Live data from Hacker News

How we uncovered the identity of popular spyware makers

medium.com

11–20 of 31 posts

Re: How we uncovered the identity of popular spyware makers

#11
post #5

> The UK address. 145-157 St John Street, London, EC1V 4PY. According to a BBC report, this is the address used by a company which sells its use as a registered office address. Because there does not seem to be an obligation to check that users of the service are legitimate companies, criminals are attracted to it. According to the BBC, the address is in common use among fake companies operating "boiler room" fake sh…

Would you recommend another formation agent instead?

Re: How we uncovered the identity of popular spyware makers

#12
post #5

> The UK address. 145-157 St John Street, London, EC1V 4PY. According to a BBC report, this is the address used by a company which sells its use as a registered office address. Because there does not seem to be an obligation to check that users of the service are legitimate companies, criminals are attracted to it. According to the BBC, the address is in common use among fake companies operating "boiler room" fake sh…

Would you recommend another formation agent instead?

For company formation, do it yourself.

It's a trivially small fee and can be done online with Companies House in a very short amount of time and they will auto-notify HMRC in the same go.

For mail forwarding and registered office address... I honestly now think you should only consider one of three options:

1) Your work address if it is a sole-use mailbox and you know you will be there for more than a year.

2) Your accountants address (with their consent).

3) Your home address.

I would not now use a third party for the registered address, the risks are too high. There is no junk or spam mail sent to this address, it really is just actionable and important government communication from Companies House, HMRC, etc.

Re: How we uncovered the identity of popular spyware makers

#13
I liked the style and flow of this piece a lot. I sort of felt like I was left hanging at the end, though. There was no huge reveal or dramatic conclusion, just a bunch of arm waving and strong language.

I wonder if rewriting this so that the ending leaves more of a mystery might help the piece. As it is, I got the feeling the author was trying to tell a story that just wasn't there. Great tone and style, though, and worth the read. This new brand of "Nerd Detective Novel" is really cool. Would love to see more of it.

Re: How we uncovered the identity of popular spyware makers

#14
Thanks for the story, it was a nice read. However, the answer is at the beginning: The author of the software is exactly the guy he claims to be. Along with photo and an interview in the Forbes Magazine.

Yes, they use all kinds of fake companies for whatever purposes, but there's really no need to entangle it all.

Re: How we uncovered the identity of popular spyware makers

#15
> We decided to sneak a peak. Logging in with the “mobiteam@icloud.com” apple ID and the password graciously provided in clear text, we have identified a typical QA team account...

This provides the 'break in the case' but it's based on illegal activity. Just because a company is acting unethically doesn't give researchers a legal shield. (Especially considering a quick search led me to the probable identity of the author.)

Re: How we uncovered the identity of popular spyware makers

#16

I liked the style and flow of this piece a lot. I sort of felt like I was left hanging at the end, though. There was no huge reveal or dramatic conclusion, just a bunch of arm waving and strong language. I wonder if rewriting this so that the ending leaves more of a mystery might help the piece. As it is, I got the feeling the author was trying to tell a story that just wasn't there. Great tone and style, though, and…

Agreed! Nice piece of well written suspense and intrigue in the tech world. If it's also factual, that's a bonus :-)

Re: How we uncovered the identity of popular spyware makers

#17
post #5

> The UK address. 145-157 St John Street, London, EC1V 4PY. According to a BBC report, this is the address used by a company which sells its use as a registered office address. Because there does not seem to be an obligation to check that users of the service are legitimate companies, criminals are attracted to it. According to the BBC, the address is in common use among fake companies operating "boiler room" fake sh…

Would you recommend another formation agent instead?

I used Stanley Davis - stanleydavis.co.uk

I was planning to open a Barclays bank account anyway, so the minimal processing fee (£30) was basically null when Barclays gave me £40 to open their account. I was referred to them by a well known city-based accounting firm.

Re: How we uncovered the identity of popular spyware makers

#18

> We decided to sneak a peak. Logging in with the “mobiteam@icloud.com” apple ID and the password graciously provided in clear text, we have identified a typical QA team account... This provides the 'break in the case' but it's based on illegal activity. Just because a company is acting unethically doesn't give researchers a legal shield. (Especially considering a quick search led me to the probable identity of the a…

I came here to say the same thing. IANAL but it looks like if Apple wanted (which they probably don't) they could have them charged under the computer abuse and fraud acts, even if Apple doesn't act the DoJ still can. I can understand the researcher's desire to follow the trail but in attempting to unmask the criminal did they themselves not become one in the process? This is "Ends justify the means" type thinking which is really dangerous (Patriot Act anyone?).

Re: How we uncovered the identity of popular spyware makers

#19
post #12

Earlier quoted context omitted.

Would you recommend another formation agent instead?

For company formation, do it yourself. It's a trivially small fee and can be done online with Companies House in a very short amount of time and they will auto-notify HMRC in the same go. For mail forwarding and registered office address... I honestly now think you should only consider one of three options: 1) Your work address if it is a sole-use mailbox and you know you will be there for more than a year. 2) Your a…

I'd be hesitant to use a home address as it goes on public record. If you rent then it can be against the terms of the tenancy contract to register a business at the address. Also you might move and someone else could get your post and potentially do bad things. Are these reasonable concerns?

Re: How we uncovered the identity of popular spyware makers

#20
post #12

Earlier quoted context omitted.

For company formation, do it yourself. It's a trivially small fee and can be done online with Companies House in a very short amount of time and they will auto-notify HMRC in the same go. For mail forwarding and registered office address... I honestly now think you should only consider one of three options: 1) Your work address if it is a sole-use mailbox and you know you will be there for more than a year. 2) Your a…

I'd be hesitant to use a home address as it goes on public record. If you rent then it can be against the terms of the tenancy contract to register a business at the address. Also you might move and someone else could get your post and potentially do bad things. Are these reasonable concerns?

If you're in short-term rental accommodation (1 year or less) or if you share a mailbox... then yes, these are concerns.

If you fail to respond to HMRC mail, you can be fined. i.e. missing reminders about a tax return, or PAYE info.

Both Companies House and HMRC will send authorisation codes to the registered address, and you can use these to change shareholdings, dissolve a company, make declarations that are untrue, etc.

You definitely need to trust the registered address a lot, and that trust needs to be stable.

Post reply on HN