📸 Photo

KINGPIN

flashy ads promising a lifestyle of partying, beautiful women, and piles and piles of cash.

Gollumfun, an influential founder, had already publicly retired from the site when another founder named BlackOps announced he was leaving as well. “Shadowcrew has been reduced from its once lustrous form to a degrading environment of children who lack knowledge, the skills or desire to interact with other members in a positive way,” he wrote. “Gone are the well thought out tutorials; gone are the well-respected members; and gone is the civility. No longer do we help the newbies find their way, we simply flame them to death until they leave and then complain that there aren’t any new members.”

“BlackOps, you will be missed, thank you for your services,” Cumbajohnny wrote tactfully. “SC is changing, and for the best.”

Max paid little attention to the politics of the carding scene. But the VPN announcement made him uneasy. It turned out Cumbajohnny had been privately selling his VPN service to Shadowcrew’s leaders for three months. Now, Cumbajohnny wrote, any Shadowcrew member in good standing could buy the same peace of mind for $30 to $50 a month.

But VPNs have one well-known weakness: everything transpiring over the network has to be funneled through a central point, unencrypted and vulnerable to eavesdropping. “If the FBI, or whoever, really wanted to they could get into the datacenter and change some of the configs on the VPN box and start logging, and then you would be kinda screwed,” one member noted. “But that is just straight paranoia,” he conceded.

Cumbajohnny reassured him. “No one can touch the VPN without me knowing about it.”

Max wasn’t convinced. In his white-hat days, he’d written a program for the Honeynet Project called Privmsg—a PERL script that took the data from a packet sniffer and used it to reconstruct IRC chats. When an intruder was lured into cracking one of the project’s honeypots, the attacker would often use the system to hold online conversations with his fellow hackers. With Privmsg, the white hats could see the whole thing. It