How does one get hired by a top cybercrime gang?(krebsonsecurity.com)
krebsonsecurity.com
How does one get hired by a top cybercrime gang?
https://krebsonsecurity.com/2021/06/how-does-one-get-hired-by-a-top-cybercrime-gang/
151 comments
Seems like they just hacked the one affiliate, not the whole org. I don't think it was FBI undercover blow up the entire northeast oil supply type of conspiracy
>I'm not quite sure what this implies? That the team who did the initial infection was in fact some sort of FBI undercover?
I suppose that's one of the many possibilities that are implied, but its not even close to the most likely.
I think its more likely that some of the attackers' systems or accounts were compromised (AKA hacked).
I suppose that's one of the many possibilities that are implied, but its not even close to the most likely.
I think its more likely that some of the attackers' systems or accounts were compromised (AKA hacked).
US agencies have tried to set up action and had it get away from them. More the CIA than the FBI from memory.
why is that more likely that the attackers systems were compromised?
Does it not sound weird that a cybercrime gang would leave a hot wallet on some random VPS? That seems incredibly unlikely.
Does it not sound weird that a cybercrime gang would leave a hot wallet on some random VPS? That seems incredibly unlikely.
I’m not surprised. There is no reason to suspect they’re going to be particularly elite with that respect.
It doesn’t take a _ton_ of technical proficiency to get ransomware someone else made and target a company with it.
It doesn’t take a _ton_ of technical proficiency to get ransomware someone else made and target a company with it.
If you would have clicked on the link to the article, it's explained in a little more detail and a few experts weigh in with what likely happened: https://krebsonsecurity.com/2021/06/justice-dept-claws-back-...
This article is similarly light on actual details of how they might've done it.
> I'm not quite sure what this implies?
This implies less technically inclined “affiliates” used the malware made by someone else, slipped up and had their 85% cut retrieved. Meanwhile, the creators of the ransomware took their 15% cut safely.
This implies less technically inclined “affiliates” used the malware made by someone else, slipped up and had their 85% cut retrieved. Meanwhile, the creators of the ransomware took their 15% cut safely.
This reminds me of the story in Freakanomics about the street level drug dealers making basically minimum wage, with the majority of the money going to high level traffickers who are typically firewalled through layers of middlemen.
There should be a name for this type of societal organization... anyway, I have a rocketship to catch.
A blue origin one? lol
America?
It is: corporation
If I recall correctly many had regular jobs that even paid better.
The idea of a full time 'career criminal' guy who works at it full time without another job seems less common than people seem to think.
The idea of a full time 'career criminal' guy who works at it full time without another job seems less common than people seem to think.
Most drug dealers I know just do it to achieve a lifestyle they wouldn't normally be capable of with their existing job(s).
Most drug dealers are doing it so they can smoke/drink for free maybe make a few dollars.
While we're being honest, there's a small segment that sells because they think it cool.
That whole gangster rap testosterone street $900 shoe guy.
In college, I moved into a very cheap apartment. I had no idea, it was the worst part of Oakland. I saw some things that didn't make any sense. Some successful dealers had other opportunities. Most probally didn't. I was so naieve, I didn't know my roommate was selling until my second semester. I just though he had a lot of friends. He finally told me what he did one night over a video game.
Where is he now? He's in a midwest prison over dealing pot. Yes, dealing pot. Why? He heard Potheads pay triple for what Californian's pay. He got his brother to come along. I remember him telling his brother, "you don't want to be a Waiter for life?"
He, and his brother go to Ohio. They set up shop. They weren't violent, and didn't fit the stereotypes of a drug dealers.
Everything was fine until they hired this little rich white kid who thought he was in a NWA alternative reality. He was "slinging" their product in his vernacular.
Will this idiot killed a guy over a small amount of pot.
The cops were more interested in the "kingpin" behind the operation.
Well the kid squealed, and the prosecutor threw the book at my friend. They made him out to be Pablo Chicone. He was anything but a hard nosed killer. He never even owned a gun.
Well, he got a long sentence.
That whole gangster rap testosterone street $900 shoe guy.
In college, I moved into a very cheap apartment. I had no idea, it was the worst part of Oakland. I saw some things that didn't make any sense. Some successful dealers had other opportunities. Most probally didn't. I was so naieve, I didn't know my roommate was selling until my second semester. I just though he had a lot of friends. He finally told me what he did one night over a video game.
Where is he now? He's in a midwest prison over dealing pot. Yes, dealing pot. Why? He heard Potheads pay triple for what Californian's pay. He got his brother to come along. I remember him telling his brother, "you don't want to be a Waiter for life?"
He, and his brother go to Ohio. They set up shop. They weren't violent, and didn't fit the stereotypes of a drug dealers.
Everything was fine until they hired this little rich white kid who thought he was in a NWA alternative reality. He was "slinging" their product in his vernacular.
Will this idiot killed a guy over a small amount of pot.
The cops were more interested in the "kingpin" behind the operation.
Well the kid squealed, and the prosecutor threw the book at my friend. They made him out to be Pablo Chicone. He was anything but a hard nosed killer. He never even owned a gun.
Well, he got a long sentence.
I'm sorry to hear that about your friend. Its never good to hear about how someone threw their life away for temporary rewards.
You say they weren't violent, but violence is not the only reason we incarcerate individuals. He broke the law, he knew it, he got caught, and now he's living with those consequences. I hope he learns a lot from this and decides to no longer break the law in the future. I hope others can read your story and decide that breaking the law is not worth it.
People are very cavalier with "non violent drug charges" as if dealing drugs is value neutral. It is not. There is societal harm to dealing drugs and I'm grateful for laws that forbid it and punish individuals that do it.
You say they weren't violent, but violence is not the only reason we incarcerate individuals. He broke the law, he knew it, he got caught, and now he's living with those consequences. I hope he learns a lot from this and decides to no longer break the law in the future. I hope others can read your story and decide that breaking the law is not worth it.
People are very cavalier with "non violent drug charges" as if dealing drugs is value neutral. It is not. There is societal harm to dealing drugs and I'm grateful for laws that forbid it and punish individuals that do it.
The same argument applies to Turing being imprisoned for his homosexuality. There's nothing wrong with marijuana that deserves making it illegal, especially more illegal than murder, which was the point of this story!
That was going to be another point I wanted to raise.
Homosexuality was illegal not so long ago, but it also harms no one and is approximately the business of only those directly involved.
And yet we used to persecute people for... what? Something we'd been conditioned to reflexively disagree with.
Shameful.
Homosexuality was illegal not so long ago, but it also harms no one and is approximately the business of only those directly involved.
And yet we used to persecute people for... what? Something we'd been conditioned to reflexively disagree with.
Shameful.
https://en.wikipedia.org/wiki/Legality_of_cannabis_by_U.S._j...
Marijuana is legal or decriminalised in most of the developed world, including the USA. It's widely accepted to be relatively harmless, much less harmful than alcohol.
This guy? He was an entrepreneur, just another person running a small business with a couple of employees. He didn't deserver a long jail sentence for someone else's fuck up.
Just because it's illegal doesn't mean it's wrong / just because it's legal doesn't mean it's rigth.
Marijuana is legal or decriminalised in most of the developed world, including the USA. It's widely accepted to be relatively harmless, much less harmful than alcohol.
This guy? He was an entrepreneur, just another person running a small business with a couple of employees. He didn't deserver a long jail sentence for someone else's fuck up.
Just because it's illegal doesn't mean it's wrong / just because it's legal doesn't mean it's rigth.
What do we call entrepreneurs that break the law?
Criminals.
Criminals.
What a way to avoid dealing with actual arguments.
Btw we don't.
Most law breaking in entrepreneurship is usually finable misdemeanours. Like 99.99% of it. We don't call those people criminals.
Btw we don't.
Most law breaking in entrepreneurship is usually finable misdemeanours. Like 99.99% of it. We don't call those people criminals.
Didn't Uber start off by breaking laws just about everywhere it operated by being an unlicensed taxi service?
In my opinion its basically a miracle that Uber was ever allowed to operate.
The government seemed to just decide to enforce the law differently because computers were involved.
The government seemed to just decide to enforce the law differently because computers were involved.
Exceptions for those that have a LOT of money...
We who? Depends what law. If you broke the law that prevents harming other people then sure. If however the law is totally unjust (and some of them really are) they might be criminals only from the point of view of the crooks that make our governments and write laws. Me - I would call them victims of fucked up system where some self-righteous POS dictates how people should live their lives.
And yes. Money talk. The less money one has the less chances to get justice.
And yes. Money talk. The less money one has the less chances to get justice.
I'm not sure why people are down voting you. They disagree with the law? The law exists. He broke it. If you don't like it, work to change the law. I got a speeding ticket - can I get a bunch of up votes because no one likes to get a speeding ticket?
As an aside, Americans like to think they live in a bubble. Like their actions are independent from everyone else's and my bad decisions don't impact other people. This simply isn't true in a society where we all interact. There are laws preventing banks from loaning money at high interest rates - because it is bad for society. There are HOAs that maintain neighborhoods - because it is good for the neighborhood. We mandate health insurance (sort of). Amd we have laws regulating drugs.
We can disagree with how the laws are enforced - but we should not pretend that other people's actions have no impact on us.
As an aside, Americans like to think they live in a bubble. Like their actions are independent from everyone else's and my bad decisions don't impact other people. This simply isn't true in a society where we all interact. There are laws preventing banks from loaning money at high interest rates - because it is bad for society. There are HOAs that maintain neighborhoods - because it is good for the neighborhood. We mandate health insurance (sort of). Amd we have laws regulating drugs.
We can disagree with how the laws are enforced - but we should not pretend that other people's actions have no impact on us.
How many people at Wells Fargo went to jail for their massive fraudulent creation of accounts?
People are allowed to be upset with how the law is unevenly applied.
People are allowed to be upset with how the law is unevenly applied.
>"There are HOAs that maintain neighborhoods - because it is good for the neighborhood"
Oh I hate those with all my guts. And no, they're not good for the neighborhood. They're good for destroying whatever little self respect and dignity people have left. I wish those control HOA freaks will go to /dev/null .
Oh I hate those with all my guts. And no, they're not good for the neighborhood. They're good for destroying whatever little self respect and dignity people have left. I wish those control HOA freaks will go to /dev/null .
Upvote given, cheekily! I hate speeding tickets!
I am very much your ideological opponent on this issue, but I agree that there is a solid ethical case for obeying the law regardless of its content, because the rule of law is a phenomenal human achievement that enables us to live vastly more peaceful existences than would be possible if it were absent. My own lifestyle, which doesn't involve much concern at all for self-defense or alliance building wouldn't be possible in conditions with significantly weaker rule of law, and the rule of law is not a given — it can be threatened; we could lose it.
But there's another consideration that's in tension with that one. No one ever ascented to the laws that they're governed by. Yes, there are endless backs and forth in the philosophical literature on this point, but I think the strongest case that governments can justly impose restrictions without explicit consent is going to have to say that there are some kinds of restrictions that governments can impose, but some that they can't. Otherwise you're committed to saying that governments can justly enforce regimes of slavery and so on. The question is how much less evil than slavery do you have to get before governments can justly impose restrictions on their subjects.
You say that selling drugs is not value neutral. I agree. It's value-positive. Drug dealers are heroes: they put their lives and freedoms on the line to let others enjoy the cognitive liberty that their governments would deprive them of. The idea of cognitive liberty is that it is a human right to have the freedom to shape your conscious experience as you see fit. It's not presently recognized as a human right by any nation, but neither was freedom of thought some centuries ago, yet we don't recognize historical rulers as particularly respectful of human rights. The legal scholar Richard Glen Boire has spent his career elaborating and promoting this principle.
You're, I take it, concerned that drugs cause harm to the people who use them and the people near those who use them. Drugs definitely do have the potential to cause harm (although cannabis, the drug in question, is especially weak in its potential to cause harm). But the idea that people have about the harm of drugs is distorted in three main ways:
1. Prohibition makes drugs far more expensive than they would be without distortionary market policy. Much of the harm of drugs comes from people being driven into poverty by addiction. This is almost entirely a consequence of prohibition, and would be a much lesser problem under a regime that respected cognitive liberty.
2. There's selection bias in the stories that we hear about users of drugs. Due to the stigma and legal risks around drug use, people who are able to keep their drug use private choose to keep it private, and we get an exaggerated sample of people who end up in need of an intervention or on the streets as a result of their drug use. See the recent book Drug Use For Grown-Ups by Dr. Carl Hart for more on this.
3. The lack of drug education, and the belief — widespread even among users of drugs — that drug use is inherently self destructive, leads people to be far more reckless in their drug use than is necessary. Certainly there will always be people who are reckless with drugs, but we can do a lot better than having young people learn about drugs from their peers in contexts where it's uncool to be concerned with safety, and half the point of the activity is to signal disregard for authority and rules.
I'm not sure that respecting people's cognitive liberty wouldn't result in more people suffering at the hands of their own drug use, but I suspect that it would be fewer than most people imagine. And cognitive liberty is something that's valuable in itself.
But there's another consideration that's in tension with that one. No one ever ascented to the laws that they're governed by. Yes, there are endless backs and forth in the philosophical literature on this point, but I think the strongest case that governments can justly impose restrictions without explicit consent is going to have to say that there are some kinds of restrictions that governments can impose, but some that they can't. Otherwise you're committed to saying that governments can justly enforce regimes of slavery and so on. The question is how much less evil than slavery do you have to get before governments can justly impose restrictions on their subjects.
You say that selling drugs is not value neutral. I agree. It's value-positive. Drug dealers are heroes: they put their lives and freedoms on the line to let others enjoy the cognitive liberty that their governments would deprive them of. The idea of cognitive liberty is that it is a human right to have the freedom to shape your conscious experience as you see fit. It's not presently recognized as a human right by any nation, but neither was freedom of thought some centuries ago, yet we don't recognize historical rulers as particularly respectful of human rights. The legal scholar Richard Glen Boire has spent his career elaborating and promoting this principle.
You're, I take it, concerned that drugs cause harm to the people who use them and the people near those who use them. Drugs definitely do have the potential to cause harm (although cannabis, the drug in question, is especially weak in its potential to cause harm). But the idea that people have about the harm of drugs is distorted in three main ways:
1. Prohibition makes drugs far more expensive than they would be without distortionary market policy. Much of the harm of drugs comes from people being driven into poverty by addiction. This is almost entirely a consequence of prohibition, and would be a much lesser problem under a regime that respected cognitive liberty.
2. There's selection bias in the stories that we hear about users of drugs. Due to the stigma and legal risks around drug use, people who are able to keep their drug use private choose to keep it private, and we get an exaggerated sample of people who end up in need of an intervention or on the streets as a result of their drug use. See the recent book Drug Use For Grown-Ups by Dr. Carl Hart for more on this.
3. The lack of drug education, and the belief — widespread even among users of drugs — that drug use is inherently self destructive, leads people to be far more reckless in their drug use than is necessary. Certainly there will always be people who are reckless with drugs, but we can do a lot better than having young people learn about drugs from their peers in contexts where it's uncool to be concerned with safety, and half the point of the activity is to signal disregard for authority and rules.
I'm not sure that respecting people's cognitive liberty wouldn't result in more people suffering at the hands of their own drug use, but I suspect that it would be fewer than most people imagine. And cognitive liberty is something that's valuable in itself.
Some, knew one in college paying the 40k/yr tuition selling overpriced molly/weed/coke to the students. Good racket lol.
He got his degree and then went into some marketing and sales gig for a decade is doing quite well and I believe continues to sell on the side to trusted clients so not a street dealer (saw him last year at a buddies wedding).
He got his degree and then went into some marketing and sales gig for a decade is doing quite well and I believe continues to sell on the side to trusted clients so not a street dealer (saw him last year at a buddies wedding).
I don't know about most. Yeah, a lot of users peddle tiny amounts to cover their own consumption. Some dude sells a couple ounces of weed to get one free. A lot of street-level dealers don't use their product. They're hustling, it's a job. And the middlemen above them don't want them consuming the product. Junkies are not good dealers.
It's common in a fair number of places: professional sports, music, book writing (among those doing it for money), acting, law (to a lesser degree).
The very top does well, even very very well. Most everyone else scrapes by--if that.
Most professional jobs aren't like that. Sure senior execs can make an outsized amount of money but most of the rank and file are still doing OK.
The very top does well, even very very well. Most everyone else scrapes by--if that.
Most professional jobs aren't like that. Sure senior execs can make an outsized amount of money but most of the rank and file are still doing OK.
Law is more bimodal than a pyramid.
All those other ones you mentioned rely on popularity to determine one's paycheck, which is why they are all pyramids.
All those other ones you mentioned rely on popularity to determine one's paycheck, which is why they are all pyramids.
Are the two modes partner/partner-track and everyone else? I'm not very familiar with it.
They're not really pyramids though. If you're a baseball player, you either make a lot of money by most people's standards, albeit for a possibly short career, or you basically don't make much at all, even if you can play in the minors.
Law isn't quite so stark. You don't have to be at a white shoe firm to do OK (corporate counsel, prosperous practice in a smaller city) but a lot of lawyers certainly make pretty modest salaries.
Law isn't quite so stark. You don't have to be at a white shoe firm to do OK (corporate counsel, prosperous practice in a smaller city) but a lot of lawyers certainly make pretty modest salaries.
It's still a pyramid. There are a few people at the top. There is the next layer of the people who make a decent living, aka the "middle class" actors, the folks making MLB minimum wage ($600K/yr), etc. and then all the people in the bottom layer trying to break in (the starving actors, the minor league players, etc).
And lawyers are very bimodal. You have a ton of lawyers who make less than <$90K/yr, and then a whole bunch making >$200K/yr, and not a lot in between.
And lawyers are very bimodal. You have a ton of lawyers who make less than <$90K/yr, and then a whole bunch making >$200K/yr, and not a lot in between.
Maybe. I don't dispute that law is bimodal but I also am pretty sure there are a fair number of corporate counsels and partners at smaller practices earning comfortable low six figure salaries out there.
Exactly. The middle ones are all government attorneys who exchange earning potential for stability and more humane hours.
I remember reading, some years ago, about how lawyers who couldn't find work would be stuck doing document review, and they would rant on the internet about how mind-numbing, low-paid, and degrading it was. But they'd be stuck, because it was the only option to pay off student loans.
I assume at some point the job was mostly offshored? It's one of those things that I wonder if people overseas would do a better job even at the same price, if they saw it as a great job, as opposed to Americans who see it as a badge of failure.
I assume at some point the job was mostly offshored? It's one of those things that I wonder if people overseas would do a better job even at the same price, if they saw it as a great job, as opposed to Americans who see it as a badge of failure.
A lot of rote legal work was also automated as I understand it.
Historically, law schools were also something that folks from even elite liberal arts colleges went to because they weren't sure what they wanted to do when they "grew up." I know a lot of folks with law degrees that maybe worked as associates for a few years but ended off going and doing something else related to politics or whatever.
Historically, law schools were also something that folks from even elite liberal arts colleges went to because they weren't sure what they wanted to do when they "grew up." I know a lot of folks with law degrees that maybe worked as associates for a few years but ended off going and doing something else related to politics or whatever.
I’ve always called them glamour or prestige jobs. If people think it’s cool there will always be someone willing to do it for free.
I believe most major US professional sports have players unions, which provides minimum salaries that are livable.
Though I recall ~20 years ago that MLB players on league minimums (~70k/yr) were able to collect state unemployment benefits during the off season.
Though I recall ~20 years ago that MLB players on league minimums (~70k/yr) were able to collect state unemployment benefits during the off season.
It doesn't say what these coders make. But, as with the dealers, it's likely tax free, so even "minimum wage" is better than it sounds.
No benefits, no social security, no resume, no references (outside the criminal world, if they even use references), no personal network (outside crime), permanent and catastrophic damage to your reputation if you are caught ... but you save on taxes!
You don't even save on taxes, because you don't qualify for the Earned Income tax credit.
yeah but considering the risks it's actually very, very bad.
The hospital costs for uninsured low level drug dealers who have a lead allergy must be astronomical.
Sure, but society picks up the tab
Where do you live where that"s free?
There's only one Developed country where it isn't.
Where do you live that it's not??
If you examine marginal behaviour, we're all picking up each others' tabs.
There was a part in the article about cyber criminal gangs having a steady stream of cheap programmers.
Presumably there in cities with "drug problems", there are also a steady stream of relatively young kids with limited options, and no desire to stay in school.
Presumably there in cities with "drug problems", there are also a steady stream of relatively young kids with limited options, and no desire to stay in school.
It's not tax free. The IRS has a line for you to report illegal income on. If you do illegal profit-making activities you are guilty of tax evasion unless you pay your taxes on those ill gotten gains.
Unfortunately, very often it's not lead-free.
I think that the difference here is that actors in places with radically different COL can pariticpate. Imagine if a kid in a Northern Triangle country could sell drugs on the street of an American city--the risk/reward is much different. To them, even American minimum wage could be a boon.
Can confirm, mostly dealt drugs to be cool. Way too much risk for almost no reward. Was an idiot and thought I was contributing to the culture but after leaving the game I still get questioned if I'm a cop and get no respect from the paranoid dealers where I moved to. I thought we were a society :(
[deleted]
Many of the people that sell drugs aren't concerned with what they make. The money is under the table so it does not interfere with other welfare assistance they get. Additionally, many of these people are not able to work for someone else because they aren't used to structure. Think of the people you bought pot from when you were a kid, they were most likely a woman working some easy to replace job with a man who did absolutely or damn near nothing.
Getting hired is just applying to another job posting. The interview process is two-step, with a project-based technical component. The job itself is also two-step: first year is similar to contract work, with good employees brought into the fold not long after.
It looks like DOJ is trying to make an example out of some lowly frontend/freelance developer. Her work includes:
- creating a "web panel used to access victim data stored in a database"
- added a feature that "showed an infected computer or ‘bot’ status in different colors based on the colors of a traffic light"
- added a feature that "allowed other Trickbot Group members to know when their co-conspirators were working on a particular infected machine"
One thing DOJ accuses her of is "developing tools and protocols for the storage of credentials stolen and exfiltrated from victims infected by Trickbot." But its pretty obvious they don't know what "frontend developer" even means.
It looks like DOJ is trying to make an example out of some lowly frontend/freelance developer. Her work includes:
- creating a "web panel used to access victim data stored in a database"
- added a feature that "showed an infected computer or ‘bot’ status in different colors based on the colors of a traffic light"
- added a feature that "allowed other Trickbot Group members to know when their co-conspirators were working on a particular infected machine"
One thing DOJ accuses her of is "developing tools and protocols for the storage of credentials stolen and exfiltrated from victims infected by Trickbot." But its pretty obvious they don't know what "frontend developer" even means.
Why would doing these be fundamentally less bad then other tech other work for gang? It is pretty clear from your examples that she knew who she is working for. And yes, this sort of admin codinf large part of any hackers group. Large scale operation reaquires that.
Second, your section "Her work includes" picks least harmful sounding sentences. And they still sound harmful enough.
Second, your section "Her work includes" picks least harmful sounding sentences. And they still sound harmful enough.
I don't think it's obvious at all.
They gave one example of how she got hired, but not a comprehensive list of every feature she made.
They gave one example of how she got hired, but not a comprehensive list of every feature she made.
I mean, surely if one isn't absolutely clueless it would be pretty obvious what is being developed. Sure, she didn't code the active part of the malware, but the types of information being passed & displayed would almost certainly tip off what her employer was up to. I'm sure they know what a front-end dev does, none of that sounds like something beyond the job description.
It does seem shitty that all the other suspects had their names redacted except her, she likely wasnt high level in the organization, so singling her out like this is shitty. If the other suspects are still under investigation, react all the names until they can be made public. But that's a legal, not technical, issue.
It does seem shitty that all the other suspects had their names redacted except her, she likely wasnt high level in the organization, so singling her out like this is shitty. If the other suspects are still under investigation, react all the names until they can be made public. But that's a legal, not technical, issue.
Shame, I smoked a blunt 3 months ago in California. I'll try again next year!
I wonder what the stats are on how many amazing candidates they are losing because someone had an edible on a weekend 9 months ago.
“Sorry, you admitted you drank a beer 6 months back. Try again in a couple of years and don’t drink!”
“Sorry, you admitted you drank a beer 6 months back. Try again in a couple of years and don’t drink!”
I was in talks with a recruiter for a large defense contractor (not Lockheed, but in that ballpark), and the recruiter bemoaned the fact that it was hard to find cybersecurity folks because of marijuana. He said it was an acute problem for their Bolder, Colorado office.
Literally the first two questions he asked me were: 1.) "You know what we do right? And you're ok with that?" 2.) "You don't do recreational drugs, do you?"
Literally the first two questions he asked me were: 1.) "You know what we do right? And you're ok with that?" 2.) "You don't do recreational drugs, do you?"
“Sorry, you admitted you drank a beer 6 months back. Try again in a couple of years and don’t admit that you drink!”
You undergo polygraph to join FBI, no? Seems like a bad idea to start under false pretenses.
Wait, the "wall of perp photos connected by bits of yarn" is REAL?! And here I thought I was watching way too many procedurals. Mind = blown.
Look at how your last few jobs were represented by the recruiting department compared to how the actual job was. Everybody does this, it’s a transparent lie to push you over the edge if you were already interested.
If they represented it with a real photo you wouldn't be able to tell the difference to a general office job.
Answer: work on a decent Open Source, end-to-end secure messaging app that takes donations.
Many corporations sponsor open Source Projects that they rely on.
After the Anom App drug bust, organised crime should (in a rational world) become major "anonymous donors" to "Fully Secure" messaging to further their own ends.
Many corporations sponsor open Source Projects that they rely on.
After the Anom App drug bust, organised crime should (in a rational world) become major "anonymous donors" to "Fully Secure" messaging to further their own ends.
Not entirely related, but at the end of the 90s, just before the big Y2K, I was living in San Francisco, and interviewed at a residential house with some guy who was in the business of popups. The malware of that time. The job was to basically to do WHATEVER it takes to make those popups pop. No rules, anything goes, dirty tricks and all.
Hated popups. Didn't take the job.
Hated popups. Didn't take the job.
> Witte did not feel obligated to avoid traveling to areas where she might be within reach of U.S. law enforcement agencies.
If the US really wants to get you, Russia, China, and North Korea (and maybe Cuba) are probably the only real safe havens.
If you are anywhere else, there is a chance that they can get you if they really want you.
If the US really wants to get you, Russia, China, and North Korea (and maybe Cuba) are probably the only real safe havens.
If you are anywhere else, there is a chance that they can get you if they really want you.
Why would a person doing this type of crime reside in the US? I understand quality of life is higher than Russia, but Russia neighbors Latvia--her country of origin. It is confusing to me because if she were there, her activities would have been discovered but she would have had the tacit protection of the state.
> quality of life is higher than Russia
Have you been to Russia?
Have you been to Russia?
She doesn't reside in US, read the text. She lives in Suriname and was just flying through (or temporarily to) the US.
Yup, I commented before finishing the text based on where she was arrested.
The point still stands I think. Yes, it's not as flagrant as living in the US. But you'd think a person engaged in this kind of thing would feel reluctant to have a layover in a country that cooperates closely with US law enforcement let alone Miami.
The point still stands I think. Yes, it's not as flagrant as living in the US. But you'd think a person engaged in this kind of thing would feel reluctant to have a layover in a country that cooperates closely with US law enforcement let alone Miami.
Here is irrefutable evidence that the suspect is actually a berlin police: https://www.youtube.com/watch?v=wwZbonjAlPc
In many of Krebs' other articles the criminals are men in their 50s or 60s, but this has never warranted a passing mention or any sympathy.
Should she get a lighter sentence for being a woman?
Don't we all want equity in software development and elsewhere?
Until half of all criminal ransomware developers, and half the prison population, are women, it would seem we have a problem as a society.
This is actually a great step forward.
Should she get a lighter sentence for being a woman?
Don't we all want equity in software development and elsewhere?
Until half of all criminal ransomware developers, and half the prison population, are women, it would seem we have a problem as a society.
This is actually a great step forward.
You're extrapolating an elaborate political agenda from an extremely brief description of a criminal.
While I'm with you on the weird degree to which he focuses on it, I'm not seeing the sympathy. And where's the mention of lighter sentencing?
It reads instead to me as paternalistic and honestly verging into weirdly misogynistic. More a tone of How did this mere mother manage to get involved in crime?
It reads instead to me as paternalistic and honestly verging into weirdly misogynistic. More a tone of How did this mere mother manage to get involved in crime?
No
Quite frankly she doesn’t come across as very smart, and certainly not very technologically sophisticated. The idea that you run into a problem and use Google to solve it hardly constitutes skill development.
It is interesting that they’re hiring based on job boards. I don’t know how normal gangs recruit but I’d guess it’s a lot of word of mouth. It seems when there are real honest alternatives out there for skilled labor, that you need to go to the public will also be an Achilles’ heel.
It is interesting that they’re hiring based on job boards. I don’t know how normal gangs recruit but I’d guess it’s a lot of word of mouth. It seems when there are real honest alternatives out there for skilled labor, that you need to go to the public will also be an Achilles’ heel.
This doesn’t in any way downplay your point, I just noticed this sentence and it made me think: “The idea that you run into a problem and use Google to solve it hardly constitutes skill development.”
It’s probably natural for most folks on HN to consider “googling problems” an obvious, basic first solution - but I’m always stunned by how many people in real life, outside of the IT industry, don’t have that path in their brains well-trodden. For some reason, they’d rather flail around or ask a real human (often me) for help, rather than type a couple words into a search bar and see what happens.
I wonder if there’s an opportunity to teach a “how to search” class in schools. You could have some fun open-Google exams!
It’s probably natural for most folks on HN to consider “googling problems” an obvious, basic first solution - but I’m always stunned by how many people in real life, outside of the IT industry, don’t have that path in their brains well-trodden. For some reason, they’d rather flail around or ask a real human (often me) for help, rather than type a couple words into a search bar and see what happens.
I wonder if there’s an opportunity to teach a “how to search” class in schools. You could have some fun open-Google exams!
Many (most?) people are simply not curious. When they run into something they don’t know how to do, they don’t wonder how to figure out how to do it, they just sit there until someone shows them how.
I assume when most people here on HN run into a problem, their first thought isn’t, “who can I ask?” but instead, “how can I figure it out?” because most hacker types are naturally curious and relish an opportunity to learn something new.
In my experience most people who zero interest in learning something new when they encounter something they don’t know.
I assume when most people here on HN run into a problem, their first thought isn’t, “who can I ask?” but instead, “how can I figure it out?” because most hacker types are naturally curious and relish an opportunity to learn something new.
In my experience most people who zero interest in learning something new when they encounter something they don’t know.
> Many (most?) people are simply not curious.
Is this really so? With respect, this take seems too cynical to me. I say this as a person to whom many come when they can't figure things out.
I often initially feel much like you do, but I temper that feeling with the knowledge that the asker is likely under delivery pressure, etc and has to subvert their curiosity in order to maintain velocity.
Is this really so? With respect, this take seems too cynical to me. I say this as a person to whom many come when they can't figure things out.
I often initially feel much like you do, but I temper that feeling with the knowledge that the asker is likely under delivery pressure, etc and has to subvert their curiosity in order to maintain velocity.
Purely anecdotal, and perhaps cynical, but that’s been my experience.
Yes, sometimes people will simply take the expedient option, but I often get the feeling they never even tried on their own, like even a little bit.
Yes, sometimes people will simply take the expedient option, but I often get the feeling they never even tried on their own, like even a little bit.
> I wonder if there’s an opportunity to teach a “how to search” class in schools. You could have some fun open-Google exams!
I had something similar to that when I was in elementary school, including comparing results across search engines. Boolean searches plus Smart Selection of keywords would quickly lead you to good sources.
Sometime between when I graduated high school and 2016, most of those tricks stopped working reliably. Google, Bing, and DDG are the only games in town for the anglophone world and all three drown out the worthwhile results in reposted blog spam. Until you magically discover the shibboleth that directs you to actual information, you’re stuck in a hell of shitty how-to websites that have nearly-identical irrelevant information.
It’s less hassle and more accurate (though slower and possibly outdated) to directly ask a known local expert.
I had something similar to that when I was in elementary school, including comparing results across search engines. Boolean searches plus Smart Selection of keywords would quickly lead you to good sources.
Sometime between when I graduated high school and 2016, most of those tricks stopped working reliably. Google, Bing, and DDG are the only games in town for the anglophone world and all three drown out the worthwhile results in reposted blog spam. Until you magically discover the shibboleth that directs you to actual information, you’re stuck in a hell of shitty how-to websites that have nearly-identical irrelevant information.
It’s less hassle and more accurate (though slower and possibly outdated) to directly ask a known local expert.
I regularly teach an Information for IT professionals course in a college. My first assignment, (group, part icebreaker) involves
- comparing different search engines (to google, mostly)
- seeing if you can find patent numbers, etc.
- and the best, I mix up a bunch of "real" and "fake" sites
(e.g., the Carbon Monoxide awareness site and then the Dihydrogen Monoxide site, and giggle as they critique that the second one needs a better web designer and needs to be more professional...)
- comparing different search engines (to google, mostly)
- seeing if you can find patent numbers, etc.
- and the best, I mix up a bunch of "real" and "fake" sites
(e.g., the Carbon Monoxide awareness site and then the Dihydrogen Monoxide site, and giggle as they critique that the second one needs a better web designer and needs to be more professional...)
> opportunity to teach a “how to search” class
Not as much as SEO "how to break search" opportunities.
Not as much as SEO "how to break search" opportunities.
I encounter often the opposite problem where I'm regularly telling people who are flailing around on Google to deal with some unexpected problem, "I don't know, but you know you will? An Oncologist/IP-attorney/electrician/etc. Instead of using Google to find a pile of amateurs' competing anecdotes, perhaps you can use it to find an actual expert who can help you?"
I see what you're saying, and I guess like most, I've experienced both:
* A trivial technological problem that leaves my family helpless though it's literally the first hit on Google
* A critical life-impacting issue, usually health but sometimes things like taxes or mortgage or household maintenance - things where trustworthy experts exist and are readily available here - and they go to random sketchy Facebook groups and get random advice from random people (frequently involving Crystals or essential oils but I digress into whole other rant :P )
* A trivial technological problem that leaves my family helpless though it's literally the first hit on Google
* A critical life-impacting issue, usually health but sometimes things like taxes or mortgage or household maintenance - things where trustworthy experts exist and are readily available here - and they go to random sketchy Facebook groups and get random advice from random people (frequently involving Crystals or essential oils but I digress into whole other rant :P )
There seem to be two modes here. There's an objective fact-checking mode, and a personal network of trust mode.
This becomes a problem when the personal network is made of people who rely on hearsay, and signals-of-belonging instead of evidence-based information.
It's also a problem when "official" experts aren't truly expert, for various possible reasons - including corruption, incompetence, deliberate bad faith, and others.
It's hard for people who think in one way to understand that others don't think in the same ways.
This becomes a problem when the personal network is made of people who rely on hearsay, and signals-of-belonging instead of evidence-based information.
It's also a problem when "official" experts aren't truly expert, for various possible reasons - including corruption, incompetence, deliberate bad faith, and others.
It's hard for people who think in one way to understand that others don't think in the same ways.
Very true. "Just google it" works for a very specific subset of problems. In most disciplines, especially "real world" ones outside of computing, there is no easily googleable answer to most problems. Lawyers get a hard time for answering every question with "it depends" but unfortunately, that's the domain a lot of people work within and it's the right answer most of the time.
[deleted]
Good idea, "how to search" should also be paired with filtering noise.
There's a ton of information now and it's not always intuitive to understand what information you should value and when.
There's a ton of information now and it's not always intuitive to understand what information you should value and when.
>I wonder if there’s an opportunity to teach a “how to search” class in schools.
We did this in a public middle school around 2002-2003 with boolean searches. Was this unique to my experience or has this been a common thing for awhile?
We did this in a public middle school around 2002-2003 with boolean searches. Was this unique to my experience or has this been a common thing for awhile?
Neither: there was a brief period where there was decent ICT education, then it all went away again.
[deleted]
Pretty sure 20% of my value as a professional web builder and resident family tech support rep is my ability or willingness to "Google" something. I'm being 100% serious - I attribute most of my tech knowledge simply to my curiosity, and willingness to search out a solution. Many people (including my own kids) are happy to A) not know or B) ask someone else (me).
Don't think this is new either. Before we even had internet access at work people would ask me for help with excel or some other program and the first thing I would do would be to use built in help. Many folks just don't understand how much help a book/helpfile/internet can be.
It's not even unique to IT/software; my ex-girlfriend was a vet an she just googles things as well. Turns out there are lots of veterinary procedures on YouTube for example, and for some of the rarer chirurgies and such you need to do it's pretty useful.
I've realized over time that my "google a solution" instinct only kicks in while I'm dealing with tech problems.
For everything else, my brain takes some time to make that leap.
For everything else, my brain takes some time to make that leap.
XKCD to the rescue! [1]
[1] https://xkcd.com/627/
[1] https://xkcd.com/627/
Shockingly to me, in many fields, Google results are bare.
Coming from IT, in the industry, even questions about software (very specialized, to be honest) get useless results.
I think the openess of information in software is the exception, not the norm, though many fields like science are making improvements.
Coming from IT, in the industry, even questions about software (very specialized, to be honest) get useless results.
I think the openess of information in software is the exception, not the norm, though many fields like science are making improvements.
This rings true for me, and reminds me of my early experience learning about machining and CNC machines. There are a lot of very low quality googleable sources out there for that field (mostly dealing with the hobbyist side of it) that crowded out the information I needed for professional development and troubleshooting.
Eventually, as my knowledge of the field increased I learned the "pro" terminology for certain objects and processes, which improved my ability to search useful info. I also discovered through chance or personal recommendation some very useful pro-level online sources, which don't have a large presence on search engines. There was a long grind of several years before I got to the point where I could search online for machining information and solutions online with confidence that I could find useful results and assess their reliability. Even then, there is a lot that I need to find in books/manuals or in conversation with experts.
While this is a process that takes place when learning about any technical topic, in my experience its easier in programming (and to a lesser degree general IT topics) than in fields that exist primarily in the world of physical objects. IMO, this has something to do with the tendency of programming problems to "self-define" themselves in specific textual language (I.E. compiler errors you can copy and paste into google) and also with origins and focuses of the largest internet knowledge bases.
Eventually, as my knowledge of the field increased I learned the "pro" terminology for certain objects and processes, which improved my ability to search useful info. I also discovered through chance or personal recommendation some very useful pro-level online sources, which don't have a large presence on search engines. There was a long grind of several years before I got to the point where I could search online for machining information and solutions online with confidence that I could find useful results and assess their reliability. Even then, there is a lot that I need to find in books/manuals or in conversation with experts.
While this is a process that takes place when learning about any technical topic, in my experience its easier in programming (and to a lesser degree general IT topics) than in fields that exist primarily in the world of physical objects. IMO, this has something to do with the tendency of programming problems to "self-define" themselves in specific textual language (I.E. compiler errors you can copy and paste into google) and also with origins and focuses of the largest internet knowledge bases.
There are some definite non-trivial skills involved in successfully googling the solution to a problem. The biggest one is having enough reading comprehension to understand what you found (or alternatively, having enough time/patience to watch YouTube videos that take forever to get to the point. The second most important is the ability to recognize non-solutions or non-optimal solutions.
For many people, they are used to learning from other people instead of from search results. So it makes sense that their first instinct is to reach for asking those around them.
For many people, they are used to learning from other people instead of from search results. So it makes sense that their first instinct is to reach for asking those around them.
>> For some reason, they’d rather flail around or ask a real human (often me) for help,
When I was briefly in sales before becoming a developer, I had a co-worker who, for the life of her, could not remember how to do a soft-line break in MS Word. She literally would ask me at least once a day. I finally just printed the keystroke (shift + return) on a sheet of paper and when she would peer over the cube, I'd just hold it up and she'd sit down again.
Even in our sales group, the majority knew to use Google to get answers to all kinds of technical questions. But you're right, there's still a big group of people who are unaware or too lazy to go there first.
When I was briefly in sales before becoming a developer, I had a co-worker who, for the life of her, could not remember how to do a soft-line break in MS Word. She literally would ask me at least once a day. I finally just printed the keystroke (shift + return) on a sheet of paper and when she would peer over the cube, I'd just hold it up and she'd sit down again.
Even in our sales group, the majority knew to use Google to get answers to all kinds of technical questions. But you're right, there's still a big group of people who are unaware or too lazy to go there first.
Agreed. The layperson for the most person does not know how to search effectively. Even among my developer friends today who are competent, if they can't find something, they come to me. I have a knack for finding things that are difficult to find - going back all the way to when AltaVista was the best search engine around - I can't really explain it.
My parents, in-laws, etc... they all say on a pretty regular basis that they have trouble finding what they're searching for. Google tries really hard to return relevant results (which actually annoys me because I really, really, really want it to search for exactly what I typed - by default.)
My parents, in-laws, etc... they all say on a pretty regular basis that they have trouble finding what they're searching for. Google tries really hard to return relevant results (which actually annoys me because I really, really, really want it to search for exactly what I typed - by default.)
> The idea that you run into a problem and use Google to solve it hardly constitutes skill development.
What does, according to you?
What does, according to you?
Taking a course, reading books, watching lectures, and actually building projects in new domains. I'm not going to learn machine learning by googling each step and copy/pasting stack overflow. I'm not going to learn how TCP works by Googling and copy/pasting stack overflow at each requirement.
Skill development is something that takes a lot of time and practice.
None of that is to say that stack overflow isn't useful, or that I won't learn things when I run into a problem by reading a blog entry. But to me that isn't the same thing as learning a new skill, unless that skill is so small and shallow that a single blog entry is all of the knowledge you'd ever need.
Skill development is something that takes a lot of time and practice.
None of that is to say that stack overflow isn't useful, or that I won't learn things when I run into a problem by reading a blog entry. But to me that isn't the same thing as learning a new skill, unless that skill is so small and shallow that a single blog entry is all of the knowledge you'd ever need.
[deleted]
Something ultra-specific to this particular gatekeeping individual, I suppose.
[deleted]
> The idea that you run into a problem and use Google to solve it hardly constitutes skill development.
Until you come across people who can't even do that.
I'm unsure of your age, but I was a developer before Google was a thing, and researching your answer, using Gopher, Usenet, and/or books was very much how we solved problems.
Honorable mention: talking to that Old-office-coffee-stained-teeth-sys-admin-who-probably-forgot-more-about-computers-than-I-ever-knew.
Until you come across people who can't even do that.
I'm unsure of your age, but I was a developer before Google was a thing, and researching your answer, using Gopher, Usenet, and/or books was very much how we solved problems.
Honorable mention: talking to that Old-office-coffee-stained-teeth-sys-admin-who-probably-forgot-more-about-computers-than-I-ever-knew.
I’m not saying knowing how to google isn’t a necessary skill with unequal distribution. I’m saying that’s not the pathway that’ll take her as a front end web dev and allow her to write the underlying malware that the front end provides a UI around.
It’s as meaningless a statement as “I know how to read books so I can learn new skills.”
It’s as meaningless a statement as “I know how to read books so I can learn new skills.”
She was at least able to make a dashboard that combined database info as well as "Trojan horse status" for active victims. In a way that worked well enough for them to scam enough people that it caught the US's attention.
[deleted]
> It is interesting that they’re hiring based on job boards.
I remember reading how even cartels hire people through normal job listings. IIRC, there was some sordid article regarding this, where the cartels will list out jobs for "security" jobs, think regular security guard work, event security detailing, etc.
They'd then drive out the candidates to some remote and closed-off training site, push them hard, and just kill anyone that didn't make the cut.
I remember reading how even cartels hire people through normal job listings. IIRC, there was some sordid article regarding this, where the cartels will list out jobs for "security" jobs, think regular security guard work, event security detailing, etc.
They'd then drive out the candidates to some remote and closed-off training site, push them hard, and just kill anyone that didn't make the cut.
[deleted]
The idea that you run into a problem and use
Google to solve it hardly constitutes skill development.
For example, I don't know anything about flowers.
Sometimes I see a flower that I'd like to identify, but I can't really Google it -- aside from color and perhaps the number of petals I'd have no idea what terms I'd use to describe a flower and therefore what I might possibly type into Google.
(note: This is just an example. Never really tried to identify a flower w/ Google. Perhaps I could use Google image search, etc.)
Is this true anymore? It used to be true back when all the really cool Google search operators worked and the service didn’t use natural language processing to process search queries. But these days you’re ‘supposed’ to use google like this: ‘what is the purple wild flower that grows in spring in England?’ as opposed to ‘filetype:pdf site:blah.org +foo -bar 2010..2012’ which would find files of type pdf on domain blah.org referring to foo but not bar between the years 2010 and 2012.
Honestly I prefer searching the latter way and would love to know which search operators still work these days.
Honestly I prefer searching the latter way and would love to know which search operators still work these days.
You could use Google Lens.
However we're not talking about a domain she knows zero about. We're talking about her building web pages. I'm guessing she's not suggesting that you could throw at her 'build a new OS kernel that brings cryptographic signatures as a base primitive for all operations'. So the reality is she'll be able to Google for n+1 things, not n+1000.
Either way, my point is n+1 Googling isn't the same thing as learning a new skill. It's expanding your knowledge right at the periphery of what you understand.
However we're not talking about a domain she knows zero about. We're talking about her building web pages. I'm guessing she's not suggesting that you could throw at her 'build a new OS kernel that brings cryptographic signatures as a base primitive for all operations'. So the reality is she'll be able to Google for n+1 things, not n+1000.
Either way, my point is n+1 Googling isn't the same thing as learning a new skill. It's expanding your knowledge right at the periphery of what you understand.
Googling isn't the same thing as learning a new skill.
Of course, there are exceptions. For example if you have somebody else's expertise on tap (in book form, or they're teaching a a class, or they're your best friend, etc) then no need for search-fu.
Some UX concepts are like this. Surely I’m not the only one who arrives at a problem I can’t describe to google in a way that returns meaningful results?
For people downvoting me, I'd love to know why. The many comments here aren't negating what I said or explaining why I was wrong.
You're saying she's dumb because she Googles the answer.. not the part where she hosts malware on her own domain? Maybe voluntarily travelling to the US from a country with no extradition deal with the US? It's the Googling that does it haha
Being able to search is a legitimate skill that relatively few have too. We will probably disagree a bunch here, I can't be fluffed to have that to and fro -- so I downvoted and moved on
Being able to search is a legitimate skill that relatively few have too. We will probably disagree a bunch here, I can't be fluffed to have that to and fro -- so I downvoted and moved on
That wasn’t what I was saying. All of the things you mentioned made her come off as not very smart. Google = skill development is a separate point I took issue with.
I also didn’t say that searching itself isn’t a skill. Of course it is. I’m saying that advertising you know how to Google doesn’t mean you can acquire any new skill, which is what the bio implied.
I also didn’t say that searching itself isn’t a skill. Of course it is. I’m saying that advertising you know how to Google doesn’t mean you can acquire any new skill, which is what the bio implied.
Disagree with this. You can acquire skills using Google. You can build a curriculum and a path by Googling on a domain you don't know a fuck about. It can give you a head start. I learnt Mathematics in same way. Being able to find Dr Keith Delvin was Godsend.
It's much like Blackbox testing you know.
It's much like Blackbox testing you know.
Then I and possibly others misinterpreted what you were saying. Personally it's the wording that did it for me, I dunno about others. I've never bumped into skill development as a phrase so it got parsed wrong I guess. Put a rogue "in" between skill and development and there's the downvote
For what it's worth because I replied my downvote was nullified
For what it's worth because I replied my downvote was nullified
[deleted]
>"Multiple security experts quickly zeroed in on how investigators were able to retrieve the funds, which did not represent the total amount Colonial paid (~$4.4 million): The amount seized was roughly what a top DarkSide affiliate would have earned for scoring the initial malware infection that precipitated the ransomware incident."
I'm not quite sure what this implies? That the team who did the initial infection was in fact some sort of FBI undercover?
So undercover FBI successfully hacked colonial pipeline, ignited all this press coverage and attention, and quietly disappeared with the ransom amount? Am I interpreting that correctly?