HOW DOES THE “K” MANAGEMENT WORK?

[Детективное агентство Тула]

Comrades, hackers and other antisocial, poorly educated personalities who are convinced that using all sorts of programs and proxies there with other nonsense, they will escape from deserved punishment. Today we’ll talk with you about your safety, and more precisely about those who hunt for you. We will talk about how the well-known Department "K" (Office "K") works, and, in particular, the Bureau of Special Technical Events (BSTM).

The fight against cybercrime today is no longer a myth, but a harsh reality. Long gone are the days when the security services did not know from which end to approach the network. Yes, of course, they did not go so far as to fully control cybercrime, so the number of cybercrimes is growing every day. But all these crimes are petty, and all serious crimes are not left without punishment. In our country, Office “K” monitors cybercrime.
Office “K” is a department of the Ministry of Internal Affairs of Russia, which fights against computer crimes and illicit trafficking in RES (electronic equipment) and STS, is a structural unit of the criminal police service of the Ministry of Internal Affairs, each constituent entity of the Russian Federation.
Management "K" is part of the BSTM Ministry of Internal Affairs of Russia and investigates crimes in the field of information technology, is the only open unit.
Department “K”, being part of the Central Internal Affairs Directorate of a constituent entity of the Russian Federation, detects, warns, suppresses and discloses crimes in the field of information technology, illicit trafficking in radio electronic equipment, special technical means of STS and child pornography.
MANAGEMENT TASKS “K”

* fight against violation of copyright and related rights (Article 146 of the Criminal Code, Article 7.12 of the Administrative Code);
* identification of illegal penetration into a computer network (Article 272 of the Criminal Code of the Russian Federation), the fight against distributors of malicious programs (Article 273 of the Criminal Code of the Russian Federation);
* identification of violations of the rules of operation of a computer, a computer system or their network (article 274 of the Criminal Code);
* identification of the use of fraudulent credit cards (Article 159 of the Criminal Code);
* the fight against the spread of pornography through the Internet and CDs (Article 242 of the Criminal Code).
* identification of illegal connection to telephone lines (Article 165 of the Criminal Code, Article 13.2 of the Administrative Code).
* fight against illicit trafficking in radio electronic and special technical equipment (STS), (Article 138 of the Criminal Code of the Russian Federation, Article 171 of the Criminal Code of the Russian Federation, Articles 14.1, 14.42 of the Administrative Code of the Russian Federation)
In such organizations, not some lameugas sit, but for the most part white and fluffy hackers and pretty hackers. White hackers are citizens who, at a young age, made some kind of computer hacking at the age of not older than 13 years old and fell into the clutches of the "K" department. They, in turn, hide the matter, not making it public and exercise total control over this young hacker, gradually training him for future work.
There are also special schools of the Ministry of Internal Affairs in computer security, they teach a slightly different method with respect to civilian educational institutions in the same specialty. The subjects are completely different, all the lessons are as close as possible to the present work, that is, what the employee of department “K” does daily.
In general, the recruitment to this institution is a delicate matter and not everyone can get there, although he almost put it right. Everyone can get there, only in which room, in the sky with a cage or in a warm, cozy office with a good computer and a mug of hot tea (coffee) on the table.
Although such good specialists work in this institution, this does not mean that they should deal only with mega-complex matters. For the most part, they have to do very dirty and indecent work for their professional competence. Here is one of the cases when one of the citizens of the Russian Federation spoke negatively in the direction of one of the representatives of United Russia, at some forum dedicated to political science. The next day, representatives of department “K” sent a letter to the administration of this resource asking them to delete this statement and generally close this topic on the forum.
In response, the department "K" received a refusal from the site administration and in pursuit of a number of negative emotions about this letter. From department "K" a series of threats rained down against the administration. In the end, the message was deleted and the topic with it, but in what ways it was achieved, and indeed - this is the work of ordinary operas and it is unlikely that this relates to computer crimes.
Well, I think, now it has become clear what department “K” is and what it does. Now let's talk about how they do their work, what strategies and tactics.
ACTIVITY
Operational events are a rather cumbersome topic, a lot of articles can be written about it and it is still impossible to describe everything, because they are constantly being improved and updated, just like the types of attacks and hacks are updated in the hacker world. For this, I decided to describe one of the standard methods of operational measures.
Well, let's analyze, as they say, the foundation (there is a foundation to any system, in other words, the standard that the system should adhere to), this is what the standard of operational-search measures looks like:
1. Survey - a conversation with citizens who may be aware of facts, circumstances that are significant for the performance of tasks of operational-search activity
2. Inquiries.
3. Observation.
4. Operational inspection.
5. Control of mail, telegraph and other messages.
6. Listening to telephone conversations.
7. Operational implementation (employee input into development).
So, in order to deal with each of the stages, we need to present some real picture. Suppose that you, as usual, surf the Internet in search of holes and suddenly break a site, but it turns out that this is the official site of the Moscow Region Administration.
You first cursed Google because it brought you to this site, then you began to blame yourself for not even reading the description of the site, but were more interested in describing its errors, and also cursing yourself for leaking the database data with confidential data. And then they instantly calmed down when they remembered that you were using a fresh anonymous proxy. After relaxing, you go, put tea, take out buns to sweetly celebrate the victory and enjoy the trophies downloaded from the site.
The next day, smelling of cigarette smoke and a fume from beer, the system administrator of the hacked site raises his head from the table and notices that the logs are out of order and detects the presence of unauthorized access to confidential site data. He quickly brews himself strong coffee, drinks an anti-hangover pill and then an anti-policeman, runs with bulging eyes with a report on breaking into his boss.
And now, from this moment, the malicious hunt for you begins! And then everything is according to the instructions? a statement is submitted to the local police department with a full description of the hack and attached logs of penetration and other crap. Well, of course, that the employee who accepted the application will not be engaged in this matter, since he does not have the appropriate skills and knowledge. The case is referred to a special department, which we have already learned about - this is Department “K”.
Now the first stage begins - this is a survey of citizens who can help in the investigation and search for the offender. In our case, the admin of the site will be interviewed, they will find out through which hole the hack was made, from which ip-address the hack was made, and they will also be interested in who the hack was profitable for, whether there are suspicions of someone, or it’s a guest like you.
The second stage is to make inquiries about the criminal, or rather to process the received data from the first stage, roughly speaking, they will check your IP address in order to find out where, who is your provider. An ordinary citizen can do this using the WHOIS protocol.
WHOIS is a TCP-based network protocol for the application layer that hangs on port 43. The main use is to obtain registration information about the owners of domain names, IP addresses and autonomous systems. So, having broken the IP address obtained in the logs of the hacked machine, they see in the line Country: US - that is, the machine with this IP address is in the United States. And this is one of two options, either some kind of CIA devotee decided to break the administration site of the Moscow region, or this server is an ordinary proxy server.
Well, the first option is unlikely, but all versions are still being developed, and they need to be checked. First, the IP address is punched through the public server database. If the IP address is clean, then there is a possibility that the server is recently crooked and a proxy is installed there. In this case, you can get by calling open ports. Yes, of course, proxies can also be set up not on a standard port such as 3128 or 8080, 80. But all the same, the services will be shown by the scanner and there are a bunch of other options on how to determine whether a proxy server is worth it or not, take my word for it, for the guys from Department "K" - this will not cause any difficulties.
Having learned that this is a proxy server that you brazenly used to penetrate the system, the K department is faced with the question of how to get information from that server about which IP address it was accessed at a given time. They have two ways, an official request from their colleagues in the United States, and if you get an answer, the case will develop much easier and the answer will be attached to the case. Or the second option, not legal.
In the event that Department “K” receives a refusal in an official request, and it will be so, since there is no such agreement between our countries, then in order to advance the case it will be necessary to conduct unauthorized access to this server, again, the guys from Department “K "It’s not difficult, they are sitting there just for such purposes. But having received data from the server about your IP address, this will not be able to get to business, for that you are already taking up development and it is at this point that you need to sit down for treason.

TO BE CONTINUED.

 

[Детективное агентство Тула]

CONTINUED.

So, having learned your IP-address, it again makes its way through WHOIS and here it is already clearly visible that you are a comrade from Russia who lives, for example, in the capital of our Motherland - Moscow. They break through where you work, what you do, and a number of other necessary information. Further, they visit the provider and on some fictitious basis, such as your customers’ machines, send spam or are infected with viruses, they demand to provide logs for your person. And now, there are documents that during some other operational activities it was revealed that your IP-address from this to such-and-such was accessing the IP-address from which the site was hacked, but now it’s free attach to the case and this will serve against you in court.
The third stage comes into play - now you are carefully monitored for your identity, they monitor what sites you visit, where, what you send, etc. They can even put out. During these events, your personality will finally consolidate itself in a not very successful direction, since it is unlikely that you will stop going to forbidden sites, such as undeground, to break sites and cars.
And here it is the fourth stage - this is an operational inspection (search), in other words, based on all the data obtained during the search, you became the main suspect, and now it’s easy to authorize the search of your apartment and seizure of your system and all media such as flash drives , disks and a number of other dirt on you. They can also take all your notebooks, prints, magazines and a number of other paper media that may contain something tasty for the investigation. And yet, they do not disdain to poke around in your trash can (not virtual, but real.) All documents from there are also seized, if understood.
All your junk is transported to the building of department “K”, where they will pull out information about where you were, what you did, what software was installed on your computer, whether it was counterfeit (in which case one more article will catch you) . So, they pull your hard drive out of the system and connect it to a device that only reads (this is done in case you decide to protect yourself and install a program that can format the hard drive).
Even if you formatted your hard one before the seizure, then again, it will not be difficult for the employees of department “K” to pull out the necessary information for the investigation. Even programs such as ChromeAnalysis (a program that shows what, where, when, where the owner of this computer went through the GoogleChrome browser), FoxAnalysis (shows the same thing as the ChromeAnalysis program only about the Firefox browser), Web Historian (a universal program for analyzing time browser files) - these programs will show all your travels around the world of the Internet, and also, help to create the correct report, all your locations in the protected part of the Moscow Region Administration site will be shown.
So, now you see that it is not difficult for the employees of Department “K” to pull information from your hard drive, which confirms the fact of hacking.
The fifth and sixth stages are to ensure that you do not have any options at all in your trial. This option works for 70%, since you start calling friends, for example, a friend, a hacker Vasya Pupkin, and you begin to tell: “Remember, I told you that the site broke? So today they came, they seized everything, etc. Etc." Video recording of a telephone conversation is also attached to the case, and here you yourself are talking about the fact of hacking.
Seventh stage - this stage is put into effect if it was not possible to collect the evidence base in the previous stages. A person is being introduced into your social circle, you are posting all the necessary information and at the time of some hacking you are neatly packed, and everything starts from the fourth stage.
Starting from the fourth stage, when they come to your house with a search, you immediately need to go to the market and buy a CD with the song “Thieves' Share”, this will be very useful to you in the future. Well, you need to somehow support yourself, right?
HOW TO PROTECT?

There are two options for this.
The first - radical - is not to engage in hacking AT ALL and illegal activities in particular.
Secondly, buy yourself a special phantom stick that hangs over a hard one, and in which case, when you press the corresponding button on the system, your hard drive will burn up and no one will restore it (although this is not guaranteed), and all kinds of hammer blows, etc. ., this is not a solution, it is again being restored in special laboratories.
Well, that’s all I wanted to tell you about the “K” Office and the BSTM. I think this information will help you not do anything stupid.
REMEMBER THAT EVERYTHING YOU DO ON THE INTERNET IN THE TERRITORY OF RUSSIA WILL NOT BE HELD ANYTHING AND NO LIKE WHAT YOU DIDN'T DOWN FOR THIS. FOR OTHERWISE, AND WITHOUT ANY INTERNET, YOU WILL NOT HIDE. None of the existing programs in the world will prevent Russian specialists from reading and looking at what your anti-social person would like to hide.
***
THIS ARTICLE WILL NOT SHOW WAYS TO BYpass THE LAW AND DECLINE FROM RESPONSIBILITY. IT WILL BE TOLD THAT THE EXPECT OF A PERSON COMMITTING A CRIME, WHAT TO WAIT FOR HIM, AND HOW TO PERFORM YOURSELF IN A SIMILAR SITUATION. THE BEST WAY TO AVOID THIS IS TO DO NOT CRIME THE LAW.
After hacking, pride, shouting “only eggs are cooler than me” and the like, Article 272 of the Criminal Code of the Russian Federation may fall on you; The only thing you are under the law will be called "hacker."
Of course I'm not a lawyer, and I will not go into the details of the trial and all the procedural procedures. I’ll just explain what will happen and what you need to say and do so that you and your lawyer do not have to be bad. And let's not go into technical details, proxies are not proxies, shells are not shells. Just found ...
Yes, and captures with pistols, assault rifles, sirens and flashing lights will leave Hollywood. Everything will happen easier, much easier. At 6-7 a.m. on a weekday, a doorbell will sound and a person with a red booklet and a white piece of paper will be on the doorstep (you can call this a warrant). Behind him is a crowd of five to six people (all from the street, and the police usually don’t take off their shoes). It will be written in a white piece of paper that “someone” hacked “someone”, and the investigation (1 phone call to the provider, 1 to MGTS) established that “someone” lives in your hut. Two questions will follow:
1) Show yourself where the computer (the "tool of crime") or the search begin?
2) Who has free access to a computer?
Well, the first one understands how to answer - otherwise they are not smart, they will look for the computer in the toilets (in general, it’s better not to have it in the hut). Better to bring them by the handle to the device. The second one must be answered - EVERYTHING IN THE APARTMENT, ALL FRIENDS, ALL ACQUAINTANTS HAVE FREE ACCESS TO THE COMPUTER (it will be more difficult if you live alone), to which the cops will threaten Article 272, part 2 (by conspiracy), do not listen - let will prove. By the way, this is not a lie - it’s not in your safe. The computer will be described.
They will take everything: from the system unit, to the mouse, keyboard and modem. To show the judge that the computer is working and can go to the Internet. They will also look for purely computer books, magazines (especially Hacker), disks with all sorts of things. To show the judge your hobbies. And they will take all this together with you or the whole family to the investigation department. Take readings.
Police officers of department "K", of course, are not full of asses, they will understand that your mother is unlikely to work for the CIA, your 2-year-old brother also doesn’t look like a child prodigy - everyone will stab you. You will go to the department in a separate car, without relatives. And dudes will give you a fool like "And how you did it, damn it, horror is interesting. I want it too. Don’t worry, not for the record, tell us cleanly." Pretend to be down, you can sing some song.
Another lovely face awaits you in the department - the investigator. You will testify to him as a witness. This will require knowledge of the law. You have the right not to testify against yourself and your relatives. What is most interesting, you are asked to sign a document that says that you are familiar with this article, but of course no one will let you read it. The most important thing is not to inject. I’ll scare everyone with what they can, even a prison (they, however, do this masterful - you won’t dig in). Admit it - you get the maximum condition and a fine. And do you need a condition for such an article - you will not be given a visa in any normal country.
By the way, the theater may begin. The investigator will ask questions, or pour in threats, and two operas will sit next to him. One of them is “good” - it will reassure you, impose itself on friends, invite you to work. The second will be "bad" - to yell, demand that you be pushed into the cell, and that in general, people like you need the death penalty. They can still start and yell at each other, fight, etc. That the scene was clearly played. You will be provided with a bunch of documents in which everything is clear in your opinion - you are to blame, but there is no need to give slack. To all the rest, these leaflets do not say anything, for them it is gibberish. In your business there will be tons of pages in which 99% of the protocol of the client and server.

 

[Детективное агентство Тула]

ENDING.

At this stage, you have two options:
1) confess and calmly wait for the trial.
2) do not admit and let in during the investigation into your life a bunch of cops that will bother you at every step.
If you go the first way, another person will come running - your state and FREE defender. Who immediately says "non-state" the amount of remuneration - if you do not agree, then he will pick his nose in court. If you still can take it, let it sit, picking it. You admitted. And if they pressed you ... read on, this also applies to you. If you don’t admit, the lawyer will come running anyway. True, we must remember that he is not "completely" independent. He knows the cops, they are closer to him than you. They merge his clientele with which he receives lave. So drive him in the neck and look for familiar lawyers. Yes, and thus you delay the presentation of charges, which is not unimportant. Remember that what you said as a witness has no power if you refuse these words - and you have the right to do so.
If you go against the police (do not admit, refuse to testify), then they will begin a real investigation. They will interrogate friends, acquaintances of friends. It is better that among them there were no those before whom you boasted of a successful hack. In turn, so that there are no ill-wishers, among those to whom you boasted. Opera will go one more way. They will try to prove that you were able to do it. Those. show the depth of your computer knowledge, computer security. If the investigator collects enough dirt on you, then wait for the trial and work out a line of defense with a lawyer. But such situations are very rare. REMEMBER, to prove that it was YOU who was sitting at that moment at the computer, and that it was YOU who committed the crime almost unrealistic. You can prove that from your phone, computer and from your apartment.
If the neighbors know that you often have revels, or friends often come to you, that's good, because you can put forward the topic that perhaps you had a party that day, a friend of your friend’s friend of your old friend seemed to be sitting at the computer, like checking the soap. What's his name? You don’t know. Almost everything can be checked, it is better not to throw words if you are not sure of them, or if you are not sure of someone. A time factor still works here, usually such cases are given a course in a month, two, or even later, after submitting an application for hacking. But people are not computers - they cannot remember everything ... Then proceed according to the situation and strictly follow all the instructions of the lawyer. Of course, this will not always happen, POSSIBLE, it will be so. It all depends on the degree of the offense. If just a deface can close the case. But if credit cards, a bank, then everything is very serious. We must start sleeping on the floor, getting used to the bunks. Joke. Ugh, Ugh, Ugh.
In a year, maybe two, you will remember it with a smile and irony, but during the business you and your relatives and friends will have some gray hair ... This is not worth it, even from a material point of view. The fine will be small compared to the money that the lawyer will have to dump. And this is at least a four-digit number ... In dollars ... So your childish prank can very much affect your rest of your life.

Source: https://oppps.ru/kak-upravlenie-ki-byur ... yandex.com

 

[Матушкин Андрей Николаевич]

Good day, Konstantin Mikhailovich.
Thank you for becoming very interesting!

 

[Black Horse]

Thank! Instructive

 

[george]

thank.

 

[Детектив-Юг]

Great informative article.
From which it is worth concluding, we must live honestly, within the framework of the legal field!
But also filter the market within the framework of the approved regulations.

 

[Дмитрий Викторович]

Great informative article.
From which it is worth concluding, we must live honestly, within the framework of the legal field!
But also filter the market within the framework of the approved regulations.

Right!