Books

Beware the Internet Underworld

Cyberthieves and deviant hackers abound in Misha Glenny's grim portrait of organized crime online.

By Tom Sandborn, 24 Nov 2011, TheTyee.ca

Shadowed keyboard

Inside the secret life of your home computer.

Related

  • DarkMarket: Cyberthieves, Cybercops And You
  • Misha Glenny
  • House of Anansi (2011)

Fair warning: Read Misha Glenny's remarkable new book on cybercrime and you will never again be entirely comfortable facing a computer screen.

Glenny, a veteran war correspondent, Balkan expert, and author of McMafia -- an impressive 2008 study of what the end of the century and the Cold War did to create new and global forms of organized crime -- has moved on to exploring the dark side of the Internet, focusing on cybercrime, cyber espionage (both state sponsored and corporate) and cyber war.

In a world where an estimated 65 per cent of computer users are eventually victim to some form of cybercrime, Glenny's fact-based thriller takes a compelling, sobering look at the Internet as a kind of 21st century Hell's Kitchen, a festering, uncharted cyber-domain so riddled with crime and covert war operations that no one is safe -- even if one does have the good sense to delete email offers of multimillion dollar bank transfers from Nigerian civil servants, and ads for the implausible expansion of intimate body parts.

Identity theft, credit card fraud and electronic bank robbery are only some of the dangers the naive computer owner faces every day. Online, corporations watch their proprietary information bled out to competitors. Indeed, the gunboat diplomacy of the 19th century has been upgraded to feature massive cyber attacks on enemy computers, like those launched by the Russian government against Estonia in 2007 and Georgia in 2008.

Glenny paces his richly researched account like a thriller, taking us deep into a world where criminal conspiracies can exist entirely on the Web, involving cyber accomplices spread out from the Ukraine to the U.K., from Germany to Turkey and from Cyprus to California.

This is the Phantom Kingdom of the Geeks, where socially inept computer nerds can transform their talent for writing computer code into fortune, by hacking into secure data banks or designing and building diabolical hardware like the "skimmers" that fit into ATMs and steal key data from credit cards.

It is a world of true crime adventure that rivals anything imagined by William Gibson, the Vancouver-based science fiction genius who invented the cyberpunk genre with 1984's Neuromancer.

A market for cyberthieves

The Dark Market of Glenny's title was a website, a thieves' market that flourished from 2005 to 2008. It was a kind of cyber bazaar where hackers could buy and sell credit card information, custom-built viruses and worms (programs designed to damage or loot computers they enter -- sometimes known as "malware") and felonious equipment, like skimmers.

In its heydey, Dark Market was a cyber campus for illegal computer studies, a place to buy and sell loot, and a secure site where the hacker kings could meet other anonymous pirates of cyber space, polish their online personas (complete with colorful and typographically odd pseudonyms like Iceman, JilLsi, and Cha0) and boast about their exploits.

There was only one small flaw; one of the key figures in the Dark Market cabal, Master Splynter, was actually FBI agent Keith Mularski, who managed to infiltrate the site and for some time functioned as one of its trusted leadership figures -- a kind of Donnie Brasco in cyberspace. Mularski is one of the heroic figures in Glenny's book, along with Turkish cybercop Bilal Sen.

Glenny also traveled the world to interview many of the master hackers associated with Dark Market and other cybercrime sites and heists, and he makes these shadowy villains of cyberspace come alive as fascinating, complex characters worthy of Dostoyevsky.

When war goes online

The result is a book more exciting than The Godfather and more informative than Wikipedia. Glenny not only tells the tale of Dark Market's rise and fall, he sketches in the history of earlier crime resources online, like CarderPlanet. He provides just enough disturbing information about the emerging realities of online warfare and subversion to suggest that we have entered a new era of international relations, one in which the pen may not be mightier than the sword, but where the keyboard and high speed connection can do more damage than a dive bomber or an infantry brigade.

Take Stuxnet, for example -- the super virus developed by Israel, probably with American assistance. The virus, introduced last year into the computer systems that control Iran's nuclear labs, was custom designed to disable the centrifuges necessary for the production of high grade nuclear material. Glenny cites its creation as a significant moment in the evolution of cyber war, one that could have led to a nuclear explosion. (In an interesting intersection of high-tech cyber warfare with old-fashioned spy tradecraft, Stuxnet had to be hand-loaded into the Iranian system by an agent or dupe who managed to obtain physical access to the system, which is not connected to the Internet.)

In a recent interview with TV pundit Charlie Rose, Glenny said the Iranians are not the only ones who have seen their military hardware or infrastructure subject to cyber infection. When Israel bombed a suspected nuclear site in Syria in 2007, a computer virus that disrupted the Syrian air defenses played a key role in the success of the Israeli raid.

American bomber drones have also been found to be infected with computer viruses, as has much of the American electrical power network, which Glenny said is laced with currently-inactive Chinese "sleeper viruses" that could potentially be activated to damage the entire North American power distribution system.

The secret life of your home computer

One of the most disturbing revelations of the book, at least for this reviewer, is the way cyber criminals can use their custom-designed virus programs to colonize an otherwise innocent home or office computer, turning it into an element in a "bot net" of surreptitiously-colonized computers that figure in multimillion unit spam distributions, or attacks on company or government computers.

Not all cybercrime is committed in the service of profit or national interests. Although Glenny does not address this phenomenon, cyber anarchists like the Anonymous collective can use the methodology of sites like Dark Market to shut down the systems of corporations or governments (and have recently threatened to make the city of Toronto disappear from the web if the Occupy Toronto organization is attacked by police!)

Although Glenny's book is bound to make computer users who read it uneasy, it is required reading for anyone who wants to understand what's going on in the world today. Full of unsettling facts, and prompting well-founded anxieties that your home computer has a secret life as part of a criminal bot net, DarkMarket works both as a thrilling read and as a primer for cyber self-defense. Highly recommended.  [Tyee]

9  Comments:

Login or register to post comments

  • Eduard Hiebert

    26 weeks ago

    My thanks to Tom Sandborn, TheTyee.ca and Misha Glenny

    My thanks to Tom Sandborn, TheTyee.ca and Misha Glenny an interesting, informative and well deserved read.

    If sleeper cells in the power grid might be a problem, here is one where the tip of the iceberg is already plying the waters.

    Ever since Canada’s phone system was “deregulated” and “competitors” given access to the system, thereby exposing its innermost Achilles Heels to these new entrants, shadowy figures through the new entrants have been able to counterfeit call display, including running circles around “Call Trace”. The potentials for such counterfeiting abilities is staggering beyond belief yet in this new environment the major telcos ldo not want to take the financial initiative to clean up a problem caused by the new entrants as this is then a further subsidy to the new entrants. The RCMP refuse to touch unless the Telcos make complaint and the new entrants? Well that’s like pushing a string up a hill. Based on my contact with the “regulator” the CRTC, unless there is a sizeable occupy the CRTC movement even before the term was invented, complaints from individuals are next to meaningless.

    The nature of these problems are ones where small numbers of persons can effectively profit from barn razing the system and as long as the public, including through progressive ventures like the Tyee do not help facilitate safe and effective ways to make positive but private assembly, as in organize, then implicitly The Tyee provides systemic advantage to the barn razers at direct expense to the 99% who will contribute to the barn raising of our communities.

    Advancing two birds with one stone, through the following you can empower yourself together with your community minded neighbours to elect better candidates to public office as well as make contact.
    http://www.eduardhiebert.com/ereform/v123p.htm

  • airwin

    26 weeks ago

    Microsoft should share a large part of the blame for this

    If some company had a monopoly on house doors and refused to install locks on the doors they sold, shouldn't they takes some responsibility for the subsequent wave of house robberies? Also, wouldn't an article about that wave of house robberies be badly incomplete without a mention of the company at all?

    That analogy is an oversimplification of the relationship between Microsoft and the millions of personal computers running Microsoft software that are infested with malware these days. Nevertheless, Microsoft does have a near monopoly on personal computer software so their name should have been mentioned in the article. Also, I think it is fair to say Microsoft had no computer security for Windows 95, and they have been playing catch-up on the security front ever since.

    In contrast, Unix (e.g., Linux and Mac OS X) has had an excellent security record from the get go. For example, Unix separates the root account (with God-like powers only required for administration of the system and to propagate malware) and user accounts (with limited powers that are extensive enough for normal use but which it is difficult for malware to use) with independent passwords for each.

    Those in the know are abandoning Microsoft for Mac OS X and Linux partly because of the security concerns with Microsoft. However, Microsoft still retains a huge but slowly decreasing share of the PC market because they have the commercial power to force preinstallation of Microsoftware on most PC's, and naive computer users tend to go with whatever is preinstalled on the PC that they buy.

  • freewilly

    26 weeks ago

    windoze

    "Those in the know are abandoning Microsoft for Mac OS X and Linux partly because of the security concerns with Microsoft."

    There could be all manner of security issues with the mac OS but creators of viruses will spend their energy creating ways around the windows OS, being the most popular. Most bang for the buck?

    I used Macs exclusively from the time they were concieved. I still have a bunch of classic macs still working.
    From the time these personal computers were created, the security was scant or non existent. Viruses existed as soon as computers could talk to each other, even on the mac. In fact Norton anti-virus was created and used to address macs security issues.
    Interpetive computer languages made it possible to infect home computers, very easily. Windows computers were good for this creating open ends to access the most powerful low level functions, be it javascipt, window scripting host, DOS or whatever. These langauges increased the capability and speed to write software, or to act as wrappers to lower level functions.
    The problem with windows is that they left too many backdoors in the operating system, most for good intentions. Without rewritting the whole thing, and dumbing it down they just add securiy patches that come in almost everyday.

  • airwin

    26 weeks ago

    Re: windoze

    I have actually had no experience with Microsoft of Mac OS X (I have been using Linux on my desktop for the last 15 years), but my brother who was a rabid Microsoft fan for many years did recently switch from Windows to Mac OS X because he was tired of the hours of work each week that were required to attempt to keep his Windows box secure. And there are a lot of businesses in Victoria (and presumably elsewhere) that do nothing but clean viruses from personal computers running Microsoft. In contrast, I have never had a hint of a security breach with any of my Linux machines over the years.

    I do agree that both Mac OS X and Linux aren't challenged as much by malware as Windows because malware authors tend to target the Windows desktop monopoly. But Unix systems do have a reputation for good security by design (rather than as an afterthought) so this reputation and/or the reality of that good security may be discouraging malware authors as well. A unique advantage that Linux has over the others is security by genetic diversity; there are more than 500 different Linux distributions. Many of those don't have a lot of use, but malware designed for one of the major Linux distributions such as Ubuntu is unlikely to work properly for any of the other major Linux distros. I am all for anything that makes malware authors work harder. :-)

  • edand

    26 weeks ago

    To those who try to blame Microsoft for viruses:

    Windows is popular, so it's the main target. Viruses are not hard to write and notoriously hard to differentiate from legitimate software by any algorithmic process, and the antivirus business is mostly reactionary, due in large part to the fact that most of the best ways to stop viruses from operating also stop most useful programs from operating.

    Take UAC (User Account Control) for example: Vista started it and 7 continued it. Every expert/enthusiast I know has disabled it completely because it gets in the way of any "power user" computer usage, and because he/she knows how to keep viruses away without it. Viruses prey on those who aren't computer-savvy. Proper education is the only way to stop malware, spyware and botnets, and that's a fact.

  • snert

    26 weeks ago

    airwin

    You're brother must have been visiting some pretty bizarre sites to have to spend "hours of work each week". I consider myself a pretty broad spectrum user and only occasionally will I get a browser message saying uh, uh you don't want to continue on to that site.

    edand is absolutely correct when he says, "Viruses prey on those who aren't computer-savvy. Proper education is the only way to stop malware, spyware and botnets, and that's a fact."

    I'm currently running XP Pro with Windows Security Essentials. So far it works fine. If you run Mac or Linux you can get killed just as fast as with Windows, maybe not turned into a bot but killed just the same. Nothing is 100% secure.

  • airwin

    25 weeks ago

    edand and snert

    My principal point remains that any story about computer security issues is suspect when it does not mention the computer monopoly that is the fundamental source of this problem. I say this when that monopoly is Microsoft, and I would also say the same if Mac OS X, Linux or any other computer operating system was the monopoly that was the source of the problem.

    I agree with the general statement that it takes some due diligence to make any computer operating system secure against the most common threats out there. But from what my brother tells me that due diligence is _much_ easier for Mac OS X than for Windows, and I also have first hand experience that security is completely straightforward for Linux (make sure you have the first-class Linux firewall installed and keep your system updated which takes roughly 5 minutes per week because system updating is such a breeze with Linux). So I blame Microsoft for making their machines difficult to keep secure, and the horrific story told above about the general state of computer security is the principal consequence of that difficulty.

    I attribute the user security ease for both Mac OS X and Linux to their Unix heritage where security was built in from the start. My brother decided to buy a Mac OS X for himself after a year or so of comparisons between his wife's Mac OS X computer and his own Windows computer. That switch (based partially on how easy it was to keep a Mac OS X computer secure) says a lot for someone who has been a Microsoft advocate and power user (probably much like you guys) for more than a decade.

  • Arby

    25 weeks ago

    A Little More Thought

    Airwin: A little more thought, I think, could have gone into your posts. I would learn a lot more about computers and the internet if I had resources (money, tech savvy friends). We aren't automatically stupid or bad because we go with Microsoft rather than Linux. I would rather use Linux in fact. But I've been dealing with chaos (5 moves in 15 months for example), bad bosses, thieves, lunatics. And switching operating systems is only one of many things (ranging in importance) that I'd like to do. And I earn peanuts. I don't know you. I'm sure you're an okay person. Just saying...

  • doorsecurity

    15 weeks ago

    Door Security

    The Door Security are the combination of Safety & security,Home
    Hardware,Building Supplies,Dog Supplies,Electrical Supplies.
    You have probably heard the phrase Katy bar the door, but
    if Katy isn't available and you need to bar the door or otherwise
    protect your property, you really ought to give this Master Lock?
    dual-function door security bar a look.
    DJArmor Sliding Door Security Latch brings a double bolt design to
    prevent lifting and shimming of sliding glass doors that most security
    solutions do not address. It withstands up to 1,000 lbs of load tension
    and can be installed in minutes.
    Door Security

    • No best comments selected by an editor for this story yet. To see all comments, click the All Comments tab, above.