Slashdot Mirror
An FBI Agent's 3 Years Undercover With Identity Thieves
snydeq writes "InfoWorld offers the inside story of how FBI Supervisory Special Agent J. Keith Mularski, aka Master Splynter, penetrated and took over DarkMarket.ws, the infamous underground carding board hacked by Max Butler and later transformed by Mularski into an FBI sting operation. The three-year tour sent Mularski deeper into the world of online computer fraud than any FBI agent before, resulting in 59 arrests and preventing an estimated $70 million in bank fraud before the FBI pulled the plug on the operation in October."
How on earth are we supposed to believe it's the real Agent Mularski now?
Cool hacker name = geek culture reference + creative misspellings/capitalizations
Sample names:
Dark JedEYE
FeloniouS MonK
POPP3R SMRF
TERRORByTE
G\/\/B
I predict you will hear of these handles in future busts.
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
FYI man, alright. You could sit at home, and do like absolutely nothing, and your name goes through like 17 computers a day. 1984? Yeah right, man. That's a typo. Orwell is here now. He's livin' large. We have no names, man. No names. We are nameless!
HACK THE PLANET!
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
I had heard about this at a law enforcement/fraud analysis/intelligence analysis conference a while back. Basically, ALL the major sites were running in the open. Before all the crackdowns, I guess they thought the anonymity of the web meant they were untouchable. After the FBI cracked down on a bunch, they got wise and went underground.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Sure. But, given finite resources, should there not be some rational priorities set?
-Peter
From an article I read on Wired what seemed to have brought the downfall upon Butler was some of his associates got nabbed for trying to use stolen cards to buy expensive retail items and then fence them on Ebay for cash. Seems to me that old fashioned F**k-ups are the way these guys usually get taken down. Also from the article I read that corrupt retailers and waiters use portable card readers to steal all mag data on the card. How would you protect yourself against that kind of attack?
Namaste
As far as I know, the general idea was that the transactions would happen so quickly that even if someone was watching, the money would be long gone before anyone could track it. Keep in mind that these stories are published long after the arrest occurs, so by the time you learn about what happened, the criminals have moved deeper underground.
Palm trees and 8
You mean like at http://www.fbi.gov/quickfacts.htm ?
The FBI's jurisdiction is essentially being the nation's police force as opposed to your local city force. You can't say "ignore these sections of the state, county or city code" to a local police force just like you can't tell the FBI to ignore the U.S. Code.
Ruling certain kinds of crimes out-of-reach of the FBI simply due to resource-constraints is equivalent to encouraging the said crimes.
Crimes like peaceful protesting, you mean?
All crimes or suspected crimes deserve thorough investigation. Ruling certain kinds of crimes out-of-reach of the FBI simply due to resource-constraints is equivalent to encouraging the said crimes.
Right. Because the FBI is out investigating every single federal crime within their jurisdiction, right?
No. Because the FBI does have limited resources, cases not specifically brought to their attention by promising, credible leads -- or at least serious media attention -- don't get investigated. Those with credible leads that may not look so promising might sit on the backburner -- often for months or years.
While the FBI does investigate people who turn out to not have been criminals, that's more the exception than the rule.
My blog
The FBI does have certain, specific areas of jurisdiction. Ever read the FBI website? They say with specificity what their areas of jurisdiction and current criminal priorities are.
My blog
He probably wants a new assignment that involves less time at a computer. Did you RTFA? He was spending 18 hours a day on his computer, and was online every day of the week. His relationship with his wife was strained because he had to be available on his computer as often as possible to avoid suspicion and to keep his credibility up. He had to report his vacations to the people he was trying to bust weeks ahead of time, to keep up that reputation. To me, that sounds like the sort of assignment that you only participate in once, if only to keep your heart healthy.
Palm trees and 8
Buy things at small retailers unlikely to have complicated security policies or good video surveillance. Use local criminals to do the deal for you, promising a cut if they are successful getting the item out of the store. Keep the purchases under $2,000.00
Sell those things for cash on the street. Don't sell in the same area that you bought the items. Stick to big cities, as the police have way more to deal with than small-time theft. Once you get a big enough stash, use it to start a cash friendly business or find a way to get it to a trusted party in the third world and do the same thing.
The object is to not piss one person off to the point where they dedicate themselves to finding you. As long as the victim has the credit card company to turn to for a refund, and the police don't think the fraud is connected, no one will even bother opening up a case number.
I'm still wondering why the various banks don't offer reloadable cards for their customers. Why wander around with your ENTIRE credit limit in your wallet?
And for debit cards, your ENTIRE checking account balance.
Instead, allow the user to transfer the amount that he thinks he will need to a secondary card. That way, if anything compromises that card, the MOST they can get is whatever he put on that card.
As for online purchases, how about one-use card numbers? Just go to the bank site, put in how much you want to pay and the bank will give you a one use number for that amount. Then the maximum you lose if the online site is fake is that specific amount. They never get the real numbers to your real accounts.
TECHNICALLY, under YOUR agreement with Mastercard, Visa, or Amex, NOT signing your card with your signature is a breach of your cardholder agreement. In fact (though granted, in practice rarely), Visa requires merchants who come across an unsigned / ASK FOR ID card are supposed to not finish the transaction until the card is signed. If you refuse to sign, at least up until recently, the last time I looked at a merchant contract, they're meant to retain your card (uh oh, you do remember the clause in your cardholder agreement that states that the card remains the property of the issuer, not you, right?).
Not good advice.
If you can make 1,000 a day, tax free, working thirty hours a week. And if they throw you in prison, you can take some classes and write J# middleware when you get out.
The downside is the anal raping. For most people, I mean.
FBI does do some drug crimes I guess, but usually by accident. They're more into the "cool" crimes like Murder, Sex, and Cyber.
This post is so much entertaining (and possibly accurate) when read without context...