Network News

X My Profile
View More Activity

Social Networking on Internet Scammer Forums

With social networking sites like MySpace and Facebook all the rage among the 18 to 24 set, it's not hard to see why so many young people are drawn into hacking and online crime: After all, most criminal hackers learn the tricks of their trade at Web forums and online chat networks that also serve to connect buyers with sellers of stolen consumer data.

But building social networks takes time, and finding your way around hacking forums can be an intimidating (and potentially dangerous) endeavor. Fortunately, there's an easy way for researchers and investigators to get the lay of the land without getting their virtual feet wet: a free software tool called "PieSpy."

PieSpy is a "bot," or automated program, designed to graphically map social networks within Internet relay chat (IRC) channels, the preferred method of communication among most online criminals. There are literally thousands of these simple, text-based networks, that predate modern instant-messaging systems, catering to almost every topic imaginable. Most IRC networks are used to to facilitate real-time online communication between two or more people at once, just like instant-message networks such as AOL Instant Messenger or MSN Messenger. But there are dozens of IRC channels that serve as open marketplaces for all variety of stolen consumer data. Virus and worm writers also use IRC to update and control their networks of infected computers.

To the administrator of an IRC server, a PieSpy bot looks just like any other user who happens to be lurking in the channel. All the while, the program is using a set of rules to infer relationships between pairs and groups of IRC channel members that provides insight into the social hierarchy of an IRC channel. Each time a new communication occurs on the channel, PieSpy redraws the map and takes a unique snapshot of it. Run PieSpy in a busy IRC network overnight and and you can create a slick time-lapse video of the map evolving and growing like some elaborate, genetic mutation.

I've used this nifty little program on several occasions to map some of the more heavily-used IRC fraud forums, most recently a very popular one known as "ccpower" (the "cc" stands for credit cards). In the image to the right you can see a number of users communicating with one another, with the darker blue lines indicating stronger (more frequent) relationships. Interestingly, two of the individuals near the center of the diagram, "Ccards" and a user named "the," switched places after several hours, suggesting one had handed control over the channel to the other after some time.

Of course, creating pretty maps only gets you so far. Logging the channel's communications and doing some creative Googling brings more interesting results. I managed to trace a bunch of the users in this channel back to an online fraud forum called (don't go there unless you know what you're doing), where some of the users post even more information about themselves, such as their birth date, e-mail address, and country of origin.

For example, the user "McT0ni" in the graphic above is an administrator of both the IRC channel and TalkCash, and is a 19-year-old male who most likely resides in Germany (if his e-mail address is a reliable indicator). A quick Google search on his e-mail address shows that he, at one time, used it as a drop box for user names and passwords stolen in a phishing scam targeting AOL users.

By Brian Krebs  |  June 26, 2007; 4:30 PM ET
Categories:  Fraud  
Save & Share:  Send E-mail   Facebook   Twitter   Digg   Yahoo Buzz   StumbleUpon   Technorati   Google Buzz   Previous: It's a Jungle Out There for Apple's Safari
Next: Web Worm Whacks MySpace Users


Oh, yes, please! More spyware-riddled casino sites... just the kind of thing that readers of a SECURITY BLOG are very likely to visit.

Heh heh.


PS This is in reference to a previous post that will probably be deleted before too long... :)

Posted by: xqzyl | June 27, 2007 10:23 AM | Report abuse

Very interesting.

Posted by: Middle America | July 1, 2007 10:32 AM | Report abuse

Hey, i made a social networking tool that is NOT a scam. it's called go visit it and register your cell phone, it's free, and you can control your privacy settings to suit your needs.

you can create a contact list easily, and text message/sms people for free, and really easily. it's convenient and free. so check it out

Posted by: zindar | July 6, 2007 2:43 PM | Report abuse


I am Lucy, I have found your website while searching for some info at Google. Your site has helped me in a big way.


Posted by: fotinorod | July 7, 2007 2:37 PM | Report abuse


Looks good! Very useful, good stuff. Good resources here. Thanks much!


Posted by: govokinolij | July 12, 2007 8:30 AM | Report abuse

The first step to curing acne is knowing what type of acne you have. This information gives you precious insight to what may have actually triggered the acne outset. Once you know your acne trigger, you are one step closer to removing the acne activator and living acne free.
acne natural scar treatment
There are numerous types of acne, which could explain why it is so cumbersome if not seemingly impossible for the acne sufferer to find a cure. Looking at the list below, you may be surprised discover that you acne is not caused by stress, but your new bottle of designer perfume.
acne back cure
Adult Acne Sudden onset, or continuation of acne, during adulthood. The cause may be hormone imbalances, stress, pollution or medications. Studies have shown a direct link between hormone imbalances and the onset of acne in women ages 30 to 40 years old.
proactive acne medication
Acne cosmetic This form may be rare but is triggered by use of cosmetics with acne aggravating ingredients such as lanolins, isopropyl mysristate and some pigments.
acne prone skin
Acne conglobata Severe hereditary acne that can cause scarring on the face and back.
acne remedy scar
Acne detergens Acne resulting from abrasive cleansers.
acne treatment clinics
acne clinic treatment
Acne excoriee (Mirror Addict Acne)- Psychosomatic disease caused by constant picking of the face and/or body.
drugs for acne
teen acne treatment

Posted by: GorOffimi | July 16, 2007 8:27 PM | Report abuse

The comments to this entry are closed.

RSS Feed
Subscribe to The Post

© 2010 The Washington Post Company