Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Career Choice Tip: Cybercrime Is Mostly Boring

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 106 posts

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#91

Post by RandomBacon »

bluedino wrote: post #89
RandomBacon wrote: post #81

Earlier quoted context omitted.

If your bank questions you for withdrawing $10,000 or more, I would use a different bank. I withdrew about $13,000 a few months ago, and my (national) credit union didn't hesitate or ask me anything (except for an additional piece of identification).

Do it again. They will flag your account and you will be filling out paperwork if you regularly make large cash transactions. Federal law.

That doesn't change anything about the comment I replied to or my comment though. I don't need to withdraw more cash, and I'm not going to do so based on a command from a random person.

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#92

Post by [deleted] »

raincom wrote: post #90
RandomBacon wrote: post #81

Earlier quoted context omitted.

If your bank questions you for withdrawing $10,000 or more, I would use a different bank. I withdrew about $13,000 a few months ago, and my (national) credit union didn't hesitate or ask me anything (except for an additional piece of identification).

Yes, they don't ask you any thing. However, banks/car dealerships/etc have to file CTRs(Currency Transaction reports). It is good that you withdrew $13K in one shot. Structured withdrawals (4k, one day, 5k three days later, another 4k ten days later) will be flagged by AML software of any financial institution. And folks in the compliance team will file SAR(Suspicious activity report). Lesson: when you legitimately n…

[deleted]

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#93

Post by RandomBacon »

raincom wrote: post #90
RandomBacon wrote: post #81

Earlier quoted context omitted.

If your bank questions you for withdrawing $10,000 or more, I would use a different bank. I withdrew about $13,000 a few months ago, and my (national) credit union didn't hesitate or ask me anything (except for an additional piece of identification).

Yes, they don't ask you any thing. However, banks/car dealerships/etc have to file CTRs(Currency Transaction reports). It is good that you withdrew $13K in one shot. Structured withdrawals (4k, one day, 5k three days later, another 4k ten days later) will be flagged by AML software of any financial institution. And folks in the compliance team will file SAR(Suspicious activity report). Lesson: when you legitimately n…

Thank you, it sounds like you have some insight about the process.

I'm aware of structuring, but I don't think most people are. I've heard about it only once in the news where a store owner had his money seized because he was trying to avoid depositing more than $10,000 at a time, over a long time period.

IIRC, this was the case: https://www.forbes.com/sites/instituteforjustice/2015/05/05/...

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#94

Post by RandomBacon »

dehrmann wrote: post #59
trade_unionist wrote: post #27

Earlier quoted context omitted.

Can be traced. Monero is another option but I've heard it can be traced too. I certainly wouldn't bet my life on it. But in either case you still have to convert it into cash at some point.

Not just that it can be traced, there's a long-lived distributed ledger of the transaction. In a way, it's one of the worst choices.

I agree that a long-lived distributed ledger is problematic. However it sounds like you're implying that Monero can currently be traced. If you have any links to any recent/relevant research, I'm interested in hearing about it. I'm not interested in speculation or rumors like the other comment wrote.

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#95

Post by [deleted] »

HashBasher wrote: post #47
trade_unionist wrote: post #27

Earlier quoted context omitted.

Can be traced. Monero is another option but I've heard it can be traced too. I certainly wouldn't bet my life on it. But in either case you still have to convert it into cash at some point.

Coinjoin and coinswap is quickly making the tracing very difficult.

[deleted]

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#96

Post by RandomBacon »

HashBasher wrote: post #47
trade_unionist wrote: post #27

Earlier quoted context omitted.

Can be traced. Monero is another option but I've heard it can be traced too. I certainly wouldn't bet my life on it. But in either case you still have to convert it into cash at some point.

Coinjoin and coinswap is quickly making the tracing very difficult.

Difficult ≠ impossible.

Chainalysis says that Coinjoin introduces taint: https://go.chainalysis.com/rs/503-FAP-074/images/Advanced-Ob...

I believe that if someone uses something that's private by default, then its okay. However if someone uses someyhing that isn't private by default, but goes through efforts to try to hide the source of the funds, then it's suspicious.

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#97

Post by bluedino »

Nextgrid wrote: post #37
HelloFellowDevs wrote: post #28

I am really glad that I took the cyber security 101 course in college and the professor beat the idea of it being interesting or exciting right out of me. Steered me clear of a less engaging path (for me at least).

Most corporate security is about compliance, audits, regulation and balancing the need for security with the needs of the (often stupid) users. Very little of it is actually tech. There is pentesting and malware analysis for the actual "tech" stuff but it is quite a small market to be honest.

Many cases you set up something like Alienvault or Cygilant and then it never gets looked at again...huge waste of time and $ in the name of compliance

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#98

Post by bluedino »

RandomBacon wrote: post #91
bluedino wrote: post #89

Earlier quoted context omitted.

Do it again. They will flag your account and you will be filling out paperwork if you regularly make large cash transactions. Federal law.

That doesn't change anything about the comment I replied to or my comment though. I don't need to withdraw more cash, and I'm not going to do so based on a command from a random person.

The point is if you were a "cyber criminal" doing it regularly, the FBI would eventually trace it back to organized crime and you'd get in trouble.

People make one-time withdrawls of large amounts of cash all the time.

Re: Career Choice Tip: Cybercrime Is Mostly Boring

#100

Post by blacksmith_tb »

Wowfunhappy wrote: post #84
trade_unionist wrote: post #25

The main problem with cyber crime for profit is you have to get the money at some point. So no matter what at some point you have to either trust someone (bad idea) or have the cahones to walk into a bank and withdraw the cash. Even then you to explain how you got the money if it's over like $10,000 or people start asking questions. Yeah dumb people will focus on hacking but once you think it through you see there is…

Doesn’t this apply to almost all types of crime? Dealing drugs, burglary, etc.

Presumably those 'analog' crimes tend to pay in cash (which you may not be able to bank, but at least flies below the radar if you don't). But your botnet haul needs to be converted from BTC to USD in a bank account, and then when you try to buy anything bigger than a pair of shoes it may catch the attention of the authorities.
Post reply on HN