How does one get hired by a top cybercrime gang? • Hacker News Board

Re: How does one get hired by a top cybercrime gang?

#31

Post by nkrisc » Wed, Jun 16, 2021, 5:24 PM UTC

mwint wrote: post #5

azinman2 wrote: post #3

Quite frankly she doesn’t come across as very smart, and certainly not very technologically sophisticated. The idea that you run into a problem and use Google to solve it hardly constitutes skill development. It is interesting that they’re hiring based on job boards. I don’t know how normal gangs recruit but I’d guess it’s a lot of word of mouth. It seems when there are real honest alternatives out there for skilled…

This doesn’t in any way downplay your point, I just noticed this sentence and it made me think: “The idea that you run into a problem and use Google to solve it hardly constitutes skill development.” It’s probably natural for most folks on HN to consider “googling problems” an obvious, basic first solution - but I’m always stunned by how many people in real life, outside of the IT industry, don’t have that path in th…

Many (most?) people are simply not curious. When they run into something they don’t know how to do, they don’t wonder how to figure out how to do it, they just sit there until someone shows them how.

I assume when most people here on HN run into a problem, their first thought isn’t, “who can I ask?” but instead, “how can I figure it out?” because most hacker types are naturally curious and relish an opportunity to learn something new.

In my experience most people who zero interest in learning something new when they encounter something they don’t know.

Re: How does one get hired by a top cybercrime gang?

#32

Post by JohnBooty » Wed, Jun 16, 2021, 5:31 PM UTC

azinman2 wrote: post #3

Quite frankly she doesn’t come across as very smart, and certainly not very technologically sophisticated. The idea that you run into a problem and use Google to solve it hardly constitutes skill development. It is interesting that they’re hiring based on job boards. I don’t know how normal gangs recruit but I’d guess it’s a lot of word of mouth. It seems when there are real honest alternatives out there for skilled…

    The idea that you run into a problem and use 
    Google to solve it hardly constitutes skill development.

You need to understand a domain somewhat well in order to Google effectively.

For example, I don't know anything about flowers.

Sometimes I see a flower that I'd like to identify, but I can't really Google it -- aside from color and perhaps the number of petals I'd have no idea what terms I'd use to describe a flower and therefore what I might possibly type into Google.

(note: This is just an example. Never really tried to identify a flower w/ Google. Perhaps I could use Google image search, etc.)

Re: How does one get hired by a top cybercrime gang?

#33

Post by yellowstuff » Wed, Jun 16, 2021, 5:34 PM UTC

snypher wrote: post #9

balls187 wrote: post #4

This reminds me of the story in Freakanomics about the street level drug dealers making basically minimum wage, with the majority of the money going to high level traffickers who are typically firewalled through layers of middlemen.

There should be a name for this type of societal organization... anyway, I have a rocketship to catch.

Tournament theory

https://en.wikipedia.org/wiki/Tournament_theory

Re: How does one get hired by a top cybercrime gang?

#34

Post by Kenji » Wed, Jun 16, 2021, 5:38 PM UTC

snypher wrote: post #9

balls187 wrote: post #4

This reminds me of the story in Freakanomics about the street level drug dealers making basically minimum wage, with the majority of the money going to high level traffickers who are typically firewalled through layers of middlemen.

There should be a name for this type of societal organization... anyway, I have a rocketship to catch.

There already is a name for it: Government.

Re: How does one get hired by a top cybercrime gang?

#35

Post by ackbar03 » Wed, Jun 16, 2021, 5:39 PM UTC

Wait hang on, that cliff hanger though

>"Multiple security experts quickly zeroed in on how investigators were able to retrieve the funds, which did not represent the total amount Colonial paid (~$4.4 million): The amount seized was roughly what a top DarkSide affiliate would have earned for scoring the initial malware infection that precipitated the ransomware incident."

I'm not quite sure what this implies? That the team who did the initial infection was in fact some sort of FBI undercover?

So undercover FBI successfully hacked colonial pipeline, ignited all this press coverage and attention, and quietly disappeared with the ransom amount? Am I interpreting that correctly?

Re: How does one get hired by a top cybercrime gang?

#36

Post by _zamorano_ » Wed, Jun 16, 2021, 5:45 PM UTC

mwint wrote: post #5

azinman2 wrote: post #3

Quite frankly she doesn’t come across as very smart, and certainly not very technologically sophisticated. The idea that you run into a problem and use Google to solve it hardly constitutes skill development. It is interesting that they’re hiring based on job boards. I don’t know how normal gangs recruit but I’d guess it’s a lot of word of mouth. It seems when there are real honest alternatives out there for skilled…

This doesn’t in any way downplay your point, I just noticed this sentence and it made me think: “The idea that you run into a problem and use Google to solve it hardly constitutes skill development.” It’s probably natural for most folks on HN to consider “googling problems” an obvious, basic first solution - but I’m always stunned by how many people in real life, outside of the IT industry, don’t have that path in th…

Shockingly to me, in many fields, Google results are bare.

Coming from IT, in the industry, even questions about software (very specialized, to be honest) get useless results.

I think the openess of information in software is the exception, not the norm, though many fields like science are making improvements.

Re: How does one get hired by a top cybercrime gang?

#37

Post by chevill » Wed, Jun 16, 2021, 5:46 PM UTC

ackbar03 wrote: post #35

Wait hang on, that cliff hanger though >"Multiple security experts quickly zeroed in on how investigators were able to retrieve the funds, which did not represent the total amount Colonial paid (~$4.4 million): The amount seized was roughly what a top DarkSide affiliate would have earned for scoring the initial malware infection that precipitated the ransomware incident." I'm not quite sure what this implies? That th…

>I'm not quite sure what this implies? That the team who did the initial infection was in fact some sort of FBI undercover?

I suppose that's one of the many possibilities that are implied, but its not even close to the most likely.

I think its more likely that some of the attackers' systems or accounts were compromised (AKA hacked).

Re: How does one get hired by a top cybercrime gang?

#38

Post by great_reversal » Wed, Jun 16, 2021, 6:01 PM UTC

Getting hired is just applying to another job posting. The interview process is two-step, with a project-based technical component. The job itself is also two-step: first year is similar to contract work, with good employees brought into the fold not long after.

It looks like DOJ is trying to make an example out of some lowly frontend/freelance developer. Her work includes:

- creating a "web panel used to access victim data stored in a database"

- added a feature that "showed an infected computer or ‘bot’ status in different colors based on the colors of a traffic light"

- added a feature that "allowed other Trickbot Group members to know when their co-conspirators were working on a particular infected machine"

One thing DOJ accuses her of is "developing tools and protocols for the storage of credentials stolen and exfiltrated from victims infected by Trickbot." But its pretty obvious they don't know what "frontend developer" even means.

Re: How does one get hired by a top cybercrime gang?

#39

Post by azinman2 » Wed, Jun 16, 2021, 6:10 PM UTC

jacquesm wrote: post #6

azinman2 wrote: post #3

Quite frankly she doesn’t come across as very smart, and certainly not very technologically sophisticated. The idea that you run into a problem and use Google to solve it hardly constitutes skill development. It is interesting that they’re hiring based on job boards. I don’t know how normal gangs recruit but I’d guess it’s a lot of word of mouth. It seems when there are real honest alternatives out there for skilled…

> The idea that you run into a problem and use Google to solve it hardly constitutes skill development. What does, according to you?

Taking a course, reading books, watching lectures, and actually building projects in new domains. I'm not going to learn machine learning by googling each step and copy/pasting stack overflow. I'm not going to learn how TCP works by Googling and copy/pasting stack overflow at each requirement.

Skill development is something that takes a lot of time and practice.

None of that is to say that stack overflow isn't useful, or that I won't learn things when I run into a problem by reading a blog entry. But to me that isn't the same thing as learning a new skill, unless that skill is so small and shallow that a single blog entry is all of the knowledge you'd ever need.

Re: How does one get hired by a top cybercrime gang?

#40

Post by jaywalk » Wed, Jun 16, 2021, 6:14 PM UTC

ackbar03 wrote: post #35

Wait hang on, that cliff hanger though >"Multiple security experts quickly zeroed in on how investigators were able to retrieve the funds, which did not represent the total amount Colonial paid (~$4.4 million): The amount seized was roughly what a top DarkSide affiliate would have earned for scoring the initial malware infection that precipitated the ransomware incident." I'm not quite sure what this implies? That th…

If you would have clicked on the link to the article, it's explained in a little more detail and a few experts weigh in with what likely happened: https://krebsonsecurity.com/2021/06/justice-dept-claws-back-...