Site Aims To Be the "Google" of the Underweb

tsu doh nimh writes "A new service in the cyber underground aims to be the Google search of underground Web sites, connecting buyers to a vast sea of shops that offer an array of dodgy goods and services, from stolen credit card numbers to identity information and anonymity tools. From the story: 'A glut of data breaches and stolen card numbers has spawned dozens of stores that sell the information. The trouble is that each shop requires users to create accounts and sign in before they can search for cards. Enter MegaSearch, which lets potential buyers discover which fraud shops hold the cards they're looking for without having to first create accounts at each store.'"

Comments

"Underweb"

[bonch]

"Cyber underground," ooh, scary. Clearly, the author of this article has never visited any onion indexing sites. Seriously though, f this is a publicly accessible web server, and the creator is working directly with fraud shops, it seems like it's only a matter of time before authorities find a way to catch him. Even just by arresting one of the shop owners who might flip.

Re:"Underweb"

[stanlyb]

unless they are operating under the cover of TOR....

Re:"Underweb"

[bonch]

Well, the site is publicly accessible at http://megasearch.cc./ The guy even has his Jabber contact up. It's actually kind of suspicious and makes me wonder if it's all a joke or honeypot.

Re:"Underweb"

[Zamphatta]

I thought the whole thing screams "honeypot". I doubt any of the experiences bad guys will fall for this... which means they'll catch a lot of newbies and people who otherwise wouldn't have tried this line of "work". I wonder if they could get in trouble for entrapment? Hmm. Interesting. Although, I could be totally wrong, I'd still definitely avoid the place like the plague if I was looking to buy or sell there.

Re:"Underweb"

[mhajicek]

There's no such thing as "entrapment" any more.

Re:"Underweb"

[mug funky]

and the headlines would be full of "cyber gang busted" stories regardless.

if you can only catch small fish, you'll shout to the heavens just how many you got.

Re:"Underweb"

[q.kontinuum]

If this is a honeypot, lets create some tinyurl links and post them on e.g. Foxnews website or something to give them some bees :-)
(Disclaimer: This was a joke, not a real encouragement to do any dodgy stuff. If you can't tell the difference better stay out of the internet.)

Re:"Underweb"

[jez9999]

Fox news website? I thought you wanted to give them websites that WEREN'T connected to dodgy illegal activities.

I saw the fed!

[owenferguson]

Honeypot much? Nice try, guys. Way to debut it at the end of the humpday protest cycle.

Re:I saw the fed!

[msauve]

I, for one, am happy to see that some secret US government agency can not only do their job, but make a profit doing so. What a great idea for working both sides!

Ruining it for the rest of us.

[nitehawk214]

Sites like this are why the general public thinks that laws like SOPA are ok.

Or let me put it another way, if you are creating a search engine for it... it isn't underground.

Re:Ruining it for the rest of us.

[Anonymous Coward]

Awful convenient timing for something like this to be a big story eh?

I felt "left out" after reading about the glorious underground for about 5 seconds. Then I thought.... Who seeks that kind of shit out? nevermind

Re:Ruining it for the rest of us.

[hey!]

You know, that's actually an interesting point about SOPA.

What this guy is doing is illegal under the RICO act, The problem is mechanism: how exactly would you use RICO to shut him down?

Well, you'd start with an investigation. Unless the guy is a money laundering genius, you should be able to trace back from the infrastructure he uses (DNS, Internet access, server hosting) back to some kind of bank transaction that will reveal his identity.

So what happens when you run into a block like a DNS service that keeps domains' admin and technical contacts secret? That's one of the things SOPA is supposed to address. Well, you get a court order. It's not really that difficult. The modicum of difficulty a warrant presents is a good thing. It discourages draconian actions based on frivolous claims.

But what if the trail of evidence leads to another country? Then we're stuck.

Still, we don't need a massive expansion of government regulatory powers or an attempt to impose our laws over foreign territories to deal with that. What we *really* need is some kind of cyber-crime treaty. It'd work like this: Country A detects somebody in country B that is illegal in both countries. The authorities in A contact the authorities in B, and B agrees to pursue the matter, taking regulatory and criminal law actions to shut down any enterprise that *is illegal according to its own laws*. This preserves the due-process barrier to frivolous claims.

So what if B is not a signatory to the treaty? Then we *do* need to have a law which allows us to do some of the things outlined in SOPA, *subject to due process* and with a right of appeal.

Re:Ruining it for the rest of us.

[nitehawk214]

SOPA wont hurt organizations like this. If they cant fight him with standard laws, and they use SOPA to blast his site off the internet, it is trivial for him to emerge on a new domain at a new hosting site.

In the meantime all the other customers of the hosting site will be removed from the internet. Collateral damage abound hurts everyone except and the intended target escapes with only a minor inconvenience.

Granted I don't think Megasearch has any legal purposes, and they are qualifying themselves for an internet Darwin award by announcing their intent... but the government will for certain use this against sites and services that do have legal uses.

mywot.com and malwarebytes blocked it!

[Anonymous Coward]

Out of curiously, I tried to visit MegaSearch.cc.
1. My 1st block of the site: http://www.mywot.com/en/scorecard/megasearch.cc
2. My 2nd block of the site: My Malwarebytes stopped the site from loading.
I have no desire to visit this site but thought you guys may want to use my apps to help you keep out of trouble.
Just a thought...

Re:Honeypot Detected

[ColdWetDog]

The last Google of stolen credit cards was run by the FBI.

Can't trust anybody any more. That's the last time I ever give my credit card number to an FBI agent.

IT'S A CONSPIRACY

[Anonymous Coward]

Funny that this should surface NOW, right before SOPA is voted on.....I smell a conspiracy....Seriously we need another word for conspiracy, mere mention of the word and people think your stark raving mad.

Hmm

[MeatoBurrito]

Makes me miss astalavista

Re:Hmm

[dotancohen]

Makes me miss astalavista

Still there!
http://astalavista.box.sk/

Re:Honeypot Detected

[K. S. Kyosuke]

The last Google of stolen credit cards was run by the FBI.

Can't trust anybody any more. That's the last time I ever give my credit card number to an FBI agent.

You silly. You always have to give an FBI agent someone else's credit card number, that's obvious.

Othernets are a good idea now

[symbolset]

It doesn't look like these guys plan to give up. Eventually the furor will die down and these bastards will get their way. We can't shut down the Internet to protest every day. The idea is to have a tech solution ready before then. IPV6 should help. We have about 3 months to engineer a resilient, fault-tolerant congress-proof Othernet. Hopefully the Right People are all over this, and a solution will come in time to save us from the CNN'ification of the interwebs. I'm really not looking forward to getting my Internet through a VPN to Vanuatu. The ping times totally suck.

See who's searching for YOUR credit card number

[Anonymous Coward]

More importantly, now there's one place where you can enter your credit card number and see who all has been stealing it.

Here's what I'm getting from this article...

[brennanw]

... indentity theives have to create private accounts in cyber crime stores. o_O

When they're buying their batch of stolen credit card numbers, probably with another stolen credit card number, does the store then steal the stolen credit card number and start using it themselves? Which they might then add to the next batch of stolen credit card numbers... which the identity thief might then buy back the next time he buys a new batch of stolen credit card numbers...

... it's the cycle of crime!

Just like Google?

[CheerfulMacFanboy]

So they will collect all kind of info about you and sell it to their real customers.

Re:Honeypot Detected

[Kadagan AU]

The last Google of stolen credit cards was run by the FBI.

Can't trust anybody any more. That's the last time I ever give my credit card number to an FBI agent.

You silly. You always have to give an FBI agent someone else's credit card number, that's obvious.

I know of a search engine where you can find one to use!