ShadowCrew

» see shadowcrew.com as it lived, on the wayback machine

~ the goodbye ~

Between 2002 and 2004 i was in internet cafes in Turkey playing counter-strike and pulling mp3s down a line shared by twenty machines. That was what the internet was in this country in those years, and it felt like all of it. ShadowCrew was running on the same web at the same hours, in English, selling other people's credit card numbers by the hundred, and there was no path by which it was ever going to appear on a screen next to mine.

Brett Johnson, who used the handle GOllumfun, started it in early 2002. Seth Sanders and Kim Marvin Taylor were the other founders. The forum proper dates from August 2002, and it was a forum in the completely ordinary sense, with threads and sub-forums and a moderator list. One section covered phishing technique. Another covered what to do with a card number once you had one.

The federal indictment put membership at roughly four thousand. The last copy of the site captured before the takedown shows 2,709 registered accounts, which is the more honest number and still an enormous one for what it was. Losses attributed to it ran to more than 1.7 million card numbers and about 4.3 million dollars of confirmed bank fraud, with prosecutors arguing the real figure would have been in the hundreds of millions had it kept going.

The word hacker gets attached to this and does not fit. ShadowCrew was a wholesale market. Somebody stole the data and somebody else tested it. Further along, one person printed physical cards and another walked into a shop with them. The forum was the trading floor that connected those jobs to each other, and most of the people on it never touched a computer belonging to a stranger.

~ the chronicle ~

~ how the market worked ~

The interesting engineering here is social. In a normal market you can go to court, and that possibility is what makes it safe to pay a stranger before you receive the goods. In this market nobody could go anywhere, so ShadowCrew built the missing institution itself. Accounts carried ranks. Above the ordinary member sat vendors, and above them reviewers whose job was to take a sample from a seller's batch, test whether the numbers were live, and publish a verdict.

A seller who passed could advertise. A seller caught taking money without delivering was labeled a ripper and was finished, because the label followed the handle. It is a certification body invented from scratch by people who could not have one, and it is the piece that later markets kept when everything else about them changed. The rest of the architecture, escrow held by the site and formal dispute handling, arrived properly with the generation that followed.

~ the sting ~

Albert Gonzalez, handle CumbaJohnny, was arrested in New York in 2003 with cloned cards on him and agreed to work for the Secret Service instead of going to prison. He was reportedly paid seventy five thousand dollars a year. He was also, at that point, one of the people running the site.

The operation that followed was called Firewall. Gonzalez set up a VPN for ShadowCrew members, promoted on the forum as a security improvement, which the Secret Service was recording. It ran for about a year and a half and gave investigators the one thing that market normally denies them, which is the real address behind a handle. On Sunday 26 October 2004 Gonzalez called a meeting on the site so that the membership would be at their keyboards, and the arrests happened simultaneously: twenty eight people across eight American states and six foreign countries, in something under six hours, coordinated with the British National Hi-Tech Crime Unit and the Royal Canadian Mounted Police among others. The Justice Department announced it two days later.

Gonzalez did not stay retired. He went on to run the intrusions that took roughly 130 million card numbers from TJX and other retailers, and in 2010 received twenty years, which was the longest sentence handed down for computer crime in the United States at the time.

~ what remains ~

The site itself became the notice. Anyone typing shadowcrew.com after the raids got a black page with a photograph of a hand gripping a prison bar and a line in blue capitals reading UNITED STATES SECRET SERVICE. Underneath sat a list of the statutes involved, followed by a warning that proxies and encryption no longer made anybody anonymous. The last line told the reader to contact their local Secret Service field office before we contact you.

As a piece of graphic design it is terrible and as a piece of psychology it was extremely effective, because the people it was written for had spent two years reading that domain every day. The market shape outlived the takedown by twenty years and more, through Silk Road and AlphaBay and everything since, all of it running on reputation systems descended from a forum rank called reviewer. The domain now answers nothing.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »