How the Secret Service Busted ShadowCrew

plover writes "In the story Hacker Hunters, BusinessWeek Online documents how the Secret Service turned a member of the ShadowCrew and was able to arrest dozens of the members of the phishing ring. From the article: 'Law enforcement officials are often loath to reveal details of their operations, but the Secret Service and Justice Dept. wanted to publicize a still-rare victory. So they agreed to reveal the inner dynamics of their cat-and-mouse chase to BusinessWeek. The case provides a window into the arcane culture of cybercriminals and the methods of their pursuers. ' "

Comments

Wasn't that here before?

[quickbasicguru]

I think this story was on slashdot before...

Re:Wasn't that here before?

[DustyShadow]

yes it was: http://it.slashdot.org/article.pl?sid=05/05/22/172 2243&from=rss

Re:Wasn't that here before?

[th3space]

You are admonished for both your honesty and the ultimate - and temporary - sacrifice of your worth to those in the Slashdot community.

Go in peace, my fallen brother...go in peace.

Re:Wasn't that here before?

[Neoncow]

Haven't you heard? They're coming after the ShadowCrew!!

Fly you Fool!

Re:Wasn't that here before?

[jafomatic]

I swear you deserve some of that karma back for predicting the moderation so accurately. Too bad I'm out of mod points :\

Operation Firewall?

[Anonymous Coward]

How do they come up with such clever names?

grrr..

[mrzaph0d]

dupe

Re:grrr..

[LiquidCoooled]

Its not a dupe to everyone.

I'm sure lots of people missed it first time round.
(yes, I am getting peeved at slashdot milk monitors, not specifically the parent)

Re:grrr..

[homebrewmike]

It's cute how there are so many dupes of messages saying that the article is a dupe.

Here's the thing - if it's a dupe, do you REALLY need to say that it is? If so, why? Moral superiority? Some sort of misplaced dedication? Ego trip?

Come on - as with listservs, when someone asks how to unsub, just send a message offline and leave it be. There's no need to launch into a tirade saying how slashdot has gone down hill, etc, etc.

Come on, people - this is a nice sandbox. Let's all place nice.

(I'm not suggesting the parent isn't playing nice, but he was the second "this story is a dupe.")

Re:grrr..

[Leiterfluid]

That's kinda like NBC's "If you haven't seen it, it's new to you!" summer rerun campaign.

If I didn't watch Friends the first time around, I'm not going to waste my summer watching it now.

Re:grrr..

[polysylabic psudonym]

One man's funny is another man's offtopic.

dupe?

[whizzter]

i'm pretty sure that this exact article was linked a little while ago.

Why doesn't this make sense?

[Brandon K]

Now I haven't RTFA completely yet, but I have just one question.

Why would somebody in a phishing group give out their information to fellow members? This kind of thing seems to happen so often, you'd think that there would at least be a layer of secrecy between the members, just in the case somebody is going to rat on them.

Re:Why doesn't this make sense?

[Timesprout]

Its called stupidity and be thankful for it, if bad guys didnt fuck up law enforcement would catch no one.

Re:Why doesn't this make sense?

[m50d]

It's the culture. Hacker culture is, they catch you you tell them everything. That's just the way it works.

Re:Why doesn't this make sense?

[rikkards]

Easy. There is no honor among theives.

I read the dead tree version on Tuesday and was not that impressed. There was no technical merit in how they caught them (except for the tap) basically they got an informer on the inside and got a tap on their website.

Re:Why doesn't this make sense?

[The_Mystic_For_Real]

I suppose even phishers get burnt by giving away information to their ilk.

Re:Why doesn't this make sense?

[soft_guy]

Each of the members setup a fake website for the others to log into so they would get their info to rat out to the cops if they were the first caught as an insurance against going to jail.

Re: Why doesn't this make sense?

[Black Parrot]

> I suppose even phishers get burnt by giving away information to their ilk.

"To confirm your status as a member of Phishers Anonymous, reply with your contact information and IP address."

Re:Why doesn't this make sense?

[Cruciform]

If you're a tough guy, silence is street cred.

If you're a computer criminal, silence is 2 extra years in the slammer with your new boyfriend if you're convicted.

No wonder they spill the beans.

Re:Why doesn't this make sense?

[KiloByte]

"Hacker culture" or "bottom-sucking cracker thieves culture"?

We have enough media confusing "hacker" and "cracker" already.

Re:Why doesn't this make sense?

[Gizzmonic]

I thought hacker culture was that they left little clues for Batman to figure out their next crime...oh wait, no. That was the Riddler, wasn't it?

Re:Why doesn't this make sense?

[eln]

It's because the two words are too close together. To avoid confusion in the future, we should start calling crackers "honkys".

Re:Why doesn't this make sense?

[m50d]

Hacker culture, definitely. Cracker culture borrows more from organized crime and would certainly include something as advantageous as not talking.

Re: Why doesn't this make sense?

[jacksonj04]

trainmyspamfilter@tn-uk.net - 127.0.0.1

Bring it :D

Re:Why doesn't this make sense?

[ToasterofDOOM]

or just whores

At what cost?

[xorowo]

I'm all for catching these guys, but I wonder about publicizing the details at this time. Is this supposed to make us feel better about the Patriot Act -- "look here! See how we can bust the bad guys with the 'right' tools!" -- or are we just supposed to be happy that something was done about this gang of thieves? I don't expect everything to be about freedom and democracy, but it is too easy anymore to question why authorities give us this information, rather than look at the information for information sake...if that makes any sense.

Re:At what cost?

[ScentCone]

but it is too easy anymore to question why authorities give us this information

Actually, if you've ever met anyone in counter intelligence, or their bretheren in law enforcement that deal with these somewhat less tangible threats, being able to crow about a successful bust is a rare thing. Most of the time these guys have to go home every day without even being able to talk about what they do all day, even when they've really mopped up after a particularly unpleasant character or group. They can talk to each other, but they really feel (correctly, I think) that without coverage of some of their more high profile victories, that people will either not get what they do, or (worse) dream up versions of what they do, mostly based on X-Files re-runs.

Certainly there are always going to be political components to public releases of this sort of thing. But by that I mean "political" in the sense of "making sure that people appreciate you." Not partisan politics, per se, just run of the mill See, I'm Valuable spin. No different than what happens in every office/school/church/family every day. The real accomplishments of a lot of the stealthier intel and defense people are simply never going to make the news, and it's a great frustration to the people that work in those fields. A lot of them quit and go back to the private sector just so they feel they can breathe a little. Of course, anyone in the R&D lab of a private company is going to feel the same way about drug research or battery engineering.

Re:At what cost?

[RodgerDodger]

These things need to be published for their deterrent value. One big problem with cybercrime is that the criminals feel that they'll never be caught, and if they ever are, then the punishment will be a slap on the wrist.

As long as this perception (which is very valid!) exists, the risk-reward ratio makes cybercrime attractive. Busting the crooks isn't enough to change the perception - you need to let the other crooks know that they could be busted next.

Organised crime, in particular, is a business. If they start to feel that their criminal ventures are too risky, they'll go elsewhere (quite possibly into legit business, where their complete lack of ethics will help them fit in with the rest of the corporate sharks)

Re:At what cost?

[nickscalise]

Hey, I'm in organised crime, and I resent you comparing me to those bastard corporate sharks, you insensitive clod!

Re:At what cost?

[Sycraft-fu]

I've personally always thought that some major publicity is what is really needed. Like take a TV news crew with, show the people being drug off in handcuffs ala Cops, try to get it on CNN, etc. Make a real production out of it.

As you said, the feeling of anonymity is a big problem, they believe they can't get caught so they don't worry about it. Well, if it's generally kept quiet when busts are made, then the problem continues. Remember: The media these days is quite lazy, they need to be fed stories if you want htem to have air time.

I also think this would be particularly effective against the for-fun virus writers and the like. While there is more and more orginazed crime going on online, there's still plenty of misfits that are causing trouble. People that do IRC floods are a good example, no profit in it, it's jsut asshole looking for control of channels in a chat room. Also, as the receant bust in Germany shows, there are still virus writers that just do it to cause trouble.

Well people like that are espically likely to stand up and take notice of busts. The whole reason they do what they do is because it lets them be a bully without fear of any retalition. If they feel that there's the possiblity of the cops knocking on their door, they are much less likely to do it.

Re:At what cost?

[BitGeek]

Yeah, thugs armed with machine guns taking down a bunch of 12-18 year old kids and some silly 20 year olds sure makes me feel great about the patriot act.

The reality is that most of the people they arrested did not commit crimes and weren't even capable of committing crimes-- they were just kids who wanted to be hackers who read these forums.

There may have been a thief or two there, but they were not significant criminals.

Its all propaganda, and the blatant spin put on the article from businessweek is funny... "Because some members were known to have firearms". Hmmmm...well we should arrest all teh cops too because not only do they have firearms, many of them have machine guns!

Government extends its power by making everyone subject to laws-- it doesn't matter whether a moral crime has been committed or not, the more they make the populace criminals the more they can use violence to control the populace without a revolt. That's all this is.

IF someone leaves tehir computer unprotected, and some kid logs into it and looks around and copies some pictures-- that kid has not committed a crime, but he has broken a law. The law is immoral, and thus criminal... but when they justify busting these kids for this stuff, they make it just that much easier to bust anyone who uses encrpytion or who uses spoofing services for anonymity, etc.

Accepting this immoral harassment makes it easier for them to add more immoral harassment-- such as an iron curtain of firewalls to keep track of every packet, and filter out "bad" websites, etc.

They already have the former, with carnivore which watches every email sent on every ISP... the latter is only a matter of time.

ITs time to throw out EVERY politican that supported the PATRIOT act-- whether democrat or republican, they have all shown themselves to be criminals who deserve prison sentences, not political careers. (IF you broke into someones house and got caught, you belong in jail-- if you make a law that legalizes the same kinds of rights violations, then the same punishment should apply.)

Re:At what cost?

[wljones]

Don't worry. if the quality of information from this reporter is indicated by his (lack of) knowledge of firearms, the article will be totally worthless to the bad guys. They already know law enforcement people hate them.

Re:At what cost?

[rho]

You win the Kneejerk Reactionary Award.

Yeah, thugs armed with machine guns taking down a bunch of 12-18 year old kids and some silly 20 year olds sure makes me feel great about the patriot act. The reality is that most of the people they arrested did not commit crimes and weren't even capable of committing crimes-- they were just kids who wanted to be hackers who read these forums.

You would feel differently if they had managed to hijack your identity and sent your credit rating into the toilet. I'm glad you know so much about these kids and what their intentions were. A member of ShadowCrew, are you? Jack-booted thugs, please take note.

"Because some members were known to have firearms". Hmmmm...well we should arrest all teh cops too because not only do they have firearms, many of them have machine guns!

Fascinating non sequitur. You're not winning any logic points here.

Government extends its power by making everyone subject to laws-- it doesn't matter whether a moral crime has been committed or not, the more they make the populace criminals the more they can use violence to control the populace without a revolt. That's all this is.

Sleep with the Anarchist's Cookbook under your pillow?

First, government--at least a representative government like ours--does make everybody subject to laws. Contrary to your thinking, this is a good thing. If only a few people are subject to laws, then you have something other than a democracy, and you certainly don't have the rule of law.

But, I think I know what you intended to say, before the potsmoke interfered with your thinking. You mean to say that government extends its power by making more people criminals. This is true, for a government with unlimited funds to keep everybody in jail, but that isn't terribly effective in actual practice. In fact, by making a law that makes too many people criminals, you end up with unenforceable situations such as Prohibition.

IF someone leaves tehir computer unprotected, and some kid logs into it and looks around and copies some pictures-- that kid has not committed a crime, but he has broken a law. The law is immoral, and thus criminal... but when they justify busting these kids for this stuff, they make it just that much easier to bust anyone who uses encrpytion or who uses spoofing services for anonymity, etc.

He has committed a crime. It is no more lawful for him to wander into your computer than it is to wander into your house. Even if he doesn't fiddle, touch, or steal anything.

These punks are lucky. In Texas, they could probably get shot.

Accepting this immoral harassment makes it easier for them to add more immoral harassment-- such as an iron curtain of firewalls to keep track of every packet, and filter out "bad" websites, etc.

Let's apply your logic the other direction:
If we don't track down and arrest people who phish for information, before you know it, there will be criminals in the street who will be allowed to take your wallet! POLICE STATE NOW!

ITs time to throw out EVERY politican that supported the PATRIOT act-- whether democrat or republican, they have all shown themselves to be criminals who deserve prison sentences, not political careers.

I'm no fan of the Patriot Act, but it is not as odious as the paranoids make it out to be. Stupid, pointless reactionary talk like yours only serves to cheapen the efforts of people who are smarter and more influential than you are--which is nearly everybody, to be honest--who are actually doing something about the Patriot Act other than smoke dope and bitch about it.

Re:At what cost?

[TheOldFart]

...people who are smarter and more influential than you are--which is nearly everybody, to be honest--who are actually doing something about the Patriot Act other than smoke dope and bitch about it.

The funniest thing I've read on /. Ever! I'm amazed at your patience for replying to this hallmark of human sapience. Geez... People like these make me embarrassed to say where I am from...

Re:At what cost?

[polysylabic psudonym]

No, it's not about the PATRIOT (it's an acronym, not a word) Act - they admit that it was all done with decades old wiretap laws (and we all know that PATRIOT Act is for catching drug offenders).

This one's all about "give us enough money and we can catch those rascally computer crimanals".

But, of course, they can't. They can only catch the idiots and those that allow their anonymous computer crime syndicates to grow so large that it can't keep a secret. The moral: If you're a clever computer criminal you won't be caught unless you let a snitch in on your secrets. That, and don't try to set up a criminal ebay outside Russia.

Re:At what cost?

[archeopterix]

These things need to be published for their deterrent value. One big problem with cybercrime is that the criminals feel that they'll never be caught, and if they ever are, then the punishment will be a slap on the wrist.

Deterrent value, ok, but it's probably gonna deter the stupid would-be-criminals, who are too lazy to inform themselves about possible punishment for their actions.

The smart ones know what's in store for them in case they get busted, so that's no news for them. They will read the story and try to learn from shadowcrew's mistakes.

Costs

[The Bungi]

From TFA:

Part of the problem is that cops don't have all the weapons they need to fight back. They clearly lack the financial resources to match their adversaries' technical skills and global reach. The FBI will spend just $150 million of a $5 billion fiscal 2005 budget on cybercrime -- not including personnel -- in spite of its being given the third-highest priority.

Maybe I'm being naive here, but it seems that these people are getting away with whatever they're doing and incurring much lower costs in the process.

Law enforcement needs to stop worrying about (and identifying as such) the average script kiddie and focus on the large mob-like operations. I'm guessing they'll get much more bang for their buck that way. I can't see how 150 million dollars is not enough to take down at least a couple of the big rings given that they operate on Jolt and Hot Pockets (or whatever passes for that in Romania).

Re:Costs

[ScentCone]

I can't see how 150 million dollars is not enough to take down at least a couple of the big rings given that they operate on Jolt and Hot Pockets (or whatever passes for that in Romania).

It seems that way, but do some math. It can cost millions just to prosecute a couple of local New York mobsters and have the case stand up to judicial review. Say, $2M. That's 75 such cases, and doesn't take into account the huge overhead of turning up the cases in the first place. Combine that with the costs of international logistics, legal system integration, and the higher cost of acquiring the prosecution targets in the first place, and those overseas bad guy groups are pretty hard to hit. And if the budget is fairly static, the remaining bad guys would probably take delight in getting some of their competition hung out to dry just so they'll know that budget-limited heat will be off of them.

Taking down "at least a couple" of the big rings doesn't put much of dent in it, either. Getting individual offenders (and their friends) to come to terms with cracking/phishing as a lousy way of life - that's worth something because it erodes the new-recruit foundation for the more organized mobs.

Re:Costs

[C0deM0nkey]

Law enforcement needs to stop worrying about (and identifying as such) the average script kiddie and focus on the large mob-like operations.

There's no full-proof way of determining when you are dealing with one instead of the other. Sure, there is a sophistication of attack angle at which you can look but I'm sure there are plenty of script kiddies who are members of cybergangs hoping to move higher in the organization...

The script kiddies of today may be analagous to the foot soldiers of the mob in many cases: they are the potential leaders of tomorrow's cybermafia i.e. you never know if the script kiddie you bust is the first link in a chain of events that topples the big dogs you are after.

Impunity?

[ScentCone]

I liked this:

The HangUp Team has been operating in Russia with impunity for years. Some members are allegedly based in Archangelsk, an Arctic Circle city of rusting Soviet nuclear submarines and nearly perpetual winter.

The people we put in jail for cracking and phishing are more comfortable than pretty much anyone living (with impunity or otherwise) in Archangelsk. Never the less, this whole concept of phishing/malware 'colonies' sure implies a complicit (or way, way negligent) government.

Re:Impunity?

[SupremeSpod]

Well, we have a hacking crew based here in England, at Menwith Hill in Yorkshire. They're called the NSA!!!

They have almost unlimited resources to listen in to 'phone calls, interrogate telexes and faxes.

Spod - In "Fuck off home Yanks" mode!

Re:Impunity?

[ScentCone]

About which, of course, the UK would complain mightily if they didn't, themselves, benefit hugely from the intel that the NSA (and the NRO, and the CIA, and the DIA, and the FBI and so on) gather. It's not about the NSA, it's about intel gathering at all. People who whine about the NSA whine about the more local, home-grown MI5/6, too, no doubt. So, that just sounds a little shrill. Oh: and the NSA isn't using stolen credit card info to buy flat screen televisions and sticking the merchants with the bogus charges.

Re:Impunity?

[Miaowara_Tomokato]

A Russian gang called the HangUp Team has been pummeling e-commerce Web sites and taunting its pursuers for two years, police say. The gang plants software bugs in computers that allow it to steal passwords, and it rents out huge networks of computers to others for sending out viruses and spam. HangUp Team hides in plain sight. Its Web site -- rat.net.ru/index.php -- is decorated with a red-and-black swastika firing off lightning bolts. Its blog discusses hacker tactics and rails against Americans. Its motto: In Fraud We Trust. "We think we know what they've done, where they are, and who they are," says Nagel. But authorities haven't been able to nab them so far. The Secret Service won't say why. (Emphasis mine)

Sounds like someone dug up something pretty good on some powerful folks ...

Re:Impunity?

[Anonymous Coward]

In Soviet Russia, hacker mob investigates YOU.

Re:Impunity?

[SupremeSpod]

Not at all. Unlike you septics, we have morals and laws. The NSA brings absolutely nothing to the UK intelligence community.

Re:Impunity?

[ScentCone]

Unlike you septics

Um... septics? As much as I enjoy translating British witticisms so that us poor, dumb rebellious colonials can unnerstan 'em, that one's just not cross-referencing, I'm afraid. You'll have to find another, less subtle way to make your rhetorical points.

we have morals and laws

Which definately explains the huge public surveillance infrastructure that you've built, largely in reaction to years of bombings in your own smoldering little civil conflict. Darn those high-falutin' laws and morals! They don't seem to stop people from being evil, or from having to react to (and prepare for action by) those people. To the extent that both the UK and the US are proponents of democracy, intelligence work on both sides of the Atlantic absolutely goes both ways. There is a steady stream of people from your agencies and ours visiting their counterparts and working together. And, I'm sure that the landlords, restauranteurs, pub owners, launderers, and everyone else in Yorkshire that takes money from NSA employees stationed there don't mind them much at all. And, of course, your own law enforcement folks are facing all sorts of ne'er-do-wells with ties to international crazies about whom we have better info, and about which our agencies brief your folks every day. Ask, really ask MI5/6 whether they consider their relationship with our FBI/CIA/DIA to be reciprocal or not. My sense is that you're not really interested in the actual day-to-day give and take in those circles because you're pretty much just a crank, anyway. That's OK! Our intel people all get along well enough regardless of what you think.

Re:Impunity?

[Moofie]

Sounds like somebody's still bitter about the Boston Tea Party.

Re:Impunity?

[plover]

Excuse me? Did you forget Echelon? The whole idea of the UK/USA alliance is so that the US can spy on the domestic English traffic, and the UK can spy on the domestic USA traffic. Then, since there are no rules against sharing international information between allies, the FBI and MI-5 can sit down and swap tales about what kinds of bad guys they saw in each other's countries. No laws were harmed in the violating of your privacy.

Now, whether or not we shared factual stuff, like "hey, we know about these Weapons of Mass Destruction in Iraq," and "Really? So do we!", well that's a different question.

Re:Impunity?

[ScentCone]

Septic Tanks - Yanks

Huh. You learn something every day. Now, I suppose I'm not supposed to consider that a term of endearment, am I? You know, like when I use "squareheads" when referring to my Scandinavian relatives? I mean, sure, "tanks" rhymes with "yanks," but I always thought that the Brits were a bit more poetic than that, even when they're just in the mood to insult someone. Hell, especially when they're in the mood to insult someone.

PH33R!@!!!

[MirrororriM]

PH33R TEH M4D SK1LLZ OF TEH HAX0R HUNTERS! THEY HACE HAX0R3D SLASHD0T AND REP0ST3D T0 CAUSE MAYH3M AND TEH PH33R!!#!!oneone!!

Goodbye karma...had to do it though...heh

help the cause.

[Nissmo]

If you would like to help the secret service, please send your ebay passwords and usernames.

Shadowcrew Forum

[Andorion]

For a short time after Shadowcrew was busted, their private forums were accessible to the public. I archived about 12 threads, one of which was a 10 page long "shadowcrew being investigated" thread.

Here are some excerpts:

10 full info cc's for sale

Hello

info details:
NAME ON CARD: CARD NUMBER: DATE: CVV: PIN: ROUTING: CHECKING: ADRESS: CITY: STATE: ZIP: COUNTRY: PHONE: SSN: MMN: DOB:
price is 100$ for 10 infos
I accept e-gold
icq xxxxxxxx

for buyers: we can use escrow if you like

CALIFORNIA Lic
if you are willing to sale a real cali lic. with a clean record. iam looking for one, with these details.
hispanic or indian, male, 5'9 to 5'11, brown eyes, black or brown hair. 160lbs to 180lbs, DOB: 1964 TO 1974..
drop me a PM with the info & price.
thanks for your time & be safe.

Offering DDOS Service
Hi,

Firstly I can understand if the owners, and
moderators of SC do not want this kind of service offered here, and I'll apologize in advance. However I couldn't find anything against it, other than SC being the victim of such attack.
I'd like to be reviewed for this service, if
possible. Thanks.
PayPal accounts - many
All kinds of PP ACCZ...

Verified/No Verified, Active/No Active, Mail
access/without, Any balance/0, USA, UK, Europe...

icq: xxxxxxxxx

2Admins: i can give you some for review -
knock, knock

people for instore... will provide dumps and matching plastic

I am looking for people out there who would be willing to do instore for me if I provide dumps (high quality) and matching plastic. Please PM me for more info. I dont want to discuss too much here in the open.

Scary stuff. Please use fewer junk characters. Please use fewer junk characters. Please use fewer junk characters. Please use fewer junk characters. Please use fewer junk characters. Please use fewer junk characters. Please use fewer junk characters. Please use fewer junk characters.

Re:Shadowcrew Forum

[PseudoThink]

Interesting...but what I'd REALLY love to see is the chat-log of the group meeting mentioned in the article. I'm guessing that around 9pm, it starts getting rather entertaining.

From the article:

To ensure the suspects were at home, a gang member-turned-informant had pressed his pals to go online for a group meeting.

At 9 p.m., Nagel, the Secret Service's assistant director for investigations, issued the "go" order. Agents armed with Sig-Sauer 229 pistols and MP5 semi-automatic machine guns swooped in, aided by local cops and international police. The adrenaline was pumping, in part, because several ShadowCrew members were known to own weapons. Twenty-eight members were arrested, most still at their computers. The alleged ringleaders went quietly, but one suspect jumped out a second-story window. Agents nabbed him on the ground. Later, they found a loaded assault rifle in his apartment. The operation was swift and bloodless.

Re:Shadowcrew Forum

[Entouchable]

Yeah I was able to archive a couple threads once stuff starting feeling a bit "off" there. And yeah, it was much more then a phishing crew, much more. No one was surprised about the busts, it's expected in that scene. What WAS surprising was how organized it was. Luckily I had stopped reading the site/forum a year and a half or so before the busts, and luckily that's all I did, on there, though they made it tempting to try and partake in the actions. Ethics Ethics Ethics Ethics Ethics Ethics Ethics. What added to the interest was I had the pleasure of hearing both sides of this fight, from both site readers, and the SS. As I do some tech security consulting with some retired and not so retired ss. I actually by chance heard of the busts offhand during an unrelated business meeting, when one of the not so retired were talking with a fellow tech guy, very surreal.

Interesting story

[Nick of NSTime]

...but it reminds me too much of this guy.

Re:So what if it was reported already!

[emiddlec]

I tend to agree that dupes aren't a big deal. If you don't find something interesting then why read it?

Q: Does this really count as a dupe if the BusinessWeek article is from May 30th, and the other thread May 5th?

Sloppy editing regarding firearms

[Experiment 626]

From TFA:

Agents armed with Sig-Sauer 229 pistols and MP5 semi-automatic machine guns swooped in

"Semi-automatic" means fires only one round when the trigger is pulled. "machine guns" means fires lots of rounds when the trigger is pulled. The sentence is an oxymoron, and implies the reporter is just throwing buzzwords around without knowing what he is talking about. To correct the sentence, this is the Secret Service we are talking about. They are not going to mess around with some semi-auto HK94 type of firearm. The phrase the author was looking for is "fully-automatic".

Hopefully the other aspects of the article are more factual and carefully checked.

Re:Sloppy editing regarding firearms

[77Punker]

Actually, those aren't machine guns anyway. The MP5's are submachineguns because they fire pistol ammunition, not full sized ammunition.

Re:Sloppy editing regarding firearms

[Kesh]

Actually, IIRC, there are models of the MP5 which won't do full-auto. They're built to only fire in single shot semi-auto, or a "burst fire" of three rounds with each trigger pull.

Still, the sentence was badly written no matter the facts.

Re:Sloppy editing regarding firearms

[sootman]

Last time I looked at a catalog (a while ago) you could mix-n-match the modes of operation, as evidenced by the selector: safe (one white bullet), semi (one red bullet), two-round burst (two red bullets), three-round burst (three red bullets), and full-auto (seven red bullets). You could order one with any trigger group you want--like safe, semi, two-round, and full; or safe, semi, and three-round burst only. (But if you call up and ask for 'full auto only and no safe, please' they'd probably hang up on you. :-) )

Re:Sloppy editing regarding firearms

[Frangible]

Yes, but if it can fire a burst or full auto, it's legally a machine gun under US law, regardless of caliber or design. It's silly to call the Glock 18 a machine gun, but it legally is.

Re:Sloppy editing regarding firearms

[photon317]

The only fire-control configurations that I've actually seen in real-world existance on original factory NFA-regulated HK MP5's in the US are:

safe/semi/3-burst
safe/semi/auto
safe/semi/3-b urst/auto

I've never even heard of the two-burst option, although I don't doubt it may exist in the catalog.

But honestly, I don't see why anyone chooses the burst options anyways. The MP5 (at least the original 9mm chambering - I haven't tried the .40/.45 versions which also exist) is an incredibly easy gun to control. Anyone with a modicum of experience and training can pop off a single, double, or triple at will with their trigger finger while in full-auto. The MP5 was the first full-auto weapon I ever fired in my life, and it took about 3 magazines over the coures of about 10 minutes to master controlling it.

Re:Sloppy editing regarding firearms

[77Punker]

And then they make them illegal so that we can't properly protect ourselves from the government and thugs since they're the only ones that have them.

Re:Sloppy editing regarding firearms

[jezstephens]

When did you last need to do that?

Re:Sloppy editing regarding firearms

[ToasterofDOOM]

actually, IIRC, a machine gun, or automatic in general was originally and is technically used to refer to any sort of firearm that used any sort of mechanism to relaod without interation from the user. but I could be wrong had to nitpick =D

Re:Sloppy editing regarding firearms

[77Punker]

I never have and hopefully never will; but, if I need to, I'd like to stand a chance.

Re:Sloppy editing regarding firearms

[budgenator]

One of my neighbors had to put ten rounds into a man's chest during a drug-bust, he did have a weapon, just refused to fall down when shot. It's very hard on the officer to have to do this, not to mention the wife and children of the perp who saw the whole thing.
So my advice is when they kick your door down, just sit down on the floor with your hands on your head and let the lawyers do the fighting it's just plain easier on everybody.

Re:Sloppy editing regarding firearms

[pipingguy]

Just to be more specific, a "machine gun" fires rifle rounds, a "submachine gun" fires pistol rounds.

I guess that makes the MP5 a submachine gun with selective fire modes. It's quite a nice firearm, I tried a semi-auto one at a range quite a few years ago.

Re:Sloppy editing regarding firearms

[asland]

http://www.hecklerkoch-usa.com/index.jsp?loc=231&S ITEID=B&PartNumber=MP51

Re:Sloppy editing regarding firearms

[stor]

It surprises me to see how some American gun nuts think they could protect themselves against a corrupt government using pissy consumer firearms.

If it came to that, the American population would be brought under control by the American Government and Military. They are a lot better equipped than the population and can do stuff like cut off/poison your water supply, sewage and electricity. I mean, those Iraqis with AK-47s didn't really stand a chance now did they?

I think there's a film script in that!

Cheers
Stor

Re:Sloppy editing regarding firearms

[ArtStone]

It surprises me how some .UK anti-gun nuts think they can protect themselves from illegal immigrant criminal gangs using only a pointy knife.

Oops.

Re:Sloppy editing regarding firearms

[Bastardchyld]

The burst options are there primarily more military applications. When you take a young inexperienced kid give him a rifle and send him out to get shot at the second someone pops off a round in his direction he will pull the trigger first and aim later, resulting in 0 zero dead bad guys and 1 empty clip. Now granted more and better training would fix this somewhat. But I think that it is safe to assume that the first time in that situation the first time you pull the trigger is going to be wasted. If you still have ammo left then you live. If not you die.

case-in-point: M16A1 safe-single-full vs. M16A2 safe-single-3burst, the problems with the A1 were noticed in Vietnam and corrected with the A2.

My point is that if you ever NEEDED to use it to save your life you probably wouldn't want nerves to empty your clip regardless of how easy it is to keep it on target.

Re:But at what cost to our privacy?

[wilsone8]

Uh....sorry. Perhaps I am being naive here, but what privacy rights did we give up to arrest these guys? Heck, I'll challenge you to point out a privacy right that was violated in this case.

Re:So what if it was reported already!

[emiddlec]

Correction: May 30th and May 22nd.

Re:But at what cost to our privacy?

[XanC]

their personal loss is small compared to the greater good.

That's the same argument people make for the erosion of privacy.

ENOUGH!

[garcia]

Nothing like sensational journalism:

A huge map of the U.S., spread across 12 digital screens, gave them a view of their prey, from Arizona to New Jersey.

Yes, they were "prey" and the Secret Service were eagles flying high in the air to protect freedom. Give me a fucking break. But of course this wasn't just a single sentence to get the readers interested, nope, the entire "article" is full of this crap:

The target: the ShadowCrew, a gang whose members were schooled in identity theft, bank account pillage, and the fencing of ill-gotten wares on the Web, police say.

Yes, they have a hackers college where professors teach their students how to be thieves. Oh wait, no they don't...

At 9 p.m., Nagel, the Secret Service's assistant director for investigations, issued the "go" order. Agents armed with Sig-Sauer 229 pistols and MP5 semi-automatic machine guns swooped in, aided by local cops and international police.

Ahh, the freedom eagle reference again... Swooping down on their "prey".

There's a new breed of crime-fighter prowling cyberspace: the hacker hunters.

Yes more predator/prey relationships. No, sorry.

This was not a movie, it should not be written as if it were, and it should not be written to give any ideas to other people who might want to make it into a movie. It was a typical "wait it out and arrest" type operation. There was nothing that was any more exciting about this than any other operation. Of course the media has to make it out to be more than it is to gain the attention of readers.

Stick to the facts and cut out the crap. Thanks for the dupe.

Re:ENOUGH!

[myowntrueself]

"MP5 semi-automatic machine guns"

I particularly like that part.

Evidently the USA isn't as much of a gun culture as I'd thought if they could get away with such blatant bullcrap.

Re:ENOUGH!

[imidan]

Also from TFA:

And little wonder. In Russia, the authorities can appear at times to be more interested in protecting cybercrooks than in prosecuting them. In 2000, the FBI lured two Russian hackers to Seattle with job offers, then arrested them. Agents involved in the case later downloaded data from the duo's computers, located in Chelyabinsk, Russia, over the Web. Two years after that, Russia filed charges against the FBI sleuths for hacking -- alleging the downloads were illegal. "When you have a case that involves servers in Russia, you can almost hear the law-enforcement officials sigh," says Hypponen.

So... this sounds a lot like they're talking about Skylarov, here. Gimme a break. They're comparing the guy who decrypted e-books to people who stole millions of credit card numbers, but they're glossing over the whole thing to make it sound like something worse. Talk about sensational. Blech.

Re:ENOUGH!

[bobbozzo]

Skylarov was not "lured to Seattle"; he was arrested after giving a scheduled presentation at DefCon.

IIRC, the Seattle case involved massive credit-card theft/sales.

Re:ENOUGH!

[What'sInAName]

Well, it's not like the bad guys are presented by the media in a purely factual way. You're right, this is crap, but I can understand why journalists do this. News is just entertainment, and we shouldn't pretend it is otherwise. You want a police blotter, read your local TAB (or its equivalent).

On the other hand, regarding the remark about the "semi-automatic machine gun," that was unforgivable!

Re:ENOUGH!

[Moofie]

What is a "gun culture"?

Re:ENOUGH!

[myowntrueself]

Presumably its a culture where many people know about guns and know that, for example, a 'machine gun' is not a 'semi-automatic' and that someone pretending to speak knowledgably and who conflates these terms is full of shit.

Re:ENOUGH!

[Moofie]

Where are these cultures where everybody knows the specs of any given firearm? Those guys might be fun to hang out with...

Re:ENOUGH!

[stor]

Where are these cultures where everybody knows the specs of any given firearm?

Well I'm no gun nut gumshoe but I'd start my investigations in Texas.

Cheers
Stor

Re:ENOUGH!

[xquark]

Nah, they're actually talking about ruskis that where breaking into
people's systems/networks and then black-mailing them for money
otherwise they would reveal data like CC info etc that they had stolen
from their systems to the world or where ever that kinda stuff gets revealed.

the FBI setup a sting with the help of a company that was being black-
mailed. They basically offered two of the hackers jobs in the US and
promised to get them working visas etc. The next thing you know the
two guys got on a plane and went to the US and were arrested. simple
as that.

They then in a plea bargain ratted out on the other members of the
group/team etc..

It was in the NY times last year I think.

Somewhat Off Topic

[HaloZero]

The HangUp Team has been operating in Russia with impunity for years. Some members are allegedly based in Archangelsk, an Arctic Circle city of rusting Soviet nuclear submarines and nearly perpetual winter.
That's really sad, to think about; rusting Soviet nuclear submarines. Such technology, such virtue. I would absolutely love an ex-Soviet nuclear submarine. It'd make a neat houseboat. Just seems like kindof a massive thing to leave laying around.

Re:Somewhat Off Topic

[CohibaVancouver]

It'd make a neat houseboat

I think I'd find it hard to sleep once I started glowing in the dark.

Re:Somewhat Off Topic

[Gren_Elessedil]

Hey, that's a great idea! It would be fun to go "steaming" around the world in one of those. Where to find a crew though?
Also you could probably get some decent money in the scrap metal... or the nuclear part...
Some interesting info concerning the Northern Fleet:
http://www.nti.org/db/nisprofs/russia/naval/nucflt /norflt/norflovr.htm
Wiki for the lazy: http://en.wikipedia.org/wiki/Soviet_Red_Banner_Nor thern_Fleet

Re:Somewhat Off Topic

[Gangalino]

Drug dealers have bought old Soviet submarines to move heroin to the west coast.

Re:Somewhat Off Topic

[Penguinshit]

You'd be better off with one of these...

Cuckoo's Egg by Cliff Stoll

[3770]

There is a really good book by a guy called Cliff Stoll called Cuckoo's egg about how he chased down a hacker in the early days of the Internet.

It wasn't even really the Internet as we know it today.

It will be nostalgia for old timers and a history lesson for the "noobs" around here.

Anyway, it is very interesting. I recommend it highly.

Re:Cuckoo's Egg by Cliff Stoll

[pyrrhonist]

There is a really good book by a guy called Cliff Stoll called Cuckoo's egg

He does other cool stuff too. After you're done reading his book, don't forget to buy one of Cliff's bottles.

Re:Cuckoo's Egg by Cliff Stoll

[Anonymous Coward]

Mr. Stoll broke into the CIA computers, the pentigon and other vaious sites

I call bullshit. I read that book and Cliff Stoll did not crack any computers himself.

What he did do was:

a) figure out that a cracker was using computers on his network to crack into government computers;

b) start keeping logs on the cracker, by hooking up printers to the serial data lines;

c) start trying to get someone (anyone!) in the US government to do something (anything!) about this

d) at one point, he got nervous while watching the cracker getting into a sensitive government computer, and he took his keys and shorted out some connections on a serial data line, to make noise; he made enough noise that the cracker decided to log out and try again later.

all fully documented in his book.

So, if I'm wrong and you are right, please give me the page numbers of the book where Cliff Stoll claims to have cracked any computers at all.

That book was often refered to as "The Hackers Handbook".

I call bullshit again. I have never heard anyone call The Cuckoo's Egg "The Hackers Handbook".

Error in the story

[Frangible]

At 9 p.m., Nagel, the Secret Service's assistant director for investigations, issued the "go" order. Agents armed with Sig-Sauer 229 pistols and MP5 semi-automatic machine guns swooped in

So, what's a "semi-automatic machine gun"? The MP5 is a select fire submachine gun. A semi-auto only civilian version that was briefly available was called the HK-91, and certainly wouldn't be used by the Secret Service.

Re:Error in the story

[deanoaz]

The HK-91 that I remember was a 7.62 Nato semi-auto rifle, I almost bought one, but they were kind of big and expensive.

I don't know about the civilian, semi-auto version of the MP5, but I think they would have called it something else.

"Really, I'm not out to destroy Microsoft. That will just be a completely unintentional side effect." - Linus Torvalds

Re:Error in the story

[Frangible]

Ah, you're right... my bad, it was the HK-94. Appearently they also had a SP-89 that was a semiauto MP5k without a stock. (as a pistol with a stock moves it into class III territory)

This sounds like it'd be easy to do

[CrazyJim1]

If you want to bust a phisher, be a phish. Basically give them false information, made up credit cards etc. Flag the credit card as stolen, and retrieve where it was used. I'd guess this stuff would be easy to catch.

Re:This sounds like it'd be easy to do

[guitaristx]

That'd work wonderfully, if phishers didn't do silly things like purchase things online with their stolen credit cards and obfuscate the physical trail with things like PayPal and p.o. boxes.

Re:This sounds like it'd be easy to do

[CrazyJim2]

You see, the thing about action-based MMORPGs is that people want to play them, and if people want to play, they will pay to play! So if i make a game with puzzles and intergalactic bounty hunters, people will buy it and I could make millions. I found out that if I was a game designer, I'd probably be employed at a game company, not a grocery store, so China and India wouldn't make money off of outsourcing. Also, because of that my car, without ABS I might add, would handle like some new kind of competetive, multiplayer Tetris game that only netcafe strategies from Korea could defeat. But I get ahead of myself. True A.I. is easy. Ask me, and I'll say, "Hey! Yah, true A.I. is easy! Let's make one!" Then you'll say, "Cool! That's neat! Let's research bees while our A.I. makes us spaceships." So why can't i get a job at DARPA or Google? Because there is no way for me to show my skills. It's not like rap music, where you can rap and people hear you. Also, and I know I'm dragging on so please indulge me, I think that if you combined 3rd person action with Transformers I'd be the world ranked Warcraft III player. Roaming Dragon was my idea, just like DNA and P2P, but you don't see me getting upset that someone stole my ideas and made millions. I think it is important for these things to exist and that is why I'm not suing anyone. Plus, world peace is important if we are all to get along and stop playing unimaginitive MMORPGs like World of Warcraft. I think that if someone combined Crystal Space with Fire Polar Bears and Contra (the hard way) they could make millions.

Re:This sounds like it'd be easy to do

[CrazyJim2]

Uh...so rap is greater than declarations of war? Please, only bees, the internet and StarCraft are mightier than war. And how is your translation of MY BOOK coming, CRAZYJIM1?

Nice to see actual criminals for a change....

[Vellmont]

It used to be the Secret Service wasted their time going after people publishing electronic magazines like Craig Neidorf (Phrack), people making a board game with "Hacker" as the name like Steve Jackson Games, or people looking to just break into computers for fun and understanding.

Now they're going after actual criminals that the above people warned us about. I've got to say that's a real improvement. Of course it took actual electronic criminals to make them realize who the real enemy is.

Re:Nice to see actual criminals for a change....

[Anonymous Coward]

people that break into computer systems regardless of whether it is "for understanding" are in fact criminals.

they should be treated as such.

they people should be treated harder yes, but a person that illegally breaks into a system is a criminal and should be punished.

Re:Nice to see actual criminals for a change....

[Moofie]

"illegally breaks into a system is a criminal"

Anybody who illegally does anything is a criminal. That's what we call a tautology.

Re:Nice to see actual criminals for a change....

[Vellmont]

You seem to not understand that there are multiple aspects to the word criminal. Criminals are people that do harm to other people through their law breaking. Most people consider a criminal to be someone who's acted disgracefully and broken the law, not just someone who's broken the law.

Simply breaking the law isn't enough for someone to be considered a "criminal". Have you ever sped? Commited sodomy (oral sex counts)? Smoked marijuana? If so you're a criminal by your definition.

Re:Nice to see actual criminals for a change....

[AdamJ]

SJGames published Hacker after the Secret Service incident, as a response to it.

More info available at: http://www.sjgames.com/SS/

I found his home page

[3770]

I had to look him up on the internet. He has a web page here:

http://www.ocf.berkeley.edu/~stoll/

It is funny, because it is really simple and it is actually invalid. I had to view the page source to find the intended links.

It has the answer to one of the number puzzles that he mentioned in the book (but never gives the answer to if I remember correctly).

Money

[fimbulvetr]

Part of the problem is that cops don't have all the weapons they need to fight back. They clearly lack the financial resources to match their adversaries' technical skills and global reach. The FBI will spend just $150 million of a $5 billion fiscal 2005 budget on cybercrime -- not including personnel -- in spite of its being given the third-highest priority. (Terrorism and counterintelligence come first.)

Can someone explain when budgets and financial resources will not be a problem? Everywhere you look, this "boogeyman" is the first thing law enforcement/public good places blame their
problems on.
It seems to me that:
#1. They tax us more.
#2. They spend it on useless things. (more managers, assitants, Harley Davidson Police bikes, Corvette Police cars)
#3. They say they don't have any money.

Rinse, lather, repeat?

Re:Money

[snax]

Hard to lather after you rinse....

Re:Money

[Gren_Elessedil]

Depends on who's doing the lathering...

Re:Money

[ArsonSmith]

You think someone in the public service is going to say, "We had plenty of money. I just fucked up and browsed slashdot all day rather than actually do something usefull with it."

Re:Money

[fimbulvetr]

That was the point I was trying to make...though you achieved it through sarcasm. In either case, it seems as if it's never going to end.

Re:Money

[plover]

The Harley-Davidson police bikes in our city were leased to us for $1.00/year (each bike) by Harley-Davidson. This is what they do for corporate giving. I'd be hard-pressed to say those two dollars were "spent on useless things."

The other thing to remember is that they're going to spend money to enforce laws that are the most visible to the most people. "Identity Theft" is a very popular headline these days. Most people have inboxes full of spam. By equating these annoyances with "identity thieves," spending money on fighting them becomes a politically smart manouever. And because we are collectively so stupid that we believe everything the news tells us, it doesn't even matter whether or not it has any effect on our inboxes! As long as a politician can use it to say "I'm doing something!" the money to fight it will be there.

Re:Money

[ArsonSmith]

That's why I'm a capitalist rather than a socialist/communist. People try to say that money is an evil motivator. But social services motivation is vague, usually derived from power grabs and political shenanigans.

Which is more evil?

From the article

[Jck_Strw]

They're employing some of the same tactics used to crush organized crime in the 1980s.

Um, correct me if I'm wrong, but organized crime is still going strong. Let's hope that they "crush" the phishers a little more thoroughly.

FunWithHeadlines still holding breath?

[GQuon]

I wonder wether FunWithHeadlines is still holding his breath?
From the dupe story: Re:SCO mydoom :-)

Re:glitch in the matrix

[CyberKnet]

It's a dupe complaining about a dupe....:)

Not a good thing?

[doublem]

Wait a second, I thought information wanted to be free?

Is it good or bad that these guys were caught?

* smirk *

Check if you're on the list.

[DrEldarion]

I have the huge list of e-mail addresses that were compromised. If you want to know if you're on it, please reply with your e-mail address and password and I'll get back to you if you're on the list!

Re:Check if you're on the list.

[flossie]

Same deal with the credit card details, right?

Re:Check if you're on the list.

[Geekbot]

You need to reply with how many people thought you were serious and actually emailed you their info.

Re:Check if you're on the list.

[DaCool42]

That's the same as the combination on my luggage!

Re:IRC meeting as the bust went down?

[Anonymous Coward]

[zer0kewl] AFK BEING RAIDED
[zer0kewl] BBL OFF TO WHITE COLLAR RESORT PRISON
[zer0kewl] OMFG OFF TO FEDERAL POUND ME IN THE ASS PRISON!!!
*HXXR84 is now snitch4l
[snitch4l] L8R suxx0r!

ugh?

[logik3x]

http://web.archive.org/web/20041030015234/http://s hadowcrew.com/> Defaced website... dating back to october 30 2004... this story is really old... anyways if they got cut they don't even worth talking about them.. they are not 1337 at all..

shadowcrew.com

[Anonymous Coward]

I received an unusual spam message advertising warez, cardz, etc. and took the time to trace the message back to the shadowcrew website. The forums on this site were amazing. Basically it was a hub for people to advertise very highly illegal services, or sell lists of credit cards, passwords, etc... a hub for Identitity theives, and fraudsters.

I reported this site to the FBI, and received the following response from them (back in October of last year).

"Thank you for your submission to the FBI Internet
Tip Line. Inasmuch as the FBI has recently
received numerous reports concerning the
"www.shadowcrew.com" Web site, there is no need to
forward any such additional emails to us. Our
Cyber Division is aware of this Web site, and is
addressing the matter."

It was only a matter of time until these idiots were caught. You can't be this open about such illegal activity and not expect a response from the feds.

This isn't a very good version of the story

[illumin8]

From TFA: For months, agents had been watching their every move through a clandestine gateway into their Web site, shadowcrew.com.

I read a much more interesting version of this story somewhere else. I can't find the link right now, but it explained more fully how they really caught them. This sentence above just glosses over it.

Apparently, they did this:

They got to one of the members of shadowcrew and convinced them to work with them. This guy then proceeded to go onto the shadowcrew IRC channel and told everyone that he had setup a new encrypted gateway VPN type channel that would allow them to connect to the shadowcrew servers in a "more secure" fashion. He convinced everyone to go through this proxy. Little did they know, the proxy was actually an FBI server that was monitoring and recording all traffic that passed through it.

This just goes to show, no matter how smart you are, the best hacks are social engineering hacks, not technical.

They should have been smart and used Tor instead, then they probably wouldn't have been caught.

I'm glad they got caught though. These guys were losers of the worst kind.

Duties of the Secret Service

[Khyber]

I think this article is pure bullshit.

Duties of the SS are as follows.

1. Protect (by executive order) The President of the USA.

2. Protect the nation's money from counterfeiting.

Unless these guys took the President's information, or made a threat anywhere on their site about the president, or were actually counterfeiting/spreading counterfeit bills, the SS should have had not one single reason to be involved in this. This should have been the responsibility of the FBI and the ATF. What's next, the Secret Service arresting us everytime we download pr0n?

Re:Duties of the Secret Service

[jratcliffe]

Um, no. While the Secret Service's original focus was on counterfeiting (as well as dignitary protection), its mission was expanded in the 80s and early 90s to include investigating fraud against/attacks on the US financial system as a whole, not just the creation of false currency. http://www.secretservice.gov/financial_crimes.shtm l

Re:Duties of the Secret Service

[Seventh Magpie]

According to 18USC1030, one of the the criminal codes that shadowcrew was prosecuted under, the U.S. Secret Service has jurisdiction for inevstigating computer fraud. Here is a copy of the law.

Re:But at what cost to our privacy?

[Jane_Dozey]

How about the UN's Universal Declaration of Human Rights? The US *is* still part of the UN right? But I think the GP is correct in saying that the article isn't about privacy. As far as I can tell the authorities used the proper channels to get these guys.

Computer criminal culture

[Sycraft-fu]

Who cares about the semantics of hacker vs cracker? At any rate, they then to think their crimes aren't "real" but more ot teh point they think the Internet makes them invisible and invincible.

Had one like this on campus. He was attempting to get passwords by arp poisoning and pretending to be the router. What's worse, we actually didn't have proper monitoring to catch this sort of thing at the time. However he was stupid and didn't know how to work his software, so we noticed the library disappearing from the network and figured out what he was trying to do. He kept trying and got caught.

He IMMEDIATLY and completely spilled the beans when caught. He was scared shitless because he never thought anyone could track him.

Re:Computer criminal culture

[KiloByte]

I see you're assuming that hackers break into computers, and the difference I'm talking about is the intent.

Wrong.

"Hacker" is a term for someone with an intimate knowledge of a certain system, and works on it with enthusiasm as opposed to grinding labour.
It has nothing to do with security, and in fact, very rarely has. Hacking is about finding creative solutions -- and security is more based on being damn careful while coding and even more careful when reviewing the code.

Please, don't spread this confusion. Tabloid press and Microsoft FUD misuse this word enough.

Re:Computer criminal culture

[KiloByte]

Please don't buy into the anecdote your freshman CS teacher told the class one day.

Hmm... is that a troll that I smell?

Machined gun

[It's the tripnaut!]

...MP5 semi-automatic machine guns...

Aren't mp5's SUBmachine guns?

Here's the wiki:

A submachine gun is a firearm which combines the automatic fire of a machine gun with the ammunition of a pistol, and is usually between the two in weight and size.

Re:Machined gun

[Alioth]

Yes - specifically, the name "Machinenpistole" gives it away as a SMG rather than a fullsize machine gun.

Hollywood intro...

[curious.corn]

... a là Hackers, that's bad ju ju. Anyone reading it will get this picture of Angelina Jolie naked on the kid's bed as the SWATs rammed the door. Many, many, more would be hackers tonight...

Re:Hollywood intro...

[Zemplar]

" ... a là Hackers, that's bad ju ju. Anyone reading it will get this picture of Angelina Jolie naked on the kid's bed as the SWATs rammed the door. Many, many, more would be hackers tonight..."

"Hack the Planet!"

I checked as far back as I thought I needed to

[plover]

Y'know, I even scrolled back through the Slashdot pages until I got back to May 29th. I saw the date of May 30th at the very top of the article itself, and I didn't want to submit a dupe. I figured it was safe to check back to the date on the article itself. I was wrong.

Therefore, I whole-heartedly apologize to absolutely everyone who was taken out back and beaten with sticks because I submitted a duplicate story.

Oh, what's that? You say you weren't taken out back and beaten with sticks because I submitted a dupe? Then may I ask why it is a Department of Homeland Security issue that someone posted a dupe? Honestly, I sometimes think that posting "Dupe" is just a different way of saying "FRIST PSOT" without getting immediately modded down as a troll.

Re:I checked as far back as I thought I needed to

[bani]

wonderful search function

Re:So what if it was reported already!

[LiquidCoooled]

I pay for cable tv.

Money doesn't stop dupes happening there, so why is it such a big deal here?

Riiight..

[keven]

So they caught them with the help of one of it's members? And they see this as a big accomplishment? Our government will impress me when they do something like this without the help of a nark.

Even if they're guilty...

[hubang]

It still doesn't make up for the American SS' behavior in the Hacker Crackdown.

For those of you who don't know about it, check out Bruce Sterling's book. I believe it is still a free download.

Re:Even if they're guilty...

[Seventh Magpie]

Actually Bruce Sterling has a lot of good things to say about the U.S. Secret Service in that book. You are probably referring to the Steve Jackson Games incident that occured well over a decade ago. Why would you hold one mistake that happened a while ago over an entire agencies head? Look at every government and corporate entity and you can find even bigger mistakes made in their history. FBI for example. Ruby Ridge? Waco? All them spies they hired? Their Forensics lab? etc etc etc... Look at your life and I am sure you have made your share of mistakes a decade ago too!

Huh?

[flithm]

I'm not sure what you're talking about here. The punishment for computer crime is significantly harsher than that of its non-technical counterpart.

You could walk into a bank and rob it at gun point, all the while threatening to kill people, and there's a good chance you'd only be jail for about 7 years.

On the other hand, rob the same bank, of the same amount of money, without a gun, and without threatening anyone, but do it with a computer, and you could be looking at 20 years!

In Canada, a simple DOS attack will get you 10 years in prison.

Also, under the Youth Offenders Act, youngsters who commit computer crimes are always punished to the maximum extent (3 years). In comparison, some children convicted of murder have been let go in one year.

Computer crimes carry a harsh penalty.

Despite this, cybercrime is still attractive? Precisely because it's easy, and non-confrontal. I don't think it has as much to do with the risk/reward ratio as you may think... because those who are actually considering committing these crimes are very aware of not only how easy it is to get caught, but how strict the penalities are.

It's not like the good 'ol days when you could hack a Gibson across state lines. Now days if you do something big enough, people will notice, and unless you have a huge crime syndicate protecting you, you're going to get caught.

Having said that... I think I'm going to go walk into a bank with an axe. To me, the risk/reward ratio on that one seems really good! Way better than this computer crime crap. Why waste time learning all those damn c0dez when I can just walk down the street in a crazed fit!

Re:Huh?

[cakesy]

Yeah, great point, well made.

I don't think so

[Tangurena]

Neat houseboat? no. There used to be one (a cruise missle boat) for sale in Tampa that had been converted to a restaurant. I'm not kidding, you'd load it with passengers then take them on a tour of the bottom of the harbor. Their business model, shall we say, s(t)unk, and the vessel ended up for sale. A million dollars was the asking price, and you'd need an export permit to sail it out of US waters.

If the navy saw an ex-soviet sub sailing towards the US, I think they would sink it without asking questions.

More than a few of the soviet missiles were liquid fueled: fuming nitric acid and hydrazine. Both chemicals would corrode you and both are quite toxic. Each sub would be a SuperFund site all by itself.

Re:But at what cost to our privacy?

[zuzulo]

Let me be the devils advocate here for a moment.

Postulate the existence of a cryptographically secure, anonymous peered infrastructure overlay for the internet. Not much of a strech because lots of folks happen to be working on just this sort of technology (I2P, Tor, and many others).

Then postulate the existence of an online currency based on secure cryptographic algorithms. Kind of like a digital bearer bond, if you will. This is a bit more questionable, since most research into digital cash has been directed at ways to make transactions *less* anonymous than actual hard cash transactions. On the other hand, if the aforementioned anonymous peered network exists, you just need a non trivial set of community rated key escrow and transaction settling agents to mediate transactions and currency exchange. It is hard to see how this sort of transaction would work for actual physical goods, but for digital goods (a portion of the market economy that will only increase in size) or anonymous services one can see how anonymous transactions could fairly easily take place. Designing a cryptographically secure anonymous currency is an interesting problem, however.

So, lets assume that you have both an anonymous, secure network, and a variety of well respected anonymous digital currencies. This assumption does not really seem too far fetched to me, although it may be 10 years or so before early versions of secure and anonymous digital currency become sufficiently established.

In any case, the implication here is that some individual (lets call him potential felon X) could complete a completely anonymous transaction with some supplier (potential felon Y) for digital goods and/or services utilizing a secure digital currency issued by an online bank (bank Z). None of the parties in this transaction can know who any of the other parties are.

This raises an interesting point. In this sort of environment, how do you enforce legal standards on the *process* without compromising both the buyer or the seller *independently*? Normal law enforcement proceedure is to compromise one of (X,Y,Z) and use that entity to sweep in the other parties to the transaction, but the problem becomes exponentially more difficult if none of the parties to the transaction connect.

It strikes me that this is an interesting conundrum we will have to deal with as a society in the relatively near term - if you cant track the money, and you cant connect the agents, how do you enforce societal standards of behavior except by catching folks as individuals during or after they commit whatever infraction is in question? This is true for a wide range of transactions (e.g. free speech, terrorist plots, tax evasion, collusion, fraud, identify theft, assassination, political conspiracy, insider trading, music sharing, IP infringement, copyright infringement, etc) some of which we support as a society and some of which we condemn.

The tech is coming, it seems to me that someone ought to be thinking about the implications ...

Re:glitch in the matrix

[Frogbert]

So's your comment, get used to it.

uhm...

[slew]

If a bank taking money from anonymous people and giving it to other anonymous people, I'd like to be the bank please. If I take the money (or perhaps just skim the money) who is to stand up and say that they didn't do the transation (and give up their anonymity)?

Currency is about trust (you trust you can trade in your techically worthless token for something of value), when this trust is broken your rely on identification as a backstop. Without the source identity backstop, you basically have to trust the bank we know banks never do anything bad with your money. You can argue that only honest banks will survive, but if nobody is complaining, how will you know which ones are honest vs the ones that are just being picked on by blackmailers?

Money being just a token is a funny thing in that it only has the value we assign to it...

Re:uhm...

[zuzulo]

This is certainly one of the interesting aspects of currency - that it is essentially worthless without the respect and trust of the marketplace.

Currency used to be 'hard' in the sense that it was actually made of a commodity that had some intrinsic value in the market. Then currency was 'backed' by some commodity with intrinsic value, in that you could exchange your issued currency for a well defined quantity of the commodity in question. Now currency is no longer backed by anything at all, essentially, except the degree to which the issuer is likely to be around and the amount of 'respect' the marketplace has for the currency in question. Specifically, the consumer has to trust that the bank will release his or her funds, or if it does not (cf S&L collapse) the government will make it good (FDIC in the US) and that the ultimate backer (in this case the government) will continue to be well respected by other consumers.

In some ways a secure digital currency could be more strongly backed than current currencies. Take for example eGold, mentioned as a medium of exchange used by the folks profiled in this article. This is a digital currency backed by gold bullion. The currency is only valid because we 'trust' that eGold, inc will actually redeem our eGold certificate for dollars or gold if asked to do so. It is not, however, an anonymous currency. Egold knows exactly who is making transfers to whom, and it is *up to them* to decide to what extent this information is private.

On the other hand, if i were to set up shop as a 'bank' or exchange offering a secure anonymous digital currency, my users would have to be able to trust that i would redeem the currency i issue *in exactly the same way* they have to trust that egold or any conventional bank would redeem their stored assets. Just because the users are anonymous would in no way prevent user outcry if they belive the exchange was handled unfairly since the largest part of your user base would not *require* anonymity especially in the event of an exchange believed to be fraudulent. The benefit of having a cryptographically based medium of exchange is that all parties could *verify* the validity of their currency by cryptographic means without compromising the currency itself. So it becomes quite difficult to perpetrate fraudulent exchanges since all three parties involved in the transaction can check the validity of the currency used.

On the other hand, you would still have to trust that i, as the bank issuing the currency, would honor its redemption. But since *anyone* can check the validity of the currency through published means, even a user who required that their anonymity be protected could complain in a public forum that i am refusing to accept the validity of bills X,Y, and Z despite the fact that they are clearly valid bills *as anyone can tell*.

Designing a secure system like this, is, of course, a non-trivial exercise. But the key is that if you have a system like this, it is more transparent and less prone to fraud perpetrated by the bank or the users than traditional currencies. At heart, however, users *always* have to trust currency issuers - a cryptographic system would just make it easier for users to do so.

Further discussion would likely descend into far too great a level of detail for this forum, but it seems clear to me that in many ways developing a trusted, secure currency based on cryptographic algorithms would make it *easier* for users to trust the entities responsible for issuing currency, rather than less.

Re:uhm...

[anagama]

Currency is about trust ...

May I suggest oxytocin??

Oh shut up

[Sycraft-fu]

Nobody gives a fuck about the /. definitions of terms. Hacker has come to have two contexts, good and bad, and the one most people use is bad. I don't care how you choose to define it, you aren't the one that makes the rules. From the American Heritige Dictionary:

1. One who is proficient at using or programming a computer; a computer buff.
2. One who uses programming skills to gain illegal access to a computer network or file.
3. One who enthusiastically pursues a game or sport: a weekend tennis hacker.

From Webster's Dictionary:

1 : one that hacks
2 : a person who is inexperienced or unskilled at a particular activity
3 : an expert at programming and solving problems with a computer
4 : a person who illegally gains access to and sometimes tampers with information in a computer system

Notice it is both defined as you define it, and also as someone who commits illegal activity. So sorry bud, the usage of hacker to indicate a person who does illegal things with a computer is a correct one.

Slashdot is not the authority on these things.

Houseboat???

[machinegunhand]

Maybe for a blind person, but anyone who likes natural daylight would be out of luck. No windows on subs. That's why they run into things sometimes.

A more detailed article,

[jzoom555]

without the annoying phrase "hacker hunter", can be found here:
http://www.baselinemag.com/article2/0,1397,1774393 ,00.asp

Slightly more tech-saavy article as well. Baseline is a Ziff-Davis IT Project Management trade mag.

Remarkable

[Quantam]

I posted this story and it was rejected. 4 or 5 days later somebody else posted it, and it was published. And now it's been published a SECOND time.

Re:Remarkable

[mt1955]

same thing has happened to me... the editors here must be hormonal

Re:Remarkable

[xquark]

You think thats bad, A few weeks ago, I was just merely thinking about
posting it when commander taco and his taco munching honchos with their
colorfully gay ponchos came into my mind and rejected my post from
there.

Howz that for efficiency!

have you, have you been slashdotted - lately?

Arash

Re: Costs - Federal Law Enforcements Failings

[factory186]

Law enforcement - esp. federal LE - is always going on about lacking the money and tools to fight crime - not just computer crime but any kind of crime. And there is a lot of truth in it. They drive around in their old Ford sedans, following criminals driving Audis, BMWs, Ferraris... They can't keep up, and they stand out like sore thumbs. Trying to get into exclusive nightclubs in tacky suits? Wearing flea market sunglasses in Palm Beach? And of course other examples, like having crap computers, too little staff, etc. But the real reason that federal LE has a hard time catching crims is that they are neither very bright, nor very competent, that departments are full of time-serving hacks and corruption and malfeance common. Many, perhaps most, of their big busts and successes come from informants - an area where the departments, esp. DEA, spend a lot of money - and from people busted through bad luck rolling over on everyone and sundry so as to walk away scot-free, often with their ill-gotten loot still safely pocketed. This phishing bust is probably much in that way - more bribery than detective work. If what you seek is more arrests and convictions from federal law enforcement don't look to increasing the budget spent on cybercrime or whatever area you are concerned about - just have them spend more money on informants and venal deals.

law & order in Chelyabinsk

[svelemor]

Agents involved in the case later downloaded data from the duo's computers, located in Chelyabinsk, Russia, over the Web. Two years after that, Russia filed charges against the FBI sleuths for hacking -- alleging the downloads were illegal.

Well, even if FBI is the law in the US, that doesn't make them entitled to break the law in any other country, does it? I mean, in most (!) countries not even the domestic police forces are allowed to break the law....

A break in is a break in, no matter who does it....

Re:But at what cost to our privacy?

[Zphbeeblbrox]

We may be a member of the UN but that in no way allows the UN to dictate legal precedent to us. US law is based on the constitution of the united states and nothing else. If you want to change that then you go through the legislature and work to have the constitution thrown out and or rewritten to give up our sovereignty. to a higher body. Until then no document or external entity can supersede the Constitution until they win the right either through war or a legislative action to do so.

Uh, I call bullshit

[argoff]

While that was a very nice bedtime story about the bad guys, I think people should really go back and re-read it carefully. To anyone who'se read it a few times - the description of this group is far more like a government hierachy than a criminal one. That should tell you all you need to know right there.

Most Criminals Are Stupid

[scosol]

but... you knew that already :)

Re:We need more of this.

[interstellar_donkey]

I was thinking along the same lines when I read this. It appears that higher-up feds have been generally interested in stopping computer crimes which have been committed against large companies, as opposed to crimes committed against individual citizens, and that always bothered me.

A hacker that does little more then break into a multi-national corporation's computer for the sake of curiosity and adventure is somehow public enemy #1. On the other hand, an organized group of thieves who steal the money and identities of thousands of innocent people and cause them incredible amounts of difficulty rebuilding their credit is something "we'd like to handle, but we really don't have the resources".

I can't say for sure, but I suspect operations like the one mentioned in the article are more likely motivated by pressure from credit card companies losing money on fraud and identify theft protection "insurance", not the pleas of hundreds of thousands of individual citizens who are actually victims of those crimes.

It amuses me when they talk about "damage" in dollar amounts of a worm or virus. Let's say virus A hits millions of home users destroying their individual work, financial records, and costs them time and money to get their computer running right again, while Virus B hits a few thousand machines at a select few large corporations. The dollar amount of "damage" virus A is calculated to be very small, and may only consider an increase in an ISPs or computer manufacturer's queues for telephone tech support. Virus B's damage is calculated to be some unrealistic number in the billions based not only in the real costs of repairing the damaged machines, but on subjective estimates in "loss of productivity" which always make it sound much worse then it really is.

While virus A does far more damage in the aggregate, Virus B is given a higher priority due to companies claiming outrageously over inflated "damages" based on vague and misleading estimates. Or, to put it more cynically, tracking down the perpetrators of Virus B is more important to law enforcement because it hurt big business, while Virus A really isn't a big deal because it only hurt regular people.

I realize this line of thought treads dangerously close to the "tin-foil hat wearing big business controls the government" camp. But consider this: How many individuals have been investigated, arrested and convicted for gaining unauthorized access to a corporation's computer, obtaing private or confidential information without the willing consent of that corporation? I don't know the exact number, but I'm sure there's been more then a few.

On the other hand, how many companies out there have been fined, or their corporate officers jailed for producing software which covertly installs on millions of private individual's machines without explicit permission from the user? Software like spyware which operates 'behind the scenes', is nearly impossible to remove, causes computer performance to suffer, and sends private or confidential information back to the company. None that I know of, despite the fact that many of these companies operate in the United States with offices and mailing addresses.

My guess this is because for the most part what these companies are doing is not illegal. Our laws are written in such a way where what an individual does to a single company is a criminal offense while the same action by a company against millions of innocent people is alright. In my opinion, burying a sentence littered with legalese, but which says something to the effect of "User also agrees that in using this software, certain third party software may be installed on the user's computer which may send information to various third parties" deep within the text of a EULA does not mean the end user is really making an informed decision in allowing the spyware to be installed when they click 'yes'.

So far, there have been no laws passed which require companies that produce spyware to accurately inform

Stupid article.

[blackicye]

Overdramatized pat on the back for Law Enforcement.

e.g. " The HangUp Team has been operating in Russia with impunity for years. Some members are allegedly based in Archangelsk, an Arctic Circle city of rusting Soviet nuclear submarines and nearly perpetual winter."

IANARH (not a russian hacker)

Firstly there is really no point to the stupid above statement. Secondly its most likely 100% untrue, as romantic as the post apocalyptic rusting submarine hulks and perpetual winter may be..

Here's some Pictures of Archangelsk

Bad guys are winning, indeed.

[Politicus]

The article states:

There's a clear reason for this newfound collaboration: The bad guys are winning.

While law enforcement was busy playing with their high tech toys chasing small fry, the real criminals continue to get away. Does anybody even care about the whereabouts of Kenny Boy?

What good is my identity if I can't safely participate in capital ownership?

Re:DUPE DUPE DUPE

[bensafrickingenius]

I got it.

FBI shoud have their own anti-virus experts.

[S3D]

FBI relying on the cooperation of arbitrary(?) choosen commertial anti-virus developer and implicitly promoting them doesn't sound right. It's as if FBI subcontracted part of their work to private secutity company to break some crime ring. It should be other way around. FBI should have experts of such quality that anti-virus companies would ask them for advice.

excerpt from the chatlog

[MoreDruid]

AFK, cop raid

Re:But at what cost to our privacy?

[-brazil-]

The question is: do we WANT that? I don't know about you, but I most certainly do NOT like the prospect of seeing classified ads to the tune of "Will pay $5,000 to anyone who kills Mr. John Doe living in 42 Generic Avenue, Somewhereville, CA" with no way at all to track the person who makes the offer.

Re:But at what cost to our privacy?

[SillyNickName4me]

We may be a member of the UN but that in no way allows the UN to dictate legal precedent to us.

Nah, but when congress rattifies an international treaty, the USA is bound to that treaty according to its own constitution.

With regards to the declaration of human rights, that was rattified by congress and is binding.

US law is based on the constitution of the united states and nothing else.

Despite popular belief in the USA it seems, noone is forcing laws onto your country. WHat happened is your country becomming a participant in a treaty and then rattifying that treaty, making it legally binding according to that same constitution you are so fond of.

Interestingly, people in the USA seem to feel strongly about this and respond quickly whenever they have even the slightest suspicion that someone might be trying to enforce some rule or law on them, yet, they have no problem whatsoever forcing any rules or laws on someone else, even rules that they just made up for the specific occation.

Re:But at what cost to our privacy?

[SillyNickName4me]

That's the same argument people make for the erosion of privacy.

No it is not.

The main difference is that with the erosion of privacy, everyone pays the price in order to prevent small personal loss by a few.

Re:But at what cost to our privacy?

[Zphbeeblbrox]

No treaty no matter what it says can supersede the constitution. And contrary to popular belief outside of the US of A, there is a growing movement in our justice system to use international law as precendent for domestic courts.

No treaty has the ability under our constitution to dictate domestic law. Find me the section that says that and I'll be happy to admit I'm wrong. Treaties may be able to dictate our relations with other nations but they have no business or function in domestic affairs. That is what I object to.

Re:But at what cost to our privacy?

[SillyNickName4me]

No treaty no matter what it says can supersede the constitution.

Which is not what I claimed anyway. What I claim is that when the USA enters a traty, ratifies it properly, then that treaty is binding. This is also what the constitution says for all I can tell. If the president ratifies a treaty that is unconstitutional, then there is a problem and the traty may not be valid for as far as the USA goes. So while you are right that the constitution superseeds international treaties, that does not mean that such treaties are not binding.

And contrary to popular belief outside of the US of A, there is a growing movement in our justice system to use international law as precendent for domestic courts.

That is a problem with the justice system, not with international treaties. That said, when the USA happens to be a party to some treaty, even when that treaty has something to say about domestic law (ie, international declaration of human rights) then it is bound to it. THe USA entered into obligations when ratifying the treaty, and will have to live up to that, alternative is to not ratify it.

No treaty has the ability under our constitution to dictate domestic law. Find me the section that says that and I'll be happy to admit I'm wrong. Treaties may be able to dictate our relations with other nations but they have no business or function in domestic affairs. That is what I object to.

Imho you have a very shallow understanding of the subject. I do understand your sentiment, and I don't think that it is wrong, but I also see that your understanding of what an international treaty is, and how it gets approved and incorperated into 'the law of the country' is rather incorrect. What you think is happening is simply not happening. You think it is happening because you lack the proper information and understanding.

oh and again, the USA has little trouble whatsoever trying to force traties onto others even when those others are not a party to that treaty, I'd expect you to object to that based on what you have been expressing here.

Re:But at what cost to our privacy?

[Zphbeeblbrox]

You misunderstand me. I don't object to treaties being binding. I object to my own nations government's growing tendency to sign on to treaties that overstep our own nations sovriegnty. This has nothing to do with outside parties it's just me expressing dissatisfaction with our judical, and legislative branches.

No, you shut up, cracker!

[william.gunn]

Webster is such a great source for definition of computer terms. Main Entry: cracker Pronunciation: 'kra-k&r Function: noun 1 chiefly dialect : a bragging liar : BOASTER 2 : something that makes a cracking or snapping noise: as a : FIRECRACKER b : the snapping end of a whiplash : SNAPPER c : a paper holder for a party favor that pops when the ends are pulled sharply 3 plural : NUTCRACKER 4 : a dry thin crispy baked bread product that may be leavened or unleavened 5 a usually disparaging : a poor usually Southern white b capitalized : a native or resident of Florida or Georgia -- used as a nickname 6 : the equipment in which cracking (as of petroleum) is carried out BTW, since no one will get the joke: I'm a from a small rural southern town.

Classic Mistake

[PingPongBoy]

A large gang of 28 people in an apartment - that draws a lot of attention, and once someone catches on, there's no escape.

Not to mention, having shadowcrew.com as a registered name, well that just isn't what grandma would use.