Mariposa Botmasters Sought Real Jobs After Arrest

An anonymous reader writes "Two of the three Spanish men arrested in February for their alleged role in operating the massive Mariposa botnet later sought jobs at the Spanish security firm that previously had helped get them arrested. From Krebsonsecurity.com: 'Corrons, a technical director and blogger for Spanish security firm Panda Security, said he received a visit from the hackers on the morning of March 22. The two men, known by the online nicknames "Netkairo" and "Ostiator," were arrested in February by Spanish police for their alleged role in running the "Mariposa" botnet, a malware distribution platform that spread malicious software to more than 12 million Internet addresses from 190 countries (mariposa is Spanish for "butterfly"). Now, here the two Mariposa curators were at Panda's headquarters in Bilbao, their resumes in hand, practically begging for a job, Corrons said.' The story concludes with a brief response from Netkairo, who acknowledges seeking the job at Panda because he is broke now that his moneymaking machine has been dismantled."

Comments

Spain's unemployment is at 20%

[CRCulver]

When Spain has seen incredible joblessness recently, you can't blame people for being a little desparate in their jobhunting.

Kevin Mitnick

[Pharmboy]

What about Kevin Mitnick? He is making a living by switching his hat from black to white, and no one had a problem with that. It would seem that Panda might do better having a few people who know how to make malware so successfully. The question, of course, is "can you trust them?" and only they can answer that.

What did you expect the guys to do for jobs, flip burgers? Become stock brokers? Of course they would pursue careers in security. It seems they must know a fair amount about it to get away with so much, for so long. They certainly know more than someone coming straight from a CS degree.

Re:Kevin Mitnick

[MarkvW]

TFA makes the point that these crooks were using purchased code. This indicates that they aren't very sophisticated. Their market value would appear to be zilch.

Re:Kevin Mitnick

[Pharmboy]

Mitnick used social engineering, not reverse engineering, to gain access to networks. I don't think we have enough information to know what skillz they have or do not have. Either way, I don't *blame* them for trying to get into the security biz for a job. I didn't say I would be hiring them, just said it shouldn't be shocking that they are trying to enter a field they know at least something about.

Re:Kevin Mitnick

[Monkeedude1212]

I don't think I'd trust these guys in a security firm more than I'd trust a pickpocket with my wallet.

There are white hats and black hats. But also, there are grey hats, ones who will write malware and then turn around for a pretty penny to build security for it. Let's just say, I wouldn't give someone that opportunity, especially with their history.

Re:Kevin Mitnick

[jjohnson]

The question, of course, is "can you trust them?" and only they can answer that.

From the article:

When it became clear that Panda wasn't interested in hiring him, Netkairo changed his tune, Corrons said, claiming he had found vulnerabilities in the company's cloud anti-virus software and hinting that he planned to publish the information.

Clearly in these guy's case, you can't.

Re:Kevin Mitnick

[Anonymous Coward]

I had my share of run-ins with Kevin back in the days when he was actively hacking Netcom and the Well, and while it's true that he was skilled with social engineering he should also not be portrayed as a clueless script kiddie who lacked technical skills either. In fact I think his technical experience only served to strenghten his social engineering skills.

Now it was true that UNIX was not his forte, (at least that was my observation when I watched him hack into, and subsequently kicked him out of an IRIX box at John Hopkins University back in 1996 or so), but he was quite skilled with VMS and DEC systems, having the ability to write code -- at least I'm sure he could write DCL, but very likely C and other langauges. Also, it's known that he sought technical telco manuals to Pac*Bell provisioning and switching systems (e.g., he was known to have made off with tombs of COSMOS manuals in one instance.) Towards the endgame he was also known to be reverse engineering cell phones and improving his UNIX skills.

So comparing Kevin to these people is a bit apple and orangish. My 0.02.

If nobody gives them a second chance

[pegasustonans]

...Then a life of crime is all that awaits. It's easy to say you have high standards shutting potentially talented people out of your organization, but no one should be surprised if those people turn to illegitimate activities again.

Re:If nobody gives them a second chance

[jjohnson]

From the article:

When it became clear that Panda wasn't interested in hiring him, Netkairo changed his tune, Corrons said, claiming he had found vulnerabilities in the company's cloud anti-virus software and hinting that he planned to publish the information.

This is why you don't hire criminals, ex or otherwise. Pretty much by definition, they don't have normal social controls in their heads that make them worthwhile employees.

I can see Panda potentially using them as consultants of a sort, and very carefully maintaining an arms-length relationship with them that's clearly about paying them for specific analyses or something. But hire them as employees? It'd be like planting land mines under the office carpet.

Re:If nobody gives them a second chance

[crow_t_robot]

EXACTLY. This is exactly how Carl Gugasian began his 30-year career of bank robbery [ http://en.wikipedia.org/wiki/Carl_Gugasian ] He was told that he would never get a legitimate job because of a juvenile robbery offense so he went on to become, arguably, the world's greatest bank robber for 30 years. He ended up being caught due to a total fluke.

Re:If nobody gives them a second chance

[timholman]

...Then a life of crime is all that awaits. It's easy to say you have high standards shutting potentially talented people out of your organization, but no one should be surprised if those people turn to illegitimate activities again.

"Potentially talented"? One of the most common memes I keep hearing is that malware writers are programming geniuses who need only a guiding hand to become productive members of society.

I've met or worked with a lot of very sharp programmers over the years. All of them made a good salary from their skills. A few of them have made a significant amount of money. Any one of them would be capable of creating his own botnet without difficulty. Furthermore, many of them are sharp enough to pull off some impressive social engineering to gain access to systems, a la Kevin Mitnick.

But none of them did that, because they had the ethics to understand that subverting millions of other peoples' computers for your own financial gain is wrong. Not just illegal, but wrong.

If these botnet writers are so brilliant, where are the useful programs they have written? That's right, they don't exist. These guys are more likely marginally talented shmucks who have demonstrated an ability that hundreds of thousands of more talented programmers could easily replicate. All they lacked were the morals to do the right thing.

If these guys are actually good programmers who want to be productive members of society, let them prove it writing and marketing useful software on their own, instead of malware. But let them on my systems, or deal with my customers? Not in a million years. I can hire honest programmers for that.

Re:If nobody gives them a second chance

[causality]

This is why you don't hire criminals, ex or otherwise. Pretty much by definition, they don't have normal social controls in their heads that make them worthwhile employees.

The difference between criminals and average people is that the criminals believed that they had a payoff combined with a low chance of getting caught and/or they believe they have nothing to lose. Otherwise, most average non-criminals don't have much of an internal morality, set of ethical principles, or enlightened self-interest that guide their actions. What they have is a fear of consequence and the sense that they have a great deal to lose by going to jail. They're not trying to be particularly good or ethical or moral, so "decent" is a good description of them. This is, of course, a puerile concern for the self and not a concern for how one's actions may adversely impact others. If you have ever noticed how inconsiderate and oblivious most folks are, who drive/walk/shop as though other people don't exist and could not possibly be inconvenienced by their carelessness, this is part of it.

One explanation of such is Kohlberg's stages of moral development, if you feel like you need a more formal, psychology-based description to appreciate this observation. In a much more intuitive sense, it also reminds me of the quote from Aristotle: "I have gained this by philosophy; that I do without being commanded what others do only from fear of the law."

Re:If nobody gives them a second chance

[Lumpy]

There's a large number of people that have felonies for killing someone with their car that you exclude because they,"don't have normal social controls in their heads that make them worthwhile employees"

these people got nabbed doing what you do every day, you are just lucky you haven't killed someone yet. I'm betting you speed, talk on the cellphone, or have had your attention taken away from driving regularly.

So roll yourself into that nice big generic pool you have there.

There are some people that by bad luck or really stupid risks (talking on cellphone while driving) have gotten the short end of the stick. Making an informed decision on a case by case basis is probably a better move than your blanket dismissal.

Re:If nobody gives them a second chance

[elrous0]

There are always jobs available for ex-cons in carnival operations and commercial fishing.

Seriously, there are some ex-cons who turn their lives around and do deserve a second chance. For them, they face the tough road of taking crap work for several years until they can put some distance between themselves and their crime, and show that they've truly went straight (can take as long as ten years or more for many employers to recognize that you're clearly not a criminal anymore).

But it's been my experience that most criminals *remain* criminals (especially the serious ones), in or out of prison. Their brief periods of freedom are just interludes before the cops catch them for some new theft/robbery/drug deal/gang hit/etc. and send them right back in.

Re:If nobody gives them a second chance

[tool462]

The cynic in me wants to say that an honest person is someone who hasn't been caught lying yet.

Re:If nobody gives them a second chance

[timholman]

Maybe those were just smart enough to know that they will be caught eventually?

Frankly, I think you (and several others) are being overly cynical.

I've worked with a lot of engineering professionals in my career. What I have found is that the overwhelming majority of engineers have a strong moral / ethical compass. Most of them try to do the right thing, and do a good job. And in general, the higher the level of engineering competence, the stronger the moral compass.

Most engineers are not closet sociopaths. In fact, most of the truly intelligent people I've known, regardless of their political or religious leanings, understand that the world works best when people don't walk around looking for opportunities to screw the other guy. Compared to your average attorney, politician, or businessman, engineers tend to be saints by comparison.

This is not a black to white hat situation

[LockeOnLogic]

RTFA this isn't a situtation of some reformed skilled hacker seek a job. These are a bunch of script kiddies trying to weasle their way into a job by pretending to be like Kevin Mitnick. After being turned away several times (justifiably) they then decided to threaten to expose a security vunerability they claimed to have discovered in the companies software. They are black hats through and through.

Re:This is not a black to white hat situation

[SnarfQuest]

It would be like a jewlrey store hiring a known Kleptomaniac. If you cannot trust an employee, why hire them.

That's fine

[Sycraft-fu]

But there's a big difference between giving someone a second chance and giving them whatever job they want. These guys have already proven that they have some severe ethical problems. That can limit the roles in which a company is willing to let them work. As an example: Would you be ok with these guys working on the database that contains your credit card number, or bank account details? If not then perhaps you can understand why a company wouldn't want them in certain roles.

So while I'm not saying "Screw them, they should have to beg for food for life," I think they need to accept that they aren't going to be able to be computer security professionals, at least not for some time. Perhaps they need to look at careers away from computers entirely. However if they are staying in the computer field, they are probably going to have to look at jobs that don't involve access to much, maybe helpdesk type positions. Kinds sucks but that's life.

Trust isn't the kind of thing that you can just get back once you've destroyed it. It takes time to rebuild. They are going to need to spend time working honestly to show that indeed they have learned their lesson and can act in an ethical manner. They can't expect to get a job with access to potentially sensitive data straight off, even if their technical skills are top notch (and I question if that's the case).

Re:"Cojones"

[vegiVamp]

I do believe you mean "groans".

Actually, I HOPE you mean "groans".

Re:Someone has to cook the french fries.

[Anonymous Coward]

Let's see you survive on that salary.

A large number of people (myself included) have commited crimes out of desperation to survive when no other options were available due to circumstances outside of their control. Hell, the average American commits at LEAST 1 felony a day. That's enough to take your vote and arms away for LIFE.

Prison is an industry in America. Prisons are private corporations that will happily grease the palms of a judge to send more people to their prison. This has been demonstrated and publicized. Juries are TOLD with great rigidity how to interpret the law (basically telling them "you will vote guilty"). We put more people away than CHINA. A country KNOWN for human rights abuses. Granted, they have more capital offenses than we do and may execute more but over here, how can the prison charge the state $20/hr for the slave labor on the highways (with people throwing shit at them at 80mph) if the prisoner gets executed?

The oppressive fictional horror stories are real folks. There's just no barbed wire, the world's not in black and white with constant stormy skies or general widespread misery (yet at least). They've painted a pretty face on everything, they're all so cordial. Like Barack Obama, he just came across as such a nice guy. He is NOT your friend. And if you step out of line and try to take any action you're nothing more than a terrorist child molester. Get a few voices together and you have either a "terrorist/radical organization" or a "subversive movement". They have all but created a civilian equivalent of the Stasi by just creating an irrational overabundance of fear about what ever it is we're supposed to hate today. Drugs.... Terrorism.... Muslims.... The Constitution....

Hell, just by writing this I have most likely commited a felony in my state due to a lot of people talking about revolution on Slashdot and me participating in the discussion without registering as a subversive with the state. That's up to 10 years in SC. Theoretically, Slashdot should register in SC according to the law and if someone went insane at the state house here they could find a way to come after them or make them not respond to requests from SC ISP's.

Not all criminals are scumbags, a lot are but there's also a lot who are just unfortunate.

Re:Someone has to cook the french fries.

[interkin3tic]

Someone has to cook the french fries, after all.

In this case, given that tried to blackmail them after not being hired, yes. In general though, I'd say past criminal record is a terrible method of deciding who cooks the fries and who gets to move ahead. Some crimes anyway. Some corporate fraud, sure, force them to live under a bridge.