Reporting From the Web’s Underbelly

http://www.nytimes.com/2014/02/17/technology/reporting-from-the-webs-underbelly.html?hpw&rref=technology&_r=0

by hunterwalk • 12 years ago

141 33 12 years ago

nytimes.com

Havoc• 12 years ago

called a SWAT team to his home just as his mother was arriving for dinner.

As far as pranks go thats actually pretty good. Better than 4chan's pizzas.

kostyk• 12 years ago

hardly a prank. what if they shot him.

Fede_V• 12 years ago

pfft, as if SWAT teams would accidentally brutalize an innocent person..

nieve2• 12 years ago

Given the current state of policing in the US swatting someone has a non-zero chance of getting someone severally beaten, tazered, tear gassed, or just shot. I don't know of any deaths, but there have been some really close calls reported in the press and and injury plus property damage. I don't think that really qualifies as a good prank, more of a harassment/endangerment tactic.

sizzle3• 12 years ago

https://news.ycombinator.com/item?id=5928424

http://www.cato.org/raidmap

Now you know of some deaths

ChrisNorstrom• 12 years ago

Swat teams are known for "shoot first ask questions later" especially when they've been called in for narcotics. Hell, even playing cards.

"Why did you shoot me I was reading a book." http://www.salon.com/2013/07/07/%E2%80%9Cwhy_did_you_shoot_m...

tjaerv2• 12 years ago

http://filmingcops.com/cops-execute-80-yr-old-man-in-his-own...

meowface2• 12 years ago

Well, it's effective, but it's certainly not good. It wastes police resources, can result in your door being kicked down (they don't compensate for repairs), your dogs could be shot, you could be tazed or shot, etc.

sizzle3• 12 years ago

http://www.cato.org/raidmap

malka• 12 years ago

oh wow, so cops can go in your house, kicking door and shit, and then even if they did it for no good reason, the bill is on you ? The US are such a wonderful country.

sizzle3• 12 years ago

http://www.cato.org/raidmap

some prank alright.....

waterlesscloud• 12 years ago

Yeah, great. Drive away one of the few reporters who understands what's going on. Good idea.

rkuykendall-com• 12 years ago

Great article. Reminded me how amazing it is to explore a "world" online. Often, a world you never knew existed.

r0h1n• 12 years ago

As an ex-journalist I'm really envious of Krebs' sources and understanding of this space. I also think his background as a journalist (reporting and writing skills) might have allowed him to be far more effective than many others in the space with comparable technical skills.

meowface2• 12 years ago

The online crime world has a bitter hatred of Krebs, moreso than any other "white hat" out there probably. Numerous malware families include references to him in their source code, control panels, and domain names.

As a security researcher I frequently find botnet command & control panels that have a picture of Krebs' face above the login form. Domain names similar to "briankrebsisachildmolestor.com" are sometimes used to host malware and botnets.

Considering all that, plus the real-life harassment he's gotten (death threats, the heroin framing attempt, SWATing), I hope he invests in a good home security system. Or a security guard.

hyperion2010• 12 years ago

One of the articles profiling him mentioned he recently upgraded to a 12-guage security system.

w1ntermute• 12 years ago

You mean a 12 gauge shotgun?

ianhawes• 12 years ago

Not to take anything away from Brian, but I'd say the online crime world's hatred of Dancho Danchev is probably right up there, if not more. He has blogged[1] almost consistently about different malware campaigns, and for awhile was actually thought to be kidnapped[2].

[1] http://ddanchev.blogspot.com/

[2] http://techcrunch.com/2011/01/21/great-news-missing-cybersec...

nikcub3• 12 years ago

The source said that he had bought a large batch of stolen cards from an underground site and that they all appeared to have been used at Target.

Interesting sidenote in the Target hack. First, something that you might not know: not one of these breaches (that is Target, Neiman Marcus, Michaels, etc.) was discovered by the actual affected companies - they were all discovered by bank and security officials in the underground markets.

Bank and infosec people worked out a while ago that rather than wait for breaches to be discovered, it'd be best to set yourself up on the underground markets in the guise of a purchaser - buy up cards, correlate purchase history and work out who has been hacked. It is this type of reconstruction that lead back to Target, Neiman Marcus, et al.

Target was discovered not too long after the hackers had ramped up their sniffing, and with the response from banks and computers it meant the overall 'score' wasn't that great. A hack that should have provided enough dumps for the entire underground for more than a year ended up lasting weeks.

So score one for the good guys.

The problem now is that the black hat groups have wizened up to this. A few things are happening.

First, there has been a bit of a purge of users in the forums. It is harder than ever to get into the private forums.

Second, cards are now being 'laundered'. You take dumps from different sources and combine them together, to the point where it would be difficult to find out where the cards were stolen from. Being from a particular source used to be a selling point for the traders, but now they are blurring a lot of that info out and combining different dumps and then slicing them for sale in other ways (usually IBAN, State and Expiry).

The public 'auto sites' that sold these dumps have all been taken down, after getting a lot of attention over the Target attack. Many complete novices sought out the underground sites after the Target breach reporting in the mainstream media, flooding the forums with newbie questions and requests in a mini eternal september.

It is possible that with the underground adapting in this way and the state of security still being so poor that we won't even find out about the next big breaches.

naterator• 12 years ago

Is there a bright side to this, though? Doesn't this mean that the barrier to entry will increase for this kind of crime, and thus a smaller group of criminals will be able to perform it? Maybe that's small consolation, considering that only a handful need to do it to cause widespread havoc. Still. I hope this isn't all bad.

nikcub3• 12 years ago

You can now buy credit cards on some of the new underground markets that are replacing Silk Road.

Find the type of card you want, select how many you want ($5-20 each) and go through the checkout process, just like shopping on Amazon.

What happen is that there is now another tier of distribution - the bulk guys aren't selling directly to the public any more but there are people buying from them who are, and they are making it easy.

The bright side is that with chip+pin the horizon for dumps is short, but that leaves CVV's (card not present carding, used in online fraud).

r0muald• 12 years ago

A smaller and increasingly skilled group of organized criminals. Not that good IMHO.

gwern• 12 years ago

Being from a particular source used to be a selling point for the traders, but now they are blurring a lot of that info out and combining different dumps and then slicing them for sale in other ways (usually IBAN, State and Expiry).

I was looking at one of the newer carding shops on Tor and was wondering why they were splitting all their dumps that way. Guess now I know why.

GFK_of_xmaspast• 12 years ago

Same idea as CDOs, I guess. (http://en.wikipedia.org/wiki/Collateralized_debt_obligation)

Reporting From the Web’s Underbelly

Related Stories