Virtual Lab with VMware

http://www.ethicalhacker.net/content/view/63/2/

By EH-Net Member Negrita

Some of you reading this may be studying for Certified Ethical Hacker (CEH) or perhaps some other certification at the moment. While reading the study material and installing some of the tools on a box may suffice for some, others would prefer to have an actual lab to do their penetration testing. Buying separate boxes for all your Operating Systems (OSs) can be quite expensive, and may deter some people from wanting to do certs in the first place (unless someone else is paying for it). Thankfully there is a cheap solution to all this and you can get to learn some new things on the way.
The Exam Prep CEH book by Michael Gregg (which I'm using) recommends using at least 3 boxes; a Microsoft Windows Server, a Microsoft Windows Client and a Linux Client. After getting into things, Michael Gregg recommends installing a Linux Server too, as these are the systems you'll most probably be working with afterwards.
Virtualization is a method of using "logical" computers as opposed to using physical ones. To simplify my last statement, this means that you can install a virtual computer to run on your physical box as if it were an application. While there are a few virtualization software vendors in the market, the 2 main players are VMware and Microsoft. Some of the others include Bochs, PearPC, Parallels, SVISTA and XenSource, which are all open source. Check out this comparative table with a much fuller list. In this tutorial, I'll discuss how I've used 2 VMware products to set up my lab. The first is VMware Player and the second is VMware Workstation. I'm certainly no expert on virtualization or these tools, but I'm gladly sharing with you all how I set things up for myself, in the hope that it will help some of you too or at least give you an interesting read.

Before getting started, there are a few facts and some terminology you should know about virtual machines;
1. The main Operating System on the box is known the "host", while the virtual computers running on them are known as "guests".
2. A guest with a disk drive of say 4Gb will create a file of 4Gb on the host OS. Make sure you have enough disk space.
3. The guest OS uses RAM taken from the host. Before running a guest OS on the host, you must make sure you have enough RAM to support both/all OSs running concurrently.
4. A 64-bit guest OS cannot run on a 32-bit host OS. Make sure the guest OS matches the host's CPU.
5. Most importantly, YOU MUST HAVE A VALID LICENSE FOR ALL OS'S RUNNING ON YOUR SYSTEM. For example, if you have a Windows XP guest running on a Linux host, you must have a valid license for both OSs (Yes I know Linux comes with a GPL copyleft). Just because the XP machine is virtual doesn't exempt it from needing a license.

One of the tools I use is called VMware Player, a FREE application that allows you to run predefined virtual guests, which can also be downloaded for FREE. All the FREE virtual machines offered are obviously open source. VMware Player can be played on Windows 2000 Pro and Server, Windows XP Home and Pro, and also Windows Server 2003. It can also be played on various flavours of Red Hat Enterprise Linux, SUSE Linux, Mandrake Linux and Ubuntu Linux.

After downloading and installing VMware Player, you'll want something to play on it. Go to the VMTN Virtual Appliance web page and look through the list of virtual appliances available. You can choose from a wide variety of regular distros like Kubuntu, Gentoo, Debian, Fedora Core, FreeBSD, etc. A very large variety of tools and applications can be found like VPN servers, proxies, firewalls and scanners, and Nagios and other network monitors. Of particular interest to the hacking community are the specialised security appliances such as BackTrack. When downloading a virtual appliance take note of the primary accounts (root) username and password which should be on the download page.

One particularly useful appliance is the LiveCD Virtual Appliance which as the name suggests, allows you to play a live CD. You don't actually have to have a CD in the tray for this to work, but rather the live CD's iso image which must be placed in the same directory as the LiveCD Virtual Appliance. The iso image must be renamed "livecd.iso" for it to work.

Now that you've got your favourite linux distro running, you may start to wonder about the Windows part of the test lab. Surprisingly there is a FREE and legal solution to all this too. VMware Player will only play preinstalled virtual machines, but to create those virtual machines you need a program like VMware Workstation (which I use) or VMware Server. VMware Workstation comes fully functional with a FREE 30 day evaluation license. Once installed, you can use it to create as many virtual machines as you like. The list of supported host OSs is similar to that mentioned above for VMware Player, but the list of guest OSs includes practically all versions of Windows from Windows 95 to Vista including both 32 and 64-bit options, and also a variety of 32 and 64-bit open source OS versions and flavours such as Red Hat Enterprise Linux, SUSE Linux, Mandrake Linux, Turbolinux, Ubuntu Linux, Sun JDS, Novell, FreeBSD, Sun Solaris and other custom Linux installs with a 2.4.x or 2.6.x kernel.

Microsoft will let you download and install a 64-bit version of Windows XP Professional together with a 120 day evaluation license, and a 32 or 64-bit version of Windows Server 2003 together with a 180 day evaluation license. This should be more than enough time to study for CEH and probably a few other certs too.

Adding a new virtual machine is as simple as clicking File>New>Virtual Machine, and then following the instructions of the wizard. First choose if you want a typical or custom install. You will be prompted for the type of OS, the virtual machine's name (i.e. Win2K3 No.1), the machine's location on the host OS, the type of network connection (more on that later), and the capacity of the guest OS hard disk. You can change the amount of RAM the guest uses amongst other things, by clicking on "Edit virtual machine settings" afterwards. This can also be set, by choosing a custom install from the wizard. The custom install will also allow you to use a guest with 2 CPUs. When choosing the guest's disk size, leave enough space for the OS install and for the tools you'll want to install on it afterwards. I find that 4Gb is more than adequate. Next put your install CD in the tray and click "Start this virtual machine". The install is just like that of a regular OS. You can install and download as many virtual machines as your host HDD can hold, but remember that if you don't have enough RAM, you won't be able to run them all concurrently.

After downloading and installing all the guests you want, you'll want to connect them together in a network. When you install VMware Player or Workstation, the application will install 2 default NIC's on the host. The first is called VMnet1 and the second VMnet8. The NICs can be enabled in 3 different modes; Bridged, NAT and Host-only. When installing a new guest, if you chose a typical install, the install will default to Bridged mode. Host-only mode will not allow the guest network access. Most of the virtual appliances I downloaded had been configured to use VMnet8 in NAT mode, which gives the guest OS access to the internet via the host's network connection, so you can surf the internet, and download tools and updates. On each guest I configured a default gateway of 192.168.42.1 and an IP in the 192.168.42.0/24 range. I then pinged the default gateway and some of the other guests to test the network connectivity. This can also be configured using teams. I'm no expert on teams, but more info about them can be found here.

Finally a few words must be said about VMware Tools. VMware Tools is an all-important add on application which allows many things, such as support for faster graphics performance, synchronizing the clocks between the host and guest OSs and also supports file sharing and drag-and-drop features between the host and guests. More info about VMware tools can be found here.

As I've said earlier, I'm not an expert on these topics and they are provided as-is for your use and knowledge. I will gladly receive criticism and comments in the corresponding post in the forum.

2012 cyber crime predictions: More arrests and Willie Sutton 2.0

http://www.scmagazine.com/2012-cyber-crime-predictions-more-arrests-and-willie-sutton-20/article/219808/

In 2012 we will see more high-profile arrests of cyber criminals and more botnet takedowns, but that's just my opinion, and only one of many predictions being aired as 2011 winds down and the world looks forward to 2012. When you spend most of your time researching various aspects of data security, like malware and cyber crimes, you quickly learn that predictions can come back to bite you, hence the reluctant prognostications of my colleague David Harley, which sometimes veer toward the tongue-in-cheek. However, unless your personal or professional circumstances are such that you can afford to eschew any kind of planning for the future, you need to make at least a few “best-guess” assumptions about what lies ahead.
Although I do think that the coming year will bring more law enforcement efforts to fruition, as a wide range of agencies continue to work together to take down cyber crime operations, I'm sad to say that I see no immediate shortage of criminals willing to take a chance on cyber crime. After all, those chances still look pretty good. The risk of serving time for cyber crime, or getting injured during the execution thereof, is still incredibly low compared to more conventional crimes like walking into a bank and demanding money at gun point. And the rewards are very enticing.
Consider the crime ring busted in 2011 by Operation Ghost Click. According to the FBI, infected computers were used to generate “at least $14 million in fraudulent advertising fees” over a period of four years. Seven people were indicted, but even if the scam involved twice that number, the loot works out at $1 million per person, with almost zero risk of being shot while committing the crime. Compare that with the risky business of robbing a bank. I looked at the FBI's Bank Crime Statistics going back to 2003, and did not see a single year or calendar quarter in which the average take from a physical bank robbery in the United States exceeded $10,000. In some quarters, the average value of stolen bank loot – the FBI actually uses the term "loot" – was below $8,000.
Remember the “scareware” bust earlier this year when the FBI and law enforcement from at least 10 countries worked together to expose a scam that infected 960,000 computers with fake anti-virus software? That cyber crime project cheated consumers out of more than $72 million over three years. If 24 people were involved, that's $1 million per person per year. The smart money is clearly on cyber crime, particularly since you don't need to be smart to commit such crimes.
Consider SpyEye, this year's break-out product in the “easy-to-use botnet builder” category, complete with plug-and-play bank account hacking modules. A big clue to the target demographic for this product, apart from the slick app-style interface, is the feature that cleans up after that most embarrassing of newbie cyber crime gaffs, infecting your own machine with the malware you're trying to distribute.
Perhaps, as programs like SpyEye continue to lower the barrier to entry for aspiring cyber criminals, it is time to rephrase the legendary question asked of Willie Sutton, one of the most notorious bank robbers of the 2oth century: Why do you rob banks? To which Mr. Sutton is reported to have answered: Because that's where the money is. The 21st century version, or Sutton 2.0, might be to ask: Why do you seek unauthorized access to networks and digital devices? Because that's where the data is, and data is the new currency. Even your basic street criminal knows this.
The chances that a random mugging victim will be carrying a lot of cash are slim. There's a much better chance they will have a wallet or purse full of data-bearing plastic cards that can be easily converted into whatever the criminal wants, be it illegal drugs, anonymous gift cards, or actual money. The means to convert large amounts of data into wealth are now widely available. For example, the black market in credit card data is thriving, global and accessible from anywhere, as is the market in compromised data access points. Data pertaining to a real person can be used to fake their identity, open bogus accounts in their name, compromise or drain existing accounts, and generate credit cards used to buy gift cards used to buy high-end merchandise that can be traded for cash, or enjoyed in the comfort of your luxury apartment rented in someone else's name.
In 2012 the struggle to shut down this type of crime will continue, but there will be other forms of cyber crime to contend with as well. According to his autobiography, Where the Money Was: The Memoirs of a Bank Robber, Willie Sutton never gave that famous “where the money is” reason for robbing banks. Here's what he really thought: “Why did I rob banks? Because I enjoyed it. I loved it. I was more alive when I was inside a bank, robbing it, than at any other time in my life.” Substitute “network” for “bank,” and you pretty much have the definition of a career criminal hacker.

Industrionage

Industrial Espionage

Industrial espionage is the act of gathering proprietary data from private companies or the
government34 for the purpose of aiding another company(ies). Industrial espionage can be
perpetrated either by companies seeking to improve their competitive advantage or by
governments seeking to aid their domestic industries. Foreign industrial espionage carried out by
a government is often referred to as economic espionage. Since information is processed and
stored on computer systems, computer security can help protect against such threats; it can do
little, however, to reduce the threat of authorized employees selling that information.


http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf

Hacker TOOLKIT

                                      
http://www.bnsmidwest.com/hackertoolkit.htm



Information on hacking, security, hackers toolkits, hacking software, and many tools for testing the vulnerabilities of your network and networking devices.

REFERENCE
• The Cost of Security on Cisco Routers
• Demystifying Cisco ACL's
• Increasing Security on IP Networks
• AntiOnline
• Bindview's RAZOR
• Cult of the Dead Cow
• Fyodor's Playhouse
• Gibson Research
• Interhack
• NT Bugtraq
• NT Security
• Packet Defense
• PPTP Crack
• Security Administrator's Integrated Network Tool (SAINT)
• Security Focus
• Security Tracker

---

Tools for Windows and Linux.
Many good tools here for any aspect of security, penetration testing, IDS, firewalls, packet sniffers, network monitoring tools and just about anything else you can think of.

       TOOLS

• NMAP
• Nessus
• Ethereal
• Snort
• Netcat
• TCPDump
• WinDump
• Hping2
• DSniff
• GFI LANguard
• Ettercap
• Whisker/Libwhisker
• John the Ripper
• OpenSSH
• Sam Spade
• ISS Internet Scanner
• Tripwire
• Nikto
• Kismet
• SuperScan
• Cain & Abel
• SolarWinds Toolsets
• NTop
• Nemesis
• Honeyd
• Achilles
• Firewalk
• AVG Free Antivirus
• Trend Micro online scan
• Tiny Firewall
• Symantec Virus Tools
• Linux Security Audit Tool
• Firewall Builder
• IPCop
• AirSnort
• SATAN
• Rootkit Hunter
• SpamAssassin
• grsecurity
• IP-Scanner

A useful blog site "Hackerville"

                                                             HACKERVILLE

How a Remote Town in Romania Has Become Cybercrime Central

From Wired Magazine

Râmnicu Vâlcea has only about 120,000 residents, but among law enforcement experts around the world, it has a nickname: Hackerville. The town is full of online crooks who cruise the streets in expensive European cars.
Photo: Nick Waplington

Three hours outside Bucharest, Romanian National Road 7 begins a gentle ascent into the foothills of the Transylvanian Alps. Meadowlands give way to crumbling houses with chickens in the front yard, laundry flapping on clotheslines. But you know you’ve arrived in the town of Râmnicu Vâlcea when you see the Mercedes-Benz dealership.
It’s in the middle of a grassy field, shiny sedans behind gleaming glass walls. Right next door is another luxury car dealership selling a variety of other high-end European rides. It’s as if the sheer magic of wealth has shimmered the glass-and-steel buildings into being.
In fact, expensive cars choke the streets of Râmnicu Vâlcea’s bustling city center—top-of-the-line BMWs, Audis, and Mercedes driven by twenty- and thirtysomething men sporting gold chains and fidgeting at red lights. I ask my cab driver if these men all have high-paying jobs, and he laughs. Then he holds up his hands, palms down, and wiggles his fingers as if typing on a keyboard. “They steal money on the Internet,” he says.
Among law enforcement officials around the world, the city of 120,000 has a nickname: Hackerville. It’s something of a misnomer; the town is indeed full of online crooks, but only a small percentage of them are actual hackers. Most specialize in ecommerce scams and malware attacks on businesses. According to authorities, these schemes have brought tens of millions of dollars into the area over the past decade, fueling the development of new apartment buildings, nightclubs, and shopping centers. Râmnicu Vâlcea is a town whose business is cybercrime, and business is booming.
At a restaurant in a neighborhood of apartment buildings and gated bungalows, I meet Bogdan Stoica and Alexandru Frunza, two of just four local cops on the digital beat. Stoica, 32, is square-shouldered and stocky, with a mustache and prominent stubble. His expression rarely changes. Frunza, 29, is tall and clean shaven. He’s the funny one. “My English will improve after I have a few beers,” he says. We sit at a table on the edge of a big courtyard, piped-in Romanian pop music blaring.
Stoica and Frunza grew up in Râmnicu Vâlcea. “The only cars on the streets were those made by Dacia,” Stoica says, referring to the venerable Romanian carmaker. Access to information was limited, too: Weekday television consisted of two hours of state-run programming, mostly devoted to covering the dictator, Nicolae Ceauşescu. “We had half an hour of cartoons on Sunday,” Stoica says.
In 1989, a revolution that began with anti-government riots ended with the execution of Ceauşescu and his wife, and the country began the switch to a market economy. By 1998, when Stoica finished high school and went off to the police academy in Bucharest, another revolution was beginning: the Internet. Râmnicu Vâlcea was better off than many towns in this relatively poor country—it had a decades-old chemical plant and a modest tourism industry. But many young men and women struggled to find work.
No one really knows how or why those kids started scamming people on the Internet. “If you find out, you let us know,” says Codruţ Olaru, head of Romania’s Directorate for Investigation on Organized Crime and Terrorism. Whatever the reason, online crime was widespread by 2002. Cybercafés offered cheap Internet access, and crooks in Râmnicu Vâlcea got busy posting fake ads on eBay and other auction sites to lure victims into remitting payments by wire transfer. Eventually, FBI agents in the US and Bucharest started to get interested.
In the early days, the perpetrators weren’t exactly geniuses. One of the first cases out of the region involved a team based in the neighboring town of Piteşti. One crook would post ads for cell phones; the other picked up the wired money for orders that would never ship. The two men had made a few hundred dollars from victims in the US, and the guy receiving the cash hadn’t even bothered to use a fake ID. “I found him sitting in an Internet café, chatting online,” says Costel Ion, a Piteşti cop who had been working the cybercrime beat. “He just confessed.”
But as in any business, the scammers innovated and adapted. One early advance was establishing fake escrow services: Victims would be asked to send payments to these supposedly trustworthy third parties, which had websites that made them look like legitimate companies. The scams got better over the years, too. To explain unbelievably low prices for used cars, for example, a crook would pose as a US soldier stationed abroad, with a vehicle in storage back home that he had to sell. (That tale also established a plausible US contact to receive the money, instead of someone in Romania.) In the early years, the thieves would simply ask for advance payment for the nonexistent vehicle. As word of the scam spread, the sellers began offering to send the cars for inspection—asking for no payment except “shipping.”
The con artists got even sneakier. “They learned to create scenarios,” says Michael Eubanks, an FBI agent in Bucharest. “We’ve seen email between criminals with instructions on how to respond to different questions.” The scammers started hiring English speakers to craft emails to US targets. Specialists emerged to occupy niches in the industry, designing fake websites or coordinating low-level confederates.

Internet scammers and their underlings have turned Râmnicu Vâlcea into a hub of international organized crime.
Photo: Nick Waplington

By 2005, Romania had become widely known as a haven for online fraud, and buyers became wary of sending money there. The swindlers adapted again, arranging for payments to be wired to other European countries, where accomplices picked up the cash. A new entry level evolved, people who’d act as couriers and money launderers for a cut of the take. These money mules were called arrows, and their existence elevated Râmnicu Vâlcea to a hub of international organized crime.

Many arrows were Romanians living in Western Europe and the US; some were youngsters from Râmnicu Vâlcea who had moved overseas expressly for the job. They’d go to wire transfer offices to collect remittances from victims, then turn around and wire that money—minus a commission—to Râmnicu Vâlcea or to other arrows in the network. The system served as a kind of firewall, making it much more difficult for law enforcement to track the masterminds.
Back home, the local police were starting to realize they needed people on the cybercrime beat full-time. Frunza, who’d studied informatics in high school before attending the police academy, was working drug cases in Bucharest when he decided to come home. He ended up joining Stoica on the hunt for online con artists. The two learned that suspects expect leniency from the police because their crimes target only foreigners. “The guys will often say, ‘I am not stealing from our countrymen,’” Frunza says. “But a crime is a crime. You have to pay for it.”
Nowadays, Stoica and Frunza occasionally find themselves investigating a childhood acquaintance or, conversely, running into known criminals in social situations. Frunza used to play on the same soccer team as a suspect who was under surveillance. Those connections have helped the two cops pose a formidable challenge to the industry.
A little after 11 pm, Stoica hushes our conversation and tells me to turn around and check out a table across the courtyard, where a small group of flashily dressed young men has just arrived with two blond women who seem barely out of their teens. The men are all under investigation. “It’s a small city,” Stoica says.

The sudden appearance of luxury car dealerships among the grass fields marks the entrance into Râmnicu Vâlcea.
Photo: Nick Waplington

Defining the town center of Râmnicu Vâlcea is a towering shopping mall that looks like a giant glass igloo. The streets are lined with gleaming storefronts—leather accessories, Italian fashions—serving a demand fueled by illegal income. Near the mall is a nightclub, now closed by police because its backers were shady. New construction grinds ahead on nearly every block. But what really stands out in Râmnicu Vâlcea are the money transfer offices. At least two dozen Western Union locations lie within a four-block area downtown, the company’s black-and-yellow signs proliferating like the Starbucks mermaid circa 2003.

Driving past a block of low-rise buildings with neatly trimmed hedges, Stoica notes a couple of apartments owned by people currently under investigation. “I don’t know if the people of Râmnicu Vâlcea are too smart or too stupid,” Stoica says grimly. “They talk a lot to each other. One guy learns the job from another. They ask their high school friends: ‘Hey, do you want to make some money? I want to use you as an arrow.’ Then the arrow learns to do the scams himself.”
It’s not so different from the forces that turn a neighborhood into, say, New York’s fashion district or the aerospace hub in southern California. “To the extent that some expertise is required, friends and family members of the original entrepreneurs are more likely to have access to those resources than would-be criminals in an isolated location,” says Michael Macy, a Cornell University sociologist who studies social networks. “There may also be local political resources that provide a degree of protection.”
Online thievery as a ticket to the good life spread from the early pioneers to scores of young men, infecting Râmnicu Vâlcea’s social fabric. The con artists were the ones with the nice cars and fancy clothes—the local kids made good. And just as in Silicon Valley, the clustering of operations in one place made it that much easier for more to get started. “There’s a high concentration of people offering the kinds of services you need to build a criminal scheme,” says Gary Dickson, an FBI agent who worked in Bucharest from 2005 to 2010. “If your specialty is auction frauds, you can find a money pick-up guy. If you’re a money pick-up guy, you can find a buyer for your services.”
Stoica and Frunza both complain that they’re fighting an unstoppable tide with limited resources. But they haven’t been entirely unsuccessful—in fact, the 2008 case that first revealed the anatomy of Râmnicu Vâlcea’s fraud networks stemmed from Stoica’s investigation of a young entrepreneur named Romeo Chita.
Stoica says Chita started out as an arrow in the UK, and he was good. He moved up the ranks and eventually hired a few friends to establish his own ring. The Romanian authorities began investigating him in 2006, when he started buying new cars every few months and going to clubs every night with no apparent source of legitimate income. Chita launched an Internet service provider called NetOne, which authorities believe he was using as a shelter for fraudulent activity. When cops wanted to identify his customers, Stoica says, Chita usually told them that NetOne didn’t keep records.

Western Union signs have multiplied downtown like the Starbucks mermaid circa 2003.
Photo: Nick Waplington

In January 2008, an informant gave Stoica the cell numbers of two men working for Chita. The police tapped the phones, and the next day one of the men sent Chita a text message with money transfer control numbers—unique numeric sequences required to pick up cash. Stoica and his team followed up with surveillance of Chita and his associates, which established what Stoica calls “the money circuit,” the route through which the funds flowed from victims in the US to Chita and others. Prosecutors now allege that the operation turned into something a little more sophisticated than the usual Râmnicu Vâlcea scam. For example, the case against them details a con known as spear phishing—sending email to US companies that appeared to be from the IRS, the Department of Justice, or some other agency. Through Trojan horses attached to these emails, Chita’s group could obtain the companies’ bank account numbers and passwords. Allegedly, they even hired people in Las Vegas—Stoica says some were homeless—to open fake corporate bank accounts and receive the money.

The same month that Stoica began pursuing Chita, a police officer stopped a car for speeding in the Westlake suburb of Cleveland, Ohio. About to write a ticket, the cop noticed some drug paraphernalia in the car and arrested the two men inside. A further search turned up eight cell phones, two computers, fake IDs, two dozen money transfer receipts, and $63,000 in cash. The pair turned out to be Romanian and eventually confessed to being arrows for an organization authorities traced back to Chita. They had spent most of January driving around the Midwest, picking up money from various Western Union and MoneyGram locations. Their confessions led to more wiretaps and surveillance in the US and Romania over the following months, uncovering a network of at least two dozen accomplices.
That summer, Romanian authorities and FBI agents conducted a series of raids on both sides of the Atlantic. Chita spent 14 months in custody before being granted a provisional release pending the completion of his trial, still pending. On an org chart filed in Stoica’s office, Chita’s photo remains at the top.
Class Café is an inviting coffee shop with a terrace that overlooks a quiet street. It’s nearly empty when I walk in—just the owner behind the counter and a young couple at a corner table.
Stoica discouraged me from attempting this meeting, but I wanted to know what an alleged kingpin looks like. I ask the owner if he knows where Chita is, and he offers to call him. After a brief phone conversation, he hangs up and tells me that Chita is in Bucharest. I remind him that Chita isn’t allowed to leave Râmnicu Vâlcea under the terms of his release, and the owner smiles. He spends a few more minutes on the phone, then hangs up again and asks me to sit. Chita is on his way.
I take a table on the terrace. During our tour of town, Stoica had pointed out Chita’s silver Mercedes on the road, so I ignore the green Jaguar that drives up until a man in Bermuda shorts, canvas shoes, and a white T-shirt climbs out, enters the café, and approaches my table. He introduces himself as Chita’s brother, Marian. He licks his lips nervously and fidgets with an iPhone. “Chita’s coming,” he says after lighting a cigarette and making some phone calls. “But he’s a little drunk.”
A few minutes later, Chita walks around the corner and ambles into the café. Boyish, dressed in shorts, a light-blue polo shirt, and flip-flops, he looks more like a college student than a criminal mastermind. Despite the reputation of Râmnicu Vâlcea’s underworld as relatively free of violence, he has brought along some muscle—a young man in dark glasses with a big tattoo on his arm. The bodyguard slams a beer bottle down on the table and flexes his hand, as if getting ready for a boxing match.
Chita shakes my hand dourly and sits down next to me, looking away. Two other men join us. The young couple from the corner comes over to greet Chita with fawning smiles and handshakes. They clearly recognize him, too. The café owner gets up and leaves. As he walks away, he looks at me gravely and says, “Good luck.”

Râmnicu Vâlcea has become the Silicon Valley of online thievery— a place where the clustering of operations makes boot-strapping a criminal start-up easier.
Photo: Nick Waplington

The tattooed man leans toward me ominously. “Were you sent by Barack Obama?” he asks. I say that I wasn’t, and everyone but me lights cigarettes. Marian, getting increasingly jumpy, demands to know my true agenda. Finally, I spell my name and tell him to search for my stories on his iPhone. He Googles me and shows the screen to his brother. Everybody relaxes a bit, and I silently give thanks for wireless broadband.
Marian asks the young couple to translate for Chita, and they agree to stay. Chita has them tell me to stand, then he pats me down, asking if I’m wearing a wire.
“What do you say to the charges against you?” I ask.
“They are fake,” Chita says, in English.
Marian adds, “It’s all bullshit.” For clarification.
Chita continues with his defense in Romanian, and the couple translates enthusiastically. “He doesn’t even know how to speak English, so it is impossible for him to post ads or exchange email with buyers,” the young woman says. “He doesn’t even have an email address,” she says. “How can he do fraud on the Internet?”
I press Chita about the wiretapped conversations, but his tattooed bodyguard interrupts loudly. “You go back to your hotel room, we send you some nice pussy,” he says, raising his hand for a high five that I feel obligated to meet. The two men beside him laugh, and Chita takes a final drag from his cigarette before rising from his chair. He’s in no mood to discuss the evidence. “This interview is over,” Marian says.
They saunter out of the café and onto the sidewalk, looking surprisingly banal for guys accused of organized cybercrime, enjoying the good life with little effort or risk. Officials have dismantled a few fraud rings in recent years—there were just 188 arrests in all of Romania in 2010—but scores remain in business.
I am left with the friendly couple that helped with the translating. The young man says he’s heard about Chita from his friends and has seen his name in the papers. He tells me he has just received a diploma in engineering from an institution in Bucharest and is now looking for a job here in Râmnicu Vâlcea, his hometown. “I haven’t found anything yet,” he says. Thinking about Marian’s Jag and Chita’s Mercedes, I wonder if he’ll consider a job as an arrow. It’s like Frunza told me at the restaurant: “You arrest two of them and 20 new ones take their place,” he said. “We are two police officers, and they are 2,000.”

Yudhijit Bhattacharjee (yudhijit@gmail.com) is a staff writer at Science. He wrote about decoding a spy’s messages in issue 18.02.

Intelligence on the darker side of the internet

                                        http://www.shadowserver.org/wiki/


 The Shadowserver Foundation is an all volunteer watchdog group of security professionals that gather, track, and report on malware, botnet activity, and electronic fraud. It is the mission of the Shadowserver Foundation to improve the security of the Internet by raising awareness of the presence of compromised servers, malicious attackers, and the spread of malware.