Russian Reshipping Service 'Swat USA Drop' Exposed
krebsonsecurity.com
krebsonsecurity.com
I feel like there needs to be a financial literacy class in school that includes a unit on scams with many examples of how you can be scammed.
I never tried planning out a curriculum, but I think in addition recognizing scams, people should also be aware of options they can request/demand that would protect themselves, things a legitimate partner would agree to but scammers would refuse. For example, putting funds in escrow, or "Oh, you work at the Important Institution? Please tell me your office-extension and I'll call you back through their official phone number."
Other gaps that I would want to address if I were the Czar of Education include:
1. Debts, compounding, how bankruptcy works.
2. How contracts work, and what they don't do even if you've seen it in fiction.
3. Some basic tax stuff. (I've met adults-with-children who still think things like "I can't accept that raise, it'll put me into a higher tax bracket.")
4. What people can or can't usually sue each other for.
If talking purely about taxes and income without anything else in the context, you are correct. However, sometimes the logic you describe makes sense when it comes to government benefits.
Totally made-up example: imagine the government gives some sort of a benefit/assistance to people in certain circumstances (e.g., heavily subsidized childcare), but only if they are below a specific tax bracket, and if you cross that threshold, the benefit eligibility is gone entirely. So even though you technically still made more post-tax income if you crossed into that bracket, you might have lost more overall than you gained due to not getting that benefit/assistance (the one that requires you to be below a certain tax bracket) anymore.
0. https://www.consumerfinance.gov/paying-for-college/student-l...
For example, a former-worker, a software engineer in the Seattle area making way above welfare-levels. Perhaps he had always let his scientist-wife handle the finances before, I dunno.
Oh, absolutely. There are tons and tons of adults who don’t understand the concept of marginal tax rates and how those actually work, so they truly believe that getting into the next tax bracket makes the entire pre-tax income gets taxed at that rate.
The problem is that what you think of a "scam" is in a category of actions that businesses we consider legitimate use and those people have lobbying power over the state, which controls education. This isn't very different than how people are preyed upon by credit agencies, free trials, variable interest, etc which make up a good part of our business ecosystem. Essentially capitalist systems are about finding potential victims, and well, victimizing them.
Education programs like this are often criticized as liberal or "communist." What school administrator with a solid job and cushy state pension is going to risk the ire of the ruling monied class to potentially lose those things?
The people wondering why this and things like socialized medicine or minimum wage hikes are "taking so long" are really missing the forest for the trees here. These capitalist systems are ultimately anti-consumer and have narrow allowable cases for what is to be taught in state education. The US more so than most Western ones as it never developed a strong socialize tradition that lasted and its politics long captured by the "low regulation" monied class.
Look at the top reply to your comment, its someone saying "Well, if I was made czar of education, I'd do this and that!" If you said you were going to do those things, you'd never be made czar of education! A bit like if you said during a jury trial "I believe in jury nullification over non-violent crimes used against vulnerable populations often victimized by police dishonesty and brutality and caused by systems of oppression, poverty, racism etc," you'd never be made a juror. Anyone wanting to nullify, say non-violent drug offender charges in poor neighborhoods, will never be allowed to do so.
Nah, that's only specific countries that do so. America, and maybe... hmmm... that's it?
Plenty of other capitalist places exist, which have no problem with educating consumers.
2023 NYS Legislative Agenda: Require a personal financial literacy course in State high schools February 13, 2023
The City Bar supports legislation to require successful completion of a personal financial literacy course for all New York State high school students in order to graduate from high school in the state. Such a course should include, among other topics, instruction in automobile, homeowner/renters, health and life insurance, banking, borrowing, credit, and responsible retirement investing. Only a few of these topics are consistently taught in New York despite the fact they provide essential education needed in order to be productive individuals in a complex world. Without a required, separate course in personal financial literacy, virtually no high school graduates in New York will know, for example, that a standard homeowners insurance policy will not cover damage from flooding, or that a standard auto policy will not cover them if they have an accident while driving for Uber, or how to improve their credit score, or how to prudently borrow for college, or how to economically purchase or lease a car, or how to profitably save for retirement. Many internet-based educational tools already exist to comprehensively teach financial literacy, so it should not be onerous or expensive for educational leaders and stakeholders to vet and implement a personal financial literacy curriculum. We believe that as lawyers we have a responsibility to promote greater understanding by consumers of financial services, which a panoply of federal and state laws extensively regulate.
https://danbarber-12163.medium.com/defanging-authoritarianis...
This also reminds me of an interesting alternatvie high school in Russia I read about here on HN years ago:
https://www.euronews.com/2012/03/02/spotlight-on-russia
The New Humanitarian School in Moscow was one of the first private schools to open in Russia after the end of the Soviet era, and its teaching is radically different.
Vasily Bogin, the head teacher and founder of the New Humanitarian School, said: “We educate children in a broad sense. The education we give them includes developing their personal potential. A smart villain is worse than a stupid one. So it is primordial to make a good person first, and then a clever one.”
Lessons include “anti-manipulation classes” – interpreting hidden messages in the media. The aim is to make each child capable of independent thought.
Yeah, OpSec is hard, but come on.
Tangent: if I were to open my house free for all to come and go as they please, but a bunch of criminals kept coming over and sitting at the kitchen table keeping their illegal record of their crimes, and I let them use my mailbox to contact their people to coordinate the executions of fruad and likely some murders sprinkled in there, and they would sometimes bring over suitecases filled with illegal materials or even filing cabinets, and store them in the living room for a bit and then some other criminal would come and take them out....
at what point would I as the homeowner become an accomplice to all the crimes being ran out of my house? I'm going to say at some point in time I would no longer be a oblivious homeowner and I would start to be viewed as a criminal and I'd be getting charges of crimes hurled my way.
Now tell yourself the same story but instead of a house it's the Google product suite, sheets for the books, gmail for the comms, drive for the distribution of criminal data, etc.
Sure Google is just the oblivious homeowner for awhile, but if I could be charged with being an accomplice to crimes, or aiding and abetting, surely something should be pointed at Google, or any other company, who is providing services to probably a massive amount of people using those services to realize crimes, all around the world, day in and day out. You can't have shit like that happening in your house and not know that it's happening, and these products are free so they can mine the data from us using them, which makes the "I didn't know some mobsters were keeping book at my kitchen table" defense hard to say and expect people to believe you.
Not saying anything should happen, or that anything doesn't happen, I'm just pointing out that we don't really think about how often tech is used to commit crimes and I've never personally seen any news about the Feds going after Google for facilitating the back office of the criminal enterprise (maybe those Gov contracts Google does causes any LE to look the other way idk)
They're running a business, albeit an illicit one, and it's hard to run a business without spreadsheets. How else would they keep track of everything efficiently?
How they would run their business without spreadsheets is the same way that every business ran before spreadsheets existed. Or maybe if they didn't try to emulate legal businesses, who keep books for tax audit reasons, they wouldn't get caught. They are keeping audit records but the last thing they want is anyone to see those records. You don't need them the way legal businesses need them, the less paper trail the better.
Sure, you can get by without a computer, but you are already committing crimes, hoping to not get caught. Why make the paperwork even more onerous? If the Feds make you, your goose is probably already cooked.
>“drops test” services, contractors who will test the honesty of drops by sending them fake jewelry;
For all we know, those items sent to US-located “drops” (aka unaware victims and accessories to the crime) for shipping overseas were indeed bought with gift cards. That’s beside the point, the problems that those SWAT services are supposed address are explicitly related to shipping items (which were purchased with stolen credit cards, either directly or by using gift cards) to countries where most western merchants refuse to ship in the first place.
Gift cards won’t even be needed here, since the only person who can get pinned for this is the US-based “drop” who was unknowingly helping out the criminals.
The OP mentions that the main guy running the SWAT service makes roughly $100k/mo at most.
While it is certainly a lot of money, it isn’t even close to being “above the law.”
The OP says that the service has been operating under a bunch of different names for somewhere close to a decade. Even though they certainly were not making $100k/mo from the beginning, let’s make the most generous assumptions possible and do some napkin math of the upper bound. 10 years = 120 months, so 120*100k = $12mil. And that’s the upper bound.
That’s only a single order of magnitude more than what someone who bought a house in the US for about $600k a decade ago has in net worth (with the fairly realistic assumption that the value of it rose to at least $1mil), and there are tons and tons of those people.
I can almost guarantee you that he wasn't the big fish/the end of the trail. His entire operation is just a proxy hop, one of many.
$100k a month is an insane amount of money to me, and is more than enough to have power to buy people, lawyers, houses in countries that don't extradite or recognize the charges as crimes, and have people murdered. If you're not able to buy everyone around you with $100k every single month you're not even trying. I would assume anyway, who knows though lol
buy == bribe/put in your pocket (just so it's not confused with literally buying people, which you could also do with that kind of money I'm assuming)
Anyways, those kind of criminals live in places like Russia and they don't live in a vacuum. They exist because the government and organized crime allow them to exist. Like a cute pet that pays kickbacks. I can't imagine being this flashy with I'll-gotten gains without being secure in the knowledge that everyone important has been paid off: https://www.businessinsider.com/millionaire-russian-hackers-...
That is a lot of moving pieces and risk to take such little away in the end. Why not use the cards to buy crypto and pocket the whole $1100 with no complex network of goons taking half your money and getting heat sent your way? Or, with apps like cash app, venmo, fb payments, google payments, apple payments, hiding the source of a fraudulent transaction through a proxy of easy to create and throw away, bank accounts (those apps are bank accounts) has to be stupid easy. Hell, most of the time you don't have to do any ID verification on those apps if you stay below a certain amount and stay away from known scammers, and even then, fake IDs are better than ever. I'm willing to bet that fraud transactions below a certain amount won't even be looked in to, because the effort would cost more than the lost amount, and 1 billion is pocket change to these card companies, and the losses are either a write off, or federally insured anyway, so they aren't suffering. I bet they use that themselves to have money go missing so they can owe less taxes. People are stealing a made up thing and funneling it through nonsense to get back half of the made up thing, and we care for some reason.
The network described here is overly complex and I don't see the need, but I'm not a criminal network so idk why it is needed. Feels fake though
> EasyCreator is a developer tool.
> It tries to speed up the developing process of custom components, modules, plugins, libraries, templates, CLI- and Web Applications.
> You can create a 'frame' for your extension and an installable zip package with just a few 'clicks'.
https://github.com/elkuku/EasyCreator
https://extensions.joomla.org/extension/miscellaneous/develo...
For all I know the rest of the article will clear it all up for me or this has nothing to do with it at all.
> Anyone can sign up at this website as a potential reshipping mule, although doing so requires applicants to share a great deal of personal and financial information, as well as copies of an ID or passport matching the supplied name.
We really really need scam literacy education if that's your first reaction.
And you can claim that you've sent it away. (Of course, you should forward a few packages before that and, for bonus points, keep copies of a few labels to show the police so that you can pretend you're acting in good faith.)
Disclaimer: IANAL, not a legal advice
Ahhh shit, it's time for some early 2000's "Antitrust" style quick pans to CRTs with HTML tags wizzing by while discount Bill Gates talks in the background about how you're either a 1 or a 0, alive or dead, before Teddy comes to the revolutionary realization that "The answer's not in the box, it's in the band."
But in all seriousness, that screenshot shows a page clearly designed by a backend engineer so I find the suspicion of a "custom coding job" pretty funny. I've been out of the loop for a bit but I haven't seen anything make the rounds on HN about any criminal drop shipping saas graduating from a startup accelerator with a big ole seed round and a office in SF on the way. Of course all of their software is custom, in house stuff, or heavily adapted tooling, they can't really go and use salesforce now can they? And at the end of the day what does a "custom coding job" even mean, because trace any application that's ever existed and it was a custom coding job. And also I'm lol'ing because the article is trying to make viewing html on a "hunch" out like it's fucking Batman level detective work :)
Why were they doing all of this on the clear net out in the open? They are smart enough to have a super intricate network of mules and delivery people, custom written software, and even have what appears to be management sending memo's about corporate policy, yet they weren't smart enough to put this all behind a private VPN or throw it on the TOR network AND also behind a private vpn? It almost seems like they were trying to get caught, and wtf kind of name is that? I'm not convinced this isn't a false flag for something else or a spark to act on something. It has the grab bag of things needed to breed more hatred at random countries that we've been told since grade school to hate.
By custom coding job, I think he just means that the file is unique enough to be used to fingerprint sites created by the same entity. Tracking unique assets on a page to find similarities is a solid way to hunt for malicious related sites.
> yet they weren't smart enough to put this all behind a private VPN or throw it on the TOR network
The use of Tor would limit the pool of mules either due to technical limitations or tripping BS sensors. Also, it's the dumb ones that get caught first.
What a fun ending.