Bayrob targeted eBay customers by intercepting visits to the eBay website and presenting fraudulent auctions.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“they were trying to defraud customers of eBay”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Bayrob targeted eBay customers by intercepting visits to the eBay website and presenting fraudulent auctions.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“they were trying to defraud customers of eBay”
Bayrob Group USES Jabber
The attackers used Jabber to communicate with one another.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“I could tell these guys were talking over Jabber”
Bayrob Group USES directional Wi-Fi antenna
The group used directional Wi-Fi antennas to connect to and steal neighboring Wi-Fi networks, helping conceal its actual locations.
Explicit Confidence 99% · Brian Levine EP 175 Details
“They would hack into another account in Bucharest”
“these large directional antennas”
The malware was distributed through phishing emails and Craigslist posts.
Explicit Confidence 98% · Jack Rhysider EP 175 Details
“specifically through phishing e-mails and Craigslist posts”
Bayrob Group USES custom flashed router
Each member received a custom-flashed router that allowed the group to proxy traffic between different houses.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“each of them got a custom flashed router”
Bayrob USES cryptocurrency mining
The malware-controlled systems were instructed to join mining pools and mine cryptocurrency for the group.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“We saw them instructing these computers to join mining pools and mine cryptocurrency for them”
Bayrob Group USES LUKS
The group used LUKS to encrypt its Linux systems.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they were running Linux with LUKS on it”
Bayrob Group USES AlphaBay
The Bayrob Group sold proxies and stolen credit-card information on AlphaBay.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“some of those proxies were sold on AlphaBay”
“which they then sold on AlphaBay as well”
Bayrob USES browser session injection
Bayrob intercepted eBay connections and injected false information into the victim’s browsing session.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“it would intercept your connection and it would inject false information into your browsing session”
Bayrob Group USES Tor
The Bayrob Group used Tor as part of its layered routing and concealment infrastructure.
Explicit Confidence 99% · Brian Levine EP 175 Details
“they would go to Tor, then from Tor they would go through their proxy chain”
Bayrob Group USES proxy chain
The Bayrob Group routed traffic through multiple infected machines and used those machines as proxy-chain hops to conceal its origin.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“they would jump through multiple infected machines in multiple countries”
AOL built and deployed a packet-capture indexing system called Moloch at the ISP level.
Explicit Confidence 98% · Eoin Miller EP 175 Details
“we built a full packet-capture indexing system — at the time it was called Moloch”
Bayrob Group USES TrueCrypt
The group used multiple TrueCrypt containers to protect its work systems.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they had a couple of TrueCrypt containers on it”
Bayrob USES command-and-control infrastructure
Bayrob communicated with and used a multi-layer command-and-control infrastructure.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they had a multi-layer command-and-control infrastructure”
Bayrob Group USES Off The Record
The attackers used Off The Record encryption for their Jabber chats.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“they were using OTR, Off The Record, which does end-to-end encryption on all Jabber chats”
Bayrob USES Money mule
Bayrob’s operators used money mules to receive victims’ payments and forward the money through additional intermediaries.
Explicit Confidence 97% · Jack Rhysider EP 175 Details
“the criminals hired someone else to collect that money, keep a portion of it, and then forward the rest”
Bayrob USES geofencing
The attackers geofenced the fraud so it would operate only in America and selected locations within the United States.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“the attackers were geofencing their fraud so that it could only happen in America”
Doe vs. Ashcroft ASSOCIATED_WITH National Security Letter Provision
The district judge in Doe vs. Ashcroft declared the National Security Letter provision unconstitutional, but stayed the decision during the government's appeal.
Explicit Confidence 98% · Nick Merrill EP 176 Details
“the judge issued a decision saying this is unconstitutional”
“I’m issuing a stay on the decision”
National Security Letter Provision ASSOCIATED_WITH USA PATRIOT Act
Nick says the National Security Letter Provision had been amended multiple times, with its most recent amendment occurring under the USA PATRIOT Act.
Explicit Confidence 99% · Nick Merrill EP 176 Details
“the last time it was amended was under the Patriot Act”
New York Civil Liberties Union ASSOCIATED_WITH Calyx
The New York Civil Liberties Union was one of the first organizations to get online through Nick Merrill's ISP and remained a client he hosted.
Explicit Confidence 97% · Nick Merrill EP 176 Details
“one of the first organizations that I got online was called the New York Civil Liberties Union”
“NYCLU is still kind of a client of mine at that time”
National Security Letter ASSOCIATED_WITH National Security Letter Provision
Nick identifies Title 18 U.S. Code Section 2709 as the National Security Letter Provision underlying the letter he received.
Explicit Confidence 99% · Nick Merrill EP 176 Details
“Section 2709 is the National Security Letter Provision”
Phreeli ASSOCIATED_WITH privacy by design
Nick explicitly says Phreeli applies the principle of privacy by design to mobile phone service.
Explicit Confidence 99% · Nick Merrill EP 176 Details
“trying to use the whole principle of privacy by design”
Doe vs. Mukasey ASSOCIATED_WITH National Security Letter Provision
In the later appeal, the judge again found the suppression of speech unconstitutional but stayed the ruling; the account presents this as a continuation of the NSL challenge.
Explicit Confidence 97% · Jack Rhysider EP 176 Details
“this case was renamed to Doe vs. Mukasey”
“The judge declared the suppression of speech to be unconstitutional, but again, the judge issued a stay”
National Security Letter ASSOCIATED_WITH FBI
The letter Nick received demanded information about one of his clients and was delivered as an FBI request.
Explicit Confidence 99% · Nick Merrill EP 176 Details
“I’m calling from the FBI and we have a letter for you”
“the FBI wanted all this information from me about one of the clients of the company”
Cindy Cohn AUTHORED Privacy’s Defender
Cindy Cohn says she wrote Privacy’s Defender, which documents her battle with NSLs and other digital-rights cases.
Explicit Confidence 99% · Jack Rhysider EP 176 Details
“she just published a new book called Privacy’s Defender”
“I wrote the book in part because”