Kingpin: How One Hacker Took Over the Billion Dollar Cyber Crime Underground (35 page)

  
1
required technicians to reboot the machine every 49.7 days:
Sources include Linda Geppert, “Lost Radio Contact Leaves Pilots on Their Own,”
IEEE Spectrum
, November 2004 (
http://spectrum.ieee.org/aerospace/aviation/lost-radio-contact-leaves-pilots-on-their-own
).

  
2
Giannone was pretty sure he couldn’t hack Macs:
Interview with Giannone. Max acknowledges that he hacked Giannone frequently and tracked his movements, and was also prone to sending long messages to Giannone, and others, reflecting his thoughts. He also clarified that he had no problem hacking Macs.

  
3
So he reached out to Thomas by ICQ to try to head off trouble:
Max and Aragon discussed their ongoing conflict with Thomas, who also detailed his suspicions about Carders Market and Johnson on his own website, the Grifters. Additionally, the author obtained a log of the chat between Aragon and Thomas quoted herein.

  
1
He needed the money, plain and simple:
Johnson’s personal story comes from a sworn affidavit he filed in his criminal case on April 13, 2007, and a letter he wrote his sentencing judge on March 1, 2007. See
U.S. v. Brett Shannon Johnson
, 3:06-cr-01129, U.S. District Court for the District of South Carolina.

  
2
displayed simultaneously on a forty-two-inch plasma screen hanging on the wall of the office:
Trial transcript in
U.S. v. Jonathan Giannone
, 3:06-cr-01011, U.S. District Court for the District of South Carolina.

  
3
The suspect had done everything but deep-clean the carpet and paint the walls:
Interview with Justin Feffer, senior investigator, High Technology Crime Division, Los Angeles County District Attorney’s Office. Also see
The People of the State of California v. Shawn Mimbs
, BA300469, Superior Court of California, County of Los Angeles. Mimbs declined comment.

  
4
The needles were steady as Johnson answered the first two questions:
According to Johnson. The Secret Service declined to discuss Operation Anglerphish.

  
5
“I will hound you for the rest of your life”:
From Johnson’s letter to his sentencing judge.

  
1
“Tea, these girls are white trash”:
Interview with Tsengeltsetseg Tsetsendelger. Aragon mentioned his fondness for Tsetsendelger in interviews and a letter to the author.

  
2
Iceman, she’d decided, was pretty cool:
Interview with Tsetsendelger. Max says he was respectful in chats with her but privately disliked her.

  
3
“Get out of here”:
The incident at the pool comes from interviews with Tsetsendelger and Giannone.

  
4
The bug was in the brief handshake sequence:
See CERT Vulnerability Note VU#117929. The bug was discovered accidentally by Steve Wiseman of
Intelliadmin.com
while he was writing and testing a VNC client. Technical details come from an analysis by James Evans; see
http://marc.info/?l=bugtraq&m=114771408013890&w=2
.

  
5
a widely read computer security blog:
“Schneier on Security” by Bruce Schneier.
http://www.schneier.com/blog/archives/2006/06/interview_with_1.html
.

  
6
a random blog called “Life on the Road”:
See
http://afterlife.wordpress.com/2006/06/19/cardersmarket-shadowcrew-and-credit-card-theft/
and
http://afterlife.wordpress.com/2006/07/12/carding-web-sites/
.

  
1
Carders Market had six thousand members now:
Max, his former administrator Th3C0rrupted0ne, and other carders say the site had in excess of six thousand users after the hostile takeover. The Justice Department, though, has put the number at forty-five hundred.

  
2
secret even from his mother:
According to his mother, Marlene Aragon.

  
1
industry-funded report by Javelin Research:
Javelin Strategy and Research, “2007 Identity Fraud Survey Report,” February 2007. The report was sponsored by Visa USA, Wells Fargo, and CheckFree, and then prominently cited by Visa USA in a PowerPoint presentation at a Federal Trade Commission workshop: “50% of known thieves—
were known by the victim!
” (emphasis original). Also see the author’s “Stolen Wallets, Not Hacks, Cause the Most ID Theft? Debunked,”
Wired.com
,
February 12, 2009 (
http://www.wired.com/threatlevel/2009/02/stolen-wallets/
).

  
2
Visa’s private numbers told the real story:
Presentation by Steven Johnson, director, Visa U.S.A. Public Sector Sales, at the ninth annual GSA SmartPay Conference in Philadelphia, August 23, 2007. The presentation slides are marked “Visa Confidential.”

  
3
C0rrupted had discovered the warez scene on dial-up bulletin board systems:
Biographical information comes from telephone and online interviews with Th3C0rrupted0ne, who spoke on condition that his real name not be reported.

  
4
“I can’t believe how much you know about me”:
Interview with Aragon.

  
5
“Do not follow unsolicited links”:
US-CERT Technical Cyber Security Alert TA06-262A (
http://www.kb.cert.org/vuls/id/416092
).

  
6
Each copy of the message was customized:
The text of the spear phishing e-mail comes from an FBI affidavit filed in
U.S. v. Max Ray Butler
, 3:07-mj-00438, U.S. District Court for the Eastern District of Virginia. “Mary Rheingold” is not a real name and was added by the author in place of “[First Name and Last Name of Recipient]” in the original court document.

  
1
“The Secret Service and FBI declined to comment on Iceman or the takeovers”:
Byron Acohido and Jon Swartz, “Cybercrime flourishes in online hacker forums,”
USA Today
, October 11, 2006.

  
2
“You’ve lost your fucking mind”:
Interview with Chris Aragon.

  
3
Bank of America and Capital One, in particular, were huge institutions:
Of his spear-phishing attacks, Max was charged only with the Capital One intrusion. The other victims were identified by Max.

  
1
it was just Silo trying to gather intelligence on DarkMarket members for the police:
Max, Mularski, and Th3C0rrupted0ne identified Liske as Silo. In extensive interviews, Liske was evasive about his activities on the forums but spoke obliquely of his work as an informant and his relationship with Max. “Max was a good case. You know, he was a challenge.” On the NCFTA Trojan, he said: “Isn’t it reasonable to assume that whoever was dishing out Trojans was actually dishing out Trojans to everyone in the scene?” Later, “If it were malicious I could have—someone could have caused real damage.” Detective Mark Fenton of the Vancouver Police
Department said Canadian law prohibits him from identifying or confirming an informant’s identity. On the subject of whether he received hacked evidence from informants, he said: “I know down in the States, if an individual received any information that is suspect, it’s not admissible. Up here, if someone tells me something, I say, ‘Where did you hear that from?’ He says, ‘I heard it from some guy.’ ” He likened the arrangement to the Crime Stoppers tip program. “Should Crime Stoppers be scrapped because we have criminals phoning in tips about other criminals?” One unanswered question is to what degree, if any, the Secret Service leaned on hacked information provided by the VPD to build cases in the United States. The Secret Service declined to make agents available to the author: “Although we have chosen not [to] participate with this particular project, feel free to approach us with other ideas in the future.”

  
2
the same user had once registered another address through the company:
Max says Night Fox was responsible for registering the Financial Edge News website and made this blunder.

  
1
“for 150 classics”:
Affidavit of Secret Service Special Agent Roy Dotson, July 24, 2007, filed in
USA v. E-Gold, LTD
, 1:07-cr-0019, U.S. District Court for the District of Columbia. For the complete history of e-gold, see Kim Zetter, “Bullion and Bandits: The Improbable Rise and Fall of E-Gold,”
Wired.com
, June 9, 2007.

  
2
They were working closely with Silo’s handler at the Vancouver Police Department:
Word of the meeting got back to Liske. “There was an accusation that I was Iceman,” he said in an interview. “And there was a big presentation made that this guy was Iceman. And the people this was presented to knew full well that I wasn’t.”

  
1
straight from Maksik’s massive database of stolen cards: U.S. v. Maksym Yastremski
, 3:06-cr-01989, U.S. District Court for the Southern District of California.

  
2
In early 2006, the Ukranians finally identified Maksik as one Maksym Yastremski:
Interview with Greg Crabb.

  
3
they secretly copied his hard drive for analysis:
Government filing dated July 24, 2009, in
U.S. v. Albert Gonzalez
, 2:08-cr-00160, U.S. District Court for the Eastern District of New York.

  
4
“We were lucky in this case, because Salgado’s purchaser was cooperating with the FBI”:
Written testimony of Robert S. Litt, deputy attorney general, before the Subcommittee on Telecommunications, Trade and Consumer Protection, House Commerce Committee, September 4, 1997 (
http://www.justice.gov/criminal/cybercrime/daag9_97.htm
).

  
5
But the feds lost the crypto wars:
For a detailed history, see Steven Levy,
Crypto: How the Code Rebels Beat the Government—Saving Privacy in the Digital Age
(New York: Penguin Books, 2002).

  
1
“So, you take my girls out to party now?”:
Interview with Giannone.

  
2
Once a jury is seated, a defendant’s chances for acquittal are about one in ten:
Fiscal year 2006. Calculated from “Federal Justice Statistics, 2006—Statistical Tables,” U.S. Department of Justice, Bureau of Justice Statistics, May 1, 2009 (
http://bjs.ojp.usdoj.gov/index.cfm?ty=pbdetail&iid=980
).

  
3
“I suspect that you are never going to look at the Internet exactly the same way again”:
Trial transcript in
U.S. v. Jonathan Giannone
, 3:06-cr-01011, U.S. District Court for the District of South Carolina. Some grammatical changes were made for readability.

  
4
“Who’s Iceman?”:
Interview with Giannone.

  
1
his new partner, twenty-three-year-old Guy Shitrit:
Information about Shitrit’s trouble in Miami comes from Aragon. Detective Robert Watts of the Newport Beach Police Department confirmed he’d heard the same account. Shitrit, now in custody, did not respond to a letter from the author.

  
2
His wife, Clara, had brought in $780,000 on eBay in a little over three years:
Based on sales figures from Clara Aragon’s eBay account obtained by the Newport Beach Police Department. Aragon declined to discuss his profits.

  
3
Max, he felt, was ignoring the Whiz List, their blueprint for building one big score and getting out:
Interview with Aragon. When police searched Aragon’s cell phone, they found this entry on his electronic to-do list: “tackle whiz list.”

  
4
in meticulous, hand-drawn spreadsheets summing up how much Chris owed her for each in-store appearance:
One such spreadsheet was seized by the Newport Beach Police Department and seen by the author.

  
5
Vigo was looking for a way to pay down a $100,000 debt to the Mexican Mafia:
This
according to Vigo’s statements to the police following his arrest. The Newport Beach Police Department found a copy of the shipping manifest in Vigo’s office.

  
6
Bloomingdale’s security people didn’t like to upset the store’s customers:
Interview with Detective Robert Watts.

  
7
thirty-one Coach bags, twelve new Canon PowerShot digital cameras:
Per the search warrant seizure records.