Slashdot Mirror
A Hacker's Audacious Plan To Rule the Underground
An anonymous reader writes "Wired has the inside story of Max Butler, a former white hat hacker who joined the underground following a jail stint for hacking the Pentagon. His most ambitious hack was a hostile takeover of the major underground carding boards where stolen credit card and identity data are bought and sold. The attack made his own site, CardersMarket, the largest crime forum in the world, with 6,000 users. But it also made the feds determined to catch him, since one of the sites he hacked, DarkMarket.ws, was secretly a sting operation run by the FBI."
Yeah, many years ago (in my teens) I had the ambition to be "the next bill gates", and now as I write small to medium websites and private applications from my couch, covered in empty red bull cans and small food bags, I think I managed pretty well!
</humor>
Sounds like he was always a black hat but just didn't cause enough problems while he still had his training wheels on.
Engineering is the art of compromise.
...by hackorX, the true ruler of the hacker underground. You've been warned script kiddie hacker wannabes.
Posting anonymously for obvious reasons.
I went to school with Max Butler. He's driven by constant challenges. I knew Max as a friend and as such witnessed the same vitriol and hatred he put up with from others who did not understand him. Teachers often openly mocked him, especially in computer science courses.
His escape from it all came from hacking. He noticed he had a particular knack for it. He'd get really engrossed, and it became sort of a downward spiral from there. If you know anyone like him, please do not ostracize him in his forming years. Imagine if he had been a solid, contributing member of society like timecop, or the millions of other good natured people that run trolling organizations that specialize in making fools out of idiots like yourself.
. . . to hang up his hat. Whatever the color.
No good deed goes unpunished. - Avon, Blake's 7
"Once inside, he sucked out their content, including the logins, passwords, and email addresses of everyone who bought and sold through the sites. And then he decimated them, wiping out the databases with the ease of an arsonist flicking a match."
This seems to be written more like a work of fiction than an account of the hack. The description echo'ed the language used in Jeffery Deaver's "The Blue Nowhere".
The way I figure it all the effort that goes into making big money doing crime would be better used in the 'real' world.
I live in the ghetto and the skills required to sell drugs/weapons can be easily transferred to the business world rather easily and the income is higher.
Honest money allows me to sleep at night and at the end of this train ride, the books will be balanced and that man in the sky will do the accounting and even it all out.
they showed him the real definition of a "Back door" entry method !!!!!! -_~
No conjugal visits?
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
Plenty... They're just from the other inmates is all.....
Just showing my ignorance here, but can someone give me a definition of what 'hat colors' mean? Red Hat I know (I guess), but White Hat? Black Hat? Blue Hat?
Someone throw me a bone, here.
It wasn't that this guy was whacking other underground sites, it's that he also nailed the FBI's "sting" website. The FBI and him engaged in a turf war, because if there's one thing the government hates, it's stealing. It hates competition.
#fuckbeta #iamslashdot #dicemustdie
I'm assuming this is a pseudonym? Or is he hiding abroad? Because if his real name is known, he can't be that hard to catch...
HTH - http://en.wikipedia.org/wiki/Tenderloin,_San_Francisco,_California
Pathological kinda promises Path + Logical - but instead, you get stuck with pathetic.
If you're going by the Roman definition, modern definition such as 'decimation in time' can mean any size reduction of a set, although I don't think down to zero.
Although, Lindsay Nagel would disagree, since zero is a percent.
Months later, Aragon's lawyer gave him some bad news. The Secret Service had cracked Butler's crypto and knew more about the hacker than Aragon didâ"which meant Aragon would probably never be offered a deal, even if he wanted one.
The USS cracked the Whole Disk Encryption of Max Butler.
Now reading about this guy, does Max Butler seem like the kind of guy who is going to keep his WDE password on his PDA?
No, I didn't think so either.
So, what kind would he be likely to use? dm-crypt under Linux? Commercial PGP? Scramdisk? TrueCrypt?
I think more WDE is backdoored than any of us suspect, and my takeaway from that line is that the commercial products aren't to be trusted.
Yea, but they seem to be trying to make it mean *leave* 10%.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
The obvious question: why didn't the FBI do this rather than set-up a honeypot site? I understand the focus on gathering evidence, but it is interesting the disruption isn't a more important part of the law-enforcement toolkit.
recently operation icebreaker brought down some local meth dealers. I bet the same name had been used for similar stings hundreds of times.
Now operation DarkMarket turns out to be a Fed-run honeypot.
How hard could it be to make a dictionary of likely FBI operation names, or even an application to rank the probability of a domain name being based on operation names that have been used on TV in the past ?
Nullius in verba
you all must be new here.
Please stop bringing me into this!
I got some bad grammar
Not exactly true. One of the admins was compromised after an arrest, and rather than shutting it down, they kept it running for a bit longer, planning on setting up big buyers for eventual busts.
Have you been touched by his noodly appendage?
If cracking a full-disk encryption with a ten-character password takes only five seconds, an eleven-character (assuming that it's case sensitive) password is going to take five minutes. A twelve-character will take about five hours. A thirteen-character, almost two weeks. Fourteen, two years.
Have you been touched by his noodly appendage?
That if you are an enemy of the Mafia, you are an enemy of the state.
NO SIG
Yeah, the past 400 years of usage of "decimate" have really indicated that the word only means "take away 10%." http://www.etymonline.com/index.php?search=decimate&searchmode=none
Hacking is an obsession and an addiction. It can easily take over your life, especially if you are good at it. Finding your next target is like getting in your next fix. It offers the ultimate escape, diversion and self-esteem. In a sense, it is a power trip. The kind of rush you expirience when your skills pay off is incredible. For some, it is a rush better than sex and drugs combined. It adds a new dimension to an otherwise mundane and seemingly predictable reality. Some perspective ;)
Trying to install linux on my microwave, but keep getting a kernel panic...
If you run Windows PE you can run it from a CD. Also there's the chance they are using a USB flash drive/USB hard disk and running Windows from that...
You're on your own with respect to the fingerprints though. Can't even being to explain that...
The Yellow Hat sect of Tibetan Buddhism is the school that the Dalai Lama and Panchen Lama belong to, as opposed to the Nyingma or Red Hat sect which is the school that the Karmapa Lama belongs to.
And if anybody wants you to install a piece of distributed computing software that needs you to install Tibetan fonts and nine gigabytes of RAM on your computer, do be careful...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Because I don't trust wired.com much... I did a quick search for data on Max Butler from the source: The Department of Justice's own press release on this is dated 9/11/2007.
A Man's ethical behavior should be based effectually on sympathy, education, and social ties -- Albert Einstein
Scorn is usually a bad thing anyway. Just because you don't agree or understand something doesn't mean you should react negatively. This is why I believe it's difficult to have meaningful discussions with people on the extremes, such as liberals. Don't like gay marriage? HATE MONGER!! All too often people resort to insults rather than intellect. I guess because it's easier and there's no accountability. How do you prove you're not a "Hate Monger"? Lack of evidence is evidence.
The criminal's accomplices shopped him. That, plus evidence of the public market that he created, was more than enough for a search warrant.
Once again . . . there is no honor among thieves. We should all be grateful for that.
I hope that the Feds launch that guy into the stratosphere.
do the moderators even know who timecop is?
Perhaps they do, but they actually like Jean-Claude Van Damme. Some people are weird like that.
Chernobyl 'not a wildlife haven' - BBC News
Max is/was/will always be a guy who stole identities and money other people, in many cases making their lives living Hell. You can toot all you want about the evil FBI, but fact of the matter is that Max is a thief who took things that didn't belong to him.
If you want news from today, you have to come back tomorrow.
I think this dubious honor belongs to the US government.
Yes, I for one applause that he had the guts to steal from the thiefs..too bad that the goverment does not like getting robbed.
Your name made me laugh. Thank you.
Yay me!
Is it better to capture or hire the black hats?
I always wondered.
And should I equip myself with, um, l33t haxx0r (read: script kiddie) skillz, just for my own, um, protection?
Hah! I see what you are trying to do here!
Almost fiendishly clever, you rascal!
*hint* /. user name was just 'new here'. Think about it, or not. :-)
That would work far more often if your
*runs off to patent office*
P.S. As my dear departed dad would say, "Smooth move, Ex-Lax"!"
All in fun, pay no attention to me...this is NOT an attack on your post, and my karma can withstand humour impaired mod's...I laugh with you, not at you!-If I had mod points, I would give you '+1 funny' just for your user name in this instance. (as you had planned on happening-well done!)
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
Max is/was/will always be a guy who stole identities and money other people, in many cases making their lives living Hell. You can toot all you want about the evil FBI, but fact of the matter is that Max is a thief who took things that didn't belong to him.
You could say that about everyone in government.
I have been one of Max's friends since HS. It's been most sad watching all this happen. He's such a good guy. He's made some bad choices, but he also has had his life severely constrained because of what happened with his gf in HS.
What the article doesn't really say is that his friends don't actually believe he assaulted her. He was impulsive and kinda wacky, but never hurt anybody, nor ever wanted to. Just think of him, a big kid with long hair standing in front of a box full of old, conservative, Idaho jurors. He's scary lookin'! Convict!!
Anyways, He was in prison while the rest of us went to college and got jobs. He got out and tried to play catch-up, but it was hard with a felony record. So for the rest of his life, he's been an outsider struggling to get in with the rest of us.
He's tried SO hard to do the right thing. But again, his record made it hard to get jobs, and he is so good at security stuff... It's so easy to slip. Again, bad decisions, but he had so few choices! I just wish he'd come to me to borrow money when he needed it rather than accepting these guys' offer. He was always close-mouthed about what he was doing after that. He said many times to me that he wished he could be doing good things too when I'd tell him about what was going on in my work. He had such huge collections of malware and 0day stuff that he kept meaning to organize and distribute to security researchers. He tried to help out with the honeynet project. etc.
My biggest fantasy is that the government would spring him out after a few years, put him in a room with a really smart handler, and let him rip at trying to figure out who spammers are or pentest government facilities for them or something. He could and would do SO much good. But of course, that only happens in the movies. Sigh.
From what he's said to me, there's a lot more stuff that he wants to say, but he can't talk about it until the trial is over. That said, I think that even he is pretty sure that he deserves some punishment for all this. I do too. But I temper this with the belief that he really would be a positive force for good if he were just given a chance. Please consider that before you vilify him.
Have fun!
I doubt they brute-forced the FDE, just the pass phrase to the key cert/ring.
I'll lay good money that the NSA/FBI have a full set of rainbow tables for any hash currently used for passphrases. Takes major CPU to generate, but once you've got it, it takes a very short time to find your way in.
Hell, Passware has an online site that can discover passwords for Office docs in seconds.
Trying to become famous by taking photos. Visit my homepage please.
The inside story .. from the school of very bad faction ..
.. The electric bill was so high that the apartment manager suspected Butler of operating a hydroponic dope farm"
..
"The heat in Max Butler's safe house was nearly unbearable
'This story, like the rest of this article, has been reconstructed using court documents and conversations with friends and associates; Butler declined to be interviewed'
In the hands of a competent author, this style can contribute something to the story. In the hands of lesser writers, it's painful to try and read
davecb5620@gmail.com
"Christopher Aragon had recently run an Orange County leasing company .. Butler gave him a shopping list of equipment he'd need to get started, including a new laptop, military-grade crypto, and an antenna"
.. enough from the school-of-bad-journalism ..
..
The worlds greatest hacker asks a truck leaser for 'military-grade' crypto
Is this the same Kevin Poulsen that Adrian Lamo ran into
davecb5620@gmail.com
However, its simplicity has led some to consider it "not the most secure choice." Makes you wonder if there *is* a government farm that can crack it now!
Did you actually fully read and comprehend that post. To quote:
In other words, while someone may find an attack that would allow one to break the cipher in less time than pure brute force, he doesn't believe that any such attack will actually be feasible to execute.
I think, by declaring liberals as extremists, you pretty well defined hypocrisy with your post.
You use your first 2 sentences to denounce up a type of behavior, and then engage in that very behavior in the very next sentence, you didn't even break for paragraph. Thank you for your demonstration, it may even cover cognitive dissonance as well as hypocrisy.
You know damn well that not all (not even most, and you KNOW it) liberals are extremists like that. On top of that you know (you KNOW) that there are conservatives just as extreme. Stop pretending to be on the only rational side. You'll find idiots and assholes wherever you look, especially if you go hunting for idiots and assholes.
There's a huge difference between criticism and ridicule. To be frank, most of us went through that kind of stuff growing up. Very few of us turned out anti-social.
Social networking sites don't count.
But hey, I'm anti-social, I don't care about most people in general. I hate small talk, I am not really interested in what other people do, or what their favorite sports team is, or what cute thing their kid said. I don't expect them to be interested in what mine said. I don't high-five strangers, or anyone for that matter.
I don't think it's a bad thing.
My beliefs do not require that you agree with them.
It was an admin, not the owner, that was compromised.
Have you been touched by his noodly appendage?
No, He's New Here.
February 9th, 2009 8:55pm: Slashdot becomes self-aware.