Blackhat Manifesto

Encryption Keys Please

2008-10-16T12:41:00.005Z

Now in the UK encryption keys must be surrendered to any encrypted data you have on your hard drive and somebody surrendered it to the authorities.

Why these jokers didn't say I forgot, I will never know.

I mean how hard is it to NOT self-incriminate oneself: Say you forgot. Just like every other government official says after losing a laptop full of Witness Protection persons or intelligence officers, etc.

They can't compel you to recall something you don't remember.
Simply say, "I am sorry i can't remember: my memory is a bit hazy from all the manhandling the cops did, your honor." What's the worst? Gitmo? I don't think so (although Britain has a track record of renditioning suspects to US).

At a time when courts and the government make a combined assault on our privacy and rights, while being more secretive themselves, it is up to us protect ourselves. Call me paranoid, but am the Burt Gummer type.

The Government has NO right to force me to divulge my self-secrets just like I can't force a government of the people, by the people and for the people to divulge its dirty secrets. I can't be transparent when the Government wants to be opaque.

After all, it has been proven time and time again that the Government cannot be trusted even with the most basic secrets. What is the criminal penalty for jokers who lost various laptops holding government secrets and OUR data? NONE.

What is the financial and criminal penalty the Government will pay if it causes me harm by leaking my secrets? NONE.

Until the Government pays for its mistakes(and heavily), am not going to divulge anything more to it. After all the Government am not trusty enough to know about its secrets, so why should I trust Government.

Ben Franklin, Hamilton and Mark Twain were absolutely right: You CANNOT and SHOULD NOT trust the government, if it doesn't trust you.

You can take my keys from my cold dead hands.

The name of the FICO game.

2008-07-23T18:38:00.003Z

The FICO score is intimately tied to a person's Social Security Number, their Name and their Date Of Birth, those three key pieces of information are the cornerstone of a persons modern day ID. To the new breed of criminal, ID theft is the new and easier way to rob banks without all that mucking about with guns, strong arm tactics and the traditional shouting "get on the floor this is a robbery" and such.

The system is clearly flawed, since no doubt, too much emphasis is on the personal Social Security Number of a person and the FICO score is intimately attached to everything a Social Security Number is attached to. Once this critical piece of information is ascertained by the ID thief it is effectively compromised and it leaves a permanent opening to a plethora of opportunistic attack vectors for a ID thief to take advantage of.

The counter tactics by the banks are weak since they involve asking some detail information about a persons past addresses, car loans and with whom the loans where with, etc. That a savvy ID thief is already aware of. So what IS a person "to do" about this dilemma and still live like a "normal" modern person? Well, in short, you have to redefine or at least modify the methods by which one identifies him/herself to the world. This is hard to accomplish as, most of the damage is already done if the identity has "in fact" been stolen. Many such identities have already been compromised and are already in a ID thieves' virtual roll-a-dex, students, the military, medical patients, and much more. These people unwittingly have their dossiers at many a ID thief's fingertips and in the vast majority of cases the thief is given in most cases a 30 day head start, a typical billing cycle to apply for credit cards, loans, etc before the user even is aware of the transgression.

The onus is on the actual person of that ID to be vigilant and inspect and monitor his/her data. It, literally, took an act of congress to even allow the owner of the FICO score to even peak at his/her score just to get ones bearings of where he/she is at on this arbitrary scale of credit worthiness. But to make matters worse, independent commercial entities have unrestricted access to check and pre-select people to give junk mail to. As a default everybody is opted in, unless they register with a do not call list and purposely elect to opt out. New "services" have risen in recent years, to monitor and better inspect who has access to their FICO score and subsequently the cursory personal data of the people in the databases of the credit trinity (Transunion, Experian, Equifax).

They basically are yet another 3rd party that will require you to submit all your personal information to them to put a fraud alert on the personal data (forcing everybody to first call the person to allow them to personally authorize any probing of this very sensitive data). Any citizen, of course could do this on his/her own but many are intimidated to do so. Mostly because of the relative obscurity of these private databanks and the typical difficulty for private citizens to review their own data within them. This is truly a sad state of affairs in regards to the credit game, private citizens, if they want to deal on any level with obtaining credit, a loan or purchasing a car are forced to in some manner deal with this hypocrisy. The patriot act, and the societies lean toward forcing its citizens to surrender this data to 3rd parties will make protecting their data a more complex feature in modern life.

Fuck You Wamu

2008-06-05T00:24:00.003Z

Fuck You Wamu

Wamu has the shitiest customer service department. I just got word from a customer who is trying to build up his credit and opted for one of their secured credit cards from Providian.

Now the subject has had a few run-ins with the credit trap, and wanted to build up his credit. He got one...count them one card, which he had to pay $300 into a savings account to secure the "loan" to play the credit game all over again.

His score started at 519, then to 535 the next month, then to 555 the next month, then it dropped to 508. This shocked the hell out of him and he immediately checked his score (with Transunion, Experian and Equifax) to make sure that all was on the level.

Well he got his FICO score and to his relief it was 565 it was going up as would be expected. But Wamu has recorded it as 508. He sent a message explaining the discrepancy. Wamu wrote back asking him to prove their error, which he did fax AND mail the documents they requested.

When he was able to finally talk with one of their customer service reps, he was told that the score reflected was based on a bank card enhanced FICO score and not the conventional FICO score consumers are privy to. He was able to get a correspondence from Transunion (not a trivial feat in the least). Who told him that the score that was delivered was the only score they had.

So, angry, he called Wamu on this and they insisted that the information about the bank card enhanced FICO score was correct and that he was incorrect.

When he asked for more information about this bank card enhanced FICO score, and to provide him a link online or at least a number where he could verify this information. Wamu just gave him the cold shoulder and told him that they did not have to provide their sources to him and adamantly refused to do so.

For two weeks he bantered back and forth with the Wamu customer service representatives and ultimately wasted his time and energy just trying to get a straight and forthright answer concerning this bank card enhanced FICO score.

Well, I was able to shed some light on the subject of the elusive bank card enhanced FICO score. It does in fact exist. My research has suggested that it is a new type of score, similar, but not quite like the conventional FICO score a consumer would be aware of. Further investigation revealed that Transunion and Providian has collaborated to issue this bank card enhanced FICO score to Wamu to reflect on their online credit card reports that are available online to their customers.

Well he, was livid that the customer service department just didn't tell him about the details that he directly asked for. Got him so angry and riled up that he started to talk to lawyers who knew less about the subject than he did (but charged him just the same).

My advise to him was very simple, swallow your pride, pay down the balance to $0 and sit on it for a month or so. Then check your FICO (and the bank card enhanced FICO score), give Wamu the finger and take you and your money elsewhere.

To anybody else in a similar situation, check out this link and this link.

Commentary

Wamu is clearly in the wrong by putting my associate on a wild goose chase, when they could of just come clean and show and tell him the details of the mysterious bank card enhanced FICO score. But they did not, in fact they deliberately refused to help him understand anything about the bank card enhanced FICO score and the conventional consumer FICO.

Banks are just making enemies of their customers by doing this, but they really don't seem to care. With the economy and the sensitivity to credit and credit reporting they should of been more empathetic to their customer. They get a wag of the finger and free coverage of their customer service shenanigans.

The living ID (who are you?)

2008-04-16T02:19:00.004Z

We are living in a time of changes. A time when information, or to be very specific, particular information will be the new currency of the underworld, Databases of personal data on simple machines that are to stupid to configure themselves, leaves the job to us who are just too lazy, giving job opportunities to Black-hat merchants.

Many universities have already been hit and compromised. The social security numbers, their corresponding names and most likely drivers license data or car registration.

Talk about the cost for an education. I cannot even say for sure if my own SSN was some where in that loop. In the school system, in the world system. It is now the Achilles heel of identifying citizens.

Our world, will no doubt run the gambit of attempting to find the "perfect" way to ID you and find the best was always the first solution.

From passwords to, biometrics to...passwords, again?

Why passwords? Well, for several reasons. First being I am scared as hell of letting just *any* monkey handle my DNA information. In the game of life, fuck if somebody knows my fucken social security number, if their is a problem with ID theft using, just the ancillary information about a particular entity. Just re-assign a new social security number, with NO ATTACHMENTS, to the original identity, hit the reset button no harm no fowl.

But to make, DNA or anything biometric the standard and something is compromised from your persons, like a few strands of hair for DNA or lifted fingerprints and have a decent lab nearby and presto, new ID lab that cannot be...disputed?

At least passwords are in your head, and if not too alphabetized, and some numbers and/or symbols thrown in for fun, and at least 6 characters, and you make it a mnemonic you will never forget your password and you never tell a soul (yes, I said everyone) then assuming reality is on even keel wit you, your ID should be safe...at least until quantum computers make the scene.

Electric Safe Cracking 101

2008-03-23T15:54:00.005Z

This was a image snap of an NKL INTELLISAFE, this is a Google search of the product. Bypassing this can come in two ways, a real brute force attack on the physical safe itself and/or controlling the digital interface to the device.

Bypassing the device electronically is probably the most uber, if you have to cut this with a physical blowtorch or laser cutter it may take more time than if you can seize control of the digital interface to the safe.

Here is a link to the details of the NKL AuditLok XLV. Could be a phun blackhat project.

Criminals Attacking Myspace, Facebook via/ IE attack plug-ins

2008-02-24T04:37:00.005Z

We all know the new methods of a black-hat attack, is to attack the user majority operating system and like it or not Microsoft is a victim of its own successes. By being the most popular "user friendly" operating system. It is the most targeted system of compromise by the professional...and not so professional blackhats.

Lets face it IE, is a blackhat's dream. A browser, just by visiting a web site can compromise the host system and gain root (or administration) access. I have several virtual partitions of all the different versions of Windows. One for Windows 95, 98, 2000, NT, XP, Vista. Only 2 Operating systems Linux and Mac OS X (BSD).

This slashdot.org story tells more.

Cell Phone Encryption Exploit

2008-02-22T21:04:00.004Z

Here is another exploit, for cell phones. Direct form slashdot.org of course encryption is only one of the methods of security. The details seem to be a re-discovery of prior methods of bypassing encryption. But you be the judge.

Quote:
Undetectable, 'passive' systems like the one that Muller and Hulton have created aren't new either, though previous technologies required about a million dollars worth of hardware and used a "brute force" tactic that tried 33 million times as many passwords to decrypt a cell signal. All of that means, Hulton and Muller argue, that their cheaper technique is simply drawing needed attention to a problem that mobile carriers have long ignored--one that well-financed eavesdroppers may have been exploiting for years. 'If governments or other people with millions of dollars can listen to your conversations right now, why shouldn't your next-door neighbor?' Muller says.

How is it that it caught on for the web (credit card payments over SSL), but still barely for personal communications (gpg, encrypted IM)?

That's a very good question.

One idea I've heard is that when SSL was first developed, the web was in its infancy and nobody really felt happy about the idea of sending their credit card details over it. The fact that it was relatively easy to eavesdrop on a computer network was fairly well known. This was no good to anyone who wanted to do business (OK, porn sites) over the web, and so SSL solved that problem by providing reassurance that nobody was eavesdropping.

The telephone system, on the other hand - that's been around so long that it's familiar technology and relatively few people are aware of how insecure it is. If you think GSM is bad (it's actually not that poor, and 3G introduces AES encryption), consider your land line. No encryption whatsoever and an analogue signal (so no computer equipment or specialised unusual codecs required to tap) between you and the telephone exchange.

That's a very good answer.

Cracking a Crypto Hard Drive Case

2008-02-19T18:51:00.003Z

This is an interesting story from slashdot.org

A label on the box reading 'AES' does not ensure that your data are protected. heise examined a hard drive enclosure with an RFID key that is typical of many similar products. They found that the 128-bit AES hardware encryption claimed in advertisements was in fact a simple XOR encryption that they were able to break easily with a known plain-text attack.

This means, that you have to do more than read the labels. To crack a XOR key is easier than cracking a AES key. Both encryption standards are available but because they are not well understood, one needs to be an expert on encryption to decipher and test the standards.

I would be wary of every vendor selling me a complete encryption solution. I don't know enough to make a qualified assessment if the vendor is on the level or even understands the seriousness of my security on my hard-drive.

I try to be objective with all the solutions that are out there. Also don't be afraid to try some new solutions yourself.

TrueCrypt 5.0 Released, (Encrypts Entire Drive)

2008-02-07T07:30:00.000Z

Any black-hat worth their salt knows about a popular open source privacy tool, called TrueCrypt. It has just received a major update, that provides the ability to encrypt an entire drive, prompting the user for a password during boot up.

This is a savvy and perfect encryption tool for non-technical laptop users (the kind who are likely to lose all of that sensitive proprietary data). For Linux users, the Linux version receives a nice GUI and independence from the kernel internals, and a Mac OSX version is finally available too.

Here it the word from slashdot.org on the story.

Manufacturing Methamphetamine...is it worth it?

2008-01-27T18:15:00.000Z

Chemistry is a pretty amazing thing. Almost anything can be created from it. Including illegal designer drugs. The chemicals do not recognize the law of the land. The economics of the drug trade will always influence if or not a drug is created, regardless of its legality.

Many hard lessons have been learned from aspiring amateur chemists that have decided that they can manufacture drugs on their own, without the blessings of a formal degree and without the sanctions of the major pharmaceutical firms that have had the FDA blessings of the governmental bodies that allow them to do so.

Methamphetamine is a drug that can be made in most makeshift laboratories. The profit margins on methamphetamine is much larger than those of marijuana. This is because marijuana takes time to grow, uses large amounts of electrical power, requires constant attention and sometimes large amounts of manpower to eventually harvest, dry and cure into the end product.

The margins are there, but they are greater for methamphetamine production. The real problem is the distribution and ultimately the end client. Marijuana clients tend to be less unstable than methamphetamine clients. At the end of the day, the extra profit margins created from methamphetamine production tends to be absorbed with the extra expenses involved with its distribution and complications involved with its extreme eccentricities with its client base.

Both products, methamphetamine and marijuana will yield acceptable margins of profit. Legally, marijuana (and its chemical extractions hash, THC oil, etc.) is a soft drug in most countries and may offer a grey-hat area of operation. Methamphetamine, is by and large a black-hat and mostly illegal in its manufacture outside of sanctioned pharmaceutical firms.

Both products must be produced in a clandestine fashion regardless of its legal state for a variety of reasons, that are not necessarily legal ones, but practical ones. Both products are worth money and can be bartered for trade goods and services as well as cash itself. Giving a mate a ounce of quality marijuana to work on helping with some yard work or painting a house can be better than giving the equivalent amount of cash to hire someone directly.

Methamphetamine can be bartered in much the same way, but it is wise to do this with caution as (as already noted), this client base tends to be more untrustworthy than a marijuana client. If for example, you give some meth to help painting your house don't expect to be surprised when you find you are missing your new PS/3, your wife's jewelry and your rolex.

So is methamphetamine manufacture really worth it? I would say, yes. After all it can be prescribed by a doctor for "legitimate" reasons and if taken in moderation it may be helpful in late night construction projects, house cleaning and maybe weight loss. The real question is distributing and dealing it worth it?

Well, yes and no.

Yes, if you are able to sell it to a major distributer in bulk and let them deal with the dealing. No, if you intend to produce AND distribute AND deal yourself. The legality aside, the clients are probably nobody one would want to deal with on a regular basis, but rest assured they will want to deal with you.

Vladimir Levin, the new breed of Blackhat

2008-01-27T02:25:00.000Z

Vladimir Levin is perhaps the greatest known bank thief. He was smart. A mathematician and had a degree in biochemistry from Saint Petersburg State Institute of Technology.

In 1994 Levin accessed the accounts of several large corporate customers of Citibank via their dial-up wire transfer service (Financial Institutions Citibank Cash Manager) and transferred funds to accounts set up by accomplices in Finland, the United States, the Netherlands, Germany and Israel.

Here is a artical from Byte:

Bank Robbers Go Electronic

November 1995 / News & Views / Bank Robbers Go Electronic

Udo Flohr
Bank robbers are trading in their firearms for a new weapon: computers. And although companies are usually reluctant to admit embarrassing rips in security, Citibank (New York, NY), the banking division of Citicorp, has upgraded all security procedures following a breach of the bank's cash management system. In a series of break-ins, the bank's payment system was compromised (perhaps with inside help ) for no less than the hack of the century: more than $10 million. (The bank says it eventually recovered most of that sum.)
Citibank is not the only bank to suffer from electronic burglary: Security expert Arnaud de Borchgrave estimates that in just two months this year, about $300 million dollars has disappeared, electronically, from U.S. banks.
In July 1994, Vladimir Levin, a mathematician in St. Petersburg, Russia, befriended a former St. Petersburg bus driver who had turned entrepreneur in San Francisco, according to recently unsealed court documents. Levin allegedly told his new friend he had found out how to wire-transfer money out of Citibank's computer system. Twice already, he allegedly bragged, he had squirreled substantial amounts into his own account in Finland. Court documents say Levin's colleague became a partner in what would become a multinational hacker ring.
Just a few weeks later, transfers were made to BankAmerica accounts held by Primorye (roughly translated as "Shoreland" in Russian) Corp. and Shore Corp., both of San Francisco. The companies were owned by Levin's friend Jevgenij Korolkov.
By this time, Citicorp officials had begun to suspect foul play and started questioning Korolkov. Korolkov left the country but apparently was not deterred. Instead, the two pressed on and recruited new partners around the globe, authorities say. By Oct ober 1994, 40 more transfers were made to California, Israel, Germany, Holland, and Switzerland.
Levin, who was system administrator at AO Saturn, a St. Petersburg software house, has been advised by his attorney not to speak to the press. But court documents allege he accomplished the illegal transfers by dialing into Citibank's cash management system. The system allows Citibank customers to initiate their own fund transfers to other banks; daily turnover is about $500 billion. Authorities say that to avoid causing suspicion, Levin dialed in from his house in Russia late at night. Conducting transactions during New York business hours would less likely raise alarms.Levin apparently used valid user IDs and passwords of other banks, among them Banco del Sud in Argentina and Bank Artha Graha in Indonesia. How he got those passwords, given Citibank's extensive security, is unclear. Inside help seems likely, but Citibank claims that no employees were involved. Citibank officials declined to discuss their se curity procedures with BYTE, but a spokeswoman said that the bank continuously evaluates and improves its security measures.
According to Citibank, its security system flagged two August 1994 transfers, $26,800 and $304,000, as "strange." Bank officials called the FBI, who observed the electronic interlopers as they made their illegal transfers. U.S. officials were also assisted by telecommunications employees in Russia who helped track the illegal fund transfers to St. Petersburg, according to published reports.
Citibank claims it recovered most of the approximately $10 million in illegal transfers but says perpetrators were able to withdraw "less than $400,000" before other banks were notified and able to stop the transactions. Officials also say that at no time were any client funds at risk.
In March, Levin was arrested in transit at London's Heathrow airport. At presstime, he was fighting extradition to the U.S. from England. U.S. authorities want to try Levin on charges of theft, forger y, and computer fraud. Levin's attorney, Colin Reynolds, told BYTE that Levin wants to return to Russia. Five alleged accomplices in other countries, including Israel, the Netherlands, and the U.S., have been arrested.

Dunbar Done Broke Down

2008-01-07T22:38:00.000Z

We spotted this while at Starbucks. I had to get a shot in. A 3 crew compliment. 2 guards checking out the engine and 1 guard sitting in the vehicle.

Too bad things like this can't be predicted, could of been a easy hit. Armored heists are not as easy as it would seem even when they do break down like this.

The most dangerous weapon the guards have is not their guns...but their radios. They can call for help and assistance to them will be short in coming. Of course there are no hard numbers on a typical response time. But I would not suggest a strong -arm operations lasting more than 2-3 minutes.

Jamming the radios with military grade radio jammers (the same kind used by our US forces in Iraq) could silence all radio and cellular signals within about a mile radius. The only thing for a professional black-hat crew to do is to out number and out gun the guards.

With no radio or cellular voice to call for backup, the guards may consider their $15.00/hour wage vs/ their life, a prospect that they may seriously take into account when determining a course of action.

DMT Extraction

2007-12-28T22:41:00.000Z

This is the stuff of the Gods. Crystals of such hallucinogenic power that it will blast you into the realm of Aliens, Faeries and Unicorns.

The trip is 10 minutes but the effects are very transdimentional. Often called a business man's trip, due to its short term hallucinogenic effect. Unlike shrooms or LSD which can last from 24 hours to sometimes several days depending on the dosage.

I am including a really nice tutorial link that will explain the details on extraction of DMT.

Grow-Ops on the rise

2007-12-26T22:34:00.000Z

This was a operation that turned in 120 days, plants have been harvested and sold netting a total of 20 pounds @ $5,000.00 a pound $100,000.00 was made in total and $20,000.00 was re-invested in another grow-op at another location.

The operation was done in complete secrecy for a period of 4 months before any hint of product was sold to anyone. During the last month of the grow-op, a dealer asset and a courier asset was activated. Each asset given only drop point data, a time and place to pick-up or drop-off the goods, none of the activated assets know each other directly.

Each activated agent assets are given the following compensation. For the Dealer an additional a pound of high quality bud each (valued at $5,000.00), for the courier a 1/2 pound of bud + a % of sales up to $2,500.00.

The dealer has the most flexibility income possibility in creating additional revenue from an additional pound of bud. The courier, is given cash and only half a pound of bud for services rendered. The courier is more limited in selling the product, the courier and the grower are to be abstracted from any and all front end-sales for security proposes specifically not to be marked by an undercover agent.

Dealers, are exposed to selling to the public and take the highest risk of exposing oneself to Law Enforcement and undercover agents. But even if discovered (and trailed), the dealer has no direct relation to the courier that drops off and picks up the goods, and if the courier is some how skip-traced, then the grower must also be skip-traced. Since both are never involved with selling the product to other people they are never connected to that crime.

Tactics such as these are only one of many that are in common use. Some type of method should always be used to avoid direct distribution and selling of the grow-op product.

Grow-Ops 101 (core construction)

2007-12-25T17:58:00.000Z

Internal construction should be simple and elegant, no unnecessary items should ever go in a grow room. Keep rooms air tight if possible to eliminate any possibility of any type of infection from molds or other unwanted parasites.

K.I.S.S. Keep It Simple Stupid

This is a 6 square meter room, 3 square meters (18 square feet, 9 square feet for cultivation of the actual grow product) so only half will be used to actually grow the crop.

This operation has (3), adjustable, 600-Watt HPS lamps altho this has less lumens over all in contrast to a 1,000-Watt HPS it provides for more area being covered over the plants for less money.

This operation must keep everything off the ground and must be attached to the wall or ceiling. Attention is payed to ventilation, often time a grow-op set-up overlooks this in favor of lights, water and pumps but it is often important and must be considered with equal importance when designing the layout for any grow-op.

As an added precaution, it is wise to put Infrared Defeating material on the ceiling to obfuscate any ambient heat radiation given off by the heat from the lights

You may not have any problems if you do not install Infrared Defeating material, but as the DEA and Police become more desperate to seek out grow-ops they will eventually resort to fly-bys in suspect areas.

Hydro

This is a full scale Hydroponic operation. Soil has been suggested but Hydroponics will reduce yield times and allow for a more efficient model of operations a quick turn around time is required and hydroponics has been reported to increase yields and speed up the time to harvest . Hydroponics, does in-fact, require a bit more experience but it also allows for greater yields if a superior strain is grown through it.

Each Hydro unit provides for the cultivation of 10 plants. Keeping units to factors of 10 one can adjust the amount of plants depending on the constraints of our grow environment.

AK-47 x G-13 clones
This is from a special strain crossed with AK-47 to minimize the time to harvest. AK-47 has been breed to flower in 47 days, we have crossed this with the G-13 strain, our goal is to yield a strain with a 30% THC level. Currently our super mother has a 20% level of THC.

This created strain roots like crazy, this is the 6th day of germination.

Tiger Teams on Prime time

2007-12-19T16:38:00.001Z

Court TV soon to be Truth TV is doing a reality show on black hatting. This is a interesting show and the radio interview is entertaining.

These of course are professional privateers black-bagging for the queens gold. Instead of stealing her gold directly. Funny thing is if you don't label yourself as a consultant in security you may well be labeled as a felon. They seem to do the full gambit of the hack. Including multiple person infiltration, timed attacks, social engineering and the works.

They mentioned banks a few times, and relayed a shot story about coming in after everybody left and was able to get in when the cleaning crew was cleaning up. I think it will be neat to see this televised.

An interesting Xmas gift as it is set to air on Christmas.

A Bust

2007-12-18T17:20:00.001Z

I have had the honour and privilege to meet with one of the casualties of the drug war. For the protection of this person I will refer to him as Mr.X (located in a remote Vista area). Mr. X had about 40 plants at the time of his bust and 40 plants at another location somewhere in Carlsbad area.

According to our research it was a multi agency bust that included the DEA and local police. According to my sources Mr.X was growing for about 2 years at his current location but it only took about 3 months of observation and surveillance before they made a move on him.

Upon speaking with Mr.X, he disclosed some operational mistakes to me. First and foremost dealing from the grow house (an absolute no-no). It was also revealed to me that he had an informant in his circles. He told me he didn't tell a soul, but dealing from the house you are growing at would just be an open invitation. Mr.X did not have a retained lawyer, so when the hammer did come down it tapped all of his resources and forced him to borrow around $10,000.00 in legal/bail fees.

Mr.X is also affiliated with the people of influence, so for him it is not as bad as a Johnny nobody getting busted. The last "report" I was able to gleen from Mr.X was that the DEA was eying some places in San Diego for yet another raid.

from 40 plants...he was able to yield 5-6 pounds. The medical "limits" in California are 12 plants and registration as a provider.

Lowryder

2007-12-13T20:17:00.001Z

Lowryder is a unique variety of the cannabis strain that will dramatically expand the range of possibilities for aspiring, amateur and professional Cannabis growers and breeders. Aptly named for its low profile (both literally and figuratively), Lowryder, and its more stable strain Lowryder #2 was developed for extreme rapid growth (8-9 weeks from seed to bud!), uniquely short height (will grow no taller than 17-19 in!). Passing directly from the seedling to the flowering stage, Lowryder altogether does away with the vegetative growth stage. A stage of cannabis production that mandates utilizing separate grow rooms that toggle between the vegetative (non-flowering stage) and the flowering (bud producing stage)

In short, you plant it, it sprouts, grows a set of leaves, then immediately and automatically begins flowering in 17 days for male varieties and 20 days for female varieties. As a result, it is the quickest, most compact, and most easily concealed plant available.

For indoor cultivation, The Lowryder strain completely eliminates the need to induce flowering by reduction of day-light hours, thus, it eliminates the need for a timer for grow lights. It will grow consistently well and finish under 24 hours of

light, from sprouting to harvest, in a mere eight weeks. If you need to conserve on the electric bill you may be able to achieve similar results with 18 or 12 hours of light per day, 18 hours light straight through until harvest is a good compromise that won't diminish bud production

One of the disadvantages of Lowryder, having no vegetative stage, is that it can’t be cloned or regenerated, as conventional Cannabis plants can be. Replanting seeds is a must. So male plants become somewhat important to produce more seeds to grow more product. Males become slightly more valuable for this purpose. The same rule applies as in conventional grow-operations, female strains are more valuable for smoking but at some point Males are required to produce more seeds.

The clones versus seeds debate is a subject for another article but the fact remains that seeds are much easier to transport and handle and generally have a higher success rate.

If you must plant Outdoors, Lowryder can easily be kept concealed because of its tiny size and early flowering, whether planted in fields, in gardens, on patios or even on windowsills.

The unique characteristics of Lowryder (and Lowryder #2)'s final appearance, taste, and high, have nothing to envy of the finer weed varieties, an excellent smoke with high potency and amazing resin production. You almost have to see it grow before your own eyes to believe it, but the proof is here. Lowryder is 100% stable and reliable in its properties, a product of nine generations of selective breeding, and better still it is non-deviant and hermaphrodite-free.

Genetically, Lowryder has direct descendant from another cannabis strain called superior William’s Wonder and Northern Lights no.2 indica, while keeping the identity of its third, more exotic ruderalis-type ancestor a secret. Lowryder’s unique genetic signature has practical advantages for amateur botanists and professional growers alike.

There has been many reports of great success in growing indoors and outside across the world and getting from seed to bud in 60 days. Although the bud yields are tend to be much lower than more common commercial strains, its ease of growing and the quick turn around means that you can have a continuous supply of fresh bud all year round. Also, growing for seed is a much less arduous task when the turnaround is only 2 months.

LED vs High Pressure Sodium

2007-12-10T03:28:00.000Z

This is an exciting prospect for grow-ops. We have been researching this for a while. Lights are an important piece of equipment, but the draw on electricity also make lighting very expensive (potentially drawing unwanted attention to the operation). The technology is young and unrefined, but as a nice perk, the electricity utilization can be cut almost 90%.

The major disadvantage, is that it only allows a specific spectrum of light to be exhibited, this is not altogether a bad thing since flowering of cannabis product requires the red/orange spectrum something the High Pressure Sodium lights provide, but at the cost of excessive heat (wasted energy).

This is not a call to dump the High Pressure Sodium (HPS) lights (yet), more refinement of the Light Emitting Diode (LED) is certainly required, the price will certainly go down as the LEDs become more prevalent. Cannabis product that is grown will be profitable regardless, and when the LEDs are ready to take center stage the profit margins will defiantly increase.

Check out this wiki link for the results of the current research.

http://en.wikipedia.org/wiki/Indoor_Cannabis_cultivation

Banks

2007-11-04T01:52:00.000Z

Nothing is sexier than Bank jobs. All that money, just sitting and waiting for the truly entrepreneurial mercenary.

Some would even argue better than dealing drugs, as a Bank job is a one time appointment and dealing drugs, tends to be an ongoing grind in dealing with the public to sell your wears and the head ache of skirting around undercover narcs who enter your exposed circles.

Last I checked the tellers or bank managers are not typically armed and even the security guards tend to be easy to over power and defeat.

With money comes options and the Banks tend to have a nice supply of options.

Communications for the Underworld

2007-08-20T01:31:00.000Z

This is the Cryptophone, developed specifically for the Uberhacker and the community of shadows.

Offers full-scale encryption over cell phone with full source code available for independent review. I have yet to see any SDK (Software Development Kit) for it though.

At its core it provides for encryption algorithms - AES 256 and Twofish. To its downside it runs on Windows CE as opposed to Symbian, but between those two commercial alternatives I am unsure which is the lesser of two evils. The decided that a embedded linux approach was not commercially viable enough.

This is an interesting approach to underworld communications. I like the fact that they address the needs for core encryption, but housing it on a vulnerable operating system for the basis of getting a larger consumer base may be problematic for a professional criminal.

What about pre-paid phones?

No (real) name or contract data. But they will certainly try to get it. Just refill minutes or buy a new phone all together. Its a bitch to deal with tracking your minutes but its disposable and generally non-traceable.

Certainly good for alternative and emergency communication. Speak in code, or a thieves' cant and you should be fairly innocuous to the spying eyes of the government.

Bottom line?

Know that any technology you have to conceal yourself they are working hard to find a solution that reveals all. But the "diversity" of technology forever puts a cat-and-mouse play into effect. No one the cat or the mouse is ever in the fore front for very long.

The Grow Show

2007-06-09T17:17:00.000Z

As promised, we take a exploritory mission to discover clandestine grow-ops through out the world.

This clip was taken from the Crime, Inc. headquarters. This operation, started in 2005 paid for itself in 6 months, the clients decided to liquidate the assets in 2006, bringing a complete profit of just over $800,000US.

$10,000US was the original investment, divided into the $800,000US, leveraging a profit of 8000%

When I last interviewed the "clients" they just purchased new passports and invested $500,000 of their proceeds in pharmacutical stock.

Grow-ops: somewhere on planet Earth

2007-05-17T00:12:00.000Z

I started going around to film clandestine grow-ops. As an independent research project and for fun.

This small project was my first shoot. The grower who I will name "Mary" started this from a bunch of unknown seed strains she received from a friend. She used a 1,000 watt High Pressure sodium (HPS) light to cover all of her 22 plants.

This was her first grow to actually get to the flowering stage after 2 previous. One of her crops were afflicted with root rot from over watering and the other was afflicted with Algae.

Mary started with ambitious attempts to go Hydro right from the start. But with 2 kids and a full-time job, she was unable to be very attentive to her first crop and as a result
lost about $500 dollars worth of good genetics (G13 and Blue Mystic).

She was able to acquire a bunch of seeds from a friend to start yet another crop.

Cost of growing, profit from Knowing

2007-05-14T21:32:00.000Z

Ok, grow-ops are a profitable way of scoring some coin in the realms. The Lords of the Land (i.e. the Feds) will often scour the realms searching for *anybody* who gets too comfortable with this business.

By comfortable I mean lazy and non-diligent, for fucks sake, realize that growing the required plants to yield 3-5 pounds @ $5,000 a pound is going to profit you $15,000-$25,000 per harvest. It would be very foolish to get lazy and complacent. The feds, get their coin off of big busts so grow professionally and be mindful of how you approach this business.

Now, as a matter of fact, keep the logistics of your operation a secret. I cannot emphasize this enough. Many an aspiring grow-op farmer has been done in by lovers, "friends", and business partners who desired to eliminate their competition by eliminating you.

If you *must* have partners or like a few of my friends required them for the components to grow in the first place (i.e. gave you the seeds, provided the environment, etc.). Then it is best to have a complete understanding with them.

Even with this understanding, as soon as you are able, break away and become an independent. That means, seek ways to finance a grow-op on your own. This is not to undermine any partner you may be involved with, but to secure yourself against unforeseen problems, betrayals, busts and unwitting drama involved with the money a grow-op will yield.

In a word automate.

I have seen many grow-op farmers get tangled up with complete fuck ups only to be busted when a completely benign issue turned into a blood feud. Greed got them *every* time. This is weed we are talking about, and it grows to churn out its buds constantly regenerating new plant matter for the next harvest.

But I have seen "partners" betray and fuck over my friends like this plant would never yield its fruit again. Stealing the crop, selling it to anyone and pissing away the profits on self indulgent bull shit. Rather than helping harvest and re-cloning, selecting exclusive clients to sell to and re-investing a portion of the proceeds for a bigger and more profitable harvest.

It is hard, when starting this to know who is going to be a savvy professional and who is just into it long enough to cut and run. Its bad enough, to be on the look-out for the DEA, FBI, Police, nosy neighbors, etc. than to have to worry about the people within conspiring to fuck up the operation.

Be smart, don't trust just anyone and approach potential partners with a bit of skepticism and a understanding that the more pieces to the operation the more chances for failure, but without *any* pieces it will be hard to make the puzzle of grow-ops complete.

Grow-Op Risk Assesment...is it worth it?

2007-05-10T18:51:00.000Z

In a word, maybe.

Depends on your stomach for that type of work.

From a money point of view, certainly. Think hard on this one, when the alternative is going out and getting a regular job which you will probably hate anyway when the boss plays favourites and you have to swim in a politicking quagmire, just to be enslaved for 8-10 hours a day, for a pay check that comes at the end of the week and when the pay check finally does come in 33% of it is per cured by the tax authority and the other 66% is left to the real monopolies of life, rent, food, car, insurance, etc.

More often than not alternate income, off the books, is always better. Just one obstacle is in the way, the competitors.

When you have an operation that grows $5000/pound of products, Keeping it a secret is imperative. As with any business, secrecy of its sources give a decisive edge on the advantage one has on the market.

Obviously, the legal authorities (police, DEA, etc.) can never be told, for any reason (period), as far as family, girlfriends/boyfriends and the like consider this... Most of the volatile situations stem from "close relations" and are the direct result of the money being made. If you are so independent and well-off enough as to not have any partners in a grow-op arrangement, then you have the best situation. But like most of the grow-op operators in the area one must make certain compromises and consent to limited partnerships for a variety of reasons.

Maybe you have no access to a secure growing facility or maybe you have no equipment/seeds to facilitate the grow in the first place or no capital to invest properly in a grow-op.

For this, one may have to find like minded partners. This is dangerous if not done with a complete understanding of what is to be expected. Make these arrangements with as few and the most trustworthy people who are savvy to the endgame.

Mistakes made at this level will compound themselves later. For example a friend that gave you some seeds may expect a disproportional amount of the finished product. This happened to my friend Mary, a grower who got some unknown strains from her girl friend and after everything was vegetated, flowered, cured and ready to be sold expected the entirety of the crop for her own sales and personal stash. Mary's girlfriend, conveniently ignoring the thousands of dollars in equipment (1,000w lighting, carbon scrubbers, electricity and rent paid) Mary spent out of her pocket to run the gambit of the grow-op. When Mary protested and explained to her girlfriend that her expenses needed to be covered first her girlfriend threatened to call the police on Mary to bust her operation if Mary did not consent to give up her crop.

Mary had no choice but to move her operation in its entirety to another undisclosed location, break up with her girlfriend and re-assess her partnerships in the future.

Fortunately for Mary, her son secretly sold 2 pounds of her marijuana for $10,000 in cash before Mary's girlfriend was able to carry out her threat. With that capital she was able to secure another location with relative ease.

Mary was lucky in the fact that she was able to break away clean, not many people are this lucky. But without the aid of her son she would have had to eat her loss and endure the demands of her EX-girlfriend. Mary now has a partner she can trust her son.

There are ups and downs in any arrangement, so be careful in this business.

Drug Bug

2007-05-04T15:19:00.000Z

A clandestine project of measurable worth is a marijuana grow-op
. It can be argued that more "profitable" drug operations exist, such as meth labs, however certain "drugs" attract certain client types.

The more extreme drug operations, like meth offer a very addicted type of personality and hence they would goto extremes to acquire the meth product, often attracting unwanted attention and trouble. Often, the most desperate meth users will cooperate with law enforcement to stage a sting operation just for a few quick fixes.

Needless to say, for now, Marijuana is in a very unique quasi-legal position in some states in the US and in some other countries quite legal. In the US, however, a savvy black-hat will treat any grow-op with the highest secrecy and care. Even though marijuana is virtually tolerated in the more enlightened circles, the DEA spares no expense to bring down a 9-10 million dollar operation of 1,500-2,000 plants.

links

DIAMOND BAR, Calif.

415 Mount Shasta Drive in Norco, Calif.

Inland Empire, Calif.

RANCHO CUCAMONGA

Corona area

If you are lucky enough to have a "safe" place to grow that is half the battle. Proper gear, lights, containers, pumps, timers, fertilizers, and of course the most important, proper seed and or clone stock must also be acquired.

Time, is the key as well, to initialize a grow-op is an easy 90 days to harvest with subsequent days less and less depending exactly how the initial setup was implemented and if clones are replicated successfully.

You should be in a position where you can make a substantial investment in time and money. Like a traditional business it is going to require an investment of capital as well as an investment of time. Unlike a traditional business, your ROI (return on investment) can be very lucrative in a short period of time 6 months to yield a profit as opposed to 2 years to just break even.

Study this carefully, and choose your circles wisely. Don't include any untrustworthy people and for the love of God DON'T sell where you grow.

We are living in very tough times anything that makes enough money to live comfortably will be scrutinized and made illegal. If it is legal, you will need an army of professional thieves (aka Lawyers) to defend your wealth quite possibly for the rest of your life.

In the end going legit is more trouble than its worth, but some times, necessary to keep in the clear. It is better to have a two fold approach, use grow-op subsidies to invest in legitimate operations.

If you choose to go into a pure black-hat meth drug lab, you will be going into the mouth of hell itself as the clients are usually derelicts who would just as not put a bullet into your head for a few more grams of the shit you be selling.

WiFi Riders

2007-05-01T05:56:00.000Z

It was night time when I called the crew to go war-driving over the weekend. To scan and to map-out Access Points (AP) or Network Nodes as I call them.

It was a dry run, and I did not expect much. I was only interested in the usual black-op targets. Banks, DMV, Police Stations, City Hall, Legal firms, ISP providers, Insurance Companies, Doctors Offices. Each target was a crap shoot on vulnerabilities, and each target had a specific objective and work order assigned to it.

Banks, well, attacking a bank network it the crown jewels of the profession. Banks of course have the money and business information that every black-hat worth her salt would love to have at her disposal a very juicy acquisition.

DMV, Department of Motor Vehicles. Well aside from being the main place to acquire identification and information on the registration of vehicles. Weak databases and dummy terminals make it a nice network to own and keep control of.

Police Station, simply knowing you opponents system and finding personal data on these networks is worth its weight in gold. Police have access to criminal and personal data of everybody they query, it is only wise to have access to personal data on them.

City Hall, while at first would seem a useless acquisition, there are kernels of very interesting information on these networks, most businesses that have existence in the city province will have some type of legal records there, business licenses and the like, by themselves uninteresting but when crossed with other targeted data very helpful indeed.

ISP providers, Internet Service Providers, small mom and pop wireless firms give a finger on a rather large customer base.

Legal firms, Lawyers networks have decisive advantage in the legal arenas, even when working outside of the law it is imperative to know the "technical details" of the legal practices.

Insurance Firms, detailed information on these firms can be very lucrative to the right client.

Doctors Offices, Having a tap into the legal drug dealers is a savvy lateral move to the drug business in its entirety. Typically these offices have ins to major pharmaceutical networks that can bring solid intelligence on the shipping logistics to coordinate strong-arm attacks on potentially millions of dollars worth of "legal" drugs.

All in all this was just a information gathering run, a total of 673 vulnerable WiFi points were targeted, further tests must be conducted to verify the details of the networks and crack them.

The "professional"

2007-04-07T04:50:00.000Z

Now before any body gets into trolling this blog, telling me how stupid it is for writing about criminal activity. I want to make it clear that this is not my personal journal of any heists or the like, I would never let anybody know of any activity that would incriminate me or my fellow henchmen.

Think of this, blog, as more a manafesto of professional crime and personal thoughts and rants on the subject.

To be read by all, to learn about the modius operandi of the professional criminal. So all of the Police, FBI, CIA, DEA, IRS mother fuckers who read this thinking they have a live one know this.

My name is legion and we are many.

Now to the business...

Developing a method of obtaining a proper funding source for a "professional" lifestyle has proven to be difficult, even for a simple mercinary making his way in the universe. The line between right and wrong, good and evil, legal and illegal has always been a blurred one.

Doing gigs for clients is one way, even nefarious ones sometimes does not pay well. So an aspiring "professional" needs to be resourceful, smart, level headed and even alittle insanely paranoid to merely exist in a world that wants to control the masses of the post 9/11 world.

Living in a deadzone or an area where either paying clients are in short supply and even legitimate employment prospects are slim to none. Sometimes even a savvy blackhat must resort to more conventional means of developing revenue.

So, what are some ways to make underground money?

The manufacture and distributation of drugs is one of those ways.

This is, of course, illegal and has consiquenses attached, specifically jail time. But this manifesto is about business and a truthful relation to it. The bottom line is and will always be the bottom line and without capital, specifically large amounts of it the hardships of life become more apparent.

The image of 207 million dollars in cash was taken from a drug bust in Mexico. No doubt, somebody lost their life because of this. This cash is enough to buy alot and do just about anything one would want to do. You will never make this amount through legitimate operations.