A hacker story

Date: April 25, 2005
Source: CIO Asia
By: Art Jahnke

Hacker Alexey Ivanov was lured to the United States and snared in a high-stakes cyber-sting. The FBI says he got what he deserved. But Ivanov says his gamble paid off. In the end, he got what he wanted all along

ALEXEY IVANOV'S job interview didn't go as well as he'd hoped.

Ivanov, then a 20-year-old computer programmer from Chelyabinsk, Russia, had flown to Seattle in November 2000 to apply for a job with a company called Invita Security. To the young Russian, Invita promised the dream job. The company was clearly entrepreneurial—entrepreneurial enough to seek out the services of this skilled hacker who worked in an abandoned factory halfway around the world. They even promised to pay his airfare and to pick him up at the Seattle airport. At Ivanov's suggestion, the company encouraged him to bring along a fellow programmer, Vasiliy Gorshkov. When the two Russians arrived, their Invita hosts explained what they were looking for: a few good hackers who could break into the networks of potential customers as part of an effort to persuade those companies to hire Invita to keep hackers out. Ivanov was familiar with the tactic.

As Ivanov, Gorshkov and two American business types sat at a table in a Seattle office, Gorshkov regaled the interviewers with tales of his hacking exploits, and Ivanov allowed himself to dream of a better life. He was exhausted: The trip from Chelyabinsk had taken nearly 48 hours, and he had not waited to arrive to start celebrating his good fortune. The interviewers asked their guests to demonstrate some of their skills, and the two Russians took turns logging in to their own network back in Chelyabinsk. Ivanov knew that he and Gorshkov were good, so when his hosts appeared to be impressed, Ivanov was not surprised.

The big surprise would come later, when the two Russians were being driven to their lodgings. The car stopped suddenly; the doors flew open, and Ivanov heard someone say: "FBI. Get out of the car with your hands behind your back."

It was then that he remembered something he had heard about America: It was the kind of place where anything could happen.

Ivanov and Gorshkov were charged with conspiracy, computer fraud, hacking and extortion. Gorshkov was jailed in Seattle, where his incriminating boasting took place. Ivanov was flown east, to Connecticut, to be tried in the home state of the Online Information Bureau—one of several companies whose servers he had breached.

The federal agents who arrested the Russians brandished a short catalogue of cybercrime allegations. They claimed that the Russians had tried to extort money from scores of U.S. companies, including Central National Bank of Waco, Texas; Nara Bank N.A. of Los Angeles; and a Seattle-based ISP called Speakeasy. As it turned out, most of the allegations were right on the money. Ivanov and Gorshkov had, among other things, tapped a database of an estimated 50,000 credit cards, and they were making good use of some of them. Gorshkov would be found guilty of all four crimes, sentenced to three years in jail and ordered to pay US$692,000 in restitution. He has since returned to Russia. Ivanov would eventually admit to hacking into 16 companies. He served three years and eight months in jail and owes more than US$800,000 in restitution.

THE DRAMA OF the Seattle sting is the stuff of suspense novels, but the courtroom machinations will more likely appear in law school lectures on international search and seizure. Today, with the smoke cleared, the most significant gain from the Ivanov case may be the legal milestones marked when courts upheld the right of federal agents to seize evidence remotely, and to charge foreign cybercriminals in U.S. courts. But despite those rulings, the case also leaves important cyberlaw questions unanswered—particularly in the area of uniform international rules for Internet search and seizure.

The United States of America v. Alexey V. Ivanov was touted as a major success story in the battle to protect American corporations from the menace of foreign hackers. For their work on the case, FBI agents Marty Prewett and Michael Schuler were awarded the Director's Annual Award for Outstanding Criminal Investigations. Still, most computer security experts understand that busting two reckless Russian hackers won't dent the many billions of dollars lost to cyberbandits operating overseas each year. Technology analyst firm IDC estimates that 65 percent of cyberattacks originate overseas; IDC also estimates that in 2003 U.S. corporations spent more than US$25 billion to keep hackers out of their databases.

For Alexey Ivanov, the story of his hacking, his crimes, his arrest and his release from prison ends in a place that he finds perfectly satisfactory. His goal, he says, had long been to come to the United States. And now he is here, living and working in New England. Ivanov says he started his U.S. job search in April 1999. He did it the way any sensible hacker living on the other side of the world would do it. "I went to Dice.com and downloaded a database from a job-seeking server," he says. "It was easy. I wrote some scripts, and in a few hours I was sending my résumé to 5,000 jobs."

Several prospective employers responded to his inquiries, he says, but none was willing to sponsor an unknown job candidate from Russia. "After that I decided to go a little bit the other way," he says. "I thought, Why don't I convince people about my skills, and in order for me to convince them, I have to demonstrate them. This is how I came up with the idea of hacking into companies."

Ivanov had good reason to think that such a tactic would pay off. Two years earlier, in December of 1997, he and a friend had hacked into the servers of a local Internet service provider and downloaded a database of user names and passwords. "When I notified the company," says Ivanov, "they offered me a job."

But that job, he says, paid poorly—only about US$75 a month—and he eventually joined a group of hackers who shared an appreciation for more entrepreneurial challenges. There, at a company called tech.net.ru, Ivanov learned the practice of "carding"—buying goods online with stolen credit cards.

At first, he says, it was books and CDs, ordered online from Amazon.com or Barnesandnoble.com. To avoid suspicion, the group would have the goods mailed to cities in neighboring Kazakhstan, where they would hire young women to receive the packages. Ivanov and others would travel to the distant cities, pick up the goods, and take them to Chelyabinsk. There, much of the merchandise found its way to legitimate shops, where the CDs were prized. The quality of the recordings was far superior to the shops' other CDs, which had been pirated in Bulgaria.

"At first, all of the activities at tech.net.ru were illegal," he says. "Then we came up with the idea that we would look less suspicious if we established some legal business, so we started designing webpages."

They also started hacking into any sites that looked vulnerable. For the Russians, each hack presented a new challenge and, in most cases, a new victory. Some of those victories paid off in cash, and all of them offered the satisfaction of winning. They were beating a system, and they were outsmarting the smartest security guys in the country that considered itself technologically superior to all others. For a hacker, there was nothing better.

PayPal provided the Russians with one of their more satisfying conquests, if not one of the more lucrative. Ivanov claims to have masterminded the PayPal scam. The first step, he says, involved placing scripts on eBay that collected the e-mail addresses of PayPal customers. Then, using the domain name "PayPaI," with an uppercase "I" instead of a lowercase "L," Ivanov set up a mirror site that was a replica of PayPal. Ivanov and his cohorts then sent e-mails to PayPal customers, offering them a gift of US$50, for which they had only to enter their passwords on the bogus site. The scammers simply sat back and collected the password harvest.

"We weren't really malicious," he says. "We could have sent it to thousands of people, but we only sent it to 150. We got about 120 passwords. We did that mainly for fun."

Despite its limited application, the PayPal scam provided proof of concept and emboldened Ivanov and his group to set their sights on a higher prize.

After shopping on eBay for more than a year, the hackers were convinced that the sellers of more expensive items would not deal with unknown buyers living on the other side of the world. And they wanted to buy more expensive items. "We were buying things for a shallow five hundred bucks," says Ivanov. "We wanted to get up to like five thousand bucks."

It so happened that eBay had a function that would help them do that. The site's "rate the buyer" feature could reassure sellers that the Russians were trustworthy. All they had to do was get inside and manipulate the numbers. (Hani Durzy, an eBay spokesman, says that while it may now be possible for hackers to manipulate such interactive features, that won't be the case for long. Durzy says the company is developing technology that will identify the kind of malicious code used in such hacks.)

For Ivanov and his fellow hackers, the summer and fall of 2000 was a time of plenty. A promising revenue stream had begun to flow from their freelance security services. The business model was simple and hardly unique. Ivanov and his cohorts would hack into supposedly secure networks in the United States, inform the network administrators of the hack, and offer to fix the networks' vulnerabilities for...

Page 1 2