How Did Cybercrime and Defense Evolve by 2010?

TL;DR

Cybersecurity threats were evolving steadily as criminals adapted their tactics to new defenses, while governments and law enforcement were taking a larger role in the response. Investigations into Shadowcrew, Dark Market, Albert Gonzalez, and related figures showed the value and limits of forum infiltration, international cooperation, arrests, and informants. Scheduled vendor patch releases also made enterprise vulnerability management more predictable.

Transcript

Thanks everybody. Like he said, my name is Rick Howard. I am the intelligence director for iDefense. Uh, first, let me thank you all for coming this morning at nine o'clock on a Friday session. I'm surprised anybody is still here. Uh, is there some big session coming later that you're all gonna go to? Yes? I don't know. Well, thanks for coming anyw... Read More

Key Insights

• Cybersecurity threats were evolving steadily rather than through revolutionary new techniques, as attackers changed their tactics to counter the defenses deployed against them. The presentation identifies this continuing adaptation as a central pattern in the security landscape entering 2010.
• The center of gravity in cybersecurity was shifting from the private sector toward government, according to the presentation's second major theme. Law enforcement investigations, international coordination, arrests, and legal consequences increasingly shaped the response to organized online criminal activity.
• Underground forums were marketplaces for stolen credit card information and important gathering points for cybercriminals. Shadowcrew, founded in 2002 by Albert Gonzalez and associates, became an early example of the communities where participants conducted transactions and developed criminal relationships.
• Operation Firewall was a significant but incomplete law enforcement success because it arrested 28 of Shadowcrew's 4,000 members in October 2004. Investigators disrupted the forum, but major figures were not captured during that operation, limiting its reach.
• Dark Market infiltration was sustained for two years by FBI agent Malarski, who operated under the alias Master Splinter and became a senior system administrator. His access allowed the FBI to monitor activity even though Max Butler repeatedly suspected and publicly identified him as a federal agent.
• International cooperation was essential to the Dark Market operation, which involved authorities from several countries and resulted in the arrests of 56 forum members. The investigation accelerated after Turkish authorities arrested a Dark Market administrator for ATM fraud.
• The TJX-related breaches exposed the scale and profitability of payment-card crime, with 45 million credit card numbers found on Maxim Yastremskiy's laptop. Authorities believed he earned about $11 million over two years, while Gonzalez reportedly made at least $45 million from stolen cards.
• Scheduled patch releases were becoming a vendor standard that helped enterprises plan vulnerability management. Adobe introduced scheduled maintenance for Acrobat and Reader, following practices already used by Microsoft, Oracle, and Cisco, although Adobe did not extend the schedule across its entire product suite.

Questions & Answers

Q: How were cybersecurity threats changing by 2010?

Cybersecurity threats were changing through steady tactical evolution rather than revolutionary new techniques. Attackers adjusted their behavior to counter each new defense that organizations deployed. At the same time, the center of gravity in cybersecurity was moving away from the private sector and toward government, with law enforcement operations and international cooperation becoming increasingly prominent parts of the response.

Q: What role did Albert Gonzalez play in cybercrime?

Albert Gonzalez was an original founding member of Shadowcrew in 2002 and later became associated with some of the largest retail payment-card breaches discussed in the presentation. After his 2003 arrest for ATM fraud, he cooperated with the Secret Service. He reportedly made at least $45 million through stolen credit cards and was eventually arrested and sentenced to prison.

Q: What was Shadowcrew and why was it important?

Shadowcrew was one of the early underground forums where criminals bought and sold stolen credit card information. Albert Gonzalez and two associates were among its original founders in 2002, while other prominent participants joined later. Its thousands of members made it an important target for law enforcement and a major example of organized criminal commerce operating through online communities.

Q: How successful was Operation Firewall against Shadowcrew?

Operation Firewall shut down Shadowcrew in October 2004 and led to the arrests of 28 members. However, the forum had about 4,000 members, and law enforcement did not capture major figures such as Zoomer and Max Butler through that operation. The presentation speculates that Gonzalez may have warned prominent participants before the Secret Service closed the forum.

Q: How did law enforcement infiltrate Dark Market?

FBI agent Malarski entered Dark Market using the alias Master Splinter and rose to the position of senior system administrator. He remained inside the forum for two years and monitored its participants. Max Butler repeatedly suspected that Malarski was a federal agent and said so within the forum, but other members continued their activities and allowed the infiltration to persist.

Q: Why was international cooperation important in the Dark Market case?

The Dark Market case crossed national boundaries and required cooperation among law enforcement organizations from several countries. Turkish authorities arrested a forum administrator for ATM fraud, prompting agencies elsewhere to investigate the forum more closely. A coordinated sting operation then resulted in the arrests of 56 Dark Market members, making the case a substantial law enforcement success.

Q: How were the TJX credit card breaches carried out?

Stephen Watt wrote sniffer software used by Albert Gonzalez's crew. The group positioned itself outside retail stores, captured network traffic, and eventually entered payment-processing systems where it collected credit card numbers. Watt was described as the software's author rather than a member of the crew, but he still received a sentence of two and a half years.

Q: Why did scheduled vendor patches help enterprise security?

Scheduled patch releases helped enterprises plan maintenance instead of responding whenever vendors unexpectedly issued fixes. Microsoft, Oracle, and Cisco already followed scheduled release practices, and Adobe adopted a maintenance schedule for Acrobat and Reader. Adobe did not apply it to its entire product suite, but the change still reduced patching chaos and made vulnerability management more predictable.

Summary & Key Takeaways

• Cybercrime during the period centered heavily on underground forums where participants bought and sold stolen credit card information. Albert Gonzalez helped establish Shadowcrew, later cooperated with the Secret Service after an arrest, and was also connected to major retail breaches that generated large illicit profits and exposed millions of payment records.

• Law enforcement achieved important results by infiltrating criminal communities and coordinating across national borders. Operation Firewall arrested 28 Shadowcrew members, while the Dark Market investigation produced 56 arrests. Despite these successes, prominent participants escaped early operations, and suspects in countries lacking Western extradition relationships remained beyond authorities' immediate reach.

• Cybersecurity practices were changing through evolution rather than revolutionary new attack techniques. Criminals continually adjusted their methods in response to defensive controls, while responsibility for cybersecurity increasingly shifted toward government. Vendors also adopted scheduled patch releases, giving enterprises more predictable maintenance cycles and reducing the disruption caused by unexpected security updates.