The Story of the tech.net.ru Crackers

tabdelgawad writes "The Washington Post is running a three-part story (Part 1, Part 2, and Part 3) detailing the events of the arrest of the two Russian crackers, Vasiliy Gorshkov and Alexey Ivanov, from a couple of years ago (See also Previous Slashdot Story 1 and 2). The writeup is light on technical details, but includes fascinating information about the crackers' socioeconomic conditions and motivations, as well as the competence and effectiveness of the FBI in combatting cybercrime."

Comments

True Patriot Act!

[sokkelih]

"crackers' socioeconomic conditions and motivations" These are the motives for terrorism.. Gues who is responsible for these things.

A friend of mine got busted by FBI

[192939495969798999]

A while ago, I knew a guy that got caught for piracy /hacking by the FBI... not pretty. I would use this article as a caution to anyone that thinks our government is incapable of action!

This was a great story.

[Anonymous Coward]

It highlights how oafish and ineffective the FBI can be. Read this story carefully. Want to illegally hack other people's computers and not get caught? Don't incur financial damage and the FBI will never chase you. Just ask Fyodor.

Re:This was a great story.

[GMontag]

Actually, in the Mitnick case, there was a good helping of the FBI 'coaching' the firms on how to claim damage. IIRC, none of them came back to the FBI with what the FBI wanted to hear, so they were told to use full development costs as the damage estimate. Some of the accounts that I read, quite some time ago now, the folks having to deal with the FBI seemed to be getting fed up (hey! nuce pun! just noticed in preview) with the nonsense.

This shady appraisal work was most glairing with the SUN damage estimate of >$20Million(?) for source code that could be purchased for much less and was given away free to educational institutions.

Even though I have always advocated that Kevin should have done some time for his harassing phone calls to Shimomura, around 90 days, I have yet to see any true financial damages that he caused anybody.

What about not stealing?

[POds]

Say, instead of stealing credit card number or anything at all, they just left evidence on the computer that they were there (like they did).

Could they still have been prosequted, or would anyone ever have bothered to bring it this far?

Sounds like these guys could have made a business out of it, if only it was done right (not that im suggesting my suggestion was right :)).

Re:What about not stealing?

[ahooton]

You have always stolen something from a financial standpoint, in the eyes of the law (and probably as viewed by the owners of the machines you've hacked). This is because you have utilized machine time/cycles on the machines you broke in to. You did not pay for this time/cycles, the owners of the machine(s) have, so you are stealing something of value.

This is how the argument goes. Just don't do it, it's dumb -- no smarter than jacking a car for a joyride. Nobody I know that wants to stay out of jail does either of these things.

Economic conditions and crackers...

[jkrise]

I think there is more to this than meets the eye. A recent notable case is that of the Pakistani who is said to have hacked the PassPort Password Reset bug aka feature. Poor chap hacks hotmail for a living? Or is it just the obvious (?) ter.... connection?

Even granting that economic conditions lead to cracking, it should be interesting to see the effect in the US over the next decade. Already, the DMCA, oppressive MS licensing, litigious thugs (SCO - brought to you by MS) etc. are eroding the economic wealth of the US and putting more and more money into the hands of a few rich corporations.

Countries outside the US are little affected by legislation as well as law-enforcement in the US. Piracy before, piracy in the future. The SCO case, even if settled in favor of SCO will have little impact in Europe, and nil or negative impact elsewhere across the globe. If any, it is likely to fuel further Linux adoption, courtesy the attention brought by the case.

The net result of these trends could be the rapid impoverishment of the US, and the beneficiaries could be the rest of the world. The incentives for crackers to emerge in the US could be huge, in say, another 3 to 5 years - IF the hypothesis were true.

Re:Economic conditions and crackers...

[KingRamsis]

i will just assume that you are not a troll and try to discuss the matter in a civil way

(?) ter.... connection

you mean terrorism ? nah don't think so but maybe if you have some balls to talk a bit more clearly please?.
now I live in a third world country and we are steadily migrating away from anything Microsoft anything you can pay for to an equivalent free solution, take out MS Office put Open Office, uninstall Adobe and pass that Gimp CD.
So no need to piracy at all, we are all ethical here.

Re:interesting paper

[Anonymous Coward]

Note that the US didn't make the list either, "because [US-based attacks] constituted such a large portion of the dataset"...

FBI investigative methods

[asmithmd1]

It wasn't too hard to figure out who was responsible

Ivanov was so bold he sometimes sent his résumé -- and even photos -- to prove that he was a serious security consultant. The documents listed his home phone number and detailed his previous experience

I wonder if they could have tracked him down if he didn't send them his contact info

Re:socioeconomic conditions and motivations

[axxackall]

After 1989 there was no USSR, no repressive govt

Really? How do you know that?

You heard many stories as russian mafia groups kill some of each other when they devide something. But also there are many cases when russian politicians are killed for no economical reason. Often after demanding of investigation of activity of official russian security services.

There was a repression of soviet communists before 1989, not it's a repression of russian mafia, which is a huge iceberg, and a top of it is a Russian Goverment.

By the way, do you know where most of communists gone? Nowhere! They sit in same chairs in the same rooms. They just changed the sign on the door of their office.

And speaking of a repressive state, most of russians think that the current goverment is doing a genocide of the own people. It's the same as it was in Camboja, just it's better organized in order to prevent any international sanctions.

My favorite quote for the lazy :

[aepervius]

U.S.-based attacks triggered nearly half (49%) of all the events in the 4th quarter. The U.S.-based events were not included in this study because they constituted such a large portion of the dataset and because the main focus of the study was on socioeconomic, political, and geographic patterns in the data. In order to better understand and predict the sources and nature of future attacks, data was col- lected and parsed for non-U.S. originating events.

In other word, if you want to stop piracy and hacking, shut down the most [cyber]terrorist country : ther U.S.

Not so black and white....

[pragueexpat]

I've been reading this story with interest, since I'm American, currently living in Prague, and recently visited Ukraine (OK, not Russia, but economically similar). The mafia is all over that place, and I have no doubt that these kids were being hassled for "protection money". Many homes in Russia do not even have hot water, so you can't think of this place as you would a western democracy - the people do anything to survive. Now, of course, this is no excuse for criminal behavior. However, I keep thinking - isn't it better that these guys are finding the cracks in your system and telling you about them, instead of just stealing all the credit card info and causing much more damage to your business in bad publicity and pissing off customers? This is really a catch-22. As a business owner, of course I don't want to encourage blackmail. But having vulnerabilities on your business site is YOUR problem and its better that you're told about them before someone else takes advantage. I would rather pay someone and find out about vulnerabilities than have someone else steal all my info and ruin my business reputation. Of course, these guys could just keep coming back for more money every month if they already have my CC#s and info. In that case, your server's vulnerability has cost you big time. Sorry, I don't have a good answer to this, but let's not let the business owners off the hook because they are being blackmailed from people who found mistakes in THEIR OWN servers. To sum up: Blackmail=BAD, businesses that don't secure their systems=ALSO BAD.

Re:"commercial competition"

[benzapp]

In many ways, it reminds of the American government basically refusing to enforce English copyrights in the 19th century. That was certainly commercial rivalry, but that whole revolution thing may play a part.