The Hidden History of CyberCrime Forums

The notorious dark web marketplaces Alphabay and Hansa were shut down in July following "landmark" action by police forces in the US and Europe to unmask who was running them.

They join a long list of other forums, chat rooms and boards that appeared and were blazingly popular with the criminal underworld before they were compromised and closed. But those sites, including Dark Market, Carders Market, Shadow Crew, Carder.su, Darkode, GhostMarket and the Silk Road, have more in common than just the trajectory of their genesis and demise.

They all follow the modus operandi of a landmark forum set up in 2001 called Carder Planet. Designed for criminals who specialised in monetising lists or "dumps" of credit card numbers, it has had an influence far beyond that select group.

"Carder Planet created the framework for the current criminal underground," said Andrei Barysevich, now a director at security firm Recorded Future but who, at the time the site operated, was helping to monitor cyber-crime in Eastern Europe.

Expert View

The site was set up online shortly after a face-to-face meeting at a restaurant in Odessa attended by some of Ukraine and Russia's top credit card thieves, said Mr Barysevich.

"Odessa was, and still is, the ground zero for cyber-crime," he said. "It is a very criminalised city and a centre of white collar crime."

Before Carder Planet was set up, anyone who wanted to make money from stealing card numbers had to be a jack of all trades, said Liam O'Murchu, a researcher at Symantec who has spent years tracking online crime forums.

Not only did they have to find ways to steal the card numbers, often involving malware or hacking, they also had to work out how to turn those numbers into cash and not get caught.

"What they decided to do was pool everyone's resources, so they did not have to be perfectly skilled in everything in order to be able to do crime," he said.

"They set up the forum where people could come together and trade skills and nobody had to be an expert in the entire chain from beginning to end," said Mr O'Murchu.

The site proved an immediate success and soon had thousands of members all busily trading with each other.

"They got so blasé and so sure of themselves that they organised the first real life meet-up of Carder Planet members," said Mr Barysevich. "Forum members were invited to a resort outside Odessa where they hung out together.

"They had good food, drink and girls and had a pretty good time," he said.

It was not only the attendees who enjoyed themselves. The police did too because news about the conference, as well as pictures of attendees, were leaked to the authorities. It was the first time that many of the cyber-thieves had been photographed and the images were widely studied, he said.

Shopping Growth

Despite the attention, Carder Planet kept going and enjoyed significant success, said Dmitri Alperovitch, co-founder of CrowdStrike and a veteran cyber-crime researcher, who has helped to track down and expose some of its key members.

"It was the right place at the right time," he said. "You had a lot of smart folks in Russia and Ukraine at the time and you had the proliferation of the internet in those days in the former Soviet Union and the economy was doing very, very poorly."

Given that, he said, it was not surprising that those with technical skills and nothing legitimate to do with them turned to crime.

Coupled with this was the rise of online shopping in the US, much of which was powered by people using credit cards. Unfortunately, many of the firms setting up online were better at selling than security, meaning the thieves were regularly able to steal large amounts of card numbers.

Mr Alperovitch said the board explicitly modelled itself on more traditional organised crime groups - specifically the Italian mafia.

Occasional contributors were called "soldiers" and the more someone got involved the higher up the ranks they rose. At the top, he said, were the "dons" and "capos" who ran the biggest scams and collected financial tributes from the people they set working on them.

He said it was also a board on which reputation mattered a lot - a trait seen on many other criminal forums ever since.

Before any criminals worked together they looked for "vouches" - essentially personal recommendations from other thieves about whether someone was trustworthy or not. Without those endorsements a collaboration between say a spammer and a malware writer was unlikely to get started. Anyone with a persistently bad reputation would find that no-one would work with them.

Carder Planet was shut down voluntarily by its creators in 2004 - largely to avoid the fate of other boards, many of which were compromised by police and used to gather intelligence about members.

Many of its members did keep on stealing cards and some of them, notably Roman Vega (aka Boa) and Vladislav Horohorin (aka Badb), have been tracked down and arrested.

Those arrests were a consequence of the open atmosphere on Carder Planet, said Mr Alperovitch.

"They've realised they were quite naive about law enforcement engagement and they did not realise that law enforcement was paying very close attention," he said.

BBC

You Might Also Read:

What Is Selling On the Dark Net?:

International Police Start Crackdown On The Darknet:

« Banks Join Forces to Fight CyberCrime
Get Your Data Strategy On Board »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Hyve

Hyve

Hyve provide a wide range of managed web hosting services including private, hybrid and public VMware cloud hosting.

Cisco Talos

Cisco Talos

Talos is an industry-leading threat intelligence solution that protects your organization’s people, data and infrastructure from active adversaries.

Roke Manor Research

Roke Manor Research

Roke is a world-class electronics engineering consultancy. Areas of expertise include cyber security, cyber assurance and cryptographic solutions.

Mantix4

Mantix4

Mantix4’s M4 Cyber Threat Hunting Platform actively defends against cyber threats.

SANS CyberStart

SANS CyberStart

SANS CyberStart is a unique and innovative suite of tools and games designed to introduce children and young adults to the field of cyber security.

Zamna

Zamna

Zamna (formerly VChain Technology) is an award-winning software company building GDPR compliant identity platforms for the aviation industry.

Abnormal Security

Abnormal Security

Abnormal is an API-based email security platform providing protection against the entire spectrum of targeted email attacks.

Crosspring

Crosspring

Crosspring is an incubator/accelerator for people who have the ambition to start a successful business or want to extend their existing business in the areas of FinTech, AR, VR, Cybersecurity and SaaS

Research Institute in Verified Trustworthy Software Systems (VeTSS)

Research Institute in Verified Trustworthy Software Systems (VeTSS)

The main purpose of VeTSS is to support program analysis, testing and verification, to achieve guarantees of software correctness, safety, and security.

Punk Security

Punk Security

Punk Security are specialists in integrating security into DevOps pipelines, enabling rapid and secure development.

Synagex

Synagex

Synagex Modern IT is a simple IT and cybersecurity solution for businesses.

Invictus International Consulting

Invictus International Consulting

Invictus International Consulting are a recognized leader in full-spectrum cyber technology solutions designed to protect the security of our nation's global defense and critical infrastructure.

Secur-Serv

Secur-Serv

Secur-Serv is a security-first managed services provider. We provides Managed IT, Managed Print, Managed Device, and Cybersecurity services to companies of every size.

Loccus AI

Loccus AI

Loccus are developers of AI solutions in the voice safety space. We build identity verification solutions, deepfake detection systems and fraud protection products for companies and end-users.

Apex iQ (ApexiQ)

Apex iQ (ApexiQ)

ApexiQ is a continuous asset assurance platform that empowers you with the confidence to make better data-driven decisions and take automated action to reduce your risk.

AI EdgeLabs

AI EdgeLabs

AI EdgeLabs is a powerful and autonomous cybersecurity AI platform that helps security teams respond immediately to ongoing attacks and protect Edge/IoT infrastructures.