The Hidden History of CyberCrime Forums

The notorious dark web marketplaces Alphabay and Hansa were shut down in July following "landmark" action by police forces in the US and Europe to unmask who was running them.

They join a long list of other forums, chat rooms and boards that appeared and were blazingly popular with the criminal underworld before they were compromised and closed. But those sites, including Dark Market, Carders Market, Shadow Crew, Carder.su, Darkode, GhostMarket and the Silk Road, have more in common than just the trajectory of their genesis and demise.

They all follow the modus operandi of a landmark forum set up in 2001 called Carder Planet. Designed for criminals who specialised in monetising lists or "dumps" of credit card numbers, it has had an influence far beyond that select group.

"Carder Planet created the framework for the current criminal underground," said Andrei Barysevich, now a director at security firm Recorded Future but who, at the time the site operated, was helping to monitor cyber-crime in Eastern Europe.

Expert View

The site was set up online shortly after a face-to-face meeting at a restaurant in Odessa attended by some of Ukraine and Russia's top credit card thieves, said Mr Barysevich.

"Odessa was, and still is, the ground zero for cyber-crime," he said. "It is a very criminalised city and a centre of white collar crime."

Before Carder Planet was set up, anyone who wanted to make money from stealing card numbers had to be a jack of all trades, said Liam O'Murchu, a researcher at Symantec who has spent years tracking online crime forums.

Not only did they have to find ways to steal the card numbers, often involving malware or hacking, they also had to work out how to turn those numbers into cash and not get caught.

"What they decided to do was pool everyone's resources, so they did not have to be perfectly skilled in everything in order to be able to do crime," he said.

"They set up the forum where people could come together and trade skills and nobody had to be an expert in the entire chain from beginning to end," said Mr O'Murchu.

The site proved an immediate success and soon had thousands of members all busily trading with each other.

"They got so blasé and so sure of themselves that they organised the first real life meet-up of Carder Planet members," said Mr Barysevich. "Forum members were invited to a resort outside Odessa where they hung out together.

"They had good food, drink and girls and had a pretty good time," he said.

It was not only the attendees who enjoyed themselves. The police did too because news about the conference, as well as pictures of attendees, were leaked to the authorities. It was the first time that many of the cyber-thieves had been photographed and the images were widely studied, he said.

Shopping Growth

Despite the attention, Carder Planet kept going and enjoyed significant success, said Dmitri Alperovitch, co-founder of CrowdStrike and a veteran cyber-crime researcher, who has helped to track down and expose some of its key members.

"It was the right place at the right time," he said. "You had a lot of smart folks in Russia and Ukraine at the time and you had the proliferation of the internet in those days in the former Soviet Union and the economy was doing very, very poorly."

Given that, he said, it was not surprising that those with technical skills and nothing legitimate to do with them turned to crime.

Coupled with this was the rise of online shopping in the US, much of which was powered by people using credit cards. Unfortunately, many of the firms setting up online were better at selling than security, meaning the thieves were regularly able to steal large amounts of card numbers.

Mr Alperovitch said the board explicitly modelled itself on more traditional organised crime groups - specifically the Italian mafia.

Occasional contributors were called "soldiers" and the more someone got involved the higher up the ranks they rose. At the top, he said, were the "dons" and "capos" who ran the biggest scams and collected financial tributes from the people they set working on them.

He said it was also a board on which reputation mattered a lot - a trait seen on many other criminal forums ever since.

Before any criminals worked together they looked for "vouches" - essentially personal recommendations from other thieves about whether someone was trustworthy or not. Without those endorsements a collaboration between say a spammer and a malware writer was unlikely to get started. Anyone with a persistently bad reputation would find that no-one would work with them.

Carder Planet was shut down voluntarily by its creators in 2004 - largely to avoid the fate of other boards, many of which were compromised by police and used to gather intelligence about members.

Many of its members did keep on stealing cards and some of them, notably Roman Vega (aka Boa) and Vladislav Horohorin (aka Badb), have been tracked down and arrested.

Those arrests were a consequence of the open atmosphere on Carder Planet, said Mr Alperovitch.

"They've realised they were quite naive about law enforcement engagement and they did not realise that law enforcement was paying very close attention," he said.

BBC

You Might Also Read:

What Is Selling On the Dark Net?:

International Police Start Crackdown On The Darknet:

« Banks Join Forces to Fight CyberCrime
Get Your Data Strategy On Board »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ThreatConnect

ThreatConnect

ThreatConnect is an enterprise threat intelligence platform by Cyber Squared bridging incident response, defense, and threat analysis for InfoSec & DFIR teams.

Avast Software

Avast Software

Avast Software is a security software company that develops antivirus software and internet security services.

Cyber Security Capital (CS^)

Cyber Security Capital (CS^)

Cyber Security Capital is a consultancy helping to mobilise and empower individuals, corporate leaders and entrepreneurs in cyber security.

Shift Technology

Shift Technology

Shift Technology provides insurance companies with an innovative SaaS solution to improve and scale fraud detection.

Hypersecu Information Systems

Hypersecu Information Systems

Hypersecu Information Systems, Inc. is a solution provider dedicated to multi-factor authentication, public key infrastructure and software copyright protection.

GreyCortex

GreyCortex

GreyCortex uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

Lifespan Technology

Lifespan Technology

Lifespan Technology provides the full range of IT Asset Disposition services. This includes hardware recycling and disposal, data destruction, and hardware resale.

N8 Identity

N8 Identity

N8 Identity helps organizations realize the vision of Autonomous Identity Governance™ with AI-driven Identity solutions.

e-Careers

e-Careers

e-Careers is an edtech institution that provides industry recognised courses and up-skilling solutions to individuals and organisations.

Midwest Cyber Security Alliance (MCSA)

Midwest Cyber Security Alliance (MCSA)

Midwest Cyber Security Alliance is a nonprofit, nonpartisan collaboration of individuals, businesses, government entities, and professionals advocating for more effective cyber security solutions.

South East Cyber Resilience Centre (SECRC)

South East Cyber Resilience Centre (SECRC)

The South East Cyber Resilience Centre supports and helps protect SMEs and supply chain businesses and third sector organisations in the region against cyber crime.

Cybertronium

Cybertronium

Cybertronium is a leader in managing cyber risk. We bring you the latest from the complex, ever-evolving online threat environment with the insights to inspire and the expertise to act.

Support Link Technologies (SLT)

Support Link Technologies (SLT)

Support Link Technologies are an IT Solutions Company committed to achieving customer satisfaction through excellent customer service.

PreVeil

PreVeil

We started PreVeil to bring radically better security to ordinary business and personal communication and information storage.

Nokod Security

Nokod Security

Nokod Security delivers an application security platform for low-code / no-code custom applications and Robotic Process Automation (RPA).

North Green Security

North Green Security

North Green Security is a UK-based cyber security training and consultancy company.