This wannabe hacker was caught in a pretty embarrassing way

The US Department of Justice (DoJ) has extradited a Ukrainian citizen for using a botnet to brute force people’s passwords, all thanks to his apparent messages to vape shops in Ukraine, which included a receipt with his home address.

The DoJ accuses Glib Oleksandr Ivanov-Tolpintsev of using a botnet to crack credentials of targeted users, which he’d then sell on the dark web. According to his indictment, the activity netted Ivanov-Tolpintsev over $80,000.

“During the course of the conspiracy, Ivanov-Tolpintsev stated that his botnet was capable of decrypting the login credentials of at least 2,000 computers every week...Once sold [on the dark web], credentials were used to facilitate a wide range of illegal activity, including tax fraud and ransomware attacks,” reads a press release from the DoJ.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

Take a look at these best password managers
We’ve also rounded up the best security keys
Shield yourself with these best identity theft protection services

Ivanov-Tolpintsev was taken into custody by Polish authorities in Korczowa, Poland, on October 3, 2020, and has now been extradited to the US to face trial for these crimes.

Amateur mistakes

According to an IRS affidavit, the investigators caught on to Ivanov-Tolpintsev by exploring the contents of the Gmail addresses he used to facilitate his dark web activities.

One of these accounts received a couple of digital receipts from online vape retailers that revealed Ivanov-Tolpintsev’s name and contact details.

Furthermore, the recovery address for these accounts was set to Ivanov-Tolpintsev’s regular email account. Exploring the contents of his regular account revealed all kinds of personally identifiable information such as scans of his passport, and pictures on Google Photos.

Thanks to Ivanov-Tolpintsev’s laxity in separating his criminal digital identity from his physical one, the government was able to gather enough evidence to convince a judge to order his arrest and extradition.

Although the authorities haven’t shared details about Ivanov-Tolpintsev’s botnet, the case helps to show the fallacy to relying on password alone to secure an account.

Security experts have been pushing for the use of multi-factor authentication (MFA) mechanisms, since cracking and auctioning passwords on the dark web can lead to significant attacks such as the recent one on the UN.