Slashdot Mirror
A Hacker's Audacious Plan To Rule the Underground
An anonymous reader writes "Wired has the inside story of Max Butler, a former white hat hacker who joined the underground following a jail stint for hacking the Pentagon. His most ambitious hack was a hostile takeover of the major underground carding boards where stolen credit card and identity data are bought and sold. The attack made his own site, CardersMarket, the largest crime forum in the world, with 6,000 users. But it also made the feds determined to catch him, since one of the sites he hacked, DarkMarket.ws, was secretly a sting operation run by the FBI."
Yeah, many years ago (in my teens) I had the ambition to be "the next bill gates", and now as I write small to medium websites and private applications from my couch, covered in empty red bull cans and small food bags, I think I managed pretty well!
</humor>
Sounds like he was always a black hat but just didn't cause enough problems while he still had his training wheels on.
Engineering is the art of compromise.
...by hackorX, the true ruler of the hacker underground. You've been warned script kiddie hacker wannabes.
Posting anonymously for obvious reasons.
I went to school with Max Butler. He's driven by constant challenges. I knew Max as a friend and as such witnessed the same vitriol and hatred he put up with from others who did not understand him. Teachers often openly mocked him, especially in computer science courses.
His escape from it all came from hacking. He noticed he had a particular knack for it. He'd get really engrossed, and it became sort of a downward spiral from there. If you know anyone like him, please do not ostracize him in his forming years. Imagine if he had been a solid, contributing member of society like timecop, or the millions of other good natured people that run trolling organizations that specialize in making fools out of idiots like yourself.
. . . to hang up his hat. Whatever the color.
No good deed goes unpunished. - Avon, Blake's 7
"Once inside, he sucked out their content, including the logins, passwords, and email addresses of everyone who bought and sold through the sites. And then he decimated them, wiping out the databases with the ease of an arsonist flicking a match."
This seems to be written more like a work of fiction than an account of the hack. The description echo'ed the language used in Jeffery Deaver's "The Blue Nowhere".
The first rule of hack club is you don't talk about hack club.
Hope he has fun in "Federal pound me in the ass" prison.
The way I figure it all the effort that goes into making big money doing crime would be better used in the 'real' world.
I live in the ghetto and the skills required to sell drugs/weapons can be easily transferred to the business world rather easily and the income is higher.
Honest money allows me to sleep at night and at the end of this train ride, the books will be balanced and that man in the sky will do the accounting and even it all out.
From TFA:The heat in Max Butler's safe house was nearly unbearable. It was the equipment's fault. Butler had crammed several servers and laptops into the studio apartment high above San Francisco's Tenderloin neighborhood, and the mass of processors and displays produced a swelter that pulsed through the room. Butler brought in some fans, but they didn't provide much relief. The electric bill was so high that the apartment manager suspected Butler of operating a hydroponic dope farm.
I am convinced that this story was fabricated by some Stephen Glass wannabe.
Just showing my ignorance here, but can someone give me a definition of what 'hat colors' mean? Red Hat I know (I guess), but White Hat? Black Hat? Blue Hat?
Someone throw me a bone, here.
It wasn't that this guy was whacking other underground sites, it's that he also nailed the FBI's "sting" website. The FBI and him engaged in a turf war, because if there's one thing the government hates, it's stealing. It hates competition.
#fuckbeta #iamslashdot #dicemustdie
I'm assuming this is a pseudonym? Or is he hiding abroad? Because if his real name is known, he can't be that hard to catch...
If you're going by the Roman definition, modern definition such as 'decimation in time' can mean any size reduction of a set, although I don't think down to zero.
Although, Lindsay Nagel would disagree, since zero is a percent.
Months later, Aragon's lawyer gave him some bad news. The Secret Service had cracked Butler's crypto and knew more about the hacker than Aragon didâ"which meant Aragon would probably never be offered a deal, even if he wanted one.
The USS cracked the Whole Disk Encryption of Max Butler.
Now reading about this guy, does Max Butler seem like the kind of guy who is going to keep his WDE password on his PDA?
No, I didn't think so either.
So, what kind would he be likely to use? dm-crypt under Linux? Commercial PGP? Scramdisk? TrueCrypt?
I think more WDE is backdoored than any of us suspect, and my takeaway from that line is that the commercial products aren't to be trusted.
Yea, but they seem to be trying to make it mean *leave* 10%.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
The obvious question: why didn't the FBI do this rather than set-up a honeypot site? I understand the focus on gathering evidence, but it is interesting the disruption isn't a more important part of the law-enforcement toolkit.
Moron.
Sincerely,
Kilgore Trout
recently operation icebreaker brought down some local meth dealers. I bet the same name had been used for similar stings hundreds of times.
Now operation DarkMarket turns out to be a Fed-run honeypot.
How hard could it be to make a dictionary of likely FBI operation names, or even an application to rank the probability of a domain name being based on operation names that have been used on TV in the past ?
Nullius in verba
you all must be new here.
Please stop bringing me into this!
I got some bad grammar
Not exactly true. One of the admins was compromised after an arrest, and rather than shutting it down, they kept it running for a bit longer, planning on setting up big buyers for eventual busts.
Have you been touched by his noodly appendage?
Coward.
Sincerely,
Theodore Sturgeon
If cracking a full-disk encryption with a ten-character password takes only five seconds, an eleven-character (assuming that it's case sensitive) password is going to take five minutes. A twelve-character will take about five hours. A thirteen-character, almost two weeks. Fourteen, two years.
Have you been touched by his noodly appendage?
That if you are an enemy of the Mafia, you are an enemy of the state.
NO SIG
Yeah, the past 400 years of usage of "decimate" have really indicated that the word only means "take away 10%." http://www.etymonline.com/index.php?search=decimate&searchmode=none
Hacking is an obsession and an addiction. It can easily take over your life, especially if you are good at it. Finding your next target is like getting in your next fix. It offers the ultimate escape, diversion and self-esteem. In a sense, it is a power trip. The kind of rush you expirience when your skills pay off is incredible. For some, it is a rush better than sex and drugs combined. It adds a new dimension to an otherwise mundane and seemingly predictable reality. Some perspective ;)
Trying to install linux on my microwave, but keep getting a kernel panic...
Muhammad (yeah, that one) once had an epiphany, guided to him, at least in theory by the archangel Gabriel and he took this idea to the Hebrews; "I understand you! Better yet, I can improve on what you're doing!" was generally the idea.
They laughed at him, and the world has seen Semites (both Arabs and Israelis) fight to the death since then.
Hitler had ambition to become a painter of great works. He felt he had something to say in the art world, and at some point tucked his paintings under his arm and went to Vienna to show them off. "I understand you- better yet, share in my furthering works!" was the general idea.
More than 150 MILLION people died in the eventual Darwin-inspired war that followed. But to his credit, anyplace Darwin's suggestions are instituted, slavery and genocide are permitted.
It's not surprising that a hacker who doesn't fit in, ridiculed by authority figures can do great harm. Ya see, PRIDE is mankind's downfall.
Pride can be constructive; it makes us work hard and commits us to great works. But pride in it's extreme makes us do horrific things too- murders, shooting sprees and war. The Columbine killers wanted to leave a big story- make a big splash...for their pride.
Satan's favorite tool is pride. With it, a person won't accept there can even BE a God! "Surely I'm too smart for that boring crap" and the man never lifts a finger to answer the eternal question.
Be careful with your pride, aye?
Its funny because people like Timecop probably really do believe they're doing something. Meanwhile, mimes continue to contribute more to society.
If you run Windows PE you can run it from a CD. Also there's the chance they are using a USB flash drive/USB hard disk and running Windows from that...
You're on your own with respect to the fingerprints though. Can't even being to explain that...
The Yellow Hat sect of Tibetan Buddhism is the school that the Dalai Lama and Panchen Lama belong to, as opposed to the Nyingma or Red Hat sect which is the school that the Karmapa Lama belongs to.
And if anybody wants you to install a piece of distributed computing software that needs you to install Tibetan fonts and nine gigabytes of RAM on your computer, do be careful...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Because I don't trust wired.com much... I did a quick search for data on Max Butler from the source: The Department of Justice's own press release on this is dated 9/11/2007.
A Man's ethical behavior should be based effectually on sympathy, education, and social ties -- Albert Einstein
The criminal's accomplices shopped him. That, plus evidence of the public market that he created, was more than enough for a search warrant.
Once again . . . there is no honor among thieves. We should all be grateful for that.
I hope that the Feds launch that guy into the stratosphere.
Interesting fact about Rijndael -- it has a very simple structure: it's "light" but perfectly* strong, as far as extant knowledge goes. (*"Perfectly" in the sense that there is no extant way to break it apart from brute force.) However, its simplicity has led some to consider it "not the most secure choice." Makes you wonder if there *is* a government farm that can crack it now!
do the moderators even know who timecop is?
Perhaps they do, but they actually like Jean-Claude Van Damme. Some people are weird like that.
Chernobyl 'not a wildlife haven' - BBC News
Max is/was/will always be a guy who stole identities and money other people, in many cases making their lives living Hell. You can toot all you want about the evil FBI, but fact of the matter is that Max is a thief who took things that didn't belong to him.
If you want news from today, you have to come back tomorrow.
I think this dubious honor belongs to the US government.
Yes, I for one applause that he had the guts to steal from the thiefs..too bad that the goverment does not like getting robbed.
Your name made me laugh. Thank you.
Yay me!
Yes, you wouldn't even DARE to use a password or passphrase. You'd generate a strong key.
The only thing safe is using a onetimepad (xor) encryption, since it is really UNBREAKABLE, as long as the key is as long as the message.
You just gotta hide that well or encrypt it addtionally with various layers of other ciphers.
I would carry that key around with me all the time, and hide it somewhere in huge amounts of data. Like offset 87978978971231 of a certain drive's raw data. And I'd put a self destruction device next to it.
Thanks for your comment.
You are a fucking brain-dead moron.
Is it better to capture or hire the black hats?
I always wondered.
And should I equip myself with, um, l33t haxx0r (read: script kiddie) skillz, just for my own, um, protection?
Hah! I see what you are trying to do here!
Almost fiendishly clever, you rascal!
*hint* /. user name was just 'new here'. Think about it, or not. :-)
That would work far more often if your
*runs off to patent office*
P.S. As my dear departed dad would say, "Smooth move, Ex-Lax"!"
All in fun, pay no attention to me...this is NOT an attack on your post, and my karma can withstand humour impaired mod's...I laugh with you, not at you!-If I had mod points, I would give you '+1 funny' just for your user name in this instance. (as you had planned on happening-well done!)
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
Max is/was/will always be a guy who stole identities and money other people, in many cases making their lives living Hell. You can toot all you want about the evil FBI, but fact of the matter is that Max is a thief who took things that didn't belong to him.
You could say that about everyone in government.
I have been one of Max's friends since HS. It's been most sad watching all this happen. He's such a good guy. He's made some bad choices, but he also has had his life severely constrained because of what happened with his gf in HS.
What the article doesn't really say is that his friends don't actually believe he assaulted her. He was impulsive and kinda wacky, but never hurt anybody, nor ever wanted to. Just think of him, a big kid with long hair standing in front of a box full of old, conservative, Idaho jurors. He's scary lookin'! Convict!!
Anyways, He was in prison while the rest of us went to college and got jobs. He got out and tried to play catch-up, but it was hard with a felony record. So for the rest of his life, he's been an outsider struggling to get in with the rest of us.
He's tried SO hard to do the right thing. But again, his record made it hard to get jobs, and he is so good at security stuff... It's so easy to slip. Again, bad decisions, but he had so few choices! I just wish he'd come to me to borrow money when he needed it rather than accepting these guys' offer. He was always close-mouthed about what he was doing after that. He said many times to me that he wished he could be doing good things too when I'd tell him about what was going on in my work. He had such huge collections of malware and 0day stuff that he kept meaning to organize and distribute to security researchers. He tried to help out with the honeynet project. etc.
My biggest fantasy is that the government would spring him out after a few years, put him in a room with a really smart handler, and let him rip at trying to figure out who spammers are or pentest government facilities for them or something. He could and would do SO much good. But of course, that only happens in the movies. Sigh.
From what he's said to me, there's a lot more stuff that he wants to say, but he can't talk about it until the trial is over. That said, I think that even he is pretty sure that he deserves some punishment for all this. I do too. But I temper this with the belief that he really would be a positive force for good if he were just given a chance. Please consider that before you vilify him.
Have fun!
Man, get with the times. As others should point out, this isn't identity theft, it's identity infringement. If I download your identity, you aren't deprived of it! It's like a fire that isn't diminished when another person takes a burning brand!
Oh, this isn't like downloading a song? I'm confused here.... Please, Slashdot, tell me what to think!
Max is/was/will always be a guy who stole identities and money other people, in many cases making their lives living Hell. You can toot all you want about the evil FBI, but fact of the matter is that Max is a thief who took things that didn't belong to him.
Different than thieves who take things that belong to them.
I doubt they brute-forced the FDE, just the pass phrase to the key cert/ring.
I'll lay good money that the NSA/FBI have a full set of rainbow tables for any hash currently used for passphrases. Takes major CPU to generate, but once you've got it, it takes a very short time to find your way in.
Hell, Passware has an online site that can discover passwords for Office docs in seconds.
Trying to become famous by taking photos. Visit my homepage please.
The inside story .. from the school of very bad faction ..
.. The electric bill was so high that the apartment manager suspected Butler of operating a hydroponic dope farm"
..
"The heat in Max Butler's safe house was nearly unbearable
'This story, like the rest of this article, has been reconstructed using court documents and conversations with friends and associates; Butler declined to be interviewed'
In the hands of a competent author, this style can contribute something to the story. In the hands of lesser writers, it's painful to try and read
davecb5620@gmail.com
"Christopher Aragon had recently run an Orange County leasing company .. Butler gave him a shopping list of equipment he'd need to get started, including a new laptop, military-grade crypto, and an antenna"
.. enough from the school-of-bad-journalism ..
..
The worlds greatest hacker asks a truck leaser for 'military-grade' crypto
Is this the same Kevin Poulsen that Adrian Lamo ran into
davecb5620@gmail.com
There's a huge difference between criticism and ridicule. To be frank, most of us went through that kind of stuff growing up. Very few of us turned out anti-social.
Social networking sites don't count.
But hey, I'm anti-social, I don't care about most people in general. I hate small talk, I am not really interested in what other people do, or what their favorite sports team is, or what cute thing their kid said. I don't expect them to be interested in what mine said. I don't high-five strangers, or anyone for that matter.
I don't think it's a bad thing.
My beliefs do not require that you agree with them.
Errr.. surely credit card fraud only actually defrauds the card companies themselves and not the individuals who own the cards?
Eh, everyone breaks laws. There are no exceptions. Jacking money from a bank and inconveniencing somebody is pretty white-collar. His crime will get him a serious sentence only because it was commited against banks.
It was an admin, not the owner, that was compromised.
Have you been touched by his noodly appendage?
No, He's New Here.
February 9th, 2009 8:55pm: Slashdot becomes self-aware.