POLL: Sales of hacked, compromised, and/or unauthorized transfers of accounts.

[shep]

UPDATE: Could bitcointalk members please respond to this thread with direct feedback supporting or objecting to sales of hacked/compromised/unauthorized accounts.  Unfortunately, Theymos is not persuaded to act on just poll results alone despite this appearing to be a fairly black and white issue especially when it comes to hacked accounts being sold.


I've started this thread to bring attention to a growing problem here on bitcointalk.org. Board members here are engaging in sales of hacked, compromised or unauthorized transfers of accounts for other websites.  While marketplace rules don't explicitly prohibit this behavior, I believe that many board members would consider these acts objectionable and disturbing. These sellers in turn are donating proceeds of their sales of compromised accounts back to bitcointalk.org.   If a user on another board was selling large numbers of bitcointalk.org accounts without the express permission of Theymos, i think admins here would be pretty steamed.

My personal feeling is that tolerating this behavior will only encourage more of these users to permeate these forums. Bitcoin and bitcointalk are trying to build a reputation, but these sorts of transactions when tolerated or approved reduce reputation of the site and currency as a whole. I hope that others feel the same way about this issue and will voice their objections in this thread.

It would be nice to have an informal poll about whether users here support or object the sales of hacked/compromised accounts.


Yes, I support sales of hacked/compromised/unauthorized transfer of accounts
No, I object to these sales.


+1 No

[shep]

Theyn thank you for pointing out the option

[shep]

Could members please respond to this thread with direct feedback supporting or objecting to sales of hacked/compromised/unauthorized accounts.  Unfortunately, Theymos is not persuaded to act on just poll results alone despite this appearing to be a fairly black and white issue especially when it comes to hacked accounts being sold.

[error]

Selling a compromised account that doesn't belong to you is *fraud*. I am extremely shocked that anyone involved in running this forum might condone such an activity....

[Deafboy]

I haven't seen any offer you are describing here on bitcointalk. Can you post link to some examples?

[BCB]

No I don't support this.  The bitcoin community/economy has enough troubles and misconceptions to overcome and bitcointalk.org should not be encouraging or supporting this kind of activity.

[shep]

I haven't seen any offer you are describing here on bitcointalk. Can you post link to some examples?

There are a number of threads in the marketplace forum that can be considered highly questionable sales.  A perfect example is the thread below.

https://bitcointalk.org/index.php?topic=130309.0;all




Explanation with breakdown of that thread.  There is more to this than can be discussed here.  Information was shared with Theymos privately. I had hoped that Theymos would act on this issue without the need for community intervention, but he has not yet acted against torac.  (torac is donating a portion of proceeds from each sale back to the site, which creates a conflict of interest in acting against torac)

https://bitcointalk.org/index.php?topic=484.msg1422113#msg1422113

+1 torac

I've attained multiple digital goods through him. Very responsive, helpful, and honest.

I don't consider a seller that transacts in hacked/compromised/ and or unauthorized transfers of accounts as an "honest" seller. Torac sold you login credentials that were not his to sell.  If you believe that the credentials you acquired are legitimate and not compromised you should contact the admin of the site to which they belong and confirm their authenticity. lol

If they were hacked, the original owner would contact the admins. He says he acquires them through trading and I believe him. If I thought they were stolen accounts I would have nothing to do with them. I think sometimes admins sell through the back door. Yes, selling accounts does break ToS with these already half-legal sites. Then again, jailbreaking an iPhone breaks ToS contract as well. Torac has long-time connects in the tracker invite scene. The nzb site craze is a brand new thing--and there is a lot of crossover. Become a power user on what.cd, hang out on IRC and tracker forums-- you meet a lot of people with a lot of axx.

The credentials torac is selling could be hacked.  You'll notice that torac was directly asked if the credentials were "hacked", torac did not answer this question and instead answered that they were "safe".  

Are these legit or hacked?

I'll take 1 if its real

The accounts are safe. If there will be any problems with them I will refund your money or give you another one for free.

Torac is also openly telling buyers not to change email and password credentials, which would inform the original account holder that their account is compromised.

WARNING : IF YOU BOUGHT NZBS ACCOUNT FROM ME DON'T TRY TO CHANGE E-MAIL AND PASSWORD NOW, THEY ARE WATCHING ALL ACCOUNTS AND BANNING THEM BECAUSE THEY KNOW THEY ARE SOLD !!! It wil get disabled I think if you change it. Already 2 accounts got disabled. Just use them as they are with that account and password and it should work fine for a while, maybe later you can try change the e-mail and password to your own e-mail and password but at the moment please do not do it just use it as it is.

Torac states not to list any details in the transaction. He doesn't want payment processors flagging his payment accounts.

If you send me payments, try sending as gift or goods or any other type, make sure you do not type any comments in the transaction

Torac states that he did not register the accounts.  This is highly suspicious when he is selling large volumes of accounts.

Please understand that I got the accounts by trading with other people on the internet, different trusted contacts of mine, I didn't sign-up the accounts myself. There is a chance you will encounter problems with the accounts. Please let me know if it is the case to refund you the money or to give you another account for free. Thank you for understanding.

The most likely methods of gaining credentials via automation is by brute force,  a worm/rootkit (keylogger), or via a honeypot (proxy, assuming the user transmitted via a non-secure protocol). Hacked accounts would only be identified as such when the registered user reports them (which would most likely occur when email or passwords are changed).  However, dormant and abandoned accounts or accounts infrequently used may not even be reported as hacked.  Whether it's hacked, compromised, or unauthorized, torac can spin any line he wants, he's taking in money while he can, and when this angle closes for him he'll be on to the next site to abuse.

I can tell you straight up that admins of multiple sites targeted by torac, do not approve of these sales.

Your argument about breaking ToS is a non-sequitur. There is no right of first-sale doctrine with a service, you don't own your account like you do with an iphone (property) or with games (IP) you purchased via a steam account. To add insult, some of these sites provide a free service. Most sites have actively closed registration and removed invites.  If admin wanted new users they would open registration or provide their existing userdb with invites (not likely to happen in the conceivable future thanks to torac).  

Torac is openly creating a security issue by selling accounts.  Now nokru is suggesting to escalate site abuse by loading 15-20 users per account and selling access via a proxy service. Not only is this rampant site abuse and open hostility toward admin, but it introduces a security nightmare whereby admins can not control who gains access to their sites.  I can tell you this, if you love your $10-$400 account bought from torac now, you're going to love it a lot less when a few of these sites decide to purge their entire db or shutdown.  There are always a few assholes that ruin things, Torac and nokru are very close to convincing sites to pursue this course of action.  Don't expect torac, MariusTi, PTseller or similar sellers to care about collateral damage, they've made their money, the rest of you suckers and a lot of innocent bystanders will be left in the wind.

You should also ask yourself what are the motives of people willing to spend $50-100+ per account.

[shep]

No I don't support this.  The bitcoin community/economy has enough troubles and misconceptions to overcome and bitcointalk.org should not be encouraging or supporting this kind of activity.

What boggles my mind is you would think after the cosbycoin hack of bitcointalk.org in 2011 that Theymos would not be receptive to this type of activity taking place on this forum.  I don't think Theymos would want someone selling his login credentials on another forum.

[theymos]

I haven't seen any offer you are describing here on bitcointalk. Can you post link to some examples?

There are good reasons to think that torac is selling hacked accounts.

Selling hacked accounts is not banned by any current forum policy. Selling the accounts is not illegal as far as I know (maybe the act of hacking the accounts is illegal). I'm always reluctant to go against the forum's policy of free speech, and in this case I'm not even sure that the trades are immoral. On one hand:

- The victims probably never notice.
- If the victims do notice, they can probably get their accounts back without too much hassle.
- There is no violence or deception involved.
- torac is only selling information. Some part of me thinks that selling information can never be wrong.

On the other hand, there are victims...

Also, I can never know with absolute certainty whether someone is selling hacked accounts or just reselling accounts that have been given to them willingly. (Reselling willingly-given accounts is OK. The forum clearly has no obligation to enforce the terms of service for other sites. Otherwise common trades such as Steam trades or PayPal transfers would be disallowed.) This makes a ban on trading hacked accounts potentially messy to enforce. Should I ban trades that are only probably trades of hacked accounts?

torac is donating a portion of proceeds from each sale back to the site, which creates a conflict of interest in acting against torac

The forum is non-profit. I don't get anything whether he donates or not.

What boggles my mind is you would think after the cosbycoin hack of bitcointalk.org in 2011 that Theymos would not be receptive to this type of activity taking place on his own forum.  I don't think Theymos would want someone selling his login credentials on another forum.

I wouldn't like it, but I'm not sure that selling the credentials would be immoral.

[shep]

I haven't seen any offer you are describing here on bitcointalk. Can you post link to some examples?

There are good reasons to think that torac is selling hacked accounts.

Selling hacked accounts is not banned by any current forum policy. Selling the accounts is not illegal as far as I know (maybe the act of hacking the accounts is illegal). I'm always reluctant to go against the forum's policy of free speech, and in this case I'm not even sure that the trades are immoral. On one hand:

- The victims probably never notice.
- If the victims do notice, they can probably get their accounts back without too much hassle.
- There is no violence or deception involved.
- torac is only selling information. Some part of me thinks that selling information can never be wrong.

On the other hand, there are victims...

Also, I can never know with absolute certainty whether someone is selling hacked accounts or just reselling accounts that have been given to them willingly. (Reselling willingly-given accounts is OK. The forum clearly has no obligation to enforce the terms of service for other sites. Otherwise common trades such as Steam trades or PayPal transfers would be disallowed.) This makes a ban on trading hacked accounts potentially messy to enforce. Should I ban trades that are only probably trades of hacked accounts?

torac is donating a portion of proceeds from each sale back to the site, which creates a conflict of interest in acting against torac

The forum is non-profit. I don't get anything whether he donates or not.

What boggles my mind is you would think after the cosbycoin hack of bitcointalk.org in 2011 that Theymos would not be receptive to this type of activity taking place on his own forum.  I don't think Theymos would want someone selling his login credentials on another forum.

I wouldn't like it, but I'm not sure that selling the credentials would be immoral.

Theymos I can post additional background information conducted via profiling, but that would require publicly posting torac's real name.  There is ample evidence in his personal history showing similar questionable ethics and actions being taken against him elsewhere.


OFF-TOPIC: There is ample evidence to show that the rule of first-sale doctrine does apply in the case of re-selling games purchased online despite ToS not allowing such acts.  That is a completely different issue and case for discussion than what is taking place here. First-sale involves transfers of property, accounts are not property possessed by the account holder, but personal property may be contained within an account (property within an account should be allowed for transfer if evidence of ownership exists).  The point here is that a user doesn't own an account, an account is authorized for use per ToS and permission to access may be revoked.

ON-TOPIC: In this specific case, torac is selling accounts that he does not own, nor does torac own a right to property.  He and other users engaging in these types of account/invite sales have no argument on any grounds for sales of accounts or even on sales of invites.

https://en.wikipedia.org/wiki/First-sale_doctrine
http://www.wired.com/threatlevel/2012/10/scotus-first-sale-2/


The case linked above relates to resale and/or transfer of property originating from foreign markets, but also applies to IP.  Another US Supreme Court (SCOTUS) case involves the transfer of digital goods and rights associated (with arguments made about transfer of property, like games purchased/associated with an existing account).

In July the EU ruled that users can transfer property purchased via an account (this does not mean the account itself can be sold).

http://www.forbes.com/sites/gregvoakes/2012/07/03/european-courts-rule-in-favor-of-consumers-reselling-downloaded-games/
http://forums.steampowered.com/forums/showthread.php?t=2783990
http://www.techdirt.com/articles/20120703/11345519566/eu-court-says-yes-you-can-resell-your-software-even-if-software-company-says-you-cant.shtml

[Raize]

I know this sounds crazy, but one of the datacenters I purchase from had an aggressive marketing scheme. They were "reselling" their own servers on private sites to try to break into a different market at rates that looked like the servers were stolen/hacked, and they wanted to do so without letting their regular high-paying customers know they were offering better deals to other people. They purchased a nearby building where they were "housing the servers", but it actually became an off-site warehouse they used. Meanwhile they ran two operations, one for high priced servers for powerful clients and one for dirt cheap servers for torrenting and seedboxing. They even made up things like "make sure you don't go over too much CPU/RAM usage during the day or else it'll get noticed," but in actuality they were saying that to prevent their day-customers from having issues. To my knowledge, this company still does this, and it's a very slick way to optimize their datacenter's use.

Additionally, though it seems suspicious, having a record of the transactions will be handy for law enforcement when/if they sequester the records. If you know its an actual crime, report it and point the authorities to the thread. Otherwise you're honestly kind of speculating. I'd recommend contacting whoever you think is getting scammed as well, and point them to the thread.

[shep]

I know this sounds crazy, but one of the datacenters I purchase from had an aggressive marketing scheme. They were "reselling" their own servers on private sites to try to break into a different market at rates that looked like the servers were stolen/hacked, and they wanted to do so without letting their regular high-paying customers know they were offering better deals to other people. They purchased a nearby building where they were "housing the servers", but it actually became an off-site warehouse they used. Meanwhile they ran two operations, one for high priced servers for powerful clients and one for dirt cheap servers for torrenting and seedboxing. They even made up things like "make sure you don't go over too much CPU/RAM usage during the day or else it'll get noticed," but in actuality they were saying that to prevent their day-customers from having issues. To my knowledge, this company still does this, and it's a very slick way to optimize their datacenter's use.

Additionally, though it seems suspicious, having a record of the transactions will be handy for law enforcement when/if they sequester the records. If you know its an actual crime, report it and point the authorities to the thread. Otherwise you're honestly kind of speculating. I'd recommend contacting whoever you think is getting scammed as well, and point them to the thread.

That's interesting conjecture, but not relevant to the example I'd previously given.  This is not speculation, I have been in direct communication with admin, and reclaimed 7 accounts of over 60 sold from sites that torac was offering up for sale.  Admin of those sites are aware of this board and of multiple threads involving the seller. Information was passed on to those effected; if admin choose to act beyond this board they will by their own choice.  Torac's payment processing information and much more personally identifying information has been documented (not all of this has been shared publicly or privately).  

Theymos was informed a week ago privately and supplied with evidence, but chose not to act.  He's continuing to protect torac. Why I do not know, I've speculated it has to do with torac donating a portion of his proceeds back to the site. Theymos hasn't openly refused torac's donations and continues to accept his money. I had hoped that this issue would have been resolved privately.  The longer this continues with torac and similar sellers being given sanctuary it makes the reputation of the site look worse.

[🏰 TradeFortress 🏰]

I'm always reluctant to go against the forum's policy of free speech

Try saying that while thinking of Goat and Rarity and maintaining a straight face.

I think this forum should prohibit ILLEGAL activities of where the servers are hosted. Are selling stolen property knowingly illegal? Yes, and there is reasonable evidence that torac is selling hacked accounts.

Do you ban posts selling stolen credit card details?

[shep]

I'm always reluctant to go against the forum's policy of free speech

Try saying that while thinking of Goat and Rarity and maintaining a straight face.

I think this forum should prohibit ILLEGAL activities of where the servers are hosted. Are selling stolen property knowingly illegal? Yes, and there is reasonable evidence that torac is selling hacked accounts.

Do you ban posts selling stolen credit card details?

These comments by Theymos strike me as odd.

1. Theymos acknowledged publicly and privately that accounts torac sells are likely hacked

There are good reasons to think that torac is selling hacked accounts.

2. Theymos stated that he does not think selling hacked accounts is immoral.

Selling hacked accounts is not banned by any current forum policy. Selling the accounts is not illegal as far as I know (maybe the act of hacking the accounts is illegal). I'm always reluctant to go against the forum's policy of free speech, and in this case I'm not even sure that the trades are immoral. On one hand:

- The victims probably never notice.
- If the victims do notice, they can probably get their accounts back without too much hassle.
- There is no violence or deception involved.
- torac is only selling information. Some part of me thinks that selling information can never be wrong.

3. Theymos stated that he would not object if someone hacked his own bitcointalk.org account and sold his admin credentials elsewhere.
(This is ridiculous. I do not know any admin IRL or any other person that could make that comment with a straight face and expect someone to believe them).

What boggles my mind is you would think after the cosbycoin hack of bitcointalk.org in 2011 that Theymos would not be receptive to this type of activity taking place on his own forum.  I don't think Theymos would want someone selling his login credentials on another forum.

I wouldn't like it, but I'm not sure that selling the credentials would be immoral.

4. Theymos was asked directly in a private conversation, if admin of sites affected were to contact him directly would he assist them in reclaiming accounts.  Theymos responded "no."

In two conversations, Theymos has shown little to no interest in assisting admin of other sites or in dealing with torac and sellers like him directly. Rather than dealing with the issue he suggested I create this thread in the meta forum and let the community decide. Per his suggestion I did that.  Poll traffic, responses, and feedback were small over the first week, but they did show by 9-3 that users here objected to sales of hacked accounts.  Theymos said this wasn't enough to act.  I updated the thread on Saturday asking users for direct feedback; since this update we've had additional comments and 20+ more users vote in the poll. Results now indicate a similar result as last week. Users object to sales of hacked accounts.  Theymos hasn't taken action against torac, nor has he indicated when or if he will act or what "community threshold" will convince him to act accordingly.

I wish this was not the case, but right now I don't know how to interpret Theymos continued actions other than an implicit advocation of sales of hacked/compromised credentials.

[repentance]

Do you ban posts selling stolen credit card details?

I'm curious about this too.  Where is the line on selling stolen accounts drawn?  Forum accounts?  Game and other subscription service accounts?  PayPal and other payment processor accounts?  Bitcoin service accounts?  Conventional financial services accounts?

[dscotese]

I think it's reasonable to tell forum moderators that if they want to censor messages advertising the sale of stolen accounts, they may do so.  I doubt that Theymos strictly enforces any rules about such censoring, so he wouldn't need to say anything.  Just point the mods of the boards where thieves advertise to this thread and try to convince them to start censoring if you think that's the right thing to do.  I would stop at "If you think it's best to block that kind of post, go for it."  See if a debate develops or what.  My general strategy is to add information rather than hide it.

Anyway, if you like sticking your nose in like that, feel free to contact the website of the account that may have been stolen and ask them about contacting a possibly hacked user, if you can get enough info from the supposed thief to do that.

[shep]

I think it's reasonable to tell forum moderators that if they want to censor messages advertising the sale of stolen accounts, they may do so.  I doubt that Theymos strictly enforces any rules about such censoring, so he wouldn't need to say anything.  Just point the mods of the boards where thieves advertise to this thread and try to convince them to start censoring if you think that's the right thing to do.  I would stop at "If you think it's best to block that kind of post, go for it."  See if a debate develops or what.  My general strategy is to add information rather than hide it.

Anyway, if you like sticking your nose in like that, feel free to contact the website of the account that may have been stolen and ask them about contacting a possibly hacked user, if you can get enough info from the supposed thief to do that.

This really isn't a matter of free speech. I have offered to supply information and have more information on this seller to share.  Admin of targeted sites have been purging hacked/compromised accounts that they can identify, but in the process some innocent users are probably getting caught in the net.  I approached Theymos, to try and help some of these admin.

Theymos has shown minimal interest in addressing the issue of sales of hacked/compromised credentials or in dealing with sellers that transact in large volume of credentials for accounts that clearly do not belong to them.  This is highly disturbing. In principle there is not a major difference between sales of hacked/compromised forum or website accounts from that of sales of credit card numbers.  Access is unauthorized, services are being used without permission, and control over userdb is being subverted.

[lassdas]

@theymos:

- torac is only selling information. Some part of me thinks that selling information can never be wrong.

Do you ban posts selling stolen credit card details?

I'm curious about this too.  Where is the line on selling stolen accounts drawn?  Forum accounts?  Game and other subscription service accounts?  PayPal and other payment processor accounts?  Bitcoin service accounts?  Conventional financial services accounts?

I'm curious about that too, what about credit cards, PayPal-, or MtGox-accounts?
Those are only information too, so i guess you're fully ok with selling stuff like that on the forums, huh?

I mean, ARE YOU SERIOUS?

[b!z]

@theymos:

- torac is only selling information. Some part of me thinks that selling information can never be wrong.

Do you ban posts selling stolen credit card details?

I'm curious about this too.  Where is the line on selling stolen accounts drawn?  Forum accounts?  Game and other subscription service accounts?  PayPal and other payment processor accounts?  Bitcoin service accounts?  Conventional financial services accounts?

I'm curious about that too, what about credit cards, PayPal-, or MtGox-accounts?
Those are only information too, so i guess you're fully ok with selling stuff like that on the forums, huh?

I mean, ARE YOU SERIOUS?

Financial fraud has never been allowed on this forum, as far as I know.

It is okay to sell game / torrent accounts etc., but not Paypal, or cc info. I think the admins have already drawn the line here.

[lassdas]

It seems they haven't drawn a line anywhere, as theymos clearly stated, that

Selling hacked accounts is not banned by any current forum policy. Selling the accounts is not illegal as far as I know (maybe the act of hacking the accounts is illegal)...

Selling hacked accounts is not financial fraud, it will probably lead to financial fraud though.

IMHO selling hacked accounts should immediately be banned by a forum policy, no matter if game, torrent, or any other account. And it really doesn't matter if it was the seller who hacked it, or the one he bought it from.

I can't believe that shit about "there's no victim", "but if, not much hassle", "no violence" and best of all "only information".
Honestly, i'm shocked.