The Register Home Page

back to article Researchers didn’t want to glamorize cybercrims. So they roasted them

Cybercrime crews have become almost mystical entities, with security vendors assigning them names like Wizard Spider and Velvet Tempest. They hide out in hidden corners of the dark web (often accompanied by a clearnet leak site), leading some infosec folks to talk about these miscreants as if they are invincible. But not …

  1. Doctor Syntax Silver badge

    "Scrawny Nuisance" or "Evil Ferret."

    I'd go for "miserable little toe-rag" or "useless piss-pot".

    1. The man with a spanner Silver badge

      Steaming pile,

      Foul excrescence,

      The vapid nonentity team,

      The clueless etc

      1. elsergiovolador Silver badge

        404 Career Not Found

        Zero Day Job

        Stack Underflow

        The Unshippables

        Null Contribution

    2. DJO Silver badge

      If deglamourising is the aim then don't name, just number the groups.

      Malwaregroup#321, malwaregroup#322 etc. (not starting from #1 as that too could have a certain cachet).

      1. Anonymous Coward
        Anonymous Coward

        If I'm going to get a ransom email I want it to be from 'Velvet Crimson' rather than 'Discrete HackOrg 4'

      2. Anonymous Coward
        Anonymous Coward

        My vote

        Vibe_Malware_Group_<random number>

        Just to make it a bit insulting.

        1. Anonymous Coward
          Anonymous Coward

          Vibe_Malware_Group_69

          Nice!

  2. VicMortimer Silver badge

    Is it just me, or does Evil Ferret actually sound pretty cool?

    1. Blazde Silver badge

      Even 'Scrawny Nuisance' could be made work. A name is a name, it's what you do with it that counts.

      https://tvtropes.org/pmwiki/pmwiki.php/Main/AppropriatedAppellation

      "When you bring me out, can you introduce me as Joker?"

    2. cd Silver badge

      Sounds like Ubuntu...

    3. Ken Shabby Silver badge
      Alert

      Being as they are cunning, viscous, razor sharp toothed, evil little bastards. I reckon it is a tautology. Ask a Rabbit.

  3. Alien Doctor 1.1

    Shoot me down if you wish, but for decades I have wondered how many of these cybercrims actually work as security professionals/$bigcompany devs.

    1. doublelayer Silver badge

      It's always possible and it has happened, but there's a reason those we've identified mostly haven't been. If you're already employed as a security professional in a big company then you have a relatively stable and well-paid job. The theoretical rewards of crime may be higher, but those experienced in security will also be those who have had the most opportunity to see that a few people in the ransomware game make millions, many make less than a normal job would, and many make nothing at all, so the chance of getting that criminal payday aren't as good as they appear. Also, if you're ever caught, you lose your ability to keep having the security job you started with, so the risk is higher for someone who has one than for someone who thinks they won't get one.

      1. M.V. Lipvig Silver badge

        So what you're saying is, the money for legit cybersecurity folks is in training the crims. The crims still take all the risks, and ensure the cybersecurity folks continue to be needed - with the advantage of knowing how the crims think.

    2. Clausewitz4.1
      Devil

      ” for decades I have wondered how many of these cybercrims actually work”

      Fluffy Bunny worked for a multinational for quite some time, me believes, before joining other circles…

  4. vulture65537

    This old classic article

    https://www.ranum.com/security/computer_security/editorials/dumb/

    Says, among other things:

    The #4th dumbest thing information security practitioners can do is implicitly encourage hackers by lionizing them. The media plays directly into this, by portraying hackers, variously, as "whiz kids" and "brilliant technologists"

    1. DS999 Silver badge

      Hollywood was long glamorized them

      Movies always portray bad guy hackers as nothing short of Einstein level geniuses. They can hack into anything in almost no time, are often the leaders of major operations or they are partners with the leaders.

      While they may be the "bad guys" or working for the "bad guys" it isn't because they are inherently evil. They are either just amoral (which isn't seen by the average person as nearly as bad as someone who knows they are evil) or it is part of some elaborate need for revenge because the CIA murdered their father or something like that, which again creates some sympathy for them in the minds of the audience. They are also depicted as socially awkward, the other bad guys get the hot girls but the hacker rarely does - another thing that creates some level of sympathy for them with the audience.

      I'll bet if you polled the audience of a movie that had a bad guy hacker who led a group trying to hack missile silos to launch a nuke at Washington DC, but it was because he was basically amoral and thought it was deserved because the US government had bombed his country and killed his family there would be a lot more sympathy for him than for the "big bad" Jason Statham type hitman he employed who was killing maybe a couple dozen people (depending on whether he gets a machine gun or has to do it up close with fists and knives) rather than the million a nuke on DC would.

      1. Robert Carnegie Silver badge

        Re: Hollywood was long glamorized them

        I think you may be mistaken about movie audience members identifying with the criminal hacker who does not "get the hot girls". I think the general population thinks that the hot girls are making the correct decision.

        And it's irrelevant anyway, because the hot women available to criminals are liable to be bought and paid for. Or perhaps I should say, rented and paid for. It's a significant difference, but either way, the criminal hacker that we're presuming to be male would either buy female company, or their criminal employer would arrange it. For comic relief, the hacker might be shown as unaware that it's a business arrangement.

  5. Anonymous Coward
    Anonymous Coward

    Waste of time.

    Not giving the groups "cool" names would be a start, reduce them to some bland desciptior because this just feels like it'll become a useless match of "bants" and "owning" each other with stupid name calling.

    Report the failures like they're CVEs

  6. Amanttix

    Liestoparents

    Whoisthemole

    Nofriendsatall

    Morescared

    Desperateforrespect

    Trappedandterrified

    1. LogicGate Silver badge

      ablative arseholes, bleating bimboes, cheating cherubs, desperate dimwiths, embarrasing eunuchs etc..

  7. tekHedd

    Or you could just use GAYINT's standard

    You can try to "spark a debate," or you can just assign them different names and stop using the old ones, maybe publish a lookup table for reference...

    https://gayint.org/actors/public

    Maybe install the browser plugin that replaces all the names with their proper GAYINT actor names so you don't have to look them up all the time...

    Or yeah we can discuss the merits of doing so for another year that's totally an option. ;)

  8. Anonymous Coward
    Anonymous Coward

    took long enough.....

    what surprises me most is that it took them so long to come up with this idea.

    In "Forward the Foundation" (Isaac Asimov, 1993), when Hari Seldon is First Minister and the Emperor asks how to deal with the anarchists that just seem to be destroying infrastructure massively so their names achieve notoriety, he responds with a suggestion that the Emperor re-name the individuals to "Moron #1, Moron #2, Moron #3......".

    The Emperor later reports back that it is working smashingly great having denied the various troublemakers notoriety under their own names.

    now, if only our next U.S President would do the same with the current idiot in office.........

    1. anonymous boring coward Silver badge

      Re: took long enough.....

      The current one will be "Inmate #1".

      1. LogicGate Silver badge

        Re: took long enough.....

        Inmate #1 posting on "Lies Social" about his "Big Buttful of Bill" while the "Traitor Act" is finally being dismantled together with the "Department of Homelander Insecurity", the Theater of Security Agency and InCell Eggshaped-agents are fired and investigated. All the while, the Banana Republic(an) party explains that they had nothing to do with the current debacle.

    2. Anonymous Coward
      Anonymous Coward

      I'm reminded of the "some a***ole" initiative from "The Non-Adventures of Wonderella", where they referred to every serial killer as "some a***ole" instead of by name, and substituted a bucket of chum if a picture was required. It reduced the number of serial killers and put a number of sensationalist newspapers out of business...

      1. LogicGate Silver badge

        The Norwegian mass murderer some years ago had prepared a press folder with images of himself dressed up as some sort of fantasy commando in a wetsuit.

        Sadly, the dimwits in the press fell for it and published these pictures rather than the most embarrasing pictures they could find on his aunts social media account. I am still angry about this.

    3. doublelayer Silver badge

      Re: took long enough.....

      I hope it works, but it's much easier for something to be successful when the same guy gets to write the proposal and the results. I'm not sure many of the criminals they're talking about are motivated by notoriety. I think they're mostly motivated by money. Those wanting their own brand will make one themselves rather than waiting for a security researcher to name them. So far, when organizations have given themselves a name, most researchers have used it in order to clearly communicate, but even if they insisted on referring to Dark Side as Pathetic Slugs #39, I don't think that would worry members as long as they were making money and still using the term Dark Side in their messages and advertisements.

  9. symgryph
    FAIL

    How about a UUID?

    I think giving them UUIDS would be REALLY cool, or amazon ASIN compromised account #'s !

  10. goblinski Silver badge

    "... for decades I have wondered how many of these cybercrims actually work as security professionals/$bigcompany devs..."

    I still vividly remember an article in a Bulgarian magazine or was it some other publication, in the very early nineties, discussing computer viruses. Back then there were like a handful of them to discuss and analyze.

    His comment on the (one and only) really nasty virus in the list was something along those lines:

    "...I firmly believe that the author of this virus is Bulgarian and working from Bulgaria.

    Only here in Bulgaria do we have people who can combine - in one - the level of knowledge and skills, together with the absolute lack of responsibility, professional deontology and pride needed to write something like this...".

    Cross-referencing with later works and info, I suspect the paper was by Vesselin Bontchev, discussing the Dark Avenger. I could be wrong about the who's who. Them were innocent times.

    1. Robert Carnegie Silver badge

      is it bad that I wasn't aware that deontology is a word? As a gloss, it refers to a Kantian determination of right and wrong behaviour where judgement doesn't only depend on consequences.

      A recently repeated episode of Alfie Moore's radio show of "It's a Fair Cop", about police officers' daily cases, considered a teenager arrested a short distance from what evidently was the locked bicycle that he had tried to steal, although he had not succeeded in stealing it. Several audience members, but I don't know what proportion, gave a view that since he'd failed to commit a crime, he had done no wrong. To jump to the end of the story, the police and the court did not agree.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon