Darkode

» see darkode.com as it lived, on the wayback machine

~ the last words ~

This is one of the few graves here where the honest distance is not a confession. Darkode was shut to everybody who had not been vouched for, which is to say shut to almost the entire internet, so being outside it was the ordinary condition rather than a gap in anyone's memory. i was not in it, and neither was anybody reading this. That was the product.

It launched in 2007 under a founder who went by Sp3cial1st. Daniel Placek has said publicly that he was there at the start, which he described on a podcast in september 2015, two months after the place stopped existing. What was traded there was malware and botnet access, along with stolen card numbers and credentials for servers other people owned. Europol later called it the most prolific English-speaking cybercriminal forum to date, which sounds like an exaggeration until you look at how small it was.

At the top end it held somewhere around three hundred people. Not accounts, people. A forum with fewer members than a mid-size office was the one that police in twenty countries eventually organized themselves around, and the smallness was not an accident of obscurity. It was the security model.

~ the record ~

~ how you got in ~

An existing member had to put you forward. That got you as far as the doorstep. Then you had to post an account of your skills and what you had accomplished with them, and the room decided whether it was worth anything. A CV, written to a hiring committee, describing crimes.

Every part of that is doing security work. A vouch means somebody with something to lose is standing behind you. A written record of what you have done is the strongest thing a stranger can hand over, because a police officer is exactly the person who cannot produce one truthfully and cannot invent one without leaving a claim on record. The forum built its wall out of mutual incrimination, and for eight years it mostly held.

~ the numbers nobody agrees on ~

Operation Shrouded Horizon ran from january 2014 to july 2015 and the FBI called it the largest coordinated law enforcement effort ever directed at an online criminal forum. Wikipedia's Darkode article says twenty-eight people were arrested and twelve were charged in the United States. Wikipedia's article on the operation itself says seventy individuals were arrested across twenty countries. The two pages disagree and neither corrects the other.

The FBI's own wording reconciles them. Its figure of seventy covers everybody the operation reached at all, whether that meant a charge or a knock on the door, and inside that total sit twenty-eight arrests against thirty-seven house searches. Twelve United States indictments came out of it, one of them the administrator. So one number counts people touched and the other counts people held, and the press turned both into a headline that said arrests.

~ the two weeks after ~

The servers went in july and the forum came back before the end of the month. New version, running on Tor, with membership authenticated through the blockchain instead of through a database somebody could seize. Whoever rebuilt it had read the postmortem of their own takedown and shipped a fix.

It did not matter. Another version surfaced in december 2016 and was hacked almost immediately, with its database leaked into the open. Both of the things that had kept the original alive were gone by then. The vouching chain had been walked by federal agents and the roster was a matter of public record, so the one asset the place actually ran on, which was knowing that everyone in the room had already been checked, could not be rebuilt on new hardware. darkode.com answers nothing today.

~ the legacy ~

The forum shape it perfected did not die with it. An invitation followed by a written record of prior work is now the entry process for every serious criminal market that came after, and it is also, with the crimes removed, how a lot of closed developer communities decide who gets a login.

The other inheritance is on the police side. Eighteen months of an operation run from inside a room where three hundred people had each personally guaranteed one another is a slower method than seizing a server and a much better one, and it became the standard. Two years later the Dutch police took Hansa and then quietly kept running it as a market for a month, watching, before anybody outside knew it had changed hands.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »