so the lesson goes back to opsec 101

Even with all that, if he just never left Russia there is nothing the feds could have done about it.

​@@xv0047that's what most do. he is one guy who got caught. there are hundreds more like him

Freaking spoilers >:(

@@grubybysior8635 😞 oh no

Most marketplaces not even fall. Most are still alive or did a own exit scam but it's more interesting for jonalists to talk about the fallen ones.

The court and judge would have found anyway to make him lose that case. Unfortunately the US courts or not fair if they want to catch you or don't like you

Same! I briefly felt second-hand famous.

This. Vadym Iermolovych made that mistake by going to Mexico. The night he arrive in Mexico, Mexican cops approached him at his hotel and told him he was not welcome in Mexico. They said the government of Ukraine had agreed to fly him back to Ukraine. They confiscated his laptop, and put him on an airplane. They said he would have one stop in Dallas, Texas. When the plane touched down in Dallas he was in US territory. The first 4 rows of the plane stood up, announced themselves as US federal agents, and arrested him. The Mexicans cleverly handed him over to the US and got him to agree to it.

@@napalm3899and that was his last mistake or the last bad decision.

@EramSemperRecta oh ! 😲 Was that so ?

Russia dosent have as nice beaches as the Maldives, human weakness

word that was his mistake, plus using usa hop 1 instance.

Obviously, he thought that -- being the rich son of a member of the Duma -- he was above the law and so didn't need to employ OPSEC.

RonJohn63 9

@@TheOxywolf 8

yeah but a venue like this for them to speak is pretty cool.

@@blackneos940 7

ikr

Real hackers also purchase their computer hardware with cash, and then also have it shipped to a third party - completely untraceable

He had 1.7million CC numbers on his computer. He is maybe THE definition of a 'real hacker'...sloppy though.

Ryan Kearney lol

Sometimes they bake that stuff into the BIOS. No reason to remove the manufacturer name and logo aside from bragging rights at that point. My computer still says it's from ZT Systems even though I just bought a used motherboard. I guess it was in a compuer made by them at some point. And i'm too lazy to fully reset every little thing in the BIOS just to make it say something else.

go f... yourself

To: @@aniellodellacroce9848 They will get you too Aniello. You should have kept your head down. You are Guilty of "Having a brain and attempting to use it".

@@jamesparker6876im not hiding at all. i welcome anyone who wants to give me a visit and get free involuntary led injection at very high velocity

Dan Powell Maybe he stole an average of 45k cards at each store he hacked. Or maybe he (provably) hacked/defrauded 38 stores to get to the cards, then purchased many more stolen cards from other criminals that got them through other (unspecified) crimes. After all, he had officially graduated from thief to fence long before his arrest.

Well if someone breaks into your house and steals all your stuff, they won't be charged for each individual item stolen, but for the act of burglary itself.

yes. I would love to see a trilogy film. Part one is when he starts off. part two is the terrorist attack and the coma and recovery and part three when they nail him. depending on how good it is there would be a prequel trilogy on how he learned not to use encryption and how to be sloppy 😆

He was an expert at obtaining credit card numbers through black market available malware. So far, there hasn't been much of any indication he did much of any actual hacking.

@@enlightendbel There are many cases where LEO cannot access encrypted data from a hard drive. There are definitely ways to hide your data and keep it hidden.

Adrian Yes? And? Did I say anything to the contrary? The subject is this guy, not general practices and problems.

LOL @ Blazee.. I think you mean blase.

He's not a hacker, he's a skiddie. He found one method that worked (RDP brute + malware) and abused it heavily. The reason he was so successful I think is because he was an expert at leveraging what he obtained to profit.

@g milne ДА

He's a Fed

Way outside. As are the Philippines, where they randomly stop and search people, and there is footage of raids they do over there on YT. As is Colombia, where the DEA does raids and wipes camps using drones and special forces. Not all are FARC encampments, maybe up to 40% are not going by if weapons are found. AS is Mexico, where the DEA operates over the border. As is Aruba, where the DEA arrested a bunch of people after their own incompetence got their car broken into and a bunch of people they were on a terrace with having cocktails refused to search with them. As is Italy, where they kidnap citizen for renditions and black site prisons. As is Kazakhstan, where they kidnap citizens for renditions. As is Pakistan, a supposed ally where find more people than just Bin Laden to kill. As is Japan, where an American criminal is taken out of Japan and will not see a Japanese court. See the Okinawa incident. The hash trafficker. Spoiler Alert: We can do it so we will. So fuck you.

Its all explained here why the feds started talking at defcon, black hat etc. : kzfaq.info/get/bejne/np-ni9Rn1Limnn0.html

Which cards? This guy basically surrendered by having zero opsec

Obviously you are not involved in Computer security. He was sloppy in his hacking, left breadcrumbs leading directly to him... But nothing said here was opening up any "Tell Tales" of the investigation.... No REAL cards are being shown or disclosed if you know anything about vulnerabilities in networking or computer security

shades2 when I travel I buy prepaid debit cards. If it's not my machine it doesn't get my numbers. And it's super easy to install a keylogger on any unattended machine.

Lucas Gorski very true. 👍

too? you're overestimating criminals

It depends. They had a lot of other evidence against him without the laptop. But encryption depends on the algorithm and the strength of your password (basically more entropy in the password, the better). There are also ways to create "hidden encrypted volumes" where you can keep an operating system, files, or whatever. This allows you to have plausible deniability-- you don't know about any hidden volumes! Best thing to do is always keep your online identities isolated from one another and encrypt everything. Get rid of logs. Ideally you would have a burner computer that has no identifying information associated with your real identity, fully encrypted. If you feel like the feds are sniffing your butt, just destroy the laptop and drop your activity for a while.

No, they would be able to access it. It would just be a little more hands on

Hardware based encryption can have the keys sniffed off the wire

The word is hubris.

Small businesses don't have active management in place. They don't have dedicated staff, nor do they bother to maintain a contract with an IT company. Only call for service when shit breaks.

Btw this literally means Butthole123

Meanwhile 5 years for murdering someone

because he goes straight back to Russia and continues doing it probably , only way to actually stop him is keeping him in jail here.

​@@LiEnby And 3 months for raping a child 🤪 Law enforcement only cares about protecting the banks here.

6 years later, no answer?

@@b3twiise853 i am still waiting bro

John Smith *cries in Java*

It's because IT vendors who setup POS remotely use just that. Shit never gets turned off. And no keylogger needed, he pulled the CC numbers from the server. POS server probably stores shit in open text in a database. Which isn't all that insecure... if the fucking server doesn't have RDP open!

gophop Even if not usually stored in plain text, he could install a patch that grabs each card and stores it in a plain file for later delivery to his rented server.

Port scans RDP (most of them have common passwords)then searches queries...a lot of DBs are still getting breached like this

or simply swap a pre-prepped hard drive in. A lot of the windows shit should be inadmissible in court. All of that stuff is easily editable in log files and registry.

gophop That's why they have a hallway full of cops willing to swear up and down that they picked up the laptop from another cop at so and so time, didn't plant evidence or leave it unguarded, then handed it to a 3rd cop at so and so time. Even the defense knows this, so they rarely bother. Except in the OJ Simpson case where the defense knew they had proof one of those cops was an admitted racist that they could accuse of lying.

yep I noticed that too, admin perms to infract people

I assume the pics were taken after the arrest? for evidence show or tis power point?

@@nickdrozd May be or may not be, what he wanted to point out that theres a spy/snitch/whatever in the admin/mod staff of this carder forum^^

More like they got a copy of the database of the carder forum, possibly by search warrant on the server, and then pwned the copy as god.

Could also be parallel construction for sure - nice catch.

Russian government is very corrupted. I'm pretty sure his dad knew about his son crimes and maybe even supported him in this. Looks like people in USA start to understand this, so guy will be in jail for full 21.6 years. And no way he will change his mind, I know russian people and can guarantee, that only suggenstion he and his father have that they do a poor job to protect him from a jail, that's it, no regret about crimes at all.

@@MegaSmouke US government is much more corrupt than Russian. you just got no idea

@@aniellodellacroce9848 no, US people has 20 times more money for they job than russians. Russian salary is 200$-500$ per month with constant everyday inflation. When Russian government is extremely rich people, everybody are billionaires. You very naive if you think that US government is much more corrupt than Russia. Because if it was true, american people would be much poor than russian people, but in reality american people has much higher salaries for their job, that's clearly show that US government spend much more money on their people, than russian government.

@@aniellodellacroce9848 definitely not. I think you don't realize the scale of corruption in Russia. You can pay for absolutely anything here. Nothing unusual when someone pays a police officer to not get his driver's license cancelled for DUI or something like that. Just a regular day in Russia.

@@artemiddle look there's more money in US that means there's a lot of corruption and i'm not talking about small police type of bribes but on higher level, in States if you have a lot of money you can pretty much legally bribe any Congressman, House representative and senators with that said i agree that the same thing applies to Russia BUT there is more money circulating in states (and more corporations-they bribe a lot) therefore there should be more corruption on higher level in US. obviously it's almost impossible to bribe the police in states, even if you have a lot of money you still can't bribe your way out of DUI or something. Police in Russia is more corrupt compared to US but oh higher level it's no contest due to the amount of money circulating. and let's not forget that US is the richest economy in the world so there must be more of corruption. if there's money there's corruption.

Lived in Toronto for awhile, moved back to Russia, zero regrets. Yes, some things are annoying, but overall quality of life is better, finding good job with English and some skills is easy, most importantly - no SJWs, no speech police, no feminists to speak of.

Nonsense. With millions of dollars you can build wtf you want, wherever you want, and import anything of interest. Tropical vacations are a status symbol in Russia.

@@n.k.63 We don't want an authoritarian police state to protect our feelings from 30 college students and women who want respect from society.

@@n.k.63 100% agree^^^^^^^ , also in the process of moving from toronto to moscow (originally from ukraine tho)

Totally false. I had a Russian client when I drive Uber and she was very sweet, even offered me food and asked me to come over to her workplace. She was a teacher assistant.

or dont be lazy and stupid

The bankers are the biggest criminals giving themselves millions in bonuses "some free money"

Have you ever paid something with paypal? Something as common as the double currency exchange... let's say from euros to dollars to euros.

The most profitable crimes are the legal ones.

Time to grow up and stop equating immoral but rational activities to being illegal. If you can't pay the interest, don't take the loan. If the rates in your mortgage seem too good to be true they are. Etc etc, you have a brain...no one can force you to use it.

Those two things are hardly even linked

@@fluffigverbimmelt They don't need to track you live. If there is a detailed log file, they can track you forever.

@@msnpassjan2004 No that isnt what a VPN is, a VPN cloud your data being sent to servers from your ISP or even the servers themselves. This is local, and will not be sent to severs or your ISP

Why not go with Virtual Networks ??? And Changing Mac Address Because , mac address is permanent number of your device which connecta details of u to APN , and Better to use socs For Firewall More Firewall more safety ...

Install gentoo

And why they need to blow-up whole building to kill one guy if they can just shoot him somewhere at night at dark place?

All foreigners usually go to the same restaurants, it's a natural target for some organization of peace.

It is a common thing for security agencies to talk at security conferences for some reason. In this case it's a win-win for them. Hacker was so stupid they don't have to reveal much, but they still get to advertise their success and capabilities to the BH community, thereby discouraging cybercrime.

yepp

The point was that the defense brought that up as proof of him being framed. Therefore the prosecution had to prove that that was not the case. It was a stupid defense, but "the defense is stupid" is not a valid legal argument.

@@lydianlights Ironically his stupid defense strategy could be a valid reason for appeal, under incompetent counsel rules. Although, I don't think it would make any difference in this case. His incompetence is what got him caught in the first place.

lol... and that's why I'm not a lawyer

It's meant to be an open, public exchange and showcase. If they wanted to secretly swap illegal secrets away from the eyes of the government, they wouldn't rent a function centre to do it. This is a "fun" event.

The art of Doublespeak 😜

relikvija ur pwned d00d

wouldnt you like to know problem is this guy is the dumbest of hackers. If you only try to do better than him you will still get arrest

You should start by reading relevant court cases, and all of this is public record. Nothing they said here would be hidden for someone willing to shell out for a bit of Pacer subscription, or just walk in to the court in question and go to their file division. There you can inspect all unsealed records as you wish. There are lots of books that detail cases in the way it was done in this talk, and if the people with direct involvement with the case won’t say it, then someone else whose career it is to write about such things will do it anyway. You’re vastly overestimating the effort needed to collate all this information for someone whose job was to do it, or someone just serious about it. Sure, the first time round it will suck, but so it would if you sat for the first time in your life at a piano. You wouldn’t ask someone about how hard a piece of music is to play after their first lesson on the instrument. I wouldn’t ask anyone inexperienced with gathering such information about how hard it really is to gather it. I presume you haven’t done it much.

Let's make laws secret, so criminals wouldn't know what they will be charged for

Actually quite common and boring Slavic name

lol, Roman is not a slavic name. it us clearly the Latin name used in Eastern Roman Empire

@@impaugjuldivmax let me rephrase, quite common and boring name used among Slavs

I know, right?

Andrey Antonchik The wife?

Andrey Antonchik his daughter

i just opened a credit card in her name

Yes, it was his daughter. She was born 33 years before he was..

They imaged the hard drive.

and dont go on holiday with an unencrypted laptop stuffed chock full of incrimating evidence.....

@@glanoe nailed it. but most importantly! never leave Russia lol

Aniello Dellacroce Russia is a big place, why would you need to leave it's borders.

@@glanoe to flex exotic places on instagram.. duh.

and don't use yahoo email address...

Why would the government reimburse the shops exactly...? It is their responsibility, by law, to protect any personal details on their systems. They did that inadequately and I'll be damned if they're paid for bad security out of my tax dollars. It's bad enough they did it to failures of banks.

The businesses didn’t lose money from the credit cards being stolen directly. They went under because customers didn’t trust the business anymore and for good reason.

@@yc5117 - that's why the US is tearing itself apart...the top can force the bottom to keep them from falling while putting all cost on the people...I'd rather my tax money go to help a local shop than a bank..... America became a socialist country by the order of Wall Street signed by Bush but they want a one way street. Socialism for the 1%, they deserve everything because they already have it...dog eat dog capitalism for the rest of us to fight each other or do tricks for their scraps.

They didn't go out of business because of card fraud. It's bullshit to gain sympathy and praise for FBI's heroic work. *barf*

@@gophop have you ever had card fraud as a business? It does hit you. Especially if you are swarmed with it, because your an easy cut out for carders, and a swarm can definitely put someone out of business while they wait for investigations to get the insurance reimbursement. Depends on standing capital, inventory, and credit lines to weather it.

he wasn't a government official.

His father was (is?) a member of the Duma.

So then you agree - his father is a state official, not him.

IIRC, his father the state official was in full agreement with the idea.

Lol the father, a state official, was the one that was going to be bribing the prosecutor, not the guy in prison........

Woody Woodlstein NSA needs to care about their own opsec as well. Every time you use a tool, you risk the tool becoming reverse engineered and the info sold for profit to those who wish to avoid said tool. Thus the use of tools that basically bypass everything and go straight to the camera (in essence) is reserved for a measured response, probably one or two orders of magnitude more dollars would need to be involved, or the hacking would need to be against US government.

Too low profile for NSA probably

if you think the motivation is anything more than money then you are missing the trees for the forest...

In Russia like most places it’s all about the money!!!!!

The reason is coming back to his roots. The Russian government itself is comprised of mafiosi and former gangsters.

That's what forensic chain of custody proves, what they were showing here was a spark notes of proving it wasn't an external hacker or some tomfoolery immediately after he was captured. They're not going to waste 20 minutes explaining to a Black Hat audience something that's well known even by students and has nothing unique to the case.

KnownError Chain of custody, if unbroken and honest, only proves evidence wasn't tampered after confiscation. It doesn't disprove prior framing by 3rd parties. That's the point of including evidence one of the crime accounts was used to send his wife flowers, because that is less likely to have been done that long ago to frame him much later.

С чего ты взял, что он из владивостока? Вдруг это москвич, который купил дом во владивостоке чтобы просто на море ездить.

@@machinerin151 адрес в паспорте, алё? Острякова 26, кв 113, Владивосток?

He sold them

This was all opsec fail rather than darknet identity compromise

Emanuel Fernán Because they actually knew how to efficiently bribe US authorities?

Micke Nieminen The US credit card industry is a shithole of rules and hacks on top of old systems for paper based mail and phone orders. The only attempts to secure credit card use in the US were SET and a number of callback schemes like "verified by VISA" etc. Other places have chosen not to base credit card transactions on pretending every purchase is someone phoning in their credit card over an open line, but the world is held back by incompetent bank software that makes processing harder, and also held back by the constant need to accept US credit cards and allow our citizens to shop in US shops. Here is some of what I see daily: 1. When I use my card in a physical shop, I swipe it through a sealed box that has an encrypted connection to the credit card clearing company. The box will occasionally ask to talk to the encryption chip on the card and ask me to punch my pin code on a keypad that's physically shielded from prying eyes. The shop never sees my card data, just some text to print on the receipt and of cause the money. It could be safer if the box had it's own printer (some do), but that has it's own problems. The secure box also displays the actual amount that will be charged, to protect me in case the display on the cash register lies (of there even is one, small shops literally punch the amount into the box manually). If someone completely pawns the cash register, the most damage they can do is mess with the prices, cancel payments and get the cashier in trouble for having the wrong amount of actual cash at the end of his shift. Hacks like against that grill or Target are very rare (at one point they had to update the physical seals on the secure boxes due to fake ones being substituted during break ins). 2. When shopping online, the payment step where I enter card details is a separate site run by one of a handful (5 or less) specialist credit card clearing companies, so once again the shop never sees the cards, and often I will be redirected to the credit card company for further authentication. Now compare this to buying from Amazon. On Amazon I have to enter the card details on an Amazon page that is badly secured and offers little direct control over charges. Because US based Amazon still pretends those are essentially phone or mail orders where the bank just has to trust Amazon when they claim I owe them $xxx.xx because they say so.

Andrew Cecce probably used shodan or something similar.

Username checks out.

That's phonetically incorrect. The ch is a part of the first syllable; not the second. The o sounding like ah is correct, but the ch is still a part of the first syllable.

RussianLearnsYou Can it also mean "asshole", as in "a really unpleasant person"?

@@johnfrancisdoe1563 what about dalbayob? Ever heard that one?

@@johnfrancisdoe1563 no, ochko cant be used for "really unpleasant person". dolboyob means dumbass btw

TheYuxiaodi The tutorial on his old page probably explained how to turn each unauthorized payment of $99.99 into $20 in untraceable criminal profit (very rough guess). Because he didn't physically steal the card, the owners were still using the cards and would need to watch their monthly statement and dispute each fake transaction until paying to get a new card. So basically they need to make charges that can't be reversed in time. It was suggested in this talk that crooks made fake cards with the stolen numbers (a restaurant cash register doesn't store the CVV, so can't fake online purchases). Then they used those cards to make physical transactions in places with no CCTV. By the time charges are reversed, shop assistants no longer remember the face of the guy with the (fake) credit card. Of cause the asshole didn't shop with fake cards himself, he sold that data to smaller crooks at a few dollars per victim.

It’s not the problem of the person that markets those. They surely whitewash the consequences a bit, it’s marketing after all, and there’s enough fools around to buy into this. Or into MLMs :)

Spend it all on bitcoins, once the payments are reversed you keep your coins