The Hidden History of CyberCrime Forums

The notorious dark web marketplaces Alphabay and Hansa were shut down in July following "landmark" action by police forces in the US and Europe to unmask who was running them.

They join a long list of other forums, chat rooms and boards that appeared and were blazingly popular with the criminal underworld before they were compromised and closed. But those sites, including Dark Market, Carders Market, Shadow Crew, Carder.su, Darkode, GhostMarket and the Silk Road, have more in common than just the trajectory of their genesis and demise.

They all follow the modus operandi of a landmark forum set up in 2001 called Carder Planet. Designed for criminals who specialised in monetising lists or "dumps" of credit card numbers, it has had an influence far beyond that select group.

"Carder Planet created the framework for the current criminal underground," said Andrei Barysevich, now a director at security firm Recorded Future but who, at the time the site operated, was helping to monitor cyber-crime in Eastern Europe.

Expert View

The site was set up online shortly after a face-to-face meeting at a restaurant in Odessa attended by some of Ukraine and Russia's top credit card thieves, said Mr Barysevich.

"Odessa was, and still is, the ground zero for cyber-crime," he said. "It is a very criminalised city and a centre of white collar crime."

Before Carder Planet was set up, anyone who wanted to make money from stealing card numbers had to be a jack of all trades, said Liam O'Murchu, a researcher at Symantec who has spent years tracking online crime forums.

Not only did they have to find ways to steal the card numbers, often involving malware or hacking, they also had to work out how to turn those numbers into cash and not get caught.

"What they decided to do was pool everyone's resources, so they did not have to be perfectly skilled in everything in order to be able to do crime," he said.

"They set up the forum where people could come together and trade skills and nobody had to be an expert in the entire chain from beginning to end," said Mr O'Murchu.

The site proved an immediate success and soon had thousands of members all busily trading with each other.

"They got so blasé and so sure of themselves that they organised the first real life meet-up of Carder Planet members," said Mr Barysevich. "Forum members were invited to a resort outside Odessa where they hung out together.

"They had good food, drink and girls and had a pretty good time," he said.

It was not only the attendees who enjoyed themselves. The police did too because news about the conference, as well as pictures of attendees, were leaked to the authorities. It was the first time that many of the cyber-thieves had been photographed and the images were widely studied, he said.

Shopping Growth

Despite the attention, Carder Planet kept going and enjoyed significant success, said Dmitri Alperovitch, co-founder of CrowdStrike and a veteran cyber-crime researcher, who has helped to track down and expose some of its key members.

"It was the right place at the right time," he said. "You had a lot of smart folks in Russia and Ukraine at the time and you had the proliferation of the internet in those days in the former Soviet Union and the economy was doing very, very poorly."

Given that, he said, it was not surprising that those with technical skills and nothing legitimate to do with them turned to crime.

Coupled with this was the rise of online shopping in the US, much of which was powered by people using credit cards. Unfortunately, many of the firms setting up online were better at selling than security, meaning the thieves were regularly able to steal large amounts of card numbers.

Mr Alperovitch said the board explicitly modelled itself on more traditional organised crime groups - specifically the Italian mafia.

Occasional contributors were called "soldiers" and the more someone got involved the higher up the ranks they rose. At the top, he said, were the "dons" and "capos" who ran the biggest scams and collected financial tributes from the people they set working on them.

He said it was also a board on which reputation mattered a lot - a trait seen on many other criminal forums ever since.

Before any criminals worked together they looked for "vouches" - essentially personal recommendations from other thieves about whether someone was trustworthy or not. Without those endorsements a collaboration between say a spammer and a malware writer was unlikely to get started. Anyone with a persistently bad reputation would find that no-one would work with them.

Carder Planet was shut down voluntarily by its creators in 2004 - largely to avoid the fate of other boards, many of which were compromised by police and used to gather intelligence about members.

Many of its members did keep on stealing cards and some of them, notably Roman Vega (aka Boa) and Vladislav Horohorin (aka Badb), have been tracked down and arrested.

Those arrests were a consequence of the open atmosphere on Carder Planet, said Mr Alperovitch.

"They've realised they were quite naive about law enforcement engagement and they did not realise that law enforcement was paying very close attention," he said.

BBC

You Might Also Read:

What Is Selling On the Dark Net?:

International Police Start Crackdown On The Darknet:

« Banks Join Forces to Fight CyberCrime
Get Your Data Strategy On Board »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

SC Media

SC Media

SC Media arms information security professionals with the in-depth, unbiased business and technical information they need to tackle the countless security challenges they face.

RoboForm

RoboForm

RoboForm's industry-leading encryption technology securely stores your passwords, with one Master Password serving as your encryption key.

Kenexis

Kenexis

Kenexis is a consulting engineering firm providing services for process hazards analysis, fire and gas mapping, and industrial cybersecurity.

SafenSoft (SnS)

SafenSoft (SnS)

SafenSoft delivers high-efficiency, low-impact proactive protection against malware, insider threats, and confidential data leakage.

Hypersecu Information Systems

Hypersecu Information Systems

Hypersecu Information Systems, Inc. is a solution provider dedicated to multi-factor authentication, public key infrastructure and software copyright protection.

Cancom

Cancom

CANCOM group is one of the leading providers of IT infrastructure and IT services in Germany and Austria. Solution areas include network security.

Fugue

Fugue

Fugue ensures cloud infrastructure stays in continuous compliance with enterprise security policies.

ArcusTeam

ArcusTeam

ArcusTeam is at the forefront of the firmware and applications security industry, with a mission to increase the level of security on all IoT devices and applications.

Nihon Cyber Defense

Nihon Cyber Defense

Nihon Cyber Defence’s mission is to provide robust solutions, services and support to governments, corporates and organisations in order to protect them from all forms of cyber warfare.

NetNordic Group

NetNordic Group

NetNordic is a Nordic system integrator focusing on solutions and services in the area of networking, smart data centers, cybersecurity, and unified communication.

CybrHawk

CybrHawk

CybrHawk is a leading provider of information security-driven risk intelligence solutions focused solely on protecting clients from cyber-attacks.

SEIRIM

SEIRIM

SEIRIM delivers cybersecurity solutions in Shanghai China specializing in Web Application Security, Network Security for SME's, Vulnerability Management, and serving as Managed Security as a Service.

Ascent Solutions

Ascent Solutions

Ascent is built to help firms evolve their cybersecurity posture, modernize their Microsoft solutions, and accelerate their journey to the cloud.

Lavabit

Lavabit

Lavabit's Dark Internet Mail Environment is a secure, open-source, secure end-to-end communications platform for asynchronous messaging across the internet.

Logically.ai

Logically.ai

Logically combines artificial intelligence with expert analysts to tackle harmful and manipulative content at speed and scale.

Avalor

Avalor

Avalor are on a mission to help security teams make faster, more accurate decisions by making sense of their data. With Avalor you can bring in data from anywhere, normalize it and analyze it.