Spammers for Donald Trump!

As we all know by now, Donald Trump is all about Winning, and whether you like him or hate him, if you quote him in a news story you are going to generate a lot of traffic.   Apparently spammers are wise to this truth as well.   When we saw spam messages this month imitating CNN talking about Donald Trump, our immediate thought was that this must be a malware campaign, such as the CNN "Royal Baby" spam we blogged about in 2013.

PhishMe's malware analysts took a look and reported back that this was NOT a malware distribution campaign.  So what was it?

The Trump Spam

To start, we looked for spam during the month of March that had "Trump" in the subject line and "CNN" in the sender name, but did not actually get sent from CNN's IP addresses. There were many thousands to choose from, but only thirteen subject lines were used:

Subject: BREAKING:  Trump Explosion Shocks Audience
Subject: BREAKING: Trump Scandal Could End it All...
Subject: CNN: This Time Donald Trump Crossed the Line
Subject: Donald Trump Explodes on Sunday Talk Show
Subject: Donald Trump:  Here is my Secret Weapon
Subject: Donald Trump:  I have a Secret Weapon
Subject: Donald Trump: I'M DONE
Subject: Donald Trumps Reveals His Trump Card
Subject: TRUMP ADMITS: Yes, It's Rigged
Subject: Trump Debate Comment Stops the Show
Subject: Trump Explodes at Debate, Stops the Show
Subject: Trump Explodes on Sunday Talk Show
Subject: Trump Reveals his Knockout Punch

The "sender name" for these spam messages was selected from one of the following:
CNN Breaking News
CNN Breaking Now
CNN Happening Now
CNN News Now
CNN Politics
CNN Sunday
CNN Updates

However, the email addresses had absolutely nothing to do with CNN or its domain name.  The userids were:
   info, news, notification, notify, or update

followed by many different domain names, including:

 allstayclear.com, bestbetterclass.com, childreneveryopen.com, eyealwaysher.com,
followboatstreet.com, gavewantfar.com, heardwerethan.com, intuitivefinally.com,
lessbooksure.com, offunitrain.com, pageobjectsystem.com, placewhenboy.com,
pullamongmight.net, rainwhichcome.com, redanswercontain.com, restverysay.com,
seemfarmlong.com, shegroundminute.com, sixletterwater.com, strongstoodstate.com,
thingwoodscience.com, veryknewworld.com, warmfoundagain.com

These spam messages are from a group of spammers who specialize in using high interest headlines to do a many-level redirection that eventually lands the recipient of the email on a website promising some form of "get rich quick" scheme.

Other Spam From Same IP Addresses (Walgreens, Google, Amazon)

By selecting the thirty most common spam-sending IP addresses for the CNN/Trump campaigns, we are able to learn about other favorite campaigns being run by the same group of spammers during the month of March 2016.

Subject:  (name), Your Walgreens Card is on Hold #(random number)
Subject: Walgreens Pickup Notice (random number)

was popular at the beginning of the month, with
March 1, 2016 From: info@bestbetterclass.com, info@followboatstreet.com,
March 3, 2016 From: info@doneinchyes.com,  info@veryknewworld.com
March 5, 2016 From: info@redanswercontain.com

Beginning on March 8th, a popular "Google is hiring" scam began from the same spamming computers:

Subject: Google Inc. wants to work with you (89k working from home)
Subject: Google Inc. has three positions available - $75.00 (hour)
Subject: (3) New Positions Open With Google Inc. - Salary is 89K for 2016

From: home@heardwerethan.com, home@warmfoundagain.com, home@pullamongmight.net

Then back to Walgreens, From: info@gavewantfar.com,  info@restverysay.com

The Donald Trump / CNN spam was well mixed throughout on March 3, 4, 6, 7, 9, 11, 12

After a brief hard-core sex campaign on March 12th, on March 13, the spammers began an "Amazon shopping voucher" campaign:

Subject: (name) - Ready to use - your Amazon shopping voucher - active today
Subject: (name) - Your Amazon Card
Subject: (name) - So much at your fingertips - activate your Amazon cash voucher now

with sender names of "Amazon.com.Credit, AmazonCard, ShopAmazon, and Amazon-Voucher and From: info@restverysay.com

The Redirection

In each of the spam campaigns, a single IP address was used as the source for each "from domain" and the destination URLs related to that email were all hosted on an oddly named host on the same domain.  Some examples include:

pageobjectsystem.com	89.46.63.82	mail.pageobjectsystem.com
intuitivefinally.com	94.176.163.119	b99.intuitivefinally.com
redanswercontain.com	72.1.242.156	97q.redanswercontain.com
sixletterwater.com	76.74.218.30	ffoz.sixletterwater.com

Let's take a spam message that redirects us to "smtp.friendroomdiffer.com" as an example.  The URL that we are supposed to has a path that looks similar to this: (we've replaced some characters to break the tracking)

ACRTl5OQU5IB/BIae1TW2BEpk3Z3SL/aLb6+cTbqj6whLaRcBYQTlIE8YcRUNvLS8xh5/zU31q3ruEfD3pXu64wV2NrIhYuwQKpcldGi/CRTw=

When we visit that URL, we are sent to "7roitrack.com" where the string is decoding to show an affiliate ID (who gets paid for any sales that result from this click) and a campaign ID (so they know to show us the "Trump" version of the scam).

That immediately sends us to: "en1-trk.com" which then sends us to "ih-trk.com"  which then sends us to "athome-profits.com" which has a fake "Breaking News" page shown below:

The text of the page tries to convince the gullible email-clicker that Donald Trump believes "Ultimate Home Profits" is the best way to make money from the Internet.  Here's what it says:

"It's time that people realized the amazing potential the American people have to create income for themselves and their families. The truth is, the average American can double or even triple their income today without making any changes to their current lifestyle." Mr. Trump went on.

 (Quote)
The secret, he says, is in taking advantage of the leverage available on the internet.

"It's no secret that I made my fortune in real estate and television, because those were the best opportunities available at the time. But times have changed. Right now, an average American with no special skills and no investment can go out and start earning income online today."

Mr, Trump says the best opportunity available is a new program called Ultimate Home Profits which teaches regular people to take advantage of this massive internet opportunity quickly and easily, and even places them with real online companies that pay them for their time comlpeting simple tasks.
"Emily Hudson is absolutely changing the world with her Ultimate Home Profits program" he said. "Normally, rich people keep the secrets to their wealth to themselves. But Sara, she has found an amazing opportunity, and she is sharing it with everyone. That's incredible."

Trump has not hidden his affection for Ms. Hudson. He has recently been praising her on social media for her efforts to teach regular people how to create amazing wealth in their spare time.
(End Quote)

The scam-page includes a Fake Twitter Endorsement, shown below:

Clicking any of the many links on this page forwards you to the "Ultimate Home Profits" page, which looks like this:

Trump Pills / Trump $100 Gift Cards?

 The "Ultimate Home Profits" spammers are by no means the only spammers that have been abusing Trump's name to peddle their wares (although they are certainly the highest volume spammers of the crowd!)


In this fake Fox News spam (from "FoxNews@newearningreportupdates.eu") the fake headline tells us that "Donald Trump Credits $4 Billion Empire to This Pill".  The URL forwards through "xchangetrak.com" and "tracking.routeoffers.com" and "greathealthychoices.com" before landing at "goodhealthtips.net/donald-trump" (AFFID = 1018).  Spam for this campaign includes sender names such as "Trump Reveals Trick", "Trump's Improve Thinking", "Trump's IQ Booster" and "Trump's Memory Secret", with claims that the email is endorsed by MensHealth, Forbes, CNNHealth, and as shown below, Fox News.

 

(Quote from "goodhealthtips.net" spam affiliate site)

"Trump is a big fan of creating jobs, reading books, and doing puzzles, but according to O'Reilly, he also credits his success to an IQ boosting, brain pill that helped him with memory, and recall. "This pill is the real magic," says Mr.Trump, referring to CogniMaxx XL.

"This brain booster is not heavily advertised but that's what's great about it-- CogniMaxx XL puts all their money into finding the most organic, pure all natural ingredients and that it, it all goes into the formula, so you kind of have to be 'in the know' to get your hands on it, but I tell everyone I meet my 'secret' so I guess it's not really a secret anymore."

 (End Quote)

  

This spam message promises a $100 Gift Card if you will take a survey related to Trump's chance of winning.  The Trump Gift Cards is just another example of the "Survey on any popular topic that promises a gift card" spam.   In this case the spam goes to "www.loveauthority.org" which redirects through the tracking sites "tump.brandstrendy.com", "prosper202.brandstrendy.com" "trkur5.com" and "a.websponsors.com" before landing at "publicsurveypanel.com".  From there it follows a fairly standard "steal all your public information and never give you a gift card" model that we've described on this blog so often before:  (For a full write-up on how Fake Surveys for Gift Cards works, see the story on this blog about fake Target Gift Cards).

The Spamming IPs?

For the spam-trackers who want to know . . .  those "thirty most popular" IP addresses on the Trump/CNN spam we saw are mostly in the US with a couple each from Canada and Romania, and one in Ireland.  In most cases, the criminal leases a box from a reseller who hosts services at one of these locations, and then spams as hard as possible until they get busted, then they rotate to a new IP and keep going.   Spamhaus has coined the term "Snowshoe spammers" for these people who often do single day, or even single hour, spam campaigns from a location before quickly moving to another location, never settling long enough to be considered a "big problem" for any given host.

71.19.251.180/32	ESECUREDATA - eSecureData,CA	11831	CA
71.19.251.204/32	ESECUREDATA - eSecureData,CA	11831	CA
185.24.235.30/32	WEBWORLD-AS Sternforth Ltd t/a Web World Ireland,IE	30900	IE
94.176.163.119/32	M247 M247 Ltd,GB	9009	RO
89.46.63.82/32	M247 M247 Ltd,GB	9009	RO
76.74.218.31/32	PEER1 - Peer 1 Network (USA) Inc.,US	13768	US
76.74.218.32/32	PEER1 - Peer 1 Network (USA) Inc.,US	13768	US
64.34.255.210/32	PEER1 - Peer 1 Network (USA) Inc.,US	13768	US
76.74.218.29/32	PEER1 - Peer 1 Network (USA) Inc.,US	13768	US
76.74.218.40/32	PEER1 - Peer 1 Network (USA) Inc.,US	13768	US
76.74.218.30/32	PEER1 - Peer 1 Network (USA) Inc.,US	13768	US
69.94.156.9/32	DATANOC - Lanset America Corporation,US	16578	US
69.94.156.32/32	DATANOC - Lanset America Corporation,US	16578	US
66.35.67.62/32	RAPIDVPS-COM - Infinitum Technologies Inc.,US	17183	US
172.93.102.75/32	AS-CHOOPA - Choopa, LLC,US	20473	US
108.61.147.14/32	AS-CHOOPA - Choopa, LLC,US	20473	US
108.61.147.13/32	AS-CHOOPA - Choopa, LLC,US	20473	US
172.93.102.78/32	AS-CHOOPA - Choopa, LLC,US	20473	US
108.61.147.12/32	AS-CHOOPA - Choopa, LLC,US	20473	US
172.93.102.76/32	AS-CHOOPA - Choopa, LLC,US	20473	US
64.202.126.28/32	SERVERCENTRAL - Server Central Network,US	23352	US
205.234.252.203/32	SERVERCENTRAL - Server Central Network,US	23352	US
72.1.242.154/32	NDCHOST - Network Data Center Host, Inc.,US	33322	US
72.1.242.156/32	NDCHOST - Network Data Center Host, Inc.,US	33322	US
72.1.242.148/32	NDCHOST - Network Data Center Host, Inc.,US	33322	US
198.12.68.166/32	AS-COLOCROSSING - ColoCrossing,US	36352	US
198.12.68.162/32	AS-COLOCROSSING - ColoCrossing,US	36352	US
198.12.68.164/32	AS-COLOCROSSING - ColoCrossing,US	36352	US
104.160.170.173/32	ST-BGP - Sharktech,US	46844	US
170.178.189.101/32	ST-BGP - Sharktech,US	46844	US

"Unlimited" ATM Mastermind Ercan Findikoglu pleads guilty

One of the most fascinating types of cybercrime, in my opinion, is the Unlimited ATM attack.  There have been several such attacks over the years, as we've written about in this blog previously, including:

• 02JUL2008 - 7-11 ATM Hackers - More Details
• 07SEP2008 - Is the Analyzer Really Back? (The return of Ehud Tenenbaum) 
• (Tenenbaum was transferred to the US, pled guilty to two other cases, sentenced in July 2012 to Time Served and ordered to pay $503,129 restitution) 
• 11NOV2009 - The $9 Million World-Wide Bank Robbery
• 09MAY2013 - ATM Cashers in 26 Countries Steal $40   

In an "Unlimited" attack, hackers gain access to the internal systems of a bank or banking network and are either able to "reset" ATM withdrawal limits or eliminate the limits altogether for a card or group of cards.  The magnetic stripe data from these cards are then widely distributed to "cash-out crews" who take responsibility for draining as many ATM cards as possible in their area, while each time a card is used, the hackers "undo" the transaction so that the card appears to have not been used.

33-year old Turkish citizen Ercan Findikoglu was charged with conducting three such Unlimited campaigns.

In February 2011, $10M was withdrawn using the pre-paid debit cards distributed by the American Red Cross to disaster relief victims.  The cards were operated by JPMorgan Chase.  On February 27 and 28, 2011 a total of around 20 pre-paid debit cards were used in approximately 15,000 transactions to withdraw $10M from ATM machines in 18 countries, including ATMs in the Eastern District of New York.

In Findikoglu's second Unlimited attack, pre-paid debit cards for the India-based company ECS, operated by National Bank of Ras Al-Khaimah PSC (RAKBANK) in the United Arab Emirates were used.  On December 21 and 22, 2012, approximately 5,000 transactions in at least 20 countries resulted in withdrawal of $5M.

In the largest of his three documented Unlimited campaigns, enStage, a California-based payment processor, suffered an intrusion and had many cards stolen from its internal database.  A group of pre-paid debit cards for Bank Muscat in Oman were selected as the target, and on February 19 and 20, 2013, 36,000 transactions in 24 countries were used to steal $40M.

ERCAN FINDIKOGLU, who called himself "Segate" or "Predator" online, was arrested in December of 2013 while visiting Germany.

He was originally charged with 18 counts:

(1)   CONSPIRACY TO DEFRAUD THE UNITED STATES
(2-4) FRAUD ACTIVITY CONNECTED WITH COMPUTERS
(5-6) ATTEMPT AND CONSPIRACY TO COMMIT MAIL FRAUD
(7)   BANK FRAUD
(8)   ATTEMPTS TO COMMIT AN OFFENSE
(9-14) PRODUCES/TRAFFICS IN COUNTERFEIT DEVICE
(15) MONEY LAUNDERING CONSPIRACY
(16) MONEY LAUNDERING
(17) TAMPERING WITH WITNESS, VICTIM, OR AN INFORMANT
(18) INTIMIDATION OR FORCE AGAINST WITNESS

On June 24, 2015, Ercan was ordered into US detention, having been extradited from Germany.  The German courts in Frankfurt declared that Findikoglu was "the most-wanted computer hacker in the world and may face more than 247 years in prison if convicted of all U.S. charges" (as quoted in Bloomberg's story of 23JUN2015 - "Most-wanted cybercriminal extradited to U.S. from Germany."

As usual, the reality of sentencing varies dramatically from the overblown initial press release.  On March 1, 2016, All parties appeared before the honorable Judge Kiyo A. Matsumoto for a Change of Plea Hearing.    Sentencing is scheduled for July 12, 2016, but according to the BBC, prosecutors have agreed in a plea deal to limit his incarceration for "between 11 and 15 years."  (See "US bank hacker faces long jail time").

Many of the "Cash-out crews" from these operations have been separately arrested and charged, while many others (the vast majority really) remain at large.

Vovnenko / Fly / MUXACC1 pleads guilty

Sergey Vovnenko pleads guilty

This week a Ukrainian hacker made famous for attempting to frame security journalist Brian Krebs by sending him heroin purchased on the Silk Road, had his day in court and chose to plead guilty.  Krebs blogged about his arrest in Italy in 2014 with the title The Fly Has Been Swatted, but now that a guilty plea has been entered, we can see the details of the case.

In June 2013, a U.S. Secret Service agent swore out a criminal complaint against Vovnenko for crimes he committed against citizens in New Jersey.  Although we refer to "Federal Crimes" in most cyber crimes, charges can only be brought for damages local to the U.S. Attorney's office where the prosecution makes the charges.

From 2003 until 2013, the complaint states, SERGEY VOVNENKO, AKA Centurion, AKA Flycracker, AKA Flyck, AKA MUXACC1, AKA Stranier, ran various scams related to carding.  In a specific instance, cards were stolen "on or about" March 14, 2011 from a victim in Rutherford, NJ, violating Title 18 Section 371 of the Federal Code.  Many of the early attacks used SQL Injection to gain access to target computers that were accessible via the web and had access to databases of personally identifiable information and credit card data.  Vovnenko in particular advertised "dumps" services using both his Twitter account and an ICQ account.

Between 2009 and 2011, Vovnenko managed to plant malware on computers at "Victim 1" which is described as a "global financial institution with millions of customer accounts" that "maintaned signficant infrastrucutre in New Jersey, including computer servers housing banking information located in New Jersey."

Vovnenko was an old-school carder.  He originally sold his dumps on the Shadowcrew website, which was shut down in 2004 by the U.S. Secret Service.  (This site is where Vovnenko began chatting with now infamous Data Breach king Albert Gonzalez.)  In 2008, Vovnenko used ICQ to chat with Vladislav Horohorin, the hacker known as "BadB."  BadB was sentenced to 88 months for trafficking in stolen cards and for his role in the $9M theft from Atlanta-based RBS WorldPay.  By 2010, Vovnenko was actively selling as "Centurion" on CardingWorld, Mazafaka, and Verified.ru.

Our complaintant testifies that on or about March 16, 201, Vovnenko chatted with another criminal who asked him to review his logs from his botnet to see whether he had IP addresses indicating that some of his bots were in the NJ-based Financial Institution known as "Victim 1" in the court documents.  He did, and was asked to plant an executable on that computer to give his co-conspirator remote control to the computer.  (We've heard about this type of "log selling", where a "commodity botnet infection" leads to targeted attacks at specific institutions before.  See my blog post about the Fox-IT/Group-IB "Anunak" report, "Botnets, APTS, and Malicious Emails")

A "Zeus Logs" seller offers 240MB of logs for $300-$400 ...

A Criminal Complaint is only intended to show Probable Cause to open an investigation.  It does not require the same level of details as an Indictment, which charges the accused of committing specific criminal acts.

The Indictment came in April of 2014 ...

The Indictment adds additional aliases (Tomas Rimkis, Darklife) and specific charges.  We'll focus on Charge One and Three, which are the ones he pleaded guilty to this week.

Count One:  Wire Fraud Conspiracy (18 u.s.c.§1349)
From September 2010 to August 2012, VOVNENKO and his co-conspirators "operated an international criminal organization that hacked into the computers of individual users and of companies in the United States and elsewhere, and used that access to steal data, including, among other things, user names and passwords for bank accounts and other online services, as well as debit and credit card nubmers and related personal identifying information.   After stealing the Log-In Credentials and Payment Card Data, defendant VOVNENKO and his co-conspirators used that information to illegally access and withdraw money from bank accounts and to incur unauthorized charges using the payment card data."  They also sold the data using online forums to individuals and groups that in turn did other illegal things with the data.

The indictment states that VOVNENKO had a botnet of "over 13,000 computers infected with malware" and that several of the infected computers were in New Jersey.  At least part of the malware was the "Zeus" malware that specializes in stealing banking information and recording keystrokes of users.  At least one employee (known as "J. H." in the indictment) of the Victim 1 bank had his workstation infected and from that base, the botnet was able to contact and interact with computers located inside financial institutions.  Counts Three through Six of the indictment refer to the specific acts of logging in to J.H.'s computer "in related to felony violations

18 U.S.C.§1349 and 18 U.S.C.§1030(a)(2)(C) and (c)(2)(B)(i)

By December of 2015, Vovnenko and his lawyers knew he was going to be found guilty on all charges, no ifs, ands, or buts.  They agreed to a plea agreement where Vovnenko took the rap for Count One and Count Three, agreeing that he could face a sentence of 20 years imprisonment and $250,000 fine.  Because he also faced the charge of Aggravated Identity Theft, there is an additional two year mandatory minimum sentence that cannot run concurrently with any other sentence.  Further, VOVNENKO understood that he may be required to pay restitution, and will likely be deported after his sentence is served.

Sentencing in this case is set to May 2, 2016.  At that time, a Money Judgement will also be made regarding the amount of Restitution that may be required.

Many more details about "Flycracker" (as he was known on Silk Road) or "MUXACC1" (as he was known on Twitter) are available from Brian Krebs' story "Hacker Who Sent Me Heroin Faces Charges in U.S."

Passwords, Password Cracking, and Pass Phrases

Yesterday I was contacted by a journalist who had questions about passwords.  I tried to convey some concepts to her, but when her response was "Wow.  You must really like math!"  I knew I had failed to communicate.  The story may have accomplished some purpose, but not one that would please a technical audience.  Below, I try again.

The story was partly prompted by a new password policy at UAB, where I work.  The basic policy is that you should have a 15-character password, but the quid pro quo for that is that you will only have to change your password once per year.

How Often to Change Passwords

We'll talk about the 15-characters below, but quickly about the one year.   The original "wisdom" about changing your passwords every thirty days was based on the fact that the average computer hacker using an average computer would need about thirty days to crack a password.  By changing your company's passwords every thirty days, if a hacker had managed to grab your /etc/passwd file or to dump all of your Windows hashes, by the time they had cracked the passwords, they would all be obsolete.  Now many Windows passwords can be cracked in seconds and most in less than a day.

There are still times to change the passwords more frequently.  Specifically:

• any time you feel that someone may have observed you enter your password 
• any time you have been exposed to malware or phishing
• any time you have a change in administrative/trusted computing personnel (people who may know 'shared passwords' or passwords to routers/switches/servers)
• whenever you are changing hardware or lose control of your devices (lost/stolen/sold computer/laptop/phone)

 Other than those times, there is really no reason to change your passwords, but an annual refresh still seems reasonable. 

Classes of Password Problems

Password re-use

One of the biggest problems that we face today with passwords is that people use the same passwords everywhere! Some studies have suggested that as many as 55% of adults use a single password on all websites! (See, for example, this 2013 UK study, or this June 2015 study by Harris Interactive, showing that 59% of Americans re-use passwords because it is too hard to remember them!)
Why is password re-use such a big deal? Because of the common problem of even the largest websites getting hacked and losing passwords!

• 000Webhost - Just this week a major provider of free webhosting services had 13 million userids and passwords stolen (See story in Forbes or from Troy Hunt).
• Ashley Madison - 11 million passwords have been cracked! CNN Ashley Madison passwords cracked, including the most popular passwords: 123456, password, 12345, 2345678, and qwerty. Other common passwords were "helpme", "midnight", and "yamaha".
• Adobe - in 2013 150 million Adobe software users (that is YOU if you have ever downloaded Adobe's PDF Reader or Flash Player) had their userids, password hashes, and password "hints" leaked. Crackers soon made short work of millions of those passwords by matching hashes of leaked passwords and combining multiple hints to determine the underlying password.
• LinkedIn - in 2012, hackers revealed that they had stolen 6.5 million userids and passwords from LinkedIn!

It is now generally accepted that every time one of these "major password dumps" hits the Internet, criminals use automated programs to test these userid and password combinations at all of the other bank, credit card, and merchant shops where you may have used the same userid and password on another account.  Many people make the error of treating their Email password as an "unimportant" account, failing to recognize that if I have your email password I now know where you bank (if you receive electronic statements), who you communicate with (and with your password, I *AM* you), and when you will be traveling!

Overly simple passwords
Many people who think they are being clever actually choose common passwords used by other people who thought they were being clever. A study in 2008 listed the 500 most common passwords at that time, and many of the continue to be widely used, including "clever" passwords such as "ncc1701" (the number of the Starship Enterprise), "bond007", and "qwertyui".)

One of my first exposures to the password problem came from the notorious "Morris Worm" which crashed the entire Internet back in the 1980s by using a simple password guessing list to break in to servers on the Internet. After each server was compromised, it would then try to break in to every other server it could find, starting by testing the 432 hard-coded passwords against every account it could find, and moving on to more complex cracking techniques. Robert Morris the Hacker, was the son of Robert Morris the Unix pioneer at Bell Labs. The Senior Morris had published a paper in 1979 called Password Security: A Case Study. After his death, a slashdotter revealed that he had discovered the senior Morris capturing other Bell Labs employees' passwords -- which may actually have been the source of the password list the younger Morris ended up using in his worm!

When I was a young Systems Programmer working at Samford (in 1989) I used the Morris Password list to require users at Samford to change their password if they were using any of those words. We added a few other common passwords to the list that we found our local users liked, including: bulldogs, bulldog!, ROLLTIDE, samford, and aubie1.


Password Cracking


 Let's talk about cracking alphabets:

If you have a one character password, and you restrict your password to only using the 26 lowercase alphabetic characters, guessing your password will take 26 guesses. abcdefghijklmnopqrstuvwxyz. Done! We've guessed your password!

If you have a TWO character password, how many guesses will it take? 26 SQUARED or 26^2 = 676 guesses, from aa, ab, ac to zx, zy, zz.

By raising the LENGTH of the password, we change the exponent. a 3 character password is 26^3, 4 characters = 26^4, 5 character = 26^5, etc.

By raising the SIZE of the alphabet, we change the BASE.
Lowercase = 26
Uppercase = 26
Numeric = 10
Special characters = 33

`~!@#$%^&*() -_=+[{]}\|;:'",<.>/?

(including the "space")

If we combine all of these, 26 + 26 + 10 + 33 = 95, we have a strong "alphabet" that resists crackers who have only been guessing "all lowercase" or "all lowercase plus numbers".

All the way back in the 1979 paper, Robert Morris warned about the dangers of password cracking and how simple passwords could be easily guessed by computers. In 1979, he calculated the time to crack various passwords, based on a combination of the length of the password and the size of the alphabet.

Now let's look at 1979 cracking times from the paper by Mr. Morris Senior:

n	26 lower	36 lower + numbers	62 alpha + numbers	95 printable chars	all 128 ASCII chars
1 char	30 msec	40 msec	80 msec	120 msec	160 msec
2 chars	800 msec	2 sec	5 sec	11 sec	20 sec
3 chars	22 sec	58 sec	5 min	17 min sec	44 min
4 chars	10 min	35 min	5 hrs	28 hrs	93 hrs
5 chars	4 hrs	21 hrs	318 hrs	112 days	500 days
6 chars	107 hrs	760 hrs	2.2 years	29 yrs	174 yrs

In 1979, a six character password with upper+lower+numeric+symbol would protect us from cracking for 29 years!  But today's computers are FAR faster than that! How does that compare to today's password cracking speeds?

To guess all 7-character lowercase passwords would be 26^7 guesses, or 8,031,810,176 (8 billion guesses!)

A secret about Windows passwords comes into play here. In environments that still use Windows XP, Windows defaults to a password storage mechanism called "LanMan Compatibility." That means that if your password is LONGER than 7 characters, Windows actually splits the password into two parts and hashes the first 7 characters as one hash, and the remaining 1-7 characters as a second hash. So, instead of a 14-character Windows XP password having a complexity:

26^14 = 64,509,974,703,297,150,976 (64 QUINTILLION guesses!)

It actually is stored as:

26^7 + 26^7 = 8 billion + 8 billion = 16 billion

Of course no one in their right mind is still running Windows XP! (right?)

Still, 16 billion guesses sounds like a lot, right? Unfortunately, not anymore.  How long would it take to crack a password that required 16 billion guesses?  If you have the right computer, LESS THAN ONE SECOND.

In December 2012, Ars Technica ran a story called 25 GPU Cluster Cracks Every Standard Windows Password in 6 hours!. The story is about a 5-server setup built with 25 Graphical Processing Unit cards (the video cards that the gamers love) that can guess 350 BILLION PASSWORDS PER SECOND!

So what do we do?

Even in Windows XP though, if we went to FIFTEEN characters, LanMan compatibility was broken, and we no longer divided the password, meaning that we now have:

26^15 if we use only lower case characters, or 95^15 if we use UPPER+lower+numeric+special characters!

95^15 = 463,291,230,159,753,366,058,349,609,375 (463 OCTILLION guesses!!!!)

463 OCTILLION divided by 350 Billion Passwords per second means . . .

1,323,689,229,027,866,760 seconds or
22,061,487,150,464,446 minutes or
367,691,452,507,740 hours or
15,320,477,187,822 days or
41,973,910,103 years


At UAB, we've decided that anyone who can wait 41 BILLION YEARS to crack your password is welcome to have all your data.


Of course we have to remember Moore's Law.

 Moore's Law suggests that computers double in speed every 18 months. While that doesn't sound like much, that means in 18 months it would only take 20.5 billion years. 18 months after that it would take 10.25 billion years. So in thirty-six 18 month periods, or 54 years, we would be able to crack that password in less than a year. That doesn't even take into consideration the fact that we will be able to harness additional computers together to use larger networks of computer to do the guessing.

Pass Phrases = 15 characters? How will I remember!?!?!

Remember that we not only need a LONG password, with a COMPLEX character set, we also need to make sure we don't re-use passwords across multiple sites!

There are two theories on how to do that.

One is to use password management software -- something like "LastPass" or "LogMeInOnce" -- I'm not going to address those packages here, other than to link to one review at PC Magazine -- The Best Password Managers for 2015 and to caution that MANY of the mobile phone apps that claim to be password managers are RIDICULOUSLY insecure! (See the article: ElcomSoft analyzes 17 Smartphones’ Secure Password Managers, Finds No Security).


The other theory, the one I like and use, is to use Pass phrases.


A pass phrase is a combination of words that is memorable TO YOU but that would not be something anyone else would know or use. Remember that the main trick criminals use to try to get your password is guessing commonly used passwords from a password list or dictionary BEFORE they start "brute-forcing" or guessing every combination of letters, numbers, and symbols. Password crackers come with dictionary files such as "10,000 most common passwords" and "100,000 most common passwords" and "English language names and places" and "Oxford English Dictionary Word List". We need to make sure OUR pass phrase is not on any of those lists.

Think of a memorable event. Or something you are unlikely to forget. Or a favorite book or movie. I'll give you an example of each of those.

Memorable Events
When my son got married we had an interesting situation. He hates cake. Always has. And yet WEDDING CAKES and GROOM'S CAKES are a major part of a wedding. My son did cookies instead of a groom's cake. So a password I used at about that time was:

theGROOMprefer$c00kies -- 22 characters. upper, lower, symbols, and numbers.

A common mistake people make with the numbers and symbols is to just put a "1!" at the end of their chosen word. Hackers know this, and cracking programs automatically check for that! I use common symbol and number substitions, such as replacing the letter "o" with the number zero (0), or replacing an "s" with a "$". E = 3, S = 5, A = @ are also some common substitions that are still easy to remember.

Unlikely to Forget
As many Christians do, I like to memorize scripture. I will often choose a password that relates to the site I'm visiting and invokes a Bible verse. For example, "Ancestry.com" is a family tree website. One of my favorite Psalms, Psalms 1, says that people who meditate on God's word are "like a tree planted by rivers of water" so a good pass phrase for Ancestry for me might be:

th@tTR33fromPsalms1 -- 19 characters (That tree from Psalms 1). Upper, lower, symbols, number.

I also use passwords to remind myself or motivate myself. When my brother was adopting two sons from the Ukraine I had a password:

Pr@ying4Dima&Vladik!

One of my Computer Forensics graduate students, Ran Sun, shared a presentation on passwords that included a link to this great article How a Password Changed My Life, where the author uses his passwords to remind himself to forgive someone, to encourage himself to stop smoking, and many other 'self-improvement' motivators.

Movies, Books, and Other tricks
One of my earliest password tricks was using a favorite book or movie title as a password. I remember telling one class about pass phrases and saying that one of my early passwords was "Robert Heinlein says the Moon is a Harsh Mistress". A bright student said "Oh! I see, take the first letter of every word to make your password -- RHstmiahm!" No. My password was actually: "RobertHeinleinsaysthemoonisaharshmistress". At that time 52^40. I don't care that it didn't use numbers or symbols.

Maybe your password is something related to an action by your favorite character: "Darth$@y$LukeIAMyourfather!"

or a combination of the author and his title "Hemingway&the0ldman&thesea"

or the year you first saw the movie: "1977.isawStarWarswithChad"

There are tons of ways to make a memorable pass phrase that will be memorable ONLY TO YOU!


The future of Password anti-cracking

The next technological trick to countering password cracking is to store the password hashes in a way that is more computationally complex. If an array of GPUs can guess 350 billion passwords per second, what is necessary is to make the process of guessing a SINGLE password require more computation time. Because a "real" user is only going to enter the password once, if it were to take even a full second for the password to be checked, that would be acceptable in most cases -- and yet it would make it much harder to "brute force" the account. bcrypt, an algorithm by Niels Provos and David Mazieres, is one such algorithm. Depending on the settings, it can reduce the number of password guesses per second down to under 20 even with a very fast computer! 20 vs. 350,000,000,000 will give the attacker a distinct disadvantage!

Last year at Password 2014 Conference in Norway, Thorsten Kranz presented a paper called On Password Guessing with GPUs and FPGAs (click for video of his presentation). This annual academic conference on passwords includes the "Password Hashing Competition" that discusses why bcrypt and scrypt are the best ways to store passwords.  For the uber-geeks, you will enjoy watching that!

Hillary's Email Server and the New York City malware

Wednesday night (September 30th) I had a strange Tweet in my notifications from a journalist at ForeignPolicy:

Elias explained that he was wanting some quotes in response to a "hyperbolic AP story" by Bradley Klapper, Jack Gillum and Stephen Braun that had posted on the AP wire. (The same story has been posted in the Washington Post, US News & World Report and other top news sources.
The story begins with the opening paragraph:

Russia-linked hackers tried at least five times in August 2011 to trick Hillary Rodham Clinton into infecting her computer systems while she was secretary of state, according to newly released emails from the State Department.

The New York Times version of the story is far more sensational (and far more incorrect) in their telling of the story. Given the victim of all this attention, you would have thought these stories were from Fox News! Here's NYT making up scary security-sounding stuff:

Still, the evidence that Mrs. Clinton's personal account had been on the receiving end of a "spear phishing" attempt, revealed in a batch of her emails released by the State Department on Wednesday, raises the same question the F.B.I. is trying to answer as it combs through the forensic evidence from the server that was once in Mrs. Clinton's basement.

In fact, a disclaimer on the bottom of the NYT news story now reads:

A headline on Friday with an article about Hillary Rodham Clinton's email server overstated what is known about an investigation into the server's security. As the article correctly noted, Mrs. Clinton received spam email that was intended to place malware on her computer network; the investigation has not yet determined that the malware effort was successful.

What Elias did that apparently the AP reporters and the NYT reporters did NOT do was a simple Google search. If they had, they would have seen the story on this blog, dated August 17, 2011, with the headline New York City "Uniform Traffic Ticket" tops spammed malware. The image that accompanied that story, shown below, reveals why the email was turned over to the government:



 As Politico suggests in their story Most Clinton spam messages likely deleted, the workers tasked with finding "work-related" emails to turn over probably started with a few simple rules like "turn over all the emails that are from .gov addresses" -- which would include this spam, which claimed to be from @nyc.gov.

The point of that CyberCrime & Doing Time blog post was to share that this was one of the highest volume spam campaigns we had seen that summer!  Just in the UAB Spam Data Mine, we had received 11,000 copies of this email!  Spear-Phishing, which the New York Times wrongly suggests happened here, is when an email message is personalized to target a particular high-wealth or high value target.  If Hillary Clinton was targeted, so were about 11,000 mostly entirely fictitious people whose spam goes into the UAB Spam Data Mine, as well as a few hundred people who chose to share their emails with us!

What is ChepVil?

It isn't a mystery at all.  In fact, we have that documented in the blog post as well.  The malware is not mysterious at all.  It was part of a "pay-per-install" malware ring that was very popular at that time.  When my lab at UAB reported the malware to VirusTotal, it was detected by 18 of 43 anti-virus programs, with both Microsoft and Sophos detecting the malware and calling it "Chepvil" (Microsoft called it "TrojanDownloader: Win32/Chepvil.N" while Sophos called it "Mal/ChepVil-A" - we were using the name "FraudLoad" for this malware at that time).  You can see that August 17, 2011 VirusTotal report as it looked the day we reported it.  (And you can see in the comment there, also from that day, that we explained the source of the malware and gave a link back to our blog post.)

ChepVil is a type of malware that was heavily based on the BredoLab malware, although by August 2011, the BredoLab original author was already in jail.  Armenian programmer, Georgy Avanesov,  was arrested in October of 2010 when the Dutch High Tech Crime Team police seized 143 servers located at LeaseWeb in the Netherlands that he used to control his world-wide spamming operations.  At the time of his arrest, BredoLab was infecting 3 million computer per month and being used to send approximately 3.6 billion spam messages per day.  Despite this massive seizure, because his source code was already known by other malware criminals, the attacks quickly resumed following his arrest.

The August 17, 2011 version of this malware made a connection back to the Russian domain name sfkdhjnsfjg.ru, (associated with BredoLab, according to Sophos, see for example this Sophos report from August 4, 2011.)

We reported malware communicating to that server to the Microsoft Malware Protection Center on August 11, 2011 -- pointing out that it was hosted on the IP address 195.189.226.103, one of several IP addresses on that same netblock that took turns hosting sfkdhjnsfjg.ru during August 2011, all  hosted in Mykolayiv, Ukraine.   The first time we saw this family of malware communicating with that server was in a big campaign imitating the FBI on May 5, 2011.  The same malware family pretended to be the United Parcel Service on June 9, 2011, sending my lab at UAB more than 54,000 copies of the malware.  We produced a map of the computers that sent us both the May 5 FBI spam and the June 9 UPS spam and shared it with law enforcement at that time:

The point is - it wasn't "targeted" and it wasn't "spear-phishing" and it isn't a "mystery" about how it  came to be sent to Mrs. Clinton.   This wasn't a clever Russian master mind sitting in his evil lair dreaming of taking over the State Department.  One of the millions of spam bots that were part of this network (or actually probably FIVE of them) asked the Command & Control server "Who shall I spam next?" and happened to draw Mrs. Clinton's email address.

But What COULD the Malware Do? 

In August of 2011, the primary thing that Chepvil did was deliver "Fake Anti-Virus" software.  That's it.  The malware would connect to the server and ask "What additional malware would you like to infect me with?"  The server would then see who was currently paying the highest commission to have their malware installed, and whether the daily quota for installing that additional malware had already been fulfilled, and install whatever it was told to install.

In August of 2011 - the only thing we saw Chepvil install was Fake Anti-Virus, and a near cousin "Fake System Alert".  So, *IF* Mrs. Clinton had actually been infected by this malware, it would have caused a pop-up animation to play, claiming she was infected with dozens of nasty viruses, and that she needed to pay the criminals $59 to get rid of the malware.  None of that is true -- the malware is actually just "ScareWare" -- intended to irritate you with pop-up warnings about being infected until you finally give up and pay the "license fee" or have the malware professionally removed from your PC.

The Daily Malware Report

Olivia Foust Vining (now at PhishLabs, Hi Olivia!) was the student malware analyst in my lab who brought this malware to my attention that day in her "Daily Malware Report" (a research project sponsored by UPS!)  By the end of her shift, we had actually seen 45,377 copies of the malware!  Her report gave every 15 minute breakdowns of how many copies we received during the morning hours.

count |        mbox         
-------+---------------------
   326 | 2011-08-17 03:30:00
   264 | 2011-08-17 03:45:00
  1880 | 2011-08-17 04:00:00
   756 | 2011-08-17 04:15:00
  1930 | 2011-08-17 04:30:00
  2608 | 2011-08-17 04:45:00
  5982 | 2011-08-17 05:00:00
  4364 | 2011-08-17 05:15:00
  3544 | 2011-08-17 05:30:00
  2418 | 2011-08-17 05:45:00
  2262 | 2011-08-17 06:00:00
   999 | 2011-08-17 06:15:00
   870 | 2011-08-17 06:30:00
   972 | 2011-08-17 06:45:00
   643 | 2011-08-17 07:00:00
   277 | 2011-08-17 07:15:00
   354 | 2011-08-17 07:30:00
   200 | 2011-08-17 07:45:00
  4571 | 2011-08-17 08:00:00
  3974 | 2011-08-17 08:15:00
  3109 | 2011-08-17 08:30:00
  2047 | 2011-08-17 08:45:00
  1617 | 2011-08-17 09:00:00
(23 rows)

For comparison, here is the count of the other high malware volumes for that day:

count |             md5_hex              
-------+----------------------------------
 45377 | 1c2b06a9fbbea641ae09529e52f29b96 <= the "Uniform traffic ticket" malware
  3484 | e7b48c4421a68740dfd321dade6fd5e6 <= "End of July Statement" malware
  2627 | c1f67a7542359397544bd0af0b546166 <= "Your credit card has been blocked" malware
  1021 | d22eadfda41fcbeb692c600c97d10ff5 <= "Money Transfer Information" malware

But how did Spammers learn Mrs. Clinton's email address?

There are four primary ways that spammers gather email addresses.

The first is specialized software programs that scour the web looking for email addresses on websites.  One of the richest sources of these is actually "archives" of large email lists.  When email lists provide web access to their history, many do so publicly, allowing these scraping tools to learn the email addresses of every person mentioned on the mailing list.  Spammers also JOIN tons of mailing lists to be able to gather the email addresses posted there.

Data dumps are another rich source of email addresses.  Do you recall, for example, the Adobe breach in 2013 when 38 million people who had ever used an email address to register for the free download of Adobe reader or any other Adobe product had their email addresses publicly revealed?  Such events are great days for the spammer community!

Next, we have malware on other people's computers. Many malware programs have as one "module" code that will scan a computer for email addresses.  If even ONE of Hillary's regular correspondents became infected with malware, her email address would have been discovered that way.

Lastly, we have SMTP harvesters.  These programs scan for mail servers, enumerate the domains served by that server, and then begin asking "do you deliver email for al@yourdomain.com? amos@? ann@? ... zach@?" The more intense of these servers will ask for every single letter and number combination, until it has a complete list of the "known" email addresses for the given domain.

So . . . it isn't surprising at all that even "secret" email addresses receive spam.

Thanks, Foreign Policy, for getting it right! 

I was pleasantly surprised by how well Elias Groll handled the details on this story.  He quickly identified the scare-mongering going on over at the AP, and reached out for the facts.  Obviously what I shared above is far too much technical detail for the readers of FP, but I do want to commend the level-headed reporting in their story:

Clinton's Private Emails Show Aides Worried About the Security of Her Correspondence

Hackers vs. Drones: ISIS Cyber Caliphate Leader Junaid Hussain

In what may be a first move in the new escalation of cyber warfare with kinetic results, Junaid Hussain, the 20-something hacker who fled to ISIS after being charged with hacking Tony Blair's email accounts, has been killed by a drone strike.

CNN is running with the exclusive at this time claiming "The U.S. military and intelligence community is in the final stages of confirming that a U.S. drone strike this week killed Junaid Hussain."

(Click for CNN Story)

CNN quotes "several U.S. officials" that "the drone strike was specifically targeting Hussain traveling in a vehicle in Syria after the U.S. got intelligence on where he was and watched him to confirm his presence before striking."

Those who follow the defacement community will be well-familiar with Hussain's previous shenanigans online as the leader of Team Poison.  He gradually drifted from target-of-opportunity defacing to more difficult "called target" defacing, and was eventually jailed at age 18 by the British government after publishing the details of Tony Blair's email accounts, as broadly documented in July of 2012.

Click for Telegraph story

Hussain, who hacked under the name "Trick" during his Team Poison days in England, was sentenced to six months imprisonment for "conspiring to commit public nuisance," "causing a computer to perform a function to gain unauthorized access to data or programs" and "defacing numerous websites" between January 1, 2010 and April 14, 2012.  After his release he was arrested again for his cyber activities and fled the country while out on bail.

2012 - TeaMp0ison hacks NATO

 Hacking governments and militaries was something TeamPoison (TeaMp0isoN) had been doing for years prior to Trick's run-in with the UK authorities.  Above is a typical rant from Trick decrying NATO, BAE Systems, BP Oil, and Rupert Murdoch.

On August 3, 2015, the Mirror ran the headline "ISIS: British computer hacker who fled to Syria is third on US hit list of key Islamist militants".  At that time, he was using his new jihadi-friendly hacking name of "Abu Hussain al-Britani".  According to the Mirror article, only Jihadi John (Mohammed Emwazi) and ISIS Leader Abu Bakr al-Baghdadi were more wanted on the US "kill list."

Among his crimes, Hussain was identified as the man suspected in hacking the Twitter and Facebook accounts of US Central Command.Their most recent Twitter accounts @UmmHussain_18 and @AbuHussain_23 were created after their August 13th leak of US government personnel contact information caused #17 and #22 to be deleted by Twitter.

His 45-year-old rock-musician wife Sally Jones, now "Umm Hussain Al-Britani" and their 10-year-old son also lived with him in Syria.  As of 14AUG2015, there was concern that she may have been seen back in England:

Click for "Mrs. Terror Back in Britain?"

The Case of Spamford Wallace: Guilty at Last!

My anti-spam community friends were all abuzz today with the news that Spamford Wallace had pleaded guilty in a Las Vegas court to "compromising approximately 500,000 Facebook accounts" in order to deliver "more than 27 million spam messages."

What might amaze the General Reader is that this is the SAME Spamford Wallace case that began with an indictment on July 6, 2011.

The Spamford Wallace Indictment

July 6, 2011 Original Charges

According to the Indictment, Wallace created an account on November 4, 2008 under the name "David Frederix" and then tested posting spam messages to his 'real' wall "Sanford MasterWeb Wallace" experimenting with which posts would best evade Facebook's filters.

He then made a script that would automate the process of logging in to a Facebook account, obtaining a list of all of the Friends of that account, and then posting his advertising message to each of those friends' walls.  Spamford then created a domain registrar account at Moniker Online and another at Dynadot (using the name Laura Frederix) and between the two created 2,500 domain names that would be used in these spamming attacks against Facebook users.

On November 5 and 6, 2008, Sanford sent approximately 125,000 spam messages to Facebook users using this method.  On December 28, 2008, another run was made, posting nearly 300,000 spam messages, by logging in through 143 different IP addresses that were used as proxies to disguise his origins.  On February 17, 2009, another 125,000 messages were posted.

At this point, a civil injunction was served on Sanford Wallace in the case of Facebook Inc v. Sanford Wallace (Northern District of California No 09-00798 JF) where Judge Jeremy Fogel ordered Sanford Wallace to no longer access Facebook's computer network.  (Orders issued on March 2, 2009 and March 24, 2009).  Sanford logged in on April 17, 2009, in violation of this order, while flying on a Virgin Airlines flight  from Las Vegas to New York.

In 2011, Sanford was back on Facebook, using a profile called "David Sinful-Saturdays Fredericks"

Counts 1,3, 7 - Fraud and Related Activity in Connection with Electronic Mail, carry a possibility of 3 years imprisonment.

2, 6, and 9 - Intentional Damage to a Protected Computer, carries a maximum sentence of 10 years imprisonment.

4, 5 and 8 - Fraud and Related Activity in Connection with Electronic Mail, carries a 3 year imprisonment possibility, and a possible $250,000 fine.

Counts 10 and 11  - Criminal Contempt, have unspecified potential penalties.

What's Happened Since?

Lots and lots of lawyering. . . behold the process of a Fair and Speedy Trial!!!!

• 04AUG2011 - the indictment was unsealed
• 04AUG2011 - notice of related cases was received.  These included:

1. the case of Facebook v. Sanford Wallace, Adam Arzoomanian, Scott Shaw, and John Does 1 through 25, for Violation of the CAN-SPAM ACT, violation of the Computer Fraud and Abuse Act, Violation of the California Business Code Section 229489 AKA the California Anti-Phishing Act, and Violation of California Penal Code section 502, the California Comprehensive Data Access and Fraud Act.  That case describes:  "At least one of the Defendants, Sanford (aka "Spamford") Wallace, is a notorious Internet scam artist who has been involved in various illegal spamming and malware activities since the mid 90s.  Indeed, Mr. Wallace has both Federal Trade Commission and civil judgements against him for these activities that total in excell of $235 million."  Myspace, Inc. v. Wallace; FTC v. Seismic Entertainment Prod., Inc; CompuServe v. CyberPromotions, Inc (Ohio, 1997)
2. This case resulted in a Default Judgement in favor of Facebook signed by Judge Jeremy Fogel on 29OCT2009. 

• 22AUG2011 - bail hearing
• 28SEP2011 - case reassigned to a new Judge (Judge D. Lowell Jensen)
• 30SEP2011 - Order to Waive Appearance proposed )amd gramted_
• 03OCT2011 - Status hearing held
• 04OCT2011 - case reassigned to Judge Edward J. Davila
• 31OCT2011 - Pretrial services form 8 submitted.
• 28NOV2011 - Status hearing held
• 09JAN2012 - "Fair and Speedy Trial Act" exemption requested due to AUSA Attorney being engaged in another trial, and for additional time for the defendant's need for effective preparation of counsel. "The ends of justice served by granting the requested continuance outweight the best interest of the public and the defendant in a speedy trial." - extension granted until 09APR2012.
• 02APR2012 - extended to 07MAY2012 by mutual consent.
• and again to 06AUG2012, and again to 01OCT2012, and again to 19NOV2012
• Status hearings held 14JAN2013, 11MAR2013
• 11MAR2013 - hearing grants a modification to pretrial release conditions to allow Spamford to travel to Albuquerque, New Mexico for work.
•  More delays 31MAY2013, 08AUG2013, 20SEP2013, in each case ordering that time be "excluded" from consideration in the Fair and Speedy Trial Act to allow for effective preparation for the case.
• 02NOV2013 - Sanford's attorney (K.C. Maxwell) files a sealed document asking to be relieved from the case 09DEC2013.
• Extension granted to 03FEB2014
• 17MAR2014 set as the date to hear the Motion to Withdraw as Counsel.
• Continued to 31MAR2014, when Wallace assigns his new counsel, William W. Burns, Esquire.
• 25JUN2014 new counsel asks for more time to prepare
• 18JUL2014 William Burns petitions the court to withdraw as counsel
• 21JUL2014 Burns Relieved
• 21JUL2014 a Financial affidavit is delivered to the court pertaining to Spamford Wallace
• 01AUG2014 - "The individual named above as defendant, having testified under oaht or having otherwise satisfied this court that he or she (1) is financially unable to employ counsel and (2) does not wish to waive counsel, and because the interests of justice so require, the Court finds that the defendant is indigent, therefore, IT IS ORDERED that the attorney whose name, address and telephone number are listed below is appointed to represent the above defendant." (Wm. Michael Whelan, Jr. / 95 South Market St, Ste 300 / San Jose, CA 95113 / (650) 319-5554 cell)
• 19AUG2014 - time extended to allow Whelan to prepare
• 22SEP2014 Status conference held, Jury Trial date set for 05MAY2015 through 22MAY2015.
• 29SEP2014 Whelan petitions the court that drug testing no longer be required since Sanford has never tested positive. (Granted 15OCT2014)
• 02MAR2015, status hearing extends case until an 08JUN2015 status hearing
• 12JUN2015 - new financial affidavit entered under seal
• 30JUN2015 - a change of plea hearing is requested for 27JUL2015
• 24AUG2015 - Sanford Wallace pleas guilty to a single count - Count 3.  Sentencing scheduled for 07DEC2015 at 1:30 PM

Guilty of Count Three

So, if we go back to the indictment, what does this mean that Sanford has plead guilty to?

---

COUNT THREE: (18 U.S.C.  §§1037(a)(1) and (b)(2)(A) - Fraud and Related Activity in Connection with Electronic Mail.

22. The factual allegations contained in Paragraphs One through Eleven above are realleged and incorporated herein as if set forth in full.

23.  On or about December 28, 2008, in the Northern of California and elsewhere, the defendant, SANFORD WALLACE, knowingly accessed a protected computer without authorization, and intentionally initiated the transmission of multiple commercial electronic mail messages from or through such computer, in and affecting interstate and foreign commerce, to wit: the defendant accessed Facebook's computer network in order to initate the transmission of program that resulted in nearly 300,000 spam messages being sent to Facebook users.



What were 1 through 11?  The only really important paragraph is number 5:

5. From approximately November 2008 through March 2009, WALLACE developed and executed a scheme to send spam messages to Facebook users that compromised approximately 500,000 legitimate Facebook accounts, and resulted in over 27 million spam messages being sent through Facebook's servers.)

Darkode guilty pleas: Phastman, Loki, & Strife

So far there have been three guilty pleas related to the Darkode hacking forum.  Although the case, which used the name "Operation Shrouded Horizon" resulted in 70 arrests worldwide, only twelve individuals have been indicted so far by the Department of Justice, and several of those individuals are overseas.  When the site was taken over, it displayed this graphic, showing the many foreign law enforcement agencies that cooperated with the takedown and the arrests.

Johan Gudmunds / Mafi

Image from ArrestTracker

The main administrator of Darkode is Johan Anders Gudmunds.  Gudmunds used three hacker aliases: Mafi, Crim, and Synthet!c.  According to DOJ, he resides in Sweden.   According to the indictment "From around September 2008 until about January 23, 2015" Gudmuns "knowingly and willfully did aid and abet and conspire, combine, confederate and agree together with other persons" ... "to commit offenses against the United States" including:

• intentionally accessing a computer without authorization and exceeding authorized access to a protected computer, committing the offense for purposes of commercial advantage and private financial gain in furtherance of a criminal and tortious act in violation of the Constituion and the laws of the United States to obtain a thing of value exceeding $5,000 -- 18 USC Sections 1030(a)(2)(C) and (c)(2)(B)(i)-(iii).
• knowingly and with intent to defraud accessed a protected computer and by means of such conduct intended to commit fraud or obtain something of value -- 18 USC Section 1030(a)(4) and (c)(3)(A)
• knowingly caused the transmission of a program, information, code, and commands that as a result of such conduct intentionally caused damage affecting 10 or more protected computers during a 1-year period -- 18 USC Sections 1030(a)(5)(A) and (c)(4)(B).
• knowingly and with intent to defraud trafficked in passwords and similar information through which a computer may be accessed without authorization affecting interstate and foreign commerce -- 18 USC Sections 1030(a)(6)(A) and (c)(2)(A).

Gudmunds wrote a botnet called "Blazebot" that compromised computers that he later sold access to. His price for access was $80 per 1,000 compromised machines, or 8 cents per computer.  Yes, that is how much your PC is worth!  Gudmunds also sold root access on computers at universities in Europe for $50 per server, and to at least 200 other servers for between $10 and $50.  The Zeus malware that he controlled logged more than 200,000,000 credential thefts from 60,000 compromised computers that made up his botnet.  (This would include many repeated credentials, obviously.)  Gudmunds also wrote an Exploit Kit called "CrimePack" that he sold on his forum, as well as an MSN Messenger spreader.  He was still authoring and selling code much more recently, including his package called "Pandemiya 2014"

Some of Gudmunds online ids included the jabber account "mafioso@xmpp.jb" and the email account "mafi@thesecure.biz".  He began using the Synthet!c alias in January 2012.

Daniel Placek / Loki

According to the Gudmunds indictment, the original Darkode.com forum was created by "Iserdo" and "nocen / Loki".  We know from the charges against Daniel Placek of Glendale, Wisconsin, that he was the one who used the aliases Nocen, Loki, Juggernaut, and M1rro0r.

Loki's charges say that "in or about June 2008, Daniel Placek and Martjaz Skorjanc (AKA Iserdo)  created the Internet forum with the domain darkode.com with the intention of bringing together computer hackers and other criminals to facilitate the production and sharing of malicious software, and later led to forum discussion about the creation and dissemination of botnets and the sending of spam."   Placek was an administrator on the forum, and in January 5, 2010, agreed to sell malware that he designed for harvesting network traffic for email addresses and passwords to a user named Dethan.78 for $500.  Dehtan.78 was an FBI agent.  Oops!

When Placek's computer was raided, all the way back in 2010, it was found to contain 74,190 credit card numbers and 297 bank account numbers.  In his guilty plea on July 31, 2015, Placek agreed to plea to one charge in exchange for prosecutors agreeing to seek a sentence of "six to twelve months".  This agreement carefully considered the fact that Placek has provided full cooperation regarding law enforcement queries and access to Darkode FOR MORE THAN FIVE YEARS!

From all reports, Placek has left his black hat ways behind him and has not participated in crime since his 2010 activities.   He has been working as a network engineer for a company named Swick Technologies, and neither law enforcement nor his employer has had any reason to doubt that he is reformed.  (More from this article:  Placek to plead guilty for role in creating Darkode hacker marketplace  )

Eric Croker AKA Phastman

Eric L. Crocker, a 39-year old resident of New York, (some sources say 29) was the first to plea guilty from the charges that came out of the Darkode forum seizure.  His primary plea is that he violated the CAN-SPAM ACT.  Phastman's primary activity that he is charged with is the creation of a hacking tool called the Facebook Spreader.  Although he is only directly charged for breaking into "at least 77,000 computers" and his indictment indicates he sold access to computers his botnets controlled for $200 to $300 per 10,000 (2 to 3 cents per machine) some news sources are reporting that his hacking earned Crocker "upwards of $21 Million." 

Phillip Fleitz, AKA Strife

Phillip Fleitz photo from ArrestTracker

 Phillip Fleitz was the most recent person to plead guilty on the Darkode case.  Fleitz is named along with two others in an indictment from the Western District of Pennsylvania.  The three were:

• Naveed Ahmed (AKA "Nav" AKA "Semaph0re")
• Phillip R. Fleitz (AKA "Strife")
• Dewayne Watts (AKA "m3t4lh34d" AKA "metal"

The conspiracy that these three are charged with involves leasing at least two "bullet-proof hosting" servers in China that were used to scan Internet-connected routers to identify places that would allow them to use those routers as Proxies to reroute commercial email messages to hide their true source.  The spam that was sent was primarily using "email-to-SMS gateways" so that the emails sent would show up as text messages on cell phones of the recipients.  The spam was primarily "gift card scams" with the indictment giving the particular example of Best Buy Gift Card spam.  A couple examples include:

• "Congratulations, your 4th place code is H7G0 - BestBuyVouchers.com"
• "Congratulations! You've finished Fifth!  Your code is: WM154 - FreeBestBuyCards.net"
• "Your entry placed 8 out of 10!  Claim the prize with this Code: U0V2 - BBCodeTexts.net"

Still to Come

The people who are still named by the Department of Justice, but have not yet plead guilty are:

•     Johan Anders Gudmunds - see above
•     Morgan C Culbertson - the "FireEye Intern" / Carnegie Mellon student
•     Naveed Ahmed -
•     Dewayne Watts - M3t4lh34d / metal
•     Murtaza Saifuddin
•     Matjaz Skorjanc - rzor from Pakistan
•     Florencio Carro Ruiz - NetK, Netkairo from Spain
•     Mentor Leniqi - Iceman from Slovenia
•     Rory Stephen Guidry - selling botnets, k@exploit.im

 Of those, the only individual who has received much US-based press was Morgan, who is the author of a Remote Administration Trojan known as Dendroid.            

If any more guilty pleas come through, we'll try to update this page!

By the way, much praise to a site I was not previously familiar with called "Arrest Tracker" from the people that run CyberWarNews.info.  His page "Mass Arrest #24"  here has a great summary of what's going on with Darkode, but I know many of my readers will be interested in regularly following the regular updates from his page!