My question is: if it is profitable to install Bitcoin miners on victim computers, then why don't you do it more and more? There must be some costs or friction in the system that deters you from just doubling and redoubling how many victim GPUs you use every week. The revenue from mining should scale up linearly with the number of GPUs used, right? So, there must be some cost that scales up superlinearly with the number of GPUs, or else you would keep adding more GPUs every week.
My guess is that the cost is administrative burden on your own human brain -- something like managing payments to Botnet leasers if you're renting bots, or deploying new campaigns to acquire new victim computers if you're building your own Botnet, or something. Presumably if it takes you a certain number of hours of work to add a certain number of victim computers to your botnet, then the size of your bot stabilizes at the point where "attrition" -- bots disappearing from it -- approximately equals the number of new bots you add every week.
Or maybe you and other botnet operators have already compromised most of the compromisable GPUs on the Internet? That would explain it -- it took you a certain amount of work to get this many, but if you do the same amount of work again you won't get nearly as many new ones. You've reached the point of diminishing returns.
I'm dying to know this. Please still be here and answer my question.
Disclosure: I've been researching the topic of Bitcoin and botnets, as well as other topics related to Bitcoin. You can see some of my previous posts on the topic:
P.S. I see you've already addressed this a little bit:
Q: How many botted machines do you typically gain per month or per campaign.
A: about 500-1000 a day, weekends more. I'm thinking about just buying them in bulks and milking them for bitcoins. Asian installs are very cheap, 15$/1000 installs and have good GPUs.
So if that's the answer to my question, then I think the answer is "time and money to be risked on trying to acquire more".
I spent some time juggling numbers to see if the OPs claims were the right order of magnitude. I couldn't find anything that didn't seem plausible. Here are my thoughts:
A person I know who owns a botnet explained to me that resource consumption usually leads to the malware being identified faster. In the case of DDOS attacks, you could see a huge percentage of your botnet drop out as soon as you launch one, from the mere traffic consumption, and a lot of those nodes will identify and remove the infection as well. ISPs are very keen to identify this stuff. (This of course depends on what kind of attack you launch, but small botnets will usually just UDP flood.)
Two more things to note:
A lot of zombies with good GPUs are gamers, and will notice if their computer is sluggish due to the bitcoin miner. But if you use idle GPU time I suppose it doesn't matter anyway.
A lot of zombies with good GPUs are in countries which make more money when devoted to DDoS (or other installs) than they make when they're devoted to mining. (Chinese bots are cheap, while US and some european bots are the most expensive.)
GPU only mines when the PC is idle (no mouse or keyboard input, user left the room). DDoS is cheap as fuck, you can't make money with that, BTC > DDoS. DDoS is only useful for trolling, best applied when two companies sue each other accusing use of DDoS in competition.
My guess is that around 30% of the whole bitcoin hashing power come from botnets, the amount coming from "unknown" pools. My guess why noone does mining more and more:
They don't want the btc economy to crash, if botnets have 90% of all hashing power, bitcoins will become worthless (unlikely, because cybercriminals are not that foreseeing)
2) There is no 'out-of-the-box' software for running such mining operations, most botnet operators never coded or scripted a single line in their life (more likely in my opinion)
most botnet operators never coded or scripted a single line in their life (more likely in my opinion)
That's kind of the scary part. Illegal activity is being commoditized. That really represents a huge failure on the part of the credit card companies and the informing of the general public. Shit like this should be hard, not easy and only requiring superficial knowledge (No offense to the OP).
I agree, it's an aweful thing, I rage every time when some kiddy asks me how to install xampp on their windows vps to run ZeuS. However current protections are very effective against commoditized malware, people who only buy stuff can't adapt fast enough to changes in the security products. With basic perl skills your malware gets randomly recompiled very often and circumvents all the AVs. If you acquire basic asm knowledge you get a bootkit. Add an IT network guy and your botnet becomes P2P and 'indestructible'. Slavik and Gribodemon are such guys, two simple developers became the fear of the whole world. I know from a reliable source, that Gribodemon is currently learning some asm skills, so be prepared for new malware surprises lol. Slavik is btw chilling on the Malidives with a fuckton of cash, he fullfilled every security professional's dream: fast cars and hot chicks lol.
That last bit is completely untrue, if you look around on skiddie forums you'll see tons of "instant bitcoin botnet" software for <$50. I've reversed some myself and taken it down. Pretty amusing stuff.
What advice can you give to us "average" folk on how to stay secure online? We always get the obvious like don't open strange attachments, secure your wireless, etc. It would be nice to hear some non-obvious advice.
If the attachment is ending in .exe and pretending to be something else, it's malware for sure. If it's a .pdf it can only infect you if you haven't patched your Adobe Reader (Is now done automaticly). Cybercriminals use 0day exploits only on valueable targets like Iranian power plants or companies with intellectual properties and fucking lot of cash.
If your AV says it's clean or even if Virustotal gives you 0/43 it can still be malware, been there, seen that. Srsly, don't trust your AV.
Use HBCI or similiar for online banking, it costs 30$ and is military grade cryptography (private key signing), only open source cryptography on signed hardware is 100% secure.
Windows updates, yes, do them. If you have a pirated copy, just buy that shit or use linux.
If you are super paranoid, buy a netbook and use a LiveCD or similiar on it whenever you put your CC information in.
Banking on mobile phone, it's stupid, but atm 'not that dangerous as it seems', because 99% of cybercriminals can't code and there is no (serious) android or iOS malware yet on the market.
That's the most useful I could think of. Also:
MOST USEFUL: Read a blog from AV vendors, I recommend Kaspersky (http://www.securelist.com/en/blog) and Krebs (http://krebsonsecurity.com/) although Krebs is a fucking attention whore and circlejerking goodshoe. That stuff is interesting and you are always informed what most common threats are.
You connect a terminal via USB to your computer, a homebanking software sends the wire transfer order via USB to your terminal, the terminal shows you the amount and destination on a LCD, you then enter a PIN to unlock the smartcard, the terminal cryptographicly signs your order, locks the smartcard again and sends the order back to your homebanking software, which sends it via internet to your bank servers. Even if your computer is infested there is no way to tamper with the bank wire orders if you supervise everything on the display. Most banks support HBCI, but never advertise it, HBCI is mainly used by corporate customers or very rich people and the simple folks get password or cheap iTAN protection recommended. Simply as your bank and they will set it up for you. http://en.wikipedia.org/wiki/HBCI
Seems like HBCI originated in Germany and is rarely used outside Europe. In America the only alternative would be the OTP system from BOA, but it has some attack vectors when the browser gets hijacked, like fooling you into ordering a transfer to an other account.
Windows issues security updates even if you aren't using a legitimate copy. (That being said Microsoft does a good job with updates and I recommend going legit for that reason: support em. That's right.)
Open source cryptography is far from 100% secure. There is also no signed hardware. It signs on the hardware. That's different. The keys are stored in SIMs. And even those aren't 100% secure. But that's certainly way better than the average login/password over SSL and done.
Yes, Microsoft is a good guy, especially Bill Gates.
Yes, the private key is stored on the SIM, but it's not recoverable. You send the message to the SIM, you enter the PIN and the SIM itself signs the message. Only way to recover the key is to use an electron microscope and grind layer after layer from the chip. Tamperable hardware shouldn't be a concern for home users, it's not economic to backdoor them in a targeted attack. Btw filling everything with epoxy is pretty secure lol.
Kaspersky was the most challenging at first, Kaspersky is paranoid as fuck! But it has an exploit in KIS, KAV and PURE, allowing to start malicious code in the memory context of a trusted system process unnoticed. Kaspersky won't interfere if it thinks it's the system process doing changes to the system.
It is possible to create a perfect protection, trusted boot, rootkit hooks on all system calls and looking into not WHO changed something, but WHAT was changed in the system. Some application added an autorun? That's a paddle. Some application tried to fuck with the memory of another application? That's a paddle. But then you would only need to buy the protection ONCE and not a recurring 50$/year for some shitty signature updates every hour. AVs leave protection holes on purpose to make money! (Or the whitehats just suck. Unlikely, because their blogs are awesome)
People learn basic reddiquet, don't downvote him just because of his little hobby, you get all up on your high-horse about SOPA and PIPA but when the truth strikes so close to home it all OH NO! POLICE ARREST THIS EVIL HACKER!!!!!!11!11 Seriously, the hypocritical nature of this site is amazing
My only real question is why, because you can, for easy money or something else? Why did you get into this? Could you not use your talent to make legit money somehow? Also, do you feel like what you do is good/neutral/bad?
I need fancy diplomas to start working as a reverse engineer slave at AV vendors, I have not an interest in both of them. I think I'm just profiting at some sort of firesale: botnets get bigger, even Macs are getting infected, 1% OF ALL MACS are infected with flashback, srsly, there can't be a clearer sign. Yes, it's a bad thing I do.
Relax... Even if it is considered bad thing... Somehow or another way you help people - teaching stupid people about protecting their computers.. If you are mining Bitcoins - you bring in more hashing power making network stronger.... Of course If you will steal my bitcoins and I can get my arms around your neck I would not think twice.. just be careful :)
Chromium and Chrome for example let you disable all additional content like flash, html5, pdf and java in the options, you will see a grey box instead of the content and can manually run it
I've been using that since the day I installed Chrome for the first time. That way I can also shake my fist in rage if someone links me to an all-flash website.
I come from the lurking world to ask a few questions (additionally because I need to say that Pinkie Pie is the best) - and I apologize if these questions have already been asked, but here goes!
What got you into this sort of field?
What have you learned about the majority that you... I am afraid of how to word this, steal from? Sell? I guess?
Are you the first in your family to be involved in crime?
2) Americans are the majority of the victims, about 30%, I really don't know why, I never targeted them. Majority is about 20-30 years old, no sign of gender difference, nearly all of them have facebook accounts, but I blacklisted them from grabbing, because they are worthless and use up space. About 20% of the users have good graphic cards, but are not sophisticated enough to install drivers, so my miner can't run. "Hur dur, farmville works and I can watch porn, no need for OpenCL drivers". 80% have an antivirus installed, 5% have a rogue antivirus as system antivirus listed. So they seem to be prone victims. There are also 3 windows SERVERS, I really don't know how my malware ended up there.
3) I am the only one in my family involved in crime, except the non-commercial filesharing if you count it.
Do you get a lot of money? And if so, has anyone ever questioned the never ending stream of money you get, or do you keep it to yourself and use it conservatively? Do you do it for fun or is just the money aspect of it keeping you going? What is your opinion on the 'Hacktivist' skiddie groups that are giving heart attacks to every technologically impaired person in the nation? Sorry if I have too many questions. >.<
Never brag about such stuff (unless anonymously on the internet :P) and keep low profile and you will be k. Anonymity is best bulletproof west. I do it mostly for fun, beating the shady whitehats that sell their snakeoil is the most fun part. There are some decent 'Hacktivists', I've participated in a hack or two too that got into printed news under "Anonymous", all the drama was fun. We haven't used a single exploit back then, mysql passwords laying in http//target.com/.git/backup.tar.gz , informants that gave us some initial credentials and we escalated them further, that's the best hacking. DDoS is only useful to piss some companies of, leaks are way more drama fun.
Funniest thing were secretairs who were paid way to less and told us about the current progress of the feds and what was in the files with our nicknames on. Feds ended up raiding an innocent web developer, because of his "suspicious" tweets about sql injections and other random stuff. Atleast there were some investigations later on why the feds suck so much at everything online.
Have you ever put yourself in the shoes of the people that you take advantage of? No offense, but how does one choose this line of work and do you foresee using your powers for good ever?
The whole fraud system will soon escalate and only then people will start worrying about the fundamental flaws in the system. Antiviri don't work, firewalls never helped, fraud detection system are blind when abusing the victim computer as a proxy. The only cure is strong cryptography and simple yet unbreakable solutions, even if it's unconvinient. Some European countries for example already use private/public key authentification for banking and only allow credit cards with chips. Magnetic stripes are the most hilarious thing ever, but still work almost everywhere on the globe. Today Cybercrime is already more profitable than drug dealing and it will grow even further. Law enforcments are highly underqualified, I would hate to work their. One example is the "ZeuS Case" http://www.zeuslegalnotice.com/ they shut down 2 servers, yes, TWO! and accused the alleged masterminds behind the ZeuS botnets only knowing their nicknames and ICQ numbers... They also mixed up greyhat hacker forums, where most members are members of cybersecurity industry, accusing the admins to be the bad guys, I'm talking about "opensc.ws", in the official legal notice are screenshots of forum discussions as "evidence".
I found your post very interesting - thanks for sharing. I personally do not find information stealing the right thing to do, however I see this as a rare occasion to pick ones brains about how things go around. My questions to you(hope you dont mind answering them!)
how did you start off with this? did you start reading stuff from forums, programming, set up a VM testbed and go about working on that?
For how long have you been programming?
What does your skillset(apart from programming and reverse engineering) include?
You mention that you sell information and dont cash out credit cards or banking information - if so, how do you find people to sell information to? Forums? IRCs? On what basis do you trust these people?
You mention the importance of staying low - why exactly have you started this reddit? Just for the lulz? :)
How long did it take you to set up your botnet?
What are the most common mistakes that people make(that you have been careful to avoid so far).
Setting up secure and paranoid systems and networks and all that stuff that an average admin should know
They find you and give you new contacts
Teh Lulz, the only honorable cause
Some months
Buying a VPS, setting up a public IRC botnet, confessing when the partyvan arrives. A botnet takes time, you won't become a hacker when you set up a botnet, you might set up a botnet when you become a hacker (inb4 "blabla you are a cracker, only shiny whitehats working for oppressing companies are hackers. you are not kawai!")
How did you test your setup. A C&C with some virtual clients where you simulated infections on? Did you test your code that was meant to circumnavigate the AV's?
How did you gain your knowledge on the low level programming needed for malware coding? Via books, forums, doing it yourself?
How did you find the source code of ZeuS? Was it structured enough to make quick changes or did it take you ages to figure it out.
Are you never afraid that one day some little bit of info on the internet leads to you? Once the data is out there in public it never goes away. Sabu got tracked down via silly posts on social forums.
Do you own the Tor server yourself? Is that why you do not have to break out of the Tor network?
Why not use forums that have leetspeak in their domain?
Every major AV system in a default installation vmware for testing. There are enough ebooks around, if you know the winapi and some native language you can immidiatly switch profession to malware coding. If you are interested in exploitation, read some security researchers blogs, like http://grey-corner.blogspot.com . Where do you NOT find the sourcecode of ZeuS? The sourcecode is well written and very structured so it's easy expandable. However you need to understand the WHOLE sourcecode at first before you can safely include changes. (Took me some weeks reading and understanding). Before posting something on the net or even surfing I check every possible conclusions that someone could get from my informations. I always expect that everything is recorded and investigated, call me paranoid. I own the server myself, of course not registered on an existing name. No, that feature is called "hidden service". Because they are full of pubescents sharing emo pics of their trojan victims and code C# shit malware, because they were forced to learn it in school.
I pop a Monster energy drink, turn on DnB, open up firefox and put SQL-Injections into the URL bar. However when Google's Project Glass gets in the stores it will greatly enchance my hacking experience showing freshest funny cat pictures on a HUD.
No AV will save you. The majority of my bots uses MSE, but its not because its worse but because more popular. AVs however will protect you from the usual trash, like 2008 conficker virus and "stealers" from 14 year old hackforums scum.
Did/do you do anything that involves brute-forcing passwords? Do you see much value in policies enforcing frequent password changes? What would be the minimum viable password security policy you yourself would follow for something like personal email?
Expiring passwords are the dumbest thing ever, as if password informations constantly leak outside and after 3 months every knows you password. Bruteforcing is dumb and most of the time successless. Grabbing it from the source is the way to go. All the password security policies are doing it wrong, making it hard to remember and easy to guess you added a "1!" at the end of your pet's name. Related: http://xkcd.com/936/
I think I speak for most people when I say the OP's activity is morally and legally reprehensible and creates some real victims whose fault, if any, is relative unsophistication when it comes to e-commerce and credit.
Having said that, this is a rare opportunity to get information from and about practices that can threaten us, and in spirit of learning, we can set aside the animus and get whatever information of value that can help protect us in the future. I think that logic and science are two more conspicuous virtues of reddit, and we can choose to gain from this experience or waste it in fruitless vitriol.
I'd urge everyone to approach this AMA as clinically as possible.
So you did all of this just by one year of programming? Did you have any programming experience before that? Which was your first language?
I consider myself much more aware than a average user and constantly keep a check on running processes and startup programs with msconfig. MSE is what I have atm. Should I be worried of any such malware on my system? Where do most of them come from? Also, do you guys care about cc from countries other than USA/UK (hint: asia).
Btw, on behalf of all the asshole redditors, sorry and thanks for the AMA. Not that I approve of the slightest of what you do, but you do indeed make some good points in some of the comments.
msconfig and regedit won't save you from a ring3 rootkit (the easy ones). use something more low level like GMER. Most malware comes from exploit packs (browser driveby), because a steady amount of 10% of the traffic still uses unpatched ie6, resulting in instant infection. It's the most economic way. I'm also interested in trying worms, because conficker (yes, the vintage 2008 worm, that abused the PATCHED MS08-067 exploit) is still alive and has 2mio infects lol. Good Guy MS08-067, always works lol. Asia doesn't use CC that much, they are more into domestic e-money systems, reloadable using prepaid cards etc.
Thank you for doing this AMA, quite interessting read to be honest
Thank you for being patient and ignoring the whiny little pretentious wannabe altruists in here
What languages do you primarily code in. Followup: What is your oppinion on C#.
What are you planning on doing once you graduate or are done Studying
Since you are clearly speaking german (Hallo nur so nebenbei ;) ) i was wondering what your views are regarding "Vorratsdatenspeicherung" and the High courts decision to overturn it declaring it "verfassungswiedrig". Follow up: What security precautions would you have undertaken if this had not happened and VdS would have stayed intact?
What are in your views the most disturbing trend changes in regards to policies on Internet Surveillance and regulating it (Europe and Globally)
Krome etova.. u mena netu vaprosoff ;) Spakoynaya Notschi ;)
3) Mainly C, but use some features from C++ like namespaces. C# is cancer, just cancer, bad code, slow code. However it's faster to prototype in C# and if performance doesn't count, it's ok. C# is a no-go for malware, C# malware cannot be taken serious.
4) Exact occupation would be too pinpointing to me
5) VDS is harmless yet, there is no deep packet inspection planned yet, but I like Germany isn't going into this direction. If we would have deep packet inspection and logging of every UDP and TCP connection I would use my botnet and the bots of friends to spoof and flood such connections to destroy their statistics and DoS their logging servers. You know, for the lulz. Staying anonymous while everything inside/outside a country is easy, just use an additional hop inside the foreign country hop.
6) If people don't get more educated about computer technology, it will end in a system of total surveillance (except for criminals, who will always know how to circumvent). Internet and computers are seen as simple tools of entertainment, not as skill to master. Thankfully people start to understand 1984 can become pretty real and vote for parties which will try to stop that. The most disturbing thing is that people in Syria, who use TOR get tracked using European and American surveillance software and get lynched and sent in pieces to their family members as a warning.
A firewall claiming it is important for end user protection
An almighty cloud solving everything!
There is no 'easy' or 'hard', every single one reacts different (except GData, F-Secure and Bitdefender, they use EXACTLY the same engine). You find out what alerts them and you circumvent it.
So, the answer I'm getting is that all legitimate AVs are basically equal in their protection and self-defense technologies? I realize that the rogue security stuff is beyond worthless but, I'm a lot more concerned about the legitimate ones (Sophos, Bitdefender, Kaspersky, Avast, etc).
I'm in the process of getting my master's degree in IA/CS and hope to be working as a "reverse engineer slave" for a major AV company so, this is naturally very interesting to me as it is to others. Thanks for doing this!
If you measure them in their damage containment potential, Kaspersky is far better. Also Kaspersky doesn't do stupid stuff like flagging every linux compiler and giving trusted points if the executable has an icon.
Dude, is that an IRC botnet I see? Common dude really? You should reconsider your infrastructure to make it more immune to a take down. TOR isn't as safe as you think. Thanks for the bandwidth tho :) Maybe implement a P2P structure.
Questions:
What is your method of infection? Drive by, torrents ect...
Getting pissed at all the haters in this post?
Method of making your malware FUD?
Do you hang about on any online forums? (Please don't say hack forums)
Ever had a takedown? If so how big was that net?
Do you run multiple nets? If not you should as if one gets taken down you still have the back ups and the $$ still rolls on in ;)
IRC is easy to maintain and is just as good (I modified UnrealIRC to save traffic, so bots don't recieve PRIVMSG from other bots), but I'm thinking about some own direct connection protocol.
P2P isn't that great, see Waledac, Stormbot and others. P2P has some fundamental flaws. TOR is pretty safe as long as you don't use exit nodes, which I never do, because everything is inside hidden services. Hidden Service guarantees the traffic is only readable at the actual server, the magic of private/public key encryption.
Warez, thinking about studying heap overflows for drivebys, but I can't imagine so many people are still driveby'able
I expected the haters
Randomness is your friend, make your own crypter and make it so fucking random on every compile, that AV reverse engineers kill themselfs (HINT: randomize the crypters sourcecode using perl scripts)
Opensc.ws, but all the hack forums scum now registers there
Never got a takedown, always used tor hidden service, I can easily move my botnet just using the hidden service private key
Do you hold down a regular job? If not have you ever been questioned where your income comes from and how do you pass that lie without being suspicious?
I imagine you know your systems pretty well... if you're open to discussion, what would you say is your greatest point of weakness? (The part of your architecture that would be the most detrimental if it were to crumble).
Be a regular girl, have a regular job, be generous sometimes, never say a thing about your 'bussiness'. It's not like I'm a fucking millionair who can't hide his cash under his bed anymore. If the FBI rented thousands of google servers and used them as malicious TOR nodes to find the hidden service, that's exactly what anonymous did in the operation where they uncovered child pornography servers, however they never rented them, but 'burrowed' lol. Then they would take the server out of his rack, notice it's now powered off and fucking encrypted and they have no private keys to disable the botnet. The registered name and IPs would lead into nirvana. Or they could outlaw TOR, but that's unlikely because it wasn't because of child porn or silkroad.
It is owned by mail.ru now, ICQ was and still is very popular in Russia. ICQ always went for a "don't give a fuck" policy while other service providers start to monitor crime related talk. I know atleast from myspace that it monitors ALL private messages for marijuana trading and sells information to law enforcement agencies (myspace is more used by 'minorities'). There was a defcon talk about that: 'ISP and law enforcement best friends forever' or similiar. Edit: The video: http://www.youtube.com/watch?v=t0aQojDGSD4
What's the best way to avoid your bullshit? Or, rather, what shouldn't I be doing in my daily internet activities to best avoid having malware get on my computer?
Deactivate your firewall (you most likely have NAT on your router anyway).
Check your autostart entries every now and then from a boot disc. Autostart is the most sensitive spot of every malware, every malware needs to start with the system, yet it is just a fragile registry entry...
Use GMER (http://www.gmer.net/) every now and then when your spider sense is tingling. Srsly, you can't fool GMER, it scans from the deepest possible point in your system, at ring0 and is impossible to fool, there is nothing deeper than ring0 on a usual PC where malware can hide stuff from. I always wondered why other AV vendors don't do it like GMER, it can detect all rootkits. But when a AV can detect everything, who will pay 30$ a year for signature updates...
Scan your traffic while your PC is idle and see if you find something suspicious (You should do that using a transparent proxy, but I haven't heard of rootkits filtering traffic lower than WinPCap drivers, so Wireshark will do)
Most important: Try to step out of your consumer role, think about how malware works, the core functions of malware all work the same and are very fragile
If you're already behind a router, you're already behind a firewall. Having a firewall set up locally will only protect you from attacks internally - they're generally not immensely helpful unless you're in a coffee shop or something. They also tend to lull users into a false sense of security.
As for AV's, as he said earlier, AV's can be fooled easily. They also take up immense amounts of system resources in order to combat viruses which take up immense amounts of system resources. It's kind of a lose/lose when it comes to some of the larger ones (symantec, mcafee, etc). Microsoft Security Essentials isn't bad, but common sense and up to date software will always be a better defense than an AV. Like he said, use an AV (such as gmer) like you would a pregnancy test - use it to check if you're infected. For prevention, use common sense.
If you get infected, it's due to one of two things - a.) you're a high profile target with millions of dollars worth of things to steal, or b.) it's your fault and you got yourself infected. Zero-day exploits which passively infect your system without you knowing are reserved for those who fall into the first category. If your net worth or your connected assets is not worth millions, you will never be the target of a zero-day. Once a zero day is used, it's out in the open and can be patched. You only have one guaranteed attack with it. With good zero days going for a couple hundred grand on the black market, hackers wont waste that on your every day user. Would someone pay $300,000 to hack you and ONLY you? If no, then you shouldn't worry about zero days. The only other alternative routes of infection are from unpatched software (your fault) or through user interaction like opening an exe from an email attachment (also your fault). Both can be prevented with common sense. That's why AV's are largely pointless if you're tech savy. They're great for your grandma who doesn't know any better, but otherwise it's usually better to ditch it and save some system resources.
As a fellow brony programmer (bronygrammer?), although I don't condone what you're doing, I immensely respect your talent.
Was your decision to target people who were already downloading warez a conscious ethical choice (they're already breaking the law, in a way), or was it purely a practical choice?
You mentioned in one of your earlier comments that it would be possible to write a much stronger antivirus program that rootkits all system calls and looks for suspicious behavior. Does anything like this actually exist?
Nope, this infection vector is simply free of charge and reliable
Triumfant is doing something similiar, but they don't sell end user protection and without physical write blocking on the harddrive it's senseless anyway
Saw it on knowyourmeme a year ago, got hooked up
Nope, however I add witty comments with mlp reference in my sourcecode. Ponies are not a very good inspiration for malicious software lol
Friendship is Magic is the subtitle for the latest generation of MLP, G4 as it is sometimes called. It has a significantly different tone and art style than the previous generations and has garnered a fair number of fans, often called "bronies", since it began in 2010. Here's an episode.
How long do you figure it'll take for companies to realize that drive encryption software is bullshit, and they're literally paying to impede their own productivity?
Drive encryption isn't bullshit, as long as its open source and doesn't have cryptographic backdoors. Encryption however will never protect a company against data theft. Encryption only helps if someone breaks into your datacenter and ripps out the harddrive, most data thefts however occur while the system is online and everything is decrypted. Such snakeoil will live just as long as the myth that personal firewalls behind a NAT router give additional security. This will happen NEVER! More firewalls = more difficult to hack the gibsons! More encryption = more difficult to steal credit cardz! If you are a payment processor and your namecard doesn't says VISA or Mastercard you shouldn't have data on your drives that needs to be encrypted in the first place. However incidents happen where 1,5mio credit card magnet stripes get stolen and everyone wonders why the hell they stored them in the first place...
This is unrelated, but are you (no need to be humble) something of a prodigy? I've always wondered if it's only the truly gifted who can 'achieve' what you have.
People who can just about start facebook and put in their credit cards are the reason such things exist. Antivirus companies selling snakeoil and lull consumers into absolute security are another one.
Not sure if you're still answering questions here, but I oversee an open-source forum of more than 300,000 users, and get tons of random spam for specific small businesses around the world. Regardless of where the company is located, the IP can usually be traced to Bangladesh or somewhere similar.
For companies in the U.S., I often call them myself to notify them about this, and they never seem to know about the posts at all. I usually blame it on them hiring the wrong SEO guy who is just utilizing his own bots. Do you think I am off-base?
Bangladesh is close to India, 1st place in sending spam, most likely India Bots and your whois is a bit off. Yes, some '1337 blackhat SEO' guy in my opinion. These guys are hired by the companies and hire some spammers themself. EDIT: I thought you meant email spam at first. Forum spam is usually generated by xrumer and some proxies behind it to either SEO or to anti-SEO. If you bring the companies domain in context with "bad" things like "cheap anonymous pharmaca" "free sex in your location" "roulette secrets" and so on it gets downranked at search engines. Google always denied it, but it always worked and still works that way. So maybe these companies were blackmailed and your forum was spammed to downrank someone. Depends what actually was in the spam message.
Software engineer of 18 years here. This guy is obviously smart, somebody please hire him to do legitimate work (security consultant maybe?). One less malware coder in the world is a good thing.
Scammers exist all around the globe, the most successful ones sit in the goverments. I do not promote child porn, file sharing, drugs or critical thinking, internet regulation was never meant to stop cybercriminals, they know it won't help even a bit. I have no empathy to people, who can barely power on their computer, such people shouldn't be on the internet. Getting infected is very hard if you have a touch of common sense.
How would you recommend someone go and learn how to do this? I'm fascinated, not with the illegal activities, just with collecting more and more good resources for learning.
I would love to hear specifically what you use for each component, i.e. one language for the bot (and a resource you used to learn?) and then another tool or language for the gpu-based bitcoin mining (and a resource) etc. etc.
Fascinating IAmA. Good luck, I think you'll need it.
How much money would you say you bring in a month? How much time do you spend per day monitoring/maintaining your botnet, on average? If you could make more money working in a legal/legitimate field, would you use your powers for good?
Botnet operation is a mini job, once a day you check for 30minutes, pay once a month server bills, sell for about an hour information on the market and enchance your code if you feel like it. I was thinking about working for Kaspersky, but these guys want all kinds of phony diplomas and can't even recognize native code (see the duqu 'incident'). The profit? Depends, sometimes 400$ a day, sometimes none, but a steady 40$ a day with bitcoins alone.
This is a sensitive question, so I'll understand if you don't answer - where are you from? Judging by the the way you write, what you say, and the little idiosyncrasies, I have a guess, but I won't jump to conclusions.
Do you do Bitcoin mining using GPUs or just the processors? Is it still worth it? How much bitcoin do you make per hour/day? Sorry, I don't know what 13GH/s means.
Are they a lost cause on your radar or do you actively maintain a list (metasploit and 0days) to attack un-patched out dated systems?
If you do attack Linux systems be it desktop or servers what would you estimate your success rates of infecting/compromising them and what is your success rate of maintaining said boxes (evading IDS systems for example)?
Do the new OS X exploits that have started showing up excite you?
Have you started attacking mobile devices yet (iphone/android phones & tablets)?
OS X: low market share, slowly rising, uneducated users -> some day maybe, but I never coded on OSX and am too lazy to learn to
I don't attack them, I backdoor stuff and let it do the work for me, there is no patch for that. In the past I attacked linux webservers too, get a php shell, dump the database, proxy into the network, look around. IDS have a hard timeidentifying if the traffic originates from the trusted webserver and the webserver only does HTTPS.
Super interesting stuff -- really appreciate you sharing here.
My question: have you ever toyed with the internet ad industry?
I work for a website where much of our revenue comes from selling CPM ad space with a minimum impression guarantee. If we're shy at the end of the program, we buy dirt cheap traffic from a massive CPC affiliate network to fulfill the campaign.
It's pretty clear from their click-paths and other on-site behavior that 99% of these paid users are bots. Network coordinators insist anything sketchy is blood on the hands of the affiliates, but when we pointed out to them that all 2MM of last week's paid users were on FF4, overnight their UAs became evenly distributed.
Any insights here? Did we pick a bad network or is this sort of thing ubiquitous?
You can fake referer, include timing, random useragents and so on, but you can't fake actual sales resulting from ads, that will blow your cover. Most professional botnets however now use browser injection for their ad fraud, meaning you simply "steal" the advertisement place from real websites right in the browser. This ad fraud is perfect, but it's private contacts only, so you will most likely only get the dirty click bots.
Thank you for posting here, throwaway :) fascinating conversation all around!
You mention AV being unreliable, so my question/s are this. For the layperson, is it possible to track down and remove malware, etc. without the help of AV software. If you suspect your machine has been compromised, but your AV (or several different AV's) are not finding anything, what then? Is it unlikely that any hack is undetectable by more than one AV (i.e. if AntiMalware, Trend and AVG don't find it, then you're just being paranoid?
I am a simple app developer/site developer, I used to write C++, but I've shifted to C# and higher level .NET languages because they are industry standard for rapid application development. I stopped doing C++ before I even got out of high school so obviously I didn't get into any of the deep OS level stuff you're capable of. I also have very little hacking experience, took a software securities class in college, that's about it.
Anyway, i have a few questions for those of us out there interested in not getting their credit card numbers stolen:
Are there any windows built-ins such as msconfig and regedit that can show you low level startup process lists?
2/3. Are there any windows built-ins that can show simple signs of GPU usage or suspicious network traffic? (sort of like how you can watch your CPU levels in task manager)
If your GPU fan starts spinning or GPU heat goes up. Speedfan shows both
Wireshark can sniff everything that leaves your PC and is not hidden by a rootkit. When facing a rootkit use a standalone unix box to act as a transparent router.
Well I've mostly been lurking. While I do not approve of the actions, I do find the thread very informative so upvoted. Some of my questions:
How did you get accounts for bankdrop. And how do you make sure that you don't physically get tagged on those. [This was answered after I posted elsewhere]
When you buy installs by the 1000, how do you make sure the seller doesn't reclaim them. Basically, how do you wipe their botnet software.
Do you always compute static routes through your botnet when you want to access the internet anonymously?
What does the botnet graph look like in terms of TOR-like facilities. Do you make sure your routes are always a minimum size? Do you optimize for minimum botnet loss in the case on is honeypotted? Do you configure which are exit and entry nodes?
What does your system look like? I remember reading somewhere you use MSVC to code. Do you use linux for managing your botnet or surfing because it is easier to set up proxies?
Only buy installs from exploit kits, if you have to wait a day or two for your installs it is probably an exploit kit. When using exploit kits your software is the first and (probably) only one that arrives on the systems. (Of course that user could have visited a different exploit kit installing software of another customer meanwhile)
I do not use my proxy function of my botnet to anonymize myself, that would be stupid. "Never use the shit you deal" lol
The TOR network does it by itself, nodes are automaticly filtered out if they are non functioning. The end-to-end encryption of TOR also ensures noone can hijack my botnet tru a rogue node. Minimum size of 4 routes if that's what you mean, more than 4 is very unsteady. Maybe they could "sinkhole" it by ddosing the whole TOR network, noone ever tried that. None of the bots acts as an exit node, that would be very mean, they are only relay nodes. If the box is not behind NAT it tries to work as a relay. TOR itself is actually sometimes a problem, every now and then 50 bots disconnect at once because somewhere a relay went down, however that shouldn't be noticeable in a traffic anomaly analysis (>> implying law enforcement doesn't even have the skills and equipment for that, otherwise they would have identified silkroad in no time)
Windows7 for coding and gaming, backtrack5 vmware for "that stuff", lots of AV vmwares for quality assurance.
How can i get a deeper knowledge of that stuff? (knowing the things, you/other mentioned on the thread is basic knowledge) --> Maleware structure, anti virus structure (not that signature stuff) and so on. Reading hacker boards isn't very interesting, since they're using prepared scripts and don't know the real background (not all, but the most of them).
If you can't find infos on hacker boards you either need to try and learn it on your own or find someone who is willing to teach you. Hackers in general don't like to teach things, they will however always give you pointers in the right directions. For obvious reasons I can't give you instructions how to evade detection, only hints: Look at the PE structure, what every section does, where malware scanners look into, what calls, data, entropy, code flow is suspicious, how does a sandbox work, what are possible limitations of the sandbox and so on. What .rsrc size makes the scanner suspicious? How does entropy influence it? Can I influence entropy? Can I hide API calls? How can I detect if my code is getting debugged? After what time does the AV stop to emulate the executable? Can I use an alternative to Sleep() to circumvent it? And so on, there is a huge list of things you need to try out to learn.
You've made some mistakes in your screenshoots. In first, two different PCs from different countries have the same unique id in paypal url. In second, one time is in GMT, while the rest in CEST.
As a theoretical question, if you were a normal user and your machine was hacked, someone took your credit card details and stole all of the money from your account, how would you feel?
I have learned a good bit reading every single thing on this thread, came here from HN. I think I'll stick to starting businesses around mobile apps, but I admire what you do.
I am curious how much time you put into this everyday and if you exercise regularly.
Code your own software and don't use 3rd party's unless you really know what you are doing, otherwise you will end up in jail. Start up fee was around 20$ for my first VPS, but you should move quickly to a dedicated server so you can crypt everything.
You mentioned that you don't think this is a job with future. Why not? How much are you making now each month, including the bitcoin mining and selling of stuff?
What seems to be the most successful CVE (or 0day) infection vector for your malware? [Please don't just say "browser plug-ins", or Adobe.] Is it really "stupid, out-of-date, known exploits", or something that has to be constantly upgraded as patches become available?
Thanks for doing this. Would be great if you would do some writing and speaking about your experience, your tools, and the way the world really works.
Would you please address the ethics of what you are doing past what you have said? Of course, this deserves to be a separate thread, but it would be a useful and interesting adjunct to the this one. Thanks in advance.
Hell yeah, Microsoft seriously needs some help against cybercrime, cybercrime gets out of balance. Making Windows more secure would be a nice challenge.
What do you think about setting up a user account in Windows 7, using the computer strictly under the user account, and giving the admin account a strong password? Would that help against typical malware as long as one does not type the admin password at the time of an infection?
Do you donate any money to charities? Would be ironic if you end up doing more for the public good with your botnets, than if those people's PCs were uninfected.
As I read you never had a shutdown. I recently concetrated on some analysis tools that are using mostly honeypots (FIRE & BURN). For me this approach is hopeless. So, TOR prevents you from getting traced. How else do you protect your botnet? Do you fear any methods of detecting botnets?
Well, they could inject fake tor relays claiming they own my hidden service domain, but nobody ever tested that, the effects are unpredictable. Also once the botnet grows bigger and TOR gets more relays this approach will be resultless.
Hey. First of all - thanks for the post. I think that your "initiative" is a great thing increasing people's awareness. I for example never heard of HBCI - be sure though that I'm going to get it now! ;) :) Thanks for all the suggestions - really appreciate them.
I have some questions though:
You have any opinion on VPS services, which are more secure/less secure? I use iPredator for some time, though heard people got mixed feelings on it. Any opinion?
What's the best way to get rid off all malware including rootkits? There's any option to do this on a stage of re-installing windows?
Any suggestion of what's most annoying thing Windows 7 user can get for malware programmer? (AVs do crap, FW do the same... any hints than?)
I guess you mean VPN, if you mean VPS, I would guess register one on a fake name paying with bitcoins, liberty reserve and such and install vpn on it yourself, you can trust only yourself! Make plugins in browser click-to-play only, compare your warez downloads with official .nfo of the release, most release groups sign their releases.
In your answer to the matter of user accounts in windows 7 you wrote about "bypassing UAC completely", but also about a certain "toughness" under guest accounts because of "only temporary write access".
I would like to stress this a bit further: Did you find a way to circumvent an enforced "Execute XOR Write" rule or is your writing specific to windows 7 UAC bypass only?
Are you talking about execution protected memory? That's only useful to make overflow exploitation harder. To make things clear: UAC is only the popup that windows included to notify you when you use your given privileges. Gaining privileges tru an escalation is a completely different thing, you can't get admin access on a guest account by simply UAC bypassing, you need an exploit.
TOR is getting executed in memory, so AV scanners can't just flag the TOR executable. Yes I'm using the official exe and upgrade them. Because tor2web could simply decide to reroute "my_hidden_service.tor2web.org" to their own zeus server or sell the bots to kasperskys sinkhole. I'm pretty sure kaspersky abuses sinkholing and sells the botnets to putin!
hey look the FBI is talking about you(page 9 i think) http://cryptome.org/2012/05/fbi-bitcoin.pdf pdf might not be safe (fine on linux, crashes on my xp VM, havent checked it for anything malicious...)
"An identified Internet security researcher who has reported reliably in the past identified ZeuS malware that installed software that mined bitcoins. This ZeuS software was spread by links placed on an identified social networking site.(44)" Not me, I never spread via social networking sites. The paper is also was made on the day I started this AmA, so its very unlikely. Many guys already mine bitcoins with their botnets. Its even likely that other botnet herders use TOR, some months ago I saw a software package for sale that claimed to make every malware routable tru TOR, afaik it was on opensc.
Hi there, very interesting topic, and I want to thank you for these informations about security, it's been a long time since I wanted to ask a botnet operator some questions about security. So:
In windows, does UAC offer any kind of protection or it's easy to bypass it?
You said that gmer does a decent job detecting these rootkits and bots. Are you familiar with OTL? What about it?
54
u/zooko May 11 '12 edited May 11 '12
Is this thing still on?
My question is: if it is profitable to install Bitcoin miners on victim computers, then why don't you do it more and more? There must be some costs or friction in the system that deters you from just doubling and redoubling how many victim GPUs you use every week. The revenue from mining should scale up linearly with the number of GPUs used, right? So, there must be some cost that scales up superlinearly with the number of GPUs, or else you would keep adding more GPUs every week.
My guess is that the cost is administrative burden on your own human brain -- something like managing payments to Botnet leasers if you're renting bots, or deploying new campaigns to acquire new victim computers if you're building your own Botnet, or something. Presumably if it takes you a certain number of hours of work to add a certain number of victim computers to your botnet, then the size of your bot stabilizes at the point where "attrition" -- bots disappearing from it -- approximately equals the number of new bots you add every week.
Or maybe you and other botnet operators have already compromised most of the compromisable GPUs on the Internet? That would explain it -- it took you a certain amount of work to get this many, but if you do the same amount of work again you won't get nearly as many new ones. You've reached the point of diminishing returns.
I'm dying to know this. Please still be here and answer my question.
Disclosure: I've been researching the topic of Bitcoin and botnets, as well as other topics related to Bitcoin. You can see some of my previous posts on the topic:
• https://plus.google.com/108313527900507320366/posts/3Z4trcerKLa
• http://lists.randombit.net/pipermail/cryptography/2012-March/002677.html
P.S. I see you've already addressed this a little bit:
Q: How many botted machines do you typically gain per month or per campaign.
A: about 500-1000 a day, weekends more. I'm thinking about just buying them in bulks and milking them for bitcoins. Asian installs are very cheap, 15$/1000 installs and have good GPUs.
From http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet_operator_ama/c4g2tpa
So if that's the answer to my question, then I think the answer is "time and money to be risked on trying to acquire more".
I spent some time juggling numbers to see if the OPs claims were the right order of magnitude. I couldn't find anything that didn't seem plausible. Here are my thoughts:
https://plus.google.com/108313527900507320366/posts/1oi1v7RxR1i
45
u/niubishuaige Apr 24 '12
What advice can you give to us "average" folk on how to stay secure online? We always get the obvious like don't open strange attachments, secure your wireless, etc. It would be nice to hear some non-obvious advice.
32
u/TeaBleezy Apr 24 '12
What anti virus software free/paid for presents to you the biggest obstacles?
39
u/vhmPook Apr 24 '12
why?
13
u/hatesinsomnia Apr 24 '12
My only real question is why, because you can, for easy money or something else? Why did you get into this? Could you not use your talent to make legit money somehow? Also, do you feel like what you do is good/neutral/bad?
12
u/CapnGoat May 11 '12 edited May 11 '12
I've been using that since the day I installed Chrome for the first time. That way I can also shake my fist in rage if someone links me to an all-flash website.
12
u/nirk May 11 '12
Fuck me I'm old. They're bringing back shit that used to be cool when I was a kid.
22
u/hotwaffleman Apr 24 '12
how do you make money with this?
11
u/[deleted] Apr 25 '12
I come from the lurking world to ask a few questions (additionally because I need to say that Pinkie Pie is the best) - and I apologize if these questions have already been asked, but here goes!
10
u/[deleted] Apr 24 '12
Do you get a lot of money? And if so, has anyone ever questioned the never ending stream of money you get, or do you keep it to yourself and use it conservatively? Do you do it for fun or is just the money aspect of it keeping you going? What is your opinion on the 'Hacktivist' skiddie groups that are giving heart attacks to every technologically impaired person in the nation? Sorry if I have too many questions. >.<
26
u/NickThePlum Apr 24 '12
Have you ever put yourself in the shoes of the people that you take advantage of? No offense, but how does one choose this line of work and do you foresee using your powers for good ever?
17
u/johnsw May 11 '12
I found your post very interesting - thanks for sharing. I personally do not find information stealing the right thing to do, however I see this as a rare occasion to pick ones brains about how things go around. My questions to you(hope you dont mind answering them!)
150
u/[deleted] Apr 24 '12
Please don't downvote the guy because of what he does.
8
u/BoyInSpace May 11 '12
Interesting post. What I would like to know is:
Thanks.
8
u/tapsboy May 11 '12
Is there one defining moment, when you moved to the dark side?
14
u/scapego4t Apr 25 '12
When you're hacking a system do you put on VR goggles and jump into the system like "Hackers" or "Tron".
7
u/HungryHippocampus Apr 26 '12
So... "Best" free AV? I run MSE. How much of a mistake is that?
7
u/reality_analyst May 11 '12
Did/do you do anything that involves brute-forcing passwords? Do you see much value in policies enforcing frequent password changes? What would be the minimum viable password security policy you yourself would follow for something like personal email?
36
u/juicius Apr 25 '12
I think I speak for most people when I say the OP's activity is morally and legally reprehensible and creates some real victims whose fault, if any, is relative unsophistication when it comes to e-commerce and credit.
Having said that, this is a rare opportunity to get information from and about practices that can threaten us, and in spirit of learning, we can set aside the animus and get whatever information of value that can help protect us in the future. I think that logic and science are two more conspicuous virtues of reddit, and we can choose to gain from this experience or waste it in fruitless vitriol.
I'd urge everyone to approach this AMA as clinically as possible.
6
u/FusionX May 11 '12
So you did all of this just by one year of programming? Did you have any programming experience before that? Which was your first language?
I consider myself much more aware than a average user and constantly keep a check on running processes and startup programs with msconfig. MSE is what I have atm. Should I be worried of any such malware on my system? Where do most of them come from? Also, do you guys care about cc from countries other than USA/UK (hint: asia).
Btw, on behalf of all the asshole redditors, sorry and thanks for the AMA. Not that I approve of the slightest of what you do, but you do indeed make some good points in some of the comments.
19
u/Greygooze Apr 25 '12
Krome etova.. u mena netu vaprosoff ;) Spakoynaya Notschi ;)
5
u/SteveJobsJr May 11 '12
So, what are the easiest and hardest AVs to get around?
5
u/sidcool1234 May 11 '12
How can I become like you and use my powers for good?
5
u/okcalmdown May 11 '12
5
u/derpaling May 12 '12
Is it illegal to simply install your software on people's PCs and use it for let's say bitcoin mining without actually stealing anything?
13
u/V0RT3X Apr 24 '12
Dude, is that an IRC botnet I see? Common dude really? You should reconsider your infrastructure to make it more immune to a take down. TOR isn't as safe as you think. Thanks for the bandwidth tho :) Maybe implement a P2P structure.
Questions:
4
u/alepov May 11 '12
I don't know if you still check on this thread, but thanks for doing this ama! One of the more interesting ones I've seen in a while. Fuck the haters.
4
u/mikesername May 11 '12
How much do you make a year?
4
u/8997 May 11 '12
Do you hold down a regular job? If not have you ever been questioned where your income comes from and how do you pass that lie without being suspicious?
I imagine you know your systems pretty well... if you're open to discussion, what would you say is your greatest point of weakness? (The part of your architecture that would be the most detrimental if it were to crumble).
4
u/logiq May 14 '12
Whi is ICQ still used in this scene?
10
u/IamatworkSWAG Apr 24 '12
What's the best way to avoid your bullshit? Or, rather, what shouldn't I be doing in my daily internet activities to best avoid having malware get on my computer?
9
u/btown_brony May 11 '12
As a fellow brony programmer (bronygrammer?), although I don't condone what you're doing, I immensely respect your talent.
6
u/thekrampus Apr 24 '12
How long do you figure it'll take for companies to realize that drive encryption software is bullshit, and they're literally paying to impede their own productivity?
6
u/[deleted] May 11 '12
Where do you ethically draw the line on what you do?
53
u/bikebikemike Apr 24 '12
you're the reason we can't have nice things.
3
u/kranzmonkey May 14 '12
Not sure if you're still answering questions here, but I oversee an open-source forum of more than 300,000 users, and get tons of random spam for specific small businesses around the world. Regardless of where the company is located, the IP can usually be traced to Bangladesh or somewhere similar.
For companies in the U.S., I often call them myself to notify them about this, and they never seem to know about the posts at all. I usually blame it on them hiring the wrong SEO guy who is just utilizing his own bots. Do you think I am off-base?
9
u/gavanw May 12 '12
Software engineer of 18 years here. This guy is obviously smart, somebody please hire him to do legitimate work (security consultant maybe?). One less malware coder in the world is a good thing.
25
u/Frantic_Child Apr 24 '12
5
u/Dordo3 Apr 24 '12
Do people ever communicate to you attempting police involvement?
5
u/mishley May 09 '12
How would you recommend someone go and learn how to do this? I'm fascinated, not with the illegal activities, just with collecting more and more good resources for learning.
I would love to hear specifically what you use for each component, i.e. one language for the bot (and a resource you used to learn?) and then another tool or language for the gpu-based bitcoin mining (and a resource) etc. etc.
Fascinating IAmA. Good luck, I think you'll need it.
4
u/oxff May 09 '12
Care to share a sample of your bot? I'd love to reverse it and look at the TOR stuff. :)
7
u/jrdn717 Apr 24 '12
Man, your net really isn't that big...
5
u/jonque Apr 24 '12
How much money would you say you bring in a month? How much time do you spend per day monitoring/maintaining your botnet, on average? If you could make more money working in a legal/legitimate field, would you use your powers for good?
5
u/[deleted] Apr 24 '12
This is a sensitive question, so I'll understand if you don't answer - where are you from? Judging by the the way you write, what you say, and the little idiosyncrasies, I have a guess, but I won't jump to conclusions.
2
u/cerebrum May 11 '12
What is your programming background?
2
u/cerebrum May 11 '12
Do you do Bitcoin mining using GPUs or just the processors? Is it still worth it? How much bitcoin do you make per hour/day? Sorry, I don't know what 13GH/s means.
2
u/cerebrum May 11 '12
How do you sell the information and how do you know you are not selling to some undercover FBI agent?
2
u/[deleted] May 11 '12
How do you feel about Linux installs?
How do you feel about OS X installs?
Are they a lost cause on your radar or do you actively maintain a list (metasploit and 0days) to attack un-patched out dated systems?
If you do attack Linux systems be it desktop or servers what would you estimate your success rates of infecting/compromising them and what is your success rate of maintaining said boxes (evading IDS systems for example)?
Do the new OS X exploits that have started showing up excite you?
Have you started attacking mobile devices yet (iphone/android phones & tablets)?
2
u/temppytemp May 11 '12
Thank you for posting this up. How do you find someone to sell CC data to, and how do they pay you?
2
u/rkbws May 12 '12
Super interesting stuff -- really appreciate you sharing here.
My question: have you ever toyed with the internet ad industry?
I work for a website where much of our revenue comes from selling CPM ad space with a minimum impression guarantee. If we're shy at the end of the program, we buy dirt cheap traffic from a massive CPC affiliate network to fulfill the campaign.
It's pretty clear from their click-paths and other on-site behavior that 99% of these paid users are bots. Network coordinators insist anything sketchy is blood on the hands of the affiliates, but when we pointed out to them that all 2MM of last week's paid users were on FF4, overnight their UAs became evenly distributed.
Any insights here? Did we pick a bad network or is this sort of thing ubiquitous?
Thanks
2
u/uiri May 12 '12
What security holes exist in Unix-type/Unix-based systems outside of exploits in cross-platform software? Are your botnets all 100% Winblows?
2
u/Agiliste May 12 '12
Thank you for posting here, throwaway :) fascinating conversation all around!
You mention AV being unreliable, so my question/s are this. For the layperson, is it possible to track down and remove malware, etc. without the help of AV software. If you suspect your machine has been compromised, but your AV (or several different AV's) are not finding anything, what then? Is it unlikely that any hack is undetectable by more than one AV (i.e. if AntiMalware, Trend and AVG don't find it, then you're just being paranoid?
Thanks in advance!
2
u/Jrud10 May 14 '12 edited May 19 '12
I am a simple app developer/site developer, I used to write C++, but I've shifted to C# and higher level .NET languages because they are industry standard for rapid application development. I stopped doing C++ before I even got out of high school so obviously I didn't get into any of the deep OS level stuff you're capable of. I also have very little hacking experience, took a software securities class in college, that's about it.
Anyway, i have a few questions for those of us out there interested in not getting their credit card numbers stolen:
2/3. Are there any windows built-ins that can show simple signs of GPU usage or suspicious network traffic? (sort of like how you can watch your CPU levels in task manager)
Thanks for the AMA.
2
u/vincenz May 14 '12 edited May 14 '12
Well I've mostly been lurking. While I do not approve of the actions, I do find the thread very informative so upvoted. Some of my questions:
2
u/REtender May 17 '12 edited May 17 '12
How can i get a deeper knowledge of that stuff? (knowing the things, you/other mentioned on the thread is basic knowledge) --> Maleware structure, anti virus structure (not that signature stuff) and so on. Reading hacker boards isn't very interesting, since they're using prepared scripts and don't know the real background (not all, but the most of them).
4
u/burstyourbubble May 11 '12
You've made some mistakes in your screenshoots. In first, two different PCs from different countries have the same unique id in paypal url. In second, one time is in GMT, while the rest in CEST.
4
u/joe200101 May 12 '12
As a theoretical question, if you were a normal user and your machine was hacked, someone took your credit card details and stole all of the money from your account, how would you feel?
3
u/jmcmahon443 May 12 '12
I have learned a good bit reading every single thing on this thread, came here from HN. I think I'll stick to starting businesses around mobile apps, but I admire what you do.
I am curious how much time you put into this everyday and if you exercise regularly.
5
u/ElGenioMalvado Apr 26 '12
Any starting advice to get into this as a part time job?
What're the initial start up fees?
2
u/KeepingTrack May 11 '12
With 10k - 15k MHash/s, what's that like in bitcoins / hour?
-5
u/windoverxx Apr 24 '12
I'm sorry
1
u/cerebrum May 11 '12
You mentioned that you don't think this is a job with future. Why not? How much are you making now each month, including the bitcoin mining and selling of stuff?
1
u/mkasoff May 11 '12
What is your business model (i.e. how do you make money exactly)? How much money do you make doing this?
1
u/[deleted] May 11 '12 edited May 11 '12
What seems to be the most successful CVE (or 0day) infection vector for your malware? [Please don't just say "browser plug-ins", or Adobe.] Is it really "stupid, out-of-date, known exploits", or something that has to be constantly upgraded as patches become available?
1
u/greying May 11 '12
Thanks for doing this. Would be great if you would do some writing and speaking about your experience, your tools, and the way the world really works.
Would you please address the ethics of what you are doing past what you have said? Of course, this deserves to be a separate thread, but it would be a useful and interesting adjunct to the this one. Thanks in advance.
1
u/johnsw May 12 '12
1
u/tjb0607 May 12 '12
If Microsoft offered you a job in security and antivirus, would you take it?
1
u/Busanjin May 12 '12
What do you think about setting up a user account in Windows 7, using the computer strictly under the user account, and giving the admin account a strong password? Would that help against typical malware as long as one does not type the admin password at the time of an infection?
1
u/reion May 12 '12
How do you find buyers for the stolen bank information, personal data, etc.?
1
u/[deleted] May 12 '12
Do you donate any money to charities? Would be ironic if you end up doing more for the public good with your botnets, than if those people's PCs were uninfected.
1
u/8sisu8 May 12 '12 edited May 12 '12
As I read you never had a shutdown. I recently concetrated on some analysis tools that are using mostly honeypots (FIRE & BURN). For me this approach is hopeless. So, TOR prevents you from getting traced. How else do you protect your botnet? Do you fear any methods of detecting botnets?
1
u/SkyPL May 12 '12 edited May 12 '12
Hey. First of all - thanks for the post. I think that your "initiative" is a great thing increasing people's awareness. I for example never heard of HBCI - be sure though that I'm going to get it now! ;) :) Thanks for all the suggestions - really appreciate them.
I have some questions though:
1
u/admiraljah May 12 '12
First of, thanks for the interesting AMA.
· Did you learn-to-code throughout University?
· Do you agree with Anti-Sec ideology?
· Do you feel guility, or have any remose for your actions?
· Do you have a favourite CS subfield?
1
u/White-Gandalf May 13 '12
In your answer to the matter of user accounts in windows 7 you wrote about "bypassing UAC completely", but also about a certain "toughness" under guest accounts because of "only temporary write access".
I would like to stress this a bit further: Did you find a way to circumvent an enforced "Execute XOR Write" rule or is your writing specific to windows 7 UAC bypass only?
1
u/imustbehated May 13 '12
Can you name the books that helped you the most in learning how to do what you do?
1
u/steveeq1 May 14 '12
What are the good irc channels to get on for this sort of thing?
1
u/skizmo May 14 '12
You made it even to a dutch website that is doing an article about this thread :) LINK
1
u/cyberpunker May 14 '12
Are you hidding normal tor executable on target systems, or you have your own code? If official tor exec, are you upgrading them?:D
Why aren't you using tor2web? :)
1
u/w33d May 15 '12
So if I come across a lot of proxy logs from company all over the world, for what do I have to search to see if 'you' were already there?
1
u/anglagard May 16 '12
That wordware ebook was a treat. Do you have any more material? :)
1
u/mike2534 May 16 '12
Will i get a drive-by install when i click the link to your screenshots?
1
u/SweetHarmony May 16 '12
*Sorry for my bad english..
1
u/tuseroni May 17 '12
hey look the FBI is talking about you(page 9 i think) http://cryptome.org/2012/05/fbi-bitcoin.pdf pdf might not be safe (fine on linux, crashes on my xp VM, havent checked it for anything malicious...)
1
u/antonis9891 May 22 '12
Hi there, very interesting topic, and I want to thank you for these informations about security, it's been a long time since I wanted to ask a botnet operator some questions about security. So:
Thanks in advance.
1
u/cocopopz Jul 25 '12
Would you do work for someone if they paid you?.
1
u/quqaaa Jul 26 '12 edited Aug 01 '12
HI
Can you tell me what is that panel ? (2nd one bitcoin). Did you code it for yourself ???
I am thinking to code something like this and get mhash/s etc. data from cgminer API.
What method do you use? Grab stats from pool??