Slashdot Mirror
Confessed Botnet Master Is a Security Professional
An anonymous reader writes "John Schiefer, the Los Angeles security consultant who in last 2007 admitted wielding a 250,000-node botnet to steal bank passwords, sometimes from work, says he's spent the past 15 months working as a professional in the security scene while awaiting sentencing. Prosecutors are pushing for a five-year sentence, noting the exceptional threat he represented to society."
Congratulations on your purchase of a brand new nigger! If handled properly, your apeman will give years of valuable, if reluctant, service.
INSTALLING YOUR NIGGER.
You should install your nigger differently according to whether you have purchased the field or house model. Field niggers work best in a serial configuration, i.e. chained together. Chain your nigger to another nigger immediately after unpacking it, and don't even think about taking that chain off, ever. Many niggers start singing as soon as you put a chain on them. This habit can usually be thrashed out of them if nipped in the bud. House niggers work best as standalone units, but should be hobbled or hamstrung to prevent attempts at escape. At this stage, your nigger can also be given a name. Most owners use the same names over and over, since niggers become confused by too much data. Rufus, Rastus, Remus, Toby, Carslisle, Carlton, Hey-You!-Yes-you!, Yeller, Blackstar, and Sambo are all effective names for your new buck nigger. If your nigger is a ho, it should be called Latrelle, L'Tanya, or Jemima. Some owners call their nigger hoes Latrine for a joke. Pearl, Blossom, and Ivory are also righteous names for nigger hoes. These names go straight over your nigger's head, by the way.
CONFIGURING YOUR NIGGER
Owing to a design error, your nigger comes equipped with a tongue and vocal chords. Most niggers can master only a few basic human phrases with this apparatus - "muh dick" being the most popular. However, others make barking, yelping, yapping noises and appear to be in some pain, so you should probably call a vet and have him remove your nigger's tongue. Once de-tongued your nigger will be a lot happier - at least, you won't hear it complaining anywhere near as much. Niggers have nothing interesting to say, anyway. Many owners also castrate their niggers for health reasons (yours, mine, and that of women, not the nigger's). This is strongly recommended, and frankly, it's a mystery why this is not done on the boat
HOUSING YOUR NIGGER.
Your nigger can be accommodated in cages with stout iron bars. Make sure, however, that the bars are wide enough to push pieces of nigger food through. The rule of thumb is, four niggers per square yard of cage. So a fifteen foot by thirty foot nigger cage can accommodate two hundred niggers. You can site a nigger cage anywhere, even on soft ground. Don't worry about your nigger fashioning makeshift shovels out of odd pieces of wood and digging an escape tunnel under the bars of the cage. Niggers never invented the shovel before and they're not about to now. In any case, your nigger is certainly too lazy to attempt escape. As long as the free food holds out, your nigger is living better than it did in Africa, so it will stay put. Buck niggers and hoe niggers can be safely accommodated in the same cage, as bucks never attempt sex with black hoes.
FEEDING YOUR NIGGER.
Your Nigger likes fried chicken, corn bread, and watermelon. You should therefore give it none of these things because its lazy ass almost certainly doesn't deserve it. Instead, feed it on porridge with salt, and creek water. Your nigger will supplement its diet with whatever it finds in the fields, other niggers, etc. Experienced nigger owners sometimes push watermelon slices through the bars of the nigger cage at the end of the day as a treat, but only if all niggers have worked well and nothing has been stolen that day. Mike of the Old Ranch Plantation reports that this last one is a killer, since all niggers steal something almost every single day of their lives. He reports he doesn't have to spend much on free watermelon for his niggers as a result. You should never allow your nigger meal breaks while at work, since if it stops work for more than ten minutes it will need to be retrained. You would be surprised how long it takes to teach a nigger to pick cotton. You really would. Coffee beans? Don't ask. You have no idea.
MAKING YOUR NIGGER WORK.
Niggers are very, very averse to work of any kind. The nigger's most
He is one of those people who, in my opinion, qualifies for MUCH more harsh punishment. My opinions are on the far extreme though... not likely to happen, but it does call for a good old fashioned lynching.
"..spent the last 15 months working as a professional in the security scene.."
Doesn't ANYBODY bother proofreading these things before they're posted to the main page??!? This is a simple mistake, but let's face it folks, there have been GLARING errors before. A little professionalism, please? KTHXBYE
He should have worked in finance. There it's expected for you to loot the company safe and walk away with billions of dollars. Leaving a burning building behind you taxpayers footing the bill for cleaning it up is absolutely expected. Big career path mistake on his part. Perhaps while in prison he can study for his MBA and open a hedge fund on release.
"... who in last 2007 admitted ..."
Was there confusion on which 2007 was being referred to? "last 2007" as opposed to the next 2007?
Not everyone can create a botnet. There's some skill involved and you have to know details about vulnerabilities and how to exploit them.
Did you expect him to be a shoe salesman?
This is like that guy from the Gaming Control board that was cheating slots.
As opposed to the 2007 before that?
15 years seems like a long time to figure out the punishment for a guy after he's found guilty.
I read the internet for the articles.
What about the individuals who's computers were compromised by him? Are they not themselves partially culpable for his actions? Shouldn't people feel compelled to not let themselves become zombies?
While I'm not surprised that it was someone heavily involved in the field, as a future security professional myself, I'm rather ashamed that this man's greed won out over his ethics.
Their culprit would turn out to be a pimple-faced highschool kid dialing in with his VIC-Modem and Commodore 64, and then he'd maybe even get a drudging job offer. Nowadays the job offer part comes first.
...says he's spent the past 15 working as a professional in the security scene...
Oh my God! Only the past 15?!? I've already spent the past 120 perusing slashdot.
Hint: qualifiers matter.
This guy's the limit!
Riiight, because most victims of sexual abuse go and create botnets to steal bank passwords. Disingenuous much?
Oops... wrong guy.
There should be 250,000 litigants, one each for the number of botted machines out there filing suit against him in addition to being behind bars with his hands cuffed (can one type in cuffs? might be interesting).
This guy is a poster boy for how due process ought to work for computer criminals. The trust factor should be zero. This isn't a hero, this is a master thief.
---- Teach Peace. It's Cheaper Than War.
Needs to be clarified is that this is 15 months he spent waiting for punishment, not 15 years. And the lenient sentencing is because he ultimately did not cause much damage.
to make sure the grammar is correct and the submissions lack certain unpleasantries such as run-on sentences.
Please edit submissions that contain glaring grammatical errors.
"An American security consultant who stole hundreds of thousands of online bank passwords by employing a massive botnet that he often administered from work"
davecb5620@gmail.com
Is it just me, or does 5 years seem kinda low for someone who has infiltrated 250,000 computers and has been stealing bank account passwords??
This summary hurts my brain... last 2007 and the past 15? Really?
Two of my friends were gang-raped by botnets.
and for a moment was wondering how a confused botnet master could be a security professional...
My professional opinion is that Internet Explorer is a fast, reliable, and safe web browsing platform.
Also, make sure ActiveX is turned on. It's important for your safety.
Is he going to thank Microsoft for their invaluable assistance in his career and sentencing award? After all, without Microsoft's dodgy software he wouldn't be able to have done what he did. Maybe he could just throw a chair at the judge in a symbolic gesture of thanks to Steve Ballmer.
It should read,
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Bank passwords. Don't they teach people how to parse sentences any more?
While he's in prison, make him learn a new trade. Maybe by using one of those internet colleges. He couldn't cause trouble doing that.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
I think the surprise doesn't come from the fact it was a security guy, but the idea that someone like a lot of slashdotters is that capable of hurting others. Outside of the money and women, part of what we do as IT is helping and protecting people in the wild west that is networks. The fact a "good guy" could be bad is an extra sucker punch because a lot of folks here deep down probably wouldn't do that, and would have a tough time associating with the reasons why.
Idealistic, eh? Still, sucks when John Wayne saves the girl only to go rob the bank one town over.
-Matt
--- Need web hosting?
In other news, Confessed Botnet Victims are Windows Users.
That's the sound of 30,000 other security professionals simultaneously saying "no shit!"
spent the past 15 working as a professional in the security scene
Common CmdrTaco... Months...15 months....
I do not support "The Man". I also do not support your irrational stupidity
discover a security exploit and alert everyone: should get hero's reward
discover a security exploit and uses it, to harmless effect: should get thanks for discovery, a frown, and no reward
discover a security exploit and use it to, well, exploit: throw the book at him
unfortunately, it seems that all three classes of white, gray, and black hats get the same treatment
i'm not bringing the three classes up to argue leniency for the reprobate who made the botnet, i'm bringing up the fact that this guy is an example of someone who really should get punished severely, in contrast to gray and white hats who serve society and are unfortunately treated as the same class of criminal, when they are clearly not
this guy is the contrasting example of what a gray and white hat could have done with their knowledge, but chose not to. people need to be more aware of the valuable service gray and white hats provide
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I'm not grammar queen but come on CmdrTaco! This one hurt my brain cell. I think I lost one =)
The analogy just doesn't work. When you look at how someone becomes part of a botnet, it's often a Windows user choosing to execute something. It's social, not technical, not force.
The closes I can get to a rape analogy is that a woman seeks out a man, asks him for sex, does the deed, and then the next morning decides he wasn't the guy she was looking for. He was supposed to be a pretty screensaver, and instead turned out to be a spambot. There he is, in her bedroom, writing letters and taking stamps out of her desk.
The guy's an asshole, probably a con artist and maybe a thief, but he's not a rapist. It's just not in the same league of injustice.
"Believe me!" -- Donald Trump
The title should have been "Confessed Botnet Master is a Security Professional."
It's all fun and games till someone divides by 0. Then it's hilarious.
This comes from highly intelligent people not having an outlet for their intelligence. They guy is a painter that lives in a world where paint has been banned. Of COURSE he is a criminal.
The engineer in all of us is going to go "What caused this? how can we fix it?". I don't know. Part of me wants to blame the schools. From personal experience, I know that some of the things my friends and I did in high school were illegal. The school system hated us. We were all failing out of class and constantly arguing with the teachers. School wasn't giving any of us an opportunity to get out there and stretch our intellectual legs. Naturally we gravitated towards breaking into the computers at the school.
I think that a good majority of slashdot probably has had a similar experience to what I'm describing.
Most of us did exceptionally well on our college entrance exams (good enough to get accepted with our horrible grades, at least) and some (not all) of us even tried going to college. College was more of the same. Failing classes, teachers that hated us, and breaking into the computers...
It was like a drug. The real world was boring, plain, predictable. Computers offered us a sandbox to play in that had things in it that made us work.
It is the same phenomenon that gets people addicted to WOW; WOW allows people the social stimulation that they don't (generally) find in the real world.
NewslilySocial News. No lolcats allowed.
Well he's already on path for the 8th or 9th circle of hell.
8th Circle:
Bolgia 8: Fraudulent advisors are encased in individual flames.
9th Circle:
Round 2: Antenora is named for Antenor of Troy, who according to medieval tradition betrayed his city to the Greeks. Traitors to political entities, such as party, city, or country, are located here.
So prosecutors are asking for 5 years for stealing 1000's of bank details by a professional security consultant. Yet for that dastardly foreigner (MacKinnon) and complete amateur that embarrassed the military and did not steal or actually damage anything other than the US Government's pride with his dial-up modem - he is in line for 70 years. Is it just me or is there something wrong here?
...or maybe that will be his new career. They could use a man of his honesty in that field.
Is the the same guy whose linkedin profile is here:
http://www.linkedin.com/ppl/webprofile?action=vmi&id=12553940&authToken=bUKc&authType=name&trk=ppro_viewmore&lnk=vw_pprofile
I'd start using a middle name if I had the same first and last names and was employed in the same city as this guy.
Doesn't speak well for his employers' due diligence either....
NNed to join the
"Quit being a bitch and claim it," Schiefer told an juvenile apprentice named Adam, according to court documents.
How the tables turn. Now it's Schiefer who's going to be told, "You're my bitch now, I claimed it".
-[d]-
Are we expecting another 2007? One can surmise that he most certainly did not set this up in 2007 BCE. Or did he?!
I wonder just how many security "professionals" are actually ethically compromised. When there is a conflict between money and ethics, money usually wins.
Internet. If he had he'd be facing ten years and a half million dollar fine.
Thanks to eating disorders most chicks are reasonably good looking these days.
There's some skill involved and you have to know details about vulnerabilities and how to exploit them.
Indeed. Many moons ago (back in the early 1980s, when "IBM PCs" were still new and beginning to be affordable) I was a security consultant to a certain large technology company not far west of London. Part of my brief was to write aggressive self-replicating routines in an attempt to disrupt crackers' activities. Thus I might claim credit for a few of the earliest viruses, but that's not really my point, which is that in those days work like this was done in assembly code, and as such was reasonably challenging. I was quite proud of it for that reason.
I haven't kept up with this particular technology, but I gather viruses such as these are a lot easier to craft now, particularly since users don't typically notice small (or even large) drains on resources any more.
Regardless of whether or not one admires botmasters' motives (and I don't) crafting botnets on a large scale has a certain "cool" factor, since there is quite a lot of work, skill and even artistry involved in setting them up.
This comes from highly intelligent people not having an outlet for their intelligence.
Say *what*?
You're insulting all the smart people who found an outlet for their intelligence, especially those of us with spotty academic records who somehow managed to avoid turning into criminal bullies. Maybe it's not "society's fault" after all?
but simply their perspective is narrower and maybe even biased."
i will say without a doubt that they are flat out wrong
the issue here is the scantily clad woman getting raped, and the clueless computer user getting hacked: are they to blame for their plight? no, they are blameless
sure, if they dressed like prudes and they surfed from a tor proxy, they wouldn't be in the plights they are in. but that offers up no lessons on the issue of repsonsibility. you can cause something, but not be responsible for something. likewise you can be responsible for something, even though you didn't cause it
for example, if i call a guy an idiot on the internet, and the guy stabbed me, i caused the guy to stab me, but the guy who stabbed me is the responsible party, not me. he committed the transgressive crime. blaming me in any capacity is morally incoherent
to believe otherwise is to not believe in personal responsibility. responsibility for a situation always falls on they who commits the gravest transgression, according to any cohesive moral code. and simply wearing skimpy clothes, or being clueless about computers, is but a minor foible compared with rape or hacking
to not understand this about morality is to not understand much about morality at all
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Always two there are, a master and an apprentice.
"Their culprit would turn out to be a pimple-faced highschool kid dialing in with his VIC-Modem and Commodore 64, and then he'd maybe even get a drudging job offer. Nowadays the job offer part comes first."
In all likelihood, the culprit is a former pimple-faced highschool kid who used to dial into machines with his Commodore 64.
The crackers grew up. Some of them moved on, some of them didn't.
I'd rather have 250 virtual thefts than a single forced entry theft.
What this guy didn't do is cause extreme emotional stress that a normal burglary would. This guy needs minimal jail time if any, and then some public service. The guy isn't exactly stupid, put his talents to use.
John helps run awknet.com.
The funniest thing about this, is someone is going to jail and half of slashdot is calling to "burn him" for pushing buttons on a keyboard.
A kid somewhere in the world, sitting in front of a computer, pushing some keys on a keyboard. And now he's going to jail.
el oh el internets.
"John Schiefer, the Los Angeles security consultant who in last 2007 admitted wielding a 250,000-node botnet to steal bank passwords, sometimes from work, says he's spent the past 15 months working as a professional in the security scene while awaiting sentencing.
Even worse, I hear the submitter has been working the past 15 months as a professor of English language while awaiting sentencing for negligent grammarcide.
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
John Schiefer, the Los Angeles security consultant who, in 2007, admitted
I'll try anything once. Twice if it tastes good
From TFA:
From your comment:
In all seriousness, it's a really bad idea to suggest that being capable of something, or representing a threat, is enough to punish someone for. Yes, this guy has probably caused a lot of damage. Should we convict him on the "probably"? No. Get some real, hard evidence, then do something. Preferably, do something useful, like show him how much damage he caused, and introduce him to the people who's lives he messed up, rather than just taking revenge on him. People who do that (namely, most of the so-called justice system) are part of the problem that makes this a dog-eat-dog world, not part of the solution.
If I was relatively ignorant of security matters there's no way I'd let this guy anywhere near my systems. On the other hand, knowing what I know, this is exactly the guy I'd want for the job. I'd insist, of course, on detailed information about his actions, that I could audit myself if need be. I'd much rather have someone who knows what they're doing than some of these security outfits who are basically charlatans.
You've got your computer over there, and I've got my computer over here, and I have a looooonnnnggg series of tubes connecting my computer to your computer. Your computer has your bank account information in it, so through this long series of tubes, I go into your computer and take your bank account information...
"Pushing some keys" my foot.
you've never heard of a blade server?
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I am actually impressed he had a 250,000 strong botnet. Sure cracking bank passwords is bad, but not really. No one get's physically hurt, banks are insured, no guns, and no police chase after the getaway car. Someone steals your pin and withdrawals your account it's not like you are screwed for life. It's not like the money is even real or the bank can just undo the changes. Your money is numbers on a screen and sometimes paper representing numbers on a screen. I give this man credit for finding a safer way to rob banks. Saying the man deserves some kind of lynching or any other type of strange punishment is nuts.
Don't.
Be.
Stupid.
FLR
Not generally. When you see a run of the mill buffer-overflow-execute-anything-you-want exploit, it usually only takes changing values of a few variables to get it to deliver your payload vs. what the example was doing.
Well, you can arm a PoC Exploit and crack a few PCs that way. Then you have only access to the box. Typically this might get detected quite fast by AV vendors, so you better have to obfuscate that code some more.
So by then you have a working sploit but you are not somewhere near to a botnet. First, you need code that stays on the box meaning it should start itself when the machine gets booted up. And if you want to be successful you should not choose HKLM/local...entVersion/run/ but something more subtle. The easy way to go here would be another less known registry value but this means executing a process that can be seen and thus be dealt with in your task manager. So, ideally you inject a dll into another process. Now that already takes quite some knowledge.
Now you still do not have a botnet, still far from it but closer.
No, you need a mechanism to distribute that code. That could be using the armed PoC exploit, brute forcing shares in the net, infecting files, copying to other devices or inclusion in Zip files etc. or just emailing itself in a combination with social engineering techniques so the recipient will execute that malware of yours.
And writing your own SMTP engine in assembly might not be that easy anymore. But for the sake of the argument, let's say you want to exploit a Windows SMB vulnerability. Then you have to think about algorithms for finding an IP address in an effective manner. And you have to make sure that it does not spread to fast because then you create a lot of noise that will get peoples attention and you even might cause enough scanning/exploitation attempts to clog the very pipes you need to spread.
That having said, you will want to disturb the work of antivirus companies. That means you have to identify the net ranges used by these AV companies and design your spreaing algorythm in a way that excludes those ranges. Then you will want to block AV software on infected hosts from getting signature updates, so you have to identify those IPs/DNS names as well in order to block the hosts access to them. As you can enter your victims through an exploit you even have the chance to avoid AV detection as a whole which means that you have to cleverly hide your presence form the AV or you (try to) disable the AV software altogether without the user and the host OS noticing. Not so easy at all! And you want to avoid to be dissected all to fast, so will want to implement some more obfuscation: assembly level anti-debugging features, self written executable packers, maybe virtual machine detection etc.
Congratulations, you now have written a worm. Of course you better test it with various OSses, languages, releases and AV systems, right?
Now, you still do not have a botnet!
For a botnet, you need some command and control structures. You need to communicate with your victims. Now that makes you easily traceable, so you might want to make your botnet a double-fast flux peer-to-peer network. Easy, isn't it?
And then you just have to find a way so that the money you are trying to make off of that botnet does not get easily traced back to you.
But yes, I agree, all it needs is a script kiddie that can exchange some NOP and 0xEB 0xFE code with a working payload, right? As easy as winking.
Clearly that guy neither must have any real knowledge about IT security nor can he be intelligent or skilled in any way.
Which, BTW, does not mean that I do not condone this, in fact I do. But if you happen to have those skills and you probably have invested significant time into learning everything about it and you are being paid just a bit over minimum wage (e.g. because you were on parole or for some other reason) and you are told every second day that your skills are
He worked for banks, you can't get much more special than that. Windoze hell hole for sure. In jail, he will meet more honest criminals. Now for the obligatory bad joke.
In Soviet Amerika, banks call you threat to society.
We now return you to your regular program, where your retirement is worth 1/4th of what it was 8 years ago and you are soon to be fired like all the other worker bees.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
User maintains more than a dozen sockpuppet accounts on Slashdot.
How about making the punishment actually fit the crime? I've always thought the most just crime for theft is not prison, but as stated in the Bible, "if the thief be found, he shall restore double". Most importantly, the victim actually gets compensation for what was stolen, plus some for his trouble. This is a just compensation which actually benefits the victims of a crime. Far more so than locking the guy in jail, especially for a crime which is not imminently violent, is.
Your theory on the troll mod is total bullshit. Most of us IT security guys here have been modded "Troll" so many times that we haven't seen mod points for years, and will never see them again, despite "Excellent" karma. Like every other troll mod here, very special idiot moderators with unlimited mod points are probably to blame, along with other random idiots who just happened to have a few mod points now and then.
If you mod me down, I shall become more powerful than you could possibly imagine.
The real info about his case from the DOJ: http://www.usdoj.gov/criminal/cybercrime/schieferCharge.pdf
His sentencing has been postponed twice. Currently scheduled for sentencing on Feb 25, 2009.
Currently working as the only system and network administrator at an LA start up that is a search engine/social networking company. If you've ever watched or listened to Love Line, think Adam Corolla and his famous saying before they close the show and that's the place you may want to check your bank account if you use them, as they are heavily integrated with paypal too. I would use a different search engine at least until the fire they guy and secure their network. You may want to check your Amazon S3 as they use that service.
I don't know about you, but a guy like that should not be allowed to work in IT while awaiting sentencing or after sentencing. Also, the company he is working for, knows who he is and is choosing to keep him as the system admin. They believe he is reformed.
But the worst part of the whole thing, that company shares an office space with another company who has like 20+ employees and they all share the same network, and they have no idea he's in there! good luck to you people who share the office and network!
Actually, here's a fun thought:
1. The people in prisons score on the average over 20 on the antisocial personality disorder scale, which is to say you have a spectrum ranging from borderline sociopathic to outright psychopaths. A normal person scores 2-3.
2. There is no known way to turn a sociopath into a normal person. Trying to psychanalyze them just teaches them to fake the answers that will hide their callousness better.
3. Showing one the damage he's done and the people whose life he's destroyed... does nothing whatsoever, since a sociopath doesn't give a fuck about other people in the first place. They live in a single-player world, with them as the player and the rest being about as important or empathy-worthy as the NPCs in <insert MMO or RPG>. You can lie to them, manipulate them, cause all the harm you can get away with, whatever advances your quest or keeps you entertained. It doesn't matter, they're just NPCs. That's the kind of world a sociopath lives in. It includes even their own children, not just strangers who downloaded a virus.
4. They have a tendency to not have a sense of personal responsibility. They'll just shift the blame to someone else (e.g., the victim for being too stupid to download a virus) or rationalize it in any other way.
So, seriously, if you know some way to "undo" sociopathy, by all means, we'd all be very interested to hear it. But otherwise let's bury the retarded idiocy already that prisons should be some touchy feely school in respecting other people's feelings. These guys just can't do that.
The only thing they do understand is, basically, "let's not do something that will get me locked up for good". Well, some of them. Turning it all in just a slap on the wrist and some pouty "you've been a meanie and upset people" lesson will just remove that deterrent too.
A polar bear is a cartesian bear after a coordinate transform.
If you want to real story on his case just look up the DOJ release No. 08-043
Sentencing has been postponed twice, now scheduled for FEb 25, 2009.
Currently working as a system/network administrator for a Santa Monica startup, they are a search engine/social portal(hint: hawaiian word for thankyou). If your not using the usual google/yahoo/msn. be careful!