Genesis Market

» see genesis.market as it lived, on the wayback machine

~ the last words ~

Genesis Market opened in beta in 2017 and was never open to the public in any sense. Entry required an invitation from an existing member, which is the one detail that settles where the rest of the world stood in relation to it. Nobody browsed in by accident. By the time police took it down it held around 80 million sets of credentials belonging to more than two million people, harvested by info-stealer malware from roughly 1.5 million computers in 218 countries.

What it sold was not a password list. Password lists had been traded for twenty years and the industry had built defenses against them, so a stolen password on its own would usually trip a security check the moment it was used from an unfamiliar machine. Genesis sold the unfamiliar machine as well.

The operation that ended it was called Cookie Monster. On 4 April 2023 the FBI and the Dutch National Police seized the clearnet domains, and Europol announced the result the next day: seventeen countries involved, 119 people arrested, 208 properties searched. Twenty-four domains and two servers in the United States went with it, along with cryptocurrency wallets. The FBI put the traced crypto theft at $8.7 million and the real total in the tens of millions.

~ the record ~

~ what a bot was ~

On Genesis a "bot" was one infected person's browser, packaged. The listing carried everything a fraud system looks at: session cookies, saved logins, autofill data, IP address, operating system version, plugin list. Together those are the fingerprint that decides whether a login looks like you. Buying the bot meant borrowing all of it at once, and the malware kept the listing fresh, so if the victim changed a password the buyer received the new one.

Prices started under a dollar and ran to about $370 for a machine with a lot attached to it. Rates varied by country, because an account in one market is worth more than the same account in another. Listings advertised which services the fingerprint reached, and the names were mostly ordinary: Netflix, Amazon, eBay, Facebook, online banking.

~ the storefront ~

The part that unsettles people who look at the screenshots is how normal it all looked. Genesis had a search box with filters, a shopping cart, a price list, a support channel. It shipped its own software: the Genesis Security Plugin for ordinary browsers, and Genesium, a Chromium build made specifically for loading a purchased fingerprint. There was documentation. Somebody with no technical ability at all could take over an account from a graphical interface, which is what the tooling existed for.

~ after the seizure ~

Seizing a clearnet domain removes an address, and Genesis had more than one. Within two weeks of the takedown a fully working mirror was up on the dark web, and researchers watched it keep serving listings while the arrest counts were still being reported. The brand survived its own funeral for a while, running to a much smaller audience that now knew a large number of its users had just been identified.

The arrests were only half of the work. The FBI handed millions of the seized email addresses and passwords to Have I Been Pwned, where the breach was loaded as sensitive so that nobody can search it without first proving control of the address. Dutch police put up their own checker at politie.nl/checkjehack, having estimated that around 50,000 people in the Netherlands alone had been listed. That is how most people met this product at all: after it was dead, in a notification telling them they had been inventory.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »