How does one get hired by a top cybercrime gang?
krebsonsecurity.com
krebsonsecurity.com
>"Multiple security experts quickly zeroed in on how investigators were able to retrieve the funds, which did not represent the total amount Colonial paid (~$4.4 million): The amount seized was roughly what a top DarkSide affiliate would have earned for scoring the initial malware infection that precipitated the ransomware incident."
I'm not quite sure what this implies? That the team who did the initial infection was in fact some sort of FBI undercover?
So undercover FBI successfully hacked colonial pipeline, ignited all this press coverage and attention, and quietly disappeared with the ransom amount? Am I interpreting that correctly?
I suppose that's one of the many possibilities that are implied, but its not even close to the most likely.
I think its more likely that some of the attackers' systems or accounts were compromised (AKA hacked).
Does it not sound weird that a cybercrime gang would leave a hot wallet on some random VPS? That seems incredibly unlikely.
It doesn’t take a _ton_ of technical proficiency to get ransomware someone else made and target a company with it.
This implies less technically inclined “affiliates” used the malware made by someone else, slipped up and had their 85% cut retrieved. Meanwhile, the creators of the ransomware took their 15% cut safely.
The idea of a full time 'career criminal' guy who works at it full time without another job seems less common than people seem to think.
That whole gangster rap testosterone street $900 shoe guy.
In college, I moved into a very cheap apartment. I had no idea, it was the worst part of Oakland. I saw some things that didn't make any sense. Some successful dealers had other opportunities. Most probally didn't. I was so naieve, I didn't know my roommate was selling until my second semester. I just though he had a lot of friends. He finally told me what he did one night over a video game.
Where is he now? He's in a midwest prison over dealing pot. Yes, dealing pot. Why? He heard Potheads pay triple for what Californian's pay. He got his brother to come along. I remember him telling his brother, "you don't want to be a Waiter for life?"
He, and his brother go to Ohio. They set up shop. They weren't violent, and didn't fit the stereotypes of a drug dealers.
Everything was fine until they hired this little rich white kid who thought he was in a NWA alternative reality. He was "slinging" their product in his vernacular.
Will this idiot killed a guy over a small amount of pot.
The cops were more interested in the "kingpin" behind the operation.
Well the kid squealed, and the prosecutor threw the book at my friend. They made him out to be Pablo Chicone. He was anything but a hard nosed killer. He never even owned a gun.
Well, he got a long sentence.
You say they weren't violent, but violence is not the only reason we incarcerate individuals. He broke the law, he knew it, he got caught, and now he's living with those consequences. I hope he learns a lot from this and decides to no longer break the law in the future. I hope others can read your story and decide that breaking the law is not worth it.
People are very cavalier with "non violent drug charges" as if dealing drugs is value neutral. It is not. There is societal harm to dealing drugs and I'm grateful for laws that forbid it and punish individuals that do it.
Homosexuality was illegal not so long ago, but it also harms no one and is approximately the business of only those directly involved.
And yet we used to persecute people for... what? Something we'd been conditioned to reflexively disagree with.
Shameful.
Marijuana is legal or decriminalised in most of the developed world, including the USA. It's widely accepted to be relatively harmless, much less harmful than alcohol.
This guy? He was an entrepreneur, just another person running a small business with a couple of employees. He didn't deserver a long jail sentence for someone else's fuck up.
Just because it's illegal doesn't mean it's wrong / just because it's legal doesn't mean it's rigth.
Criminals.
Btw we don't.
Most law breaking in entrepreneurship is usually finable misdemeanours. Like 99.99% of it. We don't call those people criminals.
And yes. Money talk. The less money one has the less chances to get justice.
The government seemed to just decide to enforce the law differently because computers were involved.
As an aside, Americans like to think they live in a bubble. Like their actions are independent from everyone else's and my bad decisions don't impact other people. This simply isn't true in a society where we all interact. There are laws preventing banks from loaning money at high interest rates - because it is bad for society. There are HOAs that maintain neighborhoods - because it is good for the neighborhood. We mandate health insurance (sort of). Amd we have laws regulating drugs.
We can disagree with how the laws are enforced - but we should not pretend that other people's actions have no impact on us.
People are allowed to be upset with how the law is unevenly applied.
Oh I hate those with all my guts. And no, they're not good for the neighborhood. They're good for destroying whatever little self respect and dignity people have left. I wish those control HOA freaks will go to /dev/null .
But there's another consideration that's in tension with that one. No one ever ascented to the laws that they're governed by. Yes, there are endless backs and forth in the philosophical literature on this point, but I think the strongest case that governments can justly impose restrictions without explicit consent is going to have to say that there are some kinds of restrictions that governments can impose, but some that they can't. Otherwise you're committed to saying that governments can justly enforce regimes of slavery and so on. The question is how much less evil than slavery do you have to get before governments can justly impose restrictions on their subjects.
You say that selling drugs is not value neutral. I agree. It's value-positive. Drug dealers are heroes: they put their lives and freedoms on the line to let others enjoy the cognitive liberty that their governments would deprive them of. The idea of cognitive liberty is that it is a human right to have the freedom to shape your conscious experience as you see fit. It's not presently recognized as a human right by any nation, but neither was freedom of thought some centuries ago, yet we don't recognize historical rulers as particularly respectful of human rights. The legal scholar Richard Glen Boire has spent his career elaborating and promoting this principle.
You're, I take it, concerned that drugs cause harm to the people who use them and the people near those who use them. Drugs definitely do have the potential to cause harm (although cannabis, the drug in question, is especially weak in its potential to cause harm). But the idea that people have about the harm of drugs is distorted in three main ways:
1. Prohibition makes drugs far more expensive than they would be without distortionary market policy. Much of the harm of drugs comes from people being driven into poverty by addiction. This is almost entirely a consequence of prohibition, and would be a much lesser problem under a regime that respected cognitive liberty.
2. There's selection bias in the stories that we hear about users of drugs. Due to the stigma and legal risks around drug use, people who are able to keep their drug use private choose to keep it private, and we get an exaggerated sample of people who end up in need of an intervention or on the streets as a result of their drug use. See the recent book Drug Use For Grown-Ups by Dr. Carl Hart for more on this.
3. The lack of drug education, and the belief — widespread even among users of drugs — that drug use is inherently self destructive, leads people to be far more reckless in their drug use than is necessary. Certainly there will always be people who are reckless with drugs, but we can do a lot better than having young people learn about drugs from their peers in contexts where it's uncool to be concerned with safety, and half the point of the activity is to signal disregard for authority and rules.
I'm not sure that respecting people's cognitive liberty wouldn't result in more people suffering at the hands of their own drug use, but I suspect that it would be fewer than most people imagine. And cognitive liberty is something that's valuable in itself.
He got his degree and then went into some marketing and sales gig for a decade is doing quite well and I believe continues to sell on the side to trusted clients so not a street dealer (saw him last year at a buddies wedding).
The very top does well, even very very well. Most everyone else scrapes by--if that.
Most professional jobs aren't like that. Sure senior execs can make an outsized amount of money but most of the rank and file are still doing OK.
All those other ones you mentioned rely on popularity to determine one's paycheck, which is why they are all pyramids.
Law isn't quite so stark. You don't have to be at a white shoe firm to do OK (corporate counsel, prosperous practice in a smaller city) but a lot of lawyers certainly make pretty modest salaries.
And lawyers are very bimodal. You have a ton of lawyers who make less than <$90K/yr, and then a whole bunch making >$200K/yr, and not a lot in between.
I assume at some point the job was mostly offshored? It's one of those things that I wonder if people overseas would do a better job even at the same price, if they saw it as a great job, as opposed to Americans who see it as a badge of failure.
Historically, law schools were also something that folks from even elite liberal arts colleges went to because they weren't sure what they wanted to do when they "grew up." I know a lot of folks with law degrees that maybe worked as associates for a few years but ended off going and doing something else related to politics or whatever.
Though I recall ~20 years ago that MLB players on league minimums (~70k/yr) were able to collect state unemployment benefits during the off season.
Presumably there in cities with "drug problems", there are also a steady stream of relatively young kids with limited options, and no desire to stay in school.
It looks like DOJ is trying to make an example out of some lowly frontend/freelance developer. Her work includes:
- creating a "web panel used to access victim data stored in a database"
- added a feature that "showed an infected computer or ‘bot’ status in different colors based on the colors of a traffic light"
- added a feature that "allowed other Trickbot Group members to know when their co-conspirators were working on a particular infected machine"
One thing DOJ accuses her of is "developing tools and protocols for the storage of credentials stolen and exfiltrated from victims infected by Trickbot." But its pretty obvious they don't know what "frontend developer" even means.
It does seem shitty that all the other suspects had their names redacted except her, she likely wasnt high level in the organization, so singling her out like this is shitty. If the other suspects are still under investigation, react all the names until they can be made public. But that's a legal, not technical, issue.
Second, your section "Her work includes" picks least harmful sounding sentences. And they still sound harmful enough.
They gave one example of how she got hired, but not a comprehensive list of every feature she made.
“Sorry, you admitted you drank a beer 6 months back. Try again in a couple of years and don’t drink!”
Literally the first two questions he asked me were: 1.) "You know what we do right? And you're ok with that?" 2.) "You don't do recreational drugs, do you?"
Many corporations sponsor open Source Projects that they rely on.
After the Anom App drug bust, organised crime should (in a rational world) become major "anonymous donors" to "Fully Secure" messaging to further their own ends.
Hated popups. Didn't take the job.
If the US really wants to get you, Russia, China, and North Korea (and maybe Cuba) are probably the only real safe havens.
If you are anywhere else, there is a chance that they can get you if they really want you.
The point still stands I think. Yes, it's not as flagrant as living in the US. But you'd think a person engaged in this kind of thing would feel reluctant to have a layover in a country that cooperates closely with US law enforcement let alone Miami.
Have you been to Russia?
Should she get a lighter sentence for being a woman?
Don't we all want equity in software development and elsewhere?
Until half of all criminal ransomware developers, and half the prison population, are women, it would seem we have a problem as a society.
This is actually a great step forward.
It reads instead to me as paternalistic and honestly verging into weirdly misogynistic. More a tone of How did this mere mother manage to get involved in crime?
It is interesting that they’re hiring based on job boards. I don’t know how normal gangs recruit but I’d guess it’s a lot of word of mouth. It seems when there are real honest alternatives out there for skilled labor, that you need to go to the public will also be an Achilles’ heel.
It’s probably natural for most folks on HN to consider “googling problems” an obvious, basic first solution - but I’m always stunned by how many people in real life, outside of the IT industry, don’t have that path in their brains well-trodden. For some reason, they’d rather flail around or ask a real human (often me) for help, rather than type a couple words into a search bar and see what happens.
I wonder if there’s an opportunity to teach a “how to search” class in schools. You could have some fun open-Google exams!
I assume when most people here on HN run into a problem, their first thought isn’t, “who can I ask?” but instead, “how can I figure it out?” because most hacker types are naturally curious and relish an opportunity to learn something new.
In my experience most people who zero interest in learning something new when they encounter something they don’t know.
Is this really so? With respect, this take seems too cynical to me. I say this as a person to whom many come when they can't figure things out.
I often initially feel much like you do, but I temper that feeling with the knowledge that the asker is likely under delivery pressure, etc and has to subvert their curiosity in order to maintain velocity.
Yes, sometimes people will simply take the expedient option, but I often get the feeling they never even tried on their own, like even a little bit.
Coming from IT, in the industry, even questions about software (very specialized, to be honest) get useless results.
I think the openess of information in software is the exception, not the norm, though many fields like science are making improvements.
Eventually, as my knowledge of the field increased I learned the "pro" terminology for certain objects and processes, which improved my ability to search useful info. I also discovered through chance or personal recommendation some very useful pro-level online sources, which don't have a large presence on search engines. There was a long grind of several years before I got to the point where I could search online for machining information and solutions online with confidence that I could find useful results and assess their reliability. Even then, there is a lot that I need to find in books/manuals or in conversation with experts.
While this is a process that takes place when learning about any technical topic, in my experience its easier in programming (and to a lesser degree general IT topics) than in fields that exist primarily in the world of physical objects. IMO, this has something to do with the tendency of programming problems to "self-define" themselves in specific textual language (I.E. compiler errors you can copy and paste into google) and also with origins and focuses of the largest internet knowledge bases.
For many people, they are used to learning from other people instead of from search results. So it makes sense that their first instinct is to reach for asking those around them.
* A trivial technological problem that leaves my family helpless though it's literally the first hit on Google
* A critical life-impacting issue, usually health but sometimes things like taxes or mortgage or household maintenance - things where trustworthy experts exist and are readily available here - and they go to random sketchy Facebook groups and get random advice from random people (frequently involving Crystals or essential oils but I digress into whole other rant :P )
This becomes a problem when the personal network is made of people who rely on hearsay, and signals-of-belonging instead of evidence-based information.
It's also a problem when "official" experts aren't truly expert, for various possible reasons - including corruption, incompetence, deliberate bad faith, and others.
It's hard for people who think in one way to understand that others don't think in the same ways.
We did this in a public middle school around 2002-2003 with boolean searches. Was this unique to my experience or has this been a common thing for awhile?
When I was briefly in sales before becoming a developer, I had a co-worker who, for the life of her, could not remember how to do a soft-line break in MS Word. She literally would ask me at least once a day. I finally just printed the keystroke (shift + return) on a sheet of paper and when she would peer over the cube, I'd just hold it up and she'd sit down again.
Even in our sales group, the majority knew to use Google to get answers to all kinds of technical questions. But you're right, there's still a big group of people who are unaware or too lazy to go there first.
For everything else, my brain takes some time to make that leap.
I had something similar to that when I was in elementary school, including comparing results across search engines. Boolean searches plus Smart Selection of keywords would quickly lead you to good sources.
Sometime between when I graduated high school and 2016, most of those tricks stopped working reliably. Google, Bing, and DDG are the only games in town for the anglophone world and all three drown out the worthwhile results in reposted blog spam. Until you magically discover the shibboleth that directs you to actual information, you’re stuck in a hell of shitty how-to websites that have nearly-identical irrelevant information.
It’s less hassle and more accurate (though slower and possibly outdated) to directly ask a known local expert.
- comparing different search engines (to google, mostly)
- seeing if you can find patent numbers, etc.
- and the best, I mix up a bunch of "real" and "fake" sites
(e.g., the Carbon Monoxide awareness site and then the Dihydrogen Monoxide site, and giggle as they critique that the second one needs a better web designer and needs to be more professional...)
There's a ton of information now and it's not always intuitive to understand what information you should value and when.
Not as much as SEO "how to break search" opportunities.
My parents, in-laws, etc... they all say on a pretty regular basis that they have trouble finding what they're searching for. Google tries really hard to return relevant results (which actually annoys me because I really, really, really want it to search for exactly what I typed - by default.)
Until you come across people who can't even do that.
I'm unsure of your age, but I was a developer before Google was a thing, and researching your answer, using Gopher, Usenet, and/or books was very much how we solved problems.
Honorable mention: talking to that Old-office-coffee-stained-teeth-sys-admin-who-probably-forgot-more-about-computers-than-I-ever-knew.
It’s as meaningless a statement as “I know how to read books so I can learn new skills.”
The idea that you run into a problem and use
Google to solve it hardly constitutes skill development.
For example, I don't know anything about flowers.
Sometimes I see a flower that I'd like to identify, but I can't really Google it -- aside from color and perhaps the number of petals I'd have no idea what terms I'd use to describe a flower and therefore what I might possibly type into Google.
(note: This is just an example. Never really tried to identify a flower w/ Google. Perhaps I could use Google image search, etc.)
Honestly I prefer searching the latter way and would love to know which search operators still work these days.
However we're not talking about a domain she knows zero about. We're talking about her building web pages. I'm guessing she's not suggesting that you could throw at her 'build a new OS kernel that brings cryptographic signatures as a base primitive for all operations'. So the reality is she'll be able to Google for n+1 things, not n+1000.
Either way, my point is n+1 Googling isn't the same thing as learning a new skill. It's expanding your knowledge right at the periphery of what you understand.
Googling isn't the same thing as learning a new skill.
Of course, there are exceptions. For example if you have somebody else's expertise on tap (in book form, or they're teaching a a class, or they're your best friend, etc) then no need for search-fu.
I remember reading how even cartels hire people through normal job listings. IIRC, there was some sordid article regarding this, where the cartels will list out jobs for "security" jobs, think regular security guard work, event security detailing, etc.
They'd then drive out the candidates to some remote and closed-off training site, push them hard, and just kill anyone that didn't make the cut.
What does, according to you?
Skill development is something that takes a lot of time and practice.
None of that is to say that stack overflow isn't useful, or that I won't learn things when I run into a problem by reading a blog entry. But to me that isn't the same thing as learning a new skill, unless that skill is so small and shallow that a single blog entry is all of the knowledge you'd ever need.
Being able to search is a legitimate skill that relatively few have too. We will probably disagree a bunch here, I can't be fluffed to have that to and fro -- so I downvoted and moved on
I also didn’t say that searching itself isn’t a skill. Of course it is. I’m saying that advertising you know how to Google doesn’t mean you can acquire any new skill, which is what the bio implied.
It's much like Blackbox testing you know.
For what it's worth because I replied my downvote was nullified