All of the "cybercrime" stock photos now just look like regular white-hats working in a post-COVID environment :)
It was meant as a joke. From the caption: "Yes, I realize hooded hacker stock photos have become a meme, but that’s the point."
Career Choice Tip: Cybercrime Is Mostly Boring
41–50 of 106 posts
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#42All of the "cybercrime" stock photos now just look like regular white-hats working in a post-COVID environment :)
I always liked the ones with the hacker wearing a ski mask.
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#43Earlier quoted context omitted.
Similar skillset, but as a pentester you need to be an expert in both offense and defense. So the cybercriminal side is much easier.
What do you mean by defense? Covering your tracks? In this case I'd argue it's the opposite - in pentesting the worst that can happen if you get spotted is a failed test, while in real crime this could be the difference between freedom and jail.
You are generally hire to fix problems which means you need to close the holes you find.
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#44Earlier quoted context omitted.
yeah but then all the authorities would have to do is go ask the people at Eve online what Bitcoin address was used to pay
No, you pay another player Bitcoin for ISK, and then sell the ISK to another player for USD
Eve knows the source of the ISK.
This is what these investigators do all day... track money as people try to move it around. They are good at their jobs
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#45Earlier quoted context omitted.
Still traceable. Authorities follow Bitcoin transactions and ask questions which points them right to you.
No, you give the other player the entire wallet, you don't actually do a transaction
Then the investigators go to that person, and they point them towards you.
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#46Earlier quoted context omitted.
What do you mean by defense? Covering your tracks? In this case I'd argue it's the opposite - in pentesting the worst that can happen if you get spotted is a failed test, while in real crime this could be the difference between freedom and jail.
You are generally hire to fix problems which means you need to close the holes you find.
I'm a pentester, you generally don't fix the issues you find so much as provide guidance and references on how it might be done. The defenders/app developers are in a much better position to fix most issues, they generally either weren't aware of that class of vulnerability or unaware of a specific method of exploiting the issue. Most web devs, if you tell them you found an XSS, would know what you meant and basic prevention, but maybe not the specific way you exploited it. But I don't go tweak their whitelist or implement better output encoding for them.
That said, you do have to know the defensive side well, even if you don't implement it yourself.
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#47Earlier quoted context omitted.
Bitcoin?
Can be traced. Monero is another option but I've heard it can be traced too. I certainly wouldn't bet my life on it. But in either case you still have to convert it into cash at some point.
Coinjoin and coinswap is quickly making the tracing very difficult.
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#48All of the "cybercrime" stock photos now just look like regular white-hats working in a post-COVID environment :)
I've noticed it before but never thought too deeply about it. Where did this 'stereotypical hacker' image stem from anyway? Computer 'nerds' are often cast with pressed button-up shirts, pocket protectors, and thick glasses. But if they are a 'bad nerd', they suddenly don a mysterious hoodie that covers their face as they work in a cave-like room like some kind of new-age techno-troglodyte?
They're symbolic, not realistic. The only reason they wear a black hoodie is because a striped black and white shirt with a black masquarade mask is because it's too silly.
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#49I am really glad that I took the cyber security 101 course in college and the professor beat the idea of it being interesting or exciting right out of me. Steered me clear of a less engaging path (for me at least).
Most corporate security is about compliance, audits, regulation and balancing the need for security with the needs of the (often stupid) users. Very little of it is actually tech. There is pentesting and malware analysis for the actual "tech" stuff but it is quite a small market to be honest.
>but it is quite a small market to be honest.
I get that impression too. I do some cybersecurity type stuff as a hobby and was hoping to make a business out of it somehow but it doesn't seem to be a easy market to crack.
Re: Career Choice Tip: Cybercrime Is Mostly Boring
#50Earlier quoted context omitted.
Can be traced. Monero is another option but I've heard it can be traced too. I certainly wouldn't bet my life on it. But in either case you still have to convert it into cash at some point.
Launder it through an MMO like EVE online
You're going to try to launder millions (maybe tens or hundreds of millions) of dollars through an MMO and think no one will notice? Good luck.