How AFP smashed Bottle hackers

You might think the strategies to catch criminals used by gumshoe detectives and cyber cops are worlds apart, but the investigation into the hack of Bottle Domains demonstrated that they share a common heritage.

Follow the money. Be adaptive. These were but some established police tactics used by Federal Police technical specialist Alex Tilley to nail the hacker and money man behind the 2007 hack which was made public two years later.

Two men were charged in 2009 for cracking Bottle’s network and attempting to sell a database containing some 70,000 domains and 13,000 credit card numbers. The hacker served a reduced six month sentence, while the seller received a good behaviour bond.

But the fallout from the hack could have been huge. The hacker at the time worked for an IT services company employed by Bottle Domains. He had exploited his insider knowledge to break into the company and had planned to sell the stolen database.

Tilley said it would have been a “dark day for the Australian internet” should Operation Carpo have failed to nab the perpetrators before the database could be flogged. “The damage caused by the database getting into the wrong hands ... the risk ... seventy thousand domains, auth keys ... the minds boggles ... DNS hijacking, man in the middle attacks.”

Their effort to turn the database into cash was their undoing, Tilley said.

“[The investigation] was easy only in that he was trying to monetise a database of a hacked Australian registrar,” Tilley said, pointing out that such an effort makes substantial noise in the online criminal underground.

“Even if he employed some technical wizardry, hid behind a million proxies, in the end he was trying for monetary gain.”

And rather than bounce around the world chasing the hacker, Tilley followed the money.

He approached the seller on an online forum as an interested buyer of the Bottle database.

“We wanted to get the database out of play. To buy it off them, even though all we are doing is buying a copy for the purposes of verification ... It was like a drug bust.”

The seller wanted $10,000, a bargain according to Tilley. The money would be divided so the hacker would receive $6000 and the seller $4000. It was an unusually high percentage payment for the seller, Tilley said.

Police could have received authority to buy the database, but in the end the seller supplied enough information during an online chat for an arrest to be made.

Tilley laughed: “He wanted to verify that were not cops. He said that if we were undercover cops, we’d have to admit it.”

The rest was history. “They were mates. The seller dobbed him in ... there’s no honour among thieves,” Tilley said. “They were not master criminals.”

Alex Tilley will discuss Operation Carp at RuxCon in Melbourne this weekend.

Copyright © SC Magazine, Australia