Talk:Vladimir Levin (hacker)

I believe that the character in Anna Karenina (who is a self portrait of the author, Leo Tolstoy) is actually Constantine Dmitrich Levin. His brother, who also appears in that novel, is Nikolai Dmitrich. If this is the case, then this article should be refactored. The article Anna Karenina article has yet to be started. -- Alan Peakall 16:40 Dec 12, 2002 (UTC)

"Levin's cause lives and wins"

Recently there was a very interesting article about the case at lenta.ru (one of the most popular Russian news portals). Here is a computer translation.

Lenta.ru: http://lenta.ru/articles/2005/11/02/levin/ 02.11.2005, environment(Wednesday), 21:32:43 It is updated 02.11.2005 at 18:36:43

"Levin's cause lives and wins"

On Tuesday the attention of the public again was chained to events more than ten years' prescription when the organized criminal grouping with participation of Russian hacker of Vladimir Levin undertook the largest on that moment attempt of " an electronic robbery ". Returning of interest to the given subject was caused by again opened details of this affair. 

"Saturn" almost is not seen

In brief the plot looks as follows: in 1994 the Petersburg programmer Vladimir Levin, having cracked smart systems of protection, has taken root into a computer network New York "Citibank" and has transferred(translated) more than 12 million dollars from accounts of his(its) clients to various foreign accounts. When the bank has reacted to complaints of clients at which money began to vanish, to business was connected FBI. The part of the transferbed(translated) means was received in the different countries by cash, and their further destiny has remained unknown, however the majority of couriers was arrested in the different countries at attempts to receive money to hands. With assistance of the Ministry of Internal Affairs of Russia it was possible to find out, that the unknown hacker left in a network a premise(room) of computer firm " Saturn of SPb " then operative methods established his(its) person. However to arrest Levin in territory of Russia it was impossible, as in UK the Russian Federation on that moment still were absent clauses(articles) about computer crimes, and from the point of view of working then legislations it(he) was completely innocent. In result as affirms, the thin psychological game which have been carried out(spent) by detectives of two countries (including phone calls of prisoners podel`nikov, threat on the part of concerned business "bratkov" etc.), it was possible to achieve that Levin has begun to panic and has gone to the Great Britain, presumably - to the friend of the childhood of the scold to Leonid Gluzmanu. It(he) was arrested, has hardly stepped into the British ground, is direct at airport " Stehnsted " March, 3, 1995 then was ehkstradirovan in USA where was condemned for 3 years of prison.

All this history was reconstructed in detail enough and repeatedly described in press - names of the majority of accomplices which also have received various terms are established, the chronology practically all events is restored. The basic part of the stolen money was returned to safe image to lawful owners, - from more than 12 million it was not possible to find only about 250 thousand, and that malicious languages pogovarivajut as if it "Citibank" under shumok has decided to write off(copy) own shortage. And, nevertheless, in a history there is one dark place - only one, but what.

All people which knew Vladimir Levin personally, estimated his(its) hacker's talents is low enough. It(he) at all was not the genius in the field of programming or mathematics, at all did not make impression of the superintellectual. In amateur network FIDO which in 1994 was in Russia the basic place obitanija advanced computer youth (enough to note, that the general director of Joint-Stock Company " people - Internet " Vasily Dolmatov or the chapter of Russian representation Microsoft Olga Dergunova were at that time sysops FIDO), Levin also for anything especially has not become famous. And the maintenance(contents) of his(its) work in notorious company " Saturn of SPb " may be most precisely characterized by word "ehnikejjhhik", - so on a computer slang name nizkokvalificirovannykh the broad specialists engaged in installation of programs, peretykaniem cables and replacement kartridzhejj in printers. In that Levin appeared the genius of conspiracy and successfully masked many years, cherishing artful plans, anybody from people knowing it(him) personally, simply does not trust. Attempts of FBI to use it(him) as the adviser or even a source of the information also have sufferred a full fiasco, - and you see at these guys was and than it(him) to intimidate and what to promise. At last, and itself Levin, in 2000, already after the clearing given indications in the Petersburg Department of Internal Affairs, asserted(approved), that all necessary actions made on a piece of paper, stupidly(bluntly) typing(collecting) commands which sense was not so clear to it(him).

These circumstances have caused weight of every possible assumptions and gamble, - for example as if Levin had accomplices in itself "Citibanke" due to what has received the most detailed instructions on detour of systems of protection. The bank, certainly, has lead(carried out) internal investigation of incident; results of this investigation, certainly, were not published, - however not that that about arrests, and even about dismissals which might be connected to business Levin, till now it is not known.

So, - the stolen means practically completely are returned to owners; participants of a criminal grouping have received and have left the terms; business is safely closed and transferred(handed) to archive, - all are pleased. The question on the one who actually has cracked "Citibank", similar, and has not interested anybody.

Revelations of an old hacker November, 2, 2005 on a site of " the Independent review of providers " clause(article) " Business Levin has appeared: a missing part ", signed by pseudonym ArkanoiD. Paying attention readers on that fact, that in 1994 of "computer" clauses(articles) UK the Russian Federation did not exist yet and that all possible(probable) limitation periods both on Russian, and under the American legislation have already expired, the author shares memoirs on that breaking "Citibank", one of which basic participants, it(he), as he said, was.

As he said, to group of the Russian hackers engaging in research of networks of report X.25 (technology, and today actively used in a banking, telegraphy and in a number of other applications, and in 1994 where more widespread, than the IP-technology on the basis of which the Internet works), was possible to get access to electronic bulletin board "Citibank". Using her(it) as jumping-off place, participants of group managed to receive access rights to some servers in an internal network. The further was, first of all, direct consequence(investigation) of disorder of employees of bank. So, got access to corporate email, hackers have managed to intercept letters to which in the obvious form passwords and were sent the instruction on access to various systems. When this information lacked, passwords to servers were selected by means of the elementary program perebora, the blessing were for this purpose simple enough to be present at the typical dictionary. In spite of the fact that the network of bank was equipped with system of detection of intrusions, system managers appeared so self-confident and inattentive, that hackers could walk about on their possession practically not masking - reports of system simply nobody read.

This hacker's group professed ideology white hats (" white hats "). At the hacker's environment there is a division on "black" and " white hats ", slightly reminding division of wizards met in fairy tales on kind and malicious. " Black hats " consider possible(probable) to take advantage for themselves of the knowledge and found out in another's systems ujazvimostjami for fulfilment destruktivnykh actions, plunder of another's money etc. For " white hats " it is ehticheski unacceptable - their basic purpose is studying complex(difficult) systems, revealing of unevident features of their work, reception and distribution of the information. Probably, farly from being all from participants of group were so sincere idealists, - followed events confirm it, - and absence of attempts to take advantage of access to accounts of clients of bank speaks elementary care and presence of a head shoulders. Nevertheless, server "Citibank" were used by participants of group as research range and even a playground - as recollects ArkanoiD, his(its) loved(liked) entertainment at that time was game in " Star Trek ", far off started on one of bank servers.

Completely it is no wonder, that in conditions of the uttermost disorder of system managers Russian hackers shortly actually began to manage in a bank network, having studied her(it) it is much better than its(her) own owners. They had poehtazhnymi plans of accommodation of the equipment, had an opportunity of access to accounts of clients and even solved the fine technical problems arising at bank workers. This orgy proceeded some months during which electronic systems of one world from the largest banks were under practically full control of group of the Russian hackers, and anybody at all did not notice it, while once one of participants of group has not sold the recipe of an input(entrance) in a bank network to Vladimir Levinu for 100 dollars cash - in what, actually, has on the spot repented, but was already late. Levin just only reflected and planned, as it is possible to take advantage with benefit the received information, and participants of group have covered up traces and have left(abandoned) network "Citibank" never more there to not come back.

Who is Mr. ArkanoiD? The first natural questions arising at acquaintance with this history, brushing away on the script of the Hollywood film: as far as the given information is authentic who such this mysterious ArkanoiD, whether it(he) tells the truth or completely foreign person for any reasons has decided to make to itself pablisiti, povoroshiv a history of bygone days?

On the reference(manipulation) to the electronic address specified as contact in clause(article), published on " the Independent review of providers ", the answer was received what to contact to journalists directly the author is not going, and his(its) any contacts to press should be carried out through Alexander Militskogo - the co-owner and the head of "Review", one of conducting Russian experts in the field of the Internet and telecommunications.

" The Independent review of providers " is well-known in the telecommunication market as a resource periodically publishing sharp and ambiguous, but authentic and qualitative clauses(articles), - it is enough to note, that loud scandal about piringovykh wars of main Internets - operators has burst at the end of 2002 after the publication on "Review". Alexander Militsky declares, that he(it) does not have absolutely any bases to doubt of reliability of data informed in clause(article). To open the person of the author it(he) as affirms, could not at all desire - their dialogue occurs through the Internet, and to Mr. Militskomu are unknown neither the present name, nor ArkanoiD'a address. However, and those data which anyhow might result in disclosing a pseudonym, it(he) refuses to inform differently, than under the decision of court (referring on the Law of the Russian Federation " About mass media ") though thus it(he) separately emphasizes, that from the point of view of the Russian legislation working on that moment the author of clause(article) has not made any crime, and limitation periods under the American laws have already expired. It(he) has informed only, that ArkanoiD lives in Saint Petersburg, works as the expert on information safety in one of the IT-companies and is not engaged in any illegal activity.

On given by our edition at intermediary of Mr. Militskogo the question, whether is it(he) the main character in a history with breaking "Citibank", or there are also other persons who have brought in the serious contribution to realization of this operation, ArkanoiD has answered literally the following: " Yes, I am - not only as the coordinator, but also as the researcher. Except for mentioned in this history, was some more persons accepting active participation, but now contact to them at me is not present. If someone from participants considers, that I have given not enough attention to his(its) achievements in this story, let do not take offence, and will add my history. It should not be understood so as if I personally want to appropriate(give) to myself achievements of all group, and only I want to describe the role correctly. That is it is possible to tell, that I have made more, than someone, but is no more, than all taken together. "

On the Russian and international hacker's stage name ArkanoiD is well-known, and in a number of versions of informal charts computer andergraunda it(he), alongside with such characters as Solar Designer, concerns to number of the most qualified hackers in territory of the former USSR. Attempts to inquire in andergraundnojj to environment(Wednesday) have confused business, faster, have rather than cleared, - for example, on some hearings, ArkanoiD de jure does not exist at all in a nature as at him(it) is not present and never there were passports. Under some information, it(him) call Aleks Smirnov, however there is no completely any confidence, that his(its) this present name. In " Alive magazine " there is a user living in St. Petersburg with a similar pseudonym, but in day of the publication of clause(article) it(he) has promulgated the message in which has declared the uttermost non-participation in all this history.

Nevertheless, the author of clause(article), undoubtedly, is the real person and, most likely, has really played rather essential role in breaking of network "Citibank" in 1994.

New persons Literally in some hours after ArkanoiD has published clause(article) on the server of " the Independent review of providers ", one of conducting Russian experts on information and network safety Dmitry Leonov has placed on the site " Russian BugTraq " the chapter of the book " Attack from Internet ", written by him(it) in the co-authorship with Ilya Medvedkovskim, Pavlom Sem`janovym and Alexey Lukatskim. There also there is a speech about business Levin and breaking "Citibank" - memoirs of one of participants of events are quoted with preservation of author's spelling and a punctuation:

":Prodolzhenie histories was approximately in 94 year. Then to me has on a visit gone my familiar, we shall name it(him) Bukazoid, and has very foggy told, that it(he) has dug in Sprint a heap of interesting hosts. I have recollected about the digging in bowels of Sprint and have quickly drawn into a conversation it(him):). Bukazod as appeared, has very much grown fond of one BBS which what for have established in Citibanke, has found there I booze the holes, allowing to establish any limits to users, and sat there regularly, using her(it) for dialogue with friends from different cities (the blessing paid for all Citibank).

For convenience of hackers servers had help command, and as the commands showing a configuration, the list of known IP-addresses on ARP, the list of known services (hosts in LAT and local services), and with comments. I am very fast navajal a script which downloaded the list of services, then konnektilsja with all and wrote down that they responded. THUS it was found a heap of servers - gateways in other networks, outdial'y - access to modems with an opportunity to call worldwide, the services, allowing to establish connections on X.25 from name Citibank (only on Sprintnetu and Timnetu), and paid soediennija, that allowed to incorporate to those hosts which have refused to accept the outstanding connections or connections from Russia that earlier investigated gateways in the Internet from Sprint and outdial'ami Sprint again have allowed to take advantage:)

At last I have found that searched - for Internet connection. One of routerov, in Chile to which the channel on any local bank was connected, had the address of this bank on the interface to it(him). And from a grid of that bank was open routing in the Internet. Zajjdja telnetom on this router, it was possible from him(it) further telnetom to go anywhere. And back - it was possible to go from the Internet on this router, and from him(it) - in internal network Citibank and is farther, for example, on X.25.

Bukazoid too did not doze. To program to it(him) there was a laziness, therefore it(he) dug not in breadth, and deep into. One of terminal servers had zanjatnuju dyrku - it(he) did not trace disconnect of the clients who have got on him(it) on X.25. Any client who has come on him(it) on X.25, appeared connected to the that computer with which the comrade who has earlier appeared on the same port worked if it(he) has overlooked to be chopped off from him(it). For convenience, access servers had show users command showing all clients on all ports, and addresses or names of computers to which they were connected. You come on the server, you collect(type) show users, otkljuchaesh`sja from him(it) and it begin to be connected to those ports on which someone hangs. If the port is already free, finds yourself in the necessary place. Bukazoid so has quickly got on couple VAXov instead of them adminov, has got(started) to itself there I booze loginov and has engaged in studying VMS and activity adminov Citibank. Collected there any files, read correspondence etc. For example, adminy liked to send each other the big lists with administratorskimi passwords of machines:)))

Naturally, on VAXakh the remarkable control of safety which result were huge reports on all suspicious activity was... Bukazoid has found one such - in it(him) there were all traces of his(its) work. It is sure, that that report was unpacked, bound (printed out, bound) and put on a shelf:)). From their correspondence it was found out, that about problems with this access server all know... But it especially did not excite anybody - it(him) planned to replace in one half-year - year. The matter is that was considered, that hackers may not climb through Sprint - in the American Sprint observation of hackers was well put and there nobody was put. But the world became much closer. Except for us in Citibanke dug a hacker from Bulgaria and other places.

Naturally, more than once I and Bukazoid appeared connected through this gljuchnyjj the server and to the computers responsible for financial operations. As instead of adminov, and users who worked with a certain system "client - bank" through the terminal. Simply it was possible to enter number of the account and to transfer(translate) from the account of the client money. But presence of brains has helped to avoid a criminal case - it was understandable that to steal money and to remain thus unnoticed will fail, and if it will turn out, will fail to survive after that:) Therefore with money we bypassed computers the party(side) - not it was necessary.

A bit later use Citibank became usual routine - simply convenient exhausted hole for an output(exit) in different places. Approximately in half-year has thundered a thunder - Levin has plundered bank. In couple of days to me has come running our general(common) familiar with Bukazoidom, and with horror in a voice has told, that it it(he) has told Levinu about secret, having received for it of 100 $. By a lucky chance, I with Levinym was unfamiliar, therefore me have carried by and on interrogations did not drag. But the lesson was good - it was possible to ring out for another's sins easily. Though we UK did not break - at that time there were no clauses(articles) about the non-authorized access in UK, and we did not steal money:) "

About the author of this fragment we managed to find out, that it(him) call Anatoly, it(he) also lived earlier in St. Petersburg and is the known expert in the field of telecommunications.

Obviously, under pseudonym "Bukazoid" in this fragment anybody is mentioned other, as ArkanoiD, published clause(article) on " the Independent review of providers ". The fragment was obviously written long before the moment of its(her) publication, and may be considered as independent acknowledgement(confirmation) of truthfulness of the history stated there.

Bearded sensation Steadfast studying of a question results us in rather curious conclusion - all this sensational history, it appears, very long time ago is a secret polishinelja. Both itself ArkanoiD, and his(its) environment already some times was done(made) with attempts " to tell the truth about business Levin " and repeatedly contacted to journalists of various editions, beginning(starting) since 1997. However fond up to fried sharks submitted a feather a history under such sauce, that anybody from serious people in its(her) reliability simply did not trust, and at to mountain - n`jusmejjkerov was developed proof idiosinkrazija on dialogue with representatives of the second most ancient. As writes itself ArkanoiD:

" To a question on that, for what I do not love journalists. I already did(made) some attempts anyhow to tell this history - and each time she(it) was monstrously perevrana. In particular, it is especial me irritates that fact, that journalists in final edition - which " for technical reasons " " overlooked " to show each (!) time when it was possible to me to give interview, to me, decided " to simplify " my story and to present business so, that it I and was that person who has sold Levinu materials of research group. The god would like to tell " to them the judge ", but, being is far from christian religion, I shall tell - spit in I shall give birth this rubbish. Similar accusation puts under doubt not only my professionalism, and even presence of elementary common sense. Certainly, I well understood the price of this information, and on any similar bargain and speech might not be. Yes, I was mistaken also my mistake of me to much have learned - but the idiot I was never. " The similar attitude(relation) is simple for understanding if to familiarize, for example, with clause(article) Kurta Brandenburgera " Russian m@fija " in Swiss magazine Facts:

":How the person whom long time is in the lead in the list of the best hackers looks? A brown leather coat, dark glasses, black hair up to shoulders, any mix from hippie, Rasputina and the villain from computer films. And this person with the computer holds in fear Russian banks, a body of radio station and owners of credit cards?

Arkenojj has penetrated into hospital maps of city hospitals, cracked codes of credit cards and manipulated accounts new Russian. As asserts(approves) itself Arkenojj, it(he) did(made) it for the pleasure, instead of with the purpose of enrichment: "

After occurrence in a seal of similar samples of journalistic art it is no wonder, that participants of those events have for a long time interrupted any contacts to press, and today prefer to tell about them independently, having fenced off from journalists intermediaries. If tone of then publications was less frivolous, quite probably, the history might develop and differently - you see for a moment when they have come out of press, limitation periods under the American legislation yet have not expired, and participants of breaking "Citibank" might be done responsible alongside with Levinym and it(him) podel`nikami.

Nevertheless, and it has sufficed, that in okolokomp`juternojj to environment(Wednesday) the history about breaking "Citibank" was perceived as well-known and almost classical, and well-known 100 dollars which Levin has paid for his(its) secrets, became the talk of the town. The mentioned publications open a number(line) of technical details and give performance about scale of authority which Russian hackers within several months had above a network of one world from the largest banks, - however anything essentially new, as a matter of fact, do not inform.

Scales of threat As now it became finally understandable, Vladimir Levin had no accomplices inside bank, and the opportunity of so grandiose operation appeared real, first of all, because of razdolbajjstva bank employees and their neglect elementary norms of safety. Nevertheless, capture of the control above network "Citibank" has demanded long and laborious work of group of the highly skilled hackers pursuing, however, not mercenary, but the research purposes.

Whether probably recurrence of a similar history on the part of the organized criminal grouping having more mercenary aspirations, rather than in a described case? Authors " Attacks from Internet " concern to such prospect rather skeptically: " ... The problem network krakerov in that kind as she(it) is usually presented MASS-MEDIA, actually is absent. Yes, many forces should be given protection of computer systems against "pseudo-hackers" which count itself professionals, being able to start various "njuki" (nuke) or to select passwords such as "guest". They are capable to put it the certain loss. Exist, certainly, and more qualified groups krakerov, engaged, for example, breaking of WWW-servers for "uvekovechivanija" an own name. But in us causes the big doubt existence of professionals, and furthermore adjusted industry which supposes breaking any more - less protected host "to order". By own experience we may assume, that the price of such breaking should be in some times more, than value of the information taking place there, therefore in a course there are old checked up methods such as recruitment or a payoff.

Summarizing, we count, that network krakerov, specializing on opening of hosts for money or with the purpose of use of the received information for own enrichment, practically does not exist. Their qualification should be so high, that they for certain are hackers, instead of krakerami. " However, ArkanoiD with it(him) it do not quite agree: " it is in most cases really true, that it is easier to achieve the decision of a problem(task) other methods, but for some reason many want so. And time is demand, means, for certain there will be also an offer... "

Sergey Rublyov