‘Spiderman’ Hacker Daniel Kaye Took Down Liberia’s Internet(bloomberg.com)
bloomberg.com
‘Spiderman’ Hacker Daniel Kaye Took Down Liberia’s Internet
https://www.bloomberg.com/news/features/2019-12-20/spiderman-hacker-daniel-kaye-took-down-liberia-s-internet
53 comments
That's super interesting. How was your experience working with the government? I had reached out a long while back to some people formerly in the govt to ask if I could volunteer some months of my time on e-gov stuff and the main response I got was along the lines of "we need to focus on agriculture and basic needs, digital isn't relevant yet."
I was there on a contract with an NGO, funded by the US CDC. The main project was to build a system for collecting reports of suspected epidemic diseases, including but not limited to Ebola, and correlate and track them with lab tests. I quickly realized that odds of actually getting the system implemented was low, so decided to focus on team building and spreading knowledge to my Liberian, Guinean and Nigerian colleagues. We built a pretty cool system with opportunistic sync, eventually syncing data with the MoH DHIS2 system, but obviously politics was the most important thing, and I had no real chance of succeeding with that. They rolled it out for testing in two counties, then the regime changed and it was scrapped. I did my best to spend the US tax money locally instead (I'm a big believer in helping by dealing out cash).
Another project was to build a database of all local health facilities. That would have been quite easy--basically, an Excel sheet would have been good enough as far as I understand, but the problem was that the data didn't exist. Travelling around the country to see which facilities were still operating, and tracking new ones, would have been an amazing experience, but that wasn't in my job description. There was a guy tasked with that, and AFAIK nothing happened on that side of the project during the six months I was there.
On the whole, I got quite a bleak impression of NGO work. There were some seeming to do some good work, and other, more experienced and jaded, "expats" I met gave me the vibe of good luck with that, I guess. One problem is that many NGOs want to be "cool" and high tech, where what could actually help would be to basically be a smart, good spirited renegade hacker implementing as simple solutions as possible, and most importantly working directly with the health staff, lab technicians, and the people actually working the central systems. I was shielded from that, probably for small-scale organizational politic reasons, and was too inexperienced to begin with, to work around all that. It's a strange world in a strange land, and were I to do it again I would go about it quite differently. Basically commandeering what resources I could and not minding the organization I was contracted with.
Ever since, I've looked at solutions using drones, and I found a drone system which would fit the constraints (quite large distances, cooling necessary, fast, energy efficient) but that would take a cool $1M USD just to start. I'm still in touch with a couple of CDC guys who would also like to do that, closely monitoring zipline and other similar systems, but the constraints are different. The US money dried up quickly since--when Trump dropped his "shithole countries" schtick, a lot of Liberians took it as a personal insult, I think.
It's clear to me that the US has a huge part in the troubles of the country, not only it's founding but continuing to this day, but some Americans working for the embassy and other US institutions saw it quite differently.
My native Sweden also has a large presence in the country, having operated LAMCO, a huge iron mining operation as a joint venture between the Swedish government and US steel giant Bethlehem steel. They left as war was brooding, and the vast infrastructure is since taken over by Arcelor Mittal, their only mining operation, I think. The ore is extremely pure, 85-90% iron I think, so it's basically just digging up iron and carting it off by train to the port of Buchanan.
LAMCO built the railway, individual houses for thousands of people, free schools, hospital, free trade schools for adults, as well as a go cart track, five tennis courts, an 18 hole golf course and an Olympic size swimming pool, cooled by pumping water from a nearby river hundreds of feet into the ground. They did this in the 50s! It's unbelievable when you actually see it. People up there in Nimba are still waiting for the Swedes to come back, a persistent rumor, it seems. Mittal is disliked by the people.
Another project was to build a database of all local health facilities. That would have been quite easy--basically, an Excel sheet would have been good enough as far as I understand, but the problem was that the data didn't exist. Travelling around the country to see which facilities were still operating, and tracking new ones, would have been an amazing experience, but that wasn't in my job description. There was a guy tasked with that, and AFAIK nothing happened on that side of the project during the six months I was there.
On the whole, I got quite a bleak impression of NGO work. There were some seeming to do some good work, and other, more experienced and jaded, "expats" I met gave me the vibe of good luck with that, I guess. One problem is that many NGOs want to be "cool" and high tech, where what could actually help would be to basically be a smart, good spirited renegade hacker implementing as simple solutions as possible, and most importantly working directly with the health staff, lab technicians, and the people actually working the central systems. I was shielded from that, probably for small-scale organizational politic reasons, and was too inexperienced to begin with, to work around all that. It's a strange world in a strange land, and were I to do it again I would go about it quite differently. Basically commandeering what resources I could and not minding the organization I was contracted with.
Ever since, I've looked at solutions using drones, and I found a drone system which would fit the constraints (quite large distances, cooling necessary, fast, energy efficient) but that would take a cool $1M USD just to start. I'm still in touch with a couple of CDC guys who would also like to do that, closely monitoring zipline and other similar systems, but the constraints are different. The US money dried up quickly since--when Trump dropped his "shithole countries" schtick, a lot of Liberians took it as a personal insult, I think.
It's clear to me that the US has a huge part in the troubles of the country, not only it's founding but continuing to this day, but some Americans working for the embassy and other US institutions saw it quite differently.
My native Sweden also has a large presence in the country, having operated LAMCO, a huge iron mining operation as a joint venture between the Swedish government and US steel giant Bethlehem steel. They left as war was brooding, and the vast infrastructure is since taken over by Arcelor Mittal, their only mining operation, I think. The ore is extremely pure, 85-90% iron I think, so it's basically just digging up iron and carting it off by train to the port of Buchanan.
LAMCO built the railway, individual houses for thousands of people, free schools, hospital, free trade schools for adults, as well as a go cart track, five tennis courts, an 18 hole golf course and an Olympic size swimming pool, cooled by pumping water from a nearby river hundreds of feet into the ground. They did this in the 50s! It's unbelievable when you actually see it. People up there in Nimba are still waiting for the Swedes to come back, a persistent rumor, it seems. Mittal is disliked by the people.
Throwaway for obvious reasons. Around 13 years ago when I was a lot younger we were in fight with other site community, none of it was for profit. We got hit by DDOS so we wanted to retaliate. We've scanned their DDOS boxes and found out the software that was running on them and vulnerability that they were using, then we hacked that box, got their tools because all was transferred without any encryption (different times). We wrote our own C&C software and started gathering our own botnet. Most of the bots were coming from datacenters so they had high bandwidth pipe. That community we were fighting with moved to offshore hosting in Malaysia. I've used our whole botnet and started DDOSing, oh man, I didn't know what kind of power we had. Whole country (Malaysia) was cut off the rest of the world for hours. Fun times, some teenager from some place in the world can cut off whole country from internet by executing one command.
Did they stop fucking with you after that?
An interesting aspect is how broken the Internet is (those dodgy routers and IP webcams, what other IoT devices can be exploited?), and how critical it actually is, if you can cripple a whole country's economy.
It's not really illustrative to call it a "whole country's economy". Liberia has the same population as LA but only one third of one percent of the GDP. So of course it's not going to be able to afford the protections that a typical country can.
There's a typo in the title; the hacker is known as 'Spdrman', not 'Spiderman'.
Yes, this is an example of https://xkcd.com/386/ so I'm creating an account on HN for the first time.
> The attack against Liberia began in October 2016. More than a half-million security cameras around the world tried to connect to a handful of servers used by Lonestar Cell MTN, a local mobile phone operator, and Lonestar’s network was overwhelmed. Internet access for its 1.5 million customers slowed to a crawl, then stopped.
On a more serious note,this is seriously exaggerated. Internet penetration(mostly mobile broadband) was 21% during this period and was split between LoneStarCell, Cellcom, the govt carrier - Libtelco and smaller ISPs. For a population of 4.5m people, 21% meant each mobile operator had less than 500k Internet subscribers.
The post-apocalyptic description of the impact of the DDoS doesn't fit the feeling in that period ( Nov '16). Friends from outside Liberia reached out (ironically over WhatsApp) to ask whether Liberia's Internet was cut off. I checked and saw international media reporting an Internet shutdown which was even more confusing. After emailing a couple of friends at various ISPs and the regulator, I finally got confirmation that LoneStar was under attack. Apparently, they were keeping it a secret. It did not make national news for another 2 months until the formal complaint and lawsuits were filed. Mobile broadband was very patchy back then so perhaps people just assumed it was the usual state of affairs. Now, we have LTE on both operators and an upcoming pre-5G operator.
Source: I'm from and have been based in Liberia (2015-present) and used to manage services at the national Internet exchange during that period.
National Regulator: http://www.emansion.gov.lr/doc/CONSULTATION-DOCUMENT.pdf Export.Gov: https://www.export.gov/article?id=Liberia-Telecommunications... Twitter Thread: https://mobile.twitter.com/tksiakor/status/79486360223055872...
> The attack against Liberia began in October 2016. More than a half-million security cameras around the world tried to connect to a handful of servers used by Lonestar Cell MTN, a local mobile phone operator, and Lonestar’s network was overwhelmed. Internet access for its 1.5 million customers slowed to a crawl, then stopped.
On a more serious note,this is seriously exaggerated. Internet penetration(mostly mobile broadband) was 21% during this period and was split between LoneStarCell, Cellcom, the govt carrier - Libtelco and smaller ISPs. For a population of 4.5m people, 21% meant each mobile operator had less than 500k Internet subscribers.
The post-apocalyptic description of the impact of the DDoS doesn't fit the feeling in that period ( Nov '16). Friends from outside Liberia reached out (ironically over WhatsApp) to ask whether Liberia's Internet was cut off. I checked and saw international media reporting an Internet shutdown which was even more confusing. After emailing a couple of friends at various ISPs and the regulator, I finally got confirmation that LoneStar was under attack. Apparently, they were keeping it a secret. It did not make national news for another 2 months until the formal complaint and lawsuits were filed. Mobile broadband was very patchy back then so perhaps people just assumed it was the usual state of affairs. Now, we have LTE on both operators and an upcoming pre-5G operator.
Source: I'm from and have been based in Liberia (2015-present) and used to manage services at the national Internet exchange during that period.
National Regulator: http://www.emansion.gov.lr/doc/CONSULTATION-DOCUMENT.pdf Export.Gov: https://www.export.gov/article?id=Liberia-Telecommunications... Twitter Thread: https://mobile.twitter.com/tksiakor/status/79486360223055872...
I read some more info on him from Krebs' blog. Here's a Apache tomcat vulnscan script that he wrote when he was around 19 years old:
https://www.binaryvision.co.il/wp-content/uploads/2011/01/to...
https://www.binaryvision.co.il/wp-content/uploads/2011/01/to...
Note that this has nothing to do with the hack of the Spiderman movie documents circa 2015.
Those of you who worked at Facebook/Google, wouldn't he make more money by simply being L5-L8 at one of those firms?
I always think about this too (with people that decide to resort to this sort of activity..and any criminal activity in general).
The difference: you have full control over your destiny, power that you don't have to spend a decade earning..you just take it, and you don't have ask for permission.
There's also a thrill to it. Something you really don't get from a boring desk job..even for the likes of google and Facebook.
It's very similar to those amateur pedo-busting groups on Youtube. Why not just become a detective? Because you then have to go through all kinds of red tape and answer to an asshole boss when things go wrong.
Instead, you can play super hero for views and subscription numbers.
The difference: you have full control over your destiny, power that you don't have to spend a decade earning..you just take it, and you don't have ask for permission.
There's also a thrill to it. Something you really don't get from a boring desk job..even for the likes of google and Facebook.
It's very similar to those amateur pedo-busting groups on Youtube. Why not just become a detective? Because you then have to go through all kinds of red tape and answer to an asshole boss when things go wrong.
Instead, you can play super hero for views and subscription numbers.
Good point!
I mean the thrill greatly outweighs the monetary reward of this type of activity.
For us non-FANG ppl, what does L5-L8 mean? Are those cybersec job role classifications?
I think https://www.levels.fyi/ gives these classifications.
Here is Google's career ladder for software engineers: https://codingrelic.geekhold.com/2018/08/google-software-eng...
Your typical engineer with relevant education and 5 years of experience is probably about L4/5.
Your typical engineer with relevant education and 5 years of experience is probably about L4/5.
[deleted]
Even if he did get in, it seems unlikely that he'd be able progress beyond L5, after which leadership becomes more important.
I think the OP refers to Level 5 to Level 8 but I don't know what they mean either.
He was making $10k / month cash for one botnet client alone. Factoring in CA taxes that's $16k+ he'd have to be paid at a regular job. He was making a lot more money than that from renting it to others and other undisclosed hacks. Besides, it's not just the money.
L5 at Google makes something like $29k/month according to https://www.levels.fyi/
For context L5s make 33k/mo before taxes. L7s ~66k. L8s are easily in the ~80k+ territory. The bands also get MUCH wider in L6+ land with lots of overlap.
> Daniel Kaye, also known as Spdrman, found regular jobs tough but corporate espionage easy.
Possibly, but it sounds like he was just not wired for a straight job.
For certain people, making money illegally is more fun than making it legally, even in spite of the risk.
Because of the risk.
And deal with all the organizational politics?
> simply being L5-L8
The article says he applied to many companies, and they all turned him down because he was too suspicious.
The article says he applied to many companies, and they all turned him down because he was too suspicious.
>An Israeli/American-owned telecommunications company tries to oust the dominant Liberian-owned company in Liberia, using unsavory tactics meant to shame and humiliate the latter and its users, eventually hoping to sell out to a French telecommunications giant. Oh, and then they just straight-up hack/DDOS them.
I'd like to introduce the term "neo-colonialism" to the discussion.
I'd like to introduce the term "neo-colonialism" to the discussion.
>I'd like to introduce the term "neo-colonialism" to the discussion.
I am curious if you are aware of the context of colonialism with respect to Liberia.
Oddly, many aren't aware, but Liberia was founded as a colony by the American Colonization Society in an attempt to return freed slaves back to Africa.
Although the number of US slaves that colonized Liberia was pretty limited in number (and a minority compared to the number of natives) they took power, and the Country has essentially existed in a state of civil war between the freed slaves (colonists) as minority rulers and the natives who did not view the freed US slaves as Africans.
I am curious if you are aware of the context of colonialism with respect to Liberia.
Oddly, many aren't aware, but Liberia was founded as a colony by the American Colonization Society in an attempt to return freed slaves back to Africa.
Although the number of US slaves that colonized Liberia was pretty limited in number (and a minority compared to the number of natives) they took power, and the Country has essentially existed in a state of civil war between the freed slaves (colonists) as minority rulers and the natives who did not view the freed US slaves as Africans.
The Vice documentary on the cannibal warlords of Liberia is quite shocking. The slaves that were expatriated from America to Liberia promptly enslaved the local population with a nearly identical system to the one they had been taught to live under as slaves.
If you are interest in the subject I recommend reading "The Evolution of Deadly Conflict in Liberia: From 'Paternaltarianism' to State Collapse"
Any idea where to get it without paying an arm and a leg? I see it on Amazon for $199 and then for subscription via a few journals from a quick search
Wow, sorry its something I read about 15 years ago and when I bought it then it was probably in the $19 range.
I checked out Dr. Levitt's website and it was listed for $45, but the buy link just redirects to Amazon where the book is listed used for $199 as you say.
Try contacting Dr. Levitt through his website http://drjeremylevitt.com/, let him know its a topic you are interested in and a former law student from FIU Law recommended the book, he may be able to assist.
I checked out Dr. Levitt's website and it was listed for $45, but the buy link just redirects to Amazon where the book is listed used for $199 as you say.
Try contacting Dr. Levitt through his website http://drjeremylevitt.com/, let him know its a topic you are interested in and a former law student from FIU Law recommended the book, he may be able to assist.
> in an attempt to return freed slaves back to Africa.
Is that why it is called Liberia?
Is that why it is called Liberia?
Indeed. And the capital Monrovia after president Monroe.
I am. As another user mentioned, Liberia was essentially colonized by a Western power. It's a shocking example of the virulence of the culture of exploitation that pervaded the Americas at the time.
>It's a shocking example of the virulence of the culture of exploitation that pervaded the Americas at the time.
Well I think there were both good and bad intentions.
For example, you have Lincoln who of course most would consider an advocate of the abolition of the practice of slavery in the US. And Lincoln supported the American Colonization Society initially, even into the War, but eventually changed his position after speaking with African-American soldiers in his Army (imagine that a politician changing their position on a matter without being ridiculed as a flip-flopper).
On its face without knowing more I think one might think establishing a colony in Africa for freed slaves may have been a noble cause, like Lincoln did at one time, and its not like there weren't a few thousand who took the offer.
Now in practice of course the Whites from the American Colonization Society were the rulers and then the power shifted to the freed US slaves, but of course to the local population they weren't fans of their colonizers white or black.
Well I think there were both good and bad intentions.
For example, you have Lincoln who of course most would consider an advocate of the abolition of the practice of slavery in the US. And Lincoln supported the American Colonization Society initially, even into the War, but eventually changed his position after speaking with African-American soldiers in his Army (imagine that a politician changing their position on a matter without being ridiculed as a flip-flopper).
On its face without knowing more I think one might think establishing a colony in Africa for freed slaves may have been a noble cause, like Lincoln did at one time, and its not like there weren't a few thousand who took the offer.
Now in practice of course the Whites from the American Colonization Society were the rulers and then the power shifted to the freed US slaves, but of course to the local population they weren't fans of their colonizers white or black.
I'll see your "neo-colonialism" and up you one "techno-colonialism".
It's a classic hostile takeover. No new terms needed.
Can I have the phrase "missing the forest through the trees"?
Liberia's history is quite interesting indeed, and I actually like to compare it with the state of Israel -- both are the result of an unholy alliance of people wanting to help, on the one hand, and get rid of, on the other, another people in "their" land: African descendants in the USA, and Jewish people in Europe.
I went back to live in Liberia for three months earlier this year, to try and trace some ancestors of a family member. Things are dire, indeed, with an economy hit hard by the Ebola crisis, on top of years of military rule, civil war, corruption and abuse.
Apart from being used for resources, mainly by Firestone (now Bridgestone) for rubber, but also iron (Arcelor Mittal) and gold (large parts of which is being smuggled to UAE), it remains a strategic interest for the US (their presence is still huge, with CIA's only listening post in Africa), meanwhile trade is controlled by the Indian and Lebanese communities.
Also of interest is that some Cherokee opted to join the free African Americans, with one ending up a chief of the Vai tribe, and possibly inspiring the Vai script with knowledge of the Cherokee script, recently posted here on HN: https://news.ycombinator.com/item?id=21737230