HN user

onetimeonly

237 karma

reformed blackhat

Posts0
Comments21
View on HN
No posts found.

It's worth noting that in the UK, convictions become 'spent' (so that you don't have to disclose them when asked) after a certain period of time that varies with the severity of the original sentence. But for some crimes (>48 months in prison) they never become spent. And for some jobs, the 'spent' status does not apply. Those include working with children, joining the police or security services, and a variety of other things.

I'm a hacker who served 4.5 months of a 9 month sentence 5 years ago. I was in two jails in that time, spending the majority of the time in the second, lower security place. The experience totally changed me, but in a positive way.

First of all, I actually had a lot of fun in jail. My education made certain aspects of the prison system very easy for me to navigate, such as legal documentation and debating with guards. My ability to mend broken electronics very quickly became known. These things made me feel very safe, since people were actively protecting me. It also made me feel quite important in the community.

It started when someone came to me and asked what I knew about mending mobile phones. In UK jails, many people have mobiles, usually obtained by over-the-fence smuggling. Pay-as-you-go credit vouchers are a major form of currency. This guy was very important on the wing - he had a crew of other guys who walked around with him and people often came to pay him. I said I knew enough about phones, and what did he want? He explained that someone had owed him money but couldn't pay. He'd taken the guy's phone as payment, but the phone was pin-locked and he couldn't get in. The phone was an old samsung, one which I knew (having previously owned one) didn't impose any limit on the number of pin attempts. So I told the guy: yeah, I know a few tricks. But I need to get my tools out so I'll do it overnight. (Note: I didn't have any tools). The guy left me with the phone overnight, and I sat up through the night to try all 10,000 possible 4-digit combinations. Thankfully, the correct code turned up in the mid 2000s. So the next day this guy turned up and was amazed that I had figured out the code. He went round telling everyone that I was some tech wizard and that people should always come to me with their problems. In return for the job he arranged for me to have a Playstation 2 in my cell for two weeks, and to get access to a phone whenever I wanted. For the rest of my time, people would bring me trivially broken electronics and I would retire for the evening to make it out like I was doing something difficult, then return the fixed item the next day. It massively increased my quality of life in there.

Secondly, it opened my eyes to how people less fortunate than me live their lives, and how terrible the prison system is for most people. Many, many people in jail were severely mentally ill. There was no support for them. Some were killed in jail, either by inmates or staff, because they flipped out and people got scared. Another large group of people were hopelessly addicted to very harmful drugs. People who exploited this group were the most powerful - they would have drugs smuggled in, then build an army of addicts who would do their bidding to get the next fix. It was a really explosive situation. Almost every act of violence was drug debt related. Immigrants were completely screwed in jail, because there was no way for them to navigate the bureaucracy. I helped several people avoid deportation, including one cell-mate who had a hit contract out on him in Jamaica because he defended his business when yardies tried to extort him. He couldn't read or write, so he couldn't fill out the asylum application. His patois was so strong that his lawyer couldn't really understand what he said, and the border agency was going to send him back to Jamaica to be killed. I wrote letters to the border agency, the prison governor and the home secretary and he was granted asylum and an interpreter was arranged so that his legal visits would be more productive. Hundreds of others in similar situations go without that help every year.

Thirdly, I saw some horrible things. For example: 'syruping' - when someone mixes sugar into a bucket of boiling water and dumps it on someone's face. The dissolved sugar makes the boiling water cling to the skin longer, and the skin peels off leaving the raw flesh exposed. I also saw someone held down by four guys, who performed anal surgery on him with a sharpened spoon to extract drugs he was hiding. He later maimed all four of his assailants, stabbing them in the neck with a pen (saw that too). Another was a guy who was clearly paranoid schizophrenic. His cell was opposite mine. He started screaming one night and barricaded himself in. He then stripped off and covered himself with baby oil, and started setting fire to his cell. The guards came in riot gear to tackle him, but he was so slippery it was like trying to catch an eel. He gave them the run around for quite a while before they eventually fired sedative darts into him and he collapsed screaming. He died in hospital.

Fourthly, I felt so ashamed of myself that I changed my life forever. I was a middle class white kid with a great education who got obsessed with hacking and document security as a teenager and went down for figuring out how to perfectly replicate the driving license, thus throwing away many of the advantages that luck, society and my parents had given me. Everyone else in there had no such advantages. Most of them were born to a life where poverty, drugs, violence and lack of education all being concentrated in their environment led to them being systematically channeled into prison. I was there essentially through misplaced intellectual curiosity, while others were there because their lives were so bad out of jail that crime was actually a rational survival choice. Society failed them, while it tried to hold me up with both hands. I was, and am, disgusted with myself. Upon leaving jail I learned programming, worked freelance to pay for my tuition while I got a degree, got a PhD, and am now working towards spending my life using my skills as efficiently as I can to improve the lives of as many people as possible. If I ever have a lazy moment, I just have to cast my mind back to prison, and the disgust with myself rises up again, and I launch myself back into work with an energy I never knew I had before prison.

Finally, I would say that my criminal record has not held me back. I no longer have to legally disclose it, but when I did I always did so with a letter explaining some of the circumstances and how deeply it had affected my life. I had several positive comments about my disclosure, and I have never been turned down for a job I've applied for. It doesn't have to hold you back - your attitude has to convince a potential employer that your background makes you a great candidate, not a worse one.

Prison works for a very small minority of people who are reasonably intelligent and curious, but lacking direction or drive. Being incarcerated for a short time is a hell of a wake-up call, and for me, Shon Hopwood, and a few others ever, leads you to turn your life around.

For most people it's not about rehabilitation, but deterrence, retribution, and physically restraining inmates from committing crimes in mainstream society.

I completely agree with Shon about the impact of long sentences. He says:

Five years is about the maximum amount of time for someone to “get it” and change and create a different life. More than that, and prisoners feel hopelessness and they think “why bother, I just need to get through this and go home.” It’s very difficult to “seize the day” in prison and use every day to prepare for release when you staring at a 10- or 20-year sentence in the face.

I would add that many people become institutionalised. After a few years in prison you can become socially important in the community. But on the outside, you are nobody. The longer you're in there, the less attractive it looks to reform and try to build a life on the outside.

Sorry didn't see this comment for a while.

I ran a black-hat collective between the ages of 13 and about 17. That led to getting lots of offers to hack for money, and through discussion with the people making those offers, eventually to getting interested in document security. I developed a way to replicate the UK driving license with all security features using commodity hardware. It fooled police officers and every official that ever looked at it. I sold the licenses to fund my desire to improve the design and manufacture. People used them for, among other things, fraud. 'conspiracy to defraud' was the crime.

At night the guards occasionally walk around with some sort of signal detector, so something like this already happens. Don't think they can intercept, but they can tell who's using a phone.

You can stab people with almost anything. Toothbrush, piece of paper carefully folded, shoelaces melted into a soap mould... stopping one more thing getting in won't matter.

I think the idea was to make it easier to notice them, as parent suggested.

Cells in UK jails are not barren concrete-and-metal things like in the movies. They have a sink, a desk, a kettle, a TV, a (usually padded) chair and a bed. You charge your phone by plugging it in :).

Another fact many people don't know is that you can buy things, legally, in prison. By things, I mean pretty much anything in the Argos catalogue. You get an allowance of £10/week which you can save up (you have to earn it or have it sent in - it's not free). Some people had playstation 2s. Lots of people had stereo systems.

Many of the phones came without chargers, but people were very good at reworking electronics. I saw one system where someone had rewired the inside of his casette player to have two contacts so he could slot in his phone battery and it would charge when he pressed play, in a nicely hidden compartment.

I think there's not really any way of preventing smuggling. Like all systems of oppression, prisons stimulate peoples desire for freedom. When you have 24 hours a day, 7 days a week, 365 days a year to think about a way to smuggle something in, and then you have 10k people in a prison, and people get transferred between prisons... eventually someone will come up with a way, and it will spread fast.

I've been to jail in the UK. I served 4.5 months in B and C category prisons. Phones are so easy to get hold of, I don't think most people would believe it. During my time I emailed photos from inside the prison to friends outside using a smartphone. Approx. every other prisoner had a phone, and everyone had access. They were so popular that I was able to keep myself safe (i.e. useful) by offering a phone unlocking service. Top-up voucher codes were a currency, even more than tobacco.

The thing is, they weren't small phones. People didn't smuggle them in their colons - they used code systems to arrange for their friends to throw things over the fences in particular places. Mini-riots were organised to coincide with throwovers. Drugs get in the same way.

There were a whole lot of more inventive methods used too. Suffice it to say that the problem is not the size of phones. It's that if you deprive people of their freedom, they spend all their time thinking about how to get it back. They will eventually work out how to get a little piece. Tiny phones won't make the blindest bit of difference.

Yeah, there are a few hard parts that I left out. Making it 'good enough' is hard, but for a reason I found surprising when developing the methods. Making the design look exactly right is quite easy, but making it feel perfect is damn-near impossible. The way it bends and the texture in your hands are qualities of the exact manufacturing process and materials, and you can never quite nail it with a knock-off.

That said, most people will never hand them to a customs agent, and I had reports that mine were accepted as ID by police officers on several occasions. Maybe the forger is more sensitive to the differences than most.

Well, I just disagree. My experience is that recovering your bank account after fraud is trivial. Fixing fraudulently obtained credit takes longer, but basically just involves going through a formal process with credit reference agencies and lenders. If you want to protect against this, you can get a credit record protection service from any of the major credit agencies, where they alert you if there is any activity on your credit record s you can fix it.

edit: nobody should be so unaware of their own credit record that they lose a house sale because of undiscovered fraud. Keeping on top of it is very cheap and as simple as registering on a website (UK example: https://www.creditexpert.co.uk)

Actually my biggest lesson about identity theft is that most people just don't need to worry. The negative effect of identity theft in 9999/1000 cases is just the inconvenience of correcting the mistakes by informing various institutions about it. In the last 5 years or so, banks have got very good at clearing up the mess fast.

You need to assess the risk, taking into account the very low probability of having your identity stolen and the fairly low inconvenience, against the time and effort it takes to take protective measures. Don't live in fear of it.

That said, the single best way to protect yourself from random ID theft is to use a decent bank with good fraud protection. In the UK, Barclays and HSBC are very good, Natwest and Halifax are very bad. Citibank is a bad US one.

Source: at 17 I was running a black-hat hacker collective and had, through a series of bad choices, got pretty deep into the 'real-world' side of that business: fraud. The day after my 19th birthday my house was raided by the US Secret Service and the UK Serious Organised Crime Agency in a worldwide coordinated swoop that took in dozens of loosely affiliated people. I have since completely rebuilt my life, so I don't mind anonymously sharing this.

Stealing an identity is trivially easy. Society revolves around relationships of trust between organisations and individuals, and the trust runs amazingly deep. The basic information you need to do it is publicly available: date of birth, mother's maiden name (on the birth certificate and parents' marriage certificate respectively, copies available on request from the records office).

Carrying out the ID theft takes resources and balls. You'll need to be able to manufacture ID documents, or have access to someone who does. Nowadays you can buy them on one of the onion dark markets. Generally you want a driving license, as this is the easiest to forge form of ID that gets you complete access. Banks, governments, etc. will accept it.

Sadly, making driving licenses is not too hard - document security is pretty weak. You'll need to make yourself some ultra-high resolution scans, trace the entire design in illustrator, and then get hold of some printing equipment. You usually want to print on teslin (http://en.wikipedia.org/wiki/Teslin_(material)), and laminate with a high-quality laminator. UV seals can be easily replicated by hacking an epson printer to use modified cartridges with UV pigments injected into them. Holograms can also be replicated by dusting your laminate with interference pigments and reverse-printing in clear ink to fix the design. It can all be done on commodity hardware.

With a driving license and dob/mother's maiden name you can then access a huge amount of someone's sensitive information, and more importantly, control their relationships with organisations. I don't want this to be a tutorial, so I'll simply say that with several more pieces of information you can take out credit in someone's name, control their existing accounts (e.g. by adding yourself as a new cardholder), or start causing trouble in their name.

A final word of caution. While it's easy to get people's information from government records offices, it's even easier to get it from them personally. We used to call people and social engineer them into giving us their DOB, bank account numbers, secret words, etc. Don't be stupid with your information: never tell someone your data down the telephone unless you called them. Oh, and if you're thinking of committing identity fraud, think again. It's not hard to pull off, but you're not smart enough to do it without getting caught. Everyone gets caught in the end.