Hell is with you

Pirates of the Hot Sea

Until the last byte. Hacking other people's accounts, mailboxes and blogs is an indispensable attribute of network political battles. Who and why takes on the role of virtual bandits and corsairs - The New Times found out

Hacking a political opponent's blog is an effective tool in Internet warfare. In the Russian blogosphere, two, perhaps even three, groups of hackers operate on a permanent basis. Among network hackers there are qualified professionals who hack corporate website protection programs, bank accounts. There is, for example, one anonymous hacker, a former member of the Liberal Democratic Party, who earns his living both by ordinary programming and commercial hacking, and in his spare time, out of “patriotic” motives, likes to break the websites of Estonian and Georgian ministries. However, it is possible that he is a virtual cover for professionals from the secret services.

How to hack?

Not all Internet hackers are computer professionals. What is called, why spend money on expensive escort girls, when there are a lot of amateurs who are ready to get involved in the field of Internet wars. They steal e-mail and break blogs not with programmer methods, but, so to speak, with “social” methods.

This is how many sensational hacks in LiveJournal were carried out: the blogs of the author, head of the Center for Journalism in Extreme Situations Oleg Panfilov, Ekho Moskvy journalists Vladimir Varfolomeev and Ksenia Larina, Izvestia journalist Maxim Sokolov. How do they know the password? The easiest way to do this is on those servers where a verification word is required to receive a new password for your mailbox. As a rule, when setting up an account, people use the simplest - for example, the mother's maiden name or the dog's name. To open the author's e-mail, it was necessary to find out the mother's maiden name, which the hackers obtained, apparently, through the All-Russian genealogical tree. Sokolov indicated the name of his dog as a code word, but the entire Internet knows that the dog of the Izvestia columnist is called Sidor. Having certain connections, it will not be difficult to find out the number of a civil or foreign passport, which many also use both as a code word and simply as a password itself.

Who does it?

Internet hackers, Internet pirates hide behind their nicknames and usually prefer not to advertise who they are in everyday life. But we managed to find out something. A lot is now known about the Kazakhstani burglar under the nickname "Makhno", including the exact address and phone number. His last name is really Makhno, his name is Yuri, he is a programmer, lives in Aktyubinsk. As for the hacker "Hell", he is about 30 years old, he comes from Moscow, has lived in Germany since the second half of the 90s, presumably somewhere in the vicinity of Bonn. After leaving Russia, he worked in Nuremberg as a small clerk in the social service for working with the diaspora and, thanks to this, accumulated a database of immigrants from Russia and other CIS countries. Later, Hell worked for a company that imported building materials from Russia. He took up hacking absolutely by accident - some Internet user was the first to hack into his mailbox, "Hell" was offended and decided to also master this craft.

In the first half of the 2000s, the “Hell Clan” began to form on the Internet, specializing in hacking other people's accounts to order. The group strayed on the “countercultural” websites of the current State Duma deputy — naturally from the United Russia party — Konstantin Rykov (“counterculturalism” is that it is customary to speak there in a language that largely consists of obscenities, insult each other and strangers) . The head of the Hell Clan Internet group is Timofey Shevyakov, a near-Kremlin political strategist, who until recently worked at the Gleb Pavlovsky Effective Policy Foundation, and was recently transferred from there to work in another Internet project of the Vadim Gorshenin publishing house, which is controlled by the deputy head of the administration’s internal policy department President Konstantin Kostin.

The group also includes Oslo-based programmer Mikhail Kovalev, Moscow programmer Mikhail Schwartz, Russian embassy official in China Viktor Sukhotin, St. Petersburg businessman Andrey Kruzhilin, and even ostensibly Interfax news editor Boris Petrov; until recently, the Aktobe programmer Makhno also belonged to it. The roles are distributed: someone receives and extracts orders, others are directly engaged in hacking.

Why do it?

The simplest answer is a way to make money. Fear of the "orange revolution" turned out to be that wonderful "scarecrow", which allowed us to form and cut more than one budget. So you have to convince that one undermines the country's defense capability with his blog, and from liberal blogs - huge harm to Putin, Medvedev, Surkov and the authorities as a whole. Sometimes hacking can be "left" - by order of some commercial structure. Most of the “victims” are critics of the Kremlin, who are being fought with targeted methods: someone loses their nerve, someone can’t stand it and closes their blog, someone prefers to stop criticizing the authorities on the network altogether.

Network pirates are not only hackers. Among them are people who specialize in spam, DDoS attacks on other people's resources, virologists and just plain robbers. What an unprepared user may encounter - Alexander Gostev, head of the Center for Global Research and Analytics at Kaspersky Lab, told The New Times

Recorded by Maxim Karasev

The time of lone virus writers is over. What used to be done by one person is now created using the services that cybercriminal groups provide to each other: one writes a virus, another distributes it, a third collects information stolen with the help of a virus, processes it and gives it to the customer. There are several dozen such complex groups in the world; this is a well-formed cybercriminal ecosystem, which, also due to the crisis, will only expand. These projects are financed by the virus writers themselves, because this is a big market with their own money. For example, the turnover of the spam business last year amounted to $150-200 million, and this is still a very conservative estimate. Spammers are willing to invest significant amounts in new viral technologies through which they then send their spam.

Phishing remains the simplest and cheapest form of cybercrime. ¹ By and large, all that is needed for this is to create a fake bank website and send out letters inviting customers of this bank to follow the link and enter their login, password and credit card number, after which they can freely steal money from it. To do this, "young fisher's tools" are sold on the Internet. In a crisis, everyone is worried about the problem of banks, so any information that “we had a leak, so you need to re-enter your data” will be perceived more nervously, people will be more inclined to believe such frauds. Recently, problems with the cashing of credit funds have become more frequent. Here, too, phishers offer their “services” for withdrawing money from payment systems.

With the help of a virus, you can steal any information. The most commonplace is credit card numbers, online game accounts, your email passwords, your address books and all the email addresses that can be found on your computer, passwords from ICQ and from the sites you visit, social accounts. networks and blogs and much more. And all this stolen information is sold to certain people. Big money can be earned by banal blackmail. You can arrange a DDoS attack ² to any site: for example, from 20,000 infected computers, the site receives so many requests that it is unable to cope, and the site stops working. And the attacker begins to extort money, promising to stop the attack. The income of cybercriminals varies greatly. We monitored one ordinary Moscow spammer: in six months he received orders for $125,000. It is believed that a network of 100,000 infected computers can bring its owner at least $5,000 per week.

_______________

¹ Phishing: from English. password - password and fishing - fishing.

² Distributed Denial of Service is an attack on a web server in order to paralyze its operation.