Dark Market – Lessons on Cyber Crime

Former BBC and Guardian correspondent Misha Glenny is an expert on many subjects. He wrote the definitive account of the Balkan Wars – The Fall of Yugoslavia – during a posting to the area in the early ’90s, and followed that in 2009 with McMafia: Seriously Organised Crime – the a definitive guide to international organised crime.

In his latest work, DarkMarket: CyberThieves, CyberCops and You, Glenny has turned his hand to a new subject: Cyber Crime.

Dark Market is the story of the long investigation by Keith Mularski of the FBI and Inspector Bilal Sen of the Turkish Police to disrupt cyber criminals who were acquiring, trading and exploiting stolen credit card data. It is a fantastic tale that documents the side of cyber crime that readers of this website will be least familiar with – the side after the data has been stolen. The book is a thrilling tale of criminal rivalry and sabotage, matched only by the inter-departmental rivalry between the FBI and the US Secret Service in responding to the crime. It’s a complicated story, with the criminals pitted against not just each other, but the combined might of the FBI, the Secret Service, the UK’s Serious Organised Crime Agency, the Turkish Police and the German Police.

The criminals were acquiring the data using credit card skimming devices and by hacking into eCommerce platforms. This data was then traded on forums – sold from those who acquired the data to wholesalers who would sell it on to teams who could ‘cash out’ the money by creating clone cards and visiting banks or ATMs. The trading was conducted on large websites – CarderPlanet, CardersMarket and DarkMarket – populated by hackers, criminals and police, all presided over by the main subjects of the book – Sri Lankan Tamil immigrant ‘JiLsi’, fifteen year old German schoolboy ‘Matrix001′, egotistical US hacker ‘IceMan’, a mysterious, possibly still unidentified, Turkish criminal ‘Cha0′ and, most importantly of all, ‘Master Splynter’, an undercover FBI agent.

In the process of writing the book, Glenny has clearly needed to use some of his interviews with the subjects to bring himself up to speed with the technical concepts involved and, as a result, the book is far from technically perfect. Glenny has sensationalised topics which aren’t particularly sensational – his reference to an IT administrator enabling his monitoring system as “waking the mighty VNC beast” was particularly jarring. We can forgive him this error, though, for he has set out in a highly enjoyable read, the personal stories of those whom we in Information Security work against every day, but rarely see or know.