Slashdot Mirror
Meet Paunch: the Accused Author of the BlackHole Exploit Kit
tsu doh nimh writes "In early October, news leaked out of Russia that authorities there had arrested and charged the malware kingpin known as 'Paunch,' the alleged creator and distributor of the Blackhole exploit kit. Today, Russian police and computer security experts released additional details about this individual, revealing a much more vivid picture of the cybercrime underworld today. According to pictures of the guy published by Brian Krebs, if the Russian authorities are correct then his nickname is quite appropriate. Paunch allegedly made $50,000 a month selling his exploit kit, and worked with another guy to buy zero-day browser exploits. As of October 2013, the pair had budgeted $450,000 to purchase zero-days. From the story: 'The MVD estimates that Paunch and his gang earned more than 70 million rubles, or roughly USD $2.3 million. But this estimate is misleading because Blackhole was used as a means to perpetrate a vast array of cybercrimes. I would argue that Blackhole was perhaps the most important driving force behind an explosion of cyber fraud over the past three years. A majority of Paunchâ(TM)s customers were using the kit to grow botnets powered by Zeus and Citadel, banking Trojans that are typically used in cyberheists targeting consumers and small businesses.'"
his only fault was that he didn't incorporate in France and didn't have NSA as a client.
see, if you have offices and suits and your customers wear suits then the business is legit.
world was created 5 seconds before this post as it is.
You mean Eric Estrada was a malware kingpin?
I don't believe it!
A bullet may have your name on it, but artillery is addressed to " Whom It May concern"
Surely the kit would be "bought" once then distributed freely. It's not as if they're going to go to the BSA and whine about copyright infringement, is it?
Although nobody said cybercriminals were clever, I suppose. To be smart is to win while playing by the rules; to win by cheating just means you lack scruples, and anyone can do that.
"Hosts" file? What is a "Hosts" file? Did you make that shit up? You can't think we're all gullible enough to believe that browsers and computers work that way. Someone should take your imaginary computer away.
A 'gang' of folks would indicate a number equal to or greater than three, one could assume. The group as a whole has earned $2.3mil over their course of their enterprises. They could have done significantly better had they set up a legitimate business and sold their skills for positive use on the international market. I've never understood this about criminals. So many expense a tremendous amount more effort for less gain than they would if they had a legitimate enterprise.
APK is a well-known Slashdot nutter, and the regulars are more-or-less used to him by now.
Superior security is good, but in this case it's not why windows is affected and they aren't. BSD is the only one marginally secure.
The main reason it's not targeted is market share, low lying fruit gets picked up easier than orchard maintenance.
Goes to show what amoral shitstains these people are. He's made only a couple of million profit, by causing several orders of magnitude of damage in the process. A bit like those arseholes who steal copper cables off the train network, flog them for a few quid, but disrupt the commutes of thousands of people and rack up huge repair bills. In the animal kingdom, such entities are known as "parasites".
Some questions have to be asked about why it took the Russian Interior Ministry so long to track Paunch and his crew down. Given Putin's "power vertical" and his penchant for interfering in the Russian judiciary and wielding it as a weapon against his perceived enemies, you have to wonder what it was all in aid of -- and what Paunch did to get himself arrested. Maybe the bribes weren't big enough?
if the Russian authorities are correct then his nickname is quite appropriate
He's probably a bad guy, so let's make fat jokes about his photo in the summary. There's absolutely no chance we're humiliating someone innocent, right?
`Accursed' is missing an `r.'
I would argue that Blackhole was perhaps the most important driving force behind an explosion of cyber fraud over the past three years.
I would disagree and cite NSA's PRISM and FOXACID as a far more important driving force. Even if you disagree about the classification of their action as criminal violations of the US Constitution, consider that they purchase a large volume of zero-day exploits to fuel their "cyber" weapons. This makes selling zero-day exploits on the black market very profitable even if you ended all civilian perpetrated "cyber" assaults.
And when you hack a man, you're a criminal,
Hack many, and you're a terrorist,
Hack 'em all, you're a Government!
My apologizes to Megadeth.
In prison, probably for life.
Governments treat people who harm big business like mass murderers.
How about a link to just the hosts file?
For everyone who doesn't use windows.
Thanks
http://it.slashdot.org/comments.pl?sid=4531469&cid=45633071
* :)
(It's ALWAYS A PLEASURE seeing weak trolls continually make FOOLS of themselves, vs. the challenge in the link above that I put to them just to SEE THEM RUN FROM IT, yet again... lmao!)
APK
P.S.=> Of course (per my subject-line & challenge to the bogus technically unjustifiable downmodding trolls), they'll do their USUAL "Run, Forrest: RUN!!! vs. that challenge, lol - guaranteed (since it's IMPOSSIBLE to disprove the list of hosts files value in benefits to end-users of them, in added speed, security, reliability, & even anonymity (to an extent only on the latter))...
... apk
i am not against hackers, but those who publish "kits" for the wannabes should be killed. just my opinion.
You could use Wine. But I guess part of the tool's functionality is to manually cache the IP addresses hosts you access most, at the top of the file, so that the operating system's resolver doesn't have to do so much work.
A hosts file is a method of blacklisting hostnames of servers with which you desire not to communicate, such as malware-infested servers and the servers that host social recommendation ("like") widgets that track you and slow down page loads.
"Run, Forrest: RUN" -> http://it.slashdot.org/comments.pl?sid=4531469&cid=45633071 You FAIL & you KNOW it...
(Since all you have's invalid downmods, + YOU running from a FAIR CHALLENGE I put to you, & nothing more!)
Hilarious... + the ONLY THING you "regular trolls" are used to, is getting your asses kicked, by "yours truly"...
* Especially on hosts files!
(You unjustly & invalidly "down-modding" my last 2 posts beneath THIS discussion tree PROVES my point for me, with YOU supplying the proof of your failure via technically unjustifiable downmods applied to my posts, & YET you FAILED to meet my challenge to validly technically disprove my points on hosts as well - Thanks!).
APK
P.S.=> Man - It's just (& you're MAKING me just HAVE to say it) "too, Too, TOO EASY - just '2ez'" to blow you away with a challenge to you that you can't meet, every single time, to disprove my points on custom hosts files' efficacy in providing more speed, security, reliability, & even anonymity to end users of them...
... apk
Methinks we may need a general mechanism for identifying nutters that's hard to spoof, so that the folks who used to spend their days flaming innocent passers-by on usenet can't just migrate here.
This is probably an instance of a byzantine fault-tolerance problem, as solved by Barbara Liskov. As a bad example, consider displaying one of those little bi-coloured pills one uses for friends and foes, with the numbers voting shown in each side. ONLY if N people vote him "id10t" and N is at least one greater than 3 times the the people who vote him legit, mind you! Generally displaying reputation or friend/foes icons would just lead to flaming about reputations and scores.
--dave
davecb@spamcop.net
In my 1st posts' 2nd link (vs. Zeus/Citadel/IceIX) -> http://it.slashdot.org/comments.pl?sid=4531469&cid=45632541 it leads you to the source for said custom hosts file data vs. this!
* :)
(The custom hosts file data provided's (vs. the botnet in question mentioned here in the article on /.) from ZeusTracker - they're HIGHLY ESTEEMED & often used by the security community @ large...)
APK
P.S.=> Still - My program shown in that link from my 1st post, can do the same vs. ZEUS/Citadel/IceIX - & it also does the SAME vs. many other malwares/botnets (+ FAR more that's detrimental to users online also (whereas by way of comparison, that is only vs. ZEUS & its variants only))
... apk
Half the time, I wonder if that's really apk, or just a troll(s) with some apk inspired copypasta.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
Though I guess a Russian prison is a pretty severe punishment as-is.
As gmhowell did, stating he trolls apk http://it.slashdot.org/comments.pl?sid=4531469&cid=45638001
What entry do I put in my hosts file to block apk's spam?
It's funny seeing you trolls run from apk here though http://it.slashdot.org/comments.pl?sid=4531469&cid=45633071
You have confused 'run and hide' with 'don't give a shit'.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
Nobody's confused. Ya ran scared from apk's challenge to you, cowardly troll.
gmhowell = admitted troll http://slashdot.org/~gmhowell/journal/266768
gmhowell reveals his trollish motivations http://slashdot.org/~gmhowell/journal/266768