Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IAmA a malware coder and botnet operator, AMA

reddit.com

Post reply on HN
Print view View original

41–50 of 203 posts

Re: IAmA a malware coder and botnet operator, AMA

#41

Post by white_devil »

diminish wrote: post #22
sakai wrote: post #3

Well, clearly this guy's moral compass is a bit out of whack, but the IAmA does offer some fascinating insights into this world...

yea, the world is a weird place. seeing a lot of angry ethical reactions on reddit, i can't help but think: on one side, there are people like this guy in the comments who left marketing a health product due to false claims, or me refusing to code for certain clients based on "personal" ethical judgments and on the other side there are these "crackers" who steal the credit cards of random people and who even hate the…

What is this I don't even..

It sounds like you're considering a life of crime. Probably thinking about how you could be like that botnet guy on Reddit. Getting money without working is a nice thought, after all.

You know, the "ethical reactions" stem from that guy doing evil things. He knows he's being evil but doesn't care. Some people find that appalling.

For him, it's just an easy way to make money, and the fact that he produces no value to society at large is irrelevant. He even gets to work on challenging problems!

In fact, what he's doing is quite similar to working for the financial industry, doing HFT or whatever. It's clearly wrong, and clearly harmful to mankind, but it's easy money, so ethics are thrown out the window.

It is generally easier to make money by scamming/abusing people than by doing something valuable. That doesn't mean you should.

Re: IAmA a malware coder and botnet operator, AMA

#43

Post by aneth »

mey wrote: post #32
citricsquid wrote: post #4

Most of what he says is obvious stuff and the emphasis he puts on how much he modifies stuff makes me assume he's someone that just runs programs and doesn't have any unique insight, but he does make one interesting point: > Try to use "Verified-By-Visa" and "Mastercard-Securecode" as rarely as possible. If only your CVV2 code is getting sniffed, you are not liable for any damage, because the code is physicly printed…

As someone in the financial payment industry, let me shed some light on it. 3DSecure (the generic name) when used, generally prevents the user from issuing chargebacks, even in the case of fraud. It's a Terms & Conditions change basically for that purchase. Since your credentials can be hijacked at your web browser level, it is possible to give up your credentials AND give up your ability to re-mediate the issue late…

I'm not familiar with this service. What is the advantage to the consumer in exchange for losing their fraud liability protection?

Re: IAmA a malware coder and botnet operator, AMA

#44

Post by eli »

bediger4000 wrote: post #38
16s wrote: post #13

Earlier quoted context omitted.

They can't store the CVV2 either. Doing so, even encrypted, violates PCI-DSS.

So, if you don't care about violating the terms of PCI-DSS, you can store the CVV2/CVC/whatever. I bet lots of places do. In fact, I worked for a Visa Level-1 merchant that had a card processing system that used an Oracle DB table as a queue for outgoing authorization requests. The table held the CVV2/CVC/whatever for as long as it took to get an authorization or a timeout, whichever came first. We passed the PCI aud…

How many failed CVV2 checks before your account is locked? Something tells me less than 500.

Re: IAmA a malware coder and botnet operator, AMA

#45

Post by dangrossman »

bediger4000 wrote: post #38
16s wrote: post #13

Earlier quoted context omitted.

They can't store the CVV2 either. Doing so, even encrypted, violates PCI-DSS.

So, if you don't care about violating the terms of PCI-DSS, you can store the CVV2/CVC/whatever. I bet lots of places do. In fact, I worked for a Visa Level-1 merchant that had a card processing system that used an Oracle DB table as a queue for outgoing authorization requests. The table held the CVV2/CVC/whatever for as long as it took to get an authorization or a timeout, whichever came first. We passed the PCI aud…

> Someone who really wanted to could get a CVV2 value in only 500 auth attempts on average.

That's going to trip a fraud check at the bank and get the card frozen long before 500 attempts.

Re: IAmA a malware coder and botnet operator, AMA

#46

Post by smackfu »

bediger4000 wrote: post #38
16s wrote: post #13

Earlier quoted context omitted.

They can't store the CVV2 either. Doing so, even encrypted, violates PCI-DSS.

So, if you don't care about violating the terms of PCI-DSS, you can store the CVV2/CVC/whatever. I bet lots of places do. In fact, I worked for a Visa Level-1 merchant that had a card processing system that used an Oracle DB table as a queue for outgoing authorization requests. The table held the CVV2/CVC/whatever for as long as it took to get an authorization or a timeout, whichever came first. We passed the PCI aud…

The point is that even if someone steals your order database with credit card numbers and expiration dates, they need to try every number 1000 times. That's a decent speedbump.

If you store CVV2 in your database against your merchant agreement, and someone steals it, I'm sure the credit card comp will come after you for the losses.

Re: IAmA a malware coder and botnet operator, AMA

#47

Post by danudey »

aneth wrote: post #43
mey wrote: post #32

Earlier quoted context omitted.

As someone in the financial payment industry, let me shed some light on it. 3DSecure (the generic name) when used, generally prevents the user from issuing chargebacks, even in the case of fraud. It's a Terms & Conditions change basically for that purchase. Since your credentials can be hijacked at your web browser level, it is possible to give up your credentials AND give up your ability to re-mediate the issue late…

I'm not familiar with this service. What is the advantage to the consumer in exchange for losing their fraud liability protection?

Nothing. This 'feature' is entirely designed to reduce the banks' liability. It shifts the onus of security onto you (from the banks and the merchants).

Re: IAmA a malware coder and botnet operator, AMA

#48

Post by azakai »

diminish wrote: post #29

Now, what has to be done not to get hacked ends up being answered as; AVs won't help, macs won't help, linux won't help, and use ipad? are we heading towards a world where average users will end up in managed computing behind walls, and only some hackers and crackers will use open computing? is computing doomed to be a the black and white world of tyrannic rule vs. mob rule?

> linux won't help

? He says Linux does help.

Re: IAmA a malware coder and botnet operator, AMA

#49

Post by leif »

citricsquid wrote: post #4

Most of what he says is obvious stuff and the emphasis he puts on how much he modifies stuff makes me assume he's someone that just runs programs and doesn't have any unique insight, but he does make one interesting point: > Try to use "Verified-By-Visa" and "Mastercard-Securecode" as rarely as possible. If only your CVV2 code is getting sniffed, you are not liable for any damage, because the code is physicly printed…

When a website asks me to use one of these, and I don't want to, how do I decline but still make the purchase? It always seems like my options are take-it-and-like-it or don't complete the transaction. Is there a third option?

Re: IAmA a malware coder and botnet operator, AMA

#50

Post by diminish »

azakai wrote: post #48
diminish wrote: post #29

Now, what has to be done not to get hacked ends up being answered as; AVs won't help, macs won't help, linux won't help, and use ipad? are we heading towards a world where average users will end up in managed computing behind walls, and only some hackers and crackers will use open computing? is computing doomed to be a the black and white world of tyrannic rule vs. mob rule?

> linux won't help ? He says Linux does help.

but he says, only because it is not much common, and different distros are too diverse to justify an "investment"
Post reply on HN