 0.07% of that number. I'm guessing you'll be hard pressed to call the result "fairly small".

corin_2• 14 years ago

The whole chip and pin thing is pointless though, my company credit card gets used by plenty of people who don't know the PIN thanks to online/phone purchases, and in the past when I've forgotten a PIN, or just got a new card which I haven't yet received a PIN for, I've had no problem persuading shops to let me swipe them (magnetic strip) and sign for it instead.

Chrono• 14 years ago

The US still uses checks, can't expect much...

sakai• 14 years ago

Well, clearly this guy's moral compass is a bit out of whack, but the IAmA does offer some fascinating insights into this world...

diminish4• 14 years ago

yea, the world is a weird place. seeing a lot of angry ethical reactions on reddit, i can't help but think: on one side, there are people like this guy in the comments who left marketing a health product due to false claims, or me refusing to code for certain clients based on "personal" ethical judgments and on the other side there are these "crackers" who steal the credit cards of random people and who even hate them.

one thing i want to believe, you can't build a future on crime, or can you?

white_devil6• 14 years ago

What is this I don't even..

It sounds like you're considering a life of crime. Probably thinking about how you could be like that botnet guy on Reddit. Getting money without working is a nice thought, after all.

You know, the "ethical reactions" stem from that guy doing evil things. He knows he's being evil but doesn't care. Some people find that appalling.

For him, it's just an easy way to make money, and the fact that he produces no value to society at large is irrelevant. He even gets to work on challenging problems!

In fact, what he's doing is quite similar to working for the financial industry, doing HFT or whatever. It's clearly wrong, and clearly harmful to mankind, but it's easy money, so ethics are thrown out the window.

It is generally easier to make money by scamming/abusing people than by doing something valuable. That doesn't mean you should.

jacquesm11• 14 years ago

> one thing i want to believe, you can't build a future on crime, or can you?

You definitely can.

But whether or not you would want to is another thing.

AJ0072• 14 years ago

You can't build a (very good) future on crime, but you can build a future on being evil. There is a reason lawyers have a bad reputation.

vibrunazo3• 14 years ago

I'm pretty sure that just by having done that IAmA alone, that guy has already done greater good to humanity than 99% of all human beings on this planet ever will.

Questioning his subjective opinions on morals sounds a bit of a waste of energy after this.

tripzilch2• 14 years ago

> I'm pretty sure that just by having done that IAmA alone, that guy has already done greater good to humanity than 99% of all human beings on this planet ever will.

Can you explain? I really don't understand? Because it's making people more security-conscious or something?

etherael• 14 years ago

It was quite interesting to me how he rationalised his behaviour; Yes, it's a bad thing to do, but at the same time the world is full of bad actors, unscrupulous politicians and out of control corrupt financial institutions, so really I'm just acting in accordance with the established order.

I think people don't consider how the blatant and endemic corruption in society affects the moral codes of ordinary people very often, but this is a good case in point.

citricsquid• 14 years ago

Most of what he says is obvious stuff and the emphasis he puts on how much he modifies stuff makes me assume he's someone that just runs programs and doesn't have any unique insight, but he does make one interesting point:

> Try to use "Verified-By-Visa" and "Mastercard-Securecode" as rarely as possible. If only your CVV2 code is getting sniffed, you are not liable for any damage, because the code is physicly printed and could have been stolen while you payed with your card at a store. Same applies if someone cloned your CC reading the magnetic stripe or sniffing RFID. Only losing your VBV or MCSC password can cause serious trouble.

Does anyone know if this (using verified-by-visa, mastercard-securecode remove any payment protection if you get key-logged etc) is correct?

njs123452• 14 years ago

I really wouldn't be surprised. The security group at my university do a lot of stuff on banking security, and from what I've heard, this was one of the main reasons behind the switch to chip-and-PIN in the UK --- the user is now liable when his card gets stolen and used.

DanBC• 14 years ago

Richard Clayton (etc) have lots of interesting stuff about bank security (and the lack of) - they've attacked chip and pin, which means that if someone does manage to defraud the card the owner might have some chance of getting the cash back.

shabble• 14 years ago

See, for example, Tetris on a ('secure hardware' platform) chip & pin machine[1]

The same group (security research at cambridge) are also the ones who produced the 'chip and pin is a joke'[2] paper you might be referring to.

[1] http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-termi...

[2] http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-i...

mibbitier2• 14 years ago

That's not really true.

The user is liable if the card is stolen, and it is used to conduct fraud using the PIN code.

If the card is stolen, and the fraudster simply uses it online, or via some place that doesn't ask for a PIN, then you are not liable for that fraud.

I'm sure there are rare edge cases, but my experience with Barclays has always been very good in this regard.

coffeejunk• 14 years ago

at least for mastercard this is true: as per my banks tos i have to take care that nobody gains access my 'securecode' and i am liable for any unauthorized charges. (because the 'securecode' is supposed to guarantee that it is me who is using the card)

henrikschroder• 14 years ago

> Does anyone know if this (using verified-by-visa, mastercard-securecode remove any payment protection if you get key-logged etc) is correct?

Yes. It's the whole point of the system, to remove even more risk from the CC companies and banks, and put it on you.

epoxyhockey• 14 years ago

My experience with mastercard-securecode is that I can just enter gibberish until it fails the check, then my purchase goes through anyway.

mey• 14 years ago

As someone in the financial payment industry, let me shed some light on it. 3DSecure (the generic name) when used, generally prevents the user from issuing chargebacks, even in the case of fraud. It's a Terms & Conditions change basically for that purchase. Since your credentials can be hijacked at your web browser level, it is possible to give up your credentials AND give up your ability to re-mediate the issue later.

If you are purchasing stuff online, I advise using a credit card and CVV. Federal law (in the US) limits your damages to $50 total in the event of Fraud. (Not true of debit cards, or 3DSecure).

http://en.wikipedia.org/wiki/3-D_Secure

aneth4• 14 years ago

I'm not familiar with this service. What is the advantage to the consumer in exchange for losing their fraud liability protection?

dlgeek• 14 years ago

The only merchant that I've ever seen this used at is Newegg and they make it mandatory for Visa.

leif• 14 years ago

When a website asks me to use one of these, and I don't want to, how do I decline but still make the purchase? It always seems like my options are take-it-and-like-it or don't complete the transaction. Is there a third option?

czzarr• 14 years ago

wondering the same thing

el_presidente• 14 years ago

Paypal.

pmjordan• 14 years ago

I've had certain websites require VbV for purchases. I can only assume the transaction fees are lower for such transactions, or they got some kind of other deal from their merchant bank.

The worst part is the information required for the "I forgot my password" process is often not terribly hard to get hold of (date of birth, that kind of thing).

The best option at this stage is probably to have a "normal" credit card for everyday use which is specifically NOT VbV enabled, and a special VbV credit card that you keep at home for internet purchases from companies that require it. Or just don't buy from those companies.

alexg0• 14 years ago

Use AmEx.

starwed• 14 years ago

I had this pop up today, the wording was pretty misleading.

In my case not activating Secure By Visa let me proceed with the transaction normally, but they certainly tried to imply it was necessary.

jacquesm11• 14 years ago

VBV (or 3D secure as it is called today) is part of a move by the credit card companies and the banks to push the risk to the most vulnerable party, the consumer.

The idea is that this absolutely crack proof scheme requires you to authenticate yourself to your bank in a fairly complex three way handshake.

In the old (read pre-VBV) days the card companies and issuing banks would saddle the merchants with any charges that were disputed using the chargeback mechanmism.

Verified-by-Visa removes this safeguard by adding an additional layer of authentication which supposedly has the same strength as you being on-premise and signing on the dotted line to authorize your purchase. This will effectively remove a lot of the excuses that you might have had such as 'it wasn't me', 'I wasn't there' and 'I never meant to buy this', which were the most common excuses consumers would come up with after using a service for anywhere up to 6 months and then yanking back all 6 months worth of payments and saddling the merchants with the loss of income, pay-outs to affiliates already made and additional charge-back fees on top of that.

So even if the goal was a fairly noble one it looks as though the whole idea is predicated on one tiny little detail, which is that VBV is supposedly hack-proof, but in fact this is highly dependent on both your bank and the security of their implementation. Neither of those are as ironclad as they should be to remove all doubt.

But of course the banks/card companies are not willing to end up holding the bag if there is trouble so it falls to the consumer to prove that they really were not involved in the transaction and that is very hard.

On the positive side in this whole debate: Even if a consumer is defrauded there is always someone who benefits and following the money usually leads to the perp. That's why it is hard to order stuff online with credit cards that were not issued in the country that the person using them is from, that's why it is hard to spend your money on three different continents with the same credit card within a single day and so on.

Lots and lots of money goes in to early warning fraud detection (before the fraud happens) and this nips a very large percentage of potential fraud in the bud.

computator4• 14 years ago

> VBV is supposedly hack-proof

Something very strange I noticed with Verified by Visa and with Mastercard Secure Code is that both sometimes forget that you have already enrolled and make you re-enroll (i.e., answer their weak "security questions", like date of birth, and then choose a password).

It happened once with Verified by Visa and twice with Mastercard Secure Code so far. (No, my card numbers had not changed.)

These systems can't be trusted to even reliably remember my previous password.

chris242• 14 years ago

I've only used VbV once or twice, years ago. Do they still use iframes? I've never understood why they try to make the site more "secure" by using these services, but then use an iframe so the average user can't easily confirm if the login screen is legit or not.

jentulman• 14 years ago

In the UK I see it occasionally. Oddly enough it's mainly when I order food online.

It really peeves me that they are training people to accept entering sensitive information into something it would be so very easy to fake. There's nothing to prove that it is actually what it says it is. On top of that, if you forget your phrase the security question (the usual researchable ones) and answer sequence happens within the iframe without recourse to any external site or emails.

As other comments have said, none of this is for the customers benefit.

huhtenberg2• 14 years ago

Verified by Visa is a fucking joke.

In Canada it pops up a browser window that prompts for various personal information and its URL points at ... drumroll ... https://secureserver.net. If that's not by the book appearance of a phishing site, I don't know what is.

jodrellblank• 14 years ago

Really? Because SecureServer.net is a domain used in GoDaddy's webmail:

https://login.secureserver.net/

computator4• 14 years ago

It's actually https://www.securesuite.net.

I very suspicious of that the first time I was subjected to Verified by Visa.

The other thing that infuriated me about Verified by Visa is that when you are forced to sign up for it, it thanks you for choosing to sign up. The only choice I had was to sign up or not make the transaction!

Zarathust• 14 years ago

Somewhere in the thread he says that he started coding around operation payback. That is december 2010. I would assume that either he is truely a genius or that his abilities to program properly are limited.

elorant• 14 years ago

I don't understand how these people sleep at night. The whole notion I didn't make the game I just play the ball is just hilarious.

Furthermore those guys don't understand that eventually they're hurting the web. All that will bring stricter legislation and governments will start enforcing rules like IP identification for just about anyone out there.

I can understand organized crime exploiting the cyberspace. But for individuals its just plain stupid.

Monotoko• 14 years ago

They are just like petty criminals in real life, you've seen what surveillance and legislation does in real life... virtually nothing. The smarter ones go into the cracks and the shadows (Tor) which just leaves us folk being monitored for no reason, but we're okay with it because "it's helping to stop crime"

There is also the addition that you are just interacting with a computer, a keyboard, a mouse and a screen. I bet if you asked this guy if he would go out and mug someone he'd say no, because he'd be face to face with the person... he'd see the upset and pain he's caused.

Not saying it's right, but there is certainly a bit of psychology involved here, gaining from the computer doesn't seem like a crime to those not in charge of their own compass.

intended2• 14 years ago

Well, those speed bumps increase the fitness requirements for a short time of hackers. So it's not a total loss/ black-white picture.

driverdan3• 14 years ago

This is a big part of a lot of the talks I give about my criminal past. It's not like you wake up one day and decide to start committing fraud. It's a gradual, slippery slope. Humans can, will, and need to rationalize everything they do. As you slide down the slope the rationalization becomes, well, less rational. But you don't see it that way. If you did you wouldn't be able to do it.

mikemarotti• 14 years ago

The fact that this guy even posted an AMA shows that it's either entirely fake (doesn't seem it), or he's way too cocky. I suspect some trouble may be coming his way soon. He seems to think that he's infallible and that he won't catch a charge for running a botnet.

corin_2• 14 years ago

From what he says I agree that he seems either stupid or a liar, but I'm not sure about your premise, it's not hard to post an AMA that can't be linked to you.

Jach• 14 years ago

For the average cyber-stalker, that's true. But I'd wager if some government agency actually wanted to track him down (he's probably too low-value of a target), he's revealed more than enough bits of information about his personal life for them to do so.

tlear• 14 years ago

It is more of an attitude that he has. He either gets out soon or he will get caught sooner or later, the longer you go with attitude like that the more proud you become, the more shortcuts you take and then one day you make one mistake too many

emilis_info• 14 years ago

Every bit of bragging about himself makes it easier to find him. He has disclosed this information so far:

* He tried to apply for a job at Kaspersky during last year. Didn't have enough credentials and still whines about it. * He hangs out on Anonymous IRC. * Uses Liberty Reserve. * Exchanges bitcoins to dollars (periodically I guess). * May be German-speaking. Understands Russian.

16s3• 14 years ago

The CVV2 is not recorded in the mag stripe.

vibrunazo3• 14 years ago

Ooohh.. so that's why those websites ask for it. Learn something new every day :S

16s3• 14 years ago

They can't store the CVV2 either. Doing so, even encrypted, violates PCI-DSS.

wgx2• 14 years ago

Also, whether websites do or don't ask for it depends on their (and their merchant banking) risk appetite.

Sometimes banks make it mandatory, sometimes not. It's not * required* to make a transaction, it merely offers an (optional) extra level of security.

tferris• 14 years ago

WTF

tuananh2• 14 years ago

* About 20% of the users have good graphic cards, but are not sophisticated enough to install drivers.

* 30% of victims are Americans.

* 80% have an antivirus installed.

* An average income of $40 per day (bitcoin only). May vary up to $1,000.

rntksi• 14 years ago

Thanks for the summary.

People obviously think they're safe when they have an AV solution installed...

smsm423• 14 years ago

$40 per day is weak. Less than California minimum wage. And the risks are considerable. Reminds of the work of Sudhir Venkatesh who found that average wage for drug dealing grunt is about $3.30/hr - not far from what we're seeing here, though at least bot herder doesn't risk being shot. He is right that this thing has no future for him.

computator4• 14 years ago

> About 20% of the users have good graphic cards, but are not sophisticated enough to install drivers, so my [Bitcoin] miner can't run.

If he has root-level control of the systems, why doesn't he install the needed drivers himself?

Somebody already asked him this question on reddit, but he didn't answer.

Does anyone have any idea why he wouldn't/couldn't/shouldn't install drivers himself?

fromhet3• 14 years ago

Also, why not mine litecoins (cpu's are good at doing that, so no drivers needed and he can mine bitcoins at the same time) and sell them for bitcoins? They are worth enough that his profits would go up noticeably much.

mikek• 14 years ago

Great nugget:

> a US credit card costs 2$ on the black market and a UK starts at 60$, americans are all in debt.

simonsarris• 14 years ago

Well this could be because US credit cards are magnetic and UK ones are (much more secure) chip-and-pin cards.

farnsworth2• 14 years ago

Yeah, this has got to be it. Non-US CC info seems much more difficult to acquire, and thus more valuable. And just because Americans are in debt (obviously not all) doesn't mean their credit cards are maxed out.

blackman• 14 years ago

I know that the criminals probably haven't caught up and this technology may not be widespread (so your argument holds) but...

chip and pin is definitely broken (defcon presentation) http://www.youtube.com/watch?v=JABJlvrZWbY

smackfu2• 14 years ago

I would also think Americans tend to have higher limits if they are in debt.

Retric3• 14 years ago

It's because you can't do a charge-back with a UK card and get your money back.

barrkel2• 14 years ago

Unless charge-back means something different to what I think it does, of course you can with a UK card. The terms and conditions may be different, but the usual fraud etc. is covered.

dennisgorelik• 14 years ago

I assume that's because in the US responsibility for the fraudulent purchase is on the merchant, while in UK customer is more likely to hold the bag.

driverdan3• 14 years ago

It's a supply issue. The supply of US cards is high and UK cards is low.

CoffeeDregs• 14 years ago

Great post. I forwarded it on to my family and friends in order to give them some awareness of the people who're looking at them from the other side of the internet. Rather than sending more strident "think before clicking" warnings, this post is a great way to get them to think like an attacker so that they can avoid the attacks better.

diminish4• 14 years ago

Now, what has to be done not to get hacked ends up being answered as; AVs won't help, macs won't help, linux won't help, and use ipad? are we heading towards a world where average users will end up in managed computing behind walls, and only some hackers and crackers will use open computing? is computing doomed to be a the black and white world of tyrannic rule vs. mob rule?

azakai2• 14 years ago

> linux won't help

? He says Linux does help.

diminish4• 14 years ago

but he says, only because it is not much common, and different distros are too diverse to justify an "investment"

slig• 14 years ago

He's also been a coder for only one year... if he actually modifies stuff, that sounds very impressive.

andr3w321• 14 years ago

There's so many legal ways this guy could make just as much money with his skills. I never understood why someone is willing to put his freedom at risk when that is the case.

I guess he's just lazy or thinks he's incapable of making as much as easily legally, maybe he likes the thrill and challenge of it all, maybe he thinks he's invincible and there's zero chance of him getting caught. Either way he's very foolish for continuing to do this especially if he has no endgame in sight.

K2h4• 14 years ago

I have read that in many criminal enterprises it is much like business, where grunts at the bottom have lower income and lots of hours, and most of the risk (exposure). I think this guy is a grunt, probably at the same level of structure of a 2 employee business. when i read through his comments i am struck with the impression that he has passivly attempted legit employment that use the skills he has learned but has not been sucessful yet. he probably has his initial goals set to high. if he starts at the bottom somewhere, given his supposed skill level he should be promoted quickly. just need to put in the time. if not patient enough, put that effort into consulting.

given the real return on his enterprise, i agree with your assesment that he can probably make much more with a real legitimate job and just avoid that risk altogether.

option_greek• 14 years ago

It's fascinating to know all this stuff from his perspective but the moral attacks by others in the comments truly suck. What is the point of AMA if all they do is attack the one sharing information.

andypants• 14 years ago

Especially downvoting his comments. Like he cares about karma points. All it does is push all his responses to the bottom or hide them. Then what's the point of an AMA?

K2h4• 14 years ago

I very much enjoyed the reading of his comments - I pulled a few of his that others may find interesting.

[polymorphism code - to hide virus signature]

Randomness is your friend, make your own crypter and make it so fucking random on every compile, that AV reverse engineers kill themselfs (HINT: randomize the crypters sourcecode using perl scripts)

[polymorphism code - to hide virus signature]

I started coding about a year ago, hacking old malware sourcecodes and reading russian boards. Most botnet operators are dumb as fuck, who don't even care about their traces, the ones you see on TV, catched by Microsoft and Brian Krebs. If you have more knowledge you can automatize nearly everything, like creating scripts that rewrite your sourcecode for your crypters so your malware gets undetected again, saving you hard work.

[finding infections on a computer]

Use GMER (http://www.gmer.net/) every now and then when your spider sense is tingling. Srsly, you can't fool GMER, it scans from the deepest possible point in your system, at ring0 and is impossible to fool, there is nothing deeper than ring0 on a usual PC where malware can hide stuff from. I always wondered why other AV vendors don't do it like GMER, it can detect all rootkits. But when a AV can detect everything, who will pay 30$ a year for signature updates...

rosstafarian• 14 years ago

the statement about GMER is not true. I've seen GMER miss MANY rootkits/etc. As far as catching and removing rootkits that other most av's tend to misss i've had by far the most success with combofix(which includes a GMER scan). Nothing will catch 0day rootkits 100% of the time, once a system is compromised it's best to format and start from scratch (or restore from backup if you're positive it's clean, but make sure you replace the mbr too). Theres just no other way to be completely certain. I lost track of the times that I thought I got everything on a windows machine, then google for something like malwarebytes as a test only to be redirected.

VMG2• 14 years ago

He seems to think of himself as very skilled because most other people in his field can't program. While he certainly is pretty good at what he does, it is scary to think what somebody with real knowledge could do.

cerebrum• 14 years ago

I would like to use GMER/combofix but how can I kow that I can trust them and that they don't contain malware?

reidmain• 14 years ago

"Protip against driveby infections (the ones in the browsers): Disable addons in your browser and only activate the ones you need. Chromium and Chrome for example let you disable all additional content like flash, html5, pdf and java in the options, you will see a grey box instead of the content and can manually run it using right-click -> Run. Chrome options -> Content options -> Plug-Ins -> Disable all or Click-to-play. Chrome also allows you to whitelist sites you trust, like youtube. This will make you immune to driveby infections regardless of the version of your java or adobe reader, because you will only be able to click and run content, that is VISIBLE on the site. Malicious content is ALWAYS hidden in a 0pixel iframe! This also stops the nasty flash advertisements implying you can't aim precise enough to win an iPad3."

This is one thing I've been trying to convince people to do for ages but, for some reason, that one extra click turns so many people off. The extra minute or two I probably spend a day clicking on plugins to activate them will pale in comparison to how much time I'll have to spend recovering from being infected.

sage_joch• 14 years ago

I've actually stopped using Firefox because it re-enables plugins that I've disabled (maybe it's more accurate to say it allows 3rd-party software updates to re-enable them).

capnrefsmmat• 14 years ago

This was fixed in Firefox 8, unless 3rd-party programs have gotten much more clever:

https://blog.mozilla.org/addons/2011/08/11/strengthening-use...

darksaga• 14 years ago

The thing that's scary is how easy it is for these people to get away with what they're doing. I wonder how much money is lost every year and how many hackers you never hear about going to jail for this stuff. I'm pretty sure this is the motivation to do a lot of this stuff. The risk/reward level is completely slanted.

I see a LOT of stories on HN and other Tech sites about these kinds of attacks. Unfortunately, I rarely, if ever, hear about hackers getting arrested for this sort of activity.

jacquesm11• 14 years ago

Let's play 33 bits on this guy, my guess is that he's German, Austrian or Swiss based on the settings for his IRC client, that should knock about 6 bits off, 27 to go.

zmj• 14 years ago

By '33 bits', I understand that you're referring to the minimum amount of information to identify an arbitrary person on Earth? 2^33 ~= 8.5 billion.

Interesting idiom. I hadn't heard it before, but the usage makes sense.

0x006A• 14 years ago

http://33bits.org/

nikcub• 14 years ago

oh I was doing that while reading the AMA. the giveaway is being the 4th customer of a bank that provides HBCI:

> My bank had around 20,000 customers using smsTAN and 3 (I was the 4th lol) using HBCI.

He is German, of college age and an early customer at one of 2 or 3 banks that provide HBCI. Consider him nailed.

I also bet he has published security related work under his real name at some point, especially since he has been applying for jobs. Most people in the security industry applying for legit work who don't have qualifications pad out their resumes with online research (or speaking at conferences, etc.).

vibrunazo3• 14 years ago

I really hope I never make enemies with anyone around here.

jacquesm11• 14 years ago

Studying engineering, there probably is a list floating around of German universities that have an engineering program.

gerrit• 14 years ago

Most German banks have been providing HBCI for over a decade, so that doesn't really narrow it down.

Arxiss• 14 years ago

Sherlock

depr• 14 years ago

he removed that maybe you should too

Nican• 14 years ago

He says he is Polish.

jacquesm11• 14 years ago

Polish nationals studying engineering in Germany should narrow it down quite a bit.

Edit: definitely not a Pole. Likely in former Eastern Germany though (lots of people there have a working knowledge of Russian / Polish, people from the Western parts not so much).

Universities in former Eastern Germany with an engineering department?

speleding2• 14 years ago

A commenter on Reddit points out "I'm Polish and that's not how a Pole would spell Russian words. He's German."

andiw• 14 years ago

Yep, also he likes to use conditional tense (would) in 'if' clauses, which is a typical language trap for German native speakers.

JadeNB• 14 years ago

Do you mean sentences like

> Even if 90% of those 7,200 were mined by botnets, and 100% of those mined were sold, that would represent well under 10% of the daily trading volume.

This is a perfectly correct instance of the subjunctive mood (http://en.wikipedia.org/wiki/Subjunctive_mood), I think, not a language trap.

Quarrelsome2• 14 years ago

He also mentioned that he frequents or used to frequent the forums at http://www.opensc.ws/

pestaa• 14 years ago

My favorite bit so far:

    if you know how your computer is beating inside, you are hard to fool

hippo_crete• 14 years ago

He says he has no respect for the security industry and AV companies. He makes compellling arguments against them.

Then when asked about his future, he says he plans to work for an AV company!

WTF?!

He can see what's wrong, but he can't do what's right.

And that, my friends, is the problem.

gbrindisi• 14 years ago

If you want to do this for the rest of your life you have no choice than working for a security firm (AV included) or being a criminal.

The problem is why he didn't get that job at Kaspersky. He is obviously skilled so what happened?

IAmA a malware coder and botnet operator, AMA

Related Stories