[HN Gopher] Inside Job: How a Hacker Helped Cocaine Traffickers ...
___________________________________________________________________
Inside Job: How a Hacker Helped Cocaine Traffickers Infiltrate
Europe's Ports
Author : jruohonen
Score : 86 points
Date : 2023-12-03 12:09 UTC (10 hours ago)
(HTM) web link (www.occrp.org)
(TXT) w3m dump (www.occrp.org)
| pixxel wrote:
| Interesting piece. I'm left more interested in this:
|
| > breaking into the encrypted chat platform SkyECC
|
| Psychical access to a device or something more technical...
| kotaKat wrote:
| SkyECC was blown wide open by LE.
|
| https://en.wikipedia.org/wiki/Shutdown_of_Sky_Global
| taosx wrote:
| How did they manage to decrypt the messages, I thought it's
| very expensive to decrypt a correctly encrypted piece of
| data?
|
| "About a billion messages were intercepted, about half of
| which had been decrypted by April 2021--further avenues of
| inquiry were expected to open as decryption progressed"
| kotaKat wrote:
| In some of the raids they got their hands on SkyECC
| infrastructure, IIRC. SkyECC claimed "no, that's a fake
| version of our app" yet they seemingly did have some
| service disruptions at the same time.
|
| They also suddenly claim all the users that got intercepted
| were using "elaborate fake" SkyECC apps and services, yet
| oddly those same "fake" apps could talk with actual SkyECC
| users, so, y'know. Grains of salt.
| dotnet00 wrote:
| I'd say most things are more technical than access to a device
| through psychic means ;)
| TheLoafOfBread wrote:
| Psykers are natural evolution of hackers.
| pixxel wrote:
| lol! I'm leaving it unedited.
| ta988 wrote:
| https://journals.sagepub.com/doi/10.1177/20322844231212661
|
| It is unclear how the decryption was made, but it talks about
| how the servers were tapped into including RAM access!
| pixxel wrote:
| > Dutch technicians then developed a technique to copy the
| random access memory (RAM) of one of the Sky ECC servers
| without causing them to offline
|
| Teasing! I wonder how.
|
| Thanks for sharing.
| fullspectrumdev wrote:
| There's a number of ways to take a physical memory dump
| from a server without taking it offline.
|
| On Linux, there's for example Lime if you have root.
|
| On windows there's various other tools, some commercial,
| some open source. All require admin privs.
|
| If you have access to the hypervisor it's even easier -
| just direct the hypervisor to dump the VM's RAM to a file.
| Most hypervisor tools have a utility for this.
|
| If you have only physical access it's a bit trickier, but
| if there's an available PCIe slot and you are very careful
| it's possible to dump RAM that way on a live system :)
| pixxel wrote:
| Thank you for the insight.
| TacticalCoder wrote:
| TFA talks a lot about corruption and it's way worse than people
| think.
|
| Not that long in Belgium, in the port of Antwerp ("Anvers" in
| french), non-corrupt employees found a container with cocaine.
|
| Before the authorities came to seize the shipment, corrupt _cops_
| tried to bribe the port custom employees to gain temporary access
| to the container (basically to steal part of the shipment before
| it 'd be officially weighted).
|
| I pity these people: when shipment go undetected, it's their
| fault. Then criminals try to bribe them. Then _corrupt cops_ try
| to bribe them.
|
| It's a sad state of affair.
|
| Whether cocaine should be legal or not is another topic but it's
| not legal and there are killings related to cocaine traffic in
| Europe: consumers of cocaine have their share of responsibility
| too.
| dylan604 wrote:
| >consumers of cocaine have their share of responsibility too.
|
| consumers of any product. consumers of chocolate are
| responsible for... consumers of electronics are responsible
| for... consumers of cotton are responsible for...
|
| there's only so many options consumers really have. there are
| somethings you cannot vote with your wallet. blaming addicts
| teeters precariously towards victim blaming.
| 11235813213455 wrote:
| totally right, consuming is polluting, which is a big
| responsibility nowadays for the environment
|
| So the best is to minimize consumption, and obviously things
| like drugs, travel, and many things are not essential
| products
| para_parolu wrote:
| And having children
| JumpinJack_Cash wrote:
| "You'll own nothing and you'll be happy eating bugs"
| 11235813213455 wrote:
| I already eat bug from a lot of foraging and fruit market
| waste, not very intentionally, but they are there and
| they eat the same thing, so can't be bad, extra proteins
| actually
| Scoundreller wrote:
| No need to minimize consumption for cocaine, ~90% of the
| resources used are in the distribution.
|
| If legalized, the cost of distribution would crater to that
| of other products, just a few dollars per kg.
| 11235813213455 wrote:
| it costs pollution to grow, transport, stock, plastic-
| wrap, etc..
|
| it's like saying: "it doesn't cost pollution to buy those
| avocadoes grown in another continent since they're
| already there", it's true immediately (above all if very
| ripe), but in the mid-long term, reducing consumption
| reduces production & pollution (at all level of the
| chain)
| Scoundreller wrote:
| Sure there are some essential production and distribution
| costs, but let's remember that cocaine is a minimally
| processed leaf extract.
|
| You can industrialize its production and get close to
| sugar level production pricing and distribution. Sugar
| sourced from Brazil hits my Toronto supermarket shelf
| bagged at CAD$1.50/kg at 99.9% purity, including retailer
| markup. Which is like 1/50000th the retail price of
| cocaine.
|
| Even if it costs 10x as much due to lower volume/weaker
| extracts/slower growth/additional processing, you're
| talking a 99.9something% reduction in resource
| expenditure per dose.
|
| Price of something is a good representation of the
| resources destroyed ("costs") in its production.
| dbsmith83 wrote:
| Right, let's just sit around in our tents in the dark and
| try not to move or speak unless absolutely necessary.
| Moving is not always essential, and has a caloric cost,
| which means food consumption. Are you sure being on this
| site right now is actually necessary? In fact, why bother
| being alive at all?
|
| Yeah, have fun with that. I'm going to enjoy my life!
| kortilla wrote:
| This is bullshit. Many cocaine users are not addicts but are
| just people with money partying.
|
| They are not victims and even the addicts are not absolved of
| responsibility for their actions.
|
| If an alcoholic drives drunk and kills someone, they don't
| get an exemption.
|
| If you buy cocaine from dealers known to be violent, you
| don't get an exemption either. More generally, if you buy
| cocaine that comes from a violent cartel (most of it), you're
| supporting the cartel.
|
| It's a party drug, you have a choice. Check yourself into
| rehab if you don't.
| Scoundreller wrote:
| I'm sure most buyers would looooooove to buy organic
| artisanal cocaine direct from the farmer shipped by DHL.
| But various governments make that impossible, so I'd pin
| the blame solely on governments.
| dylan604 wrote:
| Gives a new meaning to farm to table
| fragmede wrote:
| So what you're saying is we need free trade, ethical cocaine
| (along with coffee, electronics, and cotton).
| Nextgrid wrote:
| > there are killings related to cocaine traffic in Europe
|
| Which is a problem created by the stupid "war on drugs". If you
| make it impossible for parties to access the legal system to
| resolve any disputes, you're forcing them to resolve them via
| extrajudicial means.
|
| You don't generally hear about killings within the traffic of
| any other commodity such as vegetables or IT goods. In fact we
| don't even call it "traffic" but just trade.
| ta988 wrote:
| There are killings and exploitation for a lot of other
| things, gold, diamonds, rare earths, coffee, avocados you
| name it.
| ptek wrote:
| Avocado farms in New Zealand get robbed when prices start
| approaching $8NZD a a avocado, :'(. I feel sorry for the
| farmers. We have no avocados on our farms.
| harry_ord wrote:
| Quite a bit of olive oil recently as well
|
| https://www.reuters.com/world/europe/spanish-police-
| seize-74....
| OfSanguineFire wrote:
| > You don't generally hear about killings within the traffic
| of any other commodity such as vegetables
|
| Of course you do, especially if you're in Mexico where the
| cartels have now expanded beyond drugs. A web search for
| "mexican cartels avocados" might do you well.
|
| Another example is vanilla in Madagascar, where dozens of
| murders have occurred. Beyond local turf fights, Russian and
| Chinese organized crime has been involved in Madagascar's
| spice and hardwood sectors for many years now.
| aaomidi wrote:
| The only correct solution here is to recognize cocaine is a
| commodity that people want, and legalizing it and funding
| support systems etc etc with the taxes is a great way to go.
| Ckirby wrote:
| I don't care how many people die, I feel no guilt, no remorse
| and no pity
|
| Legalize drugs and the violence will end
| qwebfdzsh wrote:
| So all (addictive or not) prescription drugs for instance
| should also be available to everyone freely and without any
| limitations?
|
| Also unnecessary/avoidable deaths are only an issue if they
| are an outcome of violence or government restrictions if I
| understand correctly?
| Nextgrid wrote:
| > all (addictive or not) prescription drugs for instance
| should also be available to everyone freely and without any
| limitations
|
| Technically we already have that with cigarettes and
| alcohol, so maybe it's time to drop the double-standards?
| tester756 wrote:
| Cigarettes are really harmful, but still not as hard as
| drugs.
| Ckirby wrote:
| Uninformed Prohibitionist nonsense
| Ckirby wrote:
| Stop crying about "addiction"
|
| some dumb girl got herself killed drinking lemonade at
| Panera Bread
|
| People die, deal with it
| tester756 wrote:
| >Stop crying about "addiction"
|
| rofl, yea, addiction aint huge issue, huh?
| Ckirby wrote:
| No, it isn't
| _a_a_a_ wrote:
| > Before the authorities came to seize the shipment, corrupt
| cops tried to bribe the port custom employees to gain temporary
| access to the container (basically to steal part of the
| shipment before it'd be officially weighted).
|
| Link please.
|
| > consumers of cocaine have their share of responsibility too
|
| Arguably the gov't does also for creating the market by
| outlawing the stuff. But that's never discussed by anti-drugs
| people (BTW I'm not pro-drugs, before you assume)
| OnlyMortal wrote:
| Cocaine was always easily available in Antwerp from my
| experience (~1995-2010). More so than weed which was always a
| little surprising given it's not far to the Dutch border.
|
| Friends of mine worked at customs both for the Belgian
| authorities and the US ones.
|
| Antwerp did have a reputation for corruption. There's too much
| money involved.
| yieldcrv wrote:
| > but it's not legal and there are killings related to cocaine
| traffic in Europe
|
| almost like those two are related
| xenospn wrote:
| Can't corrupt cops just go in and grab whatever they want
| without anyone stopping them? They are corrupt and they are
| cops after all. Who is going to do anything about it?
| jonasdegendt wrote:
| The port would report them to the part of the police that's
| not corrupt, which as a Belgian, I like to think is most of
| the Antwerp police.
|
| I have a hard time believing this story to be honest, most
| police corruption here would probably be a lot more covert,
| e.g. in the form of providing information or turning a blind
| eye at the right time.
|
| Someone else already asked for a source and it's yet to show
| up.
| gumballindie wrote:
| They dont need to hack their way in. A good bribe in a dutch or
| belgian official pocket is all it takes.
| InCityDreams wrote:
| Nationality irrelevant. Any human can be bribed.
| konschubert wrote:
| It matters which nations have a culture of corruption
| erie wrote:
| That is meaningless, the culture of corruption' in US
| congress does not extend to everyone in the US.
| dotnet00 wrote:
| But no one feels the need to get defensive about
| nationality if "just bribe some American congressmen" is
| stated instead of "Dutch or Belgian official".
| gruez wrote:
| Can you clarify what exactly is meant by "the culture of
| corruption' in US congress"? I assume you're talking
| about campaign contributions and the associated quasi-
| quid pro quo dealings, but most Americans don't receive
| campaign contributions nor do they meet up with
| lobbyists, so there's very little opportunity for them to
| commit such acts of corruption.
| gumballindie wrote:
| The dutch think it's embedded within one's race - in
| europe they even make studies showing the inferiority of
| east europeans. Even covid was somehow "proven" by dutch
| universities to affect east europeans differently. Truly
| a one of a kind nation the netherlands. Yet dutch ports
| are main drug weapon and people smuggling ports.
| ptek wrote:
| Everyone has a price?!?
| konschubert wrote:
| Hopefully not.
| fullspectrumdev wrote:
| The remote access to the system was achieved via bribery - they
| bribed a port employee to run something from a provided USB
| stick so they could directly manipulate the system.
| rambambram wrote:
| It's common practice of journalists in The Netherlands to not
| publish family names of suspects in the media. There are
| exceptions for 'famous' criminals. So it was striking for me to
| read full names in the article.
|
| If you're into 'real crime' and all this cocaine smuggling and
| all the accompanying banditry is of interest to you, I can
| recommend some channels on Youtube. Just search for 'Holland
| Crime Boulevard' or 'mocro mafia', etc.
|
| There has been an ongoing feud since 2012 over a missing shipment
| of 200kg cocaine with a lot of murders. Even murders of the
| family of a crown witness, lawyer and a famous crime journalist.
| Pretty recently there was a discovery of underground containers
| setup to torture people. Ridouan Taghi and his organisation
| worked together with Italian and Irish mobsters. Well, I wasn't
| there, but that's what the media portrays. Also, this is probably
| not one group, but there were all kinds of groups working
| together once in a while.
| comprev wrote:
| Groups working together is fairly common. The importers handle
| logistics into the country. Another group handles distribution
| within a country. Others may handle distribution within
| towns/cities.
|
| They all have a mutual benefit of clear division of
| responsibilities in the journey - and thus will reduce the
| inter-group feuds from trying to branch out.
|
| The underground market can be incredibly efficient.
| wslh wrote:
| Drug traffickers and/or mafias have more cybersecurity tools that
| most states.
| lnsru wrote:
| There were some job ads from german state company on who's
| hiring thread another day. And what can I say... the salaries
| there are bad joke. One must love the country very much to join
| such place. I guess, mafia will not save on salaries here.
| wslh wrote:
| Yes, also in cybersecurity you can earn a lot of money
| discovering vulnerabilities in popular apps and devices no
| matter who is on the other side: a state or a criminal
| entity.
| Nextgrid wrote:
| > One must love the country very much to join such place
|
| Or be too bad to get any other job. This in turn breeds a
| terrible environment of mediocrity which immediately
| extinguishes any promising talent that may (accidentally)
| join.
| hn_throwaway_99 wrote:
| The section on PIN code fraud really highlights the need to move
| away from code/password matching to cryptographic verification:
|
| > The large number of port and transport personnel who are able
| to view these reference numbers -- in some cases up to 10,000
| people in a single shipping company -- provides traffickers with
| many targets.
|
| This is equivalent to storing passwords in plaintext. A code that
| is needed to actually access the goods (i.e. used as a password)
| should be stored as a cryptographic hash or signature, and then
| only the right parties can verify that signature, with middle men
| having no access to it.
|
| No, it won't solve all forms of corruption, but it will take
| thousands of people out of the "bribable" (or worse,
| "intimidatable", as the article explains) category.
| tleilaxu wrote:
| I suspect the existing implementation and it's downsides are a
| feature not a bug.
| Nextgrid wrote:
| The aforementioned example shows nefarious exploitation of
| the vulnerability, but the same vulnerability is likely also
| "exploited" day to day by authorized users as a shortcut or
| workaround against system failures, missing features or bad
| user experience.
|
| For example, in a perfectly-secure system, how hard would it
| be to delegate access to someone (we assume the reason for
| delegation is legitimate)? If it's harder than writing down
| the access code and/or texting them then it's a downgrade. Is
| there a contingency process to keep working if your
| (obviously outsourced) SSO provider is down, or your machine
| is applying updates, or your browser is pestering you to
| leave feedback and trying to convince you to switch to their
| search engine before it'll let you access the system's access
| control page? Etc.
___________________________________________________________________
(page generated 2023-12-03 23:02 UTC)