The underground market of carders. Translation of KingPIN. Chapter 21. “Master Splyntr”

Kevin Poulsen, editor of WIRED magazine, and a blackhat hacker Dark Dante as a child, wrote a book about " one of his acquaintances ."

The book shows the path from a teenage geek (but at the same time pitching), to a seasoned cyberpowder, as well as some methods of work of special services to capture hackers and carders.

The quest to translate the book began in the summer in an IT camp for high school students - “ Shkvoren: schoolchildren translate a book about hackers ”, then Habrausers and even a little editors joined in the translation.

(I apologize, the translation of the 20th chapter was lost, I have no strength to wait and I will spread the rest.)

Chapter 21. Master Splyntr

(thanks for translation ungswar )

Occupying an entire floor of a green office building on the banks of the Monongahila River, the National Cyber ​​Forensics and Training Alliance (NACCO) was very far from the secrecy of the Washington intelligence community, where Mularski took his first steps. Here, dozens of security experts from banks and technology companies worked along with students from nearby Carnegie Mellon University in neatly arranged neat cubicles, surrounded by a ring of classrooms and then walls of a tinted glass building. With Aeron * chairs and whiteboards, the office created the feeling of one of the technology companies that provided NACCO with the bulk of the funds. The FBI made several changes before moving in, remade one of the offices into a room with electronic communications,

In his office, Mularski studied the communications scheme of Crabbe, the mail inspector, who sent it by e-mail, a large diagram showing the various connections between the 125th underground targets. Mularski realized that he was doing everything wrong: he expected a crime, and then he tried to figure out the culprits. The criminals did not hide at all. They advertised their services in the forums. This made them vulnerable, just like the rituals and strict hierarchy of the New York and Chicago mafia that instructed the FBI to break gangs decades ago.

All he had to do now was join the carders.

He chose a forum from the list that Crabb sent him and clicked on the account registration link. According to the rules of the Department of Justice, Mularski could not infiltrate the forums without the consent of Washington, the terms of which suggested that he would comply with strict restrictions on his activities. To maintain his cover, he could post on forums, but he could not interact with someone directly; he will be allowed no more than three “substantial contacts” with any of the forum participants. Participation in crimes or making test purchases was outside the boundaries of what was permitted.

All this could only be a data collection operation; he will be a sponge absorbing information about his opponents.

As soon as he registered, he faced the need to make the first important strategic decision: what his nickname would be. Mularski trusted his intuition. Inspired by the cartoon “Teenage Mutant Ninja Turtles”, which was shown in the morning, the agent stopped at the nickname of the rodent-sensei living in the sewers of karate masters - a two-legged rat named Master Splinter. For uniqueness and to give a hacker touch, he wrote his last name without "extra" vowels. (Splinter - Splyntr).

So, in July 2005, Master Splintr registered at his first criminal forum CarderPortal, laughing to himself at the game of meanings - for the underground forum, he took the name of the underground rat.

Soon, Mularski played on the carder forums like on a chessboard, relying on the NACCO fraud data stream for his moves.

The center was included directly in countering fraud related to banks and e-commerce sites, so when a new criminal innovation appeared, Mularski knew about it. He posted their schemes on CarderPortal, posing as his own inventions.

Advanced scammers were given a diva from a beginner who independently mastered all their latest chips. When the methods of fraud became available to the general public and appeared in the media, the newcomers remembered that they had first heard them from Master Stplintra.

Meanwhile, the FBI agent absorbed the history of the forums, honing his vocabulary to match the cynical, obscene style of the underground.

A few months later, Mularski faced the first challenge in his data collection operation. The first forums that grew up on the ruins of Shadowcrew accepted new members with open arms - frightened by the Firewall operation, many scammers took new nicknames and, in the absence of a reputation, had no opportunity to check each other when trading carders. Now this situation has changed. A new kind of "guarantee" forums has arisen. The only way to get there was to get the support of two existing participants. But Mularski, bound by the restrictions of the Department of Justice, deliberately avoided building direct ties with the underground. Who will vouch for him?

Borrowing an idea from Robert Ludlam’s novel, Mularski decided that Master Splintre needed a legend that could propel him into new crime forums. His thoughts were directed towards a European anti-spam organization called “Spamhaus” with which he worked as part of previous FBI operations.

Spamhaus, founded by a former musician in 1998, compiled lists of ever-changing Internet addresses that distributed garbage through consumer mailboxes; their spam source database used two-thirds of international Internet providers as blacklists. More interesting for Mularski was a list of the most wanted spammers compiled by the same company.

Consisting of such as Alan “Spam King” Ralsky and Russian Leo “BadCow” Kuvaev, the Register of Famous Spam Operators (English abbr. - ROKSO), was second only to federal indictments in terms of lists in which scammers would not want to find their name.

Mularski called the founder Steve Lynford in Monaco to explain the scheme: he wanted to get into ROKSO or, at least, to get Master Splintr there. Lynford agreed and Mularski continued to work on his legend. The best lie is always based on truth, so Mularski decided to make Splintra a Polish spammer. Mularski was a father from Polish immigrants - a shirt issued by the bureau hid the Orzel Bialy tattoo (Polish - White Eagle) on his left hand - a white eagle with a golden beak and claws that adorned the Polish coat of arms. Mularski located Master Splintra in Warsaw, he was in the Polish capital and could, if necessary, describe the sights fairly well.

In August, the ROKSO lists were published for the first time linking the “real” name with the cartoon alter-invented by Mularski.
Pavel Kaminsky aka “Master Splintr” manages a poorly organized team of spammers and scammers from Eastern Europe. Perhaps a BadCow partner. It is associated with spam through proxies, phishing, pump'n'dump **, exploits, carder forums and botnets.

The profile contained examples of fraudulent spam messages allegedly sent by "Pavel Kaminsky" created at Spamhaus, and an analysis of the location of its hosts.

Now, the carders who googled Master Splintra could make sure that he was a real, conscientious hacker involved in many slippery matters. When Mularski logged onto CarderPortal, he saw in his inbox several business offers from scammers hoping to work with him. Still limited by the ban on directly interacting with suspects, he scornfully dismissed them.

You are not a very big player, he answered. I do not want to work with you because I am a professional, and you are obviously new to this. To deflect high-level fraudsters, he challenged their wallet: you don’t have enough money to invest in what I do.

Like the girl’s inaccessibility at graduation, Master Splintra’s estrangement only made him even more attractive. When the new closed forum was launched called the International Association for the Development of Criminal Activity (English abbr. - IAACA), he posted a simple post: "Hello, I need a guarantee," and two existing members vouched exclusively for his reputation.

He then received a guarantee for Theft Services, then for CardersArmy. In November 2005, he was one of the first to be invited to the new Darkmarket.ws forum.

A few months later, another, competing site grew enough to hit its radar. And Master Splintr has joined Cardersmarket.com.

* Office chair designed in 1994 by Don Chadwick and Bill Stumpf. Presented in the permanent collection of the Museum of Modern Art in New York.

** Scheme of fraud with lowering / raising stock prices of small public companies.

To be continued