Underground carders market. Translation of the book "KingPIN". Chapter 31. "Judgment"

In chapter 31, a case is described how intelligence services calculate carders by metadata.

Kevin Poulsen, editor of the magazine WIRED, and in his childhood blackhat, the hacker Dark Dante, wrote a book about " one of his acquaintances ."

The book shows the path from a teenager-geek (but at the same time pitching), to a seasoned cyber-pahan, as well as some methods of the work of the special services to catch hackers and carders.
')
The book quest for book translation began in the summer at ITish camp for high school students - “ Shkvoren: schoolchildren translate a book about hackers, ” then Habrayusers and even a little editorial staff joined the translation.

The second breath "quest for the translation of the book" was due to the company Edison .

Chapter 31. "Judgment"

(for the translation, thanks to Bogdan Zhuru aka K3lwiN )

Carder from Long Island, Jonathan Giannone, whom Max and Chris met when he was a teenager, kept the secret from everyone.

On the day when Max absorbed all of its competitors with his website, agents of the Secret Service arrested Giannone at his parents' house for selling several dumps of Max Brett Johnson, an informant for the Secret Service under the nickname Gollumfun. Giannone was released on bail, but he did not tell anyone about his puncture. He considered this as another petty nuisance. In the end, well, what threatened him for selling twenty-nine dumps?

The impression strengthened after a month after the arrest of the court of South Carolina lifted his ban on displacement. Giannone immediately flew to Auckland airport for shopping, where he was met by Tea. They rode along the highway along the Pacific coast, she bought him pizza at Fat Slice on Berklize Telegraph Avenue. Giannone seemed funny to her - a boastful white lad with curly hair and a hip-hop addiction who once boasted that he beat a football player from the New York Jets during a fight in a local bar. Now they have something in common: Chris interrupted contacts with Giannone shortly before his arrest, and Tea said to return to San Francisco Bay so that it does not create problems in Chris's relationship. He got rid of both of them.

Chris called Thea when they walked and was very surprised when he learned that Giannone was also in the city. He asked me to give the phone to Giannone.

- Are you dragging my girls to parties? - Chris asked, angry because Giannone is building a relationship with one of his people. This could seriously damage his team cashing.

“No, I just happened to be in the city and decided to see her,” Giannone answered.

This was the last telephone conversation between Giannone and Chris. Giannone went home. He kept in touch with Tea, and a few months later warned that it was better not to appear next to him. He suspected that he was being watched while on a trip to San Francisco Bay.

“I have problems now,” Giannone said.
- Which ones exactly? - asked Tea. Giannone liked such a spirit of danger.
- I am judged next week.

Judicial sessions on federal criminal law are rarely held. Hoping to at least slightly knock off the huge prison sentences imposed by strict regulatory documents, most of the suspects plead guilty before the trial, or even agree to the job of an informant. That was how 86% of cases were closed in 2006, when the Giannone hearing was held. In another nine percent of cases, charges were dropped from suspects before the trial, usually due to the insignificance of the case and the risk of losing it. As soon as the meeting began, the chance of acquittal was about one out of ten.

Giannone arranged this alignment. Not every case is based on the investigation, which was conducted by the current cybercriminal. Brett "Gollumfun" Johnson after disclosing Giannone for the fourth month had turned his scheme with taxes across the country, visiting Texas, Arizona, New Mexico, Las Vegas, California and Florida, where he was arrested in Orlando with backpacks full of dollars, common with a sum of slightly less than $ 200,000. He could not act as a witness on the part of the prosecutor.

The bailiff handed out notebooks and pens to twelve jurors, the prosecutor in a casual tone began the opening speech:
“I adore the Internet,” he said. - The Internet is a great thing! With it, we can find entertainment, gain knowledge, watch videos, play games. We can buy things. To do this, there is eBay, where you can buy goods like at auction. It sells everything you can think of. However, ladies and gentlemen, the Internet has another side that we don’t like to remember. Dark inside, where they buy, sell and trade is not clothes and trinkets. They sell, buy and exchange human lives there ... Today, you will see this side of the Internet and, I assure you, no longer look at the Internet in the old way.

The meeting lasted three days. The prosecutor immediately got rid of Brett Johnson, recognizing Gollumfun as a liar who had betrayed his curators from the Secret Service. Because the government did not allow him to testify. The main “witness” was Giannone’s chat logs with the informant, and these records spoke for themselves.

Lawyer Giannone tried to blacken the logs. "Machines sometimes make mistakes." He drew the court’s attention to the fact that the stolen credit cards were not used for criminal purposes and that there were no victims. He recalled that from the actions of his client no one died and did not suffer physical damage.

After one day of deliberation, the court delivered a verdict: guilty. Thus ended the first in the history of the federal meeting on the case of the carding underground. The judge demanded to conclude Giannone.

A week later, Giannone was taken out of his cell in Lexington Country prison. At the exit from prison, at the two steel doors that separated him from freedom, he noticed agents of the Secret Service. He recognized them - these two supervised Johnson and acted as prosecutors at the Giannone trial.

“We want to know who Iceman is,” one of them said.
- And who is Iceman? - with an innocent look asked Giannone.

The agents made it clear that the situation is serious. Iceman threatened to kill the president. Giannone demanded his lawyer and the agents immediately called him. The lawyer recommended to agree to an interview, counting on leniency to his client.

For the next three weeks, Giannone was constantly taken from prison for interrogation to the same office where Gollumfun planned an operation to capture him. Unlike most carders, Giannone did not intend to extradite anyone and demanded a meeting. But now he was waiting for a prison term of five years. He was only twenty-one.

And Giannone told them everything he knew: Iceman lived in San Francisco, did a good deal of dumping cards, sometimes selling goods under the pseudonyms Digits and Generous. To cover the tracks - hacked Wi-Fi networks. His Russian translator was a woman from Mongolia named Tea. Most importantly, he had a business partner named Christopher Aragon from Orange Country, California. Do you need an iceman? Find Chris Aragon.

This information alarmed all those who participated in the search for Iceman. When Kate Moularski put the name of Chris Aragon into the FBI's case management system, he found Werner Janer's report for 2006, where the supplier of dumps for Chris was described as a tall man with hair pulled back, called “Hacker Max.” In December 2005, Jeff Norminton was arrested while receiving a money transfer from Caner to the name of Aragon. Jeff said that after the release of Chris from Taft, he introduced him to a super baker named Max Butler. The interrogating agent was more interested in the real estate fraud scheme and he didn’t ask any more questions about hacking.

Now Mularsky and his Secret Service competitors knew the name. Giannone’s testimony confirmed it. Iceman told Giannone that he was suspected of embezzling the Half-Life 2 source codes. Mularsky launched a new search and found search warrants for the case, and there were only two of them: against Chris Toshok and against Max Ray Butler.

Iceman's identity has been hidden in government computers all this time. Giannone helped agents find this information.

However, it proved more difficult to prove the identity of Iceman than to establish it. The feds had enough data to draw up a warrant, but they didn’t know the location of Max’s shelter. Worse, Giannone prompted Iceman to use DriveCrypt. This meant that even if they found out the address, they would not be able to extract any evidence from the hard drives. They would have taken out the door to the house of Max, and within a day he would have left the courtroom, released on bail or painting. And then, using the international network for producing fake documents, Max could evaporate, and no one would have heard anything about him anymore.

Before taking the next step, they had to think it over carefully. Mularsky decided that the key was Chris Aragon. Thanks to Norminton, they knew all about remittances and the real estate fraud scheme, which he had earned five years earlier. If this put pressure on Aragon, he could be forced to cooperate against Max.

At this time, unsuspecting Max under the nickname Aphex continued his round-the-clock management of the Carders Market. Not that the new nickname fool someone. He could not resist and, like Iceman, began to throw mud at the DarkMarket executives and spread the evidence he had found against Master Splyntr. He was amazed that so many people did not believe him. “DarkMarket was developed and maintained by people from the NCFTA and the FBI, after all!”

Th3C0rrupted0ne supported Max and abandoned his status on DarkMarket to administer the Max forum, devoting 14 hours a day to the site. But Max did not trust him. It was well known that C0rrupted lived in Pittsburgh, where the NCFTA was based.

Max came up with a new scheme for identifying possible “moles” and tested it on a card in March, stating that he has been cooperating with a terrorist group for a long time and “we are thinking of slamming President Bush this weekend”. As conceived by Max, if C0rrupted was a federal, he would either discourage him or try to find out all the details of Max.

Th3C0rrupted0ne's answer reassured Max a little:
- Good luck with this presidential affair. Slam at the same time and vice-president, he is the same bastard.

Above the forum had a lot of work. Carders Market now provided services to more than a dozen vendors: DataCorporation, Bolor, Tsar Boris, Perl, and RevenantShadow sold credit card numbers and CVV2 codes to them from the United States, Canada, and Britain; Yevin traded Californian driver's license; Notepad offered to check the validity of dumps for a small amount; Snake Solid moved US and Canada dumps; Voroshilov offered to thieves of personalities a search for a social security number and a date of birth on behalf of the victim; DelusionNFX was selling hacked online bank accounts; Illusionist worked on the Carders Market in the same way that JiLsi used to do: selling, official forms and credit card images; Imagine competed with EasyLivin in plastic deals.

Max tried to control everything clearly, someone from the carders even grumbled about “militancy.” In those times when he was a white hat, he valued honesty, but did not give anyone special status, even to his closest allies.

In April, C0rrupted prepared a review of the quality of the latest versions of the forms and maps that Chris was selling. The quality was not so hot: for example, the stripes for the signature were printed directly on the cards, I had to write on them with a marker. He estimated it at 5 out of 10, but first decided to ask Max if he should open this problem.

- I know you are familiar with Easylivin 'and wanted to ask - is it worth it to post such a review or will it be too rude?
- Write the truth, I think. If you can - attach photos, - wrote Max - We are familiar, but the truth is more important. If you cover it - it will continue to sell lousy (damn, really so lousy?) Products, it will affect you and the whole Carders Market.

A bad review could hit Chris. But when it came to the quality of his underground site - Max did not hesitate.

To be continued