3MK6QXyZ

1Copyright © 2011 by Kevin Poulsen
2All rights reserved.
3Published in the United States by Crown Publishers,
4an imprint of the Crown Publishing Group,
5a division of Random House, Inc., New York.
6www.crownpublishing.com
7CROWN and the Crown colophon are registered
8trademarks of Random House, Inc.
9Library of Congress Cataloging-in-Publication Data
10Poulsen, Kevin, 1965–
11Kingpin / Kevin Poulsen.—1st ed.
12p. cm.
131. Butler, Max. 2. Computer crimes—United States—Case
14studies.
153. Computer hackers—United States—Case studies. 4.
16Commercial criminals—
17United States—Case studies. I. Title.
18HV6773.2.P68 2010
19364.16'8092—dc22 2010027952
20eISBN: 978-0-307-58870-8
21Jacket design by Chris Sergio
22Jacket photographs © Jonathan Kitchen/Photographer’s
23Choice
24v3.1
25For Lauren,
26my unindicted coconspirator in life
27
28CONTENTS
29Cover
30Title Page
31Copyright
32Dedication
33COPS AND CARDERS
34PROLOGUE
351. The Key
362. Deadly Weapons
373. The Hungry Programmers
384. The White Hat
395. Cyberwar!
406. I Miss Crime
417. Max Vision
428. Welcome to America
439. Opportunities
4410. Chris Aragon
4511. Script’s Twenty-Dollar Dumps
4612. Free Amex!
4713. Villa Siena
4814. The Raid
4915. UBuyWeRush
5016. Operation Firewall
5117. Pizza and Plastic
5218. The Briefing
5319. Carders Market
5420. The Starlight Room
5521. Master Splyntr
5622. Enemies
5723. Anglerphish
5824. Exposure
5925. Hostile Takeover
6026. What’s in Your Wallet?
6127. Web War One
6228. Carder Court
6329. One Plat and Six Classics
6430. Maksik
6531. The Trial
6632. The Mall
6733. Exit Strategy
6834. DarkMarket
6935. Sentencing
7036. Aftermath
71EPILOGUE
72NOTES
73ACKNOWLEDGMENTS
74About the Author
75
76COPS AND CARDERS
77Max Vision, born Max Butler. Ran Carders Market under
78the handle Iceman. Also known as Ghost23, Generous,
79Digits, Aphex, and the Whiz.
80Christopher Aragon, aka Easylivin’, Karma, and the
81Dude. Max’s partner on Carders Market, who ran a
82lucrative credit card counterfeiting ring fueled by Max’s
83stolen data.
84Script. A Ukrainian seller of stolen credit card data and
85founder of CarderPlanet, the first carder forum.
86King Arthur. The Eastern European phisher and ATM
87cashout king who took over CarderPlanet from Script.
88Maksik. The Ukrainian carder Maksym Yastremski, who
89replaced Script as the underground’s top vendor of stolen
90credit card data.
91Albert Gonzalez, aka Cumbajohnny and SoupNazi. An
92administrator on Shadowcrew, the largest crime site on the
93Web until the Secret Service took it down.
94David Thomas, aka El Mariachi. A veteran scammer who
95ran a carding forum called the Grifters as an intelligencegathering
96operation for the FBI.
97John Giannone, aka Zebra, Enhance, MarkRich, and the
98Kid. A young carder from Long Island who worked with Max
99online and with Chris Aragon in real life.
100J. Keith Mularski, aka Master Splyntr, Pavel Kaminski.
101The Pittsburgh-based FBI agent who took over DarkMarket
102in a high-stakes undercover operation.
103Greg Crabb. A U.S. postal inspector, and Keith Mularski’s
104mentor, who spent years tracking the underground’s elusive
105international leaders.
106Brett Johnson, aka Gollumfun. A Shadowcrew founder
107who went on to serve as an administrator on Carders
108Market.
109Tea, aka Alenka. Tsengeltsetseg Tsetsendelger, a
110Mongolian immigrant who helped run Carders Market from
111a safe house in Orange County.
112JiLsi. Renukanth Subramaniam, the Sri Lankan–born
113British citizen who founded DarkMarket.
114Matrix001. Markus Kellerer, a German DarkMarket
115administrator.
116Silo. Lloyd Liske, a Canadian hacker who became an
117informant for the Vancouver police.
118Th3C0rrupted0ne. A former drug dealer and recreational
119hacker who served as an administrator on Carders Market.
120
121PROLOGUE
122he taxi idled in front of a convenience store in
123downtown San Francisco while Max Vision paid the driver
124and unfolded his six-foot-five frame from the back of the
125car, his thick brown hair pulled into a sleek ponytail. He
126stepped into the store and waited for the cab to disappear
127down the street before emerging for the two-block walk to
128his safe house.
129Around him, tiny shops and newsstands awakened under
130the overcast sky, and suited workers filed into the office
131towers looming above. Max was going to work too, but his
132job wouldn’t have him home after nine hours for a good
133night’s sleep. He’d be cloistered for days this time. Once
134he put his plan into motion, there’d be no going home. No
135slipping out for a bite of dinner. No date night at the
136multiplex. Nothing until he was done.
137This was the day he was declaring war.
138His long gait took him to the Post Street Towers, from the
139street a five-by-fourteen grid of identical bay windows, trim
140painted the color of the Golden Gate Bridge. He’d been
141coming to this apartment complex for months, doing his
142best to blend in with the exchange students drawn by short
143leases and reasonable rents. Nobody knew his name—not
144his real one anyway. And nobody knew his past.
145Here, he wasn’t Max Butler, the small-town troublemaker
146driven by obsession to a moment of life-changing violence,
147and he wasn’t Max Vision, the self-named computer
148security expert paid one hundred dollars an hour to harden
149the networks of Silicon Valley companies. As he rode up
150the apartment building elevator, Max became someone
151else: “Iceman”—a rising leader in a criminal economy
152responsible for billions of dollars in thefts from American
153companies and consumers.
154And Iceman was fed up.
155For months, he’d been popping merchants around the
156country, prying out piles of credit card numbers that should
157have been worth hundreds of thousands on the black
158market. But the market was broken. Two years earlier
159Secret Service agents had driven a virtual bulldozer through
160the computer underworld’s largest gathering spot, arresting
161the ringleaders at gunpoint and sending the rest scurrying
162into chat rooms and small-time Web forums—all riddled
163with security holes and crawling with feds and snitches. It
164was a mess.
165Whether they knew it or not, the underworld needed a
166strong leader to unify them. To bring order.
167Off the elevator, Max idled in the hallway to check for a
168tail, then walked to his apartment door and entered the
169oppressive warmth of the rented studio. Heat was the
170biggest problem with the safe house. The servers and
171laptops crammed into the space produced a swelter that
172pulsed through the room. He’d brought in fans over the
173summer, but they provided scant relief and lofted the
174electric bill so high that the apartment manager suspected
175him of running a hydroponic dope farm. But it was just the
176machines, entwined in a web of cables, the most important
177snaking to a giant parabolic antenna aimed out the window
178like a sniper rifle.
179Shrugging off his discomfort, Max sat at his keyboard
180and trained a bead on the Web forums where computer
181criminals gathered—virtual cantinas with names like
182DarkMarket and TalkCash. For two days, he hacked, his
183fingers flying at preternatural speed as he breached the
184sites’ defenses, stealing their content, log-ins, passwords,
185and e-mail addresses. When he tired, he crashed out on
186the apartment’s foldaway bed for an hour or two, then
187returned bleary-eyed to his work.
188returned bleary-eyed to his work.
189He finished with a few keystrokes that wiped out the
190sites’ databases with the ease of an arsonist flicking a
191match. On August 16, 2006, he dispatched an unapologetic
192mass e-mail to the denizens of the sites he’d destroyed:
193They were all now members of Iceman’s own
194Cardersmarket.com, suddenly the largest criminal
195marketplace in the world, six thousand users strong and the
196only game in town.
197With one stroke, Max had undermined years of careful
198law enforcement work and revitalized a billion-dollar
199criminal underworld.
200In Russia and Ukraine, Turkey and Great Britain, and in
201apartments, offices, and houses across America, criminals
202would awaken to the announcement of the underground’s
203first hostile takeover. Some of them kept guns in their
204nightstands to protect their millions in stolen loot, but they
205couldn’t protect themselves from this. FBI and Secret
206Service agents who’d spent months or years infiltrating the
207now-destroyed underground forums would read the
208message with equal dismay, and for a moment, all of them
209—hacking masterminds, thuggish Russian mobsters,
210masters of fake identities, and the cops sworn to catch
211them—would be unified by a single thought.
212Who is Iceman?
213
2141
215The Key
216s soon as the pickup truck rolled up to the curb, the
217teenage computer geeks squatting on the sidewalk knew
218there’d be trouble. “Fucking wavers!” one of the cowboys
219called out the window. A beer bottle flew from the truck and
220crashed on the pavement. The geeks, who’d left the club to
221talk away from the din of music, had seen it all before. In
222Boise in 1988, being caught in public without a wide belt
223buckle and a cowboy hat was a bottlin’ offense.
224Then one of the geeks did something the cowboys
225weren’t expecting: He stood up. Tall and broad shouldered,
226Max Butler cut a quietly imposing figure that was enhanced
227by his haircut, a spiky punk-rock brush that added three
228inches to his height. “Waver?” Max asked calmly, feigning
229ignorance of the Boise slang for New Wave music fans and
230other freaks. “What’s that?” The two cowboys blustered and
231swore, then finally drove away with a screech of tires and
232the waving of mud flaps.
233Since they met one another in junior high, Max had
234become the unofficial bodyguard in the klatch of fellow
235computer nerds in Meridian, Idaho, a bedroom community
236then separated from Boise by eight miles of patchy
237farmland. The town fathers had named Meridian a century
238earlier for its placement directly on the Boise Meridian, one
239of the thirty-seven invisible north-south lines that form the Yaxes
240in America’s land survey system. But that was
241probably the only thing geeky about the town, where the
242high school rodeo team got all the girls.
243Max’s parents had married young, and they’d moved to
244Idaho from Phoenix when he was an infant. In some ways,
245Max combined their best qualities: Robert Butler was a
246Vietnam veteran and enthusiastic technology buff who ran a
247computer store in Boise. Natalie Skorupsky was the
248daughter of Ukrainian immigrants—a humanist and a
249peacenik, she liked to relax in front of the Weather Channel
250and nature documentaries. Max inherited his mother’s
251clean-living values, eschewing red meat, cigarettes, and
252alcohol and drugs, except for an ill-fated experiment with
253chewing tobacco. From his father, Max acquired a deep
254passion for computers. He grew up surrounded by exotic
255machines, from giant business computers that could double
256as an office desk to the first suitcase-sized “portable” IBM
257compatibles. Max was allowed to play with them freely. He
258started programming in BASIC at the age of eight.
259But Max’s equilibrium disappeared when his parents
260divorced in his fourteenth year. His father wound up in
261Boise, while Max lived in Meridian with his mother and his
262younger sister, Lisa. The divorce devastated the teenager
263and seemed to reduce him to two modes of operation:
264relaxed, and full-bore insane. When his manic side flared,
265the world was too slow to keep up; his brain moved at light
266speed and focused like a laser on whatever task was
267before him. After he got his driver’s license, he drove his
268silver Nissan like the accelerator was a toggle switch,
269speeding from stop sign to stop sign, wearing lab goggles
270like a mad scientist conducting an experiment in Newtonian
271physics.
272As Max protected his friends, they tried to protect Max
273from himself. His best buddy, a genial kid named Tim
274Spencer, found Max’s world exciting but was constantly
275reining in his friend’s impetuousness. One day he emerged
276from his home to find Max standing over an elaborate
277geometric pattern burning in the lawn. Max had found a
278canister of gasoline nearby. “Max, this is our house!” Tim
279shouted. Max sputtered apologies as the pair stamped out
280the blaze.
281• • •
282It was Max’s impulsive side that made his friends resolve
283not to tell him about the key.
284The Meridian geeks had found the key ring in an
285unlocked desk at the back of the chemistry lab. For a time,
286they just watched it, sliding open the desk drawer when the
287lab instructor wasn’t around and checking to see if it was
288still there. Finally, they swiped it, smuggled it from the lab,
289and discreetly began testing its keys against various locks
290on the Meridian High campus. That was how they
291discovered that one of the keys was a master key to the
292school; it opened the front door and every door behind it.
293Four copies were made, one for each of them: Tim, Seth,
294Luke, and John. The key ring was returned to the darkness
295of the chem lab desk after being carefully wiped down for
296fingerprints. They all agreed that Max must not know. A
297master key to the high school is a very special talisman that
298must be wielded with great care—not squandered on
299foolishness. So the juniors vowed to save the key for an
300epic senior-year prank. They would sneak into the school
301and hijack the PA system, blaring music into every
302classroom. Until that day, the four keys would stay in hiding,
303a burden borne in silence by the four of them.
304Nobody liked keeping secrets from Max, but they could
305see that he was already on a collision course with the
306school’s administrators. Max scoffed at the curriculum, and
307while instructors droned on about history or sketched
308equations on the blackboard, Max would sit at his desk
309thumbing through computer printouts from dial-up bulletin
310board systems and the pre-Web Internet. His favorite read
311was an online hacker newsletter called Phrack, a product of
312the late-1980s hacking scene. In its plain, unadorned text,
313Max could follow the exploits of editors Taran King and
314Knight Lightning, and contributors like Phone Phanatic,
315Crimson Death, and Sir Hackalot.
316The first generation to come of age in the home
317computing era was tasting the power at its fingertips, and
318Phrack was a jolt of subversive, electric information from a
319world far beyond Meridian’s sleepy borders. A typical issue
320was packed with tutorials on packet-switched networks like
321Telenet and Tymnet, guides to telephone-company
322computers like COSMOS, and inside looks at large-scale
323operating systems powering mainframe and minicomputers
324in air-conditioned equipment rooms around the
325globe.
326Phrack also diligently tracked news reports from the
327frontier battleground between hackers and their opponents
328in state and federal law enforcement, who were just
329beginning to meet the challenges posed by recreational
330hackers. In July 1989, a Cornell graduate student named
331Robert T. Morris Jr. was charged under a brand-new
332federal computer crime law after he launched the first
333Internet worm—a virus that spread to six thousand
334computers, clogging network bandwidth and dragging
335systems to a halt. The same year, in California, a young
336Kevin Mitnick picked up his second hacking arrest and
337received one year in prison—a startlingly harsh sentence at
338the time.
339Max became “Lord Max” on the Boise bulletin board
340systems and delved into phone phreaking—a hacking
341tradition dating to the 1970s. When he used his
342Commodore 64 modem to scan for free long-distance
343codes, he had his first run-in with the federal government: A
344Secret Service agent from the Boise field office visited Max
345at school and confronted him with the evidence of his
346phreaking. Because he was a juvenile, he wasn’t charged.
347But the agent warned Max to change course before he got
348in real trouble.
349Max promised he’d learned his lesson.
350Then the unthinkable happened. Max noticed an odd
351shape on John’s key ring and asked what it was. John
352confessed the truth.
353Max and John entered the school that very night and went
354berserk. One or both of them scrawled messages on the
355walls, sprayed fire extinguishers in the hallways, and
356plundered the locked closet in the chemistry lab. Max
357carted off an assortment of chemicals and piled them into
358the backseat of his car.
359Seth’s phone rang early the next morning. It was Max;
360he’d left Seth a gift in his front yard. Seth walked out to find
361the bottles of chemicals sitting in a pile on his lawn.
362Panicked, he scooped them up and took them into the
363back, where he grabbed a shovel and started digging a
364hole.
365His mother stepped out back and caught Seth in the act
366of burying the evidence.
367“You know I have to tell the school now, right?” she said.
368Seth was brought into the principal’s office and
369interrogated, but he refused to name Max. One by one, the
370other Meridian High geeks were dragged in by the school’s
371uniformed security officer for questioning, some in
372handcuffs. When it was John’s turn, he spilled the beans.
373The school called the police, who found a telltale yellow
374iodine stain in the back of Max’s Nissan.
375The chemical theft was taken very seriously in Meridian.
376Max was expelled from school and prosecuted as a
377juvenile. He pleaded guilty to malicious injury to property,
378first-degree burglary, and grand theft, and spent two weeks
379at an in-care facility under psychiatric evaluation, where the
380staff diagnosed him as bipolar. His final sentence was
381probation. His mother sent him to Boise to live with his
382father and attend Bishop Kelly, the only Catholic high
383school in the state.
384Max’s first criminal conviction was a minor one. But the
385impulsiveness and mischievousness that spawned it ran
386deep in Max’s personality. And he was destined to hold a
387lot more master keys.
388
3892
390Deadly Weapons
391HIS is the Rec Room!!!!
392This large, darkened room has no obvious exits. A
393crowd relaxes on pillows in front of a giant screen TV, and
394there is a fully stocked fridge and a bar.
395Those words welcomed visitors to TinyMUD, an online
396virtual world contained in a beige computer the size of a
397minifridge squatting on the floor of a Pittsburgh graduate
398student’s office. In 1990, hundreds of people from around
399the globe projected into the world over the Internet. Max,
400now a freshman at Boise State University, was one of them.
401The Internet was seven years old then, and about three
402million people had access through a measly three hundred
403thousand host computers at defense contractors, military
404sites, and, increasingly, colleges and universities. In
405academia, the Net was once seen as too important to
406expose directly to undergraduates, but that was changing,
407and now any decent U.S. college allowed students online.
408MUDs—“multi-user dungeons”—became a favorite
409hangout.
410Like most everything else on the pre-Web Internet, a
411MUD was a purely textual experience—a universe defined
412entirely by prose and navigated by simple commands like
413“north” and “south.” TinyMUD was distinct as the first online
414world to shrug off the Dungeons and Dragons–inspired
415rules that had shackled earlier MUDs. Instead of limiting the
416power of creation to select administrators and “wizards,” for
417example, TinyMUD granted all its inhabitants the ability to
418alter the world around them. Anyone could create a space
419of his own, define its attributes, mark its borders, and
420receive visitors. Inhabitants quickly anointed the usercreated
421recreation room the world’s social hub, building off
422it until its exits and entrances connected directly to
423TinyMUD spaces like Ghondahrl’s Flat, Majik’s Perversion
424Palace, and two hundred other locales.
425Also gone from TinyMUD was the D & D–style reward
426system that emphasized collecting wealth, finishing quests,
427and slaying monsters. Now, instead of doing battle with
428orcs and building up their characters’ experience points,
429users talked, flirted, fought, and had virtual sex. It turned out
430that freeing the game from the constraints of Tolkienesque
431roleplay made it more like real life and added to its
432addictive power. A common joke had it that MUD really
433stood for “multi-undergraduate destroyer.” For Max, that
434would prove more than just a joke.
435At Max’s urging, his girlfriend Amy had joined him in one
436of the TinyMUDs.* The original at Carnegie Mellon
437University had closed in April, but by then the same free
438software was powering several successor MUDs scattered
439around the Net. Max became Lord Max, and Amy took the
440name Cymoril, after a tragic heroine in Michael Moorcock’s
441Elric of Melniboné series of books and short stories—
442some of Max’s favorites.
443In the stories, Cymoril is the beloved of Elric, a weak
444albino transformed into a fearsome wizard emperor by dint
445of a magic sword called Stormbringer. To Max, the fictional
446sword was a metaphor for the power of a computer—
447properly wielded, it might turn an ordinary man into a king.
448But for Elric, Stormbringer was also a curse: He was bound
449to the sword, fought to tame it, and was ultimately mastered
450by it instead.
451Elric’s epic, doomed romance with Cymoril was very
452much of a piece with the fraught, uncompromising vision of
453romantic love Max had formed after his parents’ divorce:
454Cymoril meets her fate during a battle between Elric and
455his hated cousin Yyrkoon. Cymoril pleads with Elric to
456sheath Stormbringer and stop the fight, but Elric,
457sheath Stormbringer and stop the fight, but Elric,
458possessed by rage, presses on, striking Yyrkoon with a
459mortal blow. With his last breath, Yyrkoon exacts a
460heartbreaking revenge, pushing Cymoril onto the tip of
461Stormbringer.
462Then the dark truth dawned on his clearing brain
463and he moaned in grief, like an animal. He had slain
464the girl he loved. The runesword fell from his grasp,
465stained by Cymoril’s lifeblood, and clattered
466unheeded down the stairs. Sobbing now, Elric
467dropped beside the dead girl and lifted her in his
468arms.
469“Cymoril,” he moaned, his whole body throbbing.
470“Cymoril—I have slain you.”
471When she first met Max, Amy thought he was cool,
472rebellious, and kind of punky—different from the usual
473Boise crowd. But as they spent every free moment
474together, she began to see a darker, obsessive side to his
475personality, particularly after he introduced her to the
476Internet and TinyMUD.
477At first Max was thrilled that his girlfriend shared his
478passion for the online world. But as Amy started making
479friends of her own in the MUD, including guys, he became
480jealous and combative. To Max it made no difference if
481Amy was cheating on him in the virtual world or the real
482one: It was cheating either way. He tried to get her to stop
483logging on, but she refused, and the couple began arguing
484online and off.
485Eventually, Amy’d had enough; they were arguing about a
486stupid computer game? On a Wednesday night in early
487October 1990, the couple were in another user’s room in
488TinyMUD when Cymoril finally told Lord Max that she wasn’t
489sure they really belonged together after all.
490It was Max’s first serious relationship, and his reaction
491was powerful. They had sworn to spend their lives united.
492Now they should both die, rather than be parted, he wrote in
493the MUD. Then he got explicit, telling her how he’d kill her.
494Other users watched with growing concern as his raging
495took on the tone of a serious threat. What should they do?
496One of the in-world wizards got Max’s Internet IP address
497from the server—a unique identifier that was easily traced
498to Boise State University. The MUDers looked up the
499phone number for the Ada County Sheriff’s Department in
500Boise and called in a warning that a potential murdersuicide
501was unfolding.
502The year had begun hopefully for Max. He excelled at the
503part-time job his dad gave him at his computer store,
504HiTech Systems, performing clerical work, making
505deliveries in the company van, and assembling PCcompatible
506computers in the shop. And he managed to
507stay clean of probation violations—though he’d stopped
508taking his bipolar medication; his father didn’t want him
509drugged, and, anyway, Max didn’t agree with the diagnosis.
510He began dating Amy in February of 1990, four months
511after meeting her at the Zoo, a dance club in Boise that
512catered to an underage crowd. A year younger than Max,
513she was blond, blue-eyed, and, when he first saw her, on
514the arm of Max’s friend Luke Sheneman, one of the former
515Meridian key bearers. As Max finished up his last year in
516high school, they began getting serious.
517Max did nothing in half measures, and his devotion to
518Amy was absolute. She planned on attending Boise State
519University, so Max applied there, postponing his dream of
520attending CMU or MIT. He brought her home to meet his
521computer, and the couple played Tetris together. Their
522relationship was everything his parents’ hadn’t been. They
523both thought it would never end.
524His old friends barely saw him over summer break. Then
525the fall term began at Boise State. Max declared a major in
526computer science and enrolled in a battery of courses:
527calculus, chemistry, and a computer class on data
528structures. Like all students, he was given an account on
529the school’s shared UNIX system. Like a few of them, he
530started hacking the computer right away. Max’s path was
531eased by another student, David, who’d already worried his
532way into a bunch of the faculty accounts. They spent hours
533in the BSU terminal room, staring at the luminous green text
534of the terminals and banging on the clacky keyboards.
535They’d skim through faculty e-mail boxes while holding long,
536silent conversations, shooting messages back and forth
537across the room through the computer. David struggled to
538keep up with Max’s overclocked mind and typing speed,
539and Max would often get impatient. “What are you waiting
540for?” Max would type when David fell behind in the
541conversation. “Respond.”
542A little local hacking was generally tolerated by
543administrators. But then Max started poking at the
544defenses of other Internet systems, earning him a brief ban
545from the BSU computer. When his access was restored, he
546was back on TinyMUD, fighting with Amy.
547The sheriff called BSU’s network administrator at two in the
548morning to tell him about the murder-suicide threat. The
549police wanted a copy of Max’s computer files to examine
550for evidence—a request that raised difficult privacy issues
551for the college. After some discussion with the university’s
552lawyer, administrators decided not to voluntarily hand over
553anything. Instead, they’d preserve Max’s files on a
554computer tape and lock Max out of the computer at once.
555Amy worried about what Max might do next, even as she
556pressed through the slow process of breaking up with him.
557She still cared about Max, she’d later testify, and was afraid
558he’d really hurt himself.
559Max continued to call her after the TinyMUD incident, and
560the conversations followed a predictable pattern. Max
561would start off nice—showing the friendly, caring side that
562his friends and family knew well. Then he’d escalate into
563self-pity and threats before hanging up in anger.
564On October 30, Max told Amy he wanted to talk to her in
565person. Still hoping to end the relationship amicably—she
566was bound to see Max on campus, and she didn’t want him
567hating her—Amy agreed to come over.
568Max had just moved back to his mother’s home in
569Meridian, a ranchstyle house on a quiet street a block from
570his old high school. He met Amy at the door, and after
571reassuring her that he wouldn’t do anything crazy, she
572followed him to his bedroom at the back of his house. His
573mother was out, and his fourteen-year-old sister was
574watching TV.
575His bed was still disassembled, so they sat together on
576the mattress on the floor and began discussing their
577feelings. Amy admitted that she’d met another boy in
578TinyMUD. His name was Chad, and he lived in North
579Carolina. The relationship had moved beyond the
580keyboard; they’d sent each other photos in the mail, and
581she’d been calling him on the phone.
582Max struggled to control his feelings, holding back tears.
583He felt betrayed, he said. At the same time, he couldn’t
584quite believe what he was hearing. He asked her for
585Chad’s phone number, produced a calling card, and dialed
586his online rival.
587A strained three-way conversation followed; Max
588introduced himself to Chad and then let Amy take over. She
589told Chad how she felt. Then Chad asked Amy for her
590phone number. She gave it to him, and the conversation
591drifted into an idle banter that only added to Max’s
592agitation. He grabbed at the phone and hung it up.
593Amy watched Max carefully as his breathing intensified
594and his eyes darted around the room.
595“I’m going to kill you,” he finally said. “I’m going to—you’re
596going to die now.”
597She told Max that she didn’t feel like she’d betrayed him,
598and she wouldn’t apologize. Max began trembling. Then his
599and she wouldn’t apologize. Max began trembling. Then his
600hands were around her throat and he was pushing her
601down onto the mattress.
602“Fine,” she said. “Why don’t you just kill me then?”
603Once Max regained his self-control, he wanted Amy out
604of his sight. He pulled her from the mattress, pushed her out
605of his bedroom, and shuffled her through the house and out
606the front door.
607“Go, now,” he said. “Just get out, because I don’t want to
608kill you. But I might change my mind.” Amy jumped into her
609car and took off fast.
610As she headed back to Boise, she replayed the events in
611her mind. Lost in thought, she didn’t see the other car until
612she was slamming into it with a jolt and the crunch of metal
613against metal.
614Both cars were totaled, but no one was seriously hurt.
615When Amy’s parents learned about the confrontation at
616Max’s house, though, they began to fear for her life. A week
617after the accident, Amy went to the police, and Max was
618arrested.
619Max told his friends that Amy was exaggerating the
620incident. In Amy’s version of events, Max had kept her
621prisoner in his bedroom for an hour, his hands returning to
622her throat repeatedly, at one point briefly cutting off her
623breathing. In Max’s version, he’d put his fingers loosely on
624her throat for one minute, but he hadn’t choked her, and she
625was always free to leave. Amy said Max continued to
626phone her obsessively after the incident, issuing more
627threats; Max said he left her alone after pushing her out of
628his house. As far as Max was concerned, Amy was
629sacrificing him to get out of trouble for her car accident.
630The county prosecutor offered Max a misdemeanor deal.
631But a month before he was scheduled to receive a fortyfive-
632day slap on the wrist from the judge, Max—free on his
633own recognizance—spotted Amy walking hand in hand with
634a new boyfriend down University Avenue.
635Once again, Max’s emotions overrode his common
636sense. On impulse he pulled his father’s repair-shop van
637onto a lawn and caught up with the couple on foot. His body
638was tight with tension as he circled the pair.
639“Hi,” he said.
640“You’re not supposed to be around me,” Amy said in
641protest.
642“Don’t you remember what we used to have?”
643Amy’s escort spoke up, and Max gave him a warning:
644“Better watch yourself, friend.” Then he stalked off. A
645moment later, the roar of an engine. Max was back in the
646van, zooming across the center line toward the couple on
647the sidewalk. He passed close enough for Amy to feel the
648wind from the van as it tore off.
649The deal was canceled. The district attorney stretched
650the law to slam Max with a felony charge of assault with a
651deadly weapon—his hands. It was a questionable charge:
652Max’s hands were no deadlier a weapon than anyone
653else’s.
654The prosecution offered him a new deal: nine months in
655jail, if Max would admit to choking Amy. He refused. After a
656three-day trial, and just an hour and a half of deliberation,
657the jury found him guilty. On May 13, 1991, Tim Spencer
658and some of the other Meridian High geeks sat in the
659courtroom and watched as Judge Deborah Bail sentenced
660their friend to five years in prison.
661* Amy is not her real name.
662
6633
664The Hungry Programmers
665ax found Tim Spencer’s house perched at a summit
666in the hills separating the suburban sprawl of the San
667Francisco Peninsula from the quiet, undeveloped towns
668clinging to the Pacific coast. But “house” was too small a
669word. It was a villa, six thousand square feet sprawling
670across a fifty-acre plot overlooking the sleepy coastal town
671of Half Moon Bay. Max passed through the entranceway
672columns to the double front doors and entered the
673cavernous living room, where a curved wall of windows
674stretched from floor to ceiling.
675It was a year after his parole, and Max had come to San
676Francisco to start over. Tim and some of his friends from
677Idaho had been renting the house they called “Hungry
678Manor,” the name a reference to their first enterprise when
679they’d migrated to the Bay Area a year earlier. They’d
680planned to bootstrap into the Silicon Valley economy by
681forming a computer consulting business called the Hungry
682Programmers—will code for food. Instead, the valley
683quickly metabolized the geeks into full-time employment,
684and the Hungry Programmers morphed into an unofficial
685club for Tim’s friends from Meridian High and the University
686of Idaho, two dozen in all. Hungry Manor was the group’s
687party house and home to five of them. Max would be the
688sixth.
689Max walked into Hungry Manor with few belongings but
690lots of baggage, not least a deep bitterness over his
691treatment by the justice system. In 1993, while Max was on
692his second year in prison, Idaho’s Supreme Court ruled in a
693similar case that hands “or other body parts or
694appendages” couldn’t be considered deadly weapons.
695That meant Max should never have been convicted of
696aggravated assault. Despite the ruling, Max’s own appeal
697was denied on procedural grounds: The judge conceded
698that Max was technically not guilty of the felony for which he
699was serving time, but his old lawyer had failed to raise the
700issue in an earlier appeal, and it was too late now.
701When Max was finally paroled on April 26, 1995, he left
702knowing that he’d served more than four years in the Idaho
703State Penitentiary for what, by law, should have been a
704misdemeanor worth sixty days in the county jail. He’d
705served hard time on an unjust sentence, while beyond the
706prison fence his friends had gone off to college, earned
707four-year degrees, then left Idaho to start promising
708careers.
709He’d moved in with his dad near Seattle, and Tim, Seth,
710and Luke drove up from San Francisco for a reunion party
711of the old Meridian High geeks. They marveled at Max’s
712prison-enhanced physique and his seemingly boundless
713optimism, despite having no degree and a serious felony
714conviction on his record. Max knew it was a time of
715opportunity: A British computer scientist had created the
716World Wide Web three months after Max’s sentencing.
717Now there were nearly nineteen thousand websites,
718including one for the White House. Dial-up Internet service
719providers were surfacing in every major city, and America
720Online and CompuServe were adding Web access to their
721offerings.
722Everyone was going online; Max was no longer the
723weirdo, addicted to a network nobody had heard of. Now, it
724turned out, he’d been at the head of a pack that was
725growing to include millions of people. Yet, thanks to his
726record, Max struggled to win computer employment in
727Seattle, working odd tech-support jobs through a temp
728agency.
729Online, Max was hanging out in some rough
730neighborhoods. Looking for the technical challenges his
731neighborhoods. Looking for the technical challenges his
732day jobs denied him, Max returned to a network of chat
733rooms called IRC, Internet relay chat, a surviving vestige of
734the old Internet of his teenage years. When he’d gone to
735prison, IRC had been a social hotspot. But with the
736gentrification of the Net, most inhabitants moved uptown to
737easy-to-use instant messaging clients and Web-based chat
738systems. Those who remained on IRC tended to be either
739hard-core geeks or disreputable sorts—hackers and
740pirates scheming in the forgotten tunnels and alleyways
741below the whitewashed, commercialized Internet growing
742above them.
743Max fancied himself an invisible, spectral presence in
744cyberspace. He chose “Ghost23” as his IRC identity—23
745was his lucky number, and among other meanings it was
746the I Ching hexagram representing chaos. He floated into
747the IRC “warez” scene, where scofflaws build their
748reputations by pirating music, commercial software, and
749games. There, Max’s computer skills found an appreciative
750audience. Max found an unprotected FTP file server at an
751ISP in Littleton, Colorado, and turned it into a cache for
752stolen software for himself and his new friends, stocked
753with bootlegged copies of programs like NetXray, Laplink,
754and Symantec’s pcAnywhere.
755It was a mistake. The ISP noticed the drain on its
756bandwidth and traced Max’s uploads to the corporate
757offices of CompuServe in Bellevue, where Max had just
758started working a new temp job. Max was fired. Barely a
759year after his release from prison, his name was mud.
760That was when Max decided to start over again in Silicon
761Valley, where the dot-com economy was swelling to
762ripeness and a talented computer genius could pick up
763work without a lot of questions about his past.
764He’d need a new name, unstained by his past folly. Max
765had been known by a nickname in the joint, one
766abbreviated from a cyberpunk-themed ’zine he’d published
767from the prison typewriter: Maximum Vision. It was a clean,
768optimistic name that exemplified everything he wanted to
769be and crystallized his clarity and hopefulness.
770As he left Seattle in the rearview mirror, he said goodbye
771to Max Butler. From now on, he would be Max Ray
772Vision.
773• • •
774Max Vision found that life in Hungry Manor was good.
775Surrounded by rolling meadows on all sides, the house
776boasted two wings, four bedrooms, a maid’s quarters, a full
777dining room, a livestock pen, and a brick pizza oven and
778indoor barbecue in a vented room adjoining the vast, sunlit
779kitchen. The Hungries had turned the library into a computer
780lab and server room, packing in a slew of custom-built
781gaming PCs for recreation. They ran networking cable into
782every room and energized it with a high-speed Internet link
783that necessitated the partial shutdown of the 92 freeway as
784the phone company trenched a new cable run alongside the
785road. A vintage phone system linked the west wing to the
786east. As a finishing touch, one of the Hungry Programmers
787had brought in a hot tub and set it up on the grounds, under
788the stars.
789Max couldn’t have asked for a better launchpad for his
790new life. One of the resident Hungries got him a job as a
791system administrator at MPath Interactive, a computer
792gaming start-up in Silicon Valley that was flush with venture
793capital. He threw himself into the job. Defying the
794stereotype of a computer nerd, he drew his greatest
795satisfaction from his support duties. He liked helping
796people.
797But it wasn’t long before Max’s antics in Seattle caught
798up with him. One morning, a process server showed up at
799his cubicle to hand him a $300,000 lawsuit filed by the
800Software Publishers Association—an industry group that
801had decided to use his piracy bust to send a message.
802“This action is a warning to Internet users who believe they
803can infringe software copyrights without fear of exposure or
804penalty,” the association proclaimed in a press release.
805As the first lawsuit of its kind, the case earned Max Butler
806a brief write-up in Wired magazine and a mention in a
807congressional hearing on Internet piracy. Max Vision,
808though, emerged largely unscathed—few in his new life
809made the connection to the man named in the high-profile
810lawsuit.
811When the press attention faded, the SPA was willing to
812quietly settle the case for $3,500 and some free computer
813consulting. The whole affair even had a silver lining. It
814introduced Max to the FBI.
815Chris Beeson, a young agent with the bureau’s San
816Francisco computer crime squad, gave Max his pitch. The
817FBI could use Max’s assistance navigating the computer
818underground. Recreational hackers were no longer a target
819for the bureau, he said. There was a new, more dangerous
820breed of computer criminal emerging: “real” criminals. They
821were cyberthieves, pedophiles, even terrorists. The FBI
822was no longer chasing people like Max and his ilk. “We’re
823not the enemy,” said Beeson.
824Max wanted to help, and in March 1997 he was formally
825inducted into the FBI’s Criminal Informant program. His first
826written report for the bureau was an introductory course on
827the virus-writing, warez, and computer-hacking scenes. His
828follow-up report ten days later ran down compromised filetransfer
829sites—like the one he’d exploited in Seattle—and
830a music piracy gang called Rabid Neurosis that had
831debuted the previous October with a bootlegged release of
832Metallica’s Ride the Lightning.
833When Max got his hands on a pirated version of
834AutoCAD that was being circulated by a crew called
835SWAT, the FBI rewarded him with a $200 payment.
836Beeson had Max sign the receipt with the bureau’s code
837name for its new asset: Equalizer.
838Max liked the FBI agent, and the feeling seemed to be
839mutual. Neither of them knew that Chris Beeson would one
840day put his Equalizer back behind bars and begin Max’s
841transformation into one of the “real” criminals Beeson had
842hoped to catch.
843
8444
845The White Hat
846ax was building his new life at a time of profound
847change in the hacking world.
848The first people to identify themselves as hackers were
849software and electronics students at MIT in the 1960s. They
850were smart kids who took an irreverent, antiauthoritarian
851approach to the technology they would wind up pioneering
852—a scruffy counterweight to the joyless suit and lab-jacket
853culture then epitomized by the likes of IBM. Pranks were a
854part of the hacker culture, and so was phone phreaking—
855the usually illegal exploration of the forbidden back roads of
856the telephone network. But hacking was above all a
857creative effort, one that would lead to countless watershed
858moments in computer history.
859The word “hacker” took on darker connotations in the
860early 1980s, when the first home computers—the
861Commodore 64s, the TRS-80s, the Apples—came to
862teenagers’ bedrooms in suburbs and cities around the
863United States. The machines themselves were a product of
864hacker culture; the Apple II, and with it the entire home
865computer concept, was born of two Berkeley phone
866phreaks named Steve Wozniak and Steve Jobs. But not all
867teenagers were content with the machines, and in the
868impatience of youth, they weren’t inclined to wait for grad
869school to dip into real processing power or to explore the
870global networks that could be reached with a phone call
871and the squeal of a modem. So they began illicit forays into
872corporate, government, and academic systems and took
873their first tentative steps into the ARPANET, the Internet’s
874forerunner.
875When those first young intruders began getting busted in
8761983, the national press cast about for a word to describe
877them and settled on the one the kids had given themselves:
878“hackers.” Like the previous generation of hackers, they
879were pushing the limits of technology, outwitting the
880establishment, and doing things that were supposed to be
881impossible. But for them, that involved breaching corporate
882computers, taking over telephone switches, and slipping
883into government systems, universities, and defense
884contractor networks. The older generation winced at the
885comparison, but from that point on, the word “hacker” would
886have two meanings: a talented programmer who pulled
887himself up by his own bootstraps, and a recreational
888computer intruder. Adding to the confusion, many hackers
889were both.
890Now, in the mid-1990s, the hacking community was
891dividing again. The FBI and the Secret Service had staged
892arrests of high-profile intruders like Kevin Mitnick and Mark
893“Phiber Optik” Abene, a New York phone phreak, and the
894prospect of prison stigmatized recreational intrusion while
895raising the risk far beyond the rewards of ego and
896adventure. The impetus for cracking computers was fading
897as well: The Internet was open to anyone now, and personal
898computers had grown powerful enough to run the same
899operating systems and programming languages that fueled
900the big machines denied to amateurs. Most of all, there
901was real money to be made defending computers and
902none attacking them.
903Cracking systems was becoming uncool. Those
904possessed of a hacker’s mind-set were increasingly
905rejecting intrusion and going right into legitimate security
906work. And the intruders started hanging up their black hats
907to join them. They became the “white-hat hackers”—
908referencing the square-jawed heroes in old cowboy films—
909applying their computer skills on the side of truth and
910justice.
911Max thought of himself as one of the white hats. Watching
912Max thought of himself as one of the white hats. Watching
913for new types of attacks and emerging vulnerabilities was
914now in his job description, and as Max Vision, he was
915beginning to contribute to some of the computer-security
916mailing lists where the latest developments were
917discussed. But he couldn’t completely exorcise Ghost23
918from his personality. It was an open secret among Max’s
919friends that he was still cracking systems. When he saw
920something novel or interesting, he saw no harm in trying it
921out for himself.
922Tim was at work one day when he got a call from a
923flummoxed system administrator at another company who’d
924traced an intrusion back to Hungry.com—the online home
925of the Hungry Programmers, where they hosted their
926projects, hung their résumés, and maintained e-mail
927addresses that would remain steady through job changes
928and other upheavals. There were dozens of geeks on the
929shared system, but Tim knew at once who was responsible.
930He put the sysadmin on hold and phoned up Max.
931“Stop. Hacking. Now,” he said.
932Max stammered out an apology—it was the burning lawn
933all over again. Tim switched back to the other line, where
934the system administrator happily reported that the attack
935had stopped in its tracks.
936The complaint surprised and confused Max—if his
937targets knew what a good guy he was, they wouldn’t take
938issue with some harmless intrusions. “Max, you gotta get
939permission,” Tim explained. He offered some life advice.
940“Look, just sort of imagine that everyone’s looking at you.
941That’s a good way to ensure that what you’re doing is
942correct. If I was standing there, or your dad was standing
943there, would you still feel the same about doing it? What
944would we say?”
945If there was one thing Max was missing in his new life, it
946was a partner to share it with. He met twenty-year-old Kimi
947Winters at a rave called Warmth, held on an empty
948warehouse floor in the city—Max had become a fixture in
949the rave scene, dancing with a surprising, fluid grace,
950whirling his arms like a Brazilian flame dancer. Kimi was a
951community college student and part-time barista. A foot
952shorter than Max, she sported an androgynous appearance
953in the shapeless black hoodie she liked to wear when she
954went out. But on a second look, she was decidedly cute,
955with apple cheeks and her Korean mother’s copper-tinted
956skin. Max invited Kimi to a party at his place.
957The parties at Hungry Manor were legendary, and when
958Kimi arrived the living room was already packed with
959dozens of party guests from Silicon Valley’s keyboard class
960—programmers, system administrators, and Web
961designers—mingling under the glass chandelier. Max lit up
962when he spotted her. He led her on a tour of the house,
963pointing out the geeky accoutrements the Hungry
964Programmers had added.
965The tour ended in Max’s bedroom in Hungry Manor’s
966east wing. For all of the grandeur of the house, Max’s room
967had the charm of a monk’s cell—no furniture but a futon on
968the floor, no comforts except a computer. For the party, Max
969had trained blue and red spotlights on a bottle of
970peppermint schnapps—his only vice. Kimi returned for
971dinner the next night, and there was a single item on his
972vegetarian menu: raw cookie dough. Max shaved the
973sugary sludge off in slices and served it to his date with the
974schnapps. Why, after all, would anyone not eat raw cookie
975dough for dinner, given the option?
976Kimi was intrigued. Max needed so little to be happy. He
977was like a child. When his birthday came soon after the
978party, she sent a decorated box of balloons to his office at
979MPath, and Max was moved nearly to tears by the gesture.
980She was his “dream girl,” he told her later. They began to
981talk about committing to a life together.
982In September, Hungry Manor’s landlord, unhappy with the
983programmers’ upkeep of the estate, reclaimed the house,
984and after a final bash to bid farewell to their communal
985mansion, the Hungries scattered to rentals throughout the
986Bay Area. Max and Kimi landed in their own place in
987Mountain View, a cramped studio in a barracks-like
988apartment complex alongside the 101 freeway, Silicon
989Valley’s congested main artery.
990Max resumed his work for the FBI, and his haunting of
991IRC led him to a new opportunity—his chance to break out
992as a white-hat hacker. He’d made a friend in the chat
993rooms who was starting a real consulting business in San
994Francisco and was interested in bringing Max on board.
995Max went up to the city to visit Matt Harrigan, aka, “Digital
996Jesus.”
997Harrigan, just twenty-two, was one of four white hats who’d
998been profiled in a Forbes cover story the previous year,
999and he’d cannily used his fifteen minutes of fame to win
1000some seed money for a business: a professional hacking
1001shop in San Francisco’s financial district.
1002The idea was simple: Corporations would pay his
1003company, Microcosm Computer Resources, to put their
1004networks through a real hack attack, culminating in a
1005detailed report on the client’s security strengths and
1006weaknesses. The business of “penetration testing”—as it
1007was called—had been dominated by the Big Five
1008accounting firms, but Harrigan was already signing up
1009clients by admitting something that no accounting firm
1010would ever announce: that his experience came from reallife
1011hacking, and he was freely hiring other ex-hackers.
1012MCR would be billing out between $300 and $400 an
1013hour, Harrigan explained. Max would work as a
1014subcontractor, making $100 to $150. All for doing two of
1015the things he liked most in the world: hacking into shit and
1016writing reports.
1017Max had found his niche. It turned out his singlemindedness
1018made him a natural at penetration testing: He
1019was immune to frustration, hammering at a client’s network
1020for hours, moving from one attack vector to another until he
1021found a way in.
1022With Max making real money at MCR, Kimi quit her job
1023as a barista and found more rewarding work teaching
1024autistic students. The couple moved from the cramped
1025apartment in Mountain View to a duplex in San Jose. In
1026March, they got married in a church on a college campus in
1027Lakewood, Washington, where Kimi’s family lived.
1028Tim Spencer and most of the Hungry Programmers went
1029up to Washington to see their problem child married off.
1030Max’s parents, his sister, Kimi’s family, and scores of
1031friends and extended family showed up for the ceremony.
1032Max wore a tuxedo and a broad grin, and Kimi glowed in
1033her white wedding dress and veil. Surrounded by family and
1034beloved friends, they were a picture-perfect young couple
1035beginning a life together.
1036They posed outside: Kimi’s father, a military man, stood
1037proudly in his dress uniform, her mother in a traditional
1038Korean hanbok. Flanked by his own parents, Max beamed
1039at the camera, while storm clouds gathered overhead in the
1040Pacific Northwest sky.
1041It was three years almost to the day since Max walked
1042out of prison, and he had everything now—a devoted wife,
1043a promising career as a white-hat hacker, a nice home. In
1044just a few weeks, he’d throw it all away.
1045
10465
1047Cyberwar!
1048ack home in San Francisco, a temptation was waiting
1049for Max, written in computer code.
1050bcopy (fname, anbuf, alen = (char *)*cpp - fname);
1051It was one line of nine thousand comprising the Berkeley
1052Internet Name Domain, an ancient girder in the Internet’s
1053infrastructure, as important as any router or fiber-optic
1054cable. Developed in the early 1980s with a grant from the
1055Pentagon’s Defense Advanced Research Projects Agency
1056(DARPA), BIND implemented the scalable Domain Name
1057System, a kind of distributed telephone directory that
1058translates strings like Yahoo.com, which humans
1059understand, into the numeric addresses the network
1060comprehends. Without BIND, or one of the competing
1061programs that followed, we’d be getting our online news
1062from 157.166.226.25 instead of CNN.com and visiting
106374.125.67.100 to perform a Google search.
1064BIND was one of the innovations that made the explosive
1065growth of the Internet possible—it replaced a crude
1066mechanism that couldn’t have expanded with the Net. But in
1067the 1990s, it was also one of the legacy programs that
1068were shaping up as the modern Internet’s biggest security
1069problem. The code was a product of a simpler time, when
1070the network was cloistered and threats were few. Now
1071hackers were plumbing its depths and coming back with a
1072seemingly endless supply of security holes.
1073A high priesthood of network experts called the Internet
1074Software Consortium appointed themselves keepers of the
1075code and had begun furiously rewriting it. But in the
1076meantime, the most modern, sophisticated networks in the
1077world, with sparkling new servers and workstations, were
1078running a buggy computer program from another age.
1079In 1998, security experts discovered the latest flaw in the
1080code. It boiled down to that single line. It accepted an
1081inquiry from the Internet, as it should, and copied it byte for
1082byte into the temporary buffer “anbuf” in the server’s
1083memory. But it didn’t properly check the size of the
1084incoming data. Consequently, a hacker could transmit a
1085deliberately overlong query to a BIND server, overflow the
1086buffer, and spill data into the rest of the computer’s memory
1087like oil from the Exxon Valdez.
1088Performed haphazardly, such an attack would cause the
1089program to crash. But a careful hacker could do much
1090worse. He could load the buffer with his own small snippet
1091of executable computer code, then he could keep going,
1092tripping cautiously all the way to the top of the program’s
1093memory space, where a special short-term storage area
1094called the “stack” resides.
1095The stack is where the computer’s processor keeps
1096track of what it’s doing—every time a program diverts the
1097computer off to a subroutine, the processor pushes its
1098current memory address onto the stack, like a bookmark,
1099so it knows where to return to when it’s done.
1100Once a hacker is in the stack, he can overwrite the last
1101return address with the location of his own malicious
1102payload. When the computer is done with the current
1103subroutine, it returns not to where it began, but to the
1104hacker’s instruction—and because BIND runs under the allpowerful
1105administrative “root” account, the attacker’s code
1106does as well. The computer is now under the hacker’s
1107control.
1108Two weeks after Max and Kimi’s wedding, the
1109government-funded Computer Emergency Response Team
1110at Carnegie Mellon University—which runs a kind of
1111Emergency Broadcast System for security holes—issued
1112an alert about the BIND flaw, along with a link to the simple
1113fix: two additional lines of computer code that rejected
1114overlong queries. But CERT packaged its alert with two
1115other BIND vulnerabilities that were of little consequence
1116and understated the importance of the hole. Consequently,
1117not everyone appreciated the gravity of the situation.
1118Max understood perfectly.
1119He read the CERT advisory with amazement. BIND
1120came installed standard with Linux, and it ran on servers on
1121corporate, ISP, nonprofit, educational, and military
1122networks. It was everywhere. And so was the defective line
1123of code. The only thing holding back a feeding frenzy of
1124attacks was that nobody had written a program to exploit
1125the security hole. But that was just a matter of time.
1126Sure enough, on May 18, an exploit program showed up
1127on Rootshell.com, a computer security news site run by
1128hobbyists. Max picked up the phone and called his FBI
1129contact, Chris Beeson, at home. The situation was serious,
1130he explained. Anybody who hadn’t installed the BIND patch
1131could now be hacked by any script kiddy capable of
1132downloading a program and typing a command.
1133If history was a guide, government computers would be
1134particularly vulnerable. Just a month earlier, a less serious
1135bug in the Sun Solaris operating system had led to a
1136hacker cracking computers at a dozen U.S. military bases,
1137in what a deputy defense secretary called “the most
1138organized and systematic attack to date” on American
1139defense systems. Those attacks had set off a full-blown
1140cyberwarfare false alarm: The Pentagon gave the intrusions
1141the code name “Solar Sunrise” and considered Saddam
1142Hussein the prime suspect until investigators traced the
1143attacks to a young Israeli hacker who was just playing
1144around.
1145Max called Beeson again the next day, when a hacker
1146group named ADM released a weaponized version of the
1147BIND exploit designed to scan the Internet at random
1148BIND exploit designed to scan the Internet at random
1149looking for unpatched servers, then break in, install itself,
1150and use the newly compromised computer as a platform for
1151still more scans and break-ins. It was a certainty now that
1152someone was going to own the entire Internet. It was just a
1153question of who.
1154He hung up and pondered. Someone was going to do it.
1155…
1156He shared his plans with his new wife in boyish, excited
1157tones. Max would author his own BIND attack. His version
1158would close the hole everywhere it found it, like releasing
1159sterile fruit flies to tamp down an infestation. He would limit
1160his attack to the targets most in need of an emergency
1161security upgrade: U.S. military and civilian government
1162sites.
1163“Don’t get caught,” said Kimi, who’d learned not to argue
1164with Max when he was like this, his mind hostage to an
1165idea.
1166Max was struggling with the binary nature of his
1167personality: the professional married man with a stake in
1168the world around him, and the impulsive child tempted by
1169every call to mischief. The child won. He sat at his keyboard
1170and plunged into furious programming.
1171His code would operate in three rapid-fire stages. It
1172would begin by flinging a virtual grappling hook through the
1173BIND hole, executing commands that forced the machine to
1174reach out over the Internet and import a 230-byte script.
1175That script, in turn, would connect it to a different host
1176infiltrated by Max, where it would download a hefty package
1177of evil called a “rootkit.”
1178A rootkit is a bundle of standard system programs that
1179have been corrupted to secretly serve the hacker: A new
1180login program operates just like the real thing but now
1181includes a back door through which the intruder can reenter
1182the machine. The “passwd” program still lets users change
1183their passwords but also quietly records and stores the new
1184password where it can be retrieved later. The new list
1185program lists the contents of a directory, as it should, but
1186takes care to conceal any files that are part of the rootkit.
1187Once the rootkit was in place, Max’s code would
1188accomplish what the government failed to do: It would
1189upgrade the hacked computer to the latest version of BIND,
1190closing the security hole through which it had entered. The
1191computer would now be safe from any future attacks, but
1192Max, the benevolent meddler, would still be able to reenter
1193the system at will. Max was at once fixing the problem and
1194exploiting it; he was a black hat and a white hat at the same
1195time.
1196The whole attack would take just a couple of minutes
1197each time. One moment, the computer would be controlled
1198by the system administrators; then, grappling hook,
1199download script, rootkit, and it was in Max’s pocket.
1200Max was still programming when the FBI got back to him
1201and asked for a full report on the BIND hole. But the feds
1202had had their chance; Max’s code would speak for him
1203now. He took a moment to crack a couple of college
1204machines to use as a staging ground, then, on May 21, a
1205Tuesday, he dialed the Internet through a stolen Verio
1206account … and launched.
1207The results were instant and highly satisfying. Max’s
1208grappling-hook code was designed to signal its success to
1209his computer over the Verio dial-up, so he could watch the
1210attack spread. Hacked machines around the country
1211reported back to him, an Xterm window popping up on his
1212screen for each one. Brooks Air Force Base—now
1213property of Max Vision. Mc-Chord, Tinker, Offutt, Scott,
1214Maxwell, Kirtland, Keesler, Robins. His code wormed into
1215Air Force servers, Army computers, a machine in the office
1216of a cabinet secretary. Each machine now had a back door
1217that Max could use any time he wanted.
1218Max was notching up military conquests like points in a
1219video game. When his code swept into the Navy’s Internet
1220space, it found so many unpatched BIND servers that the
1221stream of pop-ups turned into a torrent. His own computer
1222struggled under the strain, then crashed.
1223After some fine-tuning, he relaunched. For five days he
1224was absorbed in his growing dominion over cyberspace.
1225He ignored e-mail from the FBI, who still wanted that report.
1226“Where’s the stuff?” Agent Beeson wrote. “Please call.”
1227There had to be more he could do with the power to
1228crack almost any network he wanted. Max trained his BIND
1229exploit on the servers of Id Software in Mesquite, Texas, a
1230gaming company developing a third installment of the
1231enormously popular first-person shooter Quake. Max loved
1232first-person shooters. He was on the network in a flash, and
1233after some exploring, he emerged with his trophy. He
1234announced to Kimi that he’d just obtained the source code
1235—the virtual blueprints—for Quake III, the most anticipated
1236game of the year.
1237Kimi was unmoved. “Can you put it back?”
1238Max soon realized that his attacks were getting some
1239attention. At Lawrence Berkeley National Laboratory, a
1240researcher named Vern Paxson spotted Max’s scanning
1241using a new system he’d developed called BRO, for Big
1242Brother. BRO was an experiment in a relatively new kind of
1243security countermeasure called an intrusion detection
1244system—a cyber burglar alarm with the sole function of
1245sitting quietly on a network and sifting through all the traffic
1246for suspicious activity, alerting administrators when it spots
1247something that doesn’t look right.
1248Paxson wrote a full report on the attack for CERT. Max
1249intercepted it and was impressed. The researcher had not
1250only detected his attack, he’d compiled a list of servers that
1251Max’s code was attacking through Lawrence Berkeley’s
1252network—Max was using the network as one of his
1253secondary launch points. He sent Paxson an anonymous
1254note from the lab’s root account.
1255Vern,
1256I’m sorry to have caused you any inconvenience, but I
1257single-handed fixed a MAJOR GAPING SECURITY
1258HOLE in many of your systems. I admit there were new
1259holes but these were all passworded, and I would
1260never cause damage to someone’s computer system.
1261If I didn’t hit these, someone else would have, and
1262they would have been dirty. These kids leave warez
1263and IRC BS laying everywhere, and /bin/rm systems
1264when they are unhappy. Lame.
1265You might not appreciate what I was doing, but it
1266was for the greater good. I am abandoning all hosts on
1267that list that you captured.… I am not touching those
1268systems since I know you turned them over to CERT.
1269CERT should hire people with my skill. Of course, if
1270paid I would never leave rootkits or such.
1271Pretty clever though? Heh. It was a blast. Owning
1272hundreds, nay thousands of systems, and knowing that
1273you were FIXING them on the way …
1274Uhm, I’m not ever doing this sort of shit again. You
1275have my tools now. That pisses me off …
1276Hrm. Anyway I just don’t want this to happen again,
1277so I’m going to let it lie …
1278“The Cracker”
1279With that, Max shut down his five-day attack on the
1280government, with more cracked systems behind him than
1281he could count. He was satisfied that he’d made the Internet
1282safer than it was before; thousands of computers that had
1283been vulnerable to every hacker in the world were now
1284vulnerable to only one: Max Vision.
1285Max immediately jumped into a new, more socially
1286acceptable project: He would write a Web application that
1287would let anyone on the Internet request an automatic realtime
1288scan of their network to assess whether or not they
1289were open to the BIND attack. He also conceived a benign
1290variant of the siege he’d just concluded. Like before, he
1291would scan government and military networks. But instead
1292of cracking the vulnerable computers, he’d automatically
1293send an e-mail warning to the administrators. There’d be
1294no need to hide behind a hacked dial-up account this time.
1295Both services would live on his brand-new public website:
1296Whitehats.com.
1297After two days and nights of work, he was knee-deep in
1298his new, legal hacking project when Beeson e-mailed
1299again. “What happened? Thought you’d send me e-mail.”
1300Max could hardly explain to his FBI friend that he’d been
1301busy staging one of the largest government computer
1302breaches in history. So he emphasized his new project
1303instead. “I am almost finished creating a public service
1304vulnerability scanner and patch site—but there are some
1305parts that aren’t ready for release,” he wrote back.
1306“Oh, and here is the ADM worm program,” he added. “I
1307don’t think it will spread very far.”
1308
13096
1310I Miss Crime
1311n the afternoon of June 2, Max opened the door of his
1312San Jose duplex to greet Chris Beeson and registered
1313instantly that he was in trouble: There were three other suits
1314with the FBI agent, including Beeson’s surly boss, Pete
1315Trahon, head of the computer crime squad.
1316The month after the BIND attack had been a busy time
1317for Max. He launched Whitehats.com, and it was an instant
1318success in the security world. In addition to housing his
1319scanning tool, the site collected the latest CERT advisories
1320and links to BIND software patches, as well as a paper Max
1321had written dissecting the ADM worm with the clarity and
1322the discerning eye of a connoisseur. Nobody in the
1323community suspected that Max Vision, the rising star
1324behind Whitehats.com, had personally provided the
1325brightest example of the seriousness of the BIND security
1326hole.
1327He was also continuing to file reports to the FBI. After his
1328last one, Beeson began e-mailing to arrange a casual
1329meeting, supposedly to go over Max’s latest findings. “How
1330’bout if we just meet at your place?” Beeson wrote. “I know I
1331have the address somewhere around here.”
1332Now that he was on Max’s doorstep, Beeson explained
1333why they were really there. He knew all about Max’s attack
1334on the Pentagon. One of the men with him, a young
1335Washington, DC–based Air Force investigator named Eric
1336Smith, had traced the BIND intrusions to Max’s house.
1337Beeson had a search warrant.
1338Max let them in, already apologizing. He only meant to
1339help, he explained.
1340They chatted amicably. Max, happy for an audience,
1341grew expansive, describing the twists and turns of his
1342attack and listening with interest as Smith described how
1343he’d tracked Max through the pop-up messages Max had
1344used to alert himself when a system was subverted: The
1345messages went to a Verio dial-up, and a subpoena to the
1346ISP produced Max’s phone number. It hadn’t been difficult.
1347Max had convinced himself he was doing something
1348positive for the Internet, so he hadn’t done much to cover
1349his tracks.
1350The feds asked if anyone had known what Max was up
1351to, and he said his boss was involved. Matt Harrigan—
1352Digital Jesus—had not completely given up hacking
1353himself, Max said, adding that Harrigan’s company was
1354about to get a contract with the National Security Agency.*
1355At the agents’ behest, Max wrote out a confession. “My
1356motives were purely for research and ‘to see if it could be
1357done,’ ” Max wrote. “I know this is no excuse, and believe
1358me, I am sorry for it, but it’s the truth.”
1359Kimi came home from school to find the feds still tossing
1360the house. Like grazing deer, they looked up in unison as
1361she entered, dismissed her as unthreatening, and turned
1362wordlessly back to their work. When they left, they hauled
1363Max’s computer equipment with them.
1364The door closed, leaving the newlyweds alone in what
1365was left of their home. An apology formed on Max’s lips.
1366Kimi cut him off angrily.
1367“I told you not to get caught!”
1368The FBI agents saw an opportunity in Max’s crime. Trahon
1369and Beeson returned to Max’s home and gave their former
1370ally the score. If Max hoped for leniency, he’d have to work
1371for them—and writing reports wasn’t going to cut it
1372anymore.
1373Eager to make amends and determined to salvage his
1374life and career, Max didn’t ask for anything in writing. He
1375took it on faith that if he helped the FBI agents, they would
1376help him.
1377Two weeks later, Max got his first assignment. A gang of
1378phone phreaks had just hijacked the phone system at the
1379networking company 3Com and were using it as their own
1380private teleconferencing facility. Beeson and Trahon could
1381dial into the illicit chat line, but they doubted their ability to
1382blend in with the hackers and gain any useful intelligence.
1383Max studied up on the latest phone phreaking methods,
1384then dialed into the system from the FBI’s field office while
1385the bureau recorded the call.
1386Dropping the names of hackers he knew and drawing on
1387his own expertise, Max easily persuaded the phone
1388phreaks that he was one of them. They opened up and
1389revealed that they were an international gang of about thirtyfive
1390phone hackers called DarkCYDE, living mostly in
1391Britain and Ireland. DarkCYDE aspired to “unite Phreakers
1392and Hackers all over the world into one big digital army,”
1393according to the group’s blustery manifesto. But at root they
1394were just kids playing with the phone, just as Max had done
1395in high school. After the call, Beeson asked Max to stay
1396close to the gang. Max chatted them up on IRC and turned
1397over the logs to his handlers.
1398Pleased with Max’s work, the agents summoned him to
1399the federal building in San Francisco a week later to brief
1400him on a new assignment. This time, he’d be going to
1401Vegas.
1402Max’s eyes moved over the nest of linen-clad card tables in
1403the gaudy exhibit hall of the Plaza Hotel and Casino.
1404Dozens of young men in T-shirts and shorts or jeans—the
1405hacker’s uniform—were at the tables hunkered over a bank
1406of computer workstations or standing on the sidelines,
1407occasionally pointing at something on a screen.
1408To the untrained eye, it was a strange way to spend a
1409weekend in Sin City—banging on keyboards like some
1410anonymous cubical drone, far from the pool, the slots, and
1411the shows. But the hackers were in pitched competition,
1412working in teams to penetrate a clutch of computers
1413hanging off a hastily erected network. The first team to
1414leave their virtual marker in one of the targets would claim a
1415$250 prize and valuable bragging rights—with points also
1416awarded for hacking other competitors. New attacks and
1417ruses were flowing from the hackers’ fingers, and secret,
1418stockpiled exploits were being pulled from virtual armories
1419to be used in public for the first time.
1420At Def Con, the world’s largest hacking convention, the
1421Capture the Flag competition was Fischer vs. Spassky
1422every year.
1423Kimi wasn’t impressed, but Max was in heaven. Across
1424the floor, more tables were cluttered with vintage computer
1425gear, odd electronics, lock-picking tools, T-shirts, books,
1426and copies of 2600: The Hacker Quarterly. Max spotted
1427Elias Levy, a famous white-hat hacker, and pointed him out
1428to Kimi. Levy, aka Aleph One, was the moderator of the
1429Bugtraq mailing list—the New York Times of computer
1430security—and the author of a seminal tutorial on buffer
1431overflows called “Smashing the Stack for Fun and Profit”
1432that had appeared in Phrack. Max didn’t dare approach the
1433luminary. What would he say?
1434Max wasn’t the only law enforcement mole at Def Con, of
1435course. From its humble beginnings in 1992 as a one-off
1436conference pulled together by a former phone phreak, Def
1437Con had grown into a legendary gathering that drew nearly
1438two thousand hackers, computer security professionals,
1439and hangers-on from around the world. They came to party
1440in person with comrades they’d befriended online, present
1441and attend technical talks, buy and sell merchandise, and
1442get very, very drunk in all-night bashes in the hotel rooms.
1443Def Con was such an obviously target-rich environment
1444for the government that the organizer, Jeff “the Dark
1445Tangent” Moss, had invented a new convention game
1446called Spot the Fed. A hacker who thought he’d identified a
1447G-man in the crowd could point him out, make a case, and,
1448if the audience concurred, take home a coveted I SPOTTED
1449THE FED AT DEF CON T-shirt. Often the suspected fed would
1450just give up and good-naturedly whip out a badge, giving
1451the hacker an easy win.
1452Max’s mission was broad. Trahon and Beeson wanted
1453him to chum up to his fellow hackers and try to get their real
1454names, then lure them into exchanging public PGP
1455encryption keys, which security-minded geeks use like
1456sealing wax to encrypt and sign their e-mail. Max’s heart
1457just wasn’t in it. Writing reports for the bureau was one
1458thing, and he’d had no qualms about getting the goods on
1459the DarkCYDE phreaks, who were too young to get in real
1460trouble. But this assignment smelled like snitching.
1461Personal loyalty was written deep into Max’s firmware, and
1462one look at the Def Con crowd told him these were his
1463people.
1464Many of the hackers were reluctantly giving up childish
1465things, migrating into legitimate dot-com jobs or starting
1466security companies. They were becoming white hats, like
1467Max. A popular T-shirt at the conference summed up the
1468mood: I MISS CRIME.
1469Max shrugged off the FBI’s edict and began attending
1470the parties and the talks. On the roster this year was a
1471much-anticipated software release by the Cult of the Dead
1472Cow. The cDc were the rock stars of the hacker world—
1473literally: They recorded and performed music and infused
1474their conference presentations with over-the-top theatrics
1475that made them media darlings. At this Def Con the group
1476was unleashing Back Orifice, a sophisticated remotecontrol
1477program for Windows machines. If you could trick
1478someone into running Back Orifice, you could access their
1479files, see what was on their screen, and even look through
1480their webcam. It was designed to embarrass Microsoft for
1481the shoddy security in Windows 98.
1482The crowd at the Back Orifice presentation was ecstatic,
1483The crowd at the Back Orifice presentation was ecstatic,
1484and Max found the energy infectious. But of more
1485pragmatic interest to Max was a talk on the legalities of
1486computer hacking by a San Francisco criminal defense
1487attorney named Jennifer Granick. Granick opened her
1488presentation by describing the recent landmark prosecution
1489of a Bay Area hacker named Carlos Salgado Jr., a thirtysix-
1490year-old computer repairman who, more than any other
1491hacker, represented the future of computer crime.
1492From his room in his parents’ house in Daly City, a few
1493miles south of San Francisco, Salgado had cracked a
1494major technology company and stolen a database of eighty
1495thousand credit card numbers, with names, ZIP codes, and
1496expiration dates. Credit card numbers had been hacked
1497before, but what Salgado did next assured him a place in
1498the cybercrime history books. Using the handle “Smak,” he
1499jumped into the #carding chat room on IRC and put the
1500entire list up for sale.
1501It was like offering a 747 for sale at a flea market. At the
1502time, the online credit card fraud underground was a
1503depressing bog of kids and small timers who’d barely
1504advanced beyond the previous generation of fraudsters
1505fishing receipt carbons from the Dumpsters behind the
1506mall. Their typical deals were in the single digits, and their
1507advice to one another was tainted by myth and idiocy. Much
1508of the conversation unfolded in an open channel where
1509anyone in law enforcement could log in and watch—the
1510carders’ only security was the fact that nobody would
1511bother.
1512Remarkably, Salgado found a prospective buyer in
1513#carding—a San Diego computer science student who’d
1514been putting himself through college by counterfeiting credit
1515cards, getting the account numbers from billing statements
1516pilfered from the U.S. mail. The student had mob contacts
1517who, he believed, would buy Smak’s entire stolen database
1518for six figures.
1519The deal went south when Salgado, looking to perform a
1520little due diligence, hacked his customer’s ISP and poked
1521through his files. When the student found out, he got mad
1522and secretly began working with the FBI. On the morning of
1523May 21, 1997, Salgado showed up at a meeting with his
1524buyer at the smoking lounge at San Francisco International
1525Airport, where he expected to trade a CD-ROM containing
1526the database for a suitcase packed with $260,000 in cash.
1527Instead, he was arrested by the San Francisco computer
1528crime squad.
1529The foiled plot was an eye-opener for the FBI: Salgado
1530represented the first of a new breed of profit-oriented
1531hacker, and he posed a threat to the future of e-commerce.
1532Surveys showed that Web users were anxious about
1533sending credit card numbers into the electronic ether—it
1534was the number one thing holding them back from Internet
1535purchasing. Now, after years of struggling to gain
1536consumers’ trust and reward the faith of investors, ecommerce
1537companies were starting to win over Wall
1538Street. Less than two weeks before Salgado’s arrest,
1539Amazon.com had launched its long-awaited initial public
1540offering and ended the day $54 million richer.
1541Salgado’s IPO was higher: The credit card companies
1542determined the total spending limits on his eighty thousand
1543cards amounted to over a billion dollars—$931,568,535 if
1544you subtracted the legitimate owners’ outstanding
1545balances. The only thing he’d been missing was a
1546NASDAQ to trade on. Once the underground figured out
1547that part of the equation, it would be an industry of its own.
1548As soon as Salgado was arrested, he’d confessed
1549everything to the FBI. That, Granick told the Def Con
1550hackers in her presentation, was his big mistake. Despite
1551his cooperation, Salgado had been sentenced to thirty
1552months in prison earlier that year.
1553“Now, the FBI wanted me to tell you that it was good for
1554Mr. Salgado that he talked.” Granick paused. “That’s
1555bullshit.
1556“Just say no!” she said, and cheers and whistles swelled
1557from the audience. “There’s never any good reason to talk
1558to a cop.… If you’re going to cooperate, you’re going to
1559cooperate after consulting with a lawyer and cutting a deal.
1560There’s never any reason to give them information for free.”
1561In the back of the room, Kimi prodded Max in the ribs
1562with her elbow. Everything Granick was advising computer
1563intruders not to do, Max had done. Everything.
1564Max was having second thoughts about his arrangement
1565with the feds.
1566• • •
1567“We need to make some changes in the way we do
1568business.”
1569Max could feel the frustration radiating from his screen as
1570he read the latest note from Chris Beeson. Max had
1571returned from Def Con empty-handed and then blown off a
1572meeting at the federal building at which he was supposed
1573to get a new assignment, pissing off Beeson’s supervisor,
1574Pete Trahon. Continuing his e-mail, Beeson warned Max of
1575dark consequences for continued flakiness. “In the future,
1576missed appointments without exceptional reasons will be
1577considered uncooperative on your part. If you are not willing
1578to cooperate then we HAVE to take the appropriate
1579actions. Pete is meeting with the prosecutor on YOUR case
1580Monday. He wants to meet with you promptly in our office at
158110:00am sharp, MONDAY 8/17/98. I am not available next
1582week (that is why I wanted to meet with you this week) so
1583you’re going to have to deal directly with Pete.”
1584This time, Max showed up. Trahon explained that he’d
1585become interested in Max’s boss at MCR, Matt Harrigan.
1586The agent was alarmed at the idea of a hacker running a
1587cybersecurity shop staffed with other hackers, like Max, and
1588vying for a contract with the NSA. If Max wanted to make
1589the FBI happy, he had to get Harrigan to admit he was still
1590hacking and had played a role in Max’s BIND attack.
1591The agent gave Max a new form to sign. It was Max’s
1592written consent to wire him for sound. Trahon handed him a
1593bureau-issued recording device disguised as a pager.
1594On the way home, Max pondered the situation. Harrigan
1595was a friend and fellow hacker. Now the FBI was asking
1596Max to perform the ultimate betrayal—to become Digital
1597Jesus’s real-life Judas.
1598The next day, Max met Harrigan at a Denny’s diner in
1599San Jose, without the FBI wire. His eyes scanned over the
1600other diners and looked out the window into the parking lot.
1601There could be feds anywhere.
1602He pulled out a piece of paper and slipped it across the
1603booth. “Here’s what’s going on.…”
1604Max phoned Jennifer Granick after the meeting—he’d
1605gotten her card at the conclusion of her Def Con talk—and
1606she agreed to represent him.
1607When they learned Max had lawyered up, Beeson and
1608Trahon wasted no time in officially dropping him as an
1609informant. Granick began phoning the FBI and the
1610prosecutor’s office to find out what the government had
1611planned for her new client. Three months later she finally got
1612an answer from the government’s top cybercrime
1613prosecutor in Silicon Valley. The United States was no
1614longer interested in Max’s cooperation. He could look
1615forward to going back to prison.
1616* Harrigan’s involvement is in dispute. Max says he planned
1617the BIND attack with Harrigan at the MCR office and that
1618Harrigan wrote the program that built the target list of
1619government computers. Harrigan says he was not involved
1620but was aware of what Max was up to.
1621
16227
1623Max Vision
1624ith his government service at an end, Max went to
1625work building his reputation as a white-hat hacker, even as
1626he lived under the sword of Damocles of a pending federal
1627indictment.
1628The BIND vulnerability and the resultant success of
1629Whitehats.com had given him a running start. Now Max
1630hung up his own shingle as a computer security consultant,
1631erecting a new website touting his services as a hacker for
1632hire at one hundred dollars an hour—or free to nonprofit
1633groups. His chief selling point: a 100 percent success rate
1634in penetration tests. He had never once confronted a
1635network he couldn’t crack.
1636It was an exciting time to be a white hat. The rebellious
1637spirit that drove the open-source software movement was
1638planting itself in the computer security world, and a new
1639crop of college graduates, dropouts, and former and
1640current black hats was upending the conservative
1641assumptions that had dominated security thinking for
1642decades.
1643First to be dustbinned was the tenet that security holes
1644and attack methods should be kept quiet, held privately
1645among a cadre of trusted responsible adults. The white
1646hats called this notion “security through obscurity.” The new
1647generation preferred “full disclosure.” Discussing security
1648problems widely not only helped get them fixed, but it also
1649advanced the science of security, and hacking, as a whole.
1650Keeping bugs private only benefited two groups: the bad
1651guys who were exploiting them, and vendors like Microsoft
1652that preferred to fix security holes without confessing the
1653details of their screwups.
1654The full-disclosure movement spawned the Bugtraq
1655mailing list, where hackers of any hat color were
1656encouraged to send in detailed reports of security flaws
1657they’d found in software. If they could provide an “exploit”—
1658code that demonstrated the flaw—so much the better. The
1659preferred path to full disclosure was to first notify the
1660software maker and give that company time to issue a
1661patch before releasing the flaw or exploit on Bugtraq. But
1662Bugtraq didn’t censor, and it was common for a bug finder
1663to drop a previously unknown exploit onto the list, releasing
1664it simultaneously to thousands of security researchers and
1665hackers in the span of minutes. The maneuver was all but
1666guaranteed to kick a software company into rapid
1667response.
1668Bugtraq provided hackers with a way to show off their
1669expertise without breaking the law. The ones who were still
1670cracking systems had an invigorated white-hat community
1671to deal with, armed with a growing arsenal of defensive
1672tools.
1673In late 1998, a former NSA cybersecurity contractor
1674named Marty Roesch developed one of the best. Roesch
1675thought it would be fun to see what random attacks were
1676crossing his home cable modem connection while he was
1677at work. As a weekend project, he cranked out a packet
1678sniffer called Snort and released it as an open-source
1679project.
1680At first, Snort was nothing special—a packet sniffer is a
1681common security tool that eavesdrops on the traffic
1682crossing a network and dumps it to a file for analysis. But a
1683month later, Roesch turned his program into a full-blown
1684intrusion detection system (IDS), which would alert the
1685operator whenever it spotted network traffic that matched
1686the signature of a known attack. There were a number of
1687proprietary IDSs on the market, but Snort’s versatility and
1688open-source licensing instantly appealed to the white hats,
1689who loved nothing more than tinkering with a new security
1690who loved nothing more than tinkering with a new security
1691tool. Volunteer programmers jumped in to add functionality
1692to the program.
1693Max was excited by Snort. The software was similar to
1694BRO, the Lawrence Berkeley lab project that had helped
1695sniff out Max’s BIND attack, and Max knew it could be a
1696game changer for online security. Now white hats could
1697watch in real time for anyone trying to exploit the
1698vulnerabilities discussed on Bugtraq and elsewhere. Snort
1699was like an early-warning system for a network—the
1700computer equivalent of the NORAD radar mesh that
1701monitors America’s airspace. All it was lacking was a
1702comprehensive and up-to-date list of attack signatures, so
1703the software would know what to look for.
1704In the first few months after Snort’s release, a
1705disorganized trickle of user-created signatures put the total
1706number at about 200. In a single sleepless night, Max more
1707than doubled the count, whipping up 490 signatures. Some
1708were original, others were improved versions of the existing
1709rules or ports from Dragon IDS, a popular proprietary
1710system. Writing a rule meant identifying unique
1711characteristics in the network traffic produced by a
1712particular attack, like the port number or a string of bytes.
1713For instance, the incantation alert udp any any -> $INTERNAL
171431337 (msg:“BackOrifice1-scan”; content:“|ce63 d1d2 16e7 13cf 38a5
1715a586|”;) detected black hats trying to use the Cult of the
1716Dead Cow’s Back Orifice malware that had so transfixed
1717the crowd at Def Con 6.0. It told Snort that an incoming
1718connection to port 31337, with a particular string of twelve
1719bytes in the network traffic, was someone trying to exploit
1720the back door.
1721Max put the signatures online as a single file on
1722Whitehats.com, crediting a handful of other security geeks
1723for their contributions, including Ghost23—a nod to his alter
1724ego. Later, he converted the file to a full-fledged database
1725and invited other experts to contribute their own rules. He
1726gave the project the catchy name arachNIDS, for Advanced
1727Reference Archive of Current Heuristics for Network
1728Intrusion Detection Systems.
1729ArachNIDS was a hit and helped Snort surge to new
1730levels of popularity in the security community, with Max
1731Vision riding the swell to security stardom. As more white
1732hats contributed to the project, it became the computersecurity
1733equivalent of the FBI’s fingerprint database,
1734capable of identifying virtually every known attack technique
1735and variant. Max built on his success by writing papers
1736dissecting Internet worms with the same clear eye he’d
1737applied to the ADM worm. The technology press started
1738seeking him out for comment on the latest attacks.
1739In 1999, Max injected himself into another promising
1740venture aimed directly at tricking black-hat hackers. The
1741Honeynet Project, as it would later be called, was the work
1742of a former Army officer who applied his interest in military
1743tactics to erect network “honeypots”—decoy computers that
1744served no purpose but to be hacked. The Honeynet Project
1745would secretly wire a packet sniffer to the system and place
1746it unprotected on the Internet, like an undercover vice cop
1747decked out in pumps and a short skirt on a street corner.
1748When a hacker targeted a honeypot, his every move
1749would be recorded and then analyzed by security experts,
1750with the results released to the world in the spirit of full
1751disclosure. Max delved into the forensic work,
1752reconstructing crimes from raw packet data and producing
1753cogent analyses that blew the lid off some of the
1754underground’s concealed techniques.
1755But Max knew his rising recognition as a white hat
1756wouldn’t save him from the federal grand jury. In quiet
1757moments, he fantasized with Kimi about escaping his fate.
1758They could run off together, to Italy or some remote island.
1759They’d start over. He’d find a benefactor, someone with
1760money who recognized Max’s talent and would pay him to
1761hack.
1762The couple’s relationship was suffering under the weight
1763of the government’s silent looming presence in their life.
1764Before the raid, they hadn’t much planned for the future.
1765Now they couldn’t. The future had been taken out of their
1766control, and the uncertainty was toxic. They fought in private
1767and snipped at each other in public. “The reason I signed
1768the confession is because we’d just gotten married, and I
1769didn’t want to hurt you,” Max said. He blamed himself, he
1770added. By getting married, he’d given his enemies a
1771weapon to use against him, a fatal flaw.
1772Kimi transferred from De Anza, a community college, to
1773UC Berkeley, and the couple moved across the bay to live
1774just off campus. The move proved fortuitous for Max. In the
1775spring of 2000, a Berkeley company named Hiverworld
1776offered him a long-awaited shot at the dot-com success
1777that had already graced other Hungry Programmers. The
1778company’s plan was to create a new antihacking system
1779that would detect intrusions, like Snort, but also actively
1780scan the user’s network for vulnerabilities, allowing it to
1781ignore malicious volleys that had no chance of success.
1782Snort author Marty Roesch was employee number 11. Now
1783the company wanted Max Vision as number 21.
1784Max’s first day was set for March 21. It was an early
1785position at a promising technology start-up. The American
1786dream, circa 2000.
1787On the morning of March 21, 2000, the FBI knocked on
1788Max’s door.
1789At first he thought it was a Hiverworld hazing, a practical
1790joke. It wasn’t. “Just don’t answer it!” he said to Kimi. He
1791grabbed a phone and found a hiding place, in case the
1792agents peered through the windows. He dialed Granick and
1793told her what was happening. The indictment must have
1794finally come down. The FBI was there to take him to jail.
1795What should he do?
1796The agents left—their arrest warrant didn’t authorize
1797them to crash into Max’s home, so he’d temporarily
1798thwarted them by the simple act of not answering the door.
1799On her end, Granick called the prosecutor to try to arrange
1800for a civilized self-surrender at the FBI field office in
1801Oakland. Max contacted Hiverworld’s CTO, his new boss,
1802to report that he wouldn’t be showing up for his first day at
1803work. He’d be in touch in a day or two to explain everything,
1804he said.
1805The evening news beat him to the punch: Alleged
1806computer hacker Max Butler had just turned himself in on a
1807fifteen-count indictment charging illegal interception of
1808communications, computer intrusion, and possession of
1809stolen passwords.
1810After two nights in jail, Max was brought in front of a
1811federal magistrate in San Jose for arraignment. Kimi, Tim
1812Spencer, and a dozen Hungry Programmers filled the
1813gallery. Max was released on a $100,000 bond—Tim
1814signed for half, and a fellow Hungry who’d struck it rich at a
1815dot-com put down the remainder in cash.
1816The arrest sent shock waves through the computer
1817security world. Hiverworld canceled its job offer on the spot
1818—no security start-up could hire a man facing current
1819computer intrusion charges. The community fretted over
1820what would happen to the arachNIDS database without
1821Max’s curatorship. “It’s his stuff,” Roesch ruled in a post on
1822a security mailing list. “So barring him explicitly ceding it to
1823someone, it’s still his to maintain.”
1824Max responded personally in a long message sweeping
1825through his early love of computers and the future direction
1826of intrusion detection. Whitehats.com and arachNIDS would
1827continue no matter what, he predicted. “My family and
1828friends have been incredibly supportive and there are offers
1829to maintain the sites to a certain degree should tragedy
1830occur.”
1831Casting himself as a victim, he railed against the “frenzy
1832of the hacker witch-hunt” and slammed Hiverworld for
1833disloyalty. “After the smoke cleared and I was in the press,
1834Hiverworld decided not to continue our relationship,” he
1835wrote. “The corporation expressed cowardice that is
1836wrote. “The corporation expressed cowardice that is
1837deplorable. I can’t tell you how disappointed I was to feel
1838the complete lack of support from the Hive.
1839“I am innocent until proven guilty,” he wrote. “And would
1840appreciate the recognition of this by our community.”
1841Six months later, Max pleaded guilty. The news was
1842nearly lost amid a flurry of federal hacker prosecutions. The
1843same month, Patrick “MostHateD” Gregory, the leader of a
1844hacker gang called globalHell, was sentenced to twenty-six
1845months in prison and ordered to pay $154,529.86 in
1846restitution for a string of website defacements. At the same
1847time, prosecutors charged twenty-year-old Jason “Shadow
1848Knight” Diekman of California with cracking NASA and
1849university systems for fun, and sixteen-year-old Jonathan
1850James, known as “C0mrade,” received a six-month
1851sentence for his recreational intrusions into Pentagon and
1852NASA computers—the first term of confinement ever
1853handed down in a juvenile hacking case.
1854To all appearances, federal law enforcement now had
1855firm control of the computer intrusions that had for so long
1856struck fear into corporate America and government
1857officials. In truth, all these victories were battles in
1858yesterday’s cyberwar against bedroom hackers, a dying
1859breed. Even as Max copped his plea in a San Jose
1860courtroom, the FBI was discovering a twenty-first-century
1861threat gathering five thousand miles away—one intimately
1862entwined with Max Vision’s future.
1863
18648
1865Welcome to America
1866he two Russians made themselves at home in the
1867small office in Seattle. Alexey Ivanov, twenty, typed on a
1868computer keyboard while his associate, nineteen-year-old
1869Vasiliy Gorshkov, stood by and watched. They were
1870straight off a flight from Russia and already knee-deep into
1871the biggest job interview of their lives—negotiating for a
1872lucrative international partnership with the U.S. computersecurity
1873start-up Invita.
1874Office workers milled around them, and tinny pop music
1875spilled from the computer’s speaker. After a few minutes,
1876Gorshkov drifted off to another computer across the room,
1877and Michael Patterson, Invita’s CEO, struck up a
1878conversation.
1879It had been Patterson who’d invited the Russians to
1880Seattle. Invita, he’d told them in an e-mail, was a young
1881company, but it was gaining customers through contacts
1882the founders had made while working at Microsoft and Sun.
1883Now the company wanted help expanding into Eastern
1884Europe. Ivanov, who claimed to have as many as twenty
1885talented programmers working with him, seemed perfect
1886for the job; Gorshkov was a tag-along, invited by Ivanov to
1887act as the duo’s spokesman. He had a fiancée waiting
1888back home, pregnant with his first child.
1889Patterson began casually asking Gorshkov about a
1890recent rash of computer intrusions into U.S. companies,
1891some of whom paid money to the attackers to make them
1892stop. “Just so I know you guys are as good as I think you
1893are,” Patterson said, “could any of that have been you
1894guys?”
1895Gorshkov—bundled in the heavy jacket he wore back
1896home in Chelyabinsk, a bleak, polluted industrial city in the
1897Ural Mountains—hedged for a minute and finally answered.
1898“A few months ago we tried, but we found it’s not so
1899profitable.”
1900The Russian was being modest. For nearly a year, small
1901to midsized Internet companies around the United States
1902had been plagued by extortionate cyberattacks from a
1903group calling itself the Expert Group of Protection Against
1904Hackers—a name that probably sounds better in Russian.
1905The crimes always unfolded the same way: Attackers from
1906Russia or Ukraine breached the victim’s network, stole
1907credit card numbers or other data, then sent an e-mail or a
1908fax to the company demanding payment to keep quiet
1909about the intrusion and to fix the security holes the hackers
1910exploited. If the company didn’t pay up, the Expert Group
1911would threaten to destroy the victim’s systems.
1912The gang had lifted tens of thousands of credit card
1913numbers from the Online Information Bureau, a financial
1914transaction clearinghouse in Vernon, Connecticut. The
1915Seattle ISP Speakeasy had been hit. Sterling
1916Microsystems in Anaheim, California, had been hacked,
1917along with a Cincinnati ISP, a Korean bank in Los Angeles,
1918a financial services company in New Jersey, the electronic
1919payment company E-Money in New York, and even the
1920venerable Western Union, which had lost nearly sixteen
1921thousand customer credit card numbers in an attack that
1922came with a $50,000 extortion threat. When music-seller
1923CD Universe didn’t give in to a $100,000 ransom demand,
1924thousands of its customers’ credit card numbers showed
1925up on a public website.
1926Several companies wound up paying the Expert Group
1927small amounts to go away, while the FBI did its best to
1928track the intrusions. They finally zeroed in on one of the
1929ringleaders, “subbsta,” whose real name was Alexey
1930Ivanov. It wasn’t that hard—the hacker, convinced he was
1931out of reach of American justice, had given his résumé to
1932out of reach of American justice, had given his résumé to
1933Speakeasy during the extortion negotiations there.
1934Russian police had ignored a diplomatic request to
1935detain and question Ivanov, and that was when the feds
1936created Invita, a full-blown undercover business designed
1937to lure the hacker into a trap. Now Ivanov and Gorshkov
1938were surrounded by undercover FBI agents posing as
1939company employees, along with a white-hat hacker from
1940the nearby University of Washington who was playing the
1941role of a computer geek named Ray. Hidden cameras and
1942microphones recorded everything in the office, and FBIinstalled
1943spyware captured every keystroke typed on the
1944computers. In the parking lot outside, around twenty FBI
1945agents were standing by to help with the arrest.
1946The agent playing CEO Patterson tried to draw Gorshkov
1947out some more. “What about credit cards? Credit card
1948numbers? Anything like that?”
1949“When we’re here, we’ll never say that we got access to
1950credit card numbers,” the hacker replied.
1951The FBI agent and Gorshkov laughed conspiratorially. “I
1952understand. I hear ya, I hear ya,” said Patterson.
1953When the two-hour meeting concluded, Patterson
1954ushered the men into a car, ostensibly to take them to the
1955temporary housing arranged for their visit. After a short
1956drive, the car stopped. Agents threw open the doors and
1957arrested the Russians.
1958Back at the office, an FBI agent realized the keystroke
1959logger installed on the bureau computers at Invita
1960presented him with a rare opportunity. What he did next
1961would make him the first FBI agent to be accused by the
1962Russian federal police of committing a computer crime. He
1963went into the keystroke logs and retrieved the password the
1964pair had used to access their computer in Chelyabinsk.
1965Then, after checking with his supervisor and a federal
1966prosecutor, he logged in to the hackers’ Russian server
1967over the Internet and started scrounging through the
1968directory names, looking for the files belonging to Ivanov
1969and Gorshkov.
1970When he found them, he downloaded 2.3 gigabytes of
1971compressed data and burned it onto CD-ROMs, only later
1972obtaining a warrant from a federal judge to search through
1973the information he’d grabbed. It was the first international
1974evidence seizure through hacking.
1975When the feds dug into the data, the breathtaking scope
1976of Ivanov’s activity became clear. In addition to the extortion
1977plots, Ivanov had developed a frighteningly effective method
1978for cashing out the cards he stole, using custom software to
1979automatically open PayPal and eBay accounts and bid on
1980auctioned goods with one of the half-million stolen credit
1981cards in his collection. When the program won an auction, it
1982had the goods shipped to Eastern Europe, where an
1983associate of Ivanov picked them up. Then the software did
1984it all again and again. PayPal checked the stolen credit
1985card list against its internal databases and found it had
1986absorbed a stunning $800,000 in fraudulent charges.
1987It was the first tremor in a tectonic shift that would
1988fundamentally change the Internet for the next decade.
1989Maybe forever. With top-flight technical colleges but few
1990legitimate opportunities for their graduates, Russia and the
1991former Soviet satellite states were incubating a new breed
1992of hacker.
1993Some, like Ivanov, were amassing personal fortunes by
1994looting consumers and companies, protected by corrupt or
1995lazy law enforcement in their home countries and poor
1996international cooperation. Others, like Gorshkov, were
1997driven into crime by tough economic circumstances. The
1998hacker graduated from Chelyabinsk State Technical
1999University with a degree in mechanical engineering and
2000sank a small inheritance from his father into a computerhosting
2001and Web-design business. Despite his swaggering
2002hacker machismo at Invita, Gorshkov had been a late
2003addition to Ivanov’s gang, and he’d paid his own way to
2004America in the hope of improving his fortunes. In a way, he
2005did: After his arrest in Seattle, he was earning more in
2006did: After his arrest in Seattle, he was earning more in
2007prison doing janitorial and kitchen work at eleven cents an
2008hour than his fiancée was drawing on public assistance
2009back home.
2010After his arrest, Ivanov began cooperating with the FBI,
2011rattling off a list of friends and accomplices still hacking
2012back home. The bureau realized there were dozens of
2013profit-oriented intruders and fraud artists from Eastern
2014Europe already reaching their tentacles into Western
2015computers.
2016In the years to come, the number would grow to
2017thousands. Ivanov and Gorshkov were Magellan and
2018Columbus: Their arrival in America instantly redrew the
2019global cybercrime map for the FBI and placed Eastern
2020Europe indisputably at its center.
2021
20229
2023Opportunities
2024ax wore a blazer and rumpled cargo pants to his
2025sentencing hearing and watched silently as the lawyers
2026sparred over his fate.
2027Jennifer Granick, the defense attorney, told Judge James
2028Ware that Max deserved a lowered sentence for his service
2029as the Equalizer. The prosecutor took the opposite
2030position. Max, he argued, had pretended to be an FBI
2031informant while secretly committing crimes against the U.S.
2032government. It was worse than if he had never cooperated
2033at all.
2034It was a strange sentencing hearing for a computer
2035criminal. A dozen of Max’s colleagues in the security world
2036—people devoted to thwarting hackers—had written to
2037Judge Ware on Max’s behalf. Dragos Ruiu, a prominent
2038security evangelist in Canada, called Max “a brilliant
2039innovator in this field.” French programmer Renaud
2040Deraison credited Max’s early support with making
2041possible Nessus, Deraison’s vulnerability scanner and one
2042of the most important free security tools then available.
2043“Given Max’s potential and his clear vision of Internet
2044security … it would be more useful for society as a whole
2045that he stays among us as a computer security
2046specialist … rather than spend time in a cell and see his
2047computing talent go through a slow but sure decay.”
2048From a technology worker in New Zealand: “Without the
2049work that Max has done … it would be so much harder for
2050my company and countless others to protect themselves
2051from hackers.” From a fan in Silicon Valley: “Taking Max
2052out of the security community would greatly hurt our ability to
2053protect ourselves.” A former Defense Department worker
2054wrote, “To imprison this individual would be a travesty.”
2055Several of the Hungries wrote letters as well, as did
2056Max’s mother and sister. In her note, Kimi pleaded
2057eloquently for Max’s freedom. “He saved my life by helping
2058me out of an abusive relationship and teaching me the
2059meaning of self-respect,” she wrote. “He gave me shelter
2060when I had no place to live. He took very good care of me
2061when I was seriously ill, saving my life again by taking me to
2062the emergency room when I protested that I was ‘fine’ even
2063as I was dying.”
2064When the lawyers finished their arguments, Max spoke
2065for himself, with the earnest politeness he always exhibited
2066away from his computer. His attack, he explained, had
2067been born of good intentions. He’d just wanted to close the
2068BIND hole and had lost his head.
2069“I got swept up,” he said softly. “It’s hard to explain the
2070feelings of someone who’s gotten caught up in the
2071computer security field.… I felt at the time that I was in a
2072race. That if I went in and closed the holes quickly, I could
2073do it before people with more malicious intentions could
2074use them.
2075“What I did was reprehensible,” Max continued. “I’ve hurt
2076my reputation in the computer security field. I’ve hurt my
2077family and friends.”
2078Judge Ware listened attentively but had already made up
2079his mind. Letting Max off without a prison term would send
2080the wrong message to other hackers. “There’s a need for
2081those who would follow your footsteps to know that this can
2082result in incarceration,” the judge said.
2083The sentence: eighteen months in prison, followed by
2084three years of supervised release in which Max wouldn’t be
2085allowed on the Internet without the permission of his
2086probation officer.
2087The prosecutor asked the judge to order Max
2088immediately taken into custody, but Ware denied the
2089request and gave the hacker a month to put his affairs in
2090request and gave the hacker a month to put his affairs in
2091order and turn himself in to the U.S. marshals.
2092• • •
2093Max and Kimi had moved to Vancouver, near her family,
2094after his guilty plea. When they returned home, Max wasted
2095no time arranging for Whitehats.com and arachNIDS to
2096survive his incarceration. He set up automatic bill payments
2097for his bandwidth and wrote out a list of items for Kimi to
2098take care of in his absence. She was in charge of
2099arachNIDS now, he said, indicating the server squatting on
2100the floor of their apartment.
2101The couple adopted two kittens to keep Kimi company
2102while he was gone, named for the swords from Elric of
2103Melniboné. The orange boy-cat was Mournblade; the gray
2104female was Stormbringer.
2105Max spent his last weekend of freedom in front of his
2106keyboard, getting arachNIDS ready for Kimi’s stewardship.
2107When Monday came he turned himself in on schedule. On
2108June 25, 2001, he was locked in the county jail pending his
2109shipment to his new home, Taft Federal Prison, a
2110corporate-run facility owned by Wackenhut, positioned near
2111a small town in central California.
2112As far as Max was concerned, it was another injustice,
2113just like back in Idaho. He’d been sent back to prison not
2114for his hacking but for refusing to set up Matt Harrigan. He
2115was being punished for his loyalty, once again a victim of a
2116capricious justice system. He doubted Judge Ware had
2117even looked at the details of his case.
2118Kimi was adrift, alone for the first time since she’d met
2119Max. For all his talk about staying with her forever, he’d
2120chosen a course of action that guaranteed their separation.
2121Two months later, Kimi was talking to him on the phone
2122from prison when she heard a pop! and the smell of acrid
2123smoke filled her nostrils. The motherboard on Max’s server
2124had burst into flames. Max tried to calm her—all she had to
2125do was replace the motherboard. He could do it in his
2126sleep. Max talked her through the process, but Kimi was
2127realizing she wasn’t cut out for life as the prison wife of a
2128hacker.
2129In August, she went to the Burning Man festival in Nevada
2130to forget her troubles. When she got home, she broke some
2131bad news to Max over the phone. She’d met someone else.
2132It was another betrayal. Max took the news with eerie
2133calm, interrogating her about every detail: What drugs was
2134she on when she cheated on him? What sexual positions
2135did they use? He wanted to hear her ask for his forgiveness
2136—he’d have given it to her in a heartbeat. But that wasn’t
2137what she was asking for. She wanted a divorce. “I don’t
2138know if you even think about the future anymore,” she said.
2139In search of closure, Kimi caught a flight to California and
2140drove to Taft, where she sat nervously in the waiting room,
2141her eyes playing over a wall of posters depicting
2142Wackenhut’s network of hivelike prisons around the
2143country. When Max was brought in, he took his place
2144across the stainless steel picnic table in the visiting room
2145and launched into an appeal. He did think of the future, he
2146told her, and he’d been making plans in the joint.
2147“I’ve been talking to some people,” he said, lowering his
2148voice to a hush. “People I think I could work with.”
2149Jeffrey James Norminton was at the tail end of a twentyseven-
2150month stretch when Max met him in Taft. At thirtyfour,
2151Norminton had the stolid physical presence of a
2152brawler, thick necked with an oversized forehead and a
2153Kirk Douglas cleft in his chin. An alcoholic and an
2154accomplished con man, he was a financial wizard who did
2155his best work half-sober. He’d start chain-chugging Coors
2156Lights as soon as he rolled out of bed, and by the end of
2157the day he’d be useless, but in that sweet spot between the
2158morning’s sobriety and the blurriness of midafternoon,
2159Norminton was a master of the high-stakes con—a criminal
2160rainmaker who could produce seven-figure sums from thin
2161air. Norminton’s latest caper had required little more than a
2162telephone and a fax machine. The target had been the
2163Entrust Group, a Pennsylvania investment brokerage
2164house. On a summer day in 1997, Norminton picked up the
2165phone and called a vice president at Entrust, adopting the
2166persona of an investment manager at Highland Federal
2167Bank, a real bank in Santa Monica, California.
2168Oozing confidence and charm, the swindler persuaded
2169Entrust to buy into the bank’s high-yield certificates of
2170deposit, promising the VP a healthy 6.20 percent return on
2171a one-year investment. When Entrust eagerly wired
2172$297,000 to Highland, the cash wound up in the account of
2173a dummy corporation Norminton’s accomplice had set up
2174under Entrust’s name. To the bank, the transaction looked
2175like an investment house moving money from one branch to
2176another.
2177The grifters promptly withdrew all but $10,000 of the cash
2178and then ran the scam again, this time with Norminton’s
2179partner making the phone call to the same VP and
2180pretending to be from a different bank, City National,
2181offering an even higher return. Entrust promptly sent two
2182more transfers totaling $800,000.
2183Norminton was undone by his ambition. He sent his
2184accomplice into City National to pull out $700,000 in a
2185single cashier’s check. An investigator at the bank got
2186suspicious and backtracked the incoming wire transfers to
2187the real Entrust. At the next withdrawal, FBI agents were
2188waiting. The financial mastermind was now cooling his
2189heels in Taft. The only silver lining to his incarceration was
2190that he’d met a talented hacker looking to get back at the
2191system.
2192Norminton made it clear that he saw real potential in
2193Max, and the pair took to walking the yard every day,
2194swapping war stories and fantasizing about how they might
2195work together when they hit the streets. With Norminton’s
2196guidance, Max could easily learn to crack brokerage
2197guidance, Max could easily learn to crack brokerage
2198houses, where they’d tap into overstuffed trading accounts
2199and drain them into offshore banks. One big haul and they’d
2200have enough cash for the rest of their lives.
2201After five months, Norminton and his schemes were sent
2202home to sunny Orange County, California, while Max
2203remained at Taft with another year left on his sentence—
2204long, tedious days of bad food, standing for count, and the
2205sound of chains and keys.
2206In August 2002, Max was granted early release to a sixtyone-
2207bed halfway house in Oakland, where he shared a
2208room with five other ex-cons. Kimi met with Max to present
2209him with divorce papers. She was getting serious with the
2210guy she’d met at Burning Man; it was time, she said, for
2211Max to let her go. Max refused to sign.
2212Max’s relative freedom at the halfway house was tenuous
2213—the facility demanded that he obtain gainful employment
2214or go back to prison, and telecommuting wasn’t allowed.
2215He reached out to his old contacts in Silicon Valley and
2216found his employability had been shattered by his highprofile
2217hacking conviction and over a year in prison.
2218Desperate, he borrowed a laptop from one of the Hungry
2219Programmers and banged out a message to an
2220employment list watched by the computer security experts
2221who had once admired him. “I have been showing up at
2222places that farm out manual labor, 5:30 am, and still haven’t
2223found any work,” he wrote. “My situation is just ridiculous.”
2224He offered his services at fire-sale prices. “I am willing to
2225work for minimum wage for the next few months. Surely
2226there is some open position at a security company in the
2227area.… The last half dozen employers I have had paid me
2228at least $100/hr for my time, now I am only asking for
2229$6.75.”
2230A consultant answered the plea, agreeing to let Max work
2231out of his home office in Fremont, a short BART ride from
2232the halfway house. He’d pay ten dollars an hour for Max to
2233help build servers, a throwback to Max’s first job for his
2234father as a teen. Tim Spencer loaned Max a bike to pedal
2235to the train station every day. Max was freed from the
2236halfway house after two months, and the Hungry
2237Programmers once again stepped up to provide him with
2238shelter. He moved into an apartment in San Francisco
2239shared by Chris Toshok, Seth Alves—a veteran of the
2240Meridian master-key adventure—and Toshok’s ex-girlfriend
2241Charity Majors.
2242Despite the jailhouse fantasies he and Norminton had
2243hatched, Max was determined to go straight. He resumed
2244his search for work. But the job offers failed to pour in for
2245the ex-con. Even the Honeynet Project, to which he’d
2246donated his expertise just a couple of years earlier,
2247shunned him.
2248His lot began improving in other ways: He started dating
2249his housemate Charity Majors, a fellow Idaho refugee who
2250designed herself like an avatar from a virtual world, painting
2251her fingernails like Skittles—each a different color—and
2252wearing contact lenses that tinted her eyes an impossible
2253emerald. Money was tight for both of them: Charity worked
2254as a system administrator for a porn website in Nevada,
2255earning Silver State wages that were stretched thin in San
2256Francisco. Max was nearly broke.
2257One of Max’s former clients in Silicon Valley tried to help
2258by giving Max a $5,000 contract to perform a penetration
2259test on the company’s network. The company liked Max
2260and didn’t really care if he produced a report, but the
2261hacker took the gig seriously. He bashed at the company’s
2262firewalls for months, expecting one of the easy victories to
2263which he’d grown accustomed as a white hat. But he was in
2264for a surprise. The state of corporate security had improved
2265while he was in the joint. He couldn’t make a dent in the
2266network of his only client. His 100 percent success record
2267was cracking.
2268“I’ve never failed to get into a system before,” Max told
2269Charity in disbelief.
2270“Sweetie, you haven’t touched a computer for years,” she
2271“Sweetie, you haven’t touched a computer for years,” she
2272said. “It’ll take you a little while. Don’t feel like you have to
2273get in today.”
2274Max pushed harder, only becoming more frustrated over
2275his powerlessness. Finally, he tried something new. Instead
2276of looking for vulnerabilities in the company’s hardened
2277servers, he targeted some of the employees individually.
2278These “client side” attacks are what most people
2279experience of hackers—a spam e-mail arrives in your inbox,
2280with a link to what purports to be an electronic greeting
2281card or a funny picture. The download is actually an
2282executable program, and if you ignore the warning
2283message on your Windows machine and install the
2284software, your computer is no longer your own.
2285In 2003 the dirty secret of these attacks was that even
2286savvy users who knew better than to install foreign software
2287could be broadsided. “Browser bloat” was largely to blame.
2288In the nineties a fierce battle with Netscape for control of the
2289browser market had driven Microsoft to stuff Internet
2290Explorer with unnecessary features and functionality. Every
2291added capability expanded the attack surface of the
2292browser. More code meant more bugs.
2293Now Internet Explorer holes were constantly surfacing.
2294They were usually discovered by one of the good guys first:
2295Microsoft’s own programmers or a white hat who often, but
2296not always, warned the company before detailing the hole
2297on Bugtraq.
2298But once a hole was public, the race was on. Black hats
2299worked to exploit the bug by setting up Web pages serving
2300the attack code and then tricking victims into visiting them.
2301Just looking at the Web page would yield control of the
2302victim’s computer, without any outward sign of infection.
2303Even if the bugs were not made public, the bad guys could
2304figure them out by reverse-engineering the vulnerability
2305from Microsoft’s patches. Security experts had been
2306watching with dismay as the time between a vulnerability’s
2307announcement and its exploitation by black hats shrank
2308from months to days. In the worst-case scenario, the black
2309hats found a bug first: a “zero day” vulnerability that left the
2310good guys playing catch-up.
2311With new Microsoft patches coming out nearly every
2312week, even vigilant corporations tended to lag in installing
2313them, and average users often didn’t patch at all. A global
2314survey of one hundred thousand Internet Explorer users
2315conducted around the time of Max’s effort found that 45
2316percent suffered from unpatched remote access
2317vulnerabilities; narrowing the field to American users
2318cooled the number only slightly, to 36 percent.
2319Max’s attack was effective. After securing access to an
2320employee’s Windows machine, he hopped on the
2321company’s network from the inside, grabbed some
2322trophies, and popped out like the chest-bursting monster in
2323Alien.
2324“It was then that I decided to scrap my old model of
2325penetration testing and include client-centric attack as a
2326mandatory part of the exercise,” he later wrote a white-hat
2327colleague. “I’ve been confident about the 100 percent rate
2328ever since.”
2329But instead of gratitude, Max’s final report was greeted
2330with outrage. Using a client-side attack in a penetration test
2331was almost unseemly; if you were hired to test physical
2332security at a company’s corporate headquarters, you
2333wouldn’t necessarily feel free to burglarize an employee’s
2334home to steal the keys. The client gave him a tonguelashing;
2335they’d paid Max to attack their servers, not their
2336employees.
2337Max began to wonder if he had a future in computer
2338security at all. His former friends in the community had all
2339moved on. Hiverworld, where Max had nearly been
2340employee 21, revamped its executive team and won $11
2341million in venture capital, changing its name to nCircle
2342Network Security. Marty Roesch left the company to build
2343on the success of Snort—to which Max had contributed—
2344starting a firm of his own called Sourcefire in Maryland.
2345Both companies were on a path to success, nCircle kicking
2346off an expansion that would take it to 160 employees in the
2347years to come and Sourcefire heading to an IPO on the
2348NASDAQ.
2349In some alternate universe in which Max had never
2350hacked the Pentagon, or never used that Verio dialup, or
2351had simply kept his mouth shut and worn a wire on Matt
2352Harrigan, the hacker would have been riding one of those
2353companies to financial success and rewarding, challenging
2354work. Instead, he could only watch from the sidelines.
2355He was itinerant, grasping for cash, and flailing for
2356something to do with his freedom. That was when he
2357checked his Whitehats.com e-mail in-box and found an
2358anonymous note from “an old friend from Shaft.” It was the
2359code phrase Max had worked out with Jeff Norminton.
2360Max met Jeff Norminton in a room at the St. Francis Hotel,
2361and they caught up. Norminton hadn’t taken well to
2362supervised release: His sentencing judge required him to
2363submit monthly urine samples, so his probation officer
2364could make sure he hadn’t started drinking again. That was
2365a problem, since he was drinking again. After he’d refused
2366two piss tests, the court had ordered him to check into
2367Impact House, a drug and alcohol rehab center in
2368Pasadena. He walked away after three weeks and was
2369now looking to scam enough zeroes to flee to Mexico.
2370It was time to act on the plans they’d made in prison,
2371Norminton said. He was ready to bankroll Max in his new
2372career as a professional hacker.
2373Max was ready. He’d struggled long enough trying to
2374make an honest living, and he was tired of being punished.
2375He knew he was wearing out his welcome at the Hungry
2376Programmers’ house, even if they’d never complain. His
2377diet was down to noodles and vegetables. He had no
2378health insurance and dental problems that would cost
2379thousands to fix.
2380Room service interrupted the conversation to deliver a
2381hospitality basket. Norminton made a show of carrying the
2382delivery into the bathroom, turning on the shower, and
2383closing the door—in case the basket was bugged, he said.
2384When they were done laughing, Max gave Norminton a
2385short shopping list of gear he’d need to get started, a highperformance
2386Alienware laptop, for one. And an antenna. A
2387big one.
2388There was just one little hitch. Norminton was broke.
2389They’d need to bring in someone else for seed money.
2390Fortunately, Jeff knew just the guy.
2391
239210
2393Chris Aragon
2394ax met his future friend and criminal partner Chris
2395Aragon in North Beach, San Francisco’s little Italy, where
2396seedy strip clubs and fortune tellers coexist with a row of
2397pleasantly gaudy restaurants serving warm bread and hot
2398pasta to sidewalk diners. The meeting was set for a coffee
2399shop near the City Lights bookstore, cradle of the Beat
2400Generation in the 1950s, and kitty-corner from Vesuvio
2401Café, a saloon announced by colorful wall murals with wine
2402bottles and a peace sign. Down the hill the Transamerica
2403Pyramid stood sentry over the financial district, stabbing
2404the sky.
2405Norminton introduced Chris to Max over the muted clatter
2406of coffee cups and dishes. The two hit it off immediately.
2407The forty-one-year-old Chris was a student of eastern
2408spirituality, a vegetarian who practiced meditation to center
2409his mind. Max, with his hippie values, seemed a kindred
2410spirit on the road of life. They’d even read some of the
2411same books.
2412And like Max, Chris had been arrested more than once.
2413It had all started in Colorado, when Chris was twenty-one
2414years old. He was working as a masseuse at a hot springs
2415resort, earning enough to cover his rent and support a
2416modest cocaine habit, when he hooked up with a troubled
2417veteran named Albert See whom he’d met in the joint while
2418serving a juvenile sentence. See had just escaped from a
2419minimum-security prison camp and needed money to get
2420out of the country.
2421Chris came from a privileged background—his mother,
2422Marlene Aragon, worked in Hollywood as voice talent, and
2423she’d recently enjoyed a run on ABC’s Saturday morning
2424cartoon Challenge of the Superfriends, voicing Wonder
2425Woman’s feline nemesis the Cheetah. But he also had
2426romantic notions of crime and criminals; on the wall of his
2427condo hung a poster of the cover art from the Waylon
2428Jennings album Ladies Love Outlaws. He took Albert in,
2429and the two embarked on a series of bold, and mostly
2430botched, bank robberies in the resort towns dotting
2431Colorado.
2432The first robbery, at the Aspen Savings and Loan, started
2433off well enough: Chris, wearing a blue and white bandana
2434over his mouth to conceal his braces, pulled an Army-issue
2435.45 automatic on the bank manager as he unlocked the
2436door in the morning. He and Albert forced the manager
2437inside, where they found a cleaning woman hiding under
2438one of the desks, phoning the police. They left in a hurry.
2439The second robbery, at the Pitkin County Bank and Trust,
2440was over before it even began. Chris’s partner hid in a
2441Dumpster by the back door, planning to jump out with his
2442shotgun when the first employees came into work in the
2443morning. The plan was aborted when Chris, watching from
2444across the street, saw a garbage truck pull into the alley to
2445empty the Dumpster.
2446The third robbery was better planned. On July 22, 1981,
2447Chris and Albert visited Voit Chevrolet in Rifle and
2448declared they wanted to test-drive a new Camaro. The
2449luckless salesman insisted on going with them, and when
2450they cleared the town limit, Chris steered to the side of the
2451road, and Albert pulled the salesman from the car at
2452gunpoint. They tied him up with rope, gagged him, and left
2453him in a field before peeling away in the silver sports car.
2454The next day at 4:50 p.m., Chris drove the stolen Camaro
2455up to the Valley Bank and Trust in Glenwood Springs,
2456where the town locals parked the cash they earned from a
2457flourishing tourist industry. Chris himself was a customer
2458there. He waited outside behind the wheel of the car while
2459Albert walked in wearing tinted sunglasses and toting a
2460leather briefcase. Albert ran out minutes later with $10,000
2461in cash and jumped into the Camaro, and Chris sped away.
2462Chris drove them south out of town on an unpaved road
2463that snaked through the rocky red hills surrounding
2464Glenwood Springs, then transferred to a jeep trail where his
2465girlfriend was waiting with the switch car. Jubilant and
2466excited, Chris drove past her and spun the Camaro into a
2467triumphant fishtail, sending a plume of dust twenty feet into
2468the air.
2469He was jumping up and down and shouting, “We did it!”
2470when a police cruiser, drawn by the dust cloud, rolled up on
2471the robbers. Chris and Albert made a mad dash on foot
2472over the craggy, tree-dotted terrain. Chris tumbled down a
2473ridge and landed on a cactus, and the two cops caught up
2474with them. Chris dropped his shotgun and surrendered.
2475Chris learned a valuable lesson from his experience: not
2476that crime didn’t pay, but that guns and getaway cars were
2477a stupid way to rob a bank. When he made parole in 1986,
2478after five years in federal prison, he delved into credit card
2479fraud and enjoyed some modest success. Then he hooked
2480up with a Mexican drug smuggler he’d met in the joint. Chris
2481helped with the delivery of two thousand pounds of
2482marijuana to a twenty-acre ranch near Riverside, California,
2483only to be busted in a nationwide DEA undercover
2484operation. He went back to prison in September of 1991.
2485When he got out in 1996, he was thirty-five years old and
2486had spent more than half his adult life, and a portion of his
2487childhood, behind bars. He vowed to go straight. With his
2488mother’s help, he founded a legitimate business called
2489Mission Pacific Capital, a leasing firm providing computer
2490and business equipment to start-up companies hustling to
2491claim their place in the dot-com race.
2492Clean-cut and handsome with an empathetic gaze, Chris
2493fit easily into the role of a Southern California entrepreneur.
2494After a lifetime of crime and uncertainty, the charms of a
2495normal, middle-class existence had an exotic and satisfying
2496normal, middle-class existence had an exotic and satisfying
2497appeal. He loved traveling to conventions, interviewing and
2498hiring employees, schmoozing with colleagues. At a
2499marketing convention in New Orleans, he met Clara Shao
2500Yen Lee, a stylish woman of Chinese descent who’d
2501emigrated from Brazil. Taken by Clara’s beauty and
2502intelligence, he promptly married her.
2503Under Chris’s leadership, Mission Pacific built a
2504reputation as an innovative leasing broker, one of the first
2505to offer instant contracts through the Web, which helped the
2506firm gain tens of thousands of clients around the country.
2507The former bank robber and drug smuggler had two
2508prominent Orange County businessmen as partners and
2509twenty-one employees working in a spacious office a block
2510from the Pacific Coast Highway. Clara dropped in
2511periodically to help out with the look and feel of the
2512company’s website and marketing material. By 2000, the
2513couple had an upscale condo in Newport Beach, a son,
2514and had staked a claim in a business that seemed as
2515limitless in its potential as the Internet itself.
2516That spring, the dream died; the dot-com bubble burst,
2517and the torrent of new companies that had been Mission
2518Pacific’s lifeblood started to dry up. Then larger companies
2519like American Express entered the leasing arena,
2520squeezing out smaller firms. Chris’s company was one of
2521dozens of leasing brokers to crash and burn. He began
2522shedding employees and finally had to tell the stragglers
2523that Mission Pacific wouldn’t be able to cut their next payroll
2524checks.
2525Chris went to work for another leasing company but was
2526cut in a round of layoffs when a large bank acquired the
2527firm. Meanwhile, his wife gave birth to a second boy. So
2528when Jeff Norminton showed up talking about the
2529superhacker he’d met in Taft, Chris was ready to listen.
2530By the time he and Max met in that North Beach
2531restaurant, Chris had already been funding Norminton’s
2532scheme, providing some of the specialized equipment
2533Norminton said his hacker needed. Now that Chris had met
2534Max in person, he was eager for a demonstration. After
2535talking for hours, the three of them left the coffee shop to
2536find someplace to hack from.
2537They wound up at the twenty-seven-story Holiday Inn in
2538Chinatown, a few blocks away. At Max’s direction, they
2539asked for a room high above the street. Max positioned
2540himself at the window, booted his laptop, plugged in the
2541antenna, and began scanning for Wi-Fi networks.
2542In 2003, the world was going wireless in a big way and
2543bringing a massive security hole with it. The revolution had
2544begun with Apple’s AirPort wireless access point and then
2545was joined by hardware makers like Linksys and Netgear.
2546As hardware prices dropped, more and more companies
2547and home users began breaking free of the tethers of their
2548blue Ethernet cables.
2549But the wireless gear being ushered into homes and
2550offices around the country was a hacker’s dream. It
2551overwhelmingly employed a wireless standard called
2552802.11b, which included an encryption scheme that, in
2553theory, would make it difficult to jump onto someone’s
2554wireless network without authorization or to passively
2555eavesdrop on computer traffic. But in 2001, researchers at
2556the University of California at Berkeley revealed a number
2557of severe weaknesses in the encryption scheme that made
2558it crackable with ordinary off-the-shelf equipment and the
2559right software. And as a practical matter that technical
2560black magic was usually not even needed. To speed
2561adoption, manufacturers were shipping wireless access
2562points with encryption turned off by default. Businesses
2563small and large simply plugged in the boxes and forgot
2564about them—sometimes assuming falsely that their office
2565walls would keep their networks from seeping out onto the
2566street.
2567A few months before Max went to jail, a white-hat hacker
2568had invented a sport called “war driving” to highlight the
2569prevalence of leaky networks in San Francisco. After
2570prevalence of leaky networks in San Francisco. After
2571slapping a magnetically mounted antenna to the roof of his
2572Saturn, the white hat cruised the city’s downtown streets
2573while his laptop scanned for beaconing Wi-Fi access
2574points. After one hour in the financial district, his setup
2575would find close to eighty networks. A year and a half had
2576passed since then, and San Francisco, like other large
2577cities, was now blanketed in an invisible sea of network
2578traffic, available to anyone who cared to dip in.
2579Hacking from home was for idiots and teenagers—Max
2580had learned that lesson the hard way. Thanks to Wi-Fi, he
2581could now work from almost anywhere with complete
2582anonymity. This time, if the police traced back one of Max’s
2583hack attacks, they’d wind up on the doorstep of whatever
2584poor sap Max had used for connectivity.
2585The antenna Max used was a monster, a two-foot-wide
2586wire-grid parabolic that quickly teased out dozens of
2587networks from the ether surrounding the Holiday Inn. He
2588jumped on one and showed Chris how it all worked.
2589Wielding a vulnerability scanner—the same kind of tool
2590he’d used in his pen tests—he could quickly scan huge
2591chunks of Internet address space for known vulnerabilities,
2592like sending a drift net into the Web. Security holes were
2593everywhere. He was confident he’d be in financial
2594institutions and e-commerce sites in no time. It was up to
2595Norminton and Chris to decide what kind of data they
2596needed and how they’d exploit it.
2597Chris was blown away. This six-foot-five, semivegetarian
2598hacker knew his stuff, even if he was rusty from
2599the joint.
2600Chris introduced Max to one of his prison contacts, a real
2601estate fraudster named Werner Janer whom Chris had met
2602in Terminal Island in ’92. Janer offered to pay Max $5,000
2603to penetrate the computer of a personal enemy. He wrote
2604the check out to Charity so Max wouldn’t have to explain the
2605income to his probation officer.
2606The money gave Max some breathing room. He began
2607flying to Orange County, misspelling his name on the ticket
2608so there’d be no record of his violating his supervised
2609release by leaving the Bay Area. He and Norminton began
2610crashing at Chris’s place for a week at a stretch, hacking
2611from Chris’s garage.
2612He downloaded a list of small-sized financial institutions
2613from the FDIC’s website, figuring they’d be most
2614vulnerable, and launched a script to scan each bank for
2615known security holes. An electronic chime rang out through
2616the garage whenever it scored a hit. He wormed into the
2617banks and pulled out customer names, financial data, and
2618checking account numbers.
2619The scattershot approach meant Max would be spared
2620the frustration he’d felt in his last legitimate penetration test.
2621Hacking any one particular target can be difficult;
2622depending on the target, maybe even impossible. But scan
2623hundreds or thousands of systems, and you’re guaranteed
2624to find some that are soft. It was a numbers game, like
2625trying car doors as you walk through a parking lot.
2626Charity had only the broadest notion of what Max was up
2627to, and she didn’t like it. In an effort to win her over, Chris
2628and Norminton invited the couple down to Orange County
2629for a short vacation, paying their way for a weekend at
2630Disneyland. Charity could see that Max and Chris were
2631clicking, but something about Chris didn’t smell right. He
2632was too slick, too polished.
2633Max’s hacking moved to small e-commerce sites, where
2634he grabbed transaction histories, some with credit card
2635numbers. But his efforts were unfocused, and neither Chris
2636nor Norminton was sure what to do with all the data he was
2637stealing.
2638Fortunately, Chris had some money coming in. Werner
2639Janer owed him $50,000 and was ready to wire-transfer
2640the money to a bank account of Chris’s choosing.
2641Determined to get his hands on cold, hard, unreported
2642cash, Chris asked Norminton to do what he did best;
2643Norminton agreed to have one of his friends receive the
2644Norminton agreed to have one of his friends receive the
2645transfer and pull it out over the course of a few days.
2646The first round of withdrawals went as planned, and
2647Norminton and his friend showed up at Chris’s and handed
2648over $30,000 in $100 bills. The following day, though,
2649Norminton reported that his friend had taken ill and would
2650have to take the day off.
2651In truth, Norminton had discovered the source of the
2652windfall: It was Chris’s cut from a real estate scam he’d
2653helped Janer pull off. The money was dirty, and Norminton
2654was now implicated in the scheme. The next morning, Chris
2655found the Honda he’d loaned Norminton parked outside his
2656office, one tire flat and a fresh dent in the fender. There was
2657a note from Norminton inside: The FBI is after me. I’m
2658skipping town.
2659Chris phoned Norminton’s cash mule, already knowing
2660what the score would be: Norminton’s associate was in
2661perfect health and had withdrawn the other $20,000 the day
2662before, as planned. He’d given it to Norminton. Didn’t Chris
2663get it?
2664Chris tracked down Max through Charity and demanded
2665answers: What did Max know about Norminton’s
2666whereabouts? Where was Chris’s money? Max was as
2667surprised as Chris at Norminton’s disappearance, and
2668eventually the two agreed to continue their partnership
2669without Norminton.
2670Max and Chris fell into a routine. Once a month, Chris flew
2671or drove north and met Max in downtown San Francisco,
2672where they checked into a hotel. They’d carry Max’s
2673massive antenna up the fire stairs to their room and mount
2674it on a tripod near the window. Then Max would putter for a
2675while to locate a high-speed Wi-Fi with a strong signal.
2676They learned that altitude wasn’t as important in Wi-Fi
2677hacking as the sprawl of buildings visible out the window. If
2678they came up dry, Chris would run down to the front desk to
2679ask for a different room, explaining earnestly that he
2680couldn’t get a cell phone signal or was too afraid of heights
2681to remain on the twentieth floor.
2682Max treated it like a job, saying good-bye to Charity and
2683then vanishing for up to a week into one of the city’s finest
2684hotels, the Hilton, Westin, W, or Hyatt. While the clang of
2685cable car bells rose from the streets below, Max cast his
2686net over cyberspace, scooping up whatever data he could
2687find—not really sure what he was looking for.
2688On a whim, he cracked Kimi’s computer and that of her
2689boyfriend, with whom she’d moved in. Max contemplated
2690plundering her address book and sending out a mass email
2691in her name, detailing how she betrayed him. He
2692thought everyone should know that Kimi’s new life was built
2693on a foundation of infidelity.
2694He didn’t go through with it. He had Charity now. Kimi
2695had moved on, and nothing would be gained by trying to
2696shame her, he realized. Shortly thereafter, he signed the
2697divorce papers.
2698Returning to his work, he began performing Google
2699searches for guidance in his targeting: What were other
2700fraudsters doing? How were they monetizing stolen data?
2701That was when he discovered where the real criminal
2702action was online: two websites called CarderPlanet and
2703Shadowcrew.
2704
270511
2706Script’s Twenty-Dollar Dumps
2707n the spring of 2001, some 150 Russian-speaking
2708computer criminals convened a summit at a restaurant in
2709the Ukraine port city of Odessa to brainstorm the launch of
2710a revolutionary website. Present were Roman Vega, a
2711thirty-seven-year-old man who sold counterfeit credit cards
2712to the underground through his online storefront BOA
2713Factory; a cybercrook known as “King Arthur”; and the man
2714who would emerge as their leader, a Ukrainian credit card
2715seller known by the handle “Script.”
2716The discussion was sparked by the success of a UKhosted
2717website erected in 2000 called Counterfeit Library,
2718which solved one of the fundamental weaknesses of
2719conducting criminal business in IRC chat rooms, where the
2720wisdom and experience of years of crime vanished into the
2721air as soon as the chat was over. Founded by a handful of
2722Western cybercrooks, Counterfeit Library collected
2723underground tutorials onto a single website and attached
2724an online discussion forum where identity thieves could
2725gather to swap tips and buy and sell “novelty” identification
2726cards—a euphemism distilled from the same spirit in which
2727hookers go on “dates.”
2728Counterfeit Library had more in common with the
2729electronic bulletin board systems of the pre-Web days than
2730with IRC. Members could post in permanent discussion
2731threads and build personal reputations and brands. As
2732criminals around the globe discovered this patch of dry land
2733in the murky ephemeral sea of underground commerce, the
2734site collected hundreds, then thousands, of members from
2735across North America and Europe. They were identity
2736thieves, hackers, phishers, spammers, currency
2737counterfeiters, credit card forgers, all of whom had been
2738slaving away in their apartments and warehouses, blind,
2739until now, to the vastness of their secret brotherhood.
2740The carders of Eastern Europe had watched Counterfeit
2741Library with envy. Now they wanted to apply the same
2742alchemy to their own underground.
2743In June 2001, the result of the Odessa summit was
2744unveiled: the International Carders Alliance, or simply
2745Carderplanet.com, a tightly organized reinvention of
2746Counterfeit Library catering to the underworld of the former
2747Soviet empire. While Counterfeit Library was a
2748freewheeling discussion board and BOA Factory a
2749straightforward storefront operation, CarderPlanet was a
2750disciplined online bazaar, charged with the excitement of a
2751commodities exchange.
2752Unabashed in its purpose, the site adopted the
2753nomenclature of the Italian Mafia for its rigid hierarchy. A
2754registered user was a “sgarrista”—a soldier, without
2755special privileges. One step up was a “giovane d’honore,”
2756who helped moderate the discussions under the
2757supervision of a “capo.” At the top of the food chain was
2758CarderPlanet’s don, Script.
2759Russian-speaking vendors flocked to the new site to
2760offer an array of products and services. Credit card
2761numbers were a staple, naturally, but only the beginning.
2762Some sellers specialized in the more valuable “full infos”—
2763a credit card number accompanied by the owner’s name,
2764address, Social Security number, and mother’s maiden
2765name, all for around $30. Hacked eBay accounts were
2766worth $20. Ambitious buyers could spend $100 for a
2767“change of billing,” or COB, a stolen credit card account
2768where the billing address could be changed to a mail drop
2769under the buyer’s control. Other vendors sold counterfeit
2770checks or money orders, or rented drop addresses in the
2771United States where merchandise ordered on American
2772credit cards could be delivered without raising alarms and
2773credit cards could be delivered without raising alarms and
2774then reshipped to the scammer.
2775Physical products like blank plastic “magstripe”
2776(magnetic stripe) cards were in the offering, as well as
2777“novelty” IDs, complete with holograms, which sold for
2778anywhere from $75 to $150, depending on the quality. One
2779could purchase a package of ten identification cards with
2780the same photo but different names for $500.
2781CarderPlanet’s registration was open to anyone, but to
2782sell on the site, vendors first had to submit their products or
2783services to an approved reviewer for inspection. New
2784vendors would sometimes be required to escrow their
2785transactions through Script or to post a bond with the site’s
2786emergency fund, used to pay out buyers in case an
2787approved vendor went out of business with unfilled orders
2788in his queue. Vendors were expected to keep the board
2789apprised of any vacation plans, safeguard buyers’
2790information from hacker attacks, and respond promptly to
2791customer complaints. “Rippers,” vendors who failed to
2792deliver on a sale, were subject to banishment, as was any
2793vendor who accumulated five customer complaints.
2794CarderPlanet was soon imitated by a second site, this
2795one aimed at the English-speaking world: Shadowcrew. In
2796September 2002, after witnessing the stunning success of
2797CarderPlanet’s regimented hierarchy, a carder named
2798“Kidd” brought over the heaviest hitters from Counterfeit
2799Library to do business the Russian way. News of the site
2800spread through IRC chat rooms and prison yards alike, and
2801by April 2003, Shadowcrew had four thousand registered
2802users.
2803With the motto “For Those Who Like to Play in the
2804Shadows,” Shadowcrew was at once a study-at-home
2805college and an online supermarket for nearly anything
2806illegal. Its tutorials offered lessons on how to use a stolen
2807credit card number, forge a driver’s license, defeat a
2808burglar alarm, or silence a gun. It boasted a wiki that
2809tracked which state driver’s licenses were forgeable. And
2810its approved vendors around the world could provide a
2811dizzying array of illicit products and services: credit reports,
2812hacked online bank accounts, and names, birth dates, and
2813Social Security numbers of potential identity theft targets.
2814As on CarderPlanet, each product had its own
2815specialists, and every vendor had to be reviewed by a
2816trusted site member before they were allowed to sell.
2817Disputes were handled judiciously, with administrators and
2818moderators working overtime to expose and ban rippers
2819selling bunk products.
2820The trading wandered beyond data into tangible items
2821like ATM skimmers, prescription drugs, and cocaine, and
2822into services like distributed denial-of-service (DDoS)
2823attacks—take down any website for $200—and malware
2824customization to evade antivirus products. One wellreviewed
2825vendor offered a test-taking service that
2826promised to get customers technical certifications within
2827days. A vendor called UBuyWeRush sprang up to flood the
2828underground with magnetic stripe writers, as well as musthaves
2829like safety paper and magnetic ink cartridges for
2830counterfeiting checks.
2831Child porn was forbidden, and one vendor who asked to
2832be reviewed for exotic animal sales was laughed off the
2833board. But nearly anything else was fair game on
2834Shadowcrew.
2835By this time, CarderPlanet had launched subforums for
2836criminals from Asia, Europe, and the States, but it was
2837Shadowcrew that forged a true international marketplace: a
2838cross between the Chicago Mercantile Exchange and Star
2839Wars’s Mos Eisley cantina, where criminals of varying
2840disciplines could meet up and collaborate on heists. An
2841identity thief in Denver could buy credit card numbers from
2842a hacker in Moscow, send them to Shanghai to be turned
2843into counterfeit cards, then pick up a fake driver’s license
2844from a forger in Ukraine before hitting the mall.
2845Max shared his discovery with Chris, who was fascinated.
2846Chris logged on to the forums and studied the content like a
2847textbook. A lot of things hadn’t changed since he’d dealt in
2848credit card fraud in the 1980s. Other things had changed a
2849lot.
2850There was a time when crooks could literally pull credit
2851card numbers from the trash by Dumpster-diving for
2852receipts or the carbon-paper slips left over from retailers’
2853sliding imprint machines. Now mechanical imprinting was
2854dead, and Visa and MasterCard insisted that receipts not
2855include full credit card account numbers. Even if you got the
2856numbers, that was no longer enough to make counterfeit
2857cards. The credit card companies now added a special
2858code to every magnetic stripe—like a PIN, but unknown
2859even to the cardholder.
2860Called a Card Verification Value, or CVV, the code is a
2861number distilled from other data on the stripe—primarily the
2862account number and expiration date—and then encrypted
2863with a secret key known only to the issuing bank. When the
2864magstripe is swiped at the point-of-sale terminal the CVV
2865is sent along with the account number and other data to the
2866issuing bank for verification; if it doesn’t match, the
2867transaction is declined.
2868When it was introduced by Visa in 1992, the CVV began
2869driving down fraud costs immediately, from nearly .18
2870percent of Visa transactions that year to around .15 percent
2871a year later. In the 2000s, the innovation proved a strong
2872bulwark against phishing attacks, in which a spammer
2873spews thousands of falsified e-mails aimed at luring
2874consumers into entering their credit card numbers into a
2875fake bank website. Without the CVV on the magnetic stripe
2876—which consumers didn’t know, and thus couldn’t reveal—
2877those stolen numbers were useless at real-world cash
2878registers. Nobody could walk into a Vegas casino, slap
2879down a card derived from a phishing attack, and get a pile
2880of black chips to carry to the roulette table.
2881MasterCard followed Visa’s lead with its own Card
2882MasterCard followed Visa’s lead with its own Card
2883Security Code, or CSC. Then in 1998, Visa introduced the
2884CVV2, a different secret code printed on the backs of
2885cards for consumers to use exclusively over the phone or
2886the Web. That further reduced crime losses and completed
2887the Chinese wall between fraud on the Internet and in real
2888life: Accounts stolen from e-commerce sites or in phishing
2889attacks could only be used online or over the phone, while
2890magstripe data could be used in-store but not on the Web,
2891because it didn’t include the printed CVV2.
2892By 2002, the security measure had turned raw magstripe
2893data into one of the underground’s most valuable
2894commodities and pushed the point of compromise closer
2895to the consumer.
2896Hackers began breaching transaction-processing
2897systems for the data, but the most straightforward way for
2898ordinary crooks to steal the information was to recruit a
2899cash-hungry restaurant employee and equip him with a
2900pocket-sized “skimmer,” a magstripe reader with built-in
2901memory. As small as a cigarette lighter and readily
2902concealed in the apron pocket of a fast-food worker or the
2903suit jacket of an upscale maître d’, a skimmer can hold
2904hundreds of cards in its memory for later retrieval through a
2905USB port. A server needs only a second of privacy to swipe
2906a customer’s card through the device.
2907In the late 1990s, thieves began fanning out in big cities
2908across the United States, eyeing waiters, waitresses, and
2909drive-through attendants who might be interested in a little
2910extra cash, typically $10 a swipe. Though it was riskier, gas
2911station managers and retail workers could get in on the
2912action as well by installing tiny skimming circuit boards in
2913pay-at-the-pump readers and point-of-sale terminals. Some
2914of the data would be exploited locally, but much of it was
2915sent to Eastern Europe, where the swipes were sold over
2916the Internet ten, twenty, a hundred, or even thousands at a
2917time.
2918The carders call these “dumps”; each contained just two
2919lines of text, one for each track on a credit card’s threeinch-
2920long magstripe.
2921Track 1: B4267841463924615^SMITH/
2922JEFFREY^04101012735200521000000
2923Track 2: 4267841463924615=041010127352521
2924A dump was worth about $20 for a standard card, $50
2925for a gold card, and $80 to $100 for a high-limit corporate
2926card.
2927Chris decided to try some carding himself. He
2928determined that Script, the godfather of CarderPlanet, was
2929the most reliable source of dumps in the world. He paid the
2930Ukrainian $800 for a set of twenty Visa Classic numbers
2931and elsewhere parted with around $500 for an MSR206,
2932the underground’s favorite magnetic stripe encoder.
2933Once the shoebox-sized MSR206 was plugged into his
2934computer and the right software installed, he could take an
2935anonymous Visa gift card, or one of his own credit cards,
2936and encode it in two quick swipes with one of Script’s
2937dumps.
2938With the reprogrammed card burning a hole in his
2939pocket, Chris browsed his local Blockbuster and some
2940retailers to scope out the opportunities. Simple magstripe
2941fraud might be cheap and easy, but it had severe
2942limitations. Through observation, Chris quickly determined
2943that shopping for consumer electronics or expensive
2944clothes would be tough: To guard against what Chris was
2945contemplating, many high-end stores require the checkout
2946clerk to physically type the last four digits from the face of
2947the credit card; the point-of-sale terminal rejects the card,
2948or worse, if the digits don’t match what’s on the stripe. A
2949reprogrammed card was only good at spots where
2950employees never get to lay their hands on the plastic, like
2951gas stations or drugstores.
2952Chris made his move at a local supermarket. He loaded
2953his cart indiscriminately and checked out, sliding his plastic
2954through the point-of-sale terminal. After a moment, the word
2955“Approved” flickered across the display, and somewhere in
2956America a random consumer was charged for $400 in
2957groceries.
2958Chris delivered his ill-gotten groceries to an Orange
2959County couple in worse financial shape than himself and
2960then took the husband—a contractor who’d recently had his
2961tools stolen—to a local Walmart to purchase new
2962construction gear. Word spread that Chris had credit cards,
2963and he began doling out his reprogrammed plastic to a few
2964friends, who were always thoughtful enough to make small
2965purchases for Chris as a thank-you.
2966He could see the outlines of a business plan in his
2967circulating plastic. Drop everything else, he told Max. The
2968real money is in dumps.
2969
297012
2971Free Amex!
2972ax broached his plan obliquely with Charity over the
2973rare indulgence of a sushi dinner. “Which institutions would
2974you say deserve to be punished the most?” he asked.
2975He had the answer ready: the moneylenders. The greedy
2976banks and credit card companies who saddle consumers
2977with $400 billion in debt each year while charging usurious
2978interest and hooking kids on plastic before they’ve
2979graduated college. And because consumers were never
2980held directly liable for fraudulent charges—by law they could
2981only be billed for the first $50, and most banks waived even
2982that—credit card fraud was a victimless crime, costing only
2983these soulless institutions money.
2984Credit wasn’t real, Max reasoned, just an abstract
2985concept; he would be stealing numbers in a system, not
2986dollars in someone’s pocket. The financial institutions
2987would be left holding the bag, and they deserved it.
2988Charity had learned to accept the bitterness Max brought
2989back from prison: Living with him meant never again
2990watching a crime drama on TV, because any depiction of
2991the police as good guys set Max fuming. She wasn’t
2992entirely sure what Max had in mind now, and she didn’t
2993want to know. But one thing was clear. Max had decided he
2994was going to be Robin Hood.
2995• • •
2996Max knew exactly where to get the magstripe data Chris
2997wanted. There were thousands of potential sources sitting
2998in plain sight, right on CarderPlanet and Shadowcrew. The
2999carders themselves would be his prey.
3000Most of them weren’t hackers, they were just crooks; they
3001knew a bit about fraud but little about computer security.
3002They certainly wouldn’t be much harder to hack than the
3003Pentagon. It was also a morally palatable proposition: He
3004would be stealing credit card numbers that had already
3005been stolen—a criminal was going to use them, so it might
3006as well be Chris Aragon, his criminal.
3007He started by choosing his weapon, picking out the slick
3008Bifrost Trojan horse program already circulating online and
3009customizing it to evade antivirus detection. To test the
3010results, he used the computer emulation software VMware
3011to run a dozen different virtual Windows boxes on his
3012computer at once, each loaded with a different flavor of
3013security software.
3014When the malware went undetected on all, he moved to
3015the next step: harvesting a list of carders’ ICQ numbers and
3016e-mail addresses from public forum posts, collecting
3017thousands of them into a database. Then, posing as a wellknown
3018dumps vendor named Hummer911, he fired off a
3019message to the entire list. The note announced that
3020Hummer911 had acquired more American Express dumps
3021than he could use or sell, so he was giving some away.
3022Click here, Max wrote, to get your free Amex.
3023When a carder clicked on the link, he found himself
3024looking at a list of fake Amex dumps Max had generated,
3025while invisible code on the Web page exploited a new
3026Internet Explorer vulnerability.
3027The exploit took advantage of the fact that Internet
3028Explorer can process more than just Web pages. In 1999,
3029Microsoft added support for a new type of file called an
3030HTML Application—a file written in the same markup and
3031scripting languages used by websites but permitted to do
3032things on a user’s computer that a website would never be
3033allowed to do, like creating or deleting files at will and
3034executing arbitrary commands. The idea was to let
3035developers already accustomed to programming for the
3036developers already accustomed to programming for the
3037Web use the same skills to craft fully functional desktop
3038applications.
3039Internet Explorer recognizes that HTML Applications can
3040be deadly and won’t execute them from the Web, only from
3041the user’s hard drive. In theory.
3042In practice, Microsoft had left a hole in the way the
3043browser screened content embedded on a Web page.
3044Many Web pages contain OBJECT tags, which are simple
3045instructions that tell the browser to grab something from
3046another Web address—typically a movie or music file—and
3047include it as part of the page. But it turned out you could
3048also load an HTML Application through the OBJECT tag
3049and get it to execute. You just had to disguise it a little.
3050While Max’s victims salivated over the bogus American
3051Express dumps, an unseen OBJECT tag instructed their
3052browsers to pull in a malicious HTML Application that Max
3053had coded for the occasion. Crucially, Max had given the
3054file a name ending in “.txt”—a superficial indication that it
3055was an ordinary text file. Internet Explorer saw that file
3056name and decided it was safe to run.
3057Once the browser started downloading the file, however,
3058Max’s server transmitted a content type indicator of
3059“application/hta”—identifying it now as an HTML
3060Application. Essentially, Max’s server changed its story,
3061presenting the file as a harmless document for the
3062browser’s security check, then correctly identifying it as an
3063HTML Application when it came time for the browser to
3064decide how to interpret the file.
3065Having judged the file safe based on the name, Internet
3066Explorer didn’t reevaluate that conclusion once it learned
3067the truth. It just ran Max’s code as an HTML Application
3068instead of a Web page.
3069Max’s HTML Application was a tight Visual Basic script
3070that wrote out and executed a small grappling-hook
3071program on the user’s machine. Max named the grappling
3072hook “hope.exe.” Hope was Charity’s middle name.
3073The grappling hook, in turn, downloaded and installed his
3074modified Bifrost Trojan horse. And just like that, Max was in
3075control.
3076• • •
3077The carders converged like hungry piranhas on his
3078poisoned page: Hundreds of their machines reported back
3079to Max for duty. Excited, he began poking around the
3080criminals’ hard drives at random. He was surprised by how
3081small-time it all looked. Most of his victims were buying
3082small batches of dumps, ten or twenty at a time—even less.
3083But there were lots of carders, and there was nothing to
3084keep him from returning to their machines over and over
3085again. In the end, the Free Amex attack would score him
3086about ten thousand dumps.
3087He siphoned the dumps to Chris as he found them and
3088vacuumed other useful data from his victims: details on
3089their scams, stolen identity information, passwords, mailing
3090lists used in phishing schemes, some real names, photos,
3091and e-mail and ICQ addresses of their friends—useful for
3092future attacks on the underground.
3093With a single well-constructed ruse, he was now invisibly
3094embedded in the carders’ ecosystem. This was the start of
3095something big. He’d be a stick-up man among the carders,
3096living off whatever he could skim from their illegal economy.
3097His victims couldn’t call the cops, and with his anonymous
3098Internet connection and other precautions, he’d be immune
3099to reprisal.
3100It wasn’t long, though, before Max discovered that not all
3101of the carders were what they seemed to be.
3102The victim was in Santa Ana. When Max strolled into the
3103computer through his back door and began poking around,
3104he saw at once that something was very wrong.
3105The computer was running a program called Camtasia
3106that keeps a video record of everything crossing the
3107computer’s screen—not the kind of information a criminal
3108normally wants to archive. Max foraged through the hard
3109drive, and his suspicions were confirmed: The disk was
3110packed with FBI reports.
3111Chris was shaken by the discovery of an FBI cybercrime
3112agent in his own backyard, but Max was intrigued—the
3113agent’s hard drive offered potentially useful insight into the
3114bureau’s methods. They talked about what to do next.
3115Some of the files indicated the agent had an informant who
3116was providing information on Script, the CarderPlanet
3117leader who sold Chris his first dumps. Should they warn
3118Script that there was an informant in his circle?
3119They decided to do nothing; if he were ever busted, Max
3120figured, he might be able to play this as a trump card. If it
3121got out that he’d accidentally hacked an FBI agent, it could
3122embarrass the bureau, maybe even cost them some
3123convictions.
3124He returned to his work hacking the carders. But he knew
3125now that he wasn’t the only outsider worming into the crime
3126forums.
3127
312813
3129Villa Siena
3130alm trees rose at the entrance of Villa Siena, a
3131sprawling gated community in Irvine, half a mile from John
3132Wayne Airport. Beyond the front gate, European-inspired
3133fountains bubbled in the manicured courtyards, and four
3134swimming pools sparkled blue beneath the sunny Southern
3135California sky. Residents were enjoying the clubhouse,
3136relaxing in the spas, getting in a workout at one of the three
3137fitness rooms, or perhaps visiting the full-time concierge to
3138make plans for the evening.
3139In one of the spacious apartments, Chris Aragon was
3140running his factory. The drapes were drawn over the giant
3141picture window to hide the riot of machinery crowding the
3142Ikea tables and granite countertops. He flipped on his card
3143printer, and it awakened with a whining rumble, wheels
3144spinning up to speed, motors pulling the ribbons taut as a
3145hospital bedsheet.
3146Max was snagging dumps regularly now, and when he
3147got a new haul, there was no time to waste—the swipes
3148were stolen property twice over, and Chris had to burn
3149through them before the crooks who’d purchased or
3150hacked the numbers maxed them out first or blundered and
3151got them flagged by the credit card companies. Chris had
3152tapped the last of his reserves to invest in about $15,000
3153worth of credit card printing gear and the apartment to
3154house it. Now the investment was paying dividends.
3155Chris loaded blank PVC cards into the hopper of an
3156unwieldy oblong machine called a Fargo HDP600 card
3157printer, a $5,000 device used to print corporate ID cards.
3158With a click on his laptop, the machine drew a card into its
3159maw and hummed once, twice, a third, and a fourth time,
3160each sound marking another color as it moved to a clear
3161transfer ribbon and was rapidly vaporized by heating
3162elements and fused to the surface of the card. A final low
3163grinding from the Fargo meant a clear laminate coat was
3164settling over the plastic.
3165It was forty-four seconds from start to finish, and then the
3166machine spat out the card—a glossy, brightly colored
3167consumer objet d’art. A bald eagle staring purposefully at a
3168Capitol One logo, or the grim American Express centurion,
3169or the simple smudge of sky blue across the white face of a
3170Sony-branded MasterCard. For the high-limit cards, the
3171process was the same, except sometimes Chris would
3172start with gold- or platinum-colored PVC stock, purchased,
3173like the white cards, in boxes of hundreds.
3174Once he had a pile of freshly printed plastic in hand,
3175Chris moved to a second stop in the assembly line: a
3176monochrome printer for the fine print on the back of the
3177card. Then if the design called for a hologram, he’d pluck a
3178sheet of Chinese-produced counterfeits from a stack, align
3179it carefully in a die punch, and pull the lever to cut out an
3180oval or rounded rectangle the size of a postage stamp. A
3181$2,000 Kwikprint Model 55 heat stamper, resembling a drill
3182press crossed with a medieval torture instrument, fused the
3183metal foil to the surface of the PVC.
3184The embosser was next: a giant motorized carousel
3185wheel of letters and numbers that sounded like an IBM
3186Selectric as it banged the name, account number, and
3187expiration date one character at a time into the plastic,
3188tipping each with silver or gold foil. From a Chinese
3189supplier, Chris had obtained the special security keys for
3190Visa’s “flying V” and MasterCard’s joined “MC”—two
3191distinctive raised characters found only on credit cards, real
3192and fake.
3193Credit card verification systems don’t check the
3194customer’s name, which meant Chris had the luxury of
3195choosing whatever moniker he liked for the front of his
3196choosing whatever moniker he liked for the front of his
3197plastic; he preferred “Chris Anderson” for the cards he
3198used himself. On his computer, Chris edited Max’s dumps
3199to make the name on the magstripe match the alias—
3200conveniently, the name was the one piece of magstripe
3201data not used in calculating the CVV security code, so it
3202could be altered at will.
3203Finally, it was two swipes through the trusty MSR206 to
3204program Max’s dump onto the magstripe, and Chris had a
3205counterfeit credit card that duplicated in nearly every way
3206the plastic nestled in a consumer’s wallet or purse
3207somewhere in America.
3208He wasn’t done yet.
3209Driver’s licenses were a must for high-end purchases,
3210and there, too, Chris’s assembly line and Shadowcrew’s
3211tutorials got the job done. For licenses, he’d switch from
3212PVC to Teslin, a thinner, more flexible material sold in 8½ ×
321311 inch sheets. It was one sheet for the front, another for the
3214back, ten licenses to a sheet.
3215California licenses include two security features that took
3216some extra hacking. One is a translucent image of the
3217California state seal, set in a repeating pattern in the clear
3218laminate over the face of the license. To simulate it, Chris
3219used Pearl Ex, a fine colored powder sold at arts-andcrafts
3220stores for less than three dollars a jar. The trick was
3221to dust a sheet of laminate with a mix of gold and silver
3222Pearl Ex, feed it into a printer loaded with a clear ink
3223cartridge, and print a mirror image of the California pattern
3224with the transparent ink. It didn’t matter that the ink was
3225invisible—it was the heat from the print head he was after.
3226When the sheet came out, the printer had heat-fused the
3227pattern onto the surface, and the extra Pearl Ex was easily
3228washed away in a cold rinse.
3229The ultraviolet printing on the face of the license was no
3230more difficult. An ordinary ink-jet printer would do the trick,
3231as long as one drained the ink from the cartridge reservoirs
3232and replaced it with multicolored UV ink bought in tubes.
3233After all the dusting, printing, and washing, Chris was left
3234with four sheets of material. He would sandwich the two
3235sheets of printed Teslin between the laminate and run it
3236through a pressure laminator. After die-cutting, the result
3237was impressive: Run your fingers over the license and feel
3238the flawless silken surface; hold it at an angle and witness
3239the ghostly state seal; put it under a UV bulb, and the state
3240flag glowed eerily, the words “California Republic” in red,
3241above them a brown bear walking on four legs across a
3242yellow hilltop.
3243With cards and licenses complete, Chris got on the
3244phone and summoned his girls. He’d figured out that
3245attractive college-aged women made the best cashers.
3246There was Nancy, a five-foot-three-inch Latina with “love”
3247tattooed on one wrist; Lindsey, a pale girl with brown hair
3248and hazel eyes; Adrian, a young Italian woman; and Jamie,
3249who’d worked as a waitress at the Hooters in Newport
3250Beach.
3251He’d met the twin brunettes Liz and Michelle Esquere at
3252Villa Siena, where they lived. Michelle was just hanging
3253around with the group, but Liz was invaluable: She had
3254worked in the mortgage industry and was whip-smart, well
3255educated, and responsible enough to take over some of
3256the administrative work, like maintaining the spreadsheet of
3257payouts, in addition to making in-store purchases.
3258Chris had a talent for recruitment. He might meet a new
3259prospect at a restaurant and invite her to go partying with
3260his friends. She’d join them at the clubs and expensive
3261dinners, ride in the back of the rented limousine when one
3262of them had a birthday to celebrate. She’d see money
3263everywhere. Then, when the time was right, maybe months
3264later, maybe when the girl confessed she had bills to pay or
3265was behind on her rent, he would casually mention that he
3266knew a way she could earn quick and easy money. He’d tell
3267her how it worked. It was a victimless crime, he’d explain.
3268They’d be “sticking it to the man.”
3269None of the girls knew where Chris got his credit card
3270None of the girls knew where Chris got his credit card
3271data. When he referred to Max, it was as “the Whiz,” an
3272unnamable superhacker whom they’d never have the
3273privilege of meeting. Chris’s code name was “the Dude.”
3274Now that his operation was purring, the Dude was paying
3275the Whiz around $10,000 a month for the dumps—
3276transferring the payments through a prepaid debit card
3277called Green Dot.
3278Marketed to students and consumers with poor credit, a
3279Green Dot Visa or MasterCard is a credit card without the
3280credit: The consumer funds the card in advance with direct
3281payroll deposits, transfers from a bank account, or cash.
3282The last option made it an ideal money pipeline between
3283Chris in Orange County and Max in San Francisco: Chris
3284would drop in at a neighborhood 7-Eleven or Walgreens
3285and purchase a Green Dot recharge number, called a
3286MoneyPak, for any amount up to $500. He’d then IM or email
3287the number to Max, who’d apply it to one of his Green
3288Dot cards at the company’s website. He could then use the
3289card for everyday purchases or make withdrawals from San
3290Francisco ATMs.
3291Once his crew arrived, ready for work, Chris passed out
3292their cards, separated into low-limit classic cards and highlimit
3293gold and platinum. They should stick to small
3294purchases for the classics, he’d remind them—$500 or so.
3295With the high-limit plastic they should go for the big bucks,
3296purchases from $1,000 to $10,000 dollars. The girls were
3297all young, but affecting the privileged bearing of stylish
3298Orange County youth they could walk into a Nordstrom’s
3299and snatch up a couple of $500 Coach bags without raising
3300eyebrows, then cross to the other side of the mall and do
3301the same thing at Bloomingdale’s.
3302New cashers were always nervous at first, but once the
3303first fake card was approved at the register, they were
3304hooked. In no time they’d be sending Chris excited text
3305messages from their shopping excursions: “Can we use
3306amex at new bloomingdales?” or “I did over 7k on a mc!
3307yeah!”
3308At the end of the day, they met Chris in a parking lot and
3309transferred the purses trunk-to-trunk. He paid them on the
3310spot, 30 percent of the retail value, and carefully recorded
3311the transaction on a payout sheet like a real businessman.
3312The handbags—elegant cloth and suede and gleaming
3313buckles—would go in boxes until Chris’s wife, Clara, could
3314sell them on eBay.
3315As night fell over Villa Siena, the lights went on above the
3316tennis courts and the outdoor fireplaces ignited. Miles away
3317Chris and his crew were at a restaurant, ordering a
3318celebratory dinner and a bottle of wine. As always, it was
3319Chris’s treat.
3320
332114
3322The Raid
3323ice TV!” said Tim, admiring the sixty-one-inch
3324Sony plasma hanging on the wall. Charity, a compulsive
3325reader, hated the new flat-screen, the way it dominated the
3326living room in their new apartment, but Max loved his
3327gadgets, and this one was more than a high-def toy. It was
3328a symbol of the couple’s newfound financial security.
3329Max’s friends knew that he was into something, and not
3330just because he was no longer struggling to make ends
3331meet. Max had begun slipping Tim CD-ROMs burned with
3332the latest exploits from the underground, giving the system
3333administrator an edge in protecting his work machines.
3334Then there were the odd comments at the monthly Hungry
3335Programmers’ dinner at Jing Jing in Palo Alto. When
3336everyone was done describing their latest projects, Max
3337would only offer a cryptic note of envy. “Wow, I wish I was
3338doing something positive.”
3339But nobody was pressing Max for the details of his new
3340gig; they could only hope it was something quasilegitimate.
3341The hacker scrupulously avoided burdening his friends with
3342the knowledge of his double life, even as he slipped farther
3343to the edge of their circle. Until the day one of his hacks
3344followed him home.
3345• • •
3346It was 6:30 a.m. and still dark out when Chris Toshok
3347awoke to the sound of his doorbell buzzing, the long
3348continuous drone of someone holding their thumb on the
3349button. Figuring it for a neighborhood drunk, he rolled over
3350and tried to get back to sleep. Then the buzz broke into an
3351insistent rhythm, bzzz, bzzz, bzzz, like a busy signal. He
3352reluctantly crawled out of bed, grabbed his pants and a
3353sweatshirt, and moved groggily down the stairs.
3354When he opened the door he found himself squinting into
3355the glare of a flashlight.
3356“Are you Chris Toshok?” said a woman’s voice.
3357“Uh, yes.”
3358“Mr. Toshok, we’re with the FBI. We have a warrant to
3359search the premises.”
3360The agent—a long-haired blonde—showed Toshok her
3361badge and pressed a thin sheaf of papers into his hands.
3362Another agent put a firm hand on his arm and guided him
3363outside to the porch, clearing the doorway to admit a flood
3364of suits into the house. They roused Toshok’s roommate,
3365then began tossing Chris’s bedroom, riffling through his
3366bookshelves and pawing through his underwear drawer.
3367The blonde, joined by a Secret Service agent, sat down
3368with Toshok to explain why they were there. Four months
3369earlier the source code for the unreleased first-person
3370shooter Half-Life 2 had been stolen from the computers of
3371Valve Software in Bellevue, Washington. It was swapped in
3372IRC for a while and then showed up on file-sharing
3373networks.
3374Half-Life 2 was perhaps the most anticipated game of all
3375time, and the emergence of the secret source code had
3376electrified the gaming world. Valve announced it would
3377have to delay the launch of the game, and the company
3378CEO issued a public call for Half-Life fans to help track
3379down the thief. Based on sales of the original game, Valve
3380valued the software at a quarter of a billion dollars.
3381The FBI had traced some of the hacking activity to
3382Toshok’s Internet IP address at his old house, the agent
3383explained. The judge would go easier on Toshok if he told
3384them where he’d stashed the source code.
3385Toshok protested his innocence, though he
3386acknowledged that he knew about the breach. His old
3387friend Max Vision was staying with him at the time of the
3388intrusion, and he got very excited when the source code
3389popped up online.
3390Hearing Max Vision’s name sent the agents into double
3391time—they nearly tripped over themselves to finish the
3392search and get back to the office to prepare a warrant
3393application for Max’s new apartment. Chris watched
3394gloomily as they gathered his nine computers, some music
3395CDs, and his Xbox. The blonde agent registered the look
3396on his face. “Yeah,” she said, “this is going to be hard for
3397you.”
3398When Max heard about the raid, he knew he didn’t have
3399much time. He ran around his apartment stashing his gear.
3400He hid an external hard drive in a stack of sweaters in the
3401closet, another in a cereal box. One of his laptops fit under
3402the sofa cushions; he hung a second one out the bathroom
3403window in a garbage bag. Everything sensitive on his
3404computers was encrypted, so even if they found his
3405hardware, the agents wouldn’t get any evidence of his
3406hacking. But under the terms of his supervised release, he
3407wasn’t supposed to be using encryption at all. Moreover, it
3408would be incredibly inconvenient to let the FBI take all of his
3409computers.
3410The feds arrived in force, as many as twenty agents
3411swarming like ants through the apartment. They found only
3412the routine trappings of a San Francisco computer geek
3413with hippie leanings: a bookshelf with Orwell’s 1984,
3414Huxley’s Brave New World, Orson Scott Card’s sci-fi
3415classic Ender’s Game, and a smattering of Asimov and
3416Carl Sagan. There was a bicycle, and stuffed penguins
3417were strewn everywhere. Max loved penguins.
3418They discovered not one of Max’s slapdash hiding spots,
3419and this time, the hacker had nothing to say. The agents left
3420without any evidence linking Max to the Valve intrusion,
3421much less any hints of the crimes he was committing with
3422Chris. Just a stack of CDs, a broken hard drive, and a
3423vanilla Windows machine he’d left out as diversions.
3424But Charity had just learned what it meant to be in Max
3425Vision’s world. Max insisted he was innocent of the source
3426code theft. It was probably the truth. There’d been several
3427first-person shooter fans crawling around Valve’s Swiss
3428cheese network in anticipation of Half-Life 2. Max
3429happened to be one of them.
3430The FBI later settled on a different Valve hacker: a
3431twenty-year-old German hacker named Axel “Ago” Gembe,
3432who admitted to his intrusions in e-mails to Valve’s CEO,
3433though he too denied stealing the code.
3434Gembe was already notorious for creating Agobot, a
3435pioneering computer worm that did more than just spread
3436from one Windows machine to another. When Agobot took
3437over a machine, the user might not notice anything but a
3438sudden sluggishness in performance. But deep in the PC’s
3439subconscious, it was joining a hacker’s private army. The
3440malware was programmed to automatically log in to a
3441preselected IRC room, announce itself, and then linger to
3442accept commands broadcast by its master in the chat
3443channel.
3444Thousands of computers would report at once, forming a
3445kind of hive mind called a botnet. With one line of text, a
3446hacker could activate keystroke loggers on all the
3447machines to capture passwords and credit card numbers.
3448He could instruct the computers to open secret e-mail
3449proxies to launder spam. Worst of all, he could direct all
3450those PCs to simultaneously flood a targeted website with
3451traffic—a distributed denial-of-service attack that could
3452take down a top site for hours while network administrators
3453blocked each IP address one at a time.
3454DDoS attacks started as a way for quarreling hackers to
3455knock each other out of IRC. Then one day in February
34562000, a fifteen-year-old Canadian named Michael
3457“MafiaBoy” Calce experimentally programmed his botnet to
3458hose down the highest-traffic websites he could find. CNN,
3459hose down the highest-traffic websites he could find. CNN,
3460Yahoo!, Amazon, eBay, Dell, and E-Trade all buckled under
3461the deluge, leading to national headlines and an
3462emergency meeting of security experts at the White House.
3463Since then, DDoS attacks had grown to become one of the
3464Internet’s most monstrous problems.
3465Bots like Ago’s marked the decade’s major innovation in
3466malware, inaugurating an era where any pissed-off script
3467kiddie can take down part of the Web at will. Gembe’s
3468confession in the Valve hack provided the FBI with a
3469golden opportunity to snare one of the innovators most
3470responsible. The FBI tried to lure Gembe to America with
3471an Invita-style job offer from Valve. After months of
3472negotiations and telephone interviews with Valve
3473executives, the hacker seemed ready to hop a flight to the
3474States.
3475Then the German police intervened, arrested the hacker,
3476and charged him locally as a youthful offender. Gembe was
3477sentenced to one year of probation.
3478The raid on Max’s house shook him, filling his head with
3479unpleasant memories of the FBI’s search warrant over the
3480BIND attacks. Max decided he needed a safe house in the
3481city, a place where he could ply his trade and store his data
3482free from the threat of search warrants—something like
3483Chris’s Villa Siena plant.
3484Under an alias, Chris rented a second apartment for
3485Max, a spacious penthouse in the Fillmore District, with a
3486balcony and a fireplace—Max liked working by an open
3487fire, and he’d joked that he could burn the evidence in an
3488emergency.
3489Max tried to get home to Charity daily, but with a
3490comfortable hacker safe house to retreat to, he began
3491disappearing for days at a stretch, sometimes only
3492emerging when his girlfriend interrupted his work with a
3493prodding phone call.
3494“Dude, time to come home. I miss you.”
3495As money started to flow into Max and Chris’s joint
3496operation, so did the mistrust. Some of the cashers in
3497Chris’s crew liked to party, and the constant presence of
3498cocaine, ecstasy, and pot called to Chris like a forgotten
3499melody. In February, he was pulled over near his home and
3500arrested for driving under the influence. He began routinely
3501vanishing with his comely employees for weekend-long
3502bacchanals in Vegas: The day was for shopping; at night,
3503Chris would snort some coke and take the girls out to the
3504Hard Rock to party or snag a VIP table at the sleek
3505Ghostbar atop the Palms, where he’d blow $1,000 on
3506dinner and another grand on wine. Back in Orange County,
3507he took a mistress—an eighteen-year-old woman he met
3508through one of his cashers.
3509Max found both drugs and marital infidelity distasteful.
3510But what really irked him was the financial arrangement.
3511Chris was paying Max haphazardly—in whatever amount
3512he felt like turning over at any given moment. Max wanted a
3513straight 50 percent of Chris’s profits. He was certain that
3514Chris was making serious bank from their joint operation.
3515Chris tried to set him straight, and he e-mailed Max a
3516detailed spreadsheet showing where the profits were
3517going. Out of a hundred cards, maybe fifty worked, and only
3518half of those could buy anything worth selling—the others
3519were seeds and stems, cards with $500 security limits that
3520were good only for trifles like gas and meals. Chris had
3521expenses, too—spreading his hustle meant flying his crew
3522to far-flung cities, and airline seats weren’t getting any
3523cheaper. Meanwhile, he was paying rent at Villa Siena for
3524his credit card factory.
3525Max was unconvinced. “Call me back when you’re not
3526stoned.”
3527The last straw came when Chris, three months after the
3528Half-Life raid, suffered a close call himself. He’d driven up
3529to San Francisco to meet with Max and make some
3530carding runs at Peninsula malls. He and his crew were
3531checked into adjacent rooms at the W, a posh hotel in the
3532checked into adjacent rooms at the W, a posh hotel in the
3533Soma district, when Chris got a call from the front desk. His
3534credit card had been declined.
3535Hungover and fuzzy-headed from the flu, Chris took the
3536elevator to the marbled lobby and pulled a new fake card
3537from his swollen wallet. He watched as the clerk swiped it. It
3538was declined. He produced another one, and it failed too.
3539The third one worked, but by then the clerk was suspicious,
3540and as the elevator was carrying Chris back to the twentyseventh
3541floor, she was picking up the phone and calling the
3542credit card company.
3543The next knock on Chris’s door was the San Francisco
3544Police Department. They cuffed him and searched his
3545rooms and car, seizing his Sony laptop, an MSR206, and
3546his SUV, which had a fake VIN tag—Chris had
3547experimented with renting cars using his plastic in Las
3548Vegas, then sending them to Mexico to be fitted with clean
3549VINs.
3550Chris was thrown in the county jail. His disappearance
3551worried Max, but Chris bailed out quickly and confessed his
3552blunder to his partner. Fortunately for him the police
3553investigation went no further. Chris was sentenced a month
3554later to three years of probation and ordered not to return to
3555the W. He boasted afterward that he’d been a beneficiary
3556of San Francisco’s liberal justice system.
3557It was the kind of bullshit local bust that happened to
3558Chris’s girls all the time; that was why Chris kept a bail
3559bondsman on retainer and even let him crash at his Villa
3560Siena factory. But Max was furious. It was unforgivably
3561sloppy for someone at Chris’s level to be arrested carding
3562a hotel room.
3563Max decided he could no longer rely exclusively on his
3564partner. He needed a Plan B.
3565
356615
3567UBuyWeRush
3568he run-down strip mall was plunked down in that vast,
3569flat interior of Los Angeles County that doesn’t make it onto
3570postcards, far from the ocean and so distant from the hills
3571that the squat stucco buildings could be a Hollywood set,
3572the featureless sky behind them a blue screen to be filled in
3573with mountains or trees in post-production.
3574Chris pulled his car into the trash-strewn parking lot. A
3575marquee at the entrance gave top billing to the Cowboy
3576Country Saloon, and below that it was the usual south Los
3577Angeles mix: a liquor store, a pawnshop, a nail salon. And
3578one more that was less usual: UBuyWeRush—the only
3579retail sign in Los Angeles that was also a handle on
3580CarderPlanet and Shadowcrew.
3581He walked into the front office, where an empty reception
3582window suggested the sixty-cent-per-square-foot space
3583had once been a medical clinic. On the wall a Mercator
3584projection map of the world bristled with pushpins. Then
3585Chris was greeted warmly by UBuy himself, Cesar
3586Carrenza.
3587Cesar had come to the underground by a circuitous
3588course. He graduated from the DeVry Institute in 2001 with
3589a degree in computer programming, hoping to get an
3590Internet job. When he couldn’t find one, he decided to try his
3591hand as an independent businessman on the Web.
3592From an ad in the Daily Commerce, he learned about an
3593upcoming auction at a public storage facility in Long
3594Beach, where the owners were selling off the contents of
3595abandoned lockers. When he showed up he found the
3596auction observed a very specific ritual. The manager,
3597wielding an imposing bolt cutter, would snip off the
3598defaulting renter’s lock while the bidders watched, and then
3599open the door. The bidders, about twenty of them, were
3600expected to evaluate the contents from where they stood
3601several feet away. The winner would then secure the unit
3602with his own padlock and clear out the contents within
3603twenty-four hours.
3604The experienced bidders were easy to spot: Padlocks
3605hung from their belts, and they held flashlights to peer into
3606the dark lockers. Cesar was less prepared but no less
3607eager. He was the only bidder on the first lot, claiming a
3608locker full of old clothes for $1.
3609He sold the clothes at a yard sale and on eBay for about
3610$60. Figuring he’d found a nice little niche, Cesar started
3611going to more auctions at storage facilities and business
3612liquidations, breaking down large lots and moving them on
3613eBay for a tidy profit. He put the money back into the
3614business and opened his storefront in the Long Beach strip
3615mall to accept consignments from neighbors with office
3616furniture, lawn chairs, and unbranded jeans to sell online.
3617It was good, honest work—not like his last independent
3618business. For most of the 1990s Cesar had been into
3619credit card fraud. He was happier selling on eBay, but
3620thinking about the past made him wonder if there was a
3621market for the kind of gear he’d used as a crook. He
3622ordered some MSR206s from the manufacturer and
3623offered them for sale through the UBuyWeRush eBay store.
3624He was impressed by how fast they were snapped up.
3625Then one of his new customers told him about a website
3626where he could really sell. He introduced Cesar to Script,
3627who approved UBuyWeRush as a CarderPlanet vendor.
3628Cesar posted his introduction on August 8, 2003. “I
3629decided to supply all you guys making the real big bucks,”
3630he wrote. “So if you need me I sell card printers, card
3631embossers, tippers, encoders, small readers and more. I
3632know it sounds like advertising, but it’s for you, a SAFE
3633place to shop.”
3634place to shop.”
3635Business exploded overnight. Cesar built his own
3636website, began vending on Shadowcrew, got an 800
3637number, and started accepting e-gold, an anonymous
3638online currency favored by carders. He developed a
3639reputation for excellent customer service. With customers in
3640every time zone, he was scrupulous about answering the
3641phone whenever it rang, day or night. It was always money
3642on the other end of the line.
3643A canny businessman, he guaranteed same-day
3644shipping and forged relationships with his rivals, so if he
3645was caught short on an item, he could buy stock from a
3646competitor to fill his orders and keep his customers happy.
3647Strategic moves like that soon turned UBuyWeRush into
3648the top supplier of hardware to a worldwide community of
3649hackers and identity thieves. “Really good person, great to
3650deal with,” wrote a carder named Fear, advising a
3651Shadowcrew newbie. “Don’t scam UBuyWeRush cause
3652he’s a cool guy, and he’ll keep your info on the downlow.”
3653Cesar soon expanded his offerings to include hundreds
3654of different products: skimmers, passport cameras, foil
3655stampers, blank plastic, barcode printers, embossers,
3656check paper, magnetic ink cartridges, even cable TV
3657descramblers. Selling equipment wasn’t in and of itself
3658illegal, as long as he wasn’t conspiring in its criminal
3659applications. He even had some law-abiding customers
3660who bought his gear to make corporate ID cards and
3661school lunch vouchers.
3662Inundated with orders, Cesar ran a help-wanted ad in the
3663classifieds and began hiring workers to inventory, pack,
3664and ship his gear. As adjoining offices opened up, he
3665annexed them for the extra storage space, doubling and
3666then tripling his square footage. Fascinated by the global
3667reach of his low-rent strip-mall operation, he bought a wall
3668map, and every time he shipped to a new city he’d sink a
3669pin into the location. After six months, the map was
3670porcupined with pins throughout the United States,
3671Canada, Europe, Africa, and Asia. An impenetrable forest
3672of metal grew southwest of Russia on the Black Sea.
3673Ukraine.
3674Chris had become friends with Cesar. He’d even had
3675him over for dinner, along with Mrs. UBuyWeRush, Clara,
3676and Chris’s two boys—well-mannered kids who stayed at
3677the dinner table all the way through dessert. Chris
3678particularly liked hanging out at Cesar’s office. You never
3679knew who would show up at UBuyWeRush. Carders too
3680paranoid to have counterfeiting gear shipped even to a
3681drop would make a pilgrimage to Los Angeles to pick up
3682their items in person, opening the front door through their
3683shirtsleeve to leave no prints and paying in cash. Foreign
3684carders vacationing in California would stop by just to see
3685the legendary warehouse with their own eyes and shake
3686Cesar’s hand.
3687On this day, the man walking in to pick up an MSR206
3688was the last person Chris expected to see in Cesar’s shop,
3689a six-foot-five hacker with a long ponytail.
3690Chris was stunned; Max rarely left San Francisco these
3691days, and he hadn’t said anything about coming to town.
3692Max was equally surprised to see Chris. They exchanged
3693pleasantries awkwardly.
3694There was only one reason Max would sneak into Los
3695Angeles to buy his own magstripe encoder, Chris knew.
3696Max had decided to stop sharing his most valuable data.
3697Max had become privy to one of the biggest security
3698blunders in banking history, one that most consumers would
3699never hear about, even as it enriched carders to the tune of
3700millions of dollars.
3701The midsized Commerce Bank in Kansas City, Missouri,
3702may have been the first to figure out what was going on. In
37032003, the bank’s security manager was alarmed to find that
3704customer accounts were being sacked for $10,000 to
3705$20,000 a day from cash machines in Italy—he would
3706come in on a Monday and find his bank had lost $70,000
3707over the weekend. When he investigated, he learned that
3708the victim customers had all fallen for a phishing attack
3709aimed specifically at their debit card numbers and PINs.
3710But something didn’t make sense: CVVs were supposed
3711to prevent exactly this kind of scam. Without the CVV
3712security code programmed onto the magnetic stripe of the
3713real cards, the phished information shouldn’t have worked
3714at any ATM in the world.
3715He dug some more and discovered the truth: His bank
3716simply wasn’t checking the CVV codes on ATM
3717withdrawals, nor on debit card purchases, where the
3718consumer enters the PIN at the register. In fact, the bank
3719couldn’t perform such a check consistently if it wanted to;
3720the third-party processing network used by the bank didn’t
3721even forward the secret code. The Italian phishers could
3722program any random garbage into the CVV field, and the
3723card would be accepted as the real thing.
3724The manager moved the bank to another processing
3725network and reprogrammed his servers to verify the CVV.
3726The mysterious withdrawals from Italy halted overnight.
3727But Commerce Bank was just the beginning. In 2004,
3728nearly half America’s banks, S&Ls, and credit unions still
3729weren’t bothering to verify the CVV on ATM and debit
3730transactions, which is why America’s in-boxes were being
3731flooded with phishing e-mails targeting PIN codes for what
3732the carders called “cashable” banks.
3733Citibank, the nation’s largest consumer bank by holdings,
3734was the most high-profile victim. “This e-mail was sent by
3735the Citibank server to verify your e-mail address,” read a
3736message spammed from Russia in a September 2003
3737campaign. “You must complete this process by clicking on
3738the link below and entering in the small window your
3739Citibank ATM/Debit Card number and PIN that you use on
3740ATM.”
3741A more artful message in 2004 capitalized on
3742consumers’ well-founded fears of cybercrime. “Recently
3743consumers’ well-founded fears of cybercrime. “Recently
3744there have been a large number of identity theft attempts
3745targeting Citibank customers,” read the spam, emblazoned
3746with Citi’s iconography. “In order to safeguard your account,
3747we require that you update your Citibank ATM/Debit card
3748PIN.” Clicking on the link took customers to a perfect
3749simulacrum of a Citibank site, hosted in China, where the
3750victim would be prompted for the data.
3751Good for direct cash, PINs were the holy grail of carding.
3752And it was CarderPlanet’s King Arthur who was most
3753successful in the quest. King, as he was known to his
3754friends, ran an international ring that specialized in hitting
3755Citibank customers, and he was a legend in the carding
3756world. One of King Arthur’s lieutenants, an American expat
3757in England, once let it slip to a colleague that King was
3758making $1 million a week from the global operation. And he
3759was just one of many Eastern Europeans running cash-outs
3760in America.
3761Max plugged himself into the Citibank cash-outs in his
3762own way: He Trojaned an American mule named Tux, and
3763started intercepting the PINs and account numbers the
3764carder was getting from his supplier. After a while, he
3765contacted the source—an anonymous Eastern European
3766whom Max suspected of being King Arthur himself—and
3767told him candidly what he’d done: Tux, he said, had been
3768guilty of the crime of slipshod security. For good measure,
3769Max claimed falsely that the mule had been ripping off the
3770supplier.
3771The supplier cut off Tux on the spot and began providing
3772Max with his PINs directly, anointing the hacker as his
3773newest cash-out mule.
3774When the PINs first started rolling in, Max had passed
3775them all to Chris, who tore into them with a vengeance.
3776Chris would pull $2,000 in cash—the daily ATM withdrawal
3777limit—and then send his girls out to make in-store debit
3778purchases with the PINs until the account was drained dry.
3779He was raping the cards. Max didn’t like it. The whole point
3780of a cash-out was to get cash, not merchandise that sold
3781for a fraction of its worth. With a little finesse, the PINs could
3782be producing a lot more liquid.
3783Then it occurred to him he didn’t need his partner at all
3784for this particular operation.
3785When he returned from UBuyWeRush with his very own
3786MSR206, Max went into business for himself. He
3787programmed a stack of Visa gift cards with the account
3788data and wrote each card’s PIN on a sticky note affixed to
3789the plastic. Then he’d get on his bicycle or take a long
3790meandering walk through the city, visiting small, customerowned
3791cash machines at locations free of surveillance
3792cameras.
3793He’d enter the PIN, then the withdrawal amount, and
3794chump, chump, chump, chump, the ATM spat out cash
3795like a slot machine. Max would pocket the money, write the
3796new, lower account balance on the Post-it, then look around
3797discreetly to make sure he hadn’t drawn any attention
3798before drawing the next card from his deck. To keep his
3799prints off the machines, he’d press the buttons through a
3800piece of paper or with his fingernails, or coat the pads of
3801his fingers with hydroxyquinoline—a clear, tacky antiseptic
3802sold in drugstores as the liquid bandage New-Skin.
3803Max dutifully sent a fixed percentage of his take to
3804Russia via Western Union MoneyGram, per his agreement
3805with the supplier. He was an honest criminal now, doing
3806straightforward business in the underground. And even
3807after getting his own magstripe writer, Max continued to
3808give some of his PINs to Chris, who continued tapping his
3809crew to burn through the cards aggressively.
3810On the surface, Max’s ATM visits weren’t much of a
3811Robin Hood operation, but Max took moral solace in the
3812fact that the cash-outs always ended with the cards being
3813canceled. That meant the fraudulent withdrawals were
3814being discovered, and Citibank would be forced to
3815reimburse its customers for the thefts.
3816After some months, Max built a nice nest egg from
3817Citibank’s losses: He moved with Charity to a $6,000-amonth
3818house rental in San Francisco’s Cole Valley and
3819installed a safe for his profits: $250,000 in cash.
3820His earnings were just a tiny piece of the losses from the
3821CVV gaffe. In May 2005, a Gartner analyst organized a
3822survey of five thousand online consumers and, extrapolating
3823the results, estimated that it had cost U.S. financial
3824institutions $2.75 billion. In just one year.
3825
382616
3827Operation Firewall
3828here was something fishy going on with Shadowcrew.
3829Max kept his presence on the Internet’s top crime site
3830low-key; to him, Shadowcrew was just a hunting ground
3831conveniently stocked with hackable carders. But in May
38322004, a Shadowcrew administrator made an offer on the
3833board that got Max’s attention. The admin, Cumbajohnny,
3834was announcing a new VPN service just for Shadowcrew
3835members.
3836A VPN—virtual private network—is typically used to
3837provide telecommuters with access to their employer’s
3838network from home. But a trustworthy underground VPN
3839appealed to carders for another reason. It meant every byte
3840of traffic from their computers could be encrypted—immune
3841to sniffing by a nosy ISP or a law enforcement agency with
3842a surveillance warrant. And any attempt to trace their
3843activities would get no farther than Cumbajohnny’s own
3844data center.
3845Cumbajohnny was a recent addition to Shadowcrew’s
3846leadership—a former moderator who was growing in
3847power and influence and changing the mood on the board.
3848Some other admins were complaining about a new meanspiritedness
3849on the forum. Banner ads appeared at the top
3850of the site: “Stop talking. Do Business. Advertise here.
3851Contact Cumbajohnny.” Shadowcrew was taking on the feel
3852of the Las Vegas strip, with flashy ads promising a lifestyle
3853of partying, beautiful women, and piles and piles of cash.
3854Gollumfun, an influential founder, had already publicly
3855retired from the site when another founder named
3856BlackOps announced he was leaving as well. “Shadowcrew
3857has been reduced from its once lustrous form to a
3858degrading environment of children who lack knowledge, the
3859skills or desire to interact with other members in a positive
3860way,” he wrote. “Gone are the well thought out tutorials;
3861gone are the well-respected members; and gone is the
3862civility. No longer do we help the newbies find their way, we
3863simply flame them to death until they leave and then
3864complain that there aren’t any new members.”
3865“BlackOps, you will be missed, thank you for your
3866services,” Cumbajohnny wrote tactfully. “SC is changing,
3867and for the best.”
3868Max paid little attention to the politics of the carding
3869scene. But the VPN announcement made him uneasy. It
3870turned out Cumbajohnny had been privately selling his VPN
3871service to Shadowcrew’s leaders for three months. Now,
3872Cumbajohnny wrote, any Shadowcrew member in good
3873standing could buy the same peace of mind for $30 to $50
3874a month.
3875But VPNs have one well-known weakness: everything
3876transpiring over the network has to be funneled through a
3877central point, unencrypted and vulnerable to
3878eavesdropping. “If the FBI, or whoever, really wanted to they
3879could get into the datacenter and change some of the
3880configs on the VPN box and start logging, and then you
3881would be kinda screwed,” one member noted. “But that is
3882just straight paranoia,” he conceded.
3883Cumbajohnny reassured him. “No one can touch the VPN
3884without me knowing about it.”
3885Max wasn’t convinced. In his white-hat days, he’d written
3886a program for the Honeynet Project called Privmsg—a
3887PERL script that took the data from a packet sniffer and
3888used it to reconstruct IRC chats. When an intruder was
3889lured into cracking one of the project’s honeypots, the
3890attacker would often use the system to hold online
3891conversations with his fellow hackers. With Privmsg, the
3892white hats could see the whole thing. It had been a strong
3893innovation in hacker tracking, turning passive honeypots
3894innovation in hacker tracking, turning passive honeypots
3895into digital wiretaps and opening a window into the
3896underground’s culture and motives.
3897Max could see the same wiretap tactic at play now in
3898Cumbajohnny’s VPN offer. There was other evidence, too;
3899while hacking random carders, he saw a message to a
3900Shadowcrew administrative account that read like a federal
3901agent giving orders to an informant. Max couldn’t shake the
3902feeling that someone was turning Shadowcrew into the
3903ultimate honeypot.
3904After talking it over with Chris, Max posted several
3905messages to Shadowcrew summarizing his doubts. The
3906posts disappeared at once.
3907Max’s suspicions were right on the money.
3908The NYPD had nabbed Albert “Cumbajohnny” Gonzalez
3909nine months earlier pulling cash out of a Chase ATM on
3910New York’s Upper West Side. Originally from Miami,
3911Gonzalez was twenty-one years old and the son of two
3912Cuban immigrants. He was also a longtime hacker who’d
3913been dedicated enough to trek to Vegas for the 2001 Def
3914Con.
3915The Secret Service interviewed Gonzalez in custody and
3916quickly ascertained his worth. The hacker was living in a
3917$700-a-month garden apartment in Kearny, New Jersey,
3918had $12,000 in credit card debt, and was officially
3919unemployed. But as “Cumbajohnny,” he was a trusted
3920confidant and colleague of carders around the world and,
3921most importantly, a moderator at Shadowcrew.
3922He was in the belly of the beast, and properly handled, he
3923might strike a deathblow against the forum.
3924The Secret Service took over the case and sprang
3925Gonzalez to use him as an informant. The VPN was the
3926agency’s masterstroke. The equipment was bought and
3927paid for by the feds, and they’d obtained wiretap warrants
3928for all the users. Cumbajohnny’s carder-only VPN service
3929was an invitation to an Internet panopticon.
3930Shadowcrew’s biggest players were drawn inexorably
3931into the Secret Service’s surveillance net. The tapped VPN
3932laid bare all the wheeling and dealing the carders kept off
3933the public website—the hard negotiating that unfolded
3934mostly in e-mail and over IM.
3935There were deals every day and every night, with a
3936weekly surge in trading Sunday evenings. The transactions
3937ranged from the petty to the gargantuan. On May 19, agents
3938watched Scarface transfer 115,695 credit card numbers to
3939another member; in July, APK moved a counterfeit UK
3940passport; in August, Mintfloss sold a fake New York driver’s
3941license, an Empire Blue Cross health insurance card, and a
3942City University of New York student ID card to a member in
3943need of a full identification portfolio. A few days later,
3944another sale by Scarface, just two cards this time; then
3945MALpadre bought nine. In September, Deck sold off
3946eighteen million hacked e-mail accounts with user names,
3947passwords, and dates of birth.
3948The Secret Service had fifteen full-time agents combing
3949through the activity—every purchase would be another
3950“underlying offense” in a grand jury indictment. And the best
3951part was, many of Shadowcrew’s denizens were unwittingly
3952paying the Secret Service for the privilege of being
3953monitored.
3954But running a game against hackers was never cut-anddried,
3955as the agency learned on July 28, 2004. That was
3956when Gonzalez informed his handlers that a carder named
3957Myth, one of King Arthur’s cashers, had somehow obtained
3958one of the agency’s confidential documents about
3959Operation Firewall. Myth had been boasting about it in an
3960IRC chat room.
3961The feds told Gonzalez to find the source of the leak, and
3962fast. As Cumbajohnny, Gonzalez made contact with Myth
3963and learned that the documents represented just a few
3964droplets in a full-blown Secret Service data spill. Myth knew
3965about subpoenas issued in the Shadowcrew probe and
3966had even discovered that the agency was monitoring his
3967had even discovered that the agency was monitoring his
3968own ICQ account. Fortunately, the documents didn’t
3969mention an informant.
3970Myth refused to tell Gonzalez who his source was but
3971agreed to arrange an introduction. The next day, Gonzalez,
3972Myth, and a mystery hacker using the temporary handle
3973“Anonyman” met on IRC. Gonzalez worked to gain
3974Anonyman’s trust, and the hacker finally revealed himself as
3975Ethics, a vendor whom Cumba already knew on
3976Shadowcrew.
3977The leak was starting to make sense. In March, the
3978Secret Service had noticed Ethics was selling access to
3979the database of a major wireless carrier, T-Mobile. “I am
3980offering reverse lookup of information for a T-Mobile cell
3981phone, by phone number,” he wrote in a post. “At the very
3982least, you get name, SSN, and DOB. At the upper end of
3983the information returned, you get Web username/password,
3984voicemail password, secret question/answer.”
3985T-Mobile had failed to patch a critical security hole in a
3986commercial server application it had purchased from the
3987San Jose, California, company BEA Systems. The hole,
3988discovered by outside researchers, was painfully simple to
3989exploit: An undocumented function allowed anyone to
3990remotely read or replace any file on a system by feeding it
3991a specially crafted Web request. BEA produced a patch for
3992the bug in March 2003 and issued a public advisory rating
3993it a high-severity vulnerability. In July of that year, the
3994researchers who discovered the hole gave it more attention
3995by presenting it at the Black Hat Briefings convention in Las
3996Vegas, an annual pre–Def Con gathering attended by
39971,700 security professionals and corporate executives.
3998Ethics learned of the BEA hole from the advisory, crafted
3999his own twenty-line exploit in Visual Basic, then began
4000scanning the Internet for potential targets who had failed to
4001patch. By October 2003, he hit pay dirt at T-Mobile. He
4002wrote his own front end to the customer database to which
4003he could return at his convenience.
4004At first, he used his access to raid the files of Hollywood
4005stars, circulating grainy candid photos of Paris Hilton, Demi
4006Moore, Ashton Kutcher, and Nicole Richie stolen from their
4007Sidekick PDAs. It was evident now that he’d gotten into a
4008Secret Service agent’s Sidekick as well.
4009A simple Google search on Ethics’s ICQ number turned
4010up his real name on a 2001 résumé seeking computer
4011security work. He was Nicholas Jacobsen, a twenty-oneyear-
4012old Oregonian who’d recently relocated to Irvine,
4013California, to take a job as a network administrator. All that
4014was left was to confirm which Secret Service agent was
4015violating policy by accessing sensitive material on his PDA.
4016That’s where Gonzalez proved his worth again. Now that
4017he was buddies with Cumbajohnny, Ethics hit up the
4018Shadowcrew leader for an account on his much-touted
4019VPN, figuring it would be a safer way to access T-Mobile.
4020Gonzalez happily obliged, and his Secret Service
4021handlers got to watch as Ethics surfed to T-Mobile’s
4022customer service website and logged in with the user name
4023and password of New York agent Peter Cavicchia III, a
4024veteran cybercrime officer who’d distinguished himself by
4025busting a former AOL employee for stealing ninety-two
4026million customer e-mail addresses to sell to spammers.
4027The leak had been found. Cavicchia would quietly retire a
4028few months later, and Ethics was added to the list of
4029Operation Firewall targets.
4030There was just one more threat to the investigation, and,
4031bizarrely, it was coming from one of the FBI’s underground
4032assets.
4033David Thomas was a lifelong scammer who’d
4034discovered the crime forums in the Counterfeit Library days
4035and soon became addicted to the high-speed deal making
4036and criminal camaraderie. Now forty-four years old, El
4037Mariachi, as he styled himself, was one of the most
4038respected members in the carding community, assuming
4039the role of mentor to younger scammers and dispensing
4040advice on everything from identity theft to basic life lessons
4041gleaned from decades on the fringe.
4042His experience, though, didn’t immunize him from the
4043hazards of his profession. In October 2002, Thomas
4044showed up in an office park in Issaquah, Washington,
4045where he and his partner had rented a drop for one of
4046CarderPlanet’s founders. They were hoping to claim
4047$30,000 in Outpost.com merchandise ordered by the
4048Ukrainian. Instead, they found local police waiting for them.
4049The police arrested Thomas, and a detective read him
4050his Miranda rights and gave him a form to sign
4051acknowledging he understood them. Thomas scoffed at the
4052idea of a local cop trying to question him. “You don’t know
4053who you have here,” he said. He urged the detective to call
4054in the feds; the Secret Service would know who El Mariachi
4055was, and he could give them a case involving Russians and
4056“millions of dollars.”
4057A Secret Service agent visited him in the county jail but
4058wasn’t impressed by Thomas’s $30,000-drop business.
4059Then an FBI agent from the Seattle field office showed up.
4060On the second meeting, the agent brought along an
4061assistant U.S. attorney and an offer: The feds couldn’t help
4062Thomas with his local case, but when he got out he could
4063go to work for the Northwest Cyber Crime Task Force in
4064Seattle.
4065It would be an intelligence-gathering mission, an official
4066designation for an FBI operation with no predetermined
4067targets. The bureau would get Thomas a new computer, put
4068him up in a nice apartment, pay all of his expenses, and
4069give him $1,000 a month in spending money. In return,
4070Thomas would gather information on the underground and
4071report it back to the task force.
4072Thomas hated snitches, but he liked the idea of being
4073paid to observe and comment on the underground with
4074which he’d become obsessed. Intelligence gathering
4075wasn’t the same as snitching, he reasoned, and he could
4076wasn’t the same as snitching, he reasoned, and he could
4077use the material he collected to write a book about the
4078carding scene, something he’d been thinking a lot about
4079lately.
4080He also knew exactly how to gather the information the
4081task force was after.
4082Thomas was released from jail five months after his
4083arrest. And in April, the FBI gained a new asset in the war
4084on cybercrime: El Mariachi and his brand-new governmentfunded
4085crime forum, the Grifters.
4086From his bureau-rented corporate apartment in Seattle,
4087El Mariachi was soon gathering information on his fellow
4088carders, particularly the Eastern Europeans. But though
4089Thomas was working for the FBI, he didn’t exactly feel
4090kinship with other government assets, and the VPN
4091a n n o u n c e m e n t convinced him—correctly—that
4092Cumbajohnny was a federal informant.
4093Thomas became fixated on exposing his rival. Ignoring
4094admonishments from his FBI handler, he continuously
4095called out Gonzalez on the forums. Gonzalez, too, seemed
4096to have it in for El Mariachi—he dug up a copy of the police
4097report from Thomas’s Seattle arrest and circulated it
4098among the Eastern European carders, drawing their
4099attention to the part where Thomas offered to help catch
4100Russians. A full-blown proxy war had broken out between
4101the FBI and Secret Service, by way of two informants.
4102It was a bad time to be distracting the Eastern
4103Europeans with American carder drama. In May 2004, one
4104of CarderPlanet’s Ukrainian founders was extradited to the
4105United States, after being arrested on vacation in Thailand.
4106The next month, the British national police moved in on the
4107site’s only native English-speaking administrator in Leeds.
4108Script, getting heat from the Orange County FBI and the
4109U.S. Postal Inspection Service, had already retired from the
4110site, leaving King Arthur in charge. On July 28, 2004, King
4111made an announcement.
4112“It is time to tell you the bad news—the forum should be
4113closed,” he wrote. “Yes, it really means closed and there
4114are a lot of reasons for that.”
4115In broken English he explained that CarderPlanet had
4116become a magnet for law enforcement agencies around
4117the world. When carders were busted, police interrogators
4118badgered them with questions about the forum and its
4119leaders. Under the relentless pressure, he implied, even he
4120might slip up. “All of us are just people and all of us can
4121make mistakes.”
4122By closing CarderPlanet, he would be depriving his
4123enemies of their greatest asset. “Our forum held them well
4124informed and up to date, and on our forum they and the
4125bank employees just have been raising their level of
4126proficiency and knowledge,” he wrote.
4127“Now all of thing will be the same but they will not know
4128where the wind blows from and what to do.”
4129With that farewell note, King Arthur, almost certainly a
4130millionaire ten times over, became a carder legend. He
4131would be remembered as the one who gently folded the
4132great CarderPlanet before anyone else could enjoy the
4133pleasure of taking it down.
4134Shadowcrew’s leaders wouldn’t be so lucky. In September,
4135the FBI pulled the plug on Thomas’s operation and gave
4136him a month to move out of his apartment—ending his war
4137with Cumbajohnny. The next month, on October 26, sixteen
4138Secret Service agents gathered in a Washington command
4139center to drop the hammer on Operation Firewall. Their
4140targets were marked on a map of the United States filling a
4141wall of computer displays. Every one of them would be at
4142home, the agents knew; at the Secret Service’s behest,
4143Gonzalez had called an online meeting for that evening, and
4144nobody said no to Cumbajohnny.
4145At nine p.m., agents armed with MP5 semiautomatic
4146assault rifles burst into Shadowcrew members’ homes
4147around the country, grabbing three founders, T-Mobile
4148hacker Ethics, and seventeen other buyers and sellers. It
4149was the biggest crackdown on identity thieves in American
4150history. Two days later, a federal grand jury handed down a
4151sixty-two-count conspiracy indictment and the Justice
4152Department went public with Operation Firewall.
4153“This indictment strikes at the heart of an organization
4154that is alleged to have served as a one-stop marketplace
4155for identity theft,” Attorney General John Ashcroft boasted in
4156a press release. “The Department of Justice is committed
4157to taking on those who deal in identity theft or fraud,
4158whether they act online or off.”
4159With Gonzalez’s help, the Secret Service locked
4160Shadowcrew’s remaining four thousand users out of the
4161site and swapped in a new front page featuring a Secret
4162Service banner and an image of a prison cell. The new
4163page struck the Shadowcrew tagline, “For Those Who Like
4164to Play in the Shadows,” and substituted a new motto: “You
4165Are No Longer Anonymous!!”
4166Panicked carders around the around the world soaked
4167up the news reports and watched the television coverage,
4168worrying for themselves and their fallen compatriots. They
4169collected on a small forum called Stealth Division to assess
4170the damage and take a head count of survivors. “I am
4171scared to death for my family right now—for my children,”
4172wrote one cyberthief. “I just learned that my every move has
4173been recorded.”
4174Slowly, they realized that Cumbajohnny wasn’t on the list
4175of defendants. That’s when he logged in to make a final
4176appearance.
4177“I want everyone to know I’m on the run and I had no
4178fucking idea the USSS had the capabilities of doing what
4179they did,” Gonzalez wrote. “From the news articles I can tell
4180they’ve wiretapped my VPN and wiretapped the
4181Shadowcrew server. This is my last post, good luck
4182everyone.”
4183Nick Jacobsen, Ethics, was kept out of the press release
4184and quietly indicted separately in Los Angeles—his
4185and quietly indicted separately in Los Angeles—his
4186intrusion into the Secret Service’s e-mail wouldn’t emerge
4187until well after the agency had collected its accolades for
4188Operation Firewall. Even then, the dragnet was a clear
4189victory for the government. CarderPlanet was shuttered,
4190and now Shadowcrew was closed for good, and its leaders
4191—save Gonzalez—were in jail.
4192The carders were confused, paranoid, and, for the
4193moment, homeless. “It will take years and years for any
4194message board like Shadowcrew to build up,” wrote one.
4195“And when or if it does, law enforcement will bust it again.
4196“And knowing what can be done, I doubt anyone will take
4197the risk of putting another one up.”
4198
419917
4200Pizza and Plastic
4201n the top floor of the Post Street Towers, Max’s
4202computers sat on the wood-veneer floor, silent and cool.
4203Outside the bay window, shops and apartments were ready
4204to unwittingly feed him bandwidth through his oversized
4205antenna.
4206Max had gone dormant for a few months after
4207accumulating a pile of cash from the Citibank operation;
4208he’d abandoned his penthouse apartment and put his
4209hacking on the back burner. But he couldn’t stay away long.
4210He’d asked Chris to rent him a new safe house, one with
4211more neighborhood Wi-Fi options than the last. “I just need
4212a closet, I don’t need any space,” he’d said.
4213Chris had delivered. There was ample Wi-Fi swimming
4214around the Post Street Towers, and the apartment was
4215indeed a closet: a three-hundred-square-foot studio that
4216seemed scarcely larger than a prison cell. Decked out in
4217blond wood, with a Formica counter, a full-sized fridge, and
4218a bed that unfolded from the wall, it was a clean and
4219functional McApartment, bare of all distractions and able to
4220provide the necessities for Max’s all-night hacking sprees.
4221The high turnover in the building made him anonymous.
4222Chris just had to flash a fake ID at the rental office, pay a
4223$500 deposit, and sign the six-month lease.
4224Once his computers were plugged in and his antenna
4225was latched on to some patsy’s network, Max wasted little
4226time in getting back on the job. As ever, he targeted
4227fraudsters, and he developed some novel ways to steal
4228from them. He monitored the alerts put out by an
4229organization called the Anti-Phishing Working Group,
4230staying on top of the latest phishing attacks. The alerts
4231included the Web addresses of the phishing sites linked to
4232the forged e-mails, allowing Max to hack the phishers’
4233servers, resteal the stolen data, and erase the original
4234copy, frustrating the phishers and grabbing valuable
4235information at the same time.
4236Other attacks were less focused. Max was still plugged
4237into the white-hat scene, and he was on the private mailing
4238lists where security holes often appeared for the first time.
4239He had machines scanning the Internet day and night for
4240servers running vulnerable software, just to see what he’d
4241turn up. He was scanning for a Windows server-side buffer
4242overflow when he made the discovery that would lead to his
4243public entry into the carding scene.
4244His scanning put him inside a Windows machine that, on
4245closer inspection, was in the back office of a Pizza
4246Schmizza restaurant in Vancouver, Washington; he knew
4247the place, it was near his mother’s house. As he looked
4248around the computer, he realized the PC was acting as the
4249back-end system for the point-of-sale terminals at the
4250restaurant—it collected the day’s credit card transactions
4251and sent them in a single batch every night to the credit
4252card processor. Max found that day’s batch stored as a
4253plain text file, with the full magstripe of every customer card
4254recorded inside.
4255Even better, the system was still storing all the previous
4256batch files, dating back to when the pizza parlor had
4257installed the system about three years earlier. It was some
4258fifty thousand transactions, just sitting there, waiting for him.
4259Max copied the files, then deleted them—they weren’t
4260needed by Pizza Schmizza; in fact, just storing them in the
4261first place was a violation of Visa’s security standards.
4262After sorting and filtering out the duplicate and expired
4263cards, he was left with about two thousand dumps.
4264For the first time, Max had a primary source, and they
4265were virgin cards, almost guaranteed to be good.
4266Chris had been complaining about the staleness of some
4267Chris had been complaining about the staleness of some
4268of Max’s dumps. That would end now. A customer could
4269walk into the Pizza Schmizza and order a twelve-inch pie
4270for his family, and his credit card could be on Max’s hard
4271drive while the leftovers were still cooling in the garbage.
4272Once he was done organizing his numbers, Max gave
4273Chris a taste. “These are extremely fresh,” he said. “They’re
4274from two days ago.”
4275There was no way that Chris and his crew could metabolize
4276the fifty dumps a day coming from the Pizza Schmizza. So
4277Max decided to make his first forays into vending in the
4278carding scene.
4279Chris offered to handle the sales in exchange for half the
4280profits. Chris’s recklessness still concerned Max—Chris
4281had nearly been arrested buying gold in, of all places, India,
4282fleeing the country one step ahead of the police. But Chris
4283knew too much about Max for the hacker to just cut him
4284loose, so he agreed to let Chris act as his representative to
4285the underground. Chris soon claimed success in marketing
4286Max’s dumps, until Max—who had a back door on Chris’s
4287computer—figured out that Chris was actually using the
4288magstripe data himself, getting a 50 percent price break by
4289claiming to have resold them. Economically, it was all the
4290same. But Max couldn’t help feeling cheated yet again.
4291Max turned to someone who might be easier to control: a
4292teenage carder from Long Island named John Giannone
4293who had become Chris’s sidekick.
4294Giannone was a smart middle-class kid with a coke habit
4295and burning desire to be a ruthless, badass cyberpunk. His
4296early ops failed to impress: He boasted to another carder
4297that he’d once pushed all the buttons on an elevator before
4298getting off, so the next passenger would have to stop at
4299every floor. On another occasion, he claimed, he walked
4300into a bank and wrote a note on the back of a deposit slip:
4301“This is a robbery. I have a bomb. Give me money or I’ll
4302blow the bank.” Then he put the slip back on the pile as a
4303surprise for the next customer.
4304When he was seventeen, Giannone joined Shadowcrew
4305and CarderPlanet under the handle MarkRich, and started
4306participating in small operations. His reputation went south
4307when he was busted carding plane tickets and a rumor
4308spread that he’d snitched on a forum regular while in
4309juvenile hall.
4310Undaunted, Giannone paid a more established carder
4311for the exclusive right to take over his handle and
4312reputation. As “Enhance,” the teen became more bold but
4313not more successful. In May 2003, copying an extortion
4314tactic perfected by the Russians, he borrowed a hacker’s
4315botnet and launched a DDoS attack against JetBlue, taking
4316down the airline’s website for some twenty-five minutes
4317before sending an e-mail demanding $500,000 in
4318protection money. But JetBlue paid him neither cash nor
4319the respect a cybergangster deserved. “We will forward this
4320to the appropriate law enforcement agencies,” the
4321company wrote. “Yesterday’s outage was due to a system
4322upgrade.”
4323When Max found Giannone with his Free Amex hack, the
4324teen was running his operations from the computer in his
4325mother’s bedroom. But Max and Chris had looked over
4326Giannone’s files and decided he could be partner material.
4327Chris in particular may have seen something of himself in
4328the young, coke-snorting gangster wannabe. Giannone was
4329already a regular visitor to Orange County—he liked
4330vacationing in the sun—and the two began partying
4331together. Chris called his apprentice “the Kid.”
4332Max knew everything about Giannone, while Giannone
4333knew virtually nothing about him. For Max, it was an ideal
4334arrangement for a partnership. Giannone made some sales
4335of Max’s dumps and then introduced Max to other carders
4336interested in making buys over ICQ. Max set up a new
4337online identity for his vending: “Generous.”
4338Dealing with strangers was a big step for Max, and he
4339took elaborate precautions to stay safe. When using carder
4340took elaborate precautions to stay safe. When using carder
4341forums or instant-messaging services, he’d bounce his
4342connection through his private network of hacked PCs
4343around the world—ensuring nobody could easily trace him
4344even as far as his hacked WiFi. He disguised his writing
4345style online for fear that some ill-considered turn of phrase
4346or choice of punctuation might be matched to one of Max
4347Vision’s security white papers or Bugtraq posts—the FBI
4348had once remarked on the copious ellipses in his
4349anonymous note to Lawrence Berkeley Laboratory during
4350the BIND attacks.
4351To collect revenue, he accepted payment through an
4352anonymous e-gold account linked to an ATM card.
4353Giannone helped him with a second remittance system.
4354The teenager established a business account at Bank of
4355America for a car repair shop called A&W Auto Clinic, then
4356sent Max the magstripe data and PIN code for his ATM
4357card, allowing Max to clone the card with his MSR206.
4358Dumps buyers in the United States could make a cash
4359deposit for A&W at their nearest Bank of America branch,
4360which Max could then withdraw at his leisure with his cloned
4361ATM card.
4362Max didn’t need the money the way he used to. He’d
4363squandered most of his nest egg from the Citibank cashouts,
4364frittering it away on everything from handouts for the
4365homeless to a $1,500 Sony AIBO robotic dog. But he
4366wasn’t broke yet, and Charity had just started a well-paying
4367job as a system administrator at Linden Lab, the brick-andmortar
4368home of Second Life—a fully realized threedimensional
4369online universe growing by thousands of
4370inhabitants a month.
4371There was just one reason he was upping the ante now.
4372He’d become addicted to life as a professional hacker. He
4373loved the cat-and-mouse games, the freedom, the secret
4374power. Cloaked in the anonymity of his safe house, he
4375could indulge any impulse, explore every forbidden corridor
4376of the Net, satisfy every fleeting interest—all without fear of
4377consequence, fettered only by the limits of his conscience.
4378At bottom, the master criminal was still the kid who couldn’t
4379resist slipping into his high school in the middle of the night
4380and leaving his mark.
4381
438218
4383The Briefing
4384n a briefing room near Washington, two dozen male faces
4385filled a computer monitor on the wall, some scowling for a
4386mugshot, others smiling for a passport photo. A couple of
4387them looked like teenagers barely out of puberty; others
4388were older, unkempt and vaguely dangerous in
4389appearance.
4390Around the table a handful of FBI agents in suits and ties
4391stared back at the faces of the international computer
4392underground. For one of the agents, a lot of things were
4393suddenly making sense.
4394At thirty-five years old, J. Keith Mularski had been an FBI
4395agent for seven years. But he’d been on the computer
4396crime beat for just four months, and he had a lot to learn.
4397Enthusiastically friendly and quick to laugh, Mularski had
4398wanted to be an FBI agent since his freshman year at
4399Pennsylvania’s Westminster College, when a bureau
4400recruiter came in to speak to one of his classes. He’d held
4401on to the list of qualifications even as he walked a more
4402pedestrian career path, starting as a furniture salesman in
4403Pittsburgh, then working his way up to a position as
4404operations manager for a national furniture chain with fifty
4405employees reporting to him at four stores.
4406In 1997, after eight years of waiting, he finally decided he
4407was ready for the FBI. After a yearlong application process
4408and sixteen weeks of training at the FBI academy in
4409Quantico, he was sworn in as an agent in July 1998.
4410As part of the bureau’s graduation ritual, the newly
4411minted agent was instructed to rank all the FBI field offices
4412in order of assignment preference. He rated his hometown
4413of Pittsburgh as number one—it was where Mularski had
4414grown up, gone to school, and met his wife. His chances of
4415transferring there evaporated the next month, when Islamic
4416terrorists bombed U.S. embassy buildings in Kenya and
4417Tanzania. Veteran FBI agents were dispatched from the
4418Washington, DC, field office to investigate the attacks, and
4419Mularski was one of fifteen fresh recruits sent to fill the
4420vacancies in DC—the city marked thirty-second on his list.
4421Almost overnight Mularski went from managing furniture
4422stores to working on some of the FBI’s most important, and
4423highly classified, investigations. When, in 1999, a listening
4424device was found in an office on the top floor of the State
4425Department’s headquarters, he was part of the team that
4426identified a Russian diplomat monitoring the transmitter
4427from outside. In 2001, he helped bring down Robert
4428Hanssen, a fellow counterespionage agent who’d been
4429secretly spying for the KGB and its successor agency for
4430twenty years.
4431It was heady work, but the secrecy chafed Mularski: He
4432held a top-secret clearance and couldn’t talk about his job
4433with outsiders—even his wife. So when headquarters
4434announced openings for two experienced agents to kickstart
4435an ambitious cybercrime initiative in Pittsburgh, he
4436saw a chance to go home and step out of the shadows at
4437the same time.
4438His new job wouldn’t be in an FBI office. He was
4439assigned to the civilian office of an industry nonprofit group
4440in Pittsburgh called the National Cyber Forensics and
4441Training Alliance. The NCFTA had been formed by banks
4442and Internet companies a couple of years earlier to track
4443and analyze the latest scams targeting consumers online—
4444mostly phishing attacks. Mularski’s job wouldn’t consist of
4445chasing individual scams—in isolation, each round of
4446phishing was too small to meet the FBI’s minimum loss
4447threshold of $100,000. Rather, he would be looking for
4448trends that pointed to a common culprit—a group or a
4449single hacker—responsible for a large number of
4450single hacker—responsible for a large number of
4451cyberthefts. Then he’d shop the results to the various FBI
4452field offices and, hopefully, hand off the investigation.
4453It was passive intelligence gathering, meticulous but
4454unexciting. Mularski wasn’t in charge of the cases, and he
4455never got the satisfaction of putting handcuffs on a bad guy.
4456But for the first time in seven years, he could talk about his
4457work with his wife over dinner.
4458Now he was back in the DC area for his first briefing on
4459the carding scene. At the head of the room was Postal
4460Inspector Greg Crabb, a solidly built man with world-weary
4461eyes who worked in the post office’s international fraud unit.
4462Crabb had stumbled upon the carding underground in 2002
4463while tracking a software counterfeiter with a sideline in
4464credit card fraud. Since then, he’d been on the ground in
4465twenty-five countries, working with local police to make
4466busts and building a massive database of raw intelligence
4467on the growing community: nicknames, IP addresses,
4468instant messages, and e-mails of more than two thousand
4469people. He’d become the government’s top expert on the
4470scene, but the enormity of his crusade now threatened to
4471overwhelm him. So he’d come to the FBI for help.
4472The briefing for about half a dozen FBI agents was held
4473at a nondescript Calverton, Baltimore, office where the
4474bureau ran its Innocent Images anti–child porn operation.
4475Speaking slowly in a rumbling, midwestern twang, the
4476postal inspector weighed each word like a parcel as he ran
4477through the history of the scene: CardersLibrary spawning
4478CarderPlanet, the legend of King Arthur, the influence of the
4479Russians and Ukrainians, and the rise and fall of
4480Shadowcrew. He threw up a screenshot of CarderPlanet to
4481show the underground’s structure: A site operator was the
4482don. Admins were capos. It was a metaphor to which the
4483FBI was institutionally attuned; hackers were the new mafia.
4484Operation Firewall, Crabb explained, had left the carders
4485scattered, paranoid, and disorganized. But they were
4486rebuilding. And unlike before, with Shadowcrew, there was
4487no singular target to go after. Instead, a slew of new,
4488smaller forums was popping up. Crabb didn’t say it, but the
4489Secret Service had treated the carders with half a dose of
4490penicillin; the survivors were immune and plentiful.
4491Mularski hung on every word. In his brief time at the
4492NCFTA, the agent had seen patterns in the raw intelligence
4493bubbling up from the underground: references to
4494nicknames, coded messages, and forums. It made sense
4495now. It was the carders organizing themselves again.
4496When Crabb wrapped up his talk and the other agents
4497began to file out, Mularski approached the postal inspector
4498at the head of the table and extended his hand
4499enthusiastically. “This stuff is fascinating,” he said. “I’d love
4500to work with you. I’d love to partner up with you.”
4501Crabb was surprised by the suggestion; in his
4502experience, a more typical proposal from an FBI agent
4503might take the form “Give me all your information. Thanks,
4504bye.” He met with Mularski and his boss privately and gave
4505the agents a more thorough rundown on the carder scene.
4506Mularski returned to Pittsburgh, his head swimming. He’d
4507thought he’d left behind the world of Russian spies, double
4508agents, and secret identities. He’d been wrong. And the
4509safe, satisfying routine of his new job was about to be
4510shattered.
4511
451219
4513Carders Market
4514ry as he might, Max couldn’t get situated on any of the
4515new forums sprouting in Shadowcrew’s ruins. They were all
4516corrupt, run by dumps vendors hostile to outside
4517competition. In a way, it was a blessing. He could never
4518really trust any of the sites; he knew all too well that the
4519scene was rank with cops and informants.
4520He finally made up his mind that if he was going to vend,
4521the only sensible venue would be a site he personally
4522controlled. Still thinking of himself as Robin Hood, he came
4523up with the perfect name for his own forum: Sherwood
4524Forest.
4525Chris approved of the plan—he liked the idea of vending
4526his counterfeit credit cards and driver’s licenses in a safe
4527environment—but hated the name. As an exercise in
4528branding, “Sherwood Forest” wasn’t going to cut it for a
4529criminal marketplace. The partners went back to the
4530drawing board, and in June 2005 Max used a fake name
4531and bogus address in Anaheim to register
4532Cardersmarket.com.
4533It was a critical time for Max: He was near the end of his
4534federal supervised release, and if he could make it until
4535midnight, October 10, 2005, he would be a free agent, no
4536longer obliged to play the role of an underemployed
4537computer consultant for the benefit of his probation officer.
4538It should have been easy enough to survive a few more
4539months. Besides Chris, there were only two people who
4540knew about Max’s double life, both Chris’s friends: Jeff
4541Norminton and Werner Janer, the real estate fraudster who
4542wrote Charity a $5,000 check that helped bootstrap Max’s
4543hacking operation.
4544Then, in September 2005, Werner Janer got busted.
4545Since hooking up with Max, Chris had been dropping
4546Janer a few cards here and there—maybe eighty over three
4547years—in exchange for 10 percent of whatever Janer
4548netted from his in-store purchases. That month Janer asked
4549for another batch of two dozen cards—a money shortage
4550had forced him to sell the family home in Los Angeles, and
4551he’d moved to Westport, Connecticut, to make a new start
4552of it. Soon after his arrival he was robbed by a criminal
4553associate of nearly all the proceeds of the house sale, and
4554he needed an income boost to support himself and his wife
4555and three children.
4556When Chris’s FedEx arrived, Janer, an avid watch
4557collector, headed straight to Richard’s of Greenwich, a
4558men’s clothing and accessory store that kept an inventory
4559of high-end timepieces. Janer had quality plastic and a
4560matching driver’s license in his pocket, all bearing the
4561name Stephen Leahy. What he didn’t have was a knack for
4562carding. He selected not one, not two, but four Anonimo
4563watches, each worth between $1,000 and $3,000, and
4564asked the store owner to ring each of them up separately
4565on four different Visa cards, which he conspicuously pulled
4566from a deck of a dozen. Two of the hefty transactions were
4567declined, so Janer left with two watches worth a total of
4568$5,777, charged to two Bank of America cards.
4569A patrol car pulled over Janer about two miles away.
4570While the cops looked over Janer’s genuine driver’s
4571license and asked him if he’d been watch shopping
4572recently, a second cruiser drove by with the store owner in
4573the passenger seat. He eyed Janer and confirmed that they
4574had the right guy.
4575The cops arrested Janer and searched his car, pulling
4576out the watches, twenty-eight credit cards, and six
4577California driver’s licenses, each with a different name.
4578When detectives served a search warrant on his house they
4579found more watches and a .22-caliber Walther P22
4580found more watches and a .22-caliber Walther P22
4581handgun.
4582The gun was bad news. Instead of a larceny charge and
4583a probation violation Janer was now facing a federal beef
4584for being a felon in possession of a firearm. Janer wasted
4585no time in offering to lead the feds to the source of the
4586counterfeit cards. In the standard arrangement for snitches,
4587the government agreed to let Janer “proffer” his information
4588under a limited grant of immunity: Nothing he said would be
4589used directly against him. If they found it useful—if it led to
4590arrests—they’d consider recommending a reduced
4591sentence on his gun-possession charge.
4592In two proffer sessions totaling nearly eight hours, Janer
4593spilled his guts to a local Secret Service agent and a
4594federal prosecutor. He told them about Chris Aragon, his
4595ring of cashers, and “Max the Hacker,” a six-foot-five
4596computer genius who’d been cracking banks from San
4597Francisco hotel rooms.
4598He didn’t know Max’s last name, he said, but he’d once
4599written a check to the hacker’s girlfriend for $5,000. Her
4600name was Charity Majors.
4601The Secret Service wrote up the interviews and entered
4602the data into the agency’s computer, but the agency never
4603followed up on the information, and prosecutors declined to
4604grant Janer any special consideration. He was sentenced
4605to twenty-seven months in prison.
4606Max Vision had dodged a bullet. Janer’s statements
4607sank into a giant government computer—they might as well
4608have been stashed in the cavernous warehouse in the final
4609scene of Raiders of the Lost Ark. As long as nobody had
4610occasion to dig them up, Max was safe.
4611Meanwhile, Max began the process of getting Carders
4612Market up and running. He had plenty of experience setting
4613up legitimate websites, but starting a crime site would take
4614special preparations. For one thing, he couldn’t just put the
4615Carders Market server on the floor of his safe house—that
4616would make him a sitting duck.
4617He hacked into a Florida data center run by Affinity
4618Internet and installed a VMware virtual machine on one of
4619its servers—secreting an entire simulated computer on one
4620of its systems. His hidden server grabbed an unused
4621Internet address from Affinity’s pool of addresses. The site
4622would be a ghost ship, not officially owned or operated by
4623anyone.
4624Max played with different Internet forum software and
4625finally settled on the flexible package vBulletin. He spent
4626months customizing the layout and designing his own
4627templates for the look and feel of the site, styling it in
4628shades of gray and muted gold. The work felt satisfying.
4629For the first time in years, he was creating something
4630instead of stealing. It was just like setting up
4631Whitehats.com, except in those ways in which it was the
4632opposite.
4633Finally, on the one-year anniversary of the Operation
4634Firewall raids, he conjured a new name in his everchanging
4635lineup of noms de guerre: Iceman. He chose the
4636handle in part for its commonality: There were lots of
4637Icemen in the underground—there’d even been one on
4638Shadowcrew. If law enforcement tried to track him down,
4639they’d find several mirages on their radar.
4640Max, as Iceman, launched Cardersmarket.com in late
46412005 with little fanfare. Chris joined as the first
4642coadministrator, inventing the handle EasyLivin’ for the site.
4643From their careful observation of Shadowcrew and the
4644splinter forums that followed, Max and Chris knew that the
4645key to gaining acceptance was to appoint big names who
4646could help run the board and attract still more heavy hitters
4647from their circle of friends. The partners soon managed to
4648draw two household names from the Shadowcrew
4649diaspora.
4650Bradley Anderson, a forty-one-year-old Cincinnati
4651bachelor, was their first pick. Anderson was a legend as
4652“ncXVI,” a fake-ID expert and author of the self-published
4653book Shedding Skin, the bible of identity reinvention. Their
4654second recruit was Brett Shannon Johnson, thirty-five, a
4655Charleston, South Carolina, identity thief famous online as
4656“Gollumfun,” a founder of both Counterfeit Library and
4657Shadowcrew who’d retired from the latter site before the
4658Secret Service swept in.
4659After vanishing from the scene for over a year, Johnson
4660was crawling out of retirement—Chris’s sidekick John
4661Giannone had spotted him online that spring and struck up
4662a conversation on ICQ, bringing him up to date on the latest
4663busts and gossip.
4664Giannone wound up selling Johnson twenty-nine of Max’s
4665dumps for an easy six hundred bucks, then introduced him
4666to Max, who sold him another five hundred cards. “I can see
4667that you and I are going to be doing some good business in
4668the future,” Johnson had told Max.
4669Johnson accepted Max’s and Chris’s invitation to
4670become an admin on Carders Market, lending the site the
4671experience and contacts of the only Shadowcrew
4672administrator to survive Operation Firewall.
4673Giannone joined Carders Market as “Zebra,” and Max
4674created a second, secret identity for himself, “Digits.” The
4675alternate handle was a keystone in Max’s new business
4676strategy. Shadowcrew had fallen because prosecutors
4677proved that the founders were themselves buying, selling,
4678and using stolen data—running an informational website
4679wasn’t, in and of itself, illegal, Max reasoned. So Iceman
4680would be the public face of Carders Market but would never
4681buy or sell stolen data. Digits, his alter ego, would handle
4682that, vending the dumps Max was siphoning from the
4683Vancouver pizza joint to anyone who could afford them.
4684To complete his vision for the site, Max needed one
4685more admin with a particular qualification: a command of
4686the Russian language. He wanted to repair the rift that
4687Operation Firewall had torn between Eastern European
4688carders and their Western counterparts. Two Russian
4689Shadowcrew members had fallen into Cumbajohnny’s VPN
4690trap, and the whole affair had left the Russians deeply
4691suspicious of English-speaking forums.
4692Max resolved that Carders Market would distinguish itself
4693by having an Eastern European section moderated by a
4694native Russian speaker. He just needed to find one.
4695Chris offered to help out, and Max accepted. If there was
4696one thing that Chris had proven to his partner, it was that he
4697knew how to recruit new talent.
4698
469920
4700The Starlight Room
4701ine chandeliers hung over the lush velvet booths at
4702Harry Denton’s Starlight Room, the light scattering off a
4703two-hundred-pound mirror ball suspended over the dance
4704floor. Heavy crimson drapes parted from the picture
4705windows like a stage, revealing the glimmering San
4706Francisco skyline beyond.
4707Positioned on the twenty-first floor of the Sir Francis
4708Drake Hotel, the Starlight Room was an opulent fixture in
4709the city’s teeming nightlife—a flashback to 1930s style,
4710strewn with deep red and gold damask and hand-rubbed
4711silk. More garish than hip, the club kept people coming by
4712hosting regular theme nights. This was Russian
4713Wednesday, and tuxedoed servers were pouring vodka
4714shots at the crowded bar while music from the motherland
4715spilled over the crowd.
4716In the ladies’ room, Tsengeltsetseg Tsetsendelger was
4717being kissed. Tipsy from a night out, the young Mongolian
4718immigrant wasn’t sure how it happened, or why, but a pretty
4719five-foot-four girl with tumbling brown hair had decided to
4720kiss her. Then Tsengeltsetseg blinked. There was another,
4721identical woman beside her.
4722Michelle and Liz introduced themselves, and a wide,
4723unaffected pumpkin smile crept onto Tsengeltsetseg’s
4724face. She told the Esquere twins that they could call her
4725“Tea.”
4726Tea was a regular at Russian Night and fluent in both
4727Russian and English. Born in northern Mongolia at a time
4728when the country was still under Soviet influence, she’d
4729learned Russian in school—until the Soviet empire
4730collapsed and Mongolia’s prime minister declared English
4731the landlocked nation’s official second language.
4732Looking for adventure and the proverbial better way of
4733life, she won a student visa and emigrated to the United
4734States in 2001. Her first thought upon landing at Los
4735Angeles International Airport that summer was that
4736Americans were awfully fat, but when she got out into the
4737city she was more impressed; she enjoyed beautiful
4738people, and L.A. was filled with them.
4739After one semester at a community college in Torrance,
4740she moved to the Bay Area and got her green card. Now
4741she was attending classes at Peralta College in Oakland,
4742paying her rent and tuition by dishing ice cream at Fenton’s
4743Creamery.
4744Liz seemed strangely delighted to learn that Tea spoke
4745Russian. The twins bought her a drink and then suggested
4746they continue the party with some friends at their hotel four
4747blocks away. It was after midnight when they got to Chris
4748Aragon’s suite at the luxe Clift Hotel near Union Square.
4749Chris was relaxing there; Tea was struck at once by how
4750handsome he was. He seemed interested in her as well,
4751particularly after the twins mentioned that Tea knew
4752Russian. Joined by two of Chris’s female employees, they
4753opened some booze and hung out until the small hours of
4754the morning, when the girls all left to go to their own rooms
4755and Tea crashed in Chris’s for the night.
4756She was still shaking off sleep the next morning when the
4757room became a hive of activity. Liz and a handful of other
4758attractive young women—all alert and cleanly scrubbed
4759after their night of partying—began popping in and out,
4760receiving envelopes and cryptic instructions from Chris.*
4761They came and went all day, picking up more envelopes,
4762dropping off department store shopping bags, sometimes
4763lingering for a time before departing again. The party
4764atmosphere hung in the air, but there was a nervous,
4765excited edge to it now that made Tea curious—but not so
4766curious as to pry.
4767curious as to pry.
4768When the sun had set and the gang had gathered back
4769at the suite, Tea said her good-byes; she had to go home
4770to the East Bay, to be at work at the ice-cream parlor in the
4771morning.
4772Chris had a better idea. He was starting a website with a
4773business partner—“Sam”—and they happened to be in
4774need of a full-time Russian translator. It would pay better
4775than spooning out Coffee Cookie Dream to yuppies all day.
4776“Don’t go,” said Liz. “You’ll make more money with us.”
4777Tea looked over her pretty new friends. They reminded
4778her of the New Russians who had emerged following the
4779collapse of the Soviet regime, flush with suspiciously
4780acquired wealth, consuming with more hunger than taste.
4781She liked Chris, though—he seemed different. And an
4782Internet translating job would grant her the freedom and
4783flexibility to focus on her college studies. She said yes.
4784The next day, Chris packed up his team for the next leg in
4785their travels, a road trip to Vegas. Tea, he said, should
4786meet them there for more fun. He told her to get a Yahoo! email
4787account, and he’d send her flight information once
4788they’d arrived.
4789Back in her apartment, the whole adventure felt like a
4790strange dream. But the next day, Tea had a confirmation
4791number for her prepaid flight to Las Vegas in her Yahoo! inbox.
4792She packed a bag and headed to the airport.
4793Chris relocated Tea to his own neighborhood and paid for
4794her to rent an apartment in her real name in Dana Point, a
4795coastal town in southern Orange County. At the end of a
4796quiet, winding cul-de-sac, painted an Umbrian orange with
4797Spanish tiles combing the roof, the “Tea House,” as he
4798dubbed it, was a world away from the Mongolian city where
4799Tea grew up.
4800They made love on her new bed, and afterward, Chris left
4801$40 on the nightstand so she could get her nails done.
4802Tea’s feelings were hurt. She wasn’t a hooker. She was
4803falling in love.
4804Chris and his team moved his card-printing gear from
4805Villa Siena into the Dana Point apartment’s attached
4806garage—the Tea House would be his new plant and party
4807house, as well as the base of operations for Tea’s twentyfour-
4808hour-a-day job on Carders Market. Her task would be
4809to haunt the Eastern European carder forums, like
4810Mazafaka and Cardingworld, and summarize what was
4811happening there for the Russian section of Carders Market.
4812She’d need a “nick,” Chris explained, a handle or
4813nickname for her online alter-ego. She decided on
4814“Alenka,” the name of a Russian candy.
4815Alenka went to work at once, glued to the monitor at the
4816Tea House day and night, doing her best to lure the highpowered
4817Russians onto the site run by Chris and “Sam,”
4818the Whiz.
4819* Liz was one of Chris Aragon’s cashers, but there’s no
4820evidence that her sister Michelle was involved.
4821
482221
4823Master Splyntr
4824aking up one floor of a lime-green office building on the
4825bank of the Monongahela River, the National Cyber
4826Forensics and Training Alliance was far removed from the
4827cloistered secrecy of Washington’s intelligence community,
4828where Mularski had cut his teeth. Here, dozens of security
4829experts from banks and technology companies worked
4830alongside students from nearby Carnegie Mellon University
4831in a cluster of neat cubicles, surrounded by a ring of offices
4832that followed the smoked-glass walls around the building.
4833With Aeron chairs and dry-erase boards, the office had the
4834feel of one of the technology companies that provided the
4835NCFTA with the bulk of its funds. The FBI had made a few
4836changes before moving in, transforming one office into an
4837electronic communications room, packed with governmentapproved
4838computer and crypto gear to securely
4839communicate with Washington.
4840In his office, Mularski looked over a “linkchart” Crabb, the
4841postal inspector, had e-mailed him—a massive
4842organization schematic showing the disparate connections
4843among 125 hard targets in the underground. Mularski
4844realized he’d been going about it all wrong by waiting for a
4845crime, then working to track it back to the culprit. The
4846criminals weren’t hiding at all. They were advertising their
4847services on the forums. That made them vulnerable, in the
4848same way the New York and Chicago Mafia’s rituals and
4849strict hierarchy had given the FBI a roadmap to crack down
4850on the mob decades before.
4851All he had to do now was join the carders.
4852He selected a forum from a list provided by Crabb and
4853clicked on the account registration link. Under Justice
4854Department regulations, Mularski could infiltrate the forums
4855without approval from Washington, provided he observed
4856strict limits on his activities. To maintain his cover, he could
4857post messages to the forum bulletin boards, but he couldn’t
4858engage anyone directly; he would be permitted no more
4859than three “substantive contacts” with any other forum
4860member. Participating in crimes, or making controlled buys
4861from a vendor, was out of the question. It could be an
4862intelligence-gathering operation only; he would be a
4863sponge, soaking up information about his adversaries.
4864As soon as he connected, he was confronted with his
4865first important strategic decision: What would his hacker
4866handle be? Mularski went with his gut. Inspired by the
4867Saturday morning cartoon Teenage Mutant Ninja Turtles ,
4868the agent settled on the moniker of the sewer-dwelling
4869karate champs’ rodent sensei, a biped rat called Master
4870Splinter. For uniqueness, and a hackerish timbre, he
4871spelled his surname without major vowels.
4872So in July 2005, Master Splyntr signed up for his first
4873crime forum, CarderPortal, laughing to himself over the
4874poetry in assuming the name of an underground rat.
4875Mularski was soon playing the carder forums like a
4876chessboard, drawing on the NCFTA’s stream of scam data
4877for his opening moves.
4878The center was plugged directly into the antifraud efforts
4879at banks and e-commerce sites, so when a new criminal
4880innovation showed up, Mularski knew about it. He posted
4881about the schemes on CarderPortal, portraying them as his
4882own inventions. The experienced crooks marveled at the
4883newcomer who’d independently reinvented their newest
4884tricks. And when the scams eventually became public in the
4885press, the newbies remembered they’d heard it first from
4886Master Splyntr.
4887In the meantime, the FBI agent was soaking up the
4888history of the forums while honing his prose to affect the
4889cynical, profanity-laced style of the underground.
4890After a few months, Mularski faced the first challenge to
4891his intelligence-gathering operation. The initial crop of
4892forums that grew from the detritus of Shadowcrew had
4893been wide open to new members—spooked by Operation
4894Firewall, many scammers had adopted new handles, and
4895without reputations to trade on there’d been no way for
4896carders to vet one another. Now that was changing. A new
4897breed of “vouched” forums was emerging. The only way to
4898get on them was to win the sponsorship of two existing
4899members. Constrained by the Justice Department’s
4900guidelines, Mularski had deliberately avoided forming
4901direct relationships in the underground. Who would vouch
4902for him?
4903Borrowing a page from a Robert Ludlum novel, Mularski
4904decided Master Splyntr needed a background legend that
4905could propel him into the new crime boards. His thoughts
4906turned to a Europe-based antispam organization called
4907Spamhaus that he’d worked with as part of previous FBI
4908initiatives.
4909Founded in 1998 by a former musician, Spamhaus
4910charts the ever-changing lineup of Internet addresses
4911spewing garbage into consumers’ in-boxes; its database of
4912spam sources is used by two-thirds of the world’s ISPs as
4913a blacklist. Of more interest to Mularski was the
4914organization’s public most-wanted list of notorious
4915spammers. Peopled by the likes of Alan “Spam King”
4916Ralsky and the Russian Leo “BadCow” Kuvayev, the
4917Registry of Known Spam Operations, or ROKSO, is
4918second only to a federal grand jury indictment on the list of
4919places an Internet scammer doesn’t want to see his name.
4920Mularski phoned up founder Steve Linford in Monaco to
4921explain his scheme: He wanted to be on ROKSO—or, at
4922least, he wanted Master Splyntr there. Linford agreed, and
4923Mularski went to work crafting his background story. The
4924best lies hew to the truth, so Mularski decided to make
4925Splyntr a Polish spammer. Mularski was descended on his
4926father’s side from Polish immigrants—his bureau-issue
4927button-down concealed a tattoo on his left arm of the Orzel
4928Bialy, the white eagle with golden beak and talons that
4929adorns Poland’s coat of arms. Mularski would locate
4930Master Splyntr in Warsaw; he’d visited Poland’s capital and
4931could roughly describe its landmarks if pressed.
4932In August, the ROKSO listing went live, for the first time
4933stapling a “real” name to Mularski’s cartoon-inspired alter
4934ego.
4935Pavel Kaminski aka “Master Splyntr” runs a loosely
4936organized spam and scam crew from Eastern Europe.
4937Possibly a BadCow affiliate. He is linked to: proxy
4938spam; phishing; pump’n’dump; javascript exploits;
4939carder forums; botnets.
4940The profile included samples of scammy spam
4941messages supposedly sent out by “Pavel Kaminski,”
4942handcrafted by Spamhaus, and an analysis of his hosting
4943arrangements.
4944Now the carders who Googled Master Splyntr could see
4945for themselves that he was the real deal, a bona fide
4946Eastern European cybercrook with sticky fingers in a lot of
4947pies. When Mularski logged on to CarderPortal, he found
4948business proposals waiting in his in-box from crooks
4949hoping to partner with him. Still not allowed to engage any
4950suspects, he blew them off sneeringly.
4951You’re not much of a player, he’d write back. I don’t want
4952to deal with you because I’m a professional and you’re
4953obviously a newbie at this. To rebuff upper-echelon
4954scammers, he challenged their pocketbooks: You don’t
4955have enough money to invest in what I’m doing.
4956Like an unattainable girl on prom night, Master Splytnr’s
4957aloofness only made him more attractive. When a new site
4958called the International Association for the Advancement of
4959Criminal Activity launched as a closed forum, he posted a
4960simple note—Hey, I need a vouch—and two existing
4961members spoke up for him solely on the strength of his
4962reputation.
4963He was vouched on Theft Services next, then
4964CardersArmy. In November 2005, he was one of the first
4965members invited to a brand-new forum called
4966Darkmarket.ws.
4967A few months later, another, competing site got big
4968enough to cross his radar, and Master Splyntr joined
4969Cardersmarket.com.
4970
497122
4972Enemies
4973onathan Giannone was learning that loss of privacy
4974was the cost of doing business with Iceman.
4975He’d been working with the mystery hacker for over a
4976year—mostly acquiring servers that Iceman used in his
4977vulnerability scanning—and he was still constantly under
4978Iceman’s electronic scrutiny. One day, the hacker sent
4979Giannone a link purporting to be a CNN article about
4980computer problems at JetBlue, the airline that had rebuffed
4981Giannone’s long-ago extortion attempt. Giannone clicked
4982on the link without thinking, and, just like that, Iceman was
4983on his computer again. Client-side attacks for the win.
4984Giannone began routinely checking his computer for
4985malware but couldn’t keep up with Iceman’s intrusions. Max
4986got ahold of Giannone’s United Airlines Mileage Plus
4987password and began tracking his movements around the
4988world—Giannone was a serious air travel aficionado who’d
4989sometimes fly just to accumulate miles. When he’d land at
4990San Francisco International, he’d find a text message from
4991Iceman waiting for him on his cell. “Why are you in San
4992Francisco?”
4993It might have been amusing if it weren’t for Iceman’s
4994frightening mood swings. He could turn on you in a minute
4995—one day you’d be his best friend, his “number one guy”;
4996the next he’d be convinced you were a snitch, a ripper, or
4997worse. He wrote Giannone long, unprompted e-mail
4998diatribes, laundry lists of grievances against Chris or
4999various members of the carding community.
5000It was jealousy, Giannone figured. While he and Chris
5001were partying in Vegas and the OC, Iceman was locked in
5002his apartment, working like a dog. Indeed, the hacker’s
5003outbursts often coincided with one of Giannone’s California
5004sojourns. In June 2005, Iceman picked a fight as Giannone
5005boarded an early morning flight to Orange County—Iceman
5006was taking him to task for some oversight in one of their
5007joint operations. The first message hit Giannone’s
5008BlackBerry at six a.m.—three in the morning San Francisco
5009time—and the texts continued nonstop for 2,500 miles
5010before Iceman finally fell silent as the plane landed. When
5011Giannone checked his e-mail later, he found dozens of
5012apologetic letters from the hacker. “Sorry, I apologize. I was
5013bugging out.”
5014On an earlier occasion, in September 2004, Giannone
5015told Iceman he was about to fly out to visit Chris, and Max
5016remarked cryptically that he could prevent the trip if he
5017wanted to. Giannone laughed. But an hour and a half into
5018his flight, the plane suddenly turned around and headed for
5019Chicago. As the airliner set down at O’Hare, the captain
5020explained that the Los Angeles air traffic control center had
5021gone dark, necessitating the change in itinerary.
5022It turned out a computer error was responsible. There
5023was a known bug in the Windows-based radio control
5024system at the Los Angeles Air Route Traffic Control Center
5025in Palmdale, which required technicians to reboot the
5026machine every 49.7 days. They’d missed a reboot, and a
5027backup system had failed at the same time. The outage
5028resulted in hundreds of flights being grounded and five
5029incidents of airplanes drifting closer to each other than
5030safety regulations permit. No foul play was discovered, but
5031years later, when the full range of Max Vision’s powers
5032became clear, Giannone would find himself wondering if
5033Iceman hadn’t cracked the FAA’s computers and crippled
5034Los Angeles, just to stop him from going clubbing with
5035Chris.
5036Giannone finally took radical measures to try to keep
5037Iceman out of his stuff: He bought an Apple. Iceman could
5038penetrate just about anything. But Giannone was pretty sure
5039penetrate just about anything. But Giannone was pretty sure
5040he couldn’t hack Macs.
5041While Max kept up surveillance of his crime partners,
5042Carders Market began slowly generating buzz, intensified
5043by the mysterious swagger of its founders. As Iceman and
5044Easylivin’, Max and Chris were unknown quantities among
5045their fellow crooks, but experienced carders could
5046practically smell the confidence and street smarts in their
5047posts.
5048In Seattle, word of the new site reached Dave “El
5049Mariachi” Thomas, the former FBI asset who, like Max, had
5050tried to blow the whistle on Operation Firewall. Thomas had
5051been feeling adrift since the feds pulled the plug on his
5052intelligence-gathering operation, and he was looking for a
5053new online home.
5054Wary at first, Thomas registered under a fake handle. But
5055when Iceman invited a public discussion of Carders
5056Market’s philosophy and charter, Thomas dove in, opining
5057in detail on the course the site should follow to nurture
5058successful ops while avoiding Shadowcrew’s fate.
5059At first, Chris and Max thought Thomas might be a
5060valuable contributor. But they soon detected that he had a
5061beef with one of their handpicked admins, Brett “Gollumfun”
5062Johnson.
5063Rumors had been swirling about Johnson since his return
5064to the scene—you don’t just disappear for two years and
5065then come back onto the carder forums as though nothing
5066has happened. In August, a hacker called “Manus Dei”—
5067the Hand of God—added fuel to the fire when he cracked
5068Johnson’s e-mail account and posted a blistering profile of
5069the carder on a Google Group called FEDwatch. The writeup
5070gave Johnson’s real name, his current address in Ohio,
5071and a slew of personal details stolen from his in-box.
5072Among the revelations: Johnson had been corresponding
5073with a New York Times reporter about the carding scene
5074and had registered a mysterious domain name,
5075Anglerphish.com—perhaps in preparation for starting his
5076own site.
5077There was nothing to suggest that Johnson was
5078snitching, though, and neither Max nor Chris had been
5079particularly alarmed by the info dump. Thomas, on the other
5080hand, was now convinced the Shadowcrew founder was an
5081informant. After all, Johnson had announced his retirement
5082before Operation Firewall and then reappeared afterward
5083with no real explanation.
5084The last thing Chris and Max needed on their emerging
5085site was a shootout between two old-school carders with a
5086Shadowcrew-era grudge. Still possessed by an
5087entrepreneurial pride, Chris wanted the site to be the best
5088crime forum possible. So he reached out to Thomas by ICQ
5089to try to head off trouble.
5090“I’m not going to entertain any drama about Gollumfun, or
5091others, who is a rat who isn’t a rat,” Chris wrote. “I just want
5092a clean nice board so we can have a safe place to play.”
5093Chris promised he’d give Johnson the same message:
5094Play nice. It was Conflict Resolution 101. He followed the
5095paternalistic lecture by asking Thomas’s advice on running
5096a successful forum—showing the elder carder respect for
5097his years of experience. But to make sure his admonition
5098was taken seriously, Chris added a warning. “We are not
5099kids dude,” he wrote. “We are very old school. And we are
5100very good at what we do.”
5101Thomas promised to behave, adding that he’d do his
5102best to help make Carders Market the drama-free forum
5103everyone wanted. But secretly, a hard pit of suspicion was
5104forming in his gut. Why would anybody defend Brett
5105Johnson, who was so obviously a snitch?
5106He noticed that Easylivin’ was using an old version of
5107ICQ that leaked an Internet IP address. Thomas tried to
5108trace the address and wound up in Boston, a known hotbed
5109of federal informants. Carders Market’s hosting was based
5110in Ft. Lauderdale, Florida, another perfect place to run an
5111undercover operation. And the phone number on the
5112domain name listing went to a police department in
5113California, albeit in a different area code. That was
5114probably a coincidence, but who knows?
5115When he was done adding up the evidence, he felt sick
5116to his stomach. Carders Market was a federal sting. It was
5117obvious now. He vowed to himself that he’d do everything
5118he could to destroy the new site and bring down the oldschool
5119assholes Easylivin’ and Iceman.
5120
512123
5122Anglerphish
5123ax was developing suspicions of his own about Brett
5124Johnson. He began keeping a close eye on the admin on
5125Carders Market, checking his access logs and scouring his
5126private messages. For good measure, he hacked into
5127Johnson’s account on the International Association for the
5128Advancement of Criminal Activity, IAACA, and reviewed his
5129activity there. He found no smoking gun.
5130Could he really have brought an informant into the inner
5131circle of his new crime site?
5132The problem was that there was no reliable test to
5133determine if Johnson, or anyone else, was working for the
5134government. Max wanted one badly—a jurisprudence
5135security hole, like the buffer overflow in BIND, that he could
5136use over and over again on anyone he suspected. If
5137(is_snitch(Gollumfun)) ban(Gollumfun);. He confided in David
5138Thomas, not realizing that Thomas had already put Iceman
5139on his mile-long enemies list.
5140At one point in checking him out, he sent us some
5141PayPal fulls that were valid, which I pegged as illegal. It
5142made me think, okay, this guy isn’t a fed or fed lackey.
5143This is very important for me to find out, because it
5144is how I have been making trust decisions. We have it
5145in mind to have a lawyer give us the definitive answer,
5146my partner said he was on that and would find out. I am
5147skeptical that we’ll ever get a straight answer though,
5148because lawyers seem to enjoy taking your money and
5149providing you heuristic guesses rather than concrete
5150facts. Maybe I’ve just had bad lawyers.
5151I would really like to know a specific way that I can
5152find something a cop or CI can’t do. Something that if
5153they do it, their cases are all thrown out 100%. What a
5154holy grail. So far I have been living as though “doing a
5155criminal act” disqualifies them. Like people who
5156smoke a joint with someone to make sure that person
5157isn’t a cop. Or a hooker who asks her john, “Are you a
5158cop? You know you have to tell me if you are.”
5159Brett Johnson was indeed dirty. But contrary to
5160suspicions, his return to crime in the post-Firewall era
5161hadn’t started as a snitching expedition. It had all begun
5162with a girl.
5163Johnson’s crime and cocaine habits had driven away his
5164wife of nine years—she threw out his MSR206 on her way
5165out the door—and he’d been seeing a psychologist to cope
5166with the loss. Then he met Elizabeth in a North Carolina
5167bar. She was a twenty-four-year-old exotic dancer at a local
5168strip club, and for Johnson it was love at first sight. He
5169burned through his savings to buy her gifts, a $1,500 purse
5170here, a $600 pair of shoes there, and she moved in with
5171him after five months. But when they had sex for the first
5172time, she wouldn’t let him kiss her.
5173Johnson’s darkest suspicions were confirmed when he
5174located Elizabeth on a website on which men post reviews
5175of strippers and prostitutes. There it was, line after line of
5176disgusting detail about the services his girlfriend had been
5177providing in exchange for cocaine and cash. He confronted
5178her with the evidence, and she tearfully promised to quit the
5179drugs and the prostitution.
5180Hoping to wrench her from the patterns of her old life,
5181Johnson showered Elizabeth with more gifts and expensive
5182dinners out. It was that, and not any hidden agenda, that
5183impelled his return from retirement. He needed the money,
5184plain and simple.
5185The luck that had seen him through Operation Firewall
5186failed him on February 8, 2005, when Charleston, North
5187Carolina, police busted him for using counterfeit Bank of
5188America cashier’s checks to pay for Krugerrands and
5189watches he won on eBay and had shipped COD to his
5190drops. After a week of stewing in the Charleston County
5191Detention Center, pining for Elizabeth, the Secret Service
5192paid him a visit. Once he convinced them he was Gollumfun
5193—the admin who got away when they dropped the hammer
5194on Shadowcrew—they agreed to help him with his state
5195case if he’d work for them.
5196The Secret Service had Johnson’s bail lowered to
5197$10,000. When he bonded out, the agents moved him from
5198Charleston to Columbia, South Carolina, where they rented
5199him a corporate apartment and paid him a $50 per diem.
5200Now he was a daily visitor to the Columbia field office,
5201checking in at four p.m. and working until nine, taking the
5202Secret Service deep into Carders Market and the other
5203boards. Everything that crossed his computer was
5204recorded and displayed simultaneously on a forty-two-inch
5205plasma screen hanging on the wall of the office.
5206They called it Operation Anglerphish, and Johnson
5207thought it would make a great book one day. That’s why
5208he’d registered the domain name Anglerphish.com and
5209opened up talks with a New York Times reporter. When
5210Manus Dei cracked his e-mail and revealed those activities
5211online, Johnson’s Secret Service handlers were irate. They
5212promptly banned him from using computers away from the
5213office and told him to cut off contact with the reporter.
5214Elizabeth left him—her name and occupation had been
5215exposed in the breach.
5216Then Iceman stripped Johnson of his privileged position
5217in Carders Market, and crooks he’d known since the
5218Counterfeit Library days started refusing to do business
5219with him. Johnson was running out of credibility, and the
5220Secret Service was running out of patience.
5221In late March 2006, the agents decided to act on one of
5222Anglerphish’s only catches, a California identity thief who’d
5223stolen at least $200,000 by e-filing bogus tax returns
5224through H&R Block, then collecting the refunds himself.
5225Johnson, an expert in that particular scam, had been talking
5226with the crook online, and the Secret Service had traced
5227the chats to the C&C Internet Café in Hollywood. A Los
5228Angeles agent visited the coffee shop and sat two tables
5229away while the man filed his fake returns.
5230But when local police and Secret Service agents raided
5231the target’s Hollywood apartment, they found it had been
5232cleaned out: no computers and not a shred of documentary
5233evidence. The suspect had done everything but deep-clean
5234the carpet and paint the walls.
5235Johnson’s handlers in Columbia already suspected their
5236asset of leaking his informant status after the drama on
5237Carders Market. Now they had reason to believe he’d
5238tipped off the target of an impending raid. They brought in a
5239polygraph examiner and strapped Johnson to the box.
5240The needles were steady as Johnson answered the first
5241two questions: Did he contact the target? Did he have
5242anyone else contact the target? No and no. The final
5243question was broader: Did Johnson have any unauthorized
5244contact with anyone? “No,” he said again, his galvanic skin
5245response skittering up the chart.
5246Despite the agents’ admonishments, Johnson had
5247secretly continued his talks with the New York Times
5248reporter, he admitted, and he was very serious about
5249getting a book deal. The feds interrogated him until two in
5250the morning, then had him sign a form consenting to a
5251search of his agency-funded apartment.
5252Tossing the apartment was like an Easter egg hunt. The
5253agents found a stored value card in a shoe in the bedroom
5254closet. A memo book containing account numbers, PINs,
5255and identity information was in a toiletry kit in the bathroom.
5256A sock stuffed in a pair of men’s pants in the closet
5257contained sixty-three ATM cards. A Rubbermaid bowl at
5258the bottom of the laundry bin was keeping fresh nearly two
5259thousand dollars in cash. Finally, there were loaded Kinko’s
5260payment cards; Johnson had been buying computer time at
5261the local copy shop.
5262He’d been leading a triple life almost from the start of his
5263service to the agency, posing as a crook at the Columbia
5264field office and pulling his own very real capers in his off
5265hours.
5266Johnson’s specialty was the same scam the Los
5267Angeles target had been carrying out. He’d mine victims’
5268Social Security numbers from online databases, including
5269California’s Death Index of recently departed Golden State
5270residents, then file bogus tax returns on their behalf,
5271directing the refunds into prepaid debit cards that could be
5272used for ATM withdrawals. He’d pulled in more than
5273$130,000 in tax refunds under forty-one names, all under
5274the nose of the Secret Service.
5275The agents phoned up Johnson’s bail bondsman and
5276persuaded him to revoke the $10,000 bond that had set the
5277fraudster free. Then they put Johnson back in the county jail.
5278After three days, Johnson’s handler showed up with a
5279senior agent, who was not happy with the informant.
5280“Before we begin, Brett, I just want to say that you are either
5281going to tell us everything that you have done the past six
5282years, or I’m going to make it my mission in life to fuck over
5283you and your family,” the supervisor growled. “And I’m not
5284just talking about these current charges. Once you get out, I
5285will hound you for the rest of your life.”
5286Johnson refused to cooperate, and the agents stormed
5287out. The U.S. Attorney’s Office started working on a federal
5288indictment. But the swindler had one more trick up his
5289sleeve. Two weeks later he managed to get his bond
5290reinstated, bailed from the detention center, and promptly
5291vanished.
5292Anglerphish was a debacle. After 1,500 hours of work,
5293the government was left with a fugitive informant and tens of
5294thousands of dollars in new fraud. There was only one silver
5295thousands of dollars in new fraud. There was only one silver
5296lining: that first batch of twenty-nine platinum dumps
5297Johnson had bought in May for $600.
5298The Secret Service had tracked some of the cards to a
5299pizza parlor in Vancouver—a dead end. But the corporate
5300Bank of America account the seller used to accept his
5301payment belonged to one John Giannone, a twenty-oneyear-
5302old living in Rockville Centre on Long Island.
5303
530424
5305Exposure
5306ea, these girls are white trash. Don’t be friends
5307with them,” said Chris. “Their minds are different.”
5308They were at Naan and Curry, a twenty-four-hour Indian
5309and Pakistani restaurant in San Francisco’s theater district.
5310It had been three months since Tea hooked up with Chris,
5311and she was with him for one of his monthly trips to the Bay
5312Area, where’d he’d meet his mysterious hacker friend
5313“Sam” just before dawn. They were only four blocks from
5314Max’s safe house now, but Tea wouldn’t be introduced to
5315the hacker on this trip or any other. Nobody met Sam in
5316person.
5317She was fascinated by how it all worked: the cashless
5318nature of the crime, the way Chris organized his crew. He’d
5319told her everything, once he thought she was ready, but
5320never asked her to hit the stores with the others. She was
5321special. He didn’t even like her hanging out with his cashing
5322crew, for fear that they’d somehow taint her personality.
5323Tea was also the only employee not being paid. After
5324she’d protested the $40 Chris left on the nightstand, Chris
5325concluded that Tea didn’t want any money from him at all,
5326despite the long hours she was spending on Carders
5327Market and the Russian crime boards. Chris was taking
5328care of the rent on the Tea House, buying her clothes, and
5329paying for her travel—but she found it a strange existence,
5330living online, traveling on confirmation numbers instead of
5331plane tickets. She’d become a ghost, her body in Orange
5332County, her mind more often projecting into Ukraine and
5333Russia, befriending organized cybercrime chieftains in her
5334role as Iceman’s emissary from the carding world of the
5335West.
5336Iceman, she’d decided, was pretty cool. He was always
5337respectful and friendly. When Chris and his partner got into
5338one of their fights, each man would whine and gossip about
5339the other to Tea over ICQ, like children. At one point,
5340Iceman sent her a bunch of dumps and suggested she go
5341into business for herself, a move that sent Chris into a
5342petulant rage.
5343As Chris and Tea chatted over Indian food, a tall man
5344with a ponytail walked in from the street and headed for the
5345cash register in back, his eyes flickering over them, just for
5346a moment, before he picked up a bag of takeout and left.
5347Chris smiled. “That was Sam.”
5348Back in Orange County, Chris’s counterfeiting operation
5349was earning enough for him to send his kids to private
5350schools, cover Tea’s apartment, and, in July, start
5351searching for a bigger and better home for himself and his
5352family. He went house-hunting with Giannone and found a
5353spacious rental—a two-story house in the coastal town of
5354Capistrano Beach at the end of a quiet cul-de-sac on a bluff
5355rising above the sandy beach. It was a family-friendly
5356neighborhood, basketball hoops hanging above garages
5357and a boat parked in a neighbor’s driveway. His move-in
5358date was July 15.
5359Giannone flew back out for the July 4 weekend—Chris’s
5360last holiday at his old condo—but wound up back at the Tea
5361House while Chris spent time with his family. It happened all
5362the time; Giannone would fly into John Wayne Airport,
5363expecting a weekend of clubbing with Chris, and instead
5364would end up holed up with one of the crew or be tasked
5365with babysitting Chris’s boys at his house. Tea was
5366tolerable, different from the cheap party girls cashing out
5367Chris’s cards, but time at the Dana Point apartment
5368dragged.
5369He phoned Chris and complained that he was bored.
5370“Come to the house,” Chris said. They were at the pool.
5371“The wife’s here with the kids.”
5372Giannone invited Tea, who’d never seen Chris’s condo
5373complex just four miles away. When they arrived, Chris,
5374Clara, and the two boys were splashing around in the pool,
5375enjoying the sun. Giannone and Tea said hello and made
5376themselves at home on some deck chairs.
5377Chris looked stunned. “I see you brought your friend,” he
5378said to Giannone testily.
5379Clara knew Giannone, the babysitter, but had never met
5380Tea. She looked at the stranger, then at Giannone, then
5381back at the Mongolian, awareness and anger creeping
5382over her face.
5383Giannone realized he’d made a blunder. The two women
5384looked uncannily alike. Tea was a younger version of
5385Chris’s wife, and at a glance, Clara knew her husband was
5386sleeping with this woman.
5387Chris pulled himself out of the pool and walked around to
5388where they were sitting, his face neutral. He squatted down
5389in front of Giannone, his hair dripping water onto the
5390concrete. “What are you doing?” he said in a low voice.
5391“Get out of here.”
5392They left. And for the first time since she joined up with
5393Chris Aragon and his gang, Tea felt dirty.
5394Chris wasn’t angry—he got a guilty, alpha-male pleasure
5395out of seeing Tea and Clara in the same place. But Tea’s
5396crush was becoming a problem. He had genuine affection
5397for her and her quirky ways, but she was becoming an
5398unwanted complication.
5399There was an ideal solution at his disposal. He bought
5400her a plane ticket to visit her home country for an extended
5401vacation, literally banishing his overardent paramour to
5402Outer Mongolia.
5403With Chris distracted by his tangled love life, Carders
5404Market was consuming more of Max’s time, and he still had
5405his business as “Digits” to run. He was working in the food
5406service industry now, and it was paying off big.
5407It had started in June 2006, when a serious security hole
5408emerged in the software RealVNC, for “virtual network
5409console”—a remote-control program used to administer
5410Windows machines over the Internet.
5411The bug was in the brief handshake sequence that opens
5412every new session between a VNC client and the RealVNC
5413server. A crucial part of the handshake comes when the
5414server and client negotiate the type of security to apply to
5415the session. It’s a two-step process: First, the RealVNC
5416server sends the client a shorthand list of the security
5417protocols the server is configured to support. The list is just
5418an array of numbers: [2,5], for example, means the server
5419supports VNC’s type 2 security, a relatively simple
5420password authentication scheme, and type 5, a fully
5421encrypted connection.
5422In the second step, the client tells the server which of the
5423offered security protocols it wants to use by sending back
5424its corresponding number, like ordering Chinese food off a
5425menu.
5426The problem was, RealVNC didn’t check the response
5427from the client to see if it was on the menu in the first place.
5428The client could send back any security type, even one the
5429server hadn’t offered, and the server unquestioningly
5430accepted it. That included type 1, which is almost never
5431offered, because type 1 is no security at all—it allows you
5432to log in to RealVNC with no password.
5433It was a simple matter to modify a VNC client to always
5434send back type 1, turning it into a skeleton key. An intruder
5435like Max could point his hacked software at any box running
5436the buggy RealVNC software and instantly enjoy unfettered
5437access to the machine.
5438Max started scanning for vulnerable RealVNC
5439installations as soon as he learned of this gaping hole. He
5440watched, stunned, as the results scrolled down his screen,
5441thousands of them: computers at homes and college
5442thousands of them: computers at homes and college
5443dorms; machines in Western Union offices, banks, and
5444hotel lobbies. He logged in to some at random; in one, he
5445found himself looking at the feeds from closed-circuit video
5446surveillance cameras in an office-building lobby. Another
5447was a computer at a Midwest police department, where he
5448could listen in on 911 calls. A third put him in a home
5449owner’s climate control system; he raised the temperature
5450ten degrees and moved on.
5451A tiny fraction of the systems were more interesting and
5452also familiar from his ongoing intrusion into the Pizza
5453Schmizza: They were restaurant point-of-sale systems.
5454They were money.
5455Unlike the simple dumb terminals sitting on the counters
5456of liquor stores and neighborhood grocers, restaurant
5457systems had become sophisticated all-in-one solutions that
5458handled everything from order taking to seating
5459arrangements, and they were all based on Microsoft
5460Windows. To support the machines remotely, service
5461vendors were installing them with commercial back doors,
5462including VNC. With his VNC skeleton key, Max could open
5463many of them at will.
5464So Max, who’d once scanned the entire U.S. military for
5465vulnerable servers, now had his computers trolling the
5466Internet day and night, finding and cracking pizza joints,
5467Italian ristorantes, French bistros, and American-style grills;
5468he harvested magstripe data everywhere he found it.
5469Under Visa-issued security standards, that shouldn’t
5470have been possible. In 2004 the company outlawed the use
5471of any point-of-sale system that stores magstripe data after
5472a transaction is complete. In an effort to comply with the
5473standards, all the major vendors produced patches that
5474would stop their systems from retaining the swipes. But
5475restaurants weren’t racing to install the upgrade, which in
5476some cases was a paid extra.
5477Max’s scanning machinery had several moving parts.
5478The first was aimed at finding VNC installations by
5479performing a high-speed “port sweep”—a standard
5480reconnaissance technique that relies on the Internet’s
5481openness and standardization.
5482From the start, the network’s protocols were designed to
5483let computers juggle a variety of different types of
5484connections simultaneously—today that can include e-mail,
5485Web traffic, file transfers, and hundreds of other more
5486esoteric services. To keep it all separate, a computer
5487initiates new connections with two pieces of information:
5488the IP address of the destination machine, and a virtual
5489“port” on that machine—a number from 0 to 65,535—that
5490identifies the type of service the connection is seeking. The
5491IP address is like a phone number, and a port is akin to a
5492telephone extension you read off to the switchboard
5493operator so he can send your call to the right desk.
5494Port numbers are standardized and published online. Email
5495software knows to connect to port 25 to send a
5496message; Web browsers connect to port 80 to retrieve a
5497website. If a connection on the specified port is refused, it’s
5498like an unanswered extension; the service you’re looking for
5499isn’t available at that IP address.
5500Max was interested in port 5900—the standard port for a
5501VNC server. He set his machines sweeping through broad
5502swaths of Internet address space, sending to each a single
5503sixty-four-byte synchronization packet that would test
5504whether port 5900 was open for service.
5505The addresses that answered his sweep streamed into a
5506PERL script Max wrote that connected to each machine
5507and tried to log in through the RealVNC bug. If the exploit
5508didn’t work, the script would try some common passwords:
5509“1234,” “vnc,” or an empty string.
5510If it got in, the program grabbed some preliminary
5511information about the computer: the name of the machine
5512and the resolution and color depth of the monitor. Max
5513snubbed computers with low-quality displays, on the
5514assumption that they were home PCs and not businesses.
5515It was a high-speed operation: Max was running on five or
5516It was a high-speed operation: Max was running on five or
5517six servers at once, each capable of zipping through a
5518Class B network, over sixty-five thousand addresses, in a
5519couple of seconds. His list of vulnerable VNC installations
5520grew by about ten thousand every day.
5521The point-of-sale systems were needles in a massive
5522haystack. He could spot some just from the name: “Aloha”
5523meant the machine was likely an Aloha POS made by
5524Atlanta-based Radiant Systems, his favorite target.
5525“Maitre’D” was a competing product from Posera Software
5526in Seattle. The rest of them took some guesswork. Any
5527machine with a name like “Server,” “Admin,” or “Manager”
5528needed a second look.
5529Slipping in over his VNC client, Max could see what was
5530on the computer’s screen as though standing right in front
5531of it. Since he worked at night, the display on the dormant
5532PC was usually dark, so he’d nudge his mouse to clear the
5533screen saver. If there was anyone in the room, it might have
5534been a little spooky: Remember that time your computer
5535monitor flipped on for no reason, and the cursor twitched? It
5536might have been Max Vision taking a quick look at your
5537screen.
5538That manual examination was the slow part. Max
5539recruited Tea to help out—he gave her a VNC client and
5540started feeding her lists of vulnerable machines, along with
5541instructions on what to look for. Soon, Max was wired into
5542eateries throughout America. A Burger King in Texas. A
5543sports bar in Montana. A trendy nightclub in Florida. A
5544California grill. He moved up to Canada and found still
5545more.
5546Max had gotten his start vending by stealing the dumps
5547from a single restaurant. Now he had as many as a hundred
5548feeding him credit card data in nearly real time. Digits
5549would be doing a lot more business.
5550With so much work to be done, Dave “El Mariachi” Thomas
5551had chosen a bad time to become a real pain in Iceman’s
5552ass. In June, Thomas did something nearly unheard of in
5553the insular computer underground: He took their dispute off
5554the forums and into public, civilian cyberspace, attacking
5555Carders Market in the comments section of a widely read
5556computer security blog, where he accused Iceman of being
5557“LE”—law enforcement.
5558“Here is a site hosted in Ft Lauderdale Florida,” Thomas
5559wrote. “Matter of fact, it’s hosted right out of a guy’s house.
5560Yet, LE refuses to shutter them. Instead, this site promotes
5561vending of PINs and numbers and PayPals and eBays and
5562so forth, all the while LE looks on at all the players.
5563“LE claims they can’t do anything to a site hosted on U.S.
5564soil. Yet, truth be told, it’s LE running the site just like they
5565ran Shadowcrew.”
5566By highlighting Carders Market’s hosting arrangements,
5567Thomas was targeting Iceman’s Achilles’ heel. The site had
5568been purring along unmolested because Affinity didn’t
5569notice the illicit server among its tens of thousands of
5570legitimate hosted sites. El was working to change that,
5571lodging complaints with the company over and over again.
5572The tactic was lacking in logic: If Carders Market really was
5573under government control, the complaints would fall on deaf
5574ears; only if it was a real crime site would Affinity kick it off.
5575If Iceman drowns, then he’s not a witch.
5576A week after Thomas’s post, Affinity abruptly cut off
5577Carders Market. The shutdown angered Max; he’d had a
5578good thing going at ValueWeb. He searched overseas for
5579new, legitimate hosting that would stand up to El Mariachi,
5580approaching companies in China, Russia, India, and
5581Singapore. It always turned out the same way—they’d
5582demand some upfront money as the price of admission
5583and then roll a spool of red tape in front of the door, asking
5584for a passport and a business license or corporate papers.
5585“Couldn’t be because you have some STUPID FUCKING
5586NAME called CARDERS this or CARDERS MARKET that,
5587now could it?” Thomas wrote, taunting Iceman. “Maybe if
5588you didn’t scream ‘CARDERS WORK HERE,’ you could
5589you didn’t scream ‘CARDERS WORK HERE,’ you could
5590get a small site going, and possibly grow to be the beast
5591you so desperately need to be.”
5592It was personal now: Thomas hated Iceman, whether he
5593was a fed or not, and the feeling had become mutual.
5594Max finally set up at Staminus, a California firm
5595specializing in high-bandwidth hosting resistant to DDoS
5596attacks. By then, Thomas was tearing into him in the
5597comments section of a random blog called “Life on the
5598Road.” The blogger had quoted Thomas’s comments about
5599Carders Market in a brief entry about the forums, unwittingly
5600volunteering his blog as the new battlefield in the El
5601Mariachi-versus-Iceman war.
5602Iceman picked up the gauntlet and posted a lengthy
5603public rebuttal to Thomas’s indictment, accusing his foe of
5604“hypocrisy and slander.”
5605CM is NOT a “crime board” or an “empire” or any
5606of this bullshit accusation. We are simply a forum that
5607chooses to allow discussion of financial crime. We
5608also lend authority in judging which members are real
5609and which are the fakes, but those are just our
5610opinions, we make no money from this service. We
5611are just a CARRIER for the information, a FORUM
5612through which this communication can occur without
5613oppression. CM is not involved in any crime
5614whatsoever. It is not illegal to operate a forum and
5615allow discussion.
5616Craigslist.com has people posting about
5617prostitution, drug hookups, and other obvious crime,
5618yet people don’t call craigslist a “hookers and blow
5619one stop shop” or a crime empire. It is recognized as a
5620CARRIER which is not responsible for the content of
5621posts therein. This is the state of Carders Market.
5622The spirited defense completely ignored the detailed
5623crime tutorials and review system on Carders Market, not
5624to mention the secret impetus for the site: to give Max a
5625place to sell stolen data.
5626Knowing his California hosting wouldn’t satisfy the
5627underground, Max resumed his search for an arrangement
5628overseas. The next month, he hacked himself a new server,
5629this time in a country as far from U.S. influence as any on
5630the Net—a nation unlikely to respond to complaints from
5631Dave Thomas or even the American government.
5632“Carders Market is now hosted in IRAN,” he announced
5633on August 11. “Registration is reopened.”
5634
563525
5636Hostile Takeover
5637apidity is the essence of war. Take advantage of
5638the enemy’s unreadiness, make your way by unexpected
5639routes, and attack unguarded spots.”
5640Max had been reading Sun Tzu’s The Art of War, using
5641the 2,600-year-old tome as his hacking manual. He
5642sketched out his plans on a pair of whiteboards in his safe
5643house; after some attrition and new entrants, there were
5644five English-language carding sites that mattered in the
5645underground, and that was four too many. He’d spent
5646weeks infiltrating his competitors: ScandinavianCarding,
5647the Vouched, TalkCash, and his chief rival, DarkMarket, the
5648UK-run site that emerged a month before Carders Market
5649and was building a powerful reputation as a ripper-free
5650zone.
5651In a way, Max’s plan to muscle in on the other forums was
5652coming from the white-hat side of his personality. The
5653status quo was working fine for Max the criminal—he
5654wasn’t greedy, and he was doing brisk business on
5655Carders Market. But the post-Shadowcrew carding scene
5656was broken, and when Max the white hat saw something
5657broken, he couldn’t resist fixing it—just as he’d done for the
5658Pentagon a few years earlier.
5659Ego played a role too. The whole carding world seemed
5660to think Iceman was just another forum administrator,
5661bankrupt of any skill except the ability to set up forum
5662software. Max saw a golden opportunity to show the
5663carders how wrong they were.
5664DarkMarket turned out to be an unguarded spot. A
5665British carder called JiLsi ran the site, and he’d made the
5666mistake of choosing the same password—“MSR206”—
5667everywhere, including Carders Market, where Max knew
5668everyone’s passwords. Max could just walk in and take
5669over. The Vouched, on the other hand, was a fortress—you
5670couldn’t even connect to the website without a privately
5671issued digital certificate installed in your browser.
5672Fortunately, JiLsi was also a member of that site, and he
5673had moderator privileges there. Max found a copy of the
5674certificate in one of JiLsi’s webmail accounts, protected by
5675the carder’s usual password. From there, it was just a
5676matter of logging in as JiLsi and leveraging his access to
5677get at the database.
5678On TalkCash and ScandinavianCarding, Max
5679determined that the forum software’s search function was
5680vulnerable to an “SQL injection” attack. It wasn’t a
5681surprising discovery. SQL injection vulnerabilities are the
5682Web’s most persistent weakness.
5683SQL injection has to do with the behind-the-scenes
5684architecture of most sophisticated websites. When you visit
5685a website with dynamic content—news articles, blog posts,
5686stock quotes, virtual shopping carts—the site’s software is
5687pulling the content in raw form from a back-end database,
5688usually running on a completely different computer than the
5689host to which you’ve connected. The website is a facade—
5690the database server is the important part, and it’s locked
5691down. Ideally, it won’t even be accessible from the Internet.
5692The website’s software speaks to the database server in
5693a standard syntax called Structured Query Language, or
5694SQL (pronounced “sequel”). The SQL command SELECT,
5695for example, asks the database server for all the
5696information that fits a specified criteria. INSERT puts new
5697information in the database. The rarely used DROP
5698instruction will mass-delete data.
5699It’s a potentially perilous arrangement, because there are
5700any number of situations where the software has to send a
5701visitor’s input as part of an SQL command—in a search
5702query, for example. If a visitor to a music site enters
5703query, for example. If a visitor to a music site enters
5704“Sinatra” in the search box, the website’s software will ask
5705the database to look for matches.
5706SELECT titles FROM music_catalog
5707WHERE artist = ‘Sinatra’;
5708An SQL injection vulnerability occurs when the software
5709doesn’t properly sanitize the user’s input before including it
5710in a database command. Punctuation is the real killer. If a
5711user in the above scenario searches on “Sinatra’; DROP
5712music_catalog;” it’s tremendously important that the
5713apostrophe and semicolons not make it through.
5714Otherwise, the database server sees this.
5715SELECT * FROM music_catalog
5716WHERE artist = ‘Sinatra’; DROP music_catalog;’;
5717As far as the database is concerned, that’s two
5718commands in succession, separated by a semicolon. The
5719first command finds Frank Sinatra albums, the second one
5720“drops” the music catalog, destroying it.
5721SQL injection is a standard weapon in every hacker’s
5722arsenal—the holes, even today, plague websites of all
5723stripes, including e-commerce and banking sites. And in
57242005, the forum software used by TalkCash and
5725ScandinavianCarding was a soft target.
5726To exploit the bug on TalkCash, Max registered for a new
5727account and posted a seemingly innocuous message on
5728one of the discussion threads. His SQL attack was hidden
5729in the body of the message, the font color set to match the
5730background so nobody would see it.
5731He ran a search query designed to find the post, and the
5732buggy forum software passed his command to the
5733database system, which executed it, INSERTing a new
5734administrator account just for Max. A similar attack worked
5735at ScandinavianCarding.
5736On August 14, Max was ready to show the carding world
5737what he was capable of. He slid into the sites through the
5738holes he’d secretly blasted in their ramparts, using his illicit
5739admin access to copy their databases. The plan would
5740have made Sun Tzu proud: Attacking and absorbing rival
5741forums was an unexpected route indeed. Most carders
5742wanted to avoid attention, not thrust themselves into
5743prominence. A hostile takeover was unprecedented.
5744When he was done with the English-speaking sites, Max
5745went to Eastern Europe. He’d strived to unite the Eastern
5746European carders with the West, but Tea’s efforts had
5747been largely fruitless—the Russians liked her but didn’t
5748trust an American board. Diplomacy had failed; it was time
5749for action. He found Cardingworld.cc and Mazafaka.cc no
5750more secure than the western boards and was soon
5751downloading their databases of private messages and
5752forum posts. Megabytes of Cyrillic flowed onto his
5753computer, a secret history of scams and hacks against the
5754West stretching back months, now permanently
5755warehoused on Max’s hard drive in San Francisco’s
5756Tenderloin.
5757When he was done, he executed the DROP command
5758on all the sites’ databases, wiping them out.
5759ScandinavianCarding, the Vouched, TalkCash,
5760DarkMarket, Cardingworld—the bustling, twenty-four-houra-
5761day marketplaces supporting a billion-dollar global
5762underground economy all winked out of existence. Ten
5763thousand criminals around the world, men with six-figure
5764deals in the works; wives, children, and mistresses to
5765support; cops to buy off; mortgages to pay; debts to satisfy;
5766and orders to fill, were, in an instant, blind. Adrift. Losing
5767money.
5768They would all know the name “Iceman.”
5769Max then went to work on the stolen membership data,
5770ignoring, for now, the Eastern European carders. After
5771culling the duplicates and undesirables from the four
5772English-language sites, there were 4,500 new members for
5773Carders Market. He rolled them all into his site’s database,
5774Carders Market. He rolled them all into his site’s database,
5775so the carders could use their old nicknames and
5776passwords to log in to their new home. Carders Market had
5777six thousand members now. It was larger than Shadowcrew
5778had ever been.
5779He announced the forced merger in a mass e-mail to his
5780new members. As the morning dawned in San Francisco,
5781he watched them gather, confused and angry, on his
5782consolidated crime forum. Matrix001, a German
5783DarkMarket administrator, demanded an explanation for
5784Iceman’s actions. A previously taciturn spam king named
5785Master Splyntr spoke up to criticize the organization of the
5786material Iceman had stolen from the other boards. The
5787entire contents of the competing sites now lived in a new
5788section of Carders Market called “Historical posts from
5789merged forums.” They were unsorted and difficult to
5790navigate; Max had found the sites’ content worthy of
5791preserving but not of organizing.
5792Max watched the grumbling for a while, then stepped in
5793and let everyone know who was in charge.
5794@Master Splyntr: unless you have something
5795constructive or specific to say, your comment is
5796unwelcome. If you are unhappy with the layout, then go
5797away and come back later, because it is not yet sorted
5798out! @matrix001: The old forums were negligent in their
5799security, using shared hosting, failing to use encryption
5800of the data, logging IP addresses, using “1234” as the
5801administrative passwords (yes really people this is
5802true!), and general administrative Nazism. Some, such
5803as TheVouched, were even giving a false sense of
5804security, which as you know is far worse than none at
5805all.
5806You ask, what is the meaning of “all this”? If you
5807mean, why would we merge five carding forums
5808together, the short answer is because I didn’t have
5809time nor interest to merge in the other four for a total of
5810nine!
5811Basically, this was overdue. Why have five different
5812forums each with the same content, splitting users and
5813vendors, and a mish-mash of poor security and
5814sometimes poor administration and poor moderation. I
5815am not saying that is the case in all, but it was for most.
5816With the right moderation, CM will return to its
5817previous “tight” reign, with zero tolerance policy
5818against ripping, and almost anarchist policy of not
5819locking threads and promoting discussion. In the
5820meantime, there is extra “fluff” from the previous
5821forums, but that will be cleaned up.
5822What is the point? Security. Convenience. Increase
5823quality and decrease the noise. Bringing order to a
5824mess …
5825A Canadian hacker called Silo countered that Iceman
5826had dissolved the social glue that held the carder
5827community together. He’d violated their trust.
5828You breached our community’s security. Stole the
5829databases of other forums. Couldn’t your merger have
5830taken place with the admins of all the boards
5831consenting to it? What’s the difference between me
5832hacking your e-mails and reading up on your business
5833and posting your communications on my board?
5834Either way you look at it, you’ve breached what little
5835trust exists in the community. My suggestion is that you
5836delete the databases you have that aren’t yours to
5837display. The proper thing to do is ASK the admins of
5838the boards if one true unified board is in the best
5839interests of our community, and wait and see if they
5840would be interested in such a board.
5841That is my two cents.
5842There are people out here with a lot of skills Iceman.
5843How they use them is what determines our community.
5844The Vouched came back online, but not for long—it was
5845supposed to be a private, secure forum open only to a
5846select few. When Max had broken its security, he’d
5847shattered its credibility, and nobody bothered to return.
5848TalkCash and ScandinavianCarding were doomed—they
5849had no backups of the databases Max had destroyed.
5850Their members mostly stayed on at Carders Market.
5851Aside from the Russian forums, which Max was having
5852trouble assimilating because of the language barrier, there
5853was just one black mark on Max’s triumph: DarkMarket. His
5854chief competitor had backups and managed to crawl back
5855to life within days. It was a slap in the face to everything
5856Max was trying to achieve for himself and the community.
5857The war had begun.
5858In Orange County, Chris was consolidating his end of the
5859business too. He decided it would be convenient to have
5860his full-time workers all living in the same place, and the
5861Archstone chain of apartment complexes offered an
5862Internet-based move-in process perfectly suited to his
5863plans. Prospective tenants could fill out a lease on the
5864company’s website and pay the easy $99 deposit and the
5865first month’s rent with a credit card. Chris could handle
5866everything online, and his people wouldn’t have to put in an
5867appearance until move-in day, when they’d stop by the
5868rental office to flash their fake ID and pick up the door key.
5869He moved two of his cashers, and Marcos, his pot
5870connection, into the Archstone Mission Viejo, a labyrinth of
5871McMansion-style apartments painted the colors of a sunset
5872and clinging to a hill dotted with palm trees and hightension
5873lines alongside Interstate 5, ten minutes from his
5874house. He was also looking to expand his crew. One girl
5875had dropped out and moved to Toledo after her second instore
5876bust, and two others had quit in disgust when Chris
5877impregnated his teenage girlfriend—he was now paying for
5878an apartment for the young woman and their son, whose
5879existence he kept secret even from his mother.
5880At the NCFTA office in Pittsburgh, Keith Mularski, in his
5881Master Splyntr guise, got a private message from Iceman
5882himself two days after the hostile takeover. The hacker
5883wanted to apologize for some of his hasty words on his
5884forum.
5885Anticipating the next stage in the DarkMarket–Carders
5886Market conflict, Iceman had boasted that he would easily
5887defuse any DDoS attacks leveled against his site. But
5888afterward, he Googled Master Splyntr and learned he was
5889a world-class spammer with a botnet army. Iceman
5890seemed loath to turn a mere critic into a full-blown enemy.
5891Don’t take offense to my smartass comments. It is
5892true that if someone attacks me I will just track the
5893botnet and try to jack it or shut it down, but it’s not
5894something I want to taunt people with. No one needs to
5895waste their time with such activity, really DDoS is no
5896fun and so don’t get the wrong idea plz. :-)
5897Mularski was beginning to see an opportunity in the
5898upheaval gripping the underground. Nobody knew who to
5899trust anymore; everyone was angry at everyone else. If he
5900were to play both sides, he might make inroads against the
5901forum administrators as they grappled for allies in the
5902brewing battle.
5903He was allowed three substantive contacts. He decided
5904to use one of them to respond to Iceman.
5905No worries brotha, we’re kewl. I’m a smartass
5906myself. I got no interest in attacking. Shit, my bots
5907aren’t even configured to attack. Mailing makes me far
5908more money! I really got no interest in doing anything
5909that doesn’t make me money, unless I have a vendetta,
5910which I don’t. And if you do get attacked, I’m also pretty
5911good in tracking and hijacking, so hit me on ICQ
5912340572667 if ya need help.… :-) MS
5913Mularski watched his screen, waiting. A few minutes
5914later, a response.
5915Excellent thank you :-) BTW, do you have any
5916suggestions for running things here, aside from the
5917obvious organizational mess? Also, I will change it so
5918you are a vendor and have user selectable title. (Done)
5919I don’t know if you vend mailing services with your net,
5920but that is a cool thing to have around and I’m sure
5921we’re better off having you available for hire. Also, if
5922you were a vendor before (or other?) then please
5923accept my apologies for the title loss. I preserved
5924some of the status like DM vendors, but messed up on
5925the other forums and those didn’t get preserved. Just
5926FYI. Thanks bro :-) Also added you to VIP group.
5927It was a promising response. Mularski talked things over
5928with his supervisor, then applied to headquarters for Group
5929II authority, the lesser of two tiers of undercover
5930engagement available to the FBI but still a step up from his
5931previous “passive observation only” mandate. The new
5932latitude wouldn’t let him participate in crimes, but he would
5933finally be permitted to actively engage with the
5934underground. He named Carders Market, and everyone
5935associated with running the site, as the investigation’s
5936targets.
5937The approval came quickly. But despite his encouraging
5938words, Iceman proved a slippery target; he kept Mularski at
5939arm’s length, not confiding in him and only chatting through
5940Carders Market’s internal messaging system. The FBI
5941agent had better luck on the other side of the battlefield.
5942He’d been an early member of DarkMarket, and now that
5943he was interactive, the site’s founder, JiLsi, quickly
5944identified Master Splyntr as management material. In early
5945September, Splyntr was appointed as a moderator on the
5946site.
5947The war was heating up. Despite the lessons of the
5948August incursion, JiLsi couldn’t manage to completely lock
5949down DarkMarket. Iceman began sneaking in regularly and
5950deleting accounts at random, just to mess with JiLsi’s head.
5951When DarkMarket retaliated with a fierce DDoS attack
5952against Carders Market’s Iranian host, Iceman fired back
5953with a DDoS of his own against DarkMarket. Both sites
5954groaned under the weight of the junk packets. Iceman
5955quietly set up service at a U.S. hosting company with the
5956bandwidth to absorb the DDoS packets, cleaning the traffic
5957before channeling it back to his real server over an
5958encrypted VPN.
5959JiLsi was tearing his hair out, voicing his frustrations to
5960Master Splyntr. Mularski shifted his focus away from
5961Iceman and toward the British cybercrime boss who was
5962starting to treat him like a friend. Tentatively, he suggested
5963that JiLsi consider turning over DarkMarket to someone
5964seasoned in setting up bulletproof hosting. Someone
5965accustomed to running sites that everyone hates. A
5966spammer.
5967Hey, you know my background, he wrote in a chat. I’m
5968real good at setting up servers. I secure servers all the time.
5969I could set this up for you.
5970Mularski was toying with an extraordinary plan. In the
5971past, the Secret Service and FBI had both run admins as
5972informants: Albert Gonzalez on Shadowcrew and Dave
5973Thomas on the Grifters. But actually running a crime forum
5974directly would provide access to everything from the
5975carders’ IP addresses to their private communications,
5976while giving Master Splyntr, as the site’s runner, more
5977credibility in the underground than any agent could dream
5978of.
5979JiLsi expressed interest in Master Splyntr’s offer, and
5980Mularski braced himself for another trip to Washington, DC.
5981
598226
5983What’s in Your Wallet?
5984Selling USA 100% APPROVED DUMPS
5985*NEW* Discounted Prices for approved dumps:
5986$11 MasterCard
5987$8 Visa Classic
5988$13 Visa Gold/Premium
5989$19 Visa Platinum
5990$24 Visa Signature
5991$24 Visa Business
5992$19 Visa Corporate
5993$24 Visa Purchasing
5994$19 American Express = new price drop (was 24)
5995$24 Discover = new price drop (was 29)
5996Minimum order 10 pieces.
5997Dumps sold by type of card. No bin list.
5998Max’s hostile takeover was about fixing the community,
5999not personal profit. But his business in stolen magstripe
6000data was stronger than ever after the merger—he was
6001earning a thousand dollars a day now selling dumps to
6002carders around the world, in addition to the five to ten
6003thousand a month he was still pulling in through his
6004partnership with Chris.
6005Publicly, at FTC meetings and elsewhere, the credit card
6006industry was doing its best to conceal the impact of the
6007rampant magstripe theft happening worldwide. Credit
6008leader Visa held up an industry-funded report by Javelin
6009Strategy and Research that claimed consumers, not
6010companies, were the source of the vast majority of identity
6011theft and credit card fraud cases: Some 63 percent of
6012cases originated with consumers, primarily victims of lost
6013or stolen wallets, followed by theft by trusted associates,
6014stolen mail, and Dumpster diving.
6015The report was grossly misleading, only tallying cases in
6016which the victim knew how his information had been stolen.
6017Visa’s private numbers told the real story. Stolen wallets
6018hadn’t been the primary source of fraud since mid-2001,
6019when credit card theft from e-commerce sites sent
6020fraudulent “card not present” transactions—online and
6021telephone purchases—rocketing up the chart, while every
6022other category held steady.
6023In 2004, when stolen magstripe data became a massive
6024underground commodity, losses to counterfeit cards
6025followed the same stratospheric climb. In the first quarter of
60262006, Chris Aragon–style counterfeiting edged out cardnot-
6027present fraud for the first time, topping $125 million in
6028quarterly losses to Visa’s member banks alone.
6029Nearly all those losses began with a price list like Max’s.
6030As Digits, Max accumulated page after page of positive
6031reviews on Carders Market and a reputation for square
6032dealing. It was a point of pride with Max—and a sign of the
6033moral compartmentalization he’d practiced since
6034childhood. Max would happily hack a carder and copy his
6035entire hard drive, but if a customer paid him for information,
6036Max wouldn’t even consider shortchanging him.
6037His generosity, too, was well known. If Max had dumps
6038that were about to expire, he’d give them away for free
6039rather than let them go to waste. Together, his exemplary
6040business practices and the quality of his product made Max
6041one of the top five dumps vendors in the world, in a market
6042traditionally dominated by Eastern European sellers.
6043Max was cautious with his vending. By refusing to sell
6044dumps by BIN—bank identification number—he made it
6045tough for the feds to identify his breaches: The government
6046couldn’t just buy twenty dumps sourced to a single financial
6047institution and ask that bank to look for a common purchase
6048point in its transaction records. Instead, a batch of twenty
6049cards could belong to twenty different banks. They’d all
6050cards could belong to twenty different banks. They’d all
6051have to cooperate with one another to nail down the source.
6052Additionally, only a few trusted associates knew that
6053Digits and Iceman were one and the same: mostly admins,
6054like Chris, a Canadian carder named NightFox, and a new
6055recruit called Th3C0rrupted0ne.
6056Of everyone he’d met in the scene, it was
6057Th3C0rrupted0ne with whom Max seemed to share the
6058most hacking history. As a teenager, C0rrupted had
6059discovered the warez scene on dial-up bulletin board
6060systems, then moved into recreational hacking under the
6061handles Acid Angel, -null-, and others. He defaced
6062websites for fun and joined a hacking gang called Ethical
6063Hackers Against Pedophiles—vigilante gray hats working
6064against Internet child pornography.
6065Like Max, he’d once thought of himself as one of the
6066good guys, before he became Th3C0rrupted0ne.
6067In other ways, they were very different. A product of a
6068hardscrabble childhood in a big-city housing project,
6069C0rrupted became a drug dealer at an early age and
6070picked up his first arrest—a gun charge—in 1996 when he
6071was eighteen years old. In college he began making fake
6072IDs for his friends, and his online research took him to
6073Fakeid.net, a Web bulletin board where experts like ncXVI
6074got their start. He graduated to small check and credit card
6075scams around the time Shadowcrew went down and then
6076found his way to the successor sites.
6077Diplomatic and even-tempered, C0rrupted was
6078universally liked in the scene and enjoyed moderator or
6079admin privileges on most of the forums. Max promoted him
6080to admin on Carders Market in the summer of 2005 and
6081made him unofficial site spokesman after the hostile
6082takeover. Max let C0rrupted in on his double identity about
6083a week after his power play.
6084So obviously I am Digits also. Might as well say it
6085straight since I blew cover in ICQ (talking about “our
6086forum,” etc.)
6087It is a pain in the ass trying to keep that separate
6088from people I know and trust and like such as yourself.
6089So there you go …
6090Anyway, reasoning is, Iceman is legal. Digits is
6091breaking the law. I assumed if I could keep it separate
6092there would be no legal leg to stand on for coming after
6093“me” as the forum admin.
6094Chris remained the greatest threat to Max’s security.
6095Every time they fought now, Max was reminded of how
6096vulnerable he was to the only carder privy to his real-life
6097identity. “I can’t believe how much you know about me,”
6098he’d spit out, angry at himself.
6099Meanwhile, Chris had been trying to drive Max into
6100pulling one big score, something that would catapult them
6101both out of the crime business for good and maybe fund a
6102new legitimate start-up for Chris in Orange County. He’d
6103crafted a flowchart and a step-by-step plan for each of them
6104to follow; he called it the “Whiz List.”
6105Max was supposed to infiltrate banking networks and
6106gain the power to direct millions of dollars to accounts
6107specified by Chris. He’d delivered on his end—from the
6108very start of their partnership, back when he was working
6109from Chris’s garage, he’d been breaching small banks and
6110savings and loans. He was in hundreds of them now and
6111could transfer money out of customers’ accounts at will. But
6112the scheme was hung up on Chris’s end. Chris had to find a
6113safe harbor for the money Max would steal—an offshore
6114repository where they could park the cash without it being
6115recalled by the victim bank. So far, he’d failed.
6116So when, in September, Max got his hands on a deadly
6117new Internet Explorer zero day, he shared the news not with
6118Chris but with a different partner, one who had more
6119knowledge of international finance, the Carders Market
6120admin called NightFox.
6121The security hole was a monster: another buffer overflow,
6122this time in the Internet Explorer code designed to let
6123websites draw vector graphics on a visitor’s screen. Sadly
6124for Max, Eastern European hackers had found the bug first,
6125and they’d been using it. A computer security company had
6126already found the Russian exploit code infecting visitors to
6127an Internet porn site and sent it to Microsoft. The
6128Department of Homeland Security had issued a blunt
6129warning to Internet Explorer users: “Do not follow
6130unsolicited links.”
6131The word was out, but there was no patch. Every Internet
6132Explorer user was vulnerable. Max got his copy of the
6133Russian exploit in the early morning hours of September 26
6134and informed NightFox enthusiastically.
6135“Assume we get a free pass today to own whatever
6136company we want,” Max wrote over Carders Market’s
6137messaging system. “There you go. No limits. Visa.com.
6138Mastercard.com. egold.com. Whatever you can get the
6139employee e-mails for. Google. Microsoft. Doesn’t matter.
6140It’s all equally ownable right now.”
6141Microsoft pushed out a patch later that day, but Max
6142knew that even the most secure company would take days
6143or weeks to test and install the update. The Russian exploit
6144was already detected by antivirus software, so he modified
6145it to change its signature, running it through his antivirus lab
6146to verify that it was now undetectable.
6147The only thing left was the social engineering: Max had to
6148trick his targets into visiting a website loaded with the
6149exploit code. Max decided on the domain name
6150Financialedgenews.com, and set up hosting at ValueWeb.
6151NightFox came back with the target list: CitiMortage,
6152GMAC, Experian’s Lowermybills.com, Bank of America,
6153Western Union MoneyGram, Lending Tree, and Capital
6154One Financial, one of the largest credit card issuers in the
6155country. NightFox had vast databases of internal corporate
6156e-mail addresses he’d acquired from a “competitive
6157intelligence” firm, and he sent Max thousands of them,
6158spread across all the targets.
6159On September 29, Max fired up his spamming software
6160and flung a personalized e-mail at his victims. The
6161message was from “Gordon Reily,” with the return address
6162g.reily@lendingnewsgroup.com.
6163I am a reporter for Lending News doing a follow up
6164story on the recent leak of customer records from
6165Capital One. I saw the name Mary Rheingold in the
6166article from Financial Edge and would like to interview
6167you for a follow up piece.
6168http://financialedgenews.com/news/09/29/Disclosure_Capital0ne
6169If you have time I would greatly appreciate an
6170opportunity to further discuss the details of the above
6171article.
6172Each copy of the message was customized, so every
6173employee would think he or she was mentioned by name in
6174the notional Financial Edge article. At Capital One, 500
6175employees got the message, from executives to PR
6176spokespeople and IT workers. About 125 of them clicked
6177on the poisoned link and were sent to a page loaded with
6178generic finance industry news. While they puzzled over the
6179page, a hidden payload zipped through the corporate
6180firewall and onto their machines.
6181The software opened a back door that would allow Max
6182to slip in at his leisure and scour the victims’ hard drives for
6183sensitive data, sniff the banks’ internal networks, steal
6184passwords. It wasn’t much different from what he’d done to
6185thousands of Defense Department computers a lifetime
6186ago. Back when it was all just fun and games.
6187
618827
6189Web War One
6190eith Mularski stood at the podium, his PowerPoint
6191presentation filling an LCD big-screen at his back. In front
6192of him were fifteen senior FBI officials and Justice
6193Department lawyers, sitting around the conference room
6194table at Justice headquarters. They were riveted. Mularski
6195was proposing something that had never been done
6196before.
6197Group I “sensitive circumstances” authorizations were a
6198rare thing in the bureau. Mularski first wrote out a twentypage
6199proposal, addressing every aspect of the plan and
6200gathering legal opinions from FBI lawyers for each. The
6201FBI’s general counsel was excited about the possibilities; if
6202it were approved, the operation could set a precedent for
6203future online undercover work.
6204The biggest obstacle for the Justice Department’s
6205Undercover Review Committee was the third-party liability
6206issue of letting crimes unfold over a website owned and
6207operated by the U.S. government. How would Mularski
6208mitigate the damage so innocent people and institutions
6209wouldn’t suffer? Mularski had an answer at the ready. The
6210criminal activity on DarkMarket was going to take place
6211whether the FBI ran the forum or not. But with the bureau
6212controlling the server, and Master Splyntr leading the site,
6213the FBI could potentially intercept large amounts of stolen
6214data that would otherwise flow freely through the black
6215market. His proposal stipulated that any financial data
6216would be sent immediately to the affected banks. Stolen
6217credit cards could be canceled before they were used.
6218The meeting lasted twenty minutes. When he returned to
6219Pittsburgh on October 7, Mularski had written approval to
6220acquire DarkMarket. Iceman was still listed as a subject of
6221the undercover operation, but now JiLsi and DarkMarket’s
6222other leaders were the primary targets.
6223Once his wife went to bed, Mularski settled in front of his
6224couch, turned on Saturday Night Live, and looked for JiLsi
6225on ICQ. After some pleasantries, he got down to business.
6226DarkMarket was under yet another DDoS attack, and
6227Mularski, as Master Splyntr, was ready to take the site onto
6228a secure server—JiLsi need only say the word, and his
6229problems with Iceman would be history.
6230JiLsi had some reservations. DarkMarket was his baby,
6231and he didn’t want to be perceived by the community as
6232ceding control. That wouldn’t be a problem, Mularski
6233explained. Master Splyntr would be a stealth administrator.
6234Nobody but he and JiLsi would know he was running the
6235site. To everyone else, he’d still just be a moderator.
6236“Bro,” JiLsi typed back. “Get your server ready. We
6237moving.”
6238Mularski went to work at once. He rented a server from a
6239Texas-based hosting company called the Planet and went
6240to the underground to shore it up, buying $500-a-month
6241DDoS protection services from a Russian named
6242Quazatron and paying for it in e-gold. Quazatron configured
6243the site so its public face was at Staminus, a DDoSresistant
6244high-bandwidth hosting company. The company’s
6245pipes could withstand a deluge, and Quazatron’s software
6246would channel only the legitimate traffic to DarkMarket’s
6247real server behind the scenes.
6248Everything would be done the way an Eastern European
6249cybercrook would do it. When Mularski wanted to log in to
6250the site’s back end, he’d go through KIRE, a Virginia
6251company offering Linux “shell accounts”—a service that lets
6252IRC users connect to chat rooms without being traced to
6253their home IP addresses. Nobody would see that the Polish
6254spam king was logging in from Pittsburgh.
6255Once the move was complete, Mularski went to court and
6256won a sealed search warrant against his own server,
6257allowing him to riffle through DarkMarket’s user database,
6258access logs, and private messages.
6259There was one more thing to do. Post-Shadowcrew, it
6260was de rigueur for carder forums to make users click on a
6261terms-of-service agreement prohibiting illegal content and
6262stipulating that the site’s operators weren’t responsible for
6263anything on the board. Forum runners believed the
6264legalistic language might shield them from prosecution.
6265DarkMarket had a particularly long and detailed user
6266agreement, so nobody noticed when Master Splyntr added
6267a line.
6268“By your use of this forum you agree that the
6269administrators may review any communication sent using
6270this forum to ensure compliance with this policy,” he wrote,
6271“or for any other purpose.”
6272“I think it’s important to note that Iceman is a foolish
6273wannabe hacker who goes around and hacks sites for fun
6274and pleasure.”
6275El Mariachi knew how to push Iceman’s buttons. After the
6276hostile takeover, Dave Thomas returned to the Life on the
6277Road blog to browbeat his foe relentlessly, calling him
6278“Iceboy,” “Officer Ice,” and “a fucking piece of shit on my
6279shoes.” He challenged Iceman to meet him in person, so
6280they could resolve their dispute like men. And he implied he
6281could hire a hit man to track down the carding kingpin and
6282end his life.
6283Max responded with growing fury. He hadn’t forgotten the
6284hassle and expense of finding a new host after Thomas
6285shut him down in Florida. The aggressiveness he’d kept
6286buried since Boise boiled from his gut and into his
6287fingertips. “You small dick limp sack of shit. I could fucking
6288tear you apart with my bare hands but a COWARD snitch
6289like yourself would call the cops and scramble for a weapon
6290at the first sight of me,” he wrote. “You better pray to your
6291god that I am never outed, because not only will you look
6292like even more of a jackass than you already do, but then I
6293will have no inhibition about coming over and wringing your
6294snitch punk neck.”
6295When he calmed down, he sent Thomas a private e-mail.
6296He’d been thinking about taking down Carders Market and
6297retiring his Iceman identity. It wouldn’t be a surrender;
6298rather, it was the most serious threat imaginable to
6299Thomas’s campaign.
6300You haven’t read the Art of War, have you, cunt?
6301You know NOTHING about me. I know EVERYTHING
6302about you.
6303I kill CM, I kill Iceman, then what do you have you
6304punk bitch? Shadowboxing?? You are FUCKED. An
6305enemy who will fuck you over constantly for years, that
6306you have NO DEFENSE and NO TARGET for
6307retribution.
6308I am your worst nightmare you little bitch, and you
6309and your family will be feeling the effects of the money
6310you cost me for a long, long time.
6311Two days later, Max proved he was serious. He hacked
6312into El Mariachi’s website, the Grifters, which Thomas had
6313turned into a semi-legitimate security site dedicated to
6314watching the carding forums. Max wiped the hard drive. The
6315site never came back.
6316Iceman announced his triumph in a final public message
6317to the blog. “I have nothing to prove, and now having beat
6318down David Renshaw Thomas, federal snitch, I make my
6319exit,” he wrote. “Unlike you people, I pay attention to my own
6320business. Learn a lesson. Move on and leave me the fuck
6321alone.”
6322But Max wasn’t going to be able to slip back into the
6323shadows. Two reporters from USA Today had taken notice
6324of the public carder war and confirmed the details of the
6325hostile takeover with security firms watching the forums.
6326The morning after Max declared victory over El Mariachi,
6327delivery drivers around the country plunked down
6328Thursday’s edition of the paper on more than two million
6329doorsteps from coast to coast. There, on the front page of
6330the business section, was the whole sordid tale of Iceman’s
6331annexation of the carding sites.
6332By letting his ego lead him into a public battle with David
6333Thomas, Max had gotten Iceman into the largest-circulation
6334daily in America.
6335“The Secret Service and FBI declined to comment on
6336Iceman or the takeovers,” the article read. “Even so, the
6337activities of this mystery figure illustrate the rising threat that
6338cybercrime’s relentless expansion—enabled in large part
6339by the existence of forums—poses for us all.”
6340The story wasn’t a surprise; the reporters had
6341approached Iceman for comment, and Max had e-mailed a
6342long one, lobbing his Craigslist defense. His views didn’t
6343make it into the article, and the story only made Max more
6344defiant. He added a quote from the piece to the top of the
6345Carders Market login page: “It’s like he created the Wal-
6346Mart of the underground.”
6347Max showed the article to Charity. “I seem to have
6348created quite a stir.”
6349Chris was apoplectic when he learned that Max had
6350corresponded with the journalists. He’d watched as Max
6351burned hours squabbling with Thomas. Now his partner
6352was giving press interviews?
6353“You’ve lost your fucking mind,” he said.
6354Max was swamped. Vouch requests were pouring into
6355Carders Market in a torrent. The USA Today article
6356seemed to bring out every street-level hood hoping to
6357break into computer fraud. The site picked up over three
6358hundred new members overnight. Two weeks later, they
6359were still coming in.
6360He offloaded as much of the work as he could to his
6361admins. Max had other things to worry about now. His
6362spear-phishing attack against the financial institutions had
6363been wildly successful, but getting past the banks’ firewalls
6364had turned out to be the easy part. Bank of America and
6365Capital One, in particular, were huge institutions, and Max
6366was lost in their vast networks. He could easily spend years
6367on either one, just looking for the data and the access he
6368needed to make a big score. Max was having trouble
6369staying motivated for the mind-numbing follow-through to
6370his intrusions; cracking the networks had been the fun part,
6371and now that was over.
6372Instead, Max put the banks on the back burner to focus
6373on the carding war. Max’s new hosting provider was getting
6374complaints about the rampant criminality on Carders
6375Market. Max saw one of the e-mails, sent from an
6376anonymous webmail account. On a hunch, Max tried
6377logging in to the account with JiLsi’s password. It worked.
6378JiLsi was trying to get him shut down.
6379Max retaliated by hacking into JiLsi’s account on the
6380Russian forum Mazafaka and posting an avalanche of
6381messages reading, simply, “I’m a fed.” Then he went public
6382with the evidence of JiLsi’s malfeasance; snitching to
6383Carders Market’s hosting company was a scummy tactic.
6384DarkMarket just didn’t have the decency to die. Max
6385could have dropped the database again, but it would do no
6386good—the site had come back before. His DDoS attacks
6387had become ineffective, too. Overnight, DarkMarket had
6388come into expensive high-bandwidth hosting and erected
6389dedicated e-mail and database servers. It was suddenly a
6390hard target.
6391Then Max heard an intriguing rumor about DarkMarket.
6392The story involved Silo, a Canadian hacker known for an
6393uncanny ability to juggle dozens of false handles in the
6394community, effortlessly switching writing styles and
6395personalities for each one. Silo’s second claim to fame
6396was his compulsive back-dooring of other carders. He was
6397was his compulsive back-dooring of other carders. He was
6398constantly posting software with hidden code that would let
6399him spy on his peers.
6400Both traits were at play when Silo registered an account
6401at DarkMarket under a new handle and submitted a piece
6402of hacking software for vendor review. True to form, Silo
6403had secreted a hidden function in the software that would
6404smuggle a user’s files out to one of Silo’s servers.
6405When Silo looked at the results, he found a small cache
6406of blank Microsoft Word templates, including a “malware
6407report” form. The templates carried the logo for an
6408organization called the National Cyber Forensics and
6409Training Alliance in Pittsburgh. Max looked them up; it was
6410a fed shop. Someone connected with DarkMarket was
6411working for the government.
6412Determined to investigate, Max breached DarkMarket
6413again through his back door. This time, it was a
6414reconnaissance mission. He dropped into a root shell and
6415entered a command to bring up the recent login history and
6416then started down the list in another window, checking the
6417public registration records for each of the Internet IP
6418addresses used by the administrators. When he got to
6419Master Splyntr, he stopped. The supposedly Polish
6420spammer had connected from an IP address belonging to
6421a private corporation in the United States called
6422Pembrooke Associates.
6423He pulled up the Whois.net registration records for the
6424company’s website, Pembetal.com. The mailing address
6425listed was a PO box in Warrendale, Pennsylvania, twenty
6426miles north of Pittsburgh. There was also a phone number.
6427Another click of his mouse, another browser window—
6428the reverse white pages at Anywho.com. He entered the
6429phone number and this time got a real street address: 2000
6430Technology Drive, Pittsburgh, Pennsylvania.
6431It was the address he’d already found for the National
6432Cyber Forensics and Training Alliance. Master Splyntr was
6433a fed.
6434
643528
6436Carder Court
6437eith Mularski was screwed.
6438He got the word first from an agent at the Secret Service
6439field office across town. “I think you may be in some
6440trouble.” One of their myriad informants heard that Iceman
6441had uncovered incontrovertible proof that Master Splyntr
6442was either a snitch, a corporate security spy, or a federal
6443agent. Iceman had forged a temporary alliance with his
6444sometime enemy Silo and was preparing a comprehensive
6445presentation for the leadership of Carders Market and
6446DarkMarket. Iceman and Silo were going to put Master
6447Splyntr on trial.
6448It had begun with Silo’s code. Master Splyntr’s reputation
6449as a spammer and programmer made him DarkMarket’s
6450go-to guy for malware reviews. It was one of the perks of
6451his undercover operation: Mularski got the first look at the
6452underground’s latest attack code and could pass it to
6453CERT, who would in turn give it to all the antivirus
6454companies. The malicious code would be detectable even
6455before it went on the black market.
6456This time, Mularski had assigned the code as a training
6457exercise to one of the CMU students interning at NCFTA.
6458As standard procedure, the student ran the program
6459isolated in a virtual machine—a kind of software petri dish
6460that could be scrubbed afterward. But he forgot that he had
6461a thumb drive in the USB port. The drive was loaded with
6462blank malware report forms containing the NCFTA logo
6463and mission statement. Before the intern realized what was
6464happening, the documents were in Silo’s hands.
6465Six DarkMarket admins and moderators had gotten a
6466copy of Silo’s code. Now the Canadian knew that one of
6467them was a fed.
6468Silo was a wild card. In real life, he was Lloyd Liske, a
6469Vancouver auto shop manager and credit card forger
6470who’d been busted a few months after Operation Firewall.
6471When he was sentenced to eighteen months of house
6472arrest, Liske changed his surname from Buckell and his
6473handle from Canucka, and reemerged in the carding
6474scene.
6475Now the Canadian was untouchable. It was widely known
6476in law enforcement circles that Silo was an informant for the
6477Vancouver Police Department. That’s why he was always
6478back-dooring other hackers: The Trojan horse that
6479infiltrated NCFTA wouldn’t have been intended to expose a
6480law enforcement operation; it was just Silo trying to gather
6481intelligence on DarkMarket members for the police.
6482Silo had no allegiance to the FBI, but he probably
6483wouldn’t have gone out of his way to expose a bureau
6484undercover operation. Unfortunately, Iceman had learned
6485about the discovery and staged his reconnaissance raid on
6486DarkMarket. That’s where Mularski’s own personal
6487screwup came into play. He normally logged in to
6488DarkMarket through his KIRE shell, hiding his location. But
6489JiLsi was a demanding boss, constantly hitting Master
6490Splyntr with maintenance tasks—like swapping in a new
6491banner ad—that simply had to be performed at once.
6492Sometimes KIRE was down when Mularski got one of
6493these requests, and he’d take a shortcut and log in directly.
6494Iceman had caught him.
6495Even then, he should have been relatively safe. The office
6496broadband service was set up under the name of a dummy
6497corporation, with a phone number that rang to an
6498unanswered VoIP line in the communications room. The
6499phone line was supposed to be unlisted. Somehow, though,
6500it wasn’t, and Iceman had gotten the address and
6501recognized it as the NCFTA’s.
6502Mularski walked hurriedly to the communications room,
6503Mularski walked hurriedly to the communications room,
6504swiped his access card, keyed in the door code, and
6505locked himself inside. He picked up the secure line to
6506Washington. The FBI agent didn’t sugarcoat his report to
6507the brass. After all his work winning undercover authority to
6508take over DarkMarket, getting a buy-in from senior Justice
6509Department and bureau officials, Iceman was going to blow
6510them out of the water just three weeks into the operation.
6511Max struggled with how to handle the exposé—after his
6512attacks on DarkMarket, he knew his findings would be
6513viewed as partisan mudslinging. He considered shuttering
6514Carders Market before exposing Master Splyntr, to avoid
6515the perception that the whole thing was just another volley in
6516the carding wars. Instead, he decided to send his new
6517lieutenant, Th3C0rrupted0ne, to represent his site.
6518The trial was held over Silo’s “Carder IM”—a free,
6519supposedly encrypted instant messaging program the
6520Canadian hacker offered as an alternative to AIM and ICQ,
6521supported by display ads for dumps vendors. Matrix001
6522showed up from the DarkMarket side—JiLsi was busy with
6523the fallout from Max’s attack on Mazafaka. Silo and two
6524other Canadian carders were also present. Silo opened the
6525meeting by handing out a compressed RAR file containing
6526the evidence gathered by him and Iceman.
6527When some of the carders opened the file, their antivirus
6528software went wild. Silo had back-doored the evidence; not
6529a promising start to a summit meeting.
6530C0rrupted and Silo walked them through the case: Silo’s
6531document templates showed that someone at NCFTA held
6532a privileged position on DarkMarket, and the access logs
6533Iceman had stolen proved that Master Splyntr was the mole.
6534“One hundred percent undeniable proof,” wrote
6535C0rrupted. “We worked hard to try and make peace, and if
6536we go public LE [law enforcement] is going to come after
6537us HARD. But if we don’t say anything, we are responsible
6538for all those who get fucked over.”
6539“This is for real dude,” said Silo.
6540Matrix was unconvinced. He ran his own Whois on the
6541Pembrooke Associates domain name and got back an
6542anonymous listing through Domains by Proxy: no street
6543address, no phone number. “Blah,” Matrix typed. “You did
6544not even verify the whois info and the company, did you?
6545Who passed you that stuff?”
6546“That’s not my stuff,” wrote Silo. “That’s Iceman.”
6547“So you believe every shit which is pasted to you?
6548Without even verifying it?”
6549Silo’s evidence was no more convincing to Matrix: The
6550NCFTA templates contained spelling and formatting errors
6551—would the FBI, or a nonprofit security group, really do
6552such shoddy work? Moreover, Iceman’s contempt for
6553DarkMarket was well-known, and Silo was a constant
6554annoyance on the board.
6555The conversation grew heated. C0rrupted dropped out,
6556and the others fell silent while Silo and Matrix began
6557exchanging insults. “What in the whole world should make
6558me trust you?” asked Matrix.
6559“Don’t,” Silo finally said. “Don’t trust me. Get the fuck off
6560my IM … Go get busted.”
6561Mularski was excluded from the meeting, but when it
6562concluded, Matrix sent Master Spyntr a transcript. The
6563agent was pleased to see his last-minute cleanup had
6564worked: As soon as he’d learned about Iceman’s plans to
6565expose him, he’d contacted the domain registrar and got
6566the company to scrub the Pembrooke Associates name
6567and phone number from the records. Then he asked
6568Anywho to take out its listing for the undercover phone line.
6569The cover-up was sure to convince Iceman all the more that
6570Master Splyntr was a fed, but nobody else was able to
6571independently verify his findings.
6572Now Mularski went into spin control over ICQ. He told
6573Matrix and anyone else who’d listen that he was innocent.
6574He directed the carders’ attention to the logs, highlighting
6575all the occasions he’d logged in from KIRE’s IP address.
6576all the occasions he’d logged in from KIRE’s IP address.
6577Those are my logins, he wrote. I don’t know who those other
6578logins are.
6579Then he spun and attacked. The doubt Iceman had sown
6580about JiLsi worked to his advantage. Things were going
6581crazy, he wrote. JiLsi had been acting suspiciously. For
6582one thing, he’d instructed Master Splyntr not to tell anyone
6583that he was running the server. And while JiLsi cultivated
6584the impression that DarkMarket was hosted in a country out
6585of reach of western law enforcement, he was actually
6586hosting it in Tampa, Florida, where the feds could just waltz
6587in any time and serve a search warrant. It was odd behavior
6588indeed.
6589JiLsi protested his innocence, but it was looking bad for
6590him. Master Splyntr publicly thanked Iceman for bringing the
6591matter to his attention and said he’d move DarkMarket out
6592of the United States at once.
6593Mularski reached out to law enforcement contacts in
6594Ukraine, and they helped him quickly get hosting there. In
6595the blink of an eye, DarkMarket was in Eastern Europe.
6596Most of the carders had to agree that no fed would move a
6597sting site to a former Soviet state.
6598There was no formal verdict, but a consensus formed that
6599Master Splyntr was innocent. They weren’t too sure about
6600JiLsi.
6601When the controversy subsided, Mularski returned to the
6602routine business of running his undercover operation. He
6603was at his desk filling out reports a couple of weeks later
6604when he got a call from another agent.
6605Special Agent Michael Schuler was a legend among the
6606bureau’s cybercrime agents. It was he who’d hacked into
6607the Russians’ computers in the Invita sting. Now stationed
6608in the Richmond, Virginia, field office, Schuler was calling
6609about a breach at nearby Capital One. The bank’s security
6610officials had detected an attack using an Internet Explorer
6611exploit. They’d sent Schuler a copy of the code, and he
6612wanted Mularski to get one of the NCFTA’s geeks to take a
6613look at it.
6614Mularski listened as Schuler described his investigation
6615to date. He’d focused on the fake news website,
6616Financialedgenews.com, used to deliver the malware. The
6617domain was registered to a false identity in Georgia. But
6618when the registrar, Go Daddy, checked its records, it found
6619the same user had once registered another address
6620through the company.
6621Cardersmarket.com.
6622Mularski recognized the significance at once. Iceman
6623positioned himself as the innocent operator of a website
6624that happened to discuss illegal activity. Now Schuler had
6625evidence that he was also a profit-oriented hacker, one
6626who’d broken into the network of the fifth-largest credit card
6627issuer in America. “Dude, you got the case!” Mularski
6628laughed. “You got the case right now on the guy we were
6629just trying to target on our Group II. We’ve got to work
6630together on this.”
6631Across town, Secret Service agents at the Pittsburgh
6632field office had made a discovery of their own about
6633Iceman: An informant tipped them off that Carders Market’s
6634kingpin had a second identity as the dumps vendor Digits.
6635Four days after the USA Today article, the agents
6636exploited that knowledge by having a second snitch make a
6637controlled buy from Digits: twenty-three dumps for $480 in
6638e-gold.
6639It was more than they needed for a felony charge.
6640
664129
6642One Plat and Six Classics
6643eith Mularski hadn’t known what he was in for when he
6644took over DarkMarket.
6645His days were crazy now. He’d start at eight in the
6646morning, logging in to his undercover computer at the office
6647and checking for overnight ICQ messages—any urgent
6648business for Master Splyntr. Then he’d hit DarkMarket and
6649make sure it was up and running. It was always hit-or-miss
6650with Iceman on the loose.
6651Next came the drudgery of backing up the SQL
6652database. Iceman had somehow dropped the tables twice
6653since his failed attempt to expose Mularski, so now the
6654backups were a part of Mularski’s morning routine. They
6655served an investigative function as well: While the database
6656was being copied, a simple script authored by an NCFTA
6657coder scanned every line for sixteen-digit numbers
6658beginning with the numerals 3 through 6. The stolen credit
6659card numbers would be automatically sorted by BIN and
6660sent to the proper banks for immediate cancellation.
6661Next, Mularski had to review all the private messages,
6662pick out the interesting chats, and check them into the FBI’s
6663central ELSUR electronic surveillance database. An hour or
6664two of report writing followed. As Master Splyntr, Mularski
6665had begun his own modest cash-out operation. Some
6666banks had agreed to issue him disposable dumps as bait,
6667with fake names but real lines of credit that the FBI would
6668cover out of its investigative budget. Mularski handed them
6669out with PINs to carders around the country, while the
6670financial institutions reported back daily on where and when
6671each withdrawal took place. Mularski had to pass the
6672information to the local agents in whatever city his cashers
6673were operating from, which meant writing up a detailed
6674memo each time.
6675At three, when the carders came online in force,
6676Mularski’s second life shifted into high gear. Everyone
6677wanted something from Master Splyntr. There were
6678disputes to settle, like a dumps vendor complaining that his
6679ad wasn’t displayed as prominently as a competitor’s, or a
6680vendor facing accusations of ripping off a customer.
6681Beggars approached him asking for free dumps or
6682spamming services.
6683Mularski went home at the end of the day, only to log on
6684again. Keeping his credibility as Master Splyntr meant he
6685had to work the same hours as a real carder, so every night
6686saw Mularski on the sofa at home, the television turned to
6687whatever was on, his laptop open and online. He was on
6688DarkMarket, and AIM, and ICQ, answering questions,
6689assigning reviewers, approving vendors, and banning
6690rippers. He stayed online and in character until two in the
6691morning, nearly every day, dealing with the underground.
6692To ingratiate himself to his primary targets, he’d give
6693them gifts or sell them discounted merchandise,
6694supposedly purchased with stolen credit cards but actually
6695paid for by the bureau. Cha0, a Turkish crime boss and
6696DarkMarket admin, coveted an $800 lightweight PC sold in
6697the States, so Mularski shipped two of them off to Cha0’s
6698drop address in Turkey. Playing Santa Claus was in his job
6699description now: He had to appear to be running ops and
6700making money, and he sure as hell wasn’t going to spam
6701anyone.
6702Being a cybercrime boss, he was discovering, was hard
6703work.
6704When he traveled or vacationed, he had to let the forum
6705know in advance—even a brief unexplained absence would
6706invite suspicion that he’d been busted and turned. In
6707January 2007, he let the board know that he’d be on a
6708plane for a while. He didn’t say where or why. He was going
6709plane for a while. He didn’t say where or why. He was going
6710to Germany to talk with prosecutors about DarkMarket’s
6711cofounder Matrix001.
6712Among other things, Matrix001 was DarkMarket’s
6713resident artist par excellence. He created and sold
6714Photoshop templates used by forgers to produce credit
6715cards or fake ID. He had them all: Visa, MasterCard,
6716American Express, Discover, the U.S. Social Security card,
6717notary seals, and driver’s licenses for several states. His
6718template for an American passport sold for $45. A Bank
6719One Visa was $125.
6720Matrix001 and Master Splyntr had grown tight since the
6721attempted exposé three months earlier: Mularski and the
6722German both liked video games, and they chatted about
6723the latest titles well into the night. They talked business, too,
6724and Matrix001 had confided that he received wire transfers
6725for some of his sales in the town of Eislingen in southern
6726Germany. That was the first clue to tracking him down.
6727From there, it was a matter of following the money. Like
6728virtually all carders, Matrix preferred to be paid by e-gold,
6729an electronic payment system created by a former Florida
6730oncologist named Douglas Jackson in 1996. A competitor
6731to PayPal, e-gold was the first virtual currency backed by
6732deposits of actual gold and silver bullion held in bank vaults
6733in London and Dubai.
6734It had been Jackson’s dream to forge a true international
6735monetary system independent of any government.
6736Criminals loved it. Unlike a real bank, e-gold took no
6737measures to verify the identity of its users—account holders
6738included “Mickey Mouse” and “No Name.” To get money in
6739or out of e-gold, users availed themselves of any of
6740hundreds of independent e-gold exchangers around the
6741world, businesses that would accept bank transfers,
6742anonymous money orders, or even cash in hand and
6743convert it to e-gold for a cut. Exchangers took another slice
6744when a user wanted to convert in the other direction,
6745changing the virtual money into the local currency or
6746receiving it by Western Union, PayPal, or wire transfer. One
6747company even offered a preloaded ATM card—the “GCard”—
6748that would let account holders withdraw their e-gold
6749from any cash machine.
6750By all evidence, criminals were e-gold’s bread and
6751butter. By December 2005, the company’s internal
6752investigations had identified more than three thousand
6753accounts involved in carding, another three thousand used
6754for buying and selling child porn, and thirteen thousand
6755accounts linked to various investment scams. They were
6756easy enough to spot: the “memo” field in child porn
6757transactions would read, for example, “Lolita”; in Ponzi
6758schemes, “HYIP,” for “high-yield investment program.”
6759Carders included shorthand descriptions of what they were
6760buying: “For 3 IDs”; “for dumps”; “10 classics”; “Fame’s
6761dumps”; “10 M/C”; “one plat and six classics”; “20
6762vclassics”; “18 ssns”; “10 AZIDs”; “4 v classics”; “four
6763cvv2s”; “for 150 classics.”
6764For a long time, e-gold largely turned a blind eye to the
6765criminal trade; employees locked down some accounts
6766used by child porn sellers but didn’t stop them from
6767transferring out their money. But the company’s attitude
6768changed dramatically in December 2005, when FBI and
6769Secret Service agents executed a search warrant at egold’s
6770Melbourne, Florida, offices and accused Jackson of
6771running an unlicensed money transfer service.
6772Jackson began voluntarily searching his database for
6773signs of criminality and sending tips to the only agency that
6774wasn’t trying to put him in jail, the U.S. Postal Inspection
6775Service. His newfound commitment to law and order was a
6776boon to Mularski. Through Greg Crabb and his team at the
6777post office, Mularski asked Jackson for information about
6778Matrix001’s e-gold account, which was under the alias
6779“Ling Ching.” When Jackson looked in his database, he
6780found that the account had originally been set up under
6781another name: Markus Kellerer, with a street address in
6782Eislingen. In November, Mularski sent a formal request for
6783Eislingen. In November, Mularski sent a formal request for
6784assistance to the German national police through the U.S.
6785consulate in Frankfurt. The police confirmed that Kellerer
6786was a real person and not just another alias, and Mularski
6787booked his flight to Stuttgart.
6788Matrix001 would be the first arrest from the DarkMarket
6789sting. Mularski would have to find someone else to chat
6790with about video games.
6791• • •
6792Once he was back in Pittsburgh, Mularski began working a
6793new, farfetched theory about Iceman. He’d been running
6794down every “Iceman” he could find—there’d been an
6795Iceman on Shadowcrew and others on IRC. They always
6796turned out to be red herrings. Now Mularski was toying with
6797the idea that his Iceman didn’t really exist.
6798It was Iceman’s supposed collaboration with the
6799Canadian informant Lloyd “Silo” Liske that intrigued him.
6800Silo had worked with Iceman to try to expose Mularski.
6801That, in itself, didn’t mean much—informants often call out
6802suspected cops and snitches to deflect suspicion from
6803themselves. But Silo had told his handler at the Vancouver
6804Police Department that he’d hacked Iceman’s computer,
6805yet when push came to shove, he couldn’t produce
6806Iceman’s real name or even a good Internet IP address.
6807And it turned out that Silo had dozens of e-gold accounts—
6808one of them under the name “Keyser Söze.”
6809If Liske was a fan of The Usual Suspects, it might occur
6810to him to create a phantom criminal mastermind and then
6811feed law enforcement false information about the supposed
6812kingpin in his role as an informant.
6813Mularski flew to Washington and presented his theory to
6814the Secret Service at their headquarters. It was shot down
6815at once. They were working closely with Silo’s handler at
6816the Vancouver Police Department, and they knew Silo as
6817one of the good guys.
6818The Secret Service had run down some false leads
6819themselves. In a lab in the Pittsburgh field office, the agents
6820had a whiteboard scrawled with handles and names
6821connected by squiggles and lines. Many of the names were
6822crossed out. It was their ever-changing road map to Iceman
6823and his world.
6824Mularski returned to Pittsburgh, and both agencies
6825resumed their search for the real Keyser Söze of the
6826cyberworld—the elusive hacking kingpin Iceman.
6827
682830
6829Maksik
6830ax could see what was coming. With an FBI agent at
6831the helm, DarkMarket was going to put a lot of carders in
6832prison. But like Cassandra from Greek mythology, he was
6833cursed to know the future and have nobody believe him.
6834Between the USA Today article and his failed attempt to
6835expose Master Splyntr, Max could feel the heat coming at
6836him. In November, he declared Iceman’s retirement and
6837made a show of handing control of the site to
6838Th3C0rrupted0ne. He secluded himself while things cooled
6839down and three weeks later took back the board under
6840another handle. Iceman was dead; long live “Aphex.”
6841Max was getting tired of the tight quarters at the Post
6842Street Towers, so Chris brought Nancy, one of his cashers,
6843up to San Francisco to rent Max a one-bedroom at
6844Archstone’s towering Fox Plaza corporate apartment
6845complex in the financial district. She posed as a sales
6846representative at Capital Solutions, a corporate front
6847Aragon used to launder some of his income. Tea, back
6848from her trip to Mongolia, was conscripted to sit in the
6849apartment and accept delivery of a bed, paid for with her
6850legitimate American Express card. Chris reimbursed her
6851afterward.
6852By January 2007, Max was back in business at his new
6853safe house, with a stew of Wi-Fi brewing outside. Fox
6854Plaza was a giant step up in luxury from the Post Street
6855Towers, but Max could afford it—he could pay a month’s
6856rent with a couple of good days of dumps vending. As
6857Digits, Max was now regarded by some carders as the
6858second-most-successful magstripe vendor in the world.
6859The number one spot was firmly occupied by a Ukrainian
6860known as Maksik. Maksik operated outside the carding
6861forums, running his own Web-based dispensary for his
6862stolen cards at Maksik.cc. Buyers would begin by sending
6863Maksik upfront money by e-gold, WebMoney, wire transfer,
6864or Western Union. That would buy them access to his
6865website, where they could select the dumps they wanted by
6866BIN and type of card and place an order. On his end,
6867Maksik would press a button to approve the transaction,
6868and the buyer would get an e-mail with the dumps he’d
6869ordered, straight from Maksik’s massive database of
6870stolen cards.
6871Maksik’s wares were phenomenal, with a high success
6872rate at the register and a mammoth selection of BINs. Like
6873Max’s, Maksik’s cards came from swipes at point-of-sale
6874terminals. But instead of targeting scores of small stores
6875and restaurants, Maksik got his cards from a smaller
6876number of giant targets: Polo Ralph Lauren in 2004; Office
6877Max in 2005. In three months, Discount Shoe Warehouse
6878lost 1.4 million cards taken from 108 stores in 25 states—
6879straight into Maksik’s database. In July 2005, a recordbreaking
688045.6 million dumps were stolen from the TJXowned
6881retail chains T. J. Maxx, Marshalls, and
6882HomeGoods.
6883There was a time when such breaches might have
6884remained a secret between the hackers, the companies,
6885and federal law enforcement—with the victim consumers
6886kept in the dark. To encourage companies to report
6887breaches, some FBI agents had an unofficial policy of
6888keeping company names out of indictments and press
6889releases, protecting corporations from bad publicity over
6890their shoddy security. In the 1997 Carlos Salgado Jr. case
6891—the first large-scale online credit card heist—the
6892government persuaded the sentencing judge to
6893permanently seal the court transcripts, for fear the targeted
6894company would suffer “loss of business due to the
6895perception by others that computer systems may be
6896perception by others that computer systems may be
6897vulnerable.” Consequently, the eighty thousand victims were
6898never notified that their names, addresses, and credit card
6899numbers had been offered for sale on IRC.
6900In 2003, the state of California effectively ended such
6901cover-ups when the legislature enacted SB1386, the
6902nation’s first compulsory breach-disclosure law. The law
6903requires hacked organizations doing business in the
6904Golden State to promptly warn potential identity theft
6905victims of a breach. In the years that followed, forty-five
6906other states passed similar legislation. Now no significant
6907breach of consumer data remains a secret for long, once
6908detected by the company and the banks.
6909The headlines over the giant retail breaches only added
6910luster to Maksik’s product—he didn’t try to hide the fact that
6911he was vending the dumps from the retail chains. When the
6912TJX attack made news in January 2007, the details that
6913emerged also confirmed what many carders already
6914suspected: the Ukrainian had a stateside hacker supplying
6915him with dumps. Maksik was a middleman for a mystery
6916hacker in the States.
6917In mid-2006, the hacker was apparently in Miami, where
6918he parked at two TJX-owned Marshalls outlets and cracked
6919the stores’ Wi-Fi encryption. From there, he hopped on the
6920local network and swam upstream to the corporate
6921headquarters, where he launched a packet sniffer to
6922capture credit card transactions live from the Marshalls, T.
6923J. Maxx, and HomeGoods stores around the country. The
6924sniffer, an investigation would later find, ran undetected for
6925seven months.
6926Max had a rival in America, and a damn good one.
6927Thanks in large part to Maksik’s hacker and Max Vision,
6928the popular consumer impression that Web transactions
6929were less secure than real-life purchases was now
6930completely false. In 2007, the majority of compromised
6931cards were stolen from brick-and-mortar retailers and
6932restaurants. The large retail intrusions were compromising
6933millions of cards at a time, but breaches at smaller
6934merchants were far more common—Visa’s analysis found
693583 percent of credit card breaches were at merchants
6936processing one million Visa transactions or less annually,
6937with the majority of thefts taking place at restaurants.
6938Max tried to keep the sources of his dumps a secret,
6939falsely claiming in his forum posts that the data came from
6940credit card processing centers to throw investigators off
6941track. But Visa knew that restaurant point-of-sale terminals
6942were being hit hard. In November 2006, the company
6943issued a bulletin to the food service industry warning about
6944hack attacks unfolding through VNC and other remoteaccess
6945software. Max, though, continued to find a steady
6946stream of vulnerable eateries.
6947But for Max, it wasn’t enough. He hadn’t gone into the
6948data-theft business to be second-best. Maksik was costing
6949him money. Even Chris was now buying from both Maksik
6950and Max, going with whichever vendor offered him a good
6951deal on the best dumps.
6952At Max’s direction, Tea befriended the Ukrainian over the
6953course of months and urged him to start vending on
6954Carders Market. Maksik declined graciously and
6955suggested she visit him sometime in Ukraine. Rebuffed,
6956Max took the gloves off and got Tea to send Maksik a
6957Trojan horse program, hoping to get control of the
6958Ukranian’s database of dumps. Maksik laughed off the
6959hacking attempt.
6960If he’d known, Max might have taken comfort in the fact
6961that he wasn’t the only one frustrated by Maksik’s tight
6962security.
6963Federal law enforcement had been tracking Maksik
6964since his rise to infamy in the wake of Operation Firewall.
6965An undercover Secret Service agent had been buying
6966dumps from him. Postal Inspector Greg Crabb had worked
6967with law enforcement in Europe to bust carders who’d done
6968business with Maksik, and he shared the resulting
6969information with the Ukrainian national police. In early 2006,
6970information with the Ukrainian national police. In early 2006,
6971the Ukranians finally identified Maksik as one Maksym
6972Yastremski, from Kharkov. But they didn’t have enough
6973evidence to make an arrest.
6974The United States refocused on identifying Maksik’s
6975hacking source. E-gold once again provided the entry
6976point. The Secret Service analyzed Maksik’s accounts in
6977the e-gold database and found that between February and
6978May 2006, Maksik had transferred $410,750 out of his
6979account to “Segvec,” a Mazafaka dumps vendor generally
6980thought to be in Eastern Europe. An outward transfer
6981implied Segvec wasn’t one of Maksik’s customers but a
6982supplier getting his cut.
6983The feds got a chance at more direct information in June
69842006, when Maksik was vacationing in Dubai. Secret
6985Service agents from San Diego worked with local police to
6986execute a “sneak-and-peek” in his room, where they
6987secretly copied his hard drive for analysis. But it was a
6988dead end. The sensitive material on the drive was all
6989encrypted with a program called Pretty Good Privacy. It
6990was good enough to stop the Secret Service in its tracks.
6991Carders like Maksik and Max were at the fore in embracing
6992one of the unheralded gifts of the computer revolution:
6993cryptography software so strong that, in theory, even the
6994NSA couldn’t crack it.
6995In the 1990s the Justice Department and Louis Freeh’s
6996FBI had tried hard to make such encryption illegal in the
6997United States, fearing that it would be embraced by
6998organized crime, pedophiles, terrorists, and hackers. It was
6999a doomed effort. American mathematicians had decades
7000before developed and published high-security encryption
7001algorithms that rivaled the government’s own classified
7002systems; the genie was out of the bottle. In 1991, a U.S.
7003programmer and activist named Phil Zimmerman had
7004released the free software Pretty Good Privacy, which was
7005available on the Web.
7006But that didn’t stop law enforcement and intelligence
7007officials from trying. In 1993, the Clinton administration
7008began producing the so-called Clipper Chip, an NSAdeveloped
7009encryption chip intended for use in computers
7010and telephones and designed with a “key recovery” feature
7011that would allow the government to crack the crypto on
7012demand, with the proper legal authority. The chip was a
7013dismal failure in the marketplace, and the project was dead
7014by 1996.
7015Then lawmakers began swinging the opposite direction,
7016talking about repealing Cold War–era export regulations
7017that classified strong encryption as a “munition” generally
7018prohibited from export. The regulations were forcing
7019technology companies to keep strong crypto out of key
7020Internet software, weakening online security; meanwhile,
7021overseas companies weren’t bound by the laws and were
7022in position to overtake America in the encryption market.
7023The feds responded with a draconian counterproposal
7024that would have made it a five-year felony to sell any
7025encryption software in America that lacked a back door for
7026law enforcement and government spies. In testimony to a
7027House subcommittee in 1997, a Justice Department lawyer
7028warned that hackers would be a prime customer of legal
7029encryption and used the Carlos Salgado bust to illustrate
7030his point. Salgado had encrypted the CD-ROM containing
7031the eighty thousand stolen credit card numbers. The FBI
7032had only been able to access it because the hacker gave
7033his supposed buyer the key.
7034“We were lucky in this case, because Salgado’s
7035purchaser was cooperating with the FBI,” the official
7036testified. “But if we had discovered this case another way,
7037law enforcement could not have penetrated the information
7038on Salgado’s CD-ROM. Crimes like this one have serious
7039implications for law enforcement’s ability to protect
7040commercial data as well as personal privacy.”
7041But the feds lost the crypto wars, and by 2005
7042unbreakable crypto was widely available to anyone who
7043unbreakable crypto was widely available to anyone who
7044wanted it. The predictions of doom had largely failed to
7045materialize; most criminals weren’t tech-savvy enough to
7046adopt encryption.
7047Max, though, was. If all his tradecraft failed and the feds
7048crashed through his safe house door, they’d find everything
7049he accumulated in his crimes, from credit card numbers to
7050hacking code, scrambled with an Israeli-made encryption
7051program called DriveCrypt—1,344-bit military-grade crypto
7052he’d purchased for about $60.
7053The government would arrest him anyway, he expected,
7054and demand his passphrase. He would claim to have
7055forgotten it. A federal judge somewhere would order him to
7056disclose the secret key, and he’d refuse. He’d be held on
7057contempt charges for maybe a year and then be released.
7058Without his files, the government wouldn’t have any
7059evidence of his real crimes.
7060Nothing had been left to chance—Max was certain. He
7061was untouchable.
7062
706331
7064The Trial
7065onathan Giannone, the Long Island carder Max and
7066Chris had discovered as a teenager, was keeping a secret
7067from everyone.
7068The same day Max had absorbed his competitors,
7069Secret Service agents had arrested Giannone at his
7070parents’ house for selling some of Max’s dumps to Brett
7071Johnson, the Secret Service informant known as Gollumfun.
7072Giannone was released on bail, but he told nobody about
7073the bust. To him, it was just a bump in the road—how much
7074trouble could he really get in for selling twenty-nine dumps?
7075The impression that he was facing a slap on the wrist
7076was bolstered when the judge in South Carolina lifted his
7077travel restrictions a month after his arrest. Giannone
7078promptly flew into Oakland Airport on a carding run, and
7079Tea picked him up and showed him around. They drove up
7080and down the Pacific Coast Highway, and she bought him
7081a pizza at Fat Slice on Berkeley’s Telegraph Avenue.
7082She’d always found Giannone amusing—a boastful, curlyhaired
7083white kid with hip-hop sensibilities who’d once
7084bragged that he’d beat up a member of the New York Jets
7085at a local bar. Now, though, they had something in common:
7086Chris had stopped talking to Giannone around the time of
7087his arrest, while Tea, for her part, had been ordered to
7088return to the Bay Area so she couldn’t make any more
7089trouble with Chris’s relationships. Chris had exiled them
7090both.
7091Chris called Tea while they were hanging out and was
7092surprised to hear that Giannone was in town. He had her
7093put Giannone on the phone. “So, you take my girls out to
7094party now?” he demanded, angry that Giannone was
7095forging a relationship with one of his people—perhaps
7096courting her for a cashing crew of his own.
7097“No, I just happen to be here and I looked her up,”
7098Giannone said a little defensively.
7099It would be Chris’s and Giannone’s last phone
7100conversation. Giannone flew home. He kept in touch with
7101Tea, and a few months later, he warned her that he might
7102not be a good person to be associating with. He was pretty
7103sure he’d been followed on his trip to the Bay Area.
7104“I got some heat on me right now,” Giannone said.
7105“What kind of heat?” Tea asked. Giannone liked to affect
7106an air of danger.
7107“I go to trial next week.”
7108Federal criminal trials are rare. Faced with the long prison
7109terms recommended by rigid sentencing guidelines, most
7110defendants opt to take a plea deal in exchange for a slightly
7111shortened sentence or limit their exposure by becoming an
7112informant. Some 87 percent of prosecutions were resolved
7113in this manner in 2006, the year of Giannone’s trial. In
7114another 9 percent of the cases, charges were dismissed
7115before reaching a trial, the government preferring to drop a
7116marginal case rather than risk a loss. Once a jury is seated,
7117a defendant’s chances for acquittal are about one in ten.
7118But Giannone liked his odds. Most cases don’t hinge on
7119the undercover work performed by an active computer
7120criminal. Soon after he’d snitched on Giannone, Brett
7121“Gollumfun” Johnson had gone on a four-month crosscountry
7122crime spree, pulling his IRS scam in Texas,
7123Arizona, New Mexico, Las Vegas, California, and Florida,
7124where he was finally nabbed in Orlando with nearly
7125$200,000 stuffed in backpacks in his bedroom. He wouldn’t
7126make a very good witness for the prosecution.
7127The bailiff passed out pads and pencils to the twelve
7128jurors, and the prosecutor began his opening statement,
7129adopting a down-home, country tone.
7130“I love the Internet,” he said. “The Internet is a fascinating
7131thing. It’s a place where we can entertain ourselves; we can
7132get information; we can watch videos; we can play games;
7133we can buy things. eBay is a great place, you can bid on
7134things. If you can think about it, you can buy it on eBay.
7135“But, ladies and gentlemen, there’s a side of the Internet
7136that we don’t like to think about. There’s kind of a dark
7137underbelly to the Internet, one where not trinkets or bobbles
7138are bought, sold, and traded. There’s a part of the Internet
7139where people’s lives are bought, sold, and traded.…
7140“You are going to see that side of the Internet. And I
7141suspect that you are never going to look at the Internet
7142exactly the same way again.”
7143The trial lasted three days. The prosecutor disposed of
7144Brett Johnson right out of the gate, acknowledging that
7145Gollumfun was a liar and a thief who’d betrayed the trust of
7146his Secret Service handlers. That was why the government
7147wasn’t calling him to testify. The prosecution’s “star
7148witness” would be the computer logs of Giannone’s chats
7149with the informant. The record would speak for itself.
7150Giannone’s lawyer did his best to attack the logs.
7151“Machines make mistakes.” He argued that because the
7152stolen credit cards were never fraudulently used, there were
7153no victims. He reminded the jurors that nobody died or
7154suffered physical harm.
7155After one day of deliberation, the verdict came in: guilty.
7156The first federal trial of the carding underground was over.
7157The judge ordered Giannone taken into custody.
7158A week later, Giannone was summoned from his cell at
7159the Lexington County Jail. He instantly recognized the
7160Secret Service agents waiting by the sally port, two steel
7161doors away from freedom; the two men had been
7162Johnson’s handlers, and they’d testified at Giannone’s trial.
7163“We want to know who this guy Iceman is,” one of them
7164said.
7165“Who’s Iceman?” Giannone answered innocently.
7166The situation was serious, the agents said; they’d
7167learned that Iceman had threatened to kill the president.
7168Giannone asked for his lawyer, and the agents phoned him
7169on the spot. The attorney consented to an interview in the
7170hope of winning leniency for his client at sentencing.
7171In a series of meetings over the next three weeks, the
7172agents pulled Giannone out of jail again and again, shuttling
7173him to the same field office where Gollumfun had
7174orchestrated his downfall. Unlike most carders, Giannone
7175had held his mud at his arrest and taken a chance on a trial
7176instead of cutting a snitch deal. But now he was looking
7177down the barrel of a five-year sentence. He was only
7178twenty-one years old.
7179Giannone told them everything he knew: Iceman lived in
7180San Francisco, did a brisk business in dumps, sometimes
7181used the aliases Digits and Generous to sell his goods. He
7182used hacked Wi-Fi to cover his tracks. A Mongolian
7183woman called Tea was his Russian translator.
7184Most crucially, he had a partner named Christopher
7185Aragon in Orange County, California. You want Iceman?
7186Get Chris Aragon.
7187The revelations electrified the agents tracking Iceman.
7188When Keith Mularski typed Chris Aragon’s name into the
7189FBI’s case management system, he found Werner Janer’s
71902006 proffer sessions, in which he’d named Chris’s dumps
7191supplier as a tall, ponytailed man he knew as “Max the
7192Hacker.” It got better. Way back in December 2005, Jeff
7193Norminton had been arrested for receiving Janer’s wire
7194transfer on behalf of Aragon. He’d told the FBI about
7195introducing Aragon to the superhacker Max Butler after his
7196release from Taft. The interviewing agent was only
7197interested in real estate fraud and hadn’t pursued the lead.
7198Now Mularski and his Secret Service counterparts had a
7199name. Giannone’s statements confirmed it. Iceman had told
7200Giannone that he was once raided as a suspect in the Half-
7201Life 2 source-code theft. Mularski ran another search and
7202saw there were only two U.S. search warrants executed in
7203that investigation: one against Chris Toshok, and one
7204against Max Ray Butler.
7205Iceman’s identity had been hidden in the government’s
7206computers all along. Giannone had given them the
7207password to unlock it.
7208Knowing Iceman’s identity wasn’t the same as proving it,
7209though. The feds had enough for a search warrant, but they
7210didn’t have the location of Max’s safe house. Worse,
7211Giannone had tipped them that Iceman used DriveCrypt.
7212That meant that even if they tracked down Max’s address,
7213they couldn’t count on finding evidence on his hard drive.
7214They could bust down Max’s door, then watch him walk out
7215of a courtroom twenty-four hours later on bail or a signature
7216bond. With an international network of fake ID vendors and
7217identity thieves at his beck and call, Max might vanish,
7218never to be seen again.
7219They needed to sew up the case before making a move.
7220Mularski decided Chris Aragon was the key. Thanks to
7221Norminton, they knew all about the wire transfer and real
7222estate fraud scheme he’d profited from almost five years
7223earlier. If they could nail Aragon for that, they could press
7224him to cooperate against Max.
7225Unaware of the net tightening around him, Max continued
7226his round-the-clock management of Carders Market as
7227“Aphex.” Not that his new identity was really fooling anyone.
7228He couldn’t resist carrying Iceman’s campaign against
7229DarkMarket’s leaders into his new persona, calling them
7230“idiots and incompetents” and circulating the evidence he’d
7231gathered against Master Splyntr. He was astonished that
7232so many people didn’t believe him. “DarkMarket is founded
7233and run by NCFTA/FBI for Christ sake!”
7234Th3C0rrupted0ne believed Max and gave up his status
7235on DarkMarket to work as a full-time admin on Max’s board
7236—he was devoting fourteen hours a day to the site now. But
7237Max didn’t trust him either. It was well-known that C0rrupted
7238lived in Pittsburgh, the home of the NCFTA.
7239Max had developed a new test function for possible
7240informants, and in March he’d tried it out on the carder,
7241announcing out of the blue that he was working with a
7242terrorist cell “and we should have a shot at killing President
7243Bush this coming weekend.” If C0rrupted was a fed, he’d
7244be obliged to discourage the notional assassination plot,
7245Max figured, or he’d ask for more details.
7246C0rrupted’s response briefly assuaged Max’s doubts.
7247“Good luck with the president thing. Make sure you get the
7248vice president as well. He is no better.”
7249There was a lot of work to do on the board. Carders
7250Market was hopping, with over a dozen specialized
7251vendors: DataCorporation, Bolor, Tsar Boris, Perl, and
7252RevenantShadow sold credit card numbers with CVV2s,
7253stolen variously from the United States, UK, and Canada;
7254Yevin vended California driver’s licenses; Notepad would
7255check the validity of dumps for a small fee; Snake Solid
7256moved U.S. and Canadian dumps; Voroshilov offered
7257identity thieves a service that could obtain a victim’s Social
7258Security number and date of birth; DelusionNFX vended
7259hacked online banking logins; Illusionist was Carders
7260Market’s answer to JiLsi, selling novelty templates and
7261credit card images; Imagine competed with EasyLivin’ in
7262the plastics trade.
7263Max tried to run a tight ship—a “military base,” one
7264carder critic groused. As in his white-hat days, he prized
7265intellectual honesty, refusing to grant special favor to even
7266his closest allies.
7267In April, C0rrupted prepared a review of Chris’s latest
7268generation of “novelty” IDs and plastics. He found them
7269wanting—for one thing, the signature strips were printed
7270right on the cards; you had to sign them with a felt-tip. He
7271right on the cards; you had to sign them with a felt-tip. He
7272thought the products were worth five stars out of ten, but he
7273asked Max if he should fluff his findings a little. “I know you
7274and Easylivin’ are close, so I wanted to know if I should post
7275a true opinion review about these things that I felt, or if I
7276should not be so harsh?”
7277“I think definitely post the truth, and if possible back it up
7278with pics etc.,” Max wrote back. “I am tight with Easylivin’,
7279but I think the truth is more important. Besides, if he is
7280covered for, and continues to ship poor quality (damn … it’s
7281really that bad?) then it will reflect badly on you and Carders
7282Market.”
7283A bad review would cost Chris money. But Max didn’t
7284hesitate when it came to the integrity of his crime site.
7285
728632
7287The Mall
7288hris pulled his Tahoe into the garage at Fashion Island
7289Mall in Newport Beach, parked, and got out with his new
7290partner, twenty-three-year-old Guy Shitrit. They walked
7291toward the Bloomingdale’s, fake American Express cards
7292in their wallets.
7293Originally from Israel, Shitrit was a handsome guitar
7294player and ladies’ man whom Chris had met on Carders
7295Market. Shitrit had been running a skimming operation in
7296Miami, recruiting professional strippers at work and
7297equipping them with exceedingly small skimming devices
7298to steal patrons’ magstripe data. When the strip-club
7299managers found out, Shitrit had to get out of town in a hurry.
7300He’d landed in Orange County, where Chris hooked him up
7301with a fake ID, a rental car, and an apartment at the
7302Archstone. Then they hit the stores.
7303Chris was close now, so close, to getting out. His wife,
7304Clara, had brought in $780,000 on eBay in a little over
7305three years: 2,609 Coach bags, iPods, Michele watches,
7306and Juicy Couture clothes. She had an employee working
7307twenty hours a week just shipping the ill-gotten
7308merchandise. Chris added to the take with his sales of
7309plastics and novelties on Carders Market, an enterprise
7310that wasn’t helped by Th3C0rrupted0ne’s nitpicking review.
7311Max, he felt, was ignoring the Whiz List, their blueprint for
7312building one big score and getting out. Chris had finally
7313figured it out: Max didn’t want to quit. He liked hacking; it
7314was all he wanted to do. So screw him. Chris had his own
7315exit strategy in place. He’d poured his profits into an
7316enterprise for Clara, a denim fashion company called
7317Trendsetter USA that already employed several full-time
7318workers at a bright, pleasant office in Aliso Viejo.
7319Eventually, he was certain, it would be profitable. And 100
7320percent legit.
7321Until then, he’d be busy.
7322Shitrit was a clotheshorse, and they’d already
7323squandered some of their stolen credit on men’s clothing
7324for him. On this visit, they’d stay focused. They walked into
7325the air-conditioned coolness of the Bloomingdale’s and
7326made a beeline for Ladies’ Handbags. The Coach purses
7327rested on small shelves along one wall, individually spotlit
7328like museum exhibits. Chris and Guy each picked some out
7329and went to the register. After some swipes at the point-ofsale
7330terminal, they were headed for the door with $13,000
7331worth of Coach in their hands.
7332Chris was breaking his own rules by going in-store
7333himself, but his crew was suddenly thinning. Nancy, who’d
7334helped set up Max’s new safe house, had since moved to
7335Atlanta and was doing only a little cashing there. Liz was
7336becoming paranoid—she was constantly accusing Chris of
7337ripping her off, conveying her displeasure in meticulous,
7338hand-drawn spreadsheets summing up how much Chris
7339owed her for each in-store appearance: $1,918 from a trip
7340to Vegas; $674 for iPods and GPS systems; $525 for four
7341Coach purses worth $1,750. The “amount paid to me”
7342column was zeroes all the way down. In the meantime, his
7343newest recruit, Sarah, was balking at big-ticket items,
7344though she was still useful for running errands. On
7345Valentine’s Day she bought Chris’s presents for his wife
7346and his girlfriend.
7347With the demands of vending, starting a legitimate
7348business, and trying to resuscitate his crew, Chris now
7349found it more efficient to pay someone else to make his
7350plastic. He’d met Federico Vigo at UBuyWeRush. Vigo
7351was looking for a way to pay down a $100,000 debt to the
7352Mexican Mafia, after accepting that amount in front money
7353to import a pallet of ephedra from China, only to have the
7354to import a pallet of ephedra from China, only to have the
7355product intercepted at the border. Chris put him to work.
7356The counterfeiting gear was moved from the Tea House to
7357Vigo’s office in Northridge, and one of Chris’s gophers was
7358running out to the Valley a couple of times a week to collect
7359the latest batch of credit cards hot off the presses, paying
7360Vigo $10 for each card.
7361Chris and Guy left the Bloomingdale’s and kept their
7362unhurried pace back to the SUV. Chris popped the back
7363and found a place for the new purchases amid a dozen
7364plain brown department store bags already jostling for
7365space, each filled with purses, watches, and a smattering
7366of men’s clothing. He closed up; they got into the car and
7367started planning their next stop.
7368They were still planning when a white police cruiser
7369zoomed into the garage. It stopped near them and
7370disgorged two uniformed Newport Beach Police
7371Department officers.
7372Chris’s heart sank. Another bust.
7373The police booked Chris at the Newport Beach Police
7374Station just down the road from the mall, then searched his
7375car, turning up seventy credit cards and small amounts of
7376Ecstasy and Xanax. Once he was fingerprinted, Chris was
7377ushered into an interrogation room, where Detective Bob
7378Watts handed him a Miranda waiver.
7379Chris signed and launched into the same basic story that
7380had gotten him out of serious trouble in San Francisco a
7381few years earlier. He promptly admitted his real name and
7382confessed with evident shame to using counterfeit credit
7383cards at Bloomingdale’s and elsewhere. It was the
7384economy, he said. He’d worked in the mortgage industry
7385and was hit hard when the real estate market collapsed.
7386That’s when the head of an Orange County carding ring
7387recruited him to card merchandise for a small percentage
7388of the profits. He was just a mule.
7389It was a familiar tale to Watts, who’d busted low-level
7390cashers before. It even explained Aragon’s amateurish
7391Bloomingdale’s run—gobbling up thousands of dollars’
7392worth of Coach bags at once. Bloomingdale’s security
7393people didn’t like to upset the store’s customers, so when
7394they had a suspicious one, they normally called Watts or his
7395partner, who’d arrange for a discreet traffic stop on a
7396“vehicle code violation” to check out the suspect away from
7397the store. If the shopper was innocent, they’d never know
7398that Bloomingdale’s had called the cops on them. Chris’s
7399and Shitrit’s behavior, though, was so blatant that the store
7400had no worries that they might be innocent. The security
7401team called the police dispatch desk directly to make sure
7402the men didn’t get out of the parking lot.
7403But Watts wasn’t buying Chris Aragon’s hard-luck story.
7404He’d been a detective for only eight months but a cop for
7405seven years; the first thing he’d done when Aragon came in
7406was run him through NCIC. He’d seen that Chris’s criminal
7407record stretched back to the seventies, and technically, he
7408was still on probation from his most recent bust in San
7409Francisco—for credit card fraud.
7410He figured he had a ringleader in his holding cell. He got
7411a search warrant in a hurry and converged with a team of
7412detectives and uniformed cops at the only address he could
7413find for Chris: Trendsetter USA. One look at the baffled
7414faces of the employees as the cops stormed the door told
7415Watts they were innocent. After some questioning, one of
7416the workers mentioned that their boss, Clara, ran an eBay
7417business in the back office.
7418Watts opened the storage cabinets in back and took
7419inventory: thirty-one Coach bags, twelve new Canon
7420PowerShot digital cameras, several TomTom GPS
7421navigators, Chanel sunglasses, Palm organizers, and
7422iPods, all new in the box.
7423Clara walked into the office in the middle of the search
7424and was promptly arrested. In her purse, Watts found
7425several utility bills for an address in Capistrano Beach, all in
7426different names. Clara reluctantly admitted she lived there;
7427different names. Clara reluctantly admitted she lived there;
7428her face fell when Watts told her it was his next stop.
7429With Clara’s house keys and a new search warrant in
7430hand, the detectives arrived at the Aragon home and began
7431their search. In Chris’s home office, they found an unlocked
7432safe in the closet. Inside were two plastic index-card cases
7433crammed with counterfeit cards. There were more cards in
7434the bedroom, bundled in rubber bands and stashed in the
7435night table. An MSR206 rested on a shelf in the family
7436room, and in the connecting garage, a box of purses sat on
7437the floor next to the fitness machine.
7438Aside from the dining room and bathrooms, the only
7439space in the house clean of evidence was the boys’
7440comfortable bedroom. Just two twin beds, side by side,
7441some stuffed animals and toys.
7442For all his talk about credit card fraud as a victimless
7443crime, Chris had overlooked the two most vulnerable
7444victims of his conduct. They were four and seven, and their
7445dad wasn’t coming home.
7446
744733
7448Exit Strategy
7449hat’s a fed,” Max said, indicating a sedan passing
7450them on the street. Charity glanced skeptically at the Ford.
7451American-made cars were just one of the many things that
7452alarmed Max these days.
7453Weeks had passed since Chris’s arrest, and reading the
7454press coverage from Orange County, Max couldn’t get over
7455how much evidence the police had found in Aragon’s
7456home. Using Chris’s payout sheets as a road map, the
7457cops had rounded up his entire cashing crew; even Marcus,
7458Chris’s pot grower and errand boy, was busted with a
7459hydroponic dope farm growing in his Archstone apartment.
7460After two weeks of hunting, the police converged on Chris’s
7461credit card factory at Federico Vigo’s office in the Valley,
7462arrested Vigo, and seized the counterfeiting gear. Chris
7463was being held on a million dollars’ bail.
7464The entire operation had been dismantled piece by
7465piece. They were calling it perhaps the largest identity-theft
7466ring in Orange County’s history.
7467“Shit, I wonder what kind of records he kept on all that,”
7468Max later wrote The3C0rrupted0ne. “I mean, if he was
7469sloppy enough to have equipment at his house.”
7470Max had already ditched his prepaid cell phone and
7471instituted a “security ban” on his former partner’s Carders
7472Market account. They were routine precautions—he was
7473largely unconcerned about the bust at first; it was, after all,
7474just a state case. Chris had been caught red-handed at the
7475W, too, and that time he walked away with probation.
7476But as the weeks passed with Chris still in jail, Max
7477started to worry. He was noticing strange cars parked on
7478his street—an animal control van aroused his suspicion so
7479much he got out a flashlight to peer in the windows. Then a
7480San Francisco FBI agent called him out of the blue to
7481inquire about Max’s long-dead arachNIDS database. Max
7482decided to invest in a rope ladder; he kept it by the back
7483window of the apartment he shared with Charity, in case he
7484had to get out fast.
7485He’d pause every now and then to reflect on his freedom
7486—here he was, enjoying life, hacking, while at that very
7487moment Chris was in a jail cell in Orange County.
7488Max picked a random San Francisco criminal defense
7489attorney from the yellow pages, walked into his office, and
7490handed over a pile of cash; he wanted the lawyer to travel
7491to Southern California to check on Chris and see if there
7492was anything he could do. The attorney said he’d look into
7493it, but Max never heard back from him.
7494It was then that Max finally learned about Giannone’s bust
7495from a news article about Brett Johnson’s life as an
7496informant. Max had lost track of Giannone, and for all his
7497hacking, Max had never thought to run the names of his
7498associates through the public federal court website. The
7499news that Giannone had lost a criminal trial worried him.
7500“Of all the rat snitch piece of shit motherfuckers out there,
7501Giannone is the closest to being able to finger me for the
7502feds,” he confided in a post to the private administrators’
7503forum on Carders Market. “The little dipshit might actually
7504be able to get the feds close to me.”
7505Max uprooted from Fox Plaza, hiding his equipment at
7506home until he was set up with a new sanctuary. On June 7,
7507he picked up the keys at the Oakwood Geary, another
7508corporate apartment building carved out of gleaming
7509marble in the Tenderloin. He was “Daniel Chance” now, just
7510another displaced software drone relocating to the Bay
7511Area. The real Chance was fifty years old and bearded,
7512while Max was clean shaven with long hair—but the fake
7513driver’s license and genuine money order were enough to
7514get him in.
7515get him in.
7516The next evening, Max checked out a red Mustang from
7517his neighborhood Zipcar and packed it with his computer
7518gear. For all his paranoia, he didn’t notice the Secret
7519Service agents tailing him on the drive to the Oakwood and
7520watching from the street as he moved into his new safe
7521house.
7522A month later, Max jolted awake, shot upright in bed, and
7523blinked into the darkness of the flat. It was just Charity; she
7524had crawled into bed next to him, trying in vain not to wake
7525him. He was growing jumpier every day.
7526“Sweetie, you can’t keep doing this,” Charity murmured.
7527“You may not realize it, but I realize it. I can see it. You’re
7528getting too sucked into it mentally. You’re losing focus of
7529who you are and what you’re doing.”
7530“You’re right,” he said. “I’m done.”
7531A lot of time had passed since his last prison term, he
7532thought. Maybe he could find honest work again. NightFox
7533had already offered him a legitimate job in Canada, but
7534he’d turned it down. He couldn’t bring himself to leave
7535Charity. He’d been contemplating marriage, playing with
7536the idea of luring her to Las Vegas on a vacation and
7537popping the question there. She was fiercely independent,
7538but she couldn’t argue that he hadn’t given her space.
7539It was time, he decided, for Max Vision, white hat, to
7540return. It would be official. He visited the San Francisco
7541courthouse and filled out the necessary paperwork. On
7542August 14, a judge approved his legal name change from
7543Max Butler to Max Ray Vision.
7544He already had an idea for a new website that could
7545catapult him back into the white-hat scene: a system for
7546disclosing and managing zero-day vulnerabilities. He could
7547seed it with the security holes he was privy to in the
7548underground, bringing the exploits into the white-hat world
7549like a defector crossing Checkpoint Charlie with a suitcase
7550full of state secrets.
7551But after all his work making Carders Market the top
7552crime forum in the English-speaking world, he couldn’t
7553bring himself to just abandon it.
7554Max returned to his safe house. It was August, and the
7555heat was back—the temperature topped 90 degrees
7556outside, and higher in his studio. His CPU was threatening
7557to burn itself alive. He turned on his fans, sat at his
7558keyboard, and began the work of phasing out his Digits
7559and Aphex identities.
7560He logged on to Carders Market and, as Digits, posted a
7561note that he was shunting his dumps vending to
7562Unauthorized, one of his admins. Then, as Aphex, he
7563announced that he was retiring from carding and was
7564selling Carders Market. He let the announcement sit for a
7565few minutes and then took down the site. When he brought
7566it back up, Achilous, one of his administrators in Canada,
7567was in charge. Max created a new, generic handle for
7568himself, “Admin,” to help Carders Market’s new kingpin
7569during the transition.
7570He was still working on his exit strategy when an instant
7571message popped up on his screen. It was from Silo, the
7572Canadian carder who was always trying, and failing, to
7573hack him. Max had tracked him down and identified him as
7574Lloyd Liske in British Columbia. He suspected Liske was
7575an informant.
7576The note was odd, a long sentence about newbies
7577making dumb mistakes. But Silo had hidden a second
7578message within it by strategically capitalizing nine of the
7579letters.
7580They spelled out “MAX VISION.”
7581A guess, Max thought. Silo couldn’t possibly know
7582anything.
7583It was just a guess.
7584• • •
7585The day after Max announced his retirement, Secret
7586Service agent Melissa McKenzie and a federal prosecutor
7587from Pittsburgh flew to California to tie up some loose
7588ends.
7589The investigation was nearly complete. The Secret
7590Service had gotten ahold of Digits’s e-mail from a contact
7591at the Vancouver Police Department—Silo’s handler. Max
7592had been using a Canadian-based webmail provider called
7593Hushmail that provides high-security encryption, using a
7594Java applet that decrypts a customer’s messages right on
7595his own PC instead of the company’s server. In theory, the
7596arrangement ensures that even Hushmail can’t get at a
7597customer’s secret key or incoming e-mail messages. The
7598company openly marketed the service as a way to
7599circumvent FBI surveillance.
7600But, like e-gold, Hushmail was another formerly crimefriendly
7601service now being mined by law enforcement. U.S.
7602and Canadian agencies had been winning special orders
7603from the Supreme Court of British Columbia that forced
7604Hushmail officials to sabotage their own system and
7605compromise specific surveillance targets’ decryption keys.
7606Now the feds had Max’s e-mail.
7607At the same time, the agency had located Tea living in
7608Berkeley serving a probation sentence—it turned out she’d
7609been caught using Aragon-produced gift cards at the
7610Emeryville Apple Store months earlier. It was supposed to
7611be a training run for one of Chris’s new recruits, but Tea
7612had never cashed before, and when she impulsively added
7613a PowerBook to her iPod purchase, she was arrested
7614along with the trainee. Eager to avoid more trouble, she’d
7615told the Secret Service everything she knew.
7616Meanwhile, the Secret Service had begun sporadic
7617physical surveillance of Max. From Werner Janer’s proffers,
7618Mularski had learned that Max had a girlfriend named
7619Charity Majors. Public records provided her address, and a
7620subpoena of her bank records showed she had a joint
7621account with Max. The Secret Service staked out the house
7622and eventually trailed Max to the Oakwood Geary.
7623Electronic surveillance confirmed that Max was operating
7624from the Oakwood. The FBI had won a secret court order
7625letting them electronically monitor the IP addresses
7626connecting to Carders Market’s false front at a U.S. hosting
7627company—the modern equivalent of taking down the
7628license plates outside a mob hangout. Several traced back
7629to broadband subscribers living within a block of the
7630corporate apartment complex and running Wi-Fi.
7631Two weeks earlier, a female Secret Service agent
7632disguised as a maid had ridden up the elevator with Max
7633and watched him unlock apartment 409. The apartment
7634number was the last piece of data they’d needed.
7635There was just one more stop before they’d move in: the
7636Orange County Central Men’s Jail, a grim lockup in the flat,
7637sun-baked center of Santa Ana, California. McKenzie and
7638federal prosecutor Luke Dembosky were shown to an
7639interview room to meet Chris Aragon.
7640Chris was the last holdout in the Orange County crew.
7641Clara and six members of his crew were headed to plea
7642deals that would ultimately net them from six months to
7643seven years in prison. Clara would get two years and eight
7644months. Chris’s mother was looking after the two boys.
7645Once the introductions were made, McKenzie and
7646Dembosky got down to business. They couldn’t do anything
7647about Chris’s state case, but if he cooperated, he’d have a
7648nice letter in his file from the U.S. government attesting that
7649he’d helped in a major federal prosecution. That could sway
7650the judge at sentencing time. It was all they could do.
7651McKenzie produced a photo lineup and asked Chris if
7652anyone looked familiar.
7653Chris’s situation was grim. With his bank robberies and
7654drug-smuggling convictions, he was eligible for California’s
7655tough three-strikes law. That meant a mandatory twentyfive-
7656to-life.
7657Chris picked out Max’s mugshot from the photos. And
7658then he told the feds the story of Max Vision’s drift to the
7659dark side.
7660• • •
7661On Wednesday, September 5, 2007, Max dropped Charity
7662at the post office on an errand and directed his cab driver
7663downtown to the CompUSA store on Market Street. He
7664picked up a new fan for his CPU, walked to his apartment,
7665stripped down, and crashed out on his bed amid a tangle of
7666unfolded laundry. He settled into a deep slumber.
7667Max had stopped hacking, but he was still disentwining
7668himself from his double life—after five years, he had a lot of
7669relationships and ventures that he couldn’t just sever
7670overnight.
7671He slept right through the knock at his door at about two
7672p.m. Then the door flew open, and a half-dozen agents
7673rushed into the room, guns drawn, shouting orders. Max
7674bolted upright and screamed.
7675“Put your hands where I can see them!” an agent yelled.
7676“Lay down!” The agent was positioned between Max and
7677his computers. Max had often thought that, in a raid, he
7678might be able to pull the plug on his server, making his
7679already formidable cyberdefenses completely bulletproof.
7680Now that it was really happening, he realized that diving for
7681his machines wasn’t an option, unless he wanted to be
7682shot.
7683Max recovered his composure. Unplugged or not, his
7684machines were locked down, and his encryption was rock
7685solid. He managed to relax a little as the agents let him get
7686dressed, then walked him down the hall in handcuffs.
7687On the way, they passed a three-man team who’d been
7688waiting for the Secret Service to secure the safe house.
7689They weren’t feds; they were from Carnegie Mellon
7690University’s Computer Emergency Response Team, and
7691they were there to bust Max’s crypto.
7692It was the first time CERT had been invited to a raid—but
7693the circumstances were special. Chris Aragon had
7694employed the same DriveCrypt whole-disk-encryption
7695software that Max used, and neither the Secret Service nor
7696CERT had been able to recover anything from the drive.
7697Full-disk encryption keeps the entire hard drive encrypted
7698at all times: all the files, the file names, the operating
7699system, the software, the directory structure—any clue to
7700what the user has been doing. Without the decryption key,
7701the disk might as well have been a Frisbee.
7702The key to cracking a full-disk encryption program is to
7703get at it while it’s still running on the computer. At that point,
7704the disk is still fully encrypted, but the decryption key is
7705stored in RAM, to allow the software to decrypt and encrypt
7706the data from the hard drive on the fly.
7707The knock on Max’s door had been intended to draw
7708Max away from his machines; if he’d shut them down
7709before the Secret Service got the cuffs on, there wouldn’t
7710have been much CERT could do—the contents of the RAM
7711would have evaporated. But Max had been caught napping,
7712and his servers were still running.
7713CERT had spent the last two weeks gaming out different
7714scenarios for what they might encounter in Max’s safe
7715house. Now the team leader looked over the setup: Max’s
7716server was wired to half a dozen hard drives. Two had lost
7717power when an agent tripped over an electrical cable
7718snaking across the floor, but the server itself was still
7719running, and that was what mattered.
7720While Secret Service flashbulbs bounced off the walls of
7721Max’s cluttered apartment, the forensics experts moved to
7722the machines and began their work, using memoryacquisition
7723software they’d brought with them to suck down
7724the live data from the RAM onto an external storage device.
7725Down the hall, Max cooled his heels in the feds’
7726apartment.
7727Two agents watched over him. Max would be questioned
7728later—for now, the agents were just babysitting, chatting
7729with one another. The Secret Service agent was from the
7730local San Francisco field office; he asked his FBI
7731local San Francisco field office; he asked his FBI
7732counterpart where he worked.
7733“I’m from Pittsburgh,” Keith Mularski answered.
7734Max’s head snapped to look at Master Splyntr. There
7735was no doubt who had won the carder war.
7736The Secret Service agents exulted over the bust. “I’ve
7737been dreaming about you,” agent Melissa McKenzie said
7738as she drove Max to the field office. On seeing his raised
7739eyebrow, she added, “I mean about Iceman. Not you
7740personally.”
7741Two of the local agents were dispatched to Charity’s
7742house. They told her what happened and took her
7743downtown to say good-bye to Max.
7744“I’m sorry,” he told her when she walked in. “You were
7745right.”
7746Max talked to the agents at the field office for a while,
7747trying to feel them out for what they knew and gauge how
7748much trouble he was in. Some of them seemed surprised
7749at his politeness—his sheer likability. Max wasn’t what they
7750expected from the cold, calculating kingpin they’d been
7751tracking for a year.
7752On the drive to jail, McKenzie finally voiced her
7753puzzlement. You seem like a nice guy, she said, and that’s
7754going to help you. “But I have this one question for you.…
7755“Why do you hate us?”
7756Max was speechless. He never hated the Secret
7757Service, or the FBI, or even the informants on Carders
7758Market. Iceman did. But Iceman was never real; he was a
7759guise, a personality Max slipped on like a suit when he was
7760in cyberspace.
7761Max Vision never hated anyone in his life.
7762The Hungry Programmers were the first to hear the news
7763that Max had been arrested again. Tim Spencer offered to
7764sign for Max’s bail bond. For collateral, he had twenty acres
7765of land in Idaho that he’d bought as his dream retirement
7766property. When Tim heard the details of the charges
7767against his old friend, he hesitated. What if he didn’t really
7768know Max at all?
7769The moment of doubt passed, and he signed the form.
7770Max’s mother offered to post the equity in her house as well
7771to secure her son’s release. Ultimately, though, it didn’t
7772matter. When Max came up for arraignment in San Jose, a
7773federal magistrate ordered the hacker held without bail
7774pending his transport to Pittsburgh.
7775The government announced Iceman’s arrest on
7776September 11, 2007. The news hit Carders Market,
7777sparking a flurry of activity. Achilous immediately deleted
7778the entire database of posts and private messages, not
7779knowing the feds already had it. “I think the SQL database
7780almost had a heart attack when I did it, but it’s done now. I
7781think this is what Aphex would have wanted,” he wrote.
7782“This forum is open for posting, so people can chat and
7783figure out where to go from here. Just be very careful,
7784specifically about following links. Try to keep the conspiracy
7785theories to a minimum everyone, please.
7786“Good luck, be safe.”
7787Silo jumped in under an alias to wrongly label his former
7788rival a snitch, based on news reports that misunderstood
7789Max’s work for the FBI during his white-hat days. “It’s sad to
7790see a brilliant guy go,” he wrote. “He brought a lot to this
7791board and the scene as a vendor and an administrator. A
7792lot of guys made a lot of money from him.”
7793But “once a rat always a rat,” he wrote, with no trace of
7794irony. “This whole board is spawned out of the fact that
7795years ago the FBI and Aphex had a disagreement on
7796whom he was snitching out.… Bottom line, he is the biggest
7797hypocrite to ever grace the scene.”
7798Back at his desk in Pittsburgh, Mularski put on Master
7799Splyntr’s black hat to join the postgame analysis. The FBI
7800agent knew full well that Iceman hadn’t been an informant,
7801but his alter ego would be expected to seize on the news
7802that Max had once worked with the feds. “Oh just where do I
7803even begin?” He gloated on DarkMarket, enjoying the
7804even begin?” He gloated on DarkMarket, enjoying the
7805moment. “Let’s see … let’s see … How about with this
7806headline from SFGate.com? And I quote, ‘Ex-FBI snitch in
7807S.F. indicted in hacking of financial institutions.’
7808“Did anyone else notice anything about that headline?
7809Ahh yeah, FBI Snitch. This is turning out to be just like
7810Gollumfun and El. No wonder why Iceman always had a
7811hard-on for them, because he was just like them and was
7812competing for his handlers’ praises.”
7813When Max arrived in Pittsburgh, his new public defender
7814tried again to get him released on bail, but the judge
7815refused after prosecutors speculated that Max was sitting
7816on vast stores of hidden cash and could easily use his
7817contacts to disappear with a new name. To prove that he’d
7818tried to evade the feds, they played their trump card: private
7819messages written by Max himself describing his use of
7820false IDs while traveling and his “evasive move” to his final
7821safe house. Max had sent the messages to a Pittsburgh
7822Secret Service informant who’d been an admin on Carders
7823Market for a full year.
7824Max wasn’t at all surprised to see that it was
7825Th3C0rrupted0ne.
7826
782734
7828DarkMarket
7829he man is sitting rigid on a polished wooden chair and
7830staring balefully into the camera. Paint peels from a
7831cracked plaster wall behind him. He’s been stripped down
7832to his underwear, and he’s holding a handwritten sign over
7833his exposed paunch. I AM KIER, it reads, in large block
7834letters. MY REAL NAME IS MERT ORTAC.… I AM RAT. I AM PIG. I AM
7835FUCKED BY CHA0.
7836The appearance of the photo on DarkMarket in May
78372008 sent Mularski hurrying back into the NCFTA
7838communications room. Headquarters would want to know
7839that one of Master Splyntr’s admins had just kidnapped and
7840tortured an informant.
7841Cha0 was an engineer in Istanbul who sold high-quality
7842ATM skimmers and PIN pads to fraudsters around the
7843world. Covertly affixed to a cash machine, the skimmer
7844would record the magstripe data on every debit or credit
7845card fed into the ATM, while the PIN-pad overlay stored the
7846user’s secret code.
7847Cha0 cut a jaunty presence in the underground. His
7848Flash-animated banner ad on DarkMarket was a classic,
7849opening with a cartoon man wading through a house full of
7850cash. “Is that you?” the text asks. “Yes. If you bought a
7851skimmer and PIN pad from Cha0.” A similarly styled video
7852tutorial for new customers was narrated by a smiling
7853caricature of Cha0 himself. “Hi, my name is Cha0. I’m a
7854developer of skimming devices. I work for you twenty-four
7855hours a day and make the best devices for skimming. You’ll
7856be able to make money in this business with me and my
7857group. We make these devices for newbies—it’s that easy
7858to use!” The animated Cha0 goes on to offer practical
7859advice: Don’t install your skimmer in the morning, because
7860passersby are more vigilant at that time. Don’t choose a
7861location where 250 people or more pass a day. Avoid
7862cities with a population less than 15,000—residents know
7863too well what the ATM is supposed to look like and might
7864notice Cha0’s product.
7865Notwithstanding his whimsical marketing, Cha0 had
7866always made it clear to his friend Master Splyntr that he
7867was a serious criminal, not afraid to get physical to protect
7868his multimillion-dollar business. Now he’d proven it. Mert
7869“Kier” Ortac had been part of Cha0’s organization, the
7870Crime Enforcers, until he went running to a Turkish TV
7871station to blab about Cha0’s activities. After a couple of
7872interviews, he vanished. When he resurfaced a short time
7873later, he told a harrowing story about being abducted and
7874beaten by Cha0 and his henchmen.
7875Now Cha0 had confirmed the tale by posting the kidnap
7876photo to DarkMarket as a warning to others.
7877The image put proof to the FBI’s long-held suspicions
7878that the computer underground was getting violent. With
7879hundreds of millions of dollars pouring into the scene every
7880year, it had seemed inevitable that the carders would take
7881on the brutal methods of traditional organized crime to
7882enlarge or protect their illegal income.
7883With Max safely locked up in an Ohio detention center,
7884DarkMarket had been free to grow, and Mularski was
7885closing in on its heaviest hitters—Cha0 among them. A
7886Turkish cybercrime detective had spent three months at the
7887NCFTA on a fellowship and was working with Mularski to
7888run down the skimmer maker.
7889Mularski had sent Cha0 two lightweight PCs as a gift the
7890previous year, opening the first door in the investigation.
7891Cha0 had directed the shipment to flunkies in his
7892organization, who were promptly put under surveillance by
7893the Turkish National Police. That led to Cagatay Evyapan,
7894an electrical engineer with a prior criminal record—details
7895an electrical engineer with a prior criminal record—details
7896that jibed with the biography Cha0 had shared privately with
7897Mularski.
7898The police approached several international shipping
7899companies and briefed them about Cha0’s operations.
7900One of them identified some of the skimmer shipments
7901from Istanbul to Europe, fingering a known member of
7902Cha0’s organization as the shipper.
7903That gave the police the evidence they needed. On
7904September 5, five police in bulletproof vests raided Cha0’s
7905apartment on the outskirts of Istanbul. They rushed into his
7906house and pushed Cha0 and an associate to the ground at
7907gunpoint.
7908Inside his apartment was a complete electrical lab and
7909assembly line, with components neatly organized in trays
7910and bins. Nearly a dozen computers were running on the
7911desks. Cha0 had all the same card-counterfeiting
7912equipment that had graced Chris Aragon’s factory, as well
7913as giant cardboard boxes holding some one thousand
7914skimmers and two thousand PIN pads, all awaiting
7915international shipment. Cha0’s records showed that four of
7916them had already gotten into the United States.
7917The cops brought Evyapan out in handcuffs, a tall, beefy
7918man with close-cropped hair and a black T-shirt
7919emblazoned with the Grim Reaper. The face of organized
7920crime in the Internet age.
7921Cha0 was the last listed target in Mularski’s undercover
7922authorization; the other key DarkMarket players had
7923already been taken down. Markus Kellerer, Matrix001, was
7924arrested in Germany in May 2007 and spent four months in
7925a high-security prison. Renukanth “JiLsi” Subramaniam, a
7926Sri Lankan–born British citizen, was raided in London in
7927June 2007 after detectives with the Serious Organised
7928Crime Agency in Britain staked out the Internet café he
7929used as an office, matching his appearances at the Java
7930Bean with JiLsi’s posts on DarkMarket and his chats with
7931Master Splyntr. JiLsi’s associate, sixty-seven-year-old John
7932“Devilman” McHugh, was picked up at the same time;
7933police found a credit card counterfeiting factory in the
7934senior citizen’s home.
7935In Turkey, six members of Cha0’s organization were
7936charged along with Cha0. With Mularski’s help, the police
7937also swooped in on Erkan “Seagate” Findikoglu, a
7938DarkMarket member who ran a massive King Arthur–style
7939cash-out operation responsible for at least two million
7940dollars in thefts from U.S. banks and credit unions—they
7941recovered one million of it in cash at his arrest. Twentyseven
7942members of Seagate’s organization were charged in
7943Turkey, and the FBI rounded up six of his cashers in the
7944United States.
7945With Cha0 and Seagate in jail, Mularski’s work was done
7946—his two years running DarkMarket had now resulted in
7947fifty-six arrests in four countries. On Tuesday, September
794816, 2008, he drafted a post formally announcing the closure
7949of the site. As an homage to the carding world’s history and
7950culture, the FBI agent borrowed from King Arthur’s
7951legendary message closing Carder Planet years before.
7952“Good day, respected and dear forum members,” he
7953began.
7954It is time to tell you the bad news—the forum should
7955be closed. Yes, I really mean closed.
7956Over the last year we have lost a lot of the admins of
7957the forums: Iceman on Carders Market; JiLsi and
7958Matrix001 disappeared, and now, Cha0 on DM. It is
7959apparent that this forum, which has been around
7960almost three years, is attracting too much attention
7961from a lot of the world services.…
7962I myself would rather go out like King Arthur than
7963Iceman. Whereas Iceman decided that all he would do
7964was change his nick to Aphex, and continue to run CM,
7965King Arthur closed CarderPlanet and faded into the
7966night. History has shown that Iceman made a fatal
7967mistake. I will not make the same.
7968Mularski planned to keep his Master Splyntr identity
7969dormant but alive: He’d have a well-established
7970underground legend that he could pull from his pocket
7971whenever he needed it in future investigations. But it was
7972not to be. About a week after DarkMarket went dark, a
7973reporter for Südwestrundfunk, Southwest Germany public
7974radio, got his hands on court documents filed in Matrix’s
7975case that laid bare Mularski’s double life. The U.S. press
7976picked up the story. Now 2,500 members of DarkMarket
7977knew they’d been doing business on a sting site and that
7978Iceman had been right all along.
7979Three days after the story broke in the United States,
7980Mularski found an ICQ message to Master Splyntr waiting
7981on his computer. It was from TheUnknown, a UK target
7982who’d gone on the run after he was raided by the British
7983police. “U fucking piece of shit. Motherfucker. Thought you
7984can catch me. Hahaha. Fucking newb. U are nowhere near
7985me.”
7986“If you want to make arrangements to turn yourself in, let
7987me know,” Mularski wrote back. “It will be easier than
7988looking over your shoulder the rest of your life.”
7989TheUnknown turned himself in a week later.
7990Mularski was almost relieved to have his secret identity
7991revealed; for two years, his laptop had been his constant
7992companion—even on vacation, he’d been online talking to
7993carders. He’d enjoyed some of it—building online
7994friendships with some of his targets, teasing and taunting
7995others. Master Splyntr could say things to criminals that a
7996respectable FBI agent never could.
7997Eager as Mularski was to have his life back, it would take
7998time. Nearly a month after DarkMarket’s closing, he was
7999still fighting a vague restlessness. Mularski had one more
8000challenge to master. He’d have to learn how to not be
8001Master Splyntr.
8002
800335
8004Sentencing
8005ax towered over the marshals as they brought him
8006into the Pittsburgh courtroom to face sentencing. He wore
8007an ill-fitting orange jail uniform, his hair trimmed short and
8008neat.
8009His escorts uncuffed his hands, and he took a seat next
8010to his public defender at the defense table. A half-dozen
8011reporters talked among themselves on one side of the
8012gallery, an equal number of feds on the other. Behind them,
8013the long wooden pews were mostly empty: no friends, no
8014family, no Charity; she’d already told Max she wasn’t going
8015to wait for him.
8016It was February 12, 2010, two and a half years after his
8017arrest at the safe house. Max had spent the first month
8018locked up at the Santa Clara county jail, speaking daily with
8019Charity in long phone calls more intimate than any
8020conversations they’d had while he was immersed in his
8021crimes. The marshals finally put him on a plane and
8022checked him into a detention facility in Ohio, where Max
8023made peace with his confinement, largely drained now of
8024the self-righteous anger that carried him through his
8025previous imprisonments. He made new friends in the joint:
8026geeks like him. They started a Dungeons and Dragons
8027campaign.
8028By year’s end, Max had no more secrets. It had taken the
8029CERT investigators only two weeks to find the encryption
8030key in the image of his computer’s RAM. At one of his court
8031appearances, prosecutor Luke Dembosky handed Max’s
8032lawyer a slip of paper with his passphrase written on it:
8033“!!One man can make a difference!”
8034For years, Max had used his encrypted hard drive as an
8035extension of his brain, storing everything he found and
8036everything he did. That the feds had it was disastrous for
8037his legal future, but more than that, it felt like an intimate
8038violation. The government was in his head, reading his
8039mind and memories. When he returned to his cell after the
8040hearing, he wept into his pillow.
8041They had everything: five terabytes of hacking tools,
8042phishing e-mails, dossiers he’d compiled on his online
8043friends and enemies, notes on his interests and activities,
8044and l.8 million credit cards accounts from over a thousand
8045banks. The government broke it down: Max had stolen 1.1
8046million of the cards from point-of-sale systems. The
8047remainder mostly came from the carders Max had hacked.
8048It was eight miles of magstripe data, and the feds were
8049prepared to charge him for every inch. The government had
8050secretly flown Chris to Pittsburgh for weeks of debriefing
8051while the credit card companies tallied the fraudulent
8052charges on Max’s cards, arriving at a staggering $86.4
8053million in losses.
8054Max’s profits were far less: Max told the government he
8055earned under $l million from his capers and had pissed
8056most of it away on rent, meals, cab fare, and gadgets. The
8057government found about $80,000 in Max’s WebMoney
8058account. But federal sentencing guidelines in theft cases
8059are based on victim harm, not the offender’s profits, so Max
8060could be held responsible for the charges rung up by Chris,
8061the carders who bought dumps from Digits and Generous,
8062and potentially the fraud performed by the carders Max
8063hacked. Rolled up with Max’s rap sheet, the $86 million
8064translated to a sentence of thirty years to life, with no
8065parole.
8066Faced with decades in prison, Max began cooperating
8067with the investigation. Mularski took him out for long
8068debriefing sessions about the hacker’s crimes. At one of
8069them, after the DarkMarket sting broke in the press, Max
8070apologized to Mularski for his attempts to expose Master
8071apologized to Mularski for his attempts to expose Master
8072Splyntr. Mularski heard sincerity in his old foe’s voice and
8073accepted his apology.
8074After a year of negotiation, Max’s lawyer and the
8075government settled on their number—a joint
8076recommendation to the judge of thirteen years. In July 2009,
8077Max had pleaded guilty.
8078The deal wasn’t binding on the court; in theory, Max could
8079be released on the spot, sentenced to life, or anything in
8080between. The day before the sentencing, Max typed out a
8081four-page letter to his judge, Maurice Cohill Jr., a seventyyear-
8082old Ford appointee who’d been a jurist since before
8083Max was born.
8084“I don’t believe further prison time in my case will help
8085anyone,” Max wrote. “I don’t think it is necessary because
8086all I want to do is help. I disagree with the blanket
8087assessment of the sentencing guidelines. Unfortunately, I
8088am facing such a horrible sentence that even 13 years
8089seems ‘good’ in comparison. But I assure you it is overkill
8090as I am the proverbial dead horse. That said, I plan to make
8091the most of the time I have left on this earth be it in prison or
8092otherwise.”
8093He continued. “I have a lot of regrets, but I think my
8094essential failing was that I lost touch with the accountability
8095and responsibility that comes with being a member of
8096society. A friend of mine once told me to behave as though
8097everyone could see what I was doing all the time. A sure
8098way to avoid engaging in illegal conduct, but I guess I
8099wasn’t a believer because when I was invisible, I forgot all
8100about this advice. I know now that we can’t be invisible, and
8101that it’s dangerous thinking.”
8102Max watched with studied calmness as his lawyer stood
8103to confer with the prosecution over last-minute details and
8104the courthouse staff went through their prehearing checklist,
8105testing the microphones and shuffling papers. At ten thirty
8106a.m. the door to chambers opened. “All rise!”
8107Judge Cohill took the bench. A wizened man with a
8108close-cropped snow-white beard, he peered at the
8109courtroom through round glasses and announced the
8110sentencing of Max Butler, the name under which Max had
8111been charged. He read Max’s sentencing guidelines for the
8112record, thirty years to life, then listened as prosecutor
8113Dembosky laid out his case for leniency. Max had provided
8114significant help to the government, he said, and was
8115deserving of a sentence below the guidelines.
8116What followed could have been an awards presentation
8117instead of a sentencing hearing, with Max’s lawyer,
8118prosecutor, and judge taking turns praising Max’s computer
8119skills and apparent remorse. “He’s an extremely bright, selftaught
8120computer expert,” said federal public defender
8121Michael Novara, albeit one who orchestrated “computer
8122security breaches on a grand scale.”
8123Dembosky, a computer-crime specialist and seven-year
8124veteran of the U.S. Attorney’s Office, called Max “extremely
8125bright and articulate and talented.” He’d been at some of
8126Max’s debriefings, and like virtually everyone who knew
8127Max in real life, he’d grown to like the hacker. “He’s almost
8128wide-eyed and optimistic in his view of the world,” he said.
8129Max’s cooperation, he added, was why they were asking
8130for only thirteen years instead of an “astronomical”
8131sentence. “I believe that he is very sorry.”
8132Max had little to add. “I’ve changed,” he said. Hacking no
8133longer held any appeal for him. He invited Judge Cohill to
8134ask him any questions. Cohill didn’t need to. The judge said
8135he was impressed by Max’s letter and by letters written by
8136Charity, Tim Spencer, and Max’s mother, father, and sister.
8137He was satisfied that Max was remorseful. “I don’t think I
8138have to give you a lecture on the problems you’ve caused
8139for your victims.”
8140Cohill had already written the sentencing order. He read
8141from it aloud. Thirteen years in prison. Max would also be
8142responsible for $27.5 million in restitution, based on the
8143cost to the banks of reissuing the 1.1 million cards Max
8144stole from point-of-sale systems. Upon his release, he’d
8145stole from point-of-sale systems. Upon his release, he’d
8146serve five years of court supervision, during which he’d be
8147allowed to use the Internet only for employment or
8148education.
8149“Good luck,” he said to Max.
8150Max stood up—his face neutral—and let a marshal
8151handcuff him behind his back, then lead him through the
8152door in the back of the courtroom connecting to the holding
8153cells. With credit for time served and good behavior, he’d
8154be out just before Christmas 2018.
8155Almost nine years in prison were still ahead of him. At the
8156time it was the longest U.S. sentence ever handed out to a
8157hacker.
8158
815936
8160Aftermath
8161y the time Max was sentenced, the Secret Service had
8162identified the mystery American hacker who’d made
8163Maksik into the world’s top carder, and he was poised to
8164get a sentence that would make Max’s look like a traffic
8165fine.
8166The big break in the case came from Turkey. In July
81672007, the Turkish National Police learned from the Secret
8168Service that Maksik, twenty-five-year-old Maksym
8169Yastremski, was vacationing in their country. An undercover
8170Secret Service operative lured him to a nightclub in Kemer,
8171where police arrested Yastremski and seized his laptop.
8172The police found the laptop hard drive impenetrably
8173encrypted, just as when the Secret Service performed its
8174sneak-and-peek in Dubai a year earlier. But after a few
8175days in a Turkish jail, Maksik coughed up the seventeencharacter
8176passphrase. The police gave the passphrase
8177and a copy of the disk to the Secret Service, which began
8178poring over its contents, taking particular interest in the logs
8179Maksik kept of his ICQ chats.
8180One chat partner stood out: ICQ user 201679996 could
8181be seen helping the Ukrainian with a hack attack against
8182the restaurant chain Dave & Buster’s and discussing some
8183of the earlier high-profile intrusions that had put Maksik on
8184the map. The agents checked out the ICQ number and
8185obtained the e-mail address used to first register the
8186account: soupnazi@efnet.ru.
8187SoupNazi was a name the agency had heard before—in
81882003, when they arrested Albert Gonzalez.
8189Gonzalez was the informant who’d lured Shadowcrew
8190carders into a wiretapped VPN, leading to the twenty-one
8191arrests in Operation Firewall—the Secret Service’s
8192legendary crackdown on the carding scene. But years
8193before he was known as Cumbajohnny on Shadowcrew,
8194Gonzalez had used the Seinfeld-inspired handle SoupNazi
8195in IRC.
8196The carder turncoat who’d made Operation Firewall
8197possible had gone on to stage the largest identity thefts in
8198U.S. history.
8199One month after Firewall, Gonzalez had gotten
8200permission to move from New Jersey back to his home,
8201Miami, where he’d launched the second act of his hacking
8202career. He took on the name Segvec and passed himself
8203off as a Ukrainian, hanging his hat on the Eastern
8204European forum Mazafaka. Under the rubric Operation Get
8205Rich or Die Tryin’—the title of a 50 Cent album and
8206Maksik’s Shadowcrew motto—he went on to create a
8207multimillion-dollar cybertheft ring that touched tens of
8208millions of Americans.
8209On May 8, 2008, the feds swooped in on Gonzalez and
8210his U.S. associates. Hoping for leniency at sentencing,
8211Gonzalez cooperated again, providing agents with the
8212encryption key for his hard drive and giving them
8213information on his entire gang. He admitted to the breaches
8214at TJX, OfficeMax, DSW, Forever 21, and Dave & Buster’s,
8215and to helping Eastern European hackers penetrate the
8216grocery chain Hannaford Bros., 7-Eleven’s ATM network,
8217Boston Market, and the credit card processing company
8218Heartland Payment Systems, which alone leaked nearly
8219130 million cards. It was a lucrative business for the hacker.
8220Gonzalez drew the Secret Service a map to over $1 million
8221in cash he’d buried in his parents’ backyard; the
8222government sought forfeiture of the money, his 2006 BMW,
8223and a Glock 27 firearm with ammunition.
8224Gonzalez had built his crew from an untapped reservoir
8225of hacker talent—onetime bedroom hackers who had
8226trouble finding a place in the white-hat world. Among them
8227was Jonathan “C0mrade” James, who’d hacked NASA as
8228a teenager and received a landmark six-month juvenile
8229sentence the same week Max Vision pleaded guilty to his
8230Pentagon hacks in 2000. After a brief flurry of fame—
8231including an interview on PBS’s Frontline—James slipped
8232into obscurity, living quietly in a house he inherited from his
8233mother in Miami.
8234Then in 2004 he allegedly began working with Gonzalez
8235and an associate named Christopher Scott. The
8236government believes James and Scott were responsible
8237for one of the earliest magstripe hauls to make their way
8238into Maksik’s vaults, cracking OfficeMax’s Wi-Fi from a
8239store parking lot in Miami and stealing thousands of swipes
8240and encrypted PINs. The two allegedly provided the data to
8241Gonzalez, who arranged with another hacker to decrypt the
8242PIN codes. Credit card companies later reissued some two
8243hundred thousand cards in response to the attack.
8244Of all the hackers, it was Jonathan James who would pay
8245the highest price in the post-Shadowcrew carder
8246crackdown. In the days after his May 2008 raid, James
8247became convinced the Secret Service would try to pin all of
8248Gonzalez’s breaches on him to wring public relations juice
8249out of his notorious past and protect their informant,
8250Gonzalez. On May 18, the twenty-four-year-old stepped into
8251the shower with a handgun and shot himself dead.
8252“I have no faith in the ‘justice’ system,” read his five-page
8253suicide note. “Perhaps my actions today, and this letter, will
8254send a stronger message to the public. Either way, I have
8255lost control over this situation, and this is my only way to
8256regain control.”
8257In March 2010, Gonzalez was sentenced to twenty years
8258in prison. His U.S. coconspirators drew sentences ranging
8259from two to seven years. In Turkey, Maksik was convicted
8260of hacking Turkish banks and sentenced to thirty years.
8261Since Max’s arrest, new scams have emerged in the
8262underground, the worst of them involving specialized Trojan
8263horse software designed to steal a target’s online banking
8264passwords and initiate money transfers from the victim’s
8265account right through his own computer. The thieves have
8266devised an ingenious solution to the problem that had
8267bedeviled Chris Aragon: how to get at the money. They
8268recruit ordinary consumers as unwitting money launderers,
8269dangling bogus work-at-home opportunities, in which the
8270“work” consists of accepting money transfers and payroll
8271deposits, then sending the bulk of the cash to Eastern
8272Europe by Western Union. In 2009, the scheme’s first year
8273of widespread operation, banks and their customers lost an
8274estimated $120 million to the attack, with small businesses
8275the most common target.
8276Meanwhile, the sale of dumps continues, dominated now
8277by a new crop of vendors, same as the old crop—Mr. BIN;
8278Prada; Vitrium; The Thief.
8279Law enforcement, though, has claimed some lasting
8280victories. So far, no prominent English-speaking board has
8281risen to replace Carders Market and DarkMarket, and the
8282Eastern Europeans have become more cloistered and
8283protective. The big players have retreated to invitation-only
8284encrypted chat servers. The marketplace exists, but the
8285carders’ sense of invulnerability is shattered, and their
8286commerce is tariffed by paranoia and mistrust, thanks
8287primarily to the FBI, the Secret Service, their international
8288partners, and the unheralded work of the post office.
8289The veil of secrecy that once protected hackers and
8290corporations alike has mostly evaporated, with law
8291enforcement no longer going out of its way to shield
8292companies from responsibility for their poor security. More
8293than one of Gonzalez’s hacking targets were made public
8294for the first time in his federal indictment.
8295Finally, Mularski’s DarkMarket sting proved the feds
8296don’t have to get in bed with the bad guys to make busts.
8297All the lowest moments in the war on the computer
8298All the lowest moments in the war on the computer
8299underground came about through the antics of informants.
8300Brett “Gollumfun” Johnson, the snitch who briefly worked as
8301a Carders Market administrator, turned the Secret
8302Service’s Operation Anglerphish into a circus by staging a
8303tax refund scam on the side. Albert Gonzalez provided the
8304clearest example. After Operation Firewall, the Secret
8305Service had been paying Gonzalez an annual salary of
8306$75,000 a year, even as he staged some of the largest
8307credit card hacks in history.
8308The post-Shadowcrew magstripe breaches led to a
8309reckoning in the civil courts. TJX paid $10 million to settle a
8310lawsuit filed by the attorneys general of 41 states and
8311another $40 million to Visa-issuing banks whose cards
8312were compromised. Banks and credit unions filed lawsuits
8313against Heartland Payment Systems for the massive
8314breach at the transaction-processing firm. Gonzalez’s
8315attacks also tore a hole in the credit card industry’s primary
8316bulwark against breaches: the so-called Payment Card
8317Industry—or PCI—Data Security Standard, which dictates
8318the steps merchants and processors must take to protect
8319systems handling credit card data. Heartland had been
8320certified PCI compliant before it was breached, and
8321Hannaford Brothers won the security certification even as
8322hackers were in its systems, stealing credit card swipes.
8323When the dust began to settle from Gonzalez’s largescale
8324hacks, the smaller but far more numerous attacks
8325against restaurant point-of-sale systems began to come
8326out. Seven restaurants in Mississippi and Louisiana who’d
8327suffered intrusions figured out they were all using the same
8328point-of-sale system, the Aloha POS that was once Max’s
8329favorite target. The restaurants filed a class-action lawsuit
8330against the manufacturer and the company that sold them
8331the terminals, Louisiana-based Computer World, which
8332allegedly installed the remote-access software pcAnywhere
8333on all the machines and set the passwords on all of them to
8334“computer.”
8335Underlying all these breaches is a single systemic
8336security flaw, exactly 3.375 inches long. Credit card
8337magstripes are a technological anachronism, a throwback
8338to the age of the eight-track tape, and today the United
8339States is virtually alone in nurturing this security hole. More
8340than a hundred other countries around the globe, in Europe,
8341Asia, and even Canada and Mexico, have implemented or
8342begun phasing in a far more secure system called EMV or
8343“chip-and-PIN.”
8344Instead of relying on a magstripe’s passive storage,
8345chip-and-PIN cards have a microchip embedded in the
8346plastic that uses a cryptographic handshake to authenticate
8347itself to the point-of-sale terminal and then to the
8348transaction-processing server. The system leaves nothing
8349for a hacker to steal—an intruder sitting on the wire could
8350eavesdrop on the entire transaction and still be unable to
8351clone a card, because the handshake sequence changes
8352every time.
8353White hats have devised attacks against chip-and-PIN,
8354but nothing that would lend itself to the mass market in
8355dumps that still exists today. So far, the biggest flaw in the
8356system is that it supports magstripe transactions as a
8357fallback for Americans traveling abroad or tourists visiting
8358the United States.
8359American banks and credit card companies have
8360rejected chip-and-PIN because of the enormous cost of
8361replacing hundreds of thousands of point-of-sale terminals
8362with new gear. In the end, the financial institutions have
8363decided their fraud losses are acceptable, even with the
8364likes of Iceman prowling their networks.
8365
8366EPILOGUE
8367n the Orange County men’s jail, Chris Aragon is lonely,
8368feeling abandoned by his friends and torn with grief that his
8369children are growing up without him. In October 2009, Clara
8370filed for divorce, seeking custody of their two children. His
8371girlfriend filed for child support.
8372Chris is studying the Bhagavad Gita and has a full-time
8373job as an inmate representative, helping several hundred
8374prisoners with legal matters, medical complaints, and
8375issues with the jail staff. His lawyer is playing a waiting
8376game, winning endless continuances for the criminal trial
8377that, if he loses, still carries a twenty-five-to-life term. After
8378Chris’s story was featured in a Wired magazine article on
8379Max, Chris was contacted by a Hollywood screenwriter and
8380a producer, but he didn’t respond. His mother suggested
8381he get an agent.
8382Max was assigned to FCI Lompoc, a low-security prison
8383an hour north of Santa Barbara, California. He hopes to use
8384his time to get a degree in physics or math—finally
8385completing the college education that was interrupted a
8386decade earlier in Boise.
8387He’s taken a mental inventory and is dismayed to find
8388that, despite everything, he still has the same impulses that
8389guided him into a life of hacking. “I’m not sure how to really
8390mitigate that, except ignore it,” he said in an interview from
8391jail. “I really believe that I’m reformed. But I don’t know
8392what’s going to happen later.”
8393It might seem a curious confession—admitting that the
8394elements of his personality that landed him in prison still
8395remain buried deep inside. But Max’s new self-awareness
8396shows hope for real change. If one is born a hacker, no
8397amount of prison can drive it out. No therapy, or court
8398supervision, or prison workshop can offer reform. Max has
8399to reform himself—learn to own his actions and channel the
8400useful parts of his nature into something productive.
8401To that end, Max has volunteered to help the government
8402during his confinement, defending U.S. networks or
8403perhaps counterattacking foreign adversaries online. He
8404wrote out a menu of the services he could offer in a memo
8405headed “Why the USA Needs Max.” “I could penetrate
8406China’s military networks and military contractors,” he
8407suggested. “I can hack al Qaida.” He’s hopeful he might do
8408enough for the government that he could apply for a
8409lowered sentence from his judge.
8410It’s a long shot, and so far, the feds haven’t taken him up
8411on his offer. But a month after his sentencing, Max took a
8412baby step in that direction. Keith Mularski arranged for Max
8413to speak at the NCFTA for an eager audience of law
8414enforcement officials, students, financial and corporate
8415security experts, and academics from Carnegie Mellon.
8416Mularski checked him out of jail for the appearance. And
8417for an hour or two, Max Vision was a white hat again.
8418
8419NOTES
8420
8421Prologue
84221 The taxi idled: Interviews with Max Vision.
8423
8424Chapter 1: The Key
84251 As soon as the pickup truck rolled up to the curb:
8426Interviews with Max’s friend Tim Spencer. The
8427confrontation was also described in less detail by
8428Kimi Mack, Max’s ex-wife. Though Max could
8429intimidate bullies, he was never forced into a
8430physical confrontation with them.
84312 Max’s parents had married young: State of Idaho
8432v. Max Butler, 1991. District Court of the Fourth
8433Judicial District, Ada County, Case No. 17519.
84343 Robert Butler was a Vietnam veteran: State of
8435Idaho v. Max Butler and interviews with Max.
84364 Weather Channel and nature documentaries:
8437Interviews with Kimi Winters and Max, respectively.
8438Max’s parents declined to be interviewed.
84395 relaxed, and full-bore insane: Interviews with Tim
8440Spencer and with “Amy,” Max’s ex-girlfriend. Max’s
8441emotional problems at this time are also reflected in
8442court records in State of Idaho v. Max Butler. Max
8443acknowledges that his parents’ divorce had a deep
8444effect on him.
84456 One day he emerged from his home: Interview with
8446Tim Spencer. Max confirms the incident but says he
8447lit the fire in a field adjacent to Spencer’s house.
84487 The Meridian geeks had found the key ring: The
8449account of the master-key incident comes from
8450interviews with Tim Spencer. Court records confirm
8451Max’s juvenile conviction. Max admits the trespass
8452and chemical theft but declined to detail what
8453occurred inside the school. John, his uncharged
8454accomplice in the burglary, declined comment.
84558 Max became “Lord Max”: Max described his run-in
8456with the Secret Service in an interview. Also
8457referenced in a letter Max wrote that was filed in
8458State of Idaho v. Max Butler.
8459
8460Chapter 2: Deadly Weapons
84611 THIS is the Rec Room!!!!: From MUDs to Virtual
8462Worlds, Don Mitchell, Microsoft social computing
8463group (March 23, 1995).
84642 three hundred thousand host computers:
8465Numerous sources, including “Illuminating the net’s
8466Dark Ages,” Colin Barras, BBC News, August 23,
84672007.
84683 At Max’s urging: The events surrounding Max’s
8469assault conviction are based on transcripts and
8470other documents in State of Idaho v. Max Butler, as
8471well as interviews with Max and “Amy.” Where there
8472are significant factual disputes, they are noted
8473herein.
84744 Then the dark truth: “The Dreaming City,” Michael
8475Moorcock, Science Fantasy 47 (June 1961).
84765 Like a few of them, he started hacking the
8477computer right away: The hacking at BSU was
8478described by Max and David in interviews. David
8479described Max’s speed and impatience. BSU
8480professor Alexander Feldman discussed Max’s
8481computer ban in an interview and said Max had
8482probed other computers.
84836 The sheriff called BSU’s network administrator at
8484two in the morning: Interview with Greg Jahn, a
8485former BSU system administrator responsible for
8486locking down Max’s account and preserving his files.
8487
8488Chapter 3: The Hungry Programmers
84891 Idaho’s Supreme Court ruled: State v. Townsend ,
8490124 Idaho 881, 865 P.2d 972 (1993).
84912 Max found an unprotected FTP file server: Cinco
8492Network, Inc. v. Max Butler, 2:96-cv-1146, U.S.
8493District Court, Western District of Washington. Max
8494confirms this account but says he was primarily
8495interested in distributing music files, not pirated
8496software.
84973 Chris Beeson, a young agent: The details of Max’s
8498assistance to the FBI come from court filings by the
8499defense attorney in his subsequent criminal case,
8500USA v. Max Ray Butler, 5:00-cr-20096, U.S.
8501District Court, Northern District of California. Details
8502of his recruitment and his relationship with the
8503agents come from interviews with Max and Max’s
8504Internet writings immediately following his guilty plea.
8505See
8506http://www.securityfocus.com/comments/articles/203/5729/threaded
8507(May 24, 2001). Max says he did not consider
8508himself an informant and only provided technical
8509information.
8510
8511Chapter 4: The White Hat
85121 The first people to identify themselves as hackers:
8513The seminal work on the early hackers is Steven
8514Levy, Hackers: Heroes of the Computer Revolution
8515(New York: Anchor Press/Doubleday, 1984). Also
8516see Steve Wozniak and Gina Smith, iWoz: From
8517Computer Geek to Cult Icon: How I Invented the
8518Personal Computer, Co-Founded Apple, and Had
8519Fun Doing It (New York: W. W. Norton and
8520Company, 2006).
85212 Tim was at work one day: This anecdote was
8522recalled by Tim Spencer. Max later recalled
8523Spencer’s advice in a letter to his sentencing judge
8524in Pittsburgh.
85253 If there was one thing Max: Details of Max’s
8526relationship with Kimi come primarily from
8527interviews with Kimi.
85284 Max went up to the city to visit Matt Harrigan:
8529Harrigan’s business and his work with Max were
8530described primarily by Harrigan, with some details
8531confirmed by Max.
8532
8533Chapter 5: Cyberwar!
85341 In 1998, security experts discovered the latest flaw
8535in the code: This account of Max’s BIND attack
8536draws primarily from court records, including Max’s
8537written confession, interviews with Kimi, and
8538interviews with former air force investigator Eric
8539Smith. E-mail snippets between Max and the FBI
8540are from court records. Technical details come
8541primarily from a contemporaneous analysis of Max’s
8542code that can be found at http://www.mailarchive.
8543com/redhatlist@
8544redhat.com/msg01857.html.
85452 issued an alert: “Inverse Query Buffer Overrun in
8546BIND 4.9 and BIND 8 Releases,” CERT Advisory
8547CA-98.05.
85483 He sent Paxson an anonymous note: The note
8549was provided to the author by Vern Paxson. Max
8550confirmed that he sent it.
8551
8552Chapter 6: I Miss Crime
85531 Kimi came home from school: Kimi described this
8554portion of the FBI search and its aftermath.
85552 The FBI agents saw an opportunity in Max’s crime:
8556The details come from court filings by the defense
8557attorney in USA v. Max Ray Butler, 5:00-cr-20096,
8558U.S. District Court, Northern District of California.
85593 Max was in heaven: Interviews with Max and Kimi.
85604 Carlos Salgado Jr., a thirty-six-year-old computer
8561repairman: Details of the Salgado caper come from
8562interviews with Salgado, Salgado’s intended buyer,
8563the former system administrator of the ISP he
8564hacked, and court records in USA v. Carlos Felipe
8565Salgado, Jr., 3:97-cr-00197, U.S. District Court,
8566Northern District of California. The FBI declined to
8567comment on the case or to identify the victim of the
8568credit card breach.
85695 The next day, Max met Harrigan at a Denny’s:
8570Interviews with Matt Harrigan and Max.
8571
8572Chapter 7: Max Vision
85731 In late 1998, a former NSA cybersecurity: Interview
8574with Marty Roesch.
85752 The reason I signed the confession: Interviews with
8576Kimi. In interviews with the author, Max expressed
8577the sentiment that his attachment to Kimi worsened
8578his legal situation.
85793 “It’s his stuff”: Snort IDS mailing list, April 3, 2000.
8580(http://archives.neohapsis.com/archives/snort/2000-
858104/0021.html).
85824 Patrick “MostHateD” Gregory: “Computer Hacker
8583Sentenced,” U.S. Department of Justice press
8584release, September 6, 2000
8585(http://www.justice.gov/criminal/cybercrime/gregorysen.htm).
85865 Jason “Shadow Knight” Diekman: “Orange County
8587Man in Federal Custody for Hacking into
8588Government Computers,” U.S. Department of
8589Justice press release, September 21, 2000
8590(http://www.justice.gov/criminal/cybercrime/diekman.htm).
85916 Sixteen-year-old Jonathan James: “Juvenile
8592Computer Hacker Sentenced to Six Months in
8593Detention Facility,” U.S. Department of Justice
8594press release, September 21, 2000
8595(http://www.justice.gov/criminal/cybercrime/comrade.htm).
8596
8597Chapter 8: Welcome to America
85981 The two Russians: The details of the Invita sting
8599and the background of the Russian defendants
8600come primarily from court records, particularly USA
8601v. Vassily Gorshkov, 2:00:mj:00561, U.S. District
8602Court, Western District of Washington, as well as an
8603interview with a former FBI agent who worked on the
8604operation. The description of the Russians’ attire
8605and the reference to “the Expert Group” comes from
8606the excellent Washington Post story “A Tempting
8607Offer for Russian Pair” by Ariana Eunjung Cha, May
860819, 2003. Quotes from within the Invita office come
8609from a transcript of the surveillance tape, with minor
8610grammatical changes for readability.
8611
8612Chapter 9: Opportunities
86131 Max wore a blazer and rumpled cargo pants: The
8614author was present at Max’s sentencing hearing:
8615see “As the Worm Turns,” SecurityFocus,
8616Businessweek online, May 21, 2001
8617(http://www.businessweek.com/technology/
8618content/jul2001/tc20010726_443.htm). The letters
8619written on Max’s behalf are filed in USA v. Max Ray
8620Butler, 5:00-cr-20096, U.S. District Court, Northern
8621District of California.
86222 Kimi was talking to him on the phone: Interview
8623with Kimi.
86243 Max took the news with eerie calm: Interview with
8625Max.
86264 “I’ve been talking to some people”: Interview with
8627Kimi.
86285 Jeffrey James Norminton: Three of Norminton’s
8629close associates, Chris Aragon, Werner Janer, and
8630an anonymous source, described Norminton’s
8631alcoholism, and Aragon discussed its effect on
8632Norminton’s criminal productivity. Federal court
8633records show Norminton’s assignment to a drug and
8634alcohol rehabilitation center, and local court records
8635reflect two DUI arrests in 1990 (Orange County
8636Superior Court cases SM90577 and SM99355).
86376 Norminton’s latest caper: USA v. Jeffrey James
8638Norminton, 2:98-cr-01260, U.S. District Court,
8639Central District of California.
86407 Norminton made it clear that he saw real potential
8641in Max: Interviews with Max, Chris Aragon, Werner
8642Janer, and another source familiar with Max’s and
8643Norminton’s jailhouse planning.
86448 Max refused to sign: Kimi and Max agree on this.
8645Max says he refused to sign because Kimi
8646appeared to be wavering in her commitment to
8647divorce him.
86489 I have been showing up at places: Max’s plea to
8649the security community is archived at
8650http://seclists.org/fulldisclosure/2002/Aug/257.
865110 Even the Honeynet Project: Max says the project
8652shunned him. Founder Lance Spitzner did not
8653answer an inquiry from the author.
865411 A global survey: Conducted by the Belgian
8655computer security company Scanit by way of a free
8656online vulnerability assessment tool, July 9, 2003.
8657
8658Chapter 10: Chris Aragon
86591 Max met his future friend and criminal partner
8660Chris Aragon: Chris Aragon provided this account
8661of his first meeting with Max. Max doesn’t remember
8662where they first met.
86632 The first robbery: The first attempted bank robbery
8664and the final successful one are described in court
8665records for USA v. Christopher John Aragon and
8666Albert Dwayne See, 81-cr-133, U.S District Court
8667for the District of Colorado. Additional details,
8668including the Dumpster incident and Aragon’s
8669lifestyle at the time, come from the author’s
8670interviews with Albert See, Aragon’s former crime
8671partner. In interviews, Aragon generally
8672acknowledged his bank robbery conviction and his
8673use of cocaine in this period.
86743 he delved into credit card fraud: Per Aragon, and
8675confirmed by his former associate Werner Janer
8676and Max.
86774 busted in a nationwide DEA undercover operation:
8678Kathryn Sosbe, “13 arrested in marijuana
8679bust/Colombian cartel used Springs as distribution
8680p o i nt , ” Colorado Springs Gazette-Telegraph,
8681September 13, 1991. The Federal Bureau of
8682Prisons confirmed Aragon’s conviction and
8683sentencing on a charge of travel in interstate
8684commerce in aid of a business enterprise involving
8685the distribution of marijuana.
86865 They wound up at the twenty-seven-story Holiday
8687Inn: The descriptions of Max and Aragon’s work
8688together here and throughout this book come
8689primarily from interviews with Max and Aragon, as
8690well as their associates Werner Janer, Jonathan
8691Giannone, Tsengeltsetseg Tsetsendelger, and
8692another source involved in their crimes. Statements
8693provided by Jeffrey Norminton to the FBI,
8694summarized in court documents, also confirm many
8695of the details.
86966 a white-hat hacker had invented a sport called “war
8697driving”: “Evil” Pete Shipley. See the author’s “War
8698Driving by the Bay,” Securityfocus.com, April 12,
86992001 (http://www.securityfocus.com/news/192).
87007 Janer offered to pay Max $5,000 to penetrate the
8701computer of a personal enemy: According to
8702Aragon, Max, and other sources. Janer says the
8703money was a loan. Charity confirms she received
8704the check on Max’s behalf.
87058 Charity had only the broadest notion of what Max
8706was up to: Interviews with Charity Majors.
87079 On a whim, he cracked Kimi’s computer: Interview
8708with Max.
8709
8710Chapter 11: Script’s Twenty-Dollar
8711Dumps
87121 In the spring of 2001, some 150 Russianspeaking
8713computer criminals: Greg Crabb, U.S.
8714Postal Inspection Service. Roman Vega, currently in
8715U.S. custody, declined comment, as did the
8716Ukrainian widely suspected to be Script.
87172 The discussion was sparked by: This history of the
8718carding forums comes from interviews with several
8719veteran carders, court records, interviews with law
8720enforcement officials, and a detailed examination of
8721the archives of Counterfeit Library, CarderPlanet,
8722and Shadowcrew.
87233 the CVV began driving down fraud costs
8724immediately: Fraud figures come from a
8725presentation by Steven Johnson, director, Visa USA
8726Public Sector Sales, at the ninth annual GSA
8727SmartPay Conference in Philadelphia, August 23,
87282007.
87294 Chris decided to try some carding himself: Aragon
8730described his dealings with Script and his first
8731fraudulent purchases.
8732
8733Chapter 12: Free Amex!
87341 Max broached his plan obliquely with Charity:
8735Interview with Charity Majors.
87362 Internet Explorer can process more than just Web
8737pages: Drew Copley and eEye Digital Security,
8738“Internet Explorer Object Data Remote Execution
8739Vulnerability,” August 20, 2003. See CERT
8740Vulnerability Note VU#865940. The author located
8741Max’s attack code in a 2003 post to a hacker Web
8742forum, and computer security researcher Marc
8743Maiffret, an executive at eEye, confirmed that it
8744exploited this bug. Max remembers having the
8745vulnerability before it was public but isn’t sure how
8746he obtained it. He says eEye and its researchers
8747never leaked bugs in advance.
87483 The disk was packed with FBI reports: Aragon,
8749Max, and Werner Janer all related the story of Max’s
8750intrusion into the FBI agent’s computer. Max, Janer,
8751and another source confirmed the agent’s name.
8752The agent, E. J. Hilbert, insists he was never hacked
8753and that Max likely penetrated an FBI honeypot filled
8754with fake information.
8755
8756Chapter 13: Villa Siena
87571 Chris loaded blank PVC cards: Aragon admits his
8758credit card counterfeiting operation and provided
8759some details in interviews. The author examined
8760Aragon’s counterfeiting gear, and dozens of his
8761finished cards, at the Newport Beach Police
8762Department. The blow-by-blow on how the
8763equipment operates comes from interviews with
8764another experienced card counterfeiter who used
8765the same gear.
87662 summoned his girls: Nancy Diaz Silva and
8767Elizabeth Ann Esquere have pleaded guilty for their
8768roles in Aragon’s operation. The other cashers were
8769described variously by Aragon’s former associates
8770Werner Janer, Jonathan Giannone, and
8771Tsengeltsetseg Tsetsendelger.
87723 They’d be “sticking it to the man”: The Newport
8773Beach Police Department interviewed one of
8774Aragon’s later cashers, Sarah Jean Gunderson, in
87752007. According to the police report: “Aragon stated
8776that it was ‘The man that we are sticking it to.’
8777Gunderson said she knew it was wrong, however all
8778of her bills were getting paid.” Gunderson has
8779pleaded guilty.
8780
8781Chapter 14: The Raid
87821 Chris Toshok awoke to the sound of his doorbell
8783buzzing: The details of the raid come primarily from
8784Toshok’s blog post “The whole surreal story,” I am
8785Pleased Precariously on January 15, 2004.
87862 The FBI tried to lure Gembe to America: Cassell
8787Bryan-Low, “Hacker Hitmen,” Wall Street Journal,
8788October 6, 2003. Also see the author’s “Valve Tried
8789to Trick Half-Life 2 Hacker into Fake Job Interview,”
8790Wired.com, November 12, 2008.
8791(http://www.wired.com/threatlevel/2008/11/valvetricked-
8792h/).
87933 “Call me back when you’re not stoned”: Aragon
8794and Max both agree they fought over money. This
8795quote was recalled by Aragon.
87964 sending them to Mexico to be fitted with clean
8797VINs: Interviews with Werner Janer and Jonathan
8798Giannone. Court records from Aragon’s San
8799Francisco arrest show his car was found to have
8800fake VIN tags, and as part of the case settlement
8801Aragon agreed to forfeit the vehicle. Aragon
8802declined to elaborate on that aspect of his activities
8803in interviews.
8804
8805Chapter 15: UBuyWeRush
88061 Cesar had come to the underground by a
8807circuitous course: Interview with Carranza.
88082 Selling equipment wasn’t in and of itself illegal:
8809Carranza pleaded guilty to money laundering in
8810December 2009 for running an e-gold exchange
8811service for carders under the UBuyWeRush brand.
8812U.S. v. Cesar Carranza, 1:08-cr-0026 U.S. District
8813Court for the Eastern District of New York. On
8814September 16, 2010, he was sentenced to six years
8815in prison.
88163 The midsized Commerce Bank in Kansas City,
8817Missouri, may have been the first: Interview with
8818Mark J. Tomasic, former vice president of bank card
8819security with Commerce Bank. Also see “Hey,
8820banks, earn your stripes and fight ATM fraud
8821scams,” Kansas City Star, June 1, 2008.
88224 Citibank, the nation’s largest consumer bank by
8823holdings, was the most high-profile victim: The
8824CVV attacks were widely known as the “Citibank
8825cash-outs” in carding circles. One of King Arthur’s
8826cashers, Kenneth Flury, was prosecuted in the
8827United States after admitting to stealing $384,000 in
8828Citibank ATM withdrawals in ten days in the spring
8829of 2004: U.S. v. Kenneth J. Flury, 1:05-cr-00515,
8830U.S. District Court for the Northern District of Ohio.
8831Citibank declined comment. To discourage
8832competitors, masterminds of the cash-outs often
8833claimed to have secret algorithms at their disposal
8834to generate workable magstripes. Max and other
8835carders confirmed this was a myth, as did FBI agent
8836J. Keith Mularski. Any data would work.
88375 once let it slip to a colleague that King was making
8838$1 million a week: Joseph Menn, “Fatal System
8839Error,” Public Affairs, January 2010.
88406 Max had passed them all to Chris, who tore into
8841them with a vengeance: Interview with Max. Werner
8842Janer confirmed that Chris worked on the Citibank
8843cash-outs with Max, but Janer did not know the
8844details. Aragon declined to comment on the cashouts.
88457 In just one year: Avitan Litan, “Criminals Exploit
8846Consumer Bank Account and ATM System
8847Weaknesses,” Gartner report G00129989, July 28,
88482005. The loss estimate includes two types of
8849magstripe “discretionary” data that was not being
8850properly verified: the CVV and an optional PIN offset
8851used by some banks.
8852
8853Chapter 16: Operation Firewall
88541 Banner ads appeared at the top of the site: This
8855and other reporting on Shadowcrew’s contents
8856comes from a mirror of the public portion of the site
8857captured in October 2004, immediately before it
8858was shuttered.
88592 The posts disappeared at once: Interviews with
8860Max. Aragon independently stated that he and Max
8861tried to warn Shadowcrew members in advance of
8862the Operation Firewall raids.
88633 The transactions ranged from the petty to the
8864gargantuan: Transaction details come from the
8865Operation Firewall indictment, U.S. v. Mantovani et
8866al., 2:04-cr-00786, U.S. District Court for the District
8867of New Jersey.
88684 the Secret Service had noticed Ethics was selling:
8869Ethics’s hacking of the Secret Service agent was
8870first reported by the author: “Hacker penetrates TMobile
8871systems,” Securityfocus.com, January 11,
88722005. His use of the BEA Systems exploit came
8873from sources close to the case and was first
8874reported by the author: “Known Hole Aided T-Mobile
8875B r e a c h , ” Wired.com, February 28, 2005
8876(http://www.wired.com/politics/security/news/2005/02/66735).
8877Also see U.S. v. Nicolas Lee Jacobsen, 2:04-mj-
887802550, U.S. District Court for the Central District of
8879California.
88805 David Thomas was a lifelong scammer who’d
8881discovered the crime forums: For Thomas’s history
8882with the forums and the details of his work for the
8883FBI, see Kim Zetter, “I Was a Cybercrook for the
8884F B I, ” Wired.com, January 20, 2007. A U.S.
8885government source confirmed to the author that
8886Thomas had worked for the bureau while running his
8887forum, the Grifters.
88886 “You don’t know who you have here”: From the
8889police report of Thomas’s arrest. “The problem with
8890the Bureau and the Secret Service is they look at the
8891largest biggest deals they can get in on,” Thomas
8892said in a 2005 interview with the author. “They want
8893the big enchilada.”
88947 Their targets were marked on a map of the United
8895States: Brian Grow, “Hacker Hunters,”
8896Businessweek, May 30, 2005
8897(http://www.businessweek.com/magazine
8898/content/05_22/b3935001_mz001.htm). The
8899identification of the Secret Service agents’ guns
8900also comes from this story.
89018 Attorney General John Ashcroft boasted in a press
8902release: “Nineteen Individuals Indicted in Internet
8903‘Carding’ Conspiracy,” October 28, 2004
8904(http://www.justice.gov/usao/nj/press/files/pdffiles/fire1028rel.pdf).
8905
8906Chapter 17: Pizza and Plastic
89071 His scanning put him inside a Windows machine:
8908Max, Jonathan Giannone, and Brett Johnson each
8909independently identified the Pizza Schmizza in
8910Vancouver, Washington, as the source of Max’s
8911dumps in this period. The store manager said the
8912restaurant has since changed ownership, and she
8913had no knowledge of a breach.
89142 Max couldn’t help feeling cheated yet again:
8915Interviews with Max.
89163 Giannone was a smart middle-class kid with a
8917coke habit: Giannone confirmed the cocaine use
8918and all the details of his relationship with Max and
8919Aragon. He discussed the elevator button pressing
8920and the “bank robbery” prank in a chat with another
8921carder, a log of which was provided to the author.
8922Giannone confirmed in an interview that he
8923discussed the bank robbery hoax but said it was an
8924idle boast, and he didn’t actually pull it off. He said
8925he did not recall the elevator matter.
89264 Giannone joined Shadowcrew and CarderPlanet
8927under the handle MarkRich: Giannone’s transition
8928through various handles was confirmed by Giannone
8929in an interview. Posts on the forums reviewed by the
8930author confirm he gave up his original handle after
8931being suspected of informing on an associate while
8932a juvenile.
89335 launched a DDoS attack against JetBlue:
8934Giannone also discussed this attack in the
8935abovementioned chat logs. He confirmed it in
8936interviews with the author.
89376 the teen was running his operations from the
8938computer in his mother’s bedroom: Interviews with
8939Max.
8940
8941Chapter 18: The Briefing
89421 Mularski had wanted to be an FBI agent since his
8943freshman year: Mularski’s biographical details and
8944his early work at NCFTA come from interviews with
8945Mularski.
89462 The briefing for about half a dozen FBI agents:
8947Interviews with J. Keith Mularski and Postal
8948Inspector Greg Crabb.
8949
8950Chapter 19: Carders Market
89511 “Sherwood Forest” wasn’t going to cut it for a
8952criminal marketplace: Aragon’s rejection of the
8953name comes from interviews with Max and a letter
8954Max later wrote his sentencing judge.
89552 Janer, an avid watch collector, headed straight to
8956Richard’s: Janer explained his motives in the failed
8957watch caper in interviews, and Aragon confirmed he
8958provided Janer with cards as a favor. The criminal
8959case file describes how he was busted and his
8960subsequent cooperation, which Janer confirmed.
8961U.S. v. Werner William Janer, 3:06-cr-00003, U.S.
8962District Court for the District of Connecticut.
89633 He hacked into a Florida data center run by
8964Affinity Internet: Court records confirm Carders
8965Market was hosted at Affinity at this time and that
8966Affinity later provided the FBI with a copy of the file
8967system. Max detailed the hack in interviews and in
8968contemporaneous postings to an Internet message
8969board as “Iceman.”
89704 “I’m looking to make a good pile of money”: Chat
8971logs admitted as evidence in U.S. v. Jonathan
8972Giannone, 3:06-cr-01011, U.S. District Court for the
8973District of South Carolina. Online chats and
8974message board posts in this book are verbatim
8975when they appear within quotes, except for some
8976minor changes of grammar, punctuation, or spelling
8977for readability.
8978
8979Chapter 20: The Starlight Room
89801 Tsengeltsetseg Tsetsendelger was being kissed:
8981Aragon, Max, and other sources confirm that
8982Tsetsendelger was recruited at the Starlight Room
8983and brought back to Aragon’s hotel. The details
8984come from interviews with Tsetsendelger. Liz and
8985Michelle Esquere declined comment.
8986
8987Chapter 22: Enemies
89881 required technicians to reboot the machine every
898949.7 days: Sources include Linda Geppert, “Lost
8990Radio Contact Leaves Pilots on Their Own,” IEEE
8991Spectrum, November 2004
8992(http://spectrum.ieee.org/aerospace/aviation/lostradio-
8993contact-leaves-pilots-on-their-own).
89942 Giannone was pretty sure he couldn’t hack Macs:
8995Interview with Giannone. Max acknowledges that he
8996hacked Giannone frequently and tracked his
8997movements, and was also prone to sending long
8998messages to Giannone, and others, reflecting his
8999thoughts. He also clarified that he had no problem
9000hacking Macs.
90013 So he reached out to Thomas by ICQ to try to
9002head off trouble: Max and Aragon discussed their
9003ongoing conflict with Thomas, who also detailed his
9004suspicions about Carders Market and Johnson on
9005his own website, the Grifters. Additionally, the author
9006obtained a log of the chat between Aragon and
9007Thomas quoted herein.
9008
9009Chapter 23: Anglerphish
90101 He needed the money, plain and simple:
9011Johnson’s personal story comes from a sworn
9012affidavit he filed in his criminal case on April 13,
90132007, and a letter he wrote his sentencing judge on
9014March 1, 2007. See U.S. v. Brett Shannon
9015Johnson, 3:06-cr-01129, U.S. District Court for the
9016District of South Carolina.
90172 displayed simultaneously on a forty-two-inch
9018plasma screen hanging on the wall of the office:
9019Trial transcript in U.S. v. Jonathan Giannone, 3:06-
9020cr-01011, U.S. District Court for the District of South
9021Carolina.
90223 The suspect had done everything but deep-clean
9023the carpet and paint the walls: Interview with Justin
9024Feffer, senior investigator, High Technology Crime
9025Division, Los Angeles County District Attorney’s
9026Office. Also see The People of the State of
9027California v. Shawn Mimbs, BA300469, Superior
9028Court of California, County of Los Angeles. Mimbs
9029declined comment.
90304 The needles were steady as Johnson answered
9031the first two questions: According to Johnson. The
9032Secret Service declined to discuss Operation
9033Anglerphish.
90345 “I will hound you for the rest of your life”: From
9035Johnson’s letter to his sentencing judge.
9036
9037Chapter 24: Exposure
90381 “Tea, these girls are white trash”: Interview with
9039Tsengeltsetseg Tsetsendelger. Aragon mentioned
9040his fondness for Tsetsendelger in interviews and a
9041letter to the author.
90422 Iceman, she’d decided, was pretty cool: Interview
9043with Tsetsendelger. Max says he was respectful in
9044chats with her but privately disliked her.
90453 “Get out of here”: The incident at the pool comes
9046from interviews with Tsetsendelger and Giannone.
90474 The bug was in the brief handshake sequence:
9048See CERT Vulnerability Note VU#117929. The bug
9049was discovered accidentally by Steve Wiseman of
9050Intelliadmin.com while he was writing and testing a
9051VNC client. Technical details come from an analysis
9052by James Evans; see http://marc.info/?
9053l=bugtraq&m=114771408013890&w=2.
90545 a widely read computer security blog: “Schneier on
9055Security” by Bruce Schneier.
9056http://www.schneier.com/blog/archives/2006/06/interview_with_1.html.
90576 a random blog called “Life on the Road”: See
9058http://afterlife.wordpress.com/2006/06/19/cardersmarketshadowcrew-
9059and-credit-card-theft/ and
9060http://afterlife.wordpress.com/2006/07/12/cardingweb-
9061sites/.
9062
9063Chapter 25: Hostile Takeover
90641 Carders Market had six thousand members now:
9065Max, his former administrator Th3C0rrupted0ne,
9066and other carders say the site had in excess of six
9067thousand users after the hostile takeover. The
9068Justice Department, though, has put the number at
9069forty-five hundred.
90702 secret even from his mother: According to his
9071mother, Marlene Aragon.
9072
9073Chapter 26: What’s in Your Wallet?
90741 industry-funded report by Javelin Research:
9075Javelin Strategy and Research, “2007 Identity Fraud
9076Survey Report,” February 2007. The report was
9077sponsored by Visa USA, Wells Fargo, and
9078CheckFree, and then prominently cited by Visa USA
9079in a PowerPoint presentation at a Federal Trade
9080Commission workshop: “50% of known thieves
9081—were known by the victim!” (emphasis original).
9082Also see the author’s “Stolen Wallets, Not Hacks,
9083Cause the Most ID Theft? Debunked,” Wired.com,
9084February 12, 2009
9085(http://www.wired.com/threatlevel/2009/02/stolenwallets/).
90862 Visa’s private numbers told the real story:
9087Presentation by Steven Johnson, director, Visa
9088U.S.A. Public Sector Sales, at the ninth annual GSA
9089SmartPay Conference in Philadelphia, August 23,
90902007. The presentation slides are marked “Visa
9091Confidential.”
90923 C0rrupted had discovered the warez scene on
9093dial-up bulletin board systems: Biographical
9094information comes from telephone and online
9095interviews with Th3C0rrupted0ne, who spoke on
9096condition that his real name not be reported.
90974 “I can’t believe how much you know about me”:
9098Interview with Aragon.
90995 “Do not follow unsolicited links”: US-CERT
9100Technical Cyber Security Alert TA06-262A
9101(http://www.kb.cert.org/vuls/id/416092).
91026 Each copy of the message was customized: The
9103text of the spear phishing e-mail comes from an FBI
9104affidavit filed in U.S. v. Max Ray Butler, 3:07-mj-
910500438, U.S. District Court for the Eastern District of
9106Virginia. “Mary Rheingold” is not a real name and
9107was added by the author in place of “[First Name
9108and Last Name of Recipient]” in the original court
9109document.
9110
9111Chapter 27: Web War One
91121 “The Secret Service and FBI declined to comment
9113on Iceman or the takeovers”: Byron Acohido and
9114Jon Swartz, “Cybercrime flourishes in online hacker
9115forums,” USA Today, October 11, 2006.
91162 “You’ve lost your fucking mind”: Interview with
9117Chris Aragon.
91183 Bank of America and Capital One, in particular,
9119were huge institutions: Of his spear-phishing
9120attacks, Max was charged only with the Capital One
9121intrusion. The other victims were identified by Max.
9122
9123Chapter 28: Carder Court
91241 it was just Silo trying to gather intelligence on
9125DarkMarket members for the police: Max, Mularski,
9126and Th3C0rrupted0ne identified Liske as Silo. In
9127extensive interviews, Liske was evasive about his
9128activities on the forums but spoke obliquely of his
9129work as an informant and his relationship with Max.
9130“Max was a good case. You know, he was a
9131challenge.” On the NCFTA Trojan, he said: “Isn’t it
9132reasonable to assume that whoever was dishing out
9133Trojans was actually dishing out Trojans to everyone
9134in the scene?” Later, “If it were malicious I could
9135have—someone could have caused real damage.”
9136Detective Mark Fenton of the Vancouver Police
9137Department said Canadian law prohibits him from
9138identifying or confirming an informant’s identity. On
9139the subject of whether he received hacked evidence
9140from informants, he said: “I know down in the States,
9141if an individual received any information that is
9142suspect, it’s not admissible. Up here, if someone
9143tells me something, I say, ‘Where did you hear that
9144from?’ He says, ‘I heard it from some guy.’ ” He
9145likened the arrangement to the Crime Stoppers tip
9146program. “Should Crime Stoppers be scrapped
9147because we have criminals phoning in tips about
9148other criminals?” One unanswered question is to
9149what degree, if any, the Secret Service leaned on
9150hacked information provided by the VPD to build
9151cases in the United States. The Secret Service
9152declined to make agents available to the author:
9153“Although we have chosen not [to] participate with
9154this particular project, feel free to approach us with
9155other ideas in the future.”
91562 the same user had once registered another
9157address through the company: Max says Night Fox
9158was responsible for registering the Financial Edge
9159News website and made this blunder.
9160
9161Chapter 29: One Plat and Six Classics
91621 “for 150 classics”: Affidavit of Secret Service
9163Special Agent Roy Dotson, July 24, 2007, filed in
9164USA v. E-Gold, LTD , 1:07-cr-0019, U.S. District
9165Court for the District of Columbia. For the complete
9166history of e-gold, see Kim Zetter, “Bullion and
9167Bandits: The Improbable Rise and Fall of E-Gold,”
9168Wired.com, June 9, 2007.
91692 They were working closely with Silo’s handler at
9170the Vancouver Police Department: Word of the
9171meeting got back to Liske. “There was an
9172accusation that I was Iceman,” he said in an
9173interview. “And there was a big presentation made
9174that this guy was Iceman. And the people this was
9175presented to knew full well that I wasn’t.”
9176
9177Chapter 30: Maksik
91781 straight from Maksik’s massive database of stolen
9179cards: U.S. v. Maksym Yastremski , 3:06-cr-01989,
9180U.S. District Court for the Southern District of
9181California.
91822 In early 2006, the Ukranians finally identified
9183Maksik as one Maksym Yastremski: Interview with
9184Greg Crabb.
91853 they secretly copied his hard drive for analysis:
9186Government filing dated July 24, 2009, in U.S. v.
9187Albert Gonzalez, 2:08-cr-00160, U.S. District Court
9188for the Eastern District of New York.
91894 “We were lucky in this case, because Salgado’s
9190purchaser was cooperating with the FBI”: Written
9191testimony of Robert S. Litt, deputy attorney general,
9192before the Subcommittee on Telecommunications,
9193Trade and Consumer Protection, House Commerce
9194Committee, September 4, 1997
9195(http://www.justice.gov/criminal/cybercrime/daag9_97.htm).
91965 But the feds lost the crypto wars: For a detailed
9197history, see Steven Levy, Crypto: How the Code
9198Rebels Beat the Government—Saving Privacy in
9199the Digital Age (New York: Penguin Books, 2002).
9200
9201Chapter 31: The Trial
92021 “So, you take my girls out to party now?”: Interview
9203with Giannone.
92042 Once a jury is seated, a defendant’s chances for
9205acquittal are about one in ten: Fiscal year 2006.
9206Calculated from “Federal Justice Statistics, 2006—
9207Statistical Tables,” U.S. Department of Justice,
9208Bureau of Justice Statistics, May 1, 2009
9209(http://bjs.ojp.usdoj.gov/index.cfm?
9210ty=pbdetail&iid=980).
92113 “I suspect that you are never going to look at the
9212Internet exactly the same way again”: Trial
9213transcript in U.S. v. Jonathan Giannone, 3:06-cr-
921401011, U.S. District Court for the District of South
9215Carolina. Some grammatical changes were made
9216for readability.
92174 “Who’s Iceman?”: Interview with Giannone.
9218
9219Chapter 32: The Mall
92201 his new partner, twenty-three-year-old Guy Shitrit:
9221Information about Shitrit’s trouble in Miami comes
9222from Aragon. Detective Robert Watts of the Newport
9223Beach Police Department confirmed he’d heard the
9224same account. Shitrit, now in custody, did not
9225respond to a letter from the author.
92262 His wife, Clara, had brought in $780,000 on eBay
9227in a little over three years: Based on sales figures
9228from Clara Aragon’s eBay account obtained by the
9229Newport Beach Police Department. Aragon
9230declined to discuss his profits.
92313 Max, he felt, was ignoring the Whiz List, their
9232blueprint for building one big score and getting out:
9233Interview with Aragon. When police searched
9234Aragon’s cell phone, they found this entry on his
9235electronic to-do list: “tackle whiz list.”
92364 in meticulous, hand-drawn spreadsheets
9237summing up how much Chris owed her for each instore
9238appearance: One such spreadsheet was
9239seized by the Newport Beach Police Department
9240and seen by the author.
92415 Vigo was looking for a way to pay down a $100,000
9242debt to the Mexican Mafia: This according to Vigo’s
9243statements to the police following his arrest. The
9244Newport Beach Police Department found a copy of
9245the shipping manifest in Vigo’s office.
92466 Bloomingdale’s security people didn’t like to upset
9247the store’s customers: Interview with Detective
9248Robert Watts.
92497 thirty-one Coach bags, twelve new Canon
9250PowerShot digital cameras: Per the search warrant
9251seizure records.
9252
9253Chapter 33: Exit Strategy
92541 Max decided to invest in a rope ladder: Interview
9255with Max.
92562 Max finally learned about Giannone’s bust from a
9257news article: Kim Zetter, “Secret Service Operative
9258Moonlights as Identity Thief,” Wired.com. June 6,
92592007
9260(http://www.wired.com/politics/law/news/2007/06/secret_service).
92613 He was growing jumpier every day: Based on an
9262interview with Charity Majors. Max says he was alert
9263but not jumpy.
92644 a judge approved his legal name change from
9265Max Butler to Max Ray Vision: In Re: Max Ray
9266Butler, CNC-07-543988, County of San Francisco,
9267Superior Court of California.
92685 Silo had hidden a second message: Interview with
9269Max. Lloyd Liske would neither confirm nor deny this
9270account.
92716 The company openly marketed the service as a
9272way to circumvent FBI surveillance: “In some
9273countries, government sponsored projects have
9274been set up to collect massive amounts of data from
9275the Internet, including emails, and store them away
9276for future analysis. […] One example of such a
9277program was the FBI’s Carnivore project. By using
9278Hushmail, you can be assured that your data will be
9279protected from that kind of broad government
9280surveillance.”
9281http://www.hushmail.com/about/technology/security/.
92827 forced Hushmail officials to sabotage their own
9283system and compromise specific surveillance
9284targets’ decryption keys: Ryan Singel, “Encrypted EMail
9285Company Hushmail Spills to Feds,” Wired.com.
9286November 7, 2007. Detective Mark Fenton of the
9287Vancouver Police Department said he provided
9288Max’s Hushmail e-mail to the Secret Service.
92898 It was supposed to be a training run for one of
9290Chris’s new recruits: Interviews with Tsengeltsetseg
9291Tsetsendelger and Chris Aragon.
92929 a female Secret Service agent disguised as a
9293maid: The Secret Service’s surveillance, including
9294the ride up the elevator with Max, was described in
9295an affidavit in U. S. v. Max Ray Butler, 2:07-cr-
929600332, U.S. District Court for the Western District of
9297Pennsylvania. Max said in an interview that the
9298agent was dressed as a maid. FBI agent Mularski
9299says the surveillance was on and off for months.
930010 Chris picked out Max’s mugshot from the photos:
9301U.S. v. Max Ray Butler, 2:07-cr-00332, U.S. District
9302Court for the Western District of Pennsylvania.
9303Aragon says the government tricked him by telling
9304him Max had already been arrested, but he also
9305gave them information on Max’s security measures,
9306which undermines that claim. Court records for
9307Aragon’s criminal case in Orange County indicate a
9308sealed letter from Dembosky is on file. The People
9309of the State of California vs. Christopher John
9310Aragon, et al., 07HF0992, Superior Court of
9311California, County of Orange.
931211 Two had lost power when an agent tripped over an
9313electrical cable: According to Max.
931412 Max’s head snapped to look at Master Splyntr:
9315Interview with Mularski.
931613 “You were right”: Interview with Charity Majors.
931714 “Why do you hate us?”: Interview with Max.
9318
9319Chapter 34: DarkMarket
93201 he told a harrowing story: “Son bilgiyi verecekken
9321yok oldu!” Haber 71, August 12, 2008
9322(http://www.haber7.com/haber/20080812/Sonbilgiyi-
9323verecekken-yok-oldu.php).
93242 fingering a known member of Cha0’s organization
9325as the shipper: Mularski described the genesis of
9326the investigation. The role played by the shipping
9327companies was detailed by Uri Rivner of RSA in a
9328blog post (http://www.rsa.com/blog/blog_entry.aspx?
9329id=1451). The Turkish National Police referred
9330inquiries to their embassy in Washington, DC, which
9331declined to make detectives available for interviews.
93323 a tall, beefy man with close-cropped hair and a
9333black T-shirt emblazoned with the Grim Reaper:
9334Per police video of the arrest and search. Also see
9335“Enselenen Chao sanal semayi anlatti,” Haber 7,
9336September 12, 2008
9337(http://www.haber7.com/haber/20080912/Enselenen-
9338Chao-sanal-semayi-anlatti.php).
93394 matching his appearances at the Java Bean with
9340JiLsi’s posts: Interview with Mularski. Also see
9341Caroline Davies, “Welcome to DarkMarket—global
9342one-stop shop for cybercrime and banking fraud,”
9343Guardian, January 4, 2010
9344(http://www.guardian.co.uk/technology/2010/jan/14/darkmarketonline-
9345fraud-trial-wembley).
93465 JiLsi’s associate, sixty-seven-year-old John
9347“Devilman” McHugh, Ibid.
93486 Erkan “Seagate” Findikoglu: Interview with
9349Mularski. Also see Fusun S. Nebil, “FBI Siber
9350Suçlarla, ABD Içinde ve Disinda Isbirlikleri ile
9351Mücadele,” Turk.internet.com, June 15, 2010
9352(http://www.turk.internet.com/portal/yazigoster.php?
9353yaziid=28171).
93547 Twenty-seven members of Seagate’s organization
9355were charged in Turkey: Interview with Mularski.
93568 a reporter for Südwestrundfunk, Southwest
9357Germany public radio: The reporter was Kai
9358Laufen. See
9359http://www.swr.de/swr2/programm/sendungen
9360/wissen/-
9361/id=660374/nid=660374/did=3904422/p6601i/index.html.
93629 The U.S. press picked up the story: The author
9363was the first to identify J. Keith Mularski by name as
9364the FBI agent posing as Master Splyntr, in
9365“Cybercrime Supersite ‘DarkMarket’ Was FBI Sting,
9366Documents Confirm,” Wired.com, October 13, 2008
9367(http://www.wired.com/threatlevel/2008/10/darkmarketpost/).
9368
9369Chapter 35: Sentencing
93701 It had taken the CERT investigators only two
9371weeks to find the encryption key: Max well knew that
9372the key was vulnerable while in RAM, but he
9373believed the software security on his server would
9374prevent anyone from gaining access to its memory.
9375CERT’s Matt Geiger, who led the forensics team,
9376declined to comment on how he bypassed that
9377security but he said he was able to run memoryacquisition
9378software on Max’s computer.
93792 Max had stolen 1.1 million of the cards from pointof-
9380sale systems: Max didn’t challenge this amount
9381for sentencing, but in interviews he expressed
9382disbelief that the number could be that high.
9383
9384Chapter 36: Aftermath
93851 An undercover Secret Service operative lured him
9386to a nightclub: “2010 Data Breach Investigations
9387Report,” Verizon RISK Team in cooperation with the
9388United States Secret Service, July 28, 2010.
93892 ICQ user 201679996: Affidavit In Support of Arrest
9390Warrant, May 8, 2007, U.S. v. Albert Gonzalez,
93912:08-mj-00444, U.S. District Court for the Eastern
9392District of New York.
93933 it was Jonathan James who would pay the highest
9394price: See the author’s “Former Teen Hacker’s
9395Suicide Linked to TJX Probe,” Wired.com, July 9,
93962009
9397(http://www.wired.com/threatlevel/2009/07/hacker/).
93984 They recruit ordinary consumers as unwitting
9399money launderers: For more detail on these socalled
9400“money mule” scams, see the blog of former
9401Washingtonpost.com reporter Brian Krebs, who has
9402covered the crime extensively:
9403http://krebsonsecurity.com/.
94045 the Secret Service had been paying Gonzalez an
9405annual salary of $75,000 a year: First reported in
9406Kim Zetter, “Secret Service Paid TJX Hacker
9407$75,000 a Year,” Wired.com, March 22, 2010.
94086 filed by the attorneys general of 41 states: Sources
9409include Dan Kaplan, “TJX settles over breach with
941041 states for $9.75 million,” SC Magazine, June 23,
94112009 (http://www.scmagazineus.com/tjx-settlesover-
9412breach-with-41-states-for-975-
9413million/article/138930/).
94147 another $40 million to Visa-issuing banks: Mark
9415Jewell, “TJX to pay up to $40.9 million in settlement
9416with Visa over data breach,” Associated Press,
9417November 30, 2007.
94188 Heartland had been certified PCI compliant:
9419Sources include Ellen Messmer, “Heartland breach
9420raises questions about PCI standard’s
9421effectiveness,” Network World, January 22, 2009
9422(http://www.networkworld.com/news/2009/012209-
9423heartland-breach.html).
94249 Hannaford Brothers won the security certification
9425even as hackers were in its systems: Sources
9426include Andrew Conry-Murray, “Supermarket Breach
9427Calls PCI Compliance into Question,”
9428InformationWeek, March 22, 2008.
942910 The restaurants filed a class-action lawsuit:
9430http://www.prlog.org/10425165-secret-serviceinvestigation-
9431lawsuit-cast-shadow-over-radiantsystems-
9432and-distributo.html. Also, “Radiant Systems
9433and Computer World responsible for breach
9434affecting restaurants—lawsuit,” Databreaches.net,
9435November 24, 2010 (http://www.databreaches.net/?
9436p=8408) and Kim Zetter, “Restaurants Sue Vendor
9437for Unsecured Card Processor,” Wired.com,
9438November 30, 2009
9439(http://www.wired.com/threatlevel/2009/11/pos).
944011 White hats have devised attacks against chipand-
9441PIN: See Steven J. Murdoch, Saar Drimer,
9442Ross Anderson, and Mike Bond, “Chip and PIN Is
9443Broken,” University of Cambridge Computer
9444Laboratory, Cambridge, UK. Presented at the 2010
9445IEEE Symposium on Security and Privacy, May
94462010
9447(http://www.cl.cam.ac.uk/research/security/banking/nopin/).
9448The response by the UK Card Association is at
9449http://www.theukcardsassociation.org.uk/
9450view_point_and_publications/what_we_think/-
9451/page/906/.
945212 hundreds of thousands of point-of-sale terminals
9453with new gear: The cards themselves are more
9454expensive as well. For a more thorough discussion
9455of the issues holding back chip-and-PIN’s adoption
9456in the United States, see Clases Bell, “Are chip and
9457PIN credit cards coming?” Bankrate.com, February
945818, 2010
9459(http://www.foxbusiness.com/story/personalfinance/
9460financial-planning/chip-pin-creditcardscoming/).
9461See also Allie Johnson, “U.S. credit cards
9462becoming outdated, less usable abroad,”
9463Creditcards.com (http://www.creditcards.com/creditcard-
9464news/outdated-smart-card-chip-pin-1273.php).
9465Epilogue
94661 His mother suggested he get an agent: A letter to
9467the author from Aragon.
9468
9469ACKNOWLEDGMENTS
9470I first encountered Max Vision some ten years ago, when I
9471was a newbie reporter for the computer security site
9472SecurityFocus.com. Max was then facing charges over his
9473scripted attack on thousands of Pentagon systems, and I
9474was fascinated by the story playing out in the Silicon Valley
9475courtroom, where the federal justice system was bearing
9476down on a once-respected computer security expert who’d
9477upended his life with a single, quixotic hack.
9478Years later, after I’d reported on hundreds of computer
9479crimes, vulnerabilities, and software glitches, Max was
9480arrested again, and a new federal indictment exposed the
9481secret life he’d led after his fall from grace. As I
9482investigated, I grew certain that Max, more than anyone
9483else, embodied the sea change I’d witnessed in the world
9484of hacking, and would be the perfect lens through which to
9485explore the modern computer underground.
9486Fortunately, others agreed. I owe a debt of thanks to my
9487agent, David Fugate, who guided me through the process
9488of developing my idea into a book proposal, and my editor
9489at Crown, Julian Pavia, who worked tirelessly to keep me
9490on course and only slightly behind schedule throughout a
9491year of reporting, writing, and rewriting.
9492Also crucial was the enormous support from my boss,
9493Evan Hansen, editor in chief at Wired.com. And I’m grateful
9494to my colleagues at Wired.com’s Threat Level blog, Kim
9495Zetter, Ryan Singel, and David Kravets, who collectively
9496shouldered the burden of my absence for two months while
9497I finished the book and then braved the burden of my
9498irritable, bleary-eyed return afterward.
9499My thanks also to Joel Deane and Todd Lapin, who
9500showed me the ropes when I became a journalist in 1998,
9501and Al Huger and Dean Turner of SecurityFocus.com.
9502and Al Huger and Dean Turner of SecurityFocus.com.
9503Jason Tanz at Wired magazine did an amazing job with my
9504feature article on Max, “Catch Me If You Can,” in the
9505January 2009 issue.
9506Among my guides in this book were the cops, feds,
9507hackers, and carders who spoke with me at length, with no
9508benefit to themselves. FBI Supervisory Special Agent J.
9509Keith Mularski was particularly generous with his time, and
9510Max Vision spent many hours on the prison phone and
9511writing long e-mails and letters to share his story with me.
9512My thanks to U.S. Postal Inspector Greg Crabb,
9513Detective Bob Watts of the Newport Beach Police
9514Department, former FBI agent E. J. Hilbert, and Assistant
9515U.S. Attorney Luke Dembosky, the latter of whom wouldn’t
9516tell me much, but was always nice about it. And I’m grateful
9517to Lord Cyric, Lloyd Liske, Th3C0rrupted0ne, Chris
9518Aragon, Jonathan Giannone, Tsengeltsetseg
9519Tsetsendelger, Werner Janer, Cesar Carranza, and other
9520veterans of the carder scene who asked to remain
9521unnamed.
9522The story of Max Vision would have listed heavily to his
9523criminal side were it not for Tim Spencer and Marty
9524Roesch, who shared their experience of Max as white-hat
9525hacker, and Kimi Mack, who spoke candidly about her
9526marriage to Max. My thanks also to security wunderkind
9527Marc Maiffret, who helped isolate some of Max’s exploits.
9528The underworld that Kingpin delves into has been
9529illuminated by a number of first-rate journalists, including
9530Bob Sullivan, Brian Krebs, Joseph Menn, Byron Acohido,
9531Jon Swartz, and my Wired colleague Kim Zetter.
9532Finally, my thanks to my wife, Lauren Gelman, without
9533whose loving support and sacrifice this book would not
9534have been possible, and to Sadelle and Asher, who will find
9535their computer use closely supervised until they’re eighteen.
9536
9537ABOUT THE AUTHOR
9538KEVIN POULSEN is a senior editor at Wired.com and a
9539contributor to Wired magazine. He oversees cybercrime,
9540privacy, and political coverage for Wired.com and edits the
9541award-winning Threat Level blog (wired.com/threatlevel),
9542which he founded in 2005. He’s broken numerous national
9543stories, including the FBI’s use of spyware in criminal and
9544national security investigations; a hacker’s penetration of a
9545Secret Service agent’s confidential files; and the secret
9546arrest of an Army intelligence officer accused of leaking
9547documents to whistle-blowing website WikiLeaks. In 2009
9548he was inducted into MIN’s Digital Hall of Fame for online
9549journalism and in 2010 was voted one of the “Top Cyber
9550Security Journalists” by his peers.