Who's behind the SWAT USA reshipping service?
krebsonsecurity.com
krebsonsecurity.com
> SWAT agreed to transfer the business in exchange for 30 percent of the net profit over the ensuing six months.
Good to know M&A deals happen in the illegal industries too :)
In the legal world, if someone reneges on the terms of their deal, you take them to court. I wonder how that gets settled in the illegal world...You send a hoodlum to beat them up?
— Goodfellas (1990)
When they got a chance to interview Scorsese about it, his response was "I made it up" :)
That, or some form of it, has traditionally been the method. Its only slightly different from the "legal" world, where you take them to court, and the court sends some one (the police) to enforce the courts decisions. Just in that case you have an (hopefully independent) third party to go through. Some more sophisticated criminal organizations actually have similar arbitration processes.
They might do anything from threaten you, blackmail, cyber sabotage, or worse, all the way up to literal murder. If I was a scammer, I'd probably focus on regular people over illegal entities, as the regular people probably have much more limited options for recourse.
Illegal businesses also probably have some decent experience in using escrow or other methods (above) of making sure illicit contracts are properly filled.
In other cases though they might just accept a loss as a form of shrinkage, like if an individual drop shipper didn't end up reshipping packages purchased with stolen credit cards. If you're doing your crime entirely online it might be easier to just let certain things go than to try and chase down the offender.
It's relatively simple to use random credentials everywhere and to completely disconnect your hacker persona from RL.
Or is it that we only hear about those that do this...
For the first decade of their career they're really only facing people who will bust them if they're totally stupid and deliver themselves to the authorities practically gift wrapped. Because the flip side of most criminals being lazy is that most police are lazy. But then after a decade they wind up with someone at least mildly competent getting interested in them and they've left traces all over the place.
You only defend the ones who get caught! By definition you never defend one who hasn’t been caught doing something suspicious.
2. Proper security takes time and effort, so there is less time to devote to actual business, which means they are less likely to be successful at a scale that makes them widely known
1. We've entered the full on "Oh shit, you don't need to be a hacker to do computer crime" phase of computer crime. Smash and grabs, just pay some disgruntled employee for their credentials, hire people to do the tech bits you need done - you don't have to be a 1337 hacker to get involved with this stuff. So they may not care or even be aware of much forum opsec.
2. Does Russia care about Russians ripping off other countries? How hard do you have to try to hide it if you just dump the username and move on when you're found out because there's not any repercussions from local law? I don't think anybody is going to go to Russia and get them any time soon.
If they're already infamous, it's too late for them. This dude seems to have been a real amateur; he not only re-uses passwords, he re-uses usernames in his passwords. He puts his birthdate in a password. He doesn't have a clue. He seems to be a low-grade criminal who should have stuck to fencing stolen goods from a lockup garage, but stepped out of his league.
I imagine that date is in a lot of Russian passwords. That was the day of the '91 coup attempt against Gorbachev.
What Krebs is suspiciously silent about is who provided (il)legal protection for the service. I guess this type of dirt on Russian officials is collected to a different folder inaccessible without clearance. Hence the framing of the lone Robin Hood story.
Maybe, and I stress maybe, he might be the kind of guy that his government gives up in a deal for some other benefit. But that both, wouldn’t happen just because he was identified, and he’s unlikely to be someone the US would care about in a realpolitik deal given how small and obscure this scam was
This picture of Magnitogorsk has always stuck with me:
https://www.reddit.com/r/UrbanHell/comments/hs0phj/magnitogo...
Pics for reference:
Barcelona: https://toposmagazine.com/wp-content/uploads/2022/05/logan-a...
Magnitogorsk: https://www.shutterstock.com/shutterstock/photos/751528006/d...
This was built as a public trans city so the narrow streets are for buses and trams. The apartment complexes aren't big blocky buildings like in say Manhattan, but L shaped to allow a large shady green area and to maximize natural light for all residents. Its full of green between the buildings and quite charming looking and walkable, especially considering some of those buildings are mixed use and allow for business as well:
https://www.shutterstock.com/image-photo/magnitogorsk-russia...
The Soviets got so much right, its such a shame the car-centric suburban sprawl model won out in the West and percolated its way to Russia and parts of the East after the fall of the SU.
You get a chance to open windows on multiple sides to get actual airflow.
And more sun.
I think you are right, and I think the city looks cool, but it also seems to have an environment that could be described as oppressive (and in this image... cold)
I see others talking about Barcelona and I agree -- Barcelona looks similar. I assume less cold on average though.
> Magnitogorsk was to become a one-industry town modeled after two of the most advanced steel-producing cities in the United States at that time: Gary, Indiana, and Pittsburgh, Pennsylvania.
100 year old industry processes usually can't be easily updated to cleaner ones. Especially if no one has actually bothered to fix anything.
> Magnitogorsk was mentioned in the Blacksmith Institute's 2007 survey of the world's worst polluted cities, placed in the report's unranked list of the 25 most-polluted places outside the top ten.
It has only left the list of 20 most polluted Russian cities 5 years ago, when official pressure to do better started (and “better than before” is not “great”). Reportedly, one third of emissions was cut, which leaves the other two thirds.
Buildings from '30s and '50s are great if they have been well kept, which is rare because of lackluster approach in the late decades of Soviet era, and economic turmoil afterwards. Otherwise they can get quite nasty. Other option is major renovation, but developers are not interested in keeping low rise blocks (if they can't erect a 20 storey building at the same place). Local videos like this are easy to find: https://www.youtube.com/watch?v=9d39wq7x9uk
What's more important, Russia is extremely centralized. There is not a lot one can do Most people with money, ambitions, or desires move to Moscow. Second option is St. Petersburg, third one is a small number of other big cities. Exactly that seemed to happen here.
In more recent years, I’ve become convinced that some of the current MLMs (especially the crypto variety) are fronts for something shadier, and/or are pure scams using the MLM format to court the crowd that’s already into that stuff. Increasingly they can’t really explain what the actual product is, and it’s clear that they’re just greed/desperation traps.
It's why so many spam campaigns are completely broken (no link, nothing to even possibly send anyone any money) because the money was made when the spam gun was sold to someone, and they have no idea how to use it.
Are you nuts? Are you trying to kill us all? Or.. are you one of Them?
I report them every time, and report the account that posts them, but Facebook seems unwilling to remove the scammers.
If he got it wrong, he'd be facing a lawsuit. He's also incentivized to retract and apologize in that case to preserve his credibility as a journalist. Very different story than an unaccountable anonymous troll with a grudge on Twitter/Reddit/4chan.
Do you see that is likely to ever happen?
Just so we are on the same page. Here we "can't get a conviction" because the person resides in a country which doesn't care about the crime he committed. Not because the evidence does not pass the required evidentiary level.
> don't have the right to ruin a life.
Please explain to him how a life is ruined here?
> Any deviation from this principle leads to mob rule.
Where a mob is a single high profile individual with his reputation on the line, and this singular "mob" performed a through analysis and provides the full reasoning how he come to the conclusion. This "mob" rule does not look like the ones I usually hear about.
Most things in life are, thankfully.
I don't want to become the subject of a New York Times expose, either, but that's no reason to ban journalism.
I feel I have a right to make my decisions based on such information also.
That doesn't mean the publisher shouldn't have liability here also. They are damaging someone's reputation, and should be held responsible if the claims are untrue.
But if the claims are true, then the damaged reputation is warranted. That's one of the consequences of doing something bad. You only have a right to have a good reputation if you don't do anything bad.
It’s realpolitik. It’s ok for Russians to steal from Americans, and likewise it’s ok for Americans to dox Russian criminals. There is no international law here, and even if there is it cannot be enforced and no one cares about. There might some moral high ground, but morals usually stay away from politics.
Ask Fox News that one, I hear they are a little over 700 million short from that stunt.
It’s just that most people don’t feel a need to protect criminals.
The same reason why it’s considered acceptable to out the folks that participated in the watergate scandal, but not ok to out a confidential informant.
Even if not charged with a crime, if you do something shitty-but-legal and someone gets a video of it, you're not going to get control over that viral video.
And even if you luck out and don't get "doxed" as part of the arrest, you will be outed as soon as your formally charged.
So, no, at least in the US, privacy is not retained until conviction.
Not in the US. I can pull out my local newspaper right now and see a list of everyone who was arrested last week; long before they will be convicted of anything if they're convicted at all. For a lot of them they probably won't even be accused of anything because the other party won't press charges.
Journalists naming people as part of their work is a third category, and probably the one this falls under. It's dangerous territory, and Krebs stands to lose a lot (i.e. credibility, lawsuits, possible reprisals) by making this allegation if it turns out he didn't do his job right.
Krebs doing his homework to reveal ringleaders of a criminal enterprise and showing how he got there is firmly in the "investigative journalism" category.
Obviously, there are unfortunate cases where some (often young and inexperienced) journalists shoot first and ask questions later, which can lead to harm, but Krebs has clearly kept the receipts here.
Previously: https://itwire.com/business-it-news/security/infosec-researc...
Also the coinhive situation where he doxxed imageboard admins due to the coinhive connection of the previous owner.
Funny story. In German „Krebs“ means cancer. And when he revealed the names and Adresses of Admins of a German Imageboard, the community started a fundraiser for cancer treatment named „Krebs ist scheiße“ or in English „cancer sucks“
It also means plain old "crab".
In most places, doxxing is not illegal. In the places where it is illegal it's usually only when there's stalking/harassment intent behind it. Doesn't appear to be against the HN rules either.
Is this conversation about a journalist not an opportunity to remind us Voltaire said “I may not agree with what you have to say, but I will defend to the death your right to say it.”
At the end of the day "maximal" isn't near as far in the max directory as people reading the statement expect.
That's mostly it. Buying merchandise from US websites that either don't ship international at all, or put increased scrutiny on purchases with us-payment-method + overseas-shipment.
And mostly to be able to convert stolen credit card numbers into physical goods. The US still does most purchases with just CC# + billing zip code + CVV2 number.
There are also legit freight forwarders, but they often also have a fair amount of customers (not most, but some) that use them for this same purpose.
However, these services are real businesses with permits operating out of warehouses with actual staff - not a network of people recruited from Craigslist to operate out of their houses.
If something is eg 100eur cheaper in germany than here, I'd use (and did use a couple of times) one of the reshipping companies, that take the package I ordered and for a fee, ship it to my country.
Same for US, a lot of stores don't ship outside of US, some due to not wanting to deal with that, some due to more practical reasons (wrong electric plug, etc., don't want to deal with customers complaining), and well.. use a reshipper for that too.
Now the shipping part is problematic, as it can be automatically flagged, is traceable. So goods are first shipped to residential addresses that don’t raise fraud alarm, then reshipped to destination country
Russian Reshipping Service ‘SWAT USA Drop’ Exposed:
https://krebsonsecurity.com/2023/11/russian-reshipping-servi...
Most online retailers grew wise to these scams years ago and stopped shipping to regions of the world most frequently associated with credit card fraud, including Eastern Europe, North Africa, and Russia.
The article gives a way more in depth view of how the reshipping scam works.
Nina Kollars - Confessions of an Nespresso Money Mule - DEF CON 27 Conference
https://www.youtube.com/watch?v=2IT2oAzTcvU
Essentially, they wait for a buyer of a product to come along to a listing and order it - they'll then buy it using stolen credentials, have it drop-shipped or reshipped to the end user.
Everyone but the person with the original card comes out ahead, which is then pushed to all of us via higher fees if they notice and report the fraud.
Your business is buying stuff with a stolen credit card, and selling it to punters.
You don't tell the merchant to send it to you, at your home address; you might get picked up! You hire someone you don't know (and who can't identify you) to take delivery of the goods at their address, and ship it on to the punters. When you're reshipper gets picked up, they can't give you away.
You don't have to be located in Russia for this to be useful; US citizens doing CC fraud have exactly the same incentive to use a reshipper, even when both the punter and the reshipper are also US citizens. Krebs seems to focus on Russians, possibly because he has his foot in the door of a number of online Russian crime communities.
I'm sure the Russians DGAF as long as the locals are getting their bribes, now if this guy ever leaves Russia he might get nabbed by an Interpol warrant.
If money transfer between those areas is complicated, what can you do? You can buy expensive goods with local cards from local backdoored computers, and ship them to local addresses. Then they can be transferred to be sold on the other side. Extra money you spend on that are not yours anyway.
I'm no expert, but something tells me that deliberately not paying low level mules is a sign of: a) the scheme being near its end (sooner or later the audience would spread the word that “those guys never pay”, and new mules would be hard to find), or b) driving the competitors with low recruitment abilities out of the market. Maybe this leak is really a sign of some quarrel underground.
> The third era that influenced Russian thought in a great manner is Mongol Russia. In the 1240s, the Mongols conquered Russia. They held Russia for 150 years. That time was cruel. There are a lot of words in Russian, related to torture, taxation and corruption, that come from the Mongol language. Dominance under personal authority was rooted in the administrative culture from the Mongols. That is, there is only one khan that leads. It is he who leads, no one else. Others are passive followers. That one guy leads and takes responsibility and the initiative. When the belief of divine legitimacy to lead is attached to this, the leader will appear as fairly tough in their world view.
> The corruption and cruelty also comes from the Mongol era. During the Mongol rule the only ways to survive were lying, corruption and violence. This still lives very deep in Russia’s strategic culture. When Mongol rule ended, the Mongols did not just pack their bags and disappear from Russia. Instead they mixed with the locals. So the traditions also stayed with the people. In particular, to the leading caste. The Mongols who had previously ruled the country merged into the ruling layers, which is still visible today.
One thing to note about Russia is it is not defensible in standard sense of it's hard to cross this river or mountain. This lead to Russia making distance it's defense. You go and capture a bunch of different peoples with no relations to each other and use them as a meat shield if anyone attacks. Meanwhile you want for the harsh winter to wear them out. But this also comes as a cost, you cannot allow any of these outlying territories to gain too much power or they could become a threat to Moscow, hence you tend to see a massive amount of Russia under developed and depopulated.
The problem is, assumed “corruption and cruelty” could only be mostly local. Mongols came, instituted all fashions of levies, grant themselves the authority to accept local rulers, and went back. They didn't help to defend their vassals from foreign armies, but they chose their side in inter-principality campaigns, ensuring that the winner is under their control.
Funnily enough, this critical view matches the view of nationalistic thinkers of old who firmly placed the stereotype of “200 years of Mongol yoke” and widespread desolation into the education curriculum. There are doubts that is was that bad, especially for the elites that served Mongols well (and therefore made their regions actual parts of Mongol empire, which is an unthinkable perspective to nationalists describing them as “independent” and spiritually “unconquered”) However, in the era of the tsars it was used to explain how Russia is a “real” European country with unfortunate fate, and why its tsars are equal peers to European kings, and now it is used to explain how it totally isn't. The catch-all stereotype of despotic Oriental rule is quite clear here.
Culture is very difficult to define, which makes it compatible with any claims - every listener perceive different meanings that make sense to us, so we can agree while meaning different things. Also, we have nothing specific to test. For example, if someone said crime is prevelent in Russia's economy, we might have data on the size of the black market, and data and information on how other factors generally affect black market size (such as, as a guess, authoritarian government, oligarchy, and of course poor delivery of goods and services by government and market).
Also, such claims are almost always made by outsiders, who know least about the 'culture' and at the same time are prone, being humans, to make broad, powerful claims about extremes in 'the other', who are slightly alien and thus might do anything.
Edit: I'm very familiar with the stereotype of Russian hackers, but stereotypes are very misleading. There are Russian government disinformation campaigns, where we do have specific claims and lots of evidence, but that seems like a different issue.
As an anecdote about russian culture, a russian coworker once told me how amused a shopkeeper was back in russia when he asked them if they could please give him something. Where in russia it is typically not done (and its not at all rude to simply instruct a shopkeeper to give you something without please or thank yous, and certainly not asking someone if they can do something but just telling them to do it). The shopkeeper thought it was endlessly funny to just say no, as though it was an earnest request. Living in the UK had changed how my coworker spoke even in their native language.
Sure some may regard these as aspects of language still, but imo the fact that it affected how my coworker spoke even in their native language perhaps shows its more a cultural thing.
Now I WOULD be very wary of making cultural arguments as relates to crime. Imo its only really appropriate for analysing individual interaction.
That depends on how we define culture - some ways it's defined in people's minds don't really exist, some do. Also, to the extent something called 'culture' exists, we also can say that alien lifeforms exist, but that doesn't mean we know anything about them.
I'd ask, 'how are you defining it', but that seems unfair on HN: Answers are far too long and complex to explore here - I'm certainly not trying! :)
> russian culture
That seems like two words for an incredibly large, diverse, complex collection of - of what? how is that part of the sentence accurately written?
> an anecdote
I think this story supports my point about our reasoning about culture. We infer about all of Russia and its 'culture' (whatever that is), based on a second-hand anecdote.
Of course, social customs depend somewhat on time, place, participants, and many other factors (language, participants' ages, recent events (don't be too cheerful after a tragedy), etc. etc.) and we have an instinct that helps us grasp what will fit in any moment. But that is a very complex, undefined thing.
It doesn’t take much to observe that Russian culture is largely accepting of bullying, dog-eat-dog mentality, and cheating to get ahead…Putin and the leadership is a reflection of that.
I live in a country known for cybercrime of a different kind (Nigeria) and will never deny that culture plays a part. Our local culture is largely accepting of corruption and cheating to get ahead, which is one of the reasons many engage in crime.
Don’t get me wrong…I’ve worked with and continue to work with some wonderful Russians. But, it doesn’t change the fact that the culture needs reforms for the good of the country.
Of course, I’m not in support of profiling. I’ll never like to be profiled as a cyber criminal because I’m from Nigeria, but I’ll never deny that our culture has a big issue with rationalizing corruption and theft and needs reform to make us better-behaved.
What about Trump and Biden in America? Point is, leaders don't often represent their people in toto, unless you count id as being the sum total of culture.
Trump represents a large part of Americans and so does Biden.
Democratic leaders are a representation of a significant percentage of their people. If you see an awful elected leader, then there's an awful large population that voted them in.
In a country with 166 million registered voters [1] and over 90% of them voting for one of these two. Yeah, they represent a big part of the population.
Similarly, in Nigeria, Buhari represented the region with the biggest population, which is also the dumbest, most illiterate, poorest, and most corrupt. Not surprising their man was a dunce too.
1- https://www.statista.com/statistics/273743/number-of-registe...
Your only argument is to make up disparagement of people who disagree.
True. The problem with insiders judging the culture is that they might be blind to it. But it’s best to not get caught up in narratives about “culture” and other such idealistic things.
> Edit: I'm very familiar with the stereotype of Russian hackers, but stereotypes are very misleading. There are Russian government disinformation campaigns, where we do have specific claims and lots of evidence, but that seems like a different issue.
There was a very strong interest in Russian government disinformation campaigns because Hillary Clinton lost the 2016 election. And I don’t doubt that there is evidence of election interference. But the amount of money that was behind that seems like a pittance considering the big election advertisement industry.[1]
None should be surprised that you will find shady and underhanded things done by the more clandestine arms of some government. But we should be wary of people using that well-of-course-they-are as an outsized scapegoat to explain a big event like a federal election.
[1] Are run of the mill smear campaigns to be classified as “disinformation” or just regular ads?
The cost to black women to get their hair done is generally more than any other group.
Almost all black women (and probably black men) have had to develop some coping mechanism for the number of non-black people who want (or at times, demand) to touch their hair.
Digression-- I remember a black doctor who had a coping mechanism for the number of patients who assumed he was the nurse and asked him where the doctor was. He would spin 360-degrees and then present himself to the patient again. :)
As for the sibling comment-- my first three sentences are falsifiable.
Edit: clarification
My "coping mechanism" for the time before I just shaved it too short to matter was to simply say, "OK, go ahead." It's not a big deal and I don't have a problem with a natural curiosity.
[edit] Asking is fine, "demanding" I would have a serious problem with.
For example, there is a fairly widespread / rampant "cheating/copying/don't-bother-learning" culture in a lot of schools in India, especially as it relates to software development. I've seen it brought up and stated as truth by people from that region over and over. There are also many VERY smart, skilled, devoted software developers from that are. I've worked with quite a few. However, because there _is_ that culture, the "noise" (bad developers) to signal (good developers) ratio is really high. And, when dealing with developers from that area (especially, from my experience, those at various contract/churn companies), you need to be careful about the work they're doing. You need to check to see it's being done well ... at least until you're familiar enough with the people/team that you can trust them.
Culture _has_ an impact; but that doesn't mean it should be assumed... just that it may mean you need to pay more attention.
Neoslavery https://www.youtube.com/watch?v=j4kI2h3iotA
Now, turning this back to Russia, is seemingly Russia has always had the idea that it's outer population is a gigantic meat shield to protect Moscow. There are a number of authors and videos on this topic and I'm not going to link any particular ones. This said in the current war with Ukraine we see this in practice, as huge amount of the soldiers being used are not from the Moscow area, but the more minority areas farther away from the capital.
tl;dr: Sowell contends that the "black ghetto culture", characterized by violence, a lack of ambition, a dismissive attitude toward education, and a casual approach to work, is not inherent to African-Americans. Instead, he argues that it is a cultural relic of white southern 'Redneck' or 'Cracker' culture, which was brought to the South by immigrants from the more lawless regions of Britain.
These immigrants, according to Sowell, came from areas that were marked by a resistance to work, a lack of education, a predilection for violence, and a general disregard for the law. These cultural traits, Sowell argues, were absorbed by the African-American population in the South during the era of slavery and have been perpetuated in certain communities to this day.
Sowell probably drew from Albion's Seed by David Hackett Fischer, which argues that US culture arose from four different British subcultures.
Thanks, I never came across this usage before.
https://www.npr.org/sections/codeswitch/2013/07/01/197644761...
Its not even that I disagree per se. I simply would love to know more about how this thinking evolves within our allies (presumably, Finland is considered an ally to the US)
That would be a very interesting lecture. If anyone has something like this, send the link my way!
Finland only joined NATO in 2023; before then it was explicitly neutral. During the Cold War, East and West discreetly (and sometimes not so discreetly) fought for Finland's allegiance but, generally speaking, the Soviet Union had great influence over its foreign policy (cf. finlanization) while the West had great influence over its culture and economy.
This also has some context in the Finnish culture, especially in the military, having quite a fearful and resentful view of Russia due to the wars during WW2, involvement in the civil war during WW1 and an oppressive era when Finland was a part of the tsarist empire.
This is not meant as an apology for anything that Russia's regime is doing and how it is.