Slashdot Mirror
An FBI Agent's 3 Years Undercover With Identity Thieves
snydeq writes "InfoWorld offers the inside story of how FBI Supervisory Special Agent J. Keith Mularski, aka Master Splynter, penetrated and took over DarkMarket.ws, the infamous underground carding board hacked by Max Butler and later transformed by Mularski into an FBI sting operation. The three-year tour sent Mularski deeper into the world of online computer fraud than any FBI agent before, resulting in 59 arrests and preventing an estimated $70 million in bank fraud before the FBI pulled the plug on the operation in October."
How much more such operations could they conduct if they weren't so clueless by having agents investigate peaceful protesters and non-criminal **HACKERS** (in the original sense, that is, not meaning "cracker")????
How on earth are we supposed to believe it's the real Agent Mularski now?
Cool hacker name = geek culture reference + creative misspellings/capitalizations
Sample names:
Dark JedEYE
FeloniouS MonK
POPP3R SMRF
TERRORByTE
G\/\/B
I predict you will hear of these handles in future busts.
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
I had heard about this at a law enforcement/fraud analysis/intelligence analysis conference a while back. Basically, ALL the major sites were running in the open. Before all the crackdowns, I guess they thought the anonymity of the web meant they were untouchable. After the FBI cracked down on a bunch, they got wise and went underground.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
From an article I read on Wired what seemed to have brought the downfall upon Butler was some of his associates got nabbed for trying to use stolen cards to buy expensive retail items and then fence them on Ebay for cash. Seems to me that old fashioned F**k-ups are the way these guys usually get taken down. Also from the article I read that corrupt retailers and waiters use portable card readers to steal all mag data on the card. How would you protect yourself against that kind of attack?
Namaste
It's like being an undercover mob boss. Except you don't get to: Bang models on their way to the street, Drown rats or wear a cool ring.
Here is my question: Now that Darkmarket is all busted and closed, will this cop just enjoy a 2nd honeymoon before starting again with a new alias and hitting on a different set of crooks.
Hell, if he plays his cards right he could enter the private sector and make millions off the MPAA and RIAA.
--= Isn't it surprising how badly I spell ?
As far as I know, the general idea was that the transactions would happen so quickly that even if someone was watching, the money would be long gone before anyone could track it. Keep in mind that these stories are published long after the arrest occurs, so by the time you learn about what happened, the criminals have moved deeper underground.
Palm trees and 8
You mean like at http://www.fbi.gov/quickfacts.htm ?
The FBI's jurisdiction is essentially being the nation's police force as opposed to your local city force. You can't say "ignore these sections of the state, county or city code" to a local police force just like you can't tell the FBI to ignore the U.S. Code.
The FBI does have certain, specific areas of jurisdiction. Ever read the FBI website? They say with specificity what their areas of jurisdiction and current criminal priorities are.
My blog
Maybe I'm a brain in a vat.
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
Buy things at small retailers unlikely to have complicated security policies or good video surveillance. Use local criminals to do the deal for you, promising a cut if they are successful getting the item out of the store. Keep the purchases under $2,000.00
Sell those things for cash on the street. Don't sell in the same area that you bought the items. Stick to big cities, as the police have way more to deal with than small-time theft. Once you get a big enough stash, use it to start a cash friendly business or find a way to get it to a trusted party in the third world and do the same thing.
The object is to not piss one person off to the point where they dedicate themselves to finding you. As long as the victim has the credit card company to turn to for a refund, and the police don't think the fraud is connected, no one will even bother opening up a case number.
> You have your messiah in the White House now.
You're damn right we do!
http://www.boingboing.net/images/x09/DSC_4696.jpg
- For the complete works of Shakespeare: cat
I'm still wondering why the various banks don't offer reloadable cards for their customers. Why wander around with your ENTIRE credit limit in your wallet?
And for debit cards, your ENTIRE checking account balance.
Instead, allow the user to transfer the amount that he thinks he will need to a secondary card. That way, if anything compromises that card, the MOST they can get is whatever he put on that card.
As for online purchases, how about one-use card numbers? Just go to the bank site, put in how much you want to pay and the bank will give you a one use number for that amount. Then the maximum you lose if the online site is fake is that specific amount. They never get the real numbers to your real accounts.
"They have a direct personal relationship with industry people in all areas, but specifically a great relationship with the financial institutions,"
Well, hell, no shit! But, for those who are curious as to why i say it that way, check out:
www.visualanalytics.com
They've been around since before 2002, and i've found them to have some really cool products, based on screen shots and explanations. As far as i'm concerned, the railing bush did on the NYT reporter who outed an ongoing investigation tool probably though along the lines of VisualAnalytics, and i bet VA was the tool used. Or, some in-house FBI/CIA modification of it.
See:
http://www.visualanalytics.com/products/visualinks/index.cfm
http://www.visualanalytics.com/products/visuaLinks/details/vlComparisonChart.cfm
http://www.visualanalytics.com/products/visuaLinks/vlPreview.cfm
Now, imagine if MySql, Postgres, and OpenOffice and other tools could be fused, but toned down for non-intelligence/spying, but for companies mining their own hepta-wheta-peta-quad data wharehouses, or for small businesses something less powerful...
As for anti-terrorism and money laundering, they have (or in 2002 had) slides showing how the bank or federal agency using the tool can interoperate and flag activities by monitoring the target's/targets' phones (any known), contacts' phones, any or all parties' banks transactions, credit cards, deposits, money orders and transfers to or from their names, addresses, and so on, and so on. Heck, if you get access to publishers and libraries, utilities, charitie, and more, HUGE or SMALL networks can be sleuthed/sussed out.
It's a mind-bogglingly powerful and impressive tool.
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
He's not the messiah, he's very naughty boy! Now, go away!
Don't you mean all the KNOWN sites were running in the open?
Actually, this sounds like the average [married] slashdotter.
You've reminded me of an old BlueWave tagline:
... Sleep? I'm a SYSOP!
even though I have written on the back of the credit card in the signature space, 'Ask for ID'.
Fraud/corruption is clearly a cost of doing business, another line item, an overhead already accounted for.
Just goes to show you cannot trust anyone you meet online. They may not be who they claim to be.
Undetectable Steganography? Yep, there's an app fo
Replying to my own thread... FTA:
"One hacker who called himself Theunknown swore at Mularski, "You piece of crap fed... you're never going to catch me."
"Why don't you turn yourself in. It beats living the rest of your life on the run," Mularski wrote back. A week later, Theunknown followed his advice."
LOL!
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
That would be great because then George W. Bush could dance along....
Seth
$5 / month hosted VPS on linux = awesome!
So Agent Mularski got a taste of what it's like to be a SysAdmin? I think it's a good thing, now he would understand what it's like to work in IT, he'll (hopefully) be more sympathetic to IT staff that he works with... We should get more Law-Enforcement officers into undercover IT "busts"!!!
;)
Now, if he had a pager that would buzz him in the 6 hours he got "off" from the computer, that would be JUST like being a SysAdmin
A Man's ethical behavior should be based effectually on sympathy, education, and social ties -- Albert Einstein
If you can make 1,000 a day, tax free, working thirty hours a week. And if they throw you in prison, you can take some classes and write J# middleware when you get out.
The downside is the anal raping. For most people, I mean.
I usually give credit where credit is due
Ace! I'll take 10,000 blank American Express. Meet me by the disused warehouse down by the docks in three hours.
"Three eyes are better than one" -- Lieutenant Columbo
This is the guy that pissed off the Russian mob so much that they are now developing the new worm out there, and are intent on taking over ALL computers in the US. Great!
Nice list but they seem to be missing alien abductions and unexplained phenomena.