Kevin Poulsen, the editor of the WIRED log, and in blackhat childhood the hacker of Dark Dante, wrote the book about "one acquaintance".
In the book the way from the teenage geek (but at the same time rolling), to the experienced cyberkingpin, and also some methods of work of intelligence agencies on capture of hackers and crankcases is shown.
The quest on transfer of the book began in the summer in Itshny camp for seniors — "The Pin: school students translate the book about hackers", then were connected to transfer also Habrayuzera and even a few edition.
Chapter 23. Anglerphish(for transfer thanks of Find_The_Truth)
Max was engaged in collection of information on Brett Johnson. It began with check of logs of access and personal messages of the administrator of CardersMarket. To check itself, Max Johnson's account on the website of "The international association of development of criminal activity" hacked ("The International Association for the Advancement of Criminal Activity", IAACA) and looked for traces of its activity. However, the smoking guns, other proofs were.
Really he could bring the informant into a narrow circle of its new website? The problem is that there is no specific method to define whether Johnson, or someone else works for the government. Max wanted to use a hole in safety of law as buffer overflow in BIND which he could use again and again concerning any whom he suspected.
If (is_snitch(Go llumfun)) ban(Go llumfun);
It trusted in David Thomas, without representing that Thomas already entered Aysman in the kilometer list of enemies.
Somehow at its check, he sent us some data of PayPal which were right, but I marked them as illegal. I thought, OK, this guy not the federal soldier and not at the beck and call of them. It was very important for me because depended on it, I will trust it, or not. We noted it and decided to contact the lawyer that he gave us the final answer, my companion told that he will be engaged in it. Though I doubted that we will receive the specific answer because lawyers like to receive money for any assumptions, than for the specific facts. Can be to me bad lawyers came across.
I very much would like to know whether I will be able to find something that cops or the informer will not be able to find. Something that will force their plans to fail for 100% if they make it. That for the Bowl of Graal. All this time I live with calculation that my activity will issue them. As the person who smokes a jamb with someone to make sure that it is not kopek. Or as the prostitute who asks the client: "You cop? If you the cop — you have to tell me about it."
Of course Brett Johnson was completely in dirt. However, contrary to suspicions, its return to crime to a post-fayervolnuyu began an era not with snitching. All this began with the girl.
Johnson's crimes and his cocaine habits in nine years expelled his wife. On the way to a door it broke its MSR206 so it had to look for the psychologist to cope with loss. Then Johnson met Elisabeth in the bar Northern Carolina. She was the 24th summer dancer in local a strip bar, and for Johnson became love at first sight. It burned the savings, presenting it with gifts: a purse for 1500 dollars, pair of new shoes for 600 dollars. In five months she moved to it. Nevertheless, when they made love in the first time, Elisabeth did not permit it to kiss herself.
Dark guesses of Johnson were confirmed when he found Elisabeth on the website where men shared responses about strippers and prostitutes. He read a line behind a line how his girlfriend renders services in exchange for money and cocaine. Johnson showed found it on what she, with tears in the eyes, promised to give up drugs and prostitution.
Hoping to pull out Elisabeth from its usual old way of life, Johnson began to shower with its even more expensive gifts and to drive in expensive restaurants. It was the real cause of its return, it very needed money. Good luck which selected it during the operation "Firewall" turned away from it on the eighth of February, 2005 when the police of the Charleston, in Northern Carolina, arrested him for use of false checks of Bank of America upon purchase Krugerrandov (gold coins in South Africa) and the watch won on eBay which expected cash on delivery on its hut. After a week of stay in the district center of the conclusion of the Charleston, grieving for Elisabeth, Johnson beat out appointment. After he convinced them that it was Gollumfun'om — the administrator who ran away when cops covered ShadowCrew — they agreed to help it if it works for them.
The secret service reduced pledge for Johnson to 10000 dollars. When it was released, agents transported it from the Charleston to Colombia, South Carolina where rented to it housing and paid 50 dollars a day. Now he was a daily visitor of field office in Colombia, being noted in 4 evenings and working to nine, devoting the Secret Service in depths of CardersMarket and other forums. Everything that occurred on Johnson's monitor, was duplicated on the 42nd to inch plasma that hung on a wall of office. They called it the operation "Anglerphish", and Johnson thought that once the cool book from this will turn out. That is why it registered the Anglerphish.com domain and began negotiations with the journalist of New York Times. When Manus Dai cracked its box and online provided data on its activity, secret service agents were angry. They reacted quickly, having closed it access to computers out of office and having ordered to break off contact with the journalist. Elisabeth threw it — her name and an occupation were exposed as violation.
Then Aysman deprived of it a privileged position on CardersMarket, and swindlers whom he knew since Counterfeit Library began to refuse affairs with it. Johnson left trust, and at the Secret Service the patience came to an end.
At the end of March, 2006 agents decided to act, using only one of operation ulov — the swindler from California who stole, at least, 200 000 dollars by means of frauds with tax declarations. Johnson as the specialist in this sphere, communicated with the swindler online, and the Secret Service traced their chat in an Internet cafe C&C; in Hollywood. At this time in Los Angeles the agent came to cafe and sat down in two little tables from the person who filled in the false declarations.
When the local police and secret service agents carried out a search of the apartment suspected in Hollywood, they found out that everything was cleaned: neither computers, nor other proofs. The suspect only did not recolour a wall and did not clean a carpet. Johnson's employers already suspected in Colombia that information on their informant became known after the incident on CardersMarket. Now they had all reasons to believe that he warned the purpose about the approaching search.
They decided to check Johnson on the lie detector. The line on a polygraph remained motionless when asked Johnson two questions: Whether "You contacted podozrevayevy? Whether" "Somebody contacted another podozrevayevy?" Johnson answered: "No". "No". The last question was more unrolled: Whether "You had unauthorized contacts with someone?" Johnson answered again: "No", but his skin reacted with sharp jump on the chart. Despite bans of agents, Johnson continued to conduct conversation with the correspondent from New York Times, he confirmed that he seriously was going to be engaged in writing of the book. Federals interrogated him till two in the night, and then gave him for the signature paper with the agreement on a search of its apartment rented by agency.
The search of the apartment was similar to search of "Easter eggs". Agents found a working credit card in a bedroom toilet. The notebook hidden in a toilet cabinet in which numbers of credit cards, PIN codes and data of clients were stored. Sixty three credit cards were hidden in a sock which Johnson thrust into one of boots. The container for breakfasts hidden at the bottom of a laundry basket stored in freshness two thousand dollars cash. And at last, payment cards of Kinko with which Johnson paid for use of the computer in local copy shop were stored in the same place.
It conducted threefold life from the very beginning of recruitment by agency, exposing itself(himself) the swindler at the Colombian office, continuing to conduct the life in the remained time. That fraud was Johnson's specialty that was the round-up purpose in Los Angeles. He used numbers of social insurance from online of bases, including a death index in California of recently died citizens, then filled in tax declarations from their names and received returns of funds for the card created in advance which he could cash in any ATM. On these frauds under forty one names it lifted more than 130 000 dollars, and all this the Secret Service near by.
Agents phoned to Johnson's guarantor and convinced him to withdraw pledge in 10000 dollars which released Johnson from custody. Then agents placed Johnson in district prison again. Three days later to Johnson his employer with the junior agent who was not glad to the informant came. "Before we will begin, Brett, I just want to tell, something you tell us everything that you made for last six years, or I will make everything to otymet you and all your family." — the agent growled. "And I speak not only about the current provision. As soon as you leave, I will pursue you and your family until the end of your days." Johnson refused cooperation, thus, agents remained nothing except how to begin to prepare charge. The office of the prosecutor of the USA began to work on a federal conviction. However the swindler had one more ace in a sleeve. Two weeks later he managed to recover pledge, left a pre-trial detention center and was successfully washed away.
The operation "Anglerphish" came to grief. After 1500 business hours the government remained with the run-away informant and tens of thousands of dollars in new swindle. There was only one ray of hope: the first batch from twenty nine dump of Johnson purchased by him in May for six hundred dollars. The secret service traced several credit cards in a pizzeria of Vancouver, but it was the deadlock. However, the corporate bank account of America that it was used at payment, belonged to the certain 21-year-old John Dzhianoni living in the Rokvill-center on Lond Island.
To be continued
1. The Key (Grisha, Sasha, Katya, Alyona, Sonya)
2. Deadly Weapons (Young programmers of FSB of the Russian Federation, 23 Aug)
3. The Hungry Programmers (Young programmers of FSB of the Russian Federation)
4. The White Hat (Sasha To, ShiawasenaHoshi)
5. Cyberwar! (ShiawasenaHoshi)
6. I Miss Crime (Valentin)
7. Max Vision (Valentin, 14 Aug)
8. Welcome to America (Alexander Ivanov, 16 Aug)
9. Opportunities (jellyprol)
10. Chris Aragon (Timur Usmanov)
11. Script’s Twenty-Dollar Dumps (Georges)
12. Free Amex! (Greenhouse of social technologies)
13. Villa Siena (Lorian_Grace)
14. The Raid (Georges)
15. UBuyWeRush (Ungswar)
16. Operation Firewall (Georges)
17. Pizza and Plastic (is ready)
18. The Briefing (Georges)
19. Carders Market (Ungswar)
20. The Starlight Room (???)
21. Master Splyntr (Ungswar)
22. Enemies (Alexander Ivanov)
23. Anglerphish (Georges)
24. Exposure (+)
25. Hostile Takeover (fantom)
26. What’s in Your Wallet? (done)
27. Web War One (Lorian_Grace?)
28. Carder Court (drak0sha)
29. One Plat and Six Classics (+)
30. Maksik (+)
31. The Trial (+)
32. The Mall (Shuflin+)
33. Exit Strategy (done)
34. DarkMarket (Valera of an ak Dima)
35. Sentencing (comodohacker+)
36. Aftermath (ex-er-sis?)
This article is a translation of the original post at habrahabr.ru/post/273719/
If you have any questions regarding the material covered in the article above, please, contact the original author of the post.
If you have any complaints about this article or you want this article to be deleted, please, drop an email here: firstname.lastname@example.org.
We believe that the knowledge, which is available at the most popular Russian IT blog habrahabr.ru, should be accessed by everyone, even though it is poorly translated.
Shared knowledge makes the world better.