xDedic

» see xdedic.biz as it lived, on the wayback machine

~ the obituary ~

The first time I heard the name was the Kaspersky report in June 2016, and it is one of the few product graves here where the correct reaction on reading about it was to go and check something. xDedic did not sell software or media. It sold the login to a server that belonged to somebody else, and the somebody else was a university, a hospital, an accounting firm, a small hosting company, whoever had left Remote Desktop open with a weak password.

It appeared around 2014 and ran in Ukrainian, from Ukraine, under Russian-speaking management. The interface was a normal storefront. You could filter by country, by operating system, by what software was installed, by whether the machine had accounting or point of sale packages on it, which is to say you shopped for a victim by what they did for a living. Prices started at six dollars. A machine with the right access on it went for more than ten thousand.

Kaspersky counted 70,624 servers listed in May 2016, offered by 416 sellers, spread across 173 countries. The most affected countries were Brazil and China at the top of a long list that included most of Europe. None of those owners had been told. Their machines were up, doing their jobs, and also for rent.

~ the case file ~

~ how the market worked ~

The sellers were not usually the buyers. One group broke into servers at scale by hammering Remote Desktop and listed whatever came back. Another group bought the access for the price of lunch and used it for whatever they were actually doing: tax refund fraud, ransomware staging, ticket scalping, a launch point for the next set of break-ins. The marketplace itself provided the verification layer and a standardized backdoor, so that a stolen login could be sold like a normal product with a normal listing.

That split is what made it durable. Nobody on the site had to be good at more than one thing, and the site took its cut regardless. Kaspersky publishing the entire operation in June 2016 changed nothing structural. The site went quiet for a few days and then came back, and researchers were still counting more than 85,000 listings afterward.

~ the day it died ~

On 24 January 2019 the domains were seized on the order of a US court out of the Middle District of Florida, and the infrastructure was dismantled. The same day, Ukrainian national police and prosecutors ran house searches in nine locations with the Belgian federal computer crime unit and the FBI alongside them, coordinated through Europol. IT systems were carried out and three suspects were questioned. A joint investigation team between Belgium and Ukraine, funded by Eurojust, had been assembling the case through two coordination meetings in 2018.

~ the receipts ~

The Justice Department later put the scale of it at more than 700,000 compromised servers offered over the life of the site, at least 150,000 of them in the United States, with losses estimated above $68 million. Nineteen people from six nationalities were charged. The lead developer was extradited from Spain in November 2022 and drew 41 months. One buyer in the group had used purchased servers to file hundreds of false tax returns chasing $60 million in refunds and got 78 months, which is longer than anyone who built the thing.

What xDedic proved is that the shortage in that economy was never technical. Breaking into a badly configured server has been easy for thirty years. What was missing was a shop counter, and once somebody built the shop counter the price of a stranger's infrastructure settled at six dollars.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »