Software Pirate Cracks Cybercriminal Wares:
Make enough friends in the Internet security community and it becomes clear that many of the folks involved in defending computers and networks against malicious hackers got started in security by engaging in online illegal activity of one sort or another. These gradual mindset shifts are sometimes motivated by ethical, karmic or personal safety reasons, but just as often
grey- and
black hat hackers gravitate toward the defensive side simply because it is more intellectually challenging.
I first encountered 20-year-old French hacker
Steven K. a few months ago while working on a series about the fake antivirus industry. I spent several hours reading accounts of his efforts to frustrate and highlight cybercriminal activity, and took time to follow the many links on his blog,
XyliBox, a variant of his hacker alias, “Xylitol.” It turns out that Xylitol, currently unemployed and living with his parents, is something of a major player in the software piracy or “warez” scene, which seeks to crack the copy protection technology built into many computer games and commercial software programs.
As a founding member of
redcrew.astalavista.ms (this site may be flagged by some antivirus software as malicious), Xylitol spent several years devising and releasing “cracks,” software patches that allow people to use popular commercial software titles without paying for a license. Cracks are frequently bundled with backdoors, Trojans and other nasties, but Xylitol claims his group never tainted its releases; he says this malicious activity is most often carried out by those who re-purpose and redistribute the pristine patches for their own (commercial and criminal) uses.
But about a year ago, Xylitol began shifting his focus to reverse engineering malware creation kits being marketed and sold on underground cybercrime forums. In October 2010, he began releasing cracked copies of the the bot builder for the
SpyEye Trojan, a crimeware kit that sells for several thousand dollars. Each time the SpyEye author released an update, Xylitol would crack it and re-release a free version. This continued for at least a dozen updates in the past year.
The cracked SpyEye releases have been met with a mix of praise and scorn from the security industry; the free releases no doubt frustrated the moneymaking capabilities of the SpyEye author, but they also led to the public distribution of a malware kit that had previously been much harder to come by.
In an instant message chat, Xylitol said he still cracks the occasional commercial software title, just for old time’s sake.
“Sometimes for the old memories, but I’m more into malware cracking now,” he wrote. “It’s more fun.”
Since Nov. 2010, Xylitol and some of his associates have been locked in a daily battle with Russian
scareware and
ransomware gangs. Scareware programs hijack PCs with incessant and misleading security warnings in a bid to frighten users into paying for the worthless software. Paying customers are given a license key eliminates the annoying security warnings. Ransomware is even more devious: It encrypts the victim’s personal files — pictures, documents, movies and music files — with a custom encryption key. Victims who want their files back usually have little recourse but to pay a fee via text message to receive a code that unlocks the encrypted files.
Xylitol and his pals have been busy over the past year cracking and publishing the license keys needed to free computers snared by scareware and ransomware. For months, these guys have been taking on a
Russian ransomeware group called the
WinAd gang, releasing the ransomware codes on a daily basis, often just hours after the WinAd gang began pushing out new ransomware variants.
In a chat conversation with KrebsOnSecurity.com, Xylitol said he’s lost track of the number of ransomware cracks he’s released, noting that at one point the WinAd gang switched to shipping a half-dozen updates daily in a bid to stay one step ahead.
“I lost count of how many of these I’ve cracked,” Xylitol said. “For a period that was daily and five or six per day, due to automatic ransomware update.”
Sometime
around Sept. 14, 2011, the WinAd gang apparently decided it was losing the war, and called it quits. In closing a year-long discussion thread on the WinAd gang,
Kernelmode.info moderator
EP_XOFF wrote:
“Since September 11, their activity has decreased significantly. September 14 had died last known domain and redirector. However this may mean nothing. We continue to search.”
Another Kernelmode member, Nickvth2009, replied, “Let’s hope it will never come back.”
GIGABYTE Technology Co. LTD are due to release their Aivia Xenon Dual Mode Touchpad Mouse, the world’s first-ever dual mode touchpad mouse. The Aivia Xenon can serve as a practical mouse with multi-touch gestures, and a portable touchpad. This innovative touchpad mouse makes you free from space boundary, and now all the operations are just one touch away.
