DarkMarket_ Cyberthieves, Cybercops and You - Misha Glenny [47]
To underline his superiority, he first created a false digital trail, which made it appear as though the CardersMarket server was located in Iran, way out of reach of both law enforcement and other carders. In fact, the server was in California, but so great was Iceman’s capacity for subterfuge that he did indeed convince everybody that the site was based in Iran. Naturally this added to the rumour mill: was Iceman an agent of Iranian intelligence, charged with sowing confusion among US law enforcement and raising funds for its covert operations?
Whoever he was, it was clear that he meant business. One after another, he successfully hacked the rival carding sites, hoovering up their databases, which included all the email addresses and passwords of the members, along with a record of all postings ever made. He then integrated all this information into CardersMarket before deleting the records on the original site.
His attacks were relentless – even the Russians were not spared his wrath. He had the temerity to hack mazafaka.ru, the iconic site that had replaced CarderPlanet in the affections of Russian hackers. But although his ego sometimes clouded his judgement, he knew perfectly well that destroying the Russian sites in the way he had the English ones would have been most unwise. The Russians included some of the most brilliant hackers in the world, and Iceman had no wish to provoke them. Furthermore, following the Shadowcrew takedown, the Russians had promptly left the carding party. That is to say, they departed – more or less en masse – from the English-speaking boards. The Babylonian exchange of criminals, informers, spies and police officers on the anglophone websites was becoming irritating and oppressive: it was getting in the way of business. The risk they ran was negligible, provided they kept away from countries where American law enforcement could act.
And so Russian hackers established a series of boards that were exclusively or predominantly Russian-speaking, including mazafaka.ru. US law enforcement found these much harder to infiltrate, while cooperation with the Russian police or the more influential KGB proved extremely difficult. The first line of defence of criminal hackers in Russia or Ukraine is always the ever-changing local slang. While some Western police officers could hold a conversation in Russian, it was much harder to keep up with the dynamic shifts in the language attached to a popular culture with which few in Washington or London could keep pace.
While the Russian sites rumbled along happily, by the summer of 2006 Iceman had killed off almost all English-language opponents. And when he noticed any of them attempting to resurrect themselves, he would launch a devastating Distributed Denial of Service (DDoS) attack.
DDoS attacks had emerged as the most common weapon in cyberspace. They were the work of so-called botnets, the cyber equivalent of the 1950s Hollywood classic, Invasion of the Body Snatchers. A virus ‘captures’ a computer, which then falls under the influence of a so-called Command and Control Server. The virus would infect thousands of computers in this way, which were referred to thereafter as zombies, enjoying the status of drones that carry out the bidding of the mighty C-and-C Server. To most intents and purposes, they continued to function as normal computers. An ordinary user would be unaware that his other machine was now a soldier in a vast Army of the Digital Dead. If an especially active zombie, the innocent victim might have noticed his or her computer running a little slowly, usually because it was being overworked to assist unseen in the distribution of billions of spam emails, either advertising penis enlargements and Vicodin or containing a new copy of the virus that could infect still more computers.
But often botnets are instructed instead to mount DDoS attacks whereby the zombies are all ordered to access a specific website at the same