Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RaidForums gets raided, alleged admin arrested

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 197 posts

Re: RaidForums gets raided, alleged admin arrested

#71

Post by at-fates-hands »

db65edfc7996 wrote: post #49
meowface wrote: post #3

Earlier quoted context omitted.

Not to mention the following paragraph: >“In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the email address unrivalled@pm.me to email the agent,” the government’s affidavit states. Investigators found this same address was used to register rf.ws and raid.lol, which Omnipotent announced on the forum would serve as alternative domain names for RaidForums…

With all digital interactions recorded forever, it only takes a single idle mistake.

True.

I always feel like the people who are involved in these illegal forums would have better OpsSec. The fact the feds got all of his electronic devices and within a few hours had plenty of damning information is always kind of shocking to me.

I guess that's the difference between the real criminals who never get caught and others who get greedy or too lazy in covering their tracks.

Re: RaidForums gets raided, alleged admin arrested

#72

Post by tyingq »

meowface wrote: post #3
jacquesm wrote: post #2

"Coelho landed on the radar of U.S. authorities in June 2018, when he tried to enter the United States at the Hartsfield-Jackson International Airport in Atlanta. The government obtained a warrant to search the electronic devices Coelho had in his luggage and found text messages, files and emails showing he was the RaidForums administrator Omnipotent." Not really the sharpest knife in the drawer, to do things like th…

Not to mention the following paragraph: >“In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the email address unrivalled@pm.me to email the agent,” the government’s affidavit states. Investigators found this same address was used to register rf.ws and raid.lol, which Omnipotent announced on the forum would serve as alternative domain names for RaidForums…

>These people tend not to be the brightest.

Well, for those that are bright, you don't hear anything at all. So it's hard to characterize all of them.

I hear something similar on shows like Dateline about how not-bright the murderers are. Yet only about half of homicides are solved in the US every year.

Re: RaidForums gets raided, alleged admin arrested

#73

Post by ourmandave »

According to the DOJ, that early activity included ‘raiding‘...

— and ‘swatting,’ the practice of making false reports to public safety agencies of situations that would necessitate a significant, and immediate armed law enforcement response.”

If he did swatting they need to lock him up for attempted murder. People die from that "prank".

Re: RaidForums gets raided, alleged admin arrested

#74

Post by [deleted] »

jacquesm wrote: post #2

"Coelho landed on the radar of U.S. authorities in June 2018, when he tried to enter the United States at the Hartsfield-Jackson International Airport in Atlanta. The government obtained a warrant to search the electronic devices Coelho had in his luggage and found text messages, files and emails showing he was the RaidForums administrator Omnipotent." Not really the sharpest knife in the drawer, to do things like th…

[deleted]

Re: RaidForums gets raided, alleged admin arrested

#75

Post by RajT88 »

_moof wrote: post #43
RajT88 wrote: post #34

Earlier quoted context omitted.

I am always surprised at how often people who know each other randomly run into each other in an airport. I mean, what are the odds? I only had it happen once, but it was nuts. A guy from my previous company I ran into randomly in Frankfurt while I was on my way to India. He lives in California, I live in Chicago. We were on the same flight to Bangalore . Our trips had nothing to do with each other, other than we bot…

Hub-and-spoke routing + "it's not a small world, it's a small social class/industry/demographic/what-have-you" + the tendency for industries to cluster geographically. And what are the odds people meet in the first place? Those exact same factors are what make folks run into each other again later. It would actually be weird if you never ran into people you know. >…Bangalore. Our trips had nothing to do with each oth…

> Bangalore is a tech city, and you both worked in tech. That's how you ran into each other.

I'll throw you another curve ball:

He was working in the same complex, and we'd run into each other at lunch.

The project he was there for was one I would have been assigned to, if I hadn't left our previous company. (I was the #1 SME for that bit of software)

Therefore, I would have been the one sent there anyways that week, and been in that area. I actually confirmed this with my old boss.

Re: RaidForums gets raided, alleged admin arrested

#76

Post by PheonixPharts »

layer8 wrote: post #38
morsch wrote: post #36

Earlier quoted context omitted.

Seems like a variation of the birthday paradox.

Not exactly, because the scenario isn’t “any two people on the plane” but “me and another person on the plane”.

We can see the full paradox at work here. The parent clearly states:

> how often people who know each other randomly run into each other in an airport.

> I mean, what are the odds?

This is explicitly stating "any two people" (and it's at an airport not a plane, so more people). But then follows up with changing the framing of question they're asking:

> I only had it happen once, but it was nuts.

The birthday paradox is only a paradox because we tend to think of birthdays in a very personal manner. So when we think of "any two people sharing a birthday" we immediately change this to "someone having my birthday", without realizing we've fundamentally changes the question we're asking.

Re: RaidForums gets raided, alleged admin arrested

#77

Post by omegacharlie »

btown wrote: post #11
meowface wrote: post #3

Earlier quoted context omitted.

Not to mention the following paragraph: >“In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the email address unrivalled@pm.me to email the agent,” the government’s affidavit states. Investigators found this same address was used to register rf.ws and raid.lol, which Omnipotent announced on the forum would serve as alternative domain names for RaidForums…

I imagine a lot of people think that just because they've used a WHOIS anonymization service through their registrar, domain registration isn't traceable back to their account. On the contrary, registrars make this incredibly straightforward for law enforcement to do: for instance, see https://www.godaddy.com/legal/agreements/subpoena-policy . It's a remarkably silly way to get busted.

Some context for those that do not know. I believe some time ago raidforums.com was transferred from NameCheap to Cloudflare registrar (pre-seizure) and it was under data redaction with an address in the territory of Cyprus in Whois data. Some sort of attempt at P.O box or shell company voodoo is my guess.

With Cloudflare registrar I would not be surprised if they were a cooperating party in this case.

Re: RaidForums gets raided, alleged admin arrested

#78

Post by PheonixPharts »

meowface wrote: post #3
jacquesm wrote: post #2

"Coelho landed on the radar of U.S. authorities in June 2018, when he tried to enter the United States at the Hartsfield-Jackson International Airport in Atlanta. The government obtained a warrant to search the electronic devices Coelho had in his luggage and found text messages, files and emails showing he was the RaidForums administrator Omnipotent." Not really the sharpest knife in the drawer, to do things like th…

Not to mention the following paragraph: >“In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the email address unrivalled@pm.me to email the agent,” the government’s affidavit states. Investigators found this same address was used to register rf.ws and raid.lol, which Omnipotent announced on the forum would serve as alternative domain names for RaidForums…

> These people tend not to be the brightest. If they were, they'd generally find legitimate employment,

A bit of survivorship bias at work here.

Criminal activity is more so a function of risk tolerance than intelligence. However getting caught is certainly a function of intelligence.

So your impression is that most criminals you read about being apprehended are people that seem to make many stupid mistakes. But this stupidity is heavily correlated with being caught, not necessarily with being a criminal.

That said there's probably also a (negative) correlation between extreme tolerance for risk and intelligence.

Re: RaidForums gets raided, alleged admin arrested

#79

Post by doldols »

Teandw wrote: post #64
rosndo wrote: post #19

Earlier quoted context omitted.

This guy was under the impression that what he was doing wasn’t illegal. IANAL but the fact that he is being charged with access device fraud might suggest that DOJ had to engage in some mental gymnastics in order to charge this. E: I’ll take that back since I actually read the indictment now, besides the usual raidforums fare he was also selling credit card data which would very much tend to attract access device fr…

He knew what he was doing was illegal. You don't go through all the steps he did to stop authorities taking down the website without knowing what you're doing is illegal.

What steps were those? How are they distinguishable from the steps you would take to protect your website from being taken down because of abuse reports from upset people?

Trading in hacked data might not be illegal unless it’s credit card information, but your average hosting provider probably isn’t going to care about such nuances.

Re: RaidForums gets raided, alleged admin arrested

#80

Post by Firehawke »

tyingq wrote: post #72
meowface wrote: post #3

Earlier quoted context omitted.

Not to mention the following paragraph: >“In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the email address unrivalled@pm.me to email the agent,” the government’s affidavit states. Investigators found this same address was used to register rf.ws and raid.lol, which Omnipotent announced on the forum would serve as alternative domain names for RaidForums…

>These people tend not to be the brightest. Well, for those that are bright, you don't hear anything at all. So it's hard to characterize all of them. I hear something similar on shows like Dateline about how not-bright the murderers are. Yet only about half of homicides are solved in the US every year.

Yeah, absolutely this. There's a bias towards the low end of the skill/intelligence curve as those guys get caught doing really stupid shit and end up in the news as a result.

I was looking over Wikipedia articles on software piracy groups of the 1980s/90s the other day and it was really interesting how many of them died to either a blatantly stupid move on the part of one of their members/leadership resulting in the whole group dropping like dominoes, or a political split when the leadership could not agree on policy (especially during a leadership changeover)

It was particularly interesting to see at least one major group collapse due to leadership getting nailed on phreaking charges, which spilled over to the entire group getting nabbed on the piracy.

A few of the brightest in the scene got out when they found an opportune time, then disappeared. At least one or two of them are CEOs in big business, if the articles are to be believed. I bet one or more are reading this now, even!

Post reply on HN