IAmA a malware coder and botnet operator, AMA • Hacker News Board

Re: IAmA a malware coder and botnet operator, AMA

#51

Post by sycr » Fri, May 11, 2012, 7:43 PM UTC

16s wrote: post #13

vibrunazo wrote: post #10

Earlier quoted context omitted.

Ooohh.. so that's why those websites ask for it. Learn something new every day :S

They can't store the CVV2 either. Doing so, even encrypted, violates PCI-DSS.

You'd be surprised how many vendors and merchants simply do not care. I was employed with an e-commerce vendor that indefinitely stored CVV2 in plaintext (among other numbers).

Re: IAmA a malware coder and botnet operator, AMA

#52

Post by netrus » Fri, May 11, 2012, 7:44 PM UTC

white_devil wrote: post #41

diminish wrote: post #22

Earlier quoted context omitted.

yea, the world is a weird place. seeing a lot of angry ethical reactions on reddit, i can't help but think: on one side, there are people like this guy in the comments who left marketing a health product due to false claims, or me refusing to code for certain clients based on "personal" ethical judgments and on the other side there are these "crackers" who steal the credit cards of random people and who even hate the…

What is this I don't even.. It sounds like you're considering a life of crime. Probably thinking about how you could be like that botnet guy on Reddit. Getting money without working is a nice thought, after all. You know, the "ethical reactions" stem from that guy doing evil things. He knows he's being evil but doesn't care. Some people find that appalling. For him, it's just an easy way to make money, and the fact t…

I do not claim to be a fan of HFT, but I wouldn't say it's on the same level as stealing CC data.

Re: IAmA a malware coder and botnet operator, AMA

#53

Post by intended » Fri, May 11, 2012, 7:44 PM UTC

white_devil wrote: post #41

diminish wrote: post #22

Earlier quoted context omitted.

yea, the world is a weird place. seeing a lot of angry ethical reactions on reddit, i can't help but think: on one side, there are people like this guy in the comments who left marketing a health product due to false claims, or me refusing to code for certain clients based on "personal" ethical judgments and on the other side there are these "crackers" who steal the credit cards of random people and who even hate the…

What is this I don't even.. It sounds like you're considering a life of crime. Probably thinking about how you could be like that botnet guy on Reddit. Getting money without working is a nice thought, after all. You know, the "ethical reactions" stem from that guy doing evil things. He knows he's being evil but doesn't care. Some people find that appalling. For him, it's just an easy way to make money, and the fact t…

Your point is well served without the analogy of heft and the financial industry being added. Matter of fact, I assume that it will likely be met with discussion that shifts the focus onto those examples which are irrelevant to the greater topic at hand.

There have been several in depth discussions and posts on both hacker news and reddit which comprehensively make the case for both.

Re: IAmA a malware coder and botnet operator, AMA

#54

Post by emilis_info » Fri, May 11, 2012, 7:47 PM UTC

corin_ wrote: post #14

mikemarotti wrote: post #6

The fact that this guy even posted an AMA shows that it's either entirely fake (doesn't seem it), or he's way too cocky. I suspect some trouble may be coming his way soon. He seems to think that he's infallible and that he won't catch a charge for running a botnet.

From what he says I agree that he seems either stupid or a liar, but I'm not sure about your premise, it's not hard to post an AMA that can't be linked to you.

Every bit of bragging about himself makes it easier to find him. He has disclosed this information so far:

* He tried to apply for a job at Kaspersky during last year. Didn't have enough credentials and still whines about it. * He hangs out on Anonymous IRC. * Uses Liberty Reserve. * Exchanges bitcoins to dollars (periodically I guess). * May be German-speaking. Understands Russian.

Re: IAmA a malware coder and botnet operator, AMA

#55

Post by intended » Fri, May 11, 2012, 7:47 PM UTC

Monotoko wrote: post #28

elorant wrote: post #5

I don't understand how these people sleep at night. The whole notion I didn't make the game I just play the ball is just hilarious. Furthermore those guys don't understand that eventually they're hurting the web. All that will bring stricter legislation and governments will start enforcing rules like IP identification for just about anyone out there. I can understand organized crime exploiting the cyberspace. But for…

They are just like petty criminals in real life, you've seen what surveillance and legislation does in real life... virtually nothing. The smarter ones go into the cracks and the shadows (Tor) which just leaves us folk being monitored for no reason, but we're okay with it because "it's helping to stop crime" There is also the addition that you are just interacting with a computer, a keyboard, a mouse and a screen. I…

Well, those speed bumps increase the fitness requirements for a short time of hackers. So it's not a total loss/ black-white picture.

Re: IAmA a malware coder and botnet operator, AMA

#56

Post by K2h » Fri, May 11, 2012, 7:48 PM UTC

I very much enjoyed the reading of his comments - I pulled a few of his that others may find interesting.

[polymorphism code - to hide virus signature]

Randomness is your friend, make your own crypter and make it so fucking random on every compile, that AV reverse engineers kill themselfs (HINT: randomize the crypters sourcecode using perl scripts)

[polymorphism code - to hide virus signature]

I started coding about a year ago, hacking old malware sourcecodes and reading russian boards. Most botnet operators are dumb as fuck, who don't even care about their traces, the ones you see on TV, catched by Microsoft and Brian Krebs. If you have more knowledge you can automatize nearly everything, like creating scripts that rewrite your sourcecode for your crypters so your malware gets undetected again, saving you hard work.

[finding infections on a computer]

Use GMER (http://www.gmer.net/) every now and then when your spider sense is tingling. Srsly, you can't fool GMER, it scans from the deepest possible point in your system, at ring0 and is impossible to fool, there is nothing deeper than ring0 on a usual PC where malware can hide stuff from. I always wondered why other AV vendors don't do it like GMER, it can detect all rootkits. But when a AV can detect everything, who will pay 30$ a year for signature updates...

Re: IAmA a malware coder and botnet operator, AMA

#57

Post by reidmain » Fri, May 11, 2012, 7:50 PM UTC

"Protip against driveby infections (the ones in the browsers): Disable addons in your browser and only activate the ones you need. Chromium and Chrome for example let you disable all additional content like flash, html5, pdf and java in the options, you will see a grey box instead of the content and can manually run it using right-click -> Run. Chrome options -> Content options -> Plug-Ins -> Disable all or Click-to-play. Chrome also allows you to whitelist sites you trust, like youtube. This will make you immune to driveby infections regardless of the version of your java or adobe reader, because you will only be able to click and run content, that is VISIBLE on the site. Malicious content is ALWAYS hidden in a 0pixel iframe! This also stops the nasty flash advertisements implying you can't aim precise enough to win an iPad3."

This is one thing I've been trying to convince people to do for ages but, for some reason, that one extra click turns so many people off. The extra minute or two I probably spend a day clicking on plugins to activate them will pale in comparison to how much time I'll have to spend recovering from being infected.

Re: IAmA a malware coder and botnet operator, AMA

#58

Post by raverbashing » Fri, May 11, 2012, 7:52 PM UTC

ajross wrote: post #8

JWhiteaker wrote: post #2

Magnetic stripes are the most hilarious thing ever, but still work almost everywhere on the globe. I am amazed that magnetic stripes are still the norm for credit cards in the US. Europe has managed to move all but completely to chip-based cards, but the US hasn't. Does the cost of fraud due to magnetic stripes outweigh the cost to upgrade the entire US system, or is the market just too fragmented to coordinate such…

Credit card fraud is actually a fairly small problem in the US. Wikipedia tells me that the total cost of fraud is 0.07% of the transaction value. And I suspect (without evidence) that the bulk of this is made up of remote purchases, not swiped activity. Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat. No, they're probably not actually wort…

"Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat"

Absolutely not!

In the US fraud may be small (but it's increasing). But magnetic stripes are very unsafe

Chip'n'Pin may have some issues, but it's much safer to most common attacks such as

- card stripers (very inconspicuous) - physical theft of the card (because it requires a pin)

And, as someone that had a striped card, it's a pain (even if liabilities are $0)

Re: IAmA a malware coder and botnet operator, AMA

#59

Post by azakai » Fri, May 11, 2012, 7:52 PM UTC

diminish wrote: post #50

azakai wrote: post #48

Earlier quoted context omitted.

> linux won't help ? He says Linux does help.

but he says, only because it is not much common, and different distros are too diverse to justify an "investment"

Yes, the reasons are not very impressive ones, but nonetheless.

Re: IAmA a malware coder and botnet operator, AMA

#60

Post by farnsworth » Fri, May 11, 2012, 7:53 PM UTC

simonsarris wrote: post #25

mikek wrote: post #21

Great nugget: > a US credit card costs 2$ on the black market and a UK starts at 60$, americans are all in debt.

Well this could be because US credit cards are magnetic and UK ones are (much more secure) chip-and-pin cards.

Yeah, this has got to be it. Non-US CC info seems much more difficult to acquire, and thus more valuable. And just because Americans are in debt (obviously not all) doesn't mean their credit cards are maxed out.