[ARTICLE] How to Vend Without Getting Caught

kilobit

VIP member
Messages
92
Reputation
2
Reaction score
3
Points
8
Here is an old tutorial I thought might be useful from SC Archives. Hope it helps.

--kilobit

----------------------------------------------------------------------------------------------

How to be a ShadowCrew Vendor by --enkrypt--

So, you have read enough tutorials, invested in some goods or what not, and have a product that is ready for sale, that no doubt will have some great intrest to your fellow crew members.

Well, people ask me all the time, what does it take. Well, many things, I will put together this little guide, to hopefully get you on your way.

Two things first.

You need integrity. You need to be honest with your customers, simple as that. If you have a problem with lies, like, yeah, it will go out tomorrow, and two weeks later, you haven't even touched someones order, vending is not for you.

Second, is your personal safety. Since everything on this board is all discussion, and some people feel they want to pretend to be a vendor, well, the pigs in the REAL world, well, they don't like that. They see it as mocking them. Since you aren't really even doing anything, well, they see you as simply laughing in their faces. So your personal safety, and anonimity is one of the most important things you can ever safeguard.

Okay. Let's get going.

Storing your goods/customer information.

Idealing, if you are producing a product, or manufactuering, or have something physical, you would want some place AWAY from your home. If you can afford it, a small studio or one bedroom apartment, would be great. A place you can go to work, but still have a couch to sit on and eat a snack while your 47 pass template is printing for 2 hours.

Apartments can get pretty pricey. A few other alternatives, is a small office, you can usually find them for much less then a small apartment. Just keep your door locked, you are not opened yet. Maybe an office that doesn't have too much open window looking in at you hehe. If they do, you want the mirror reflective tint, lets you see out, but not people see in very easily. Something that could probably be worked out with the landlord.

Another very affordable option is storage space that has some power to it. Bring lots of boxes, but PayPal a table in the back with a computer and your equipment there. Run over whenever you need to, and get working. It isn't the best option, or the most ideal option, but it is a lot more affordable then say renting out an apartment.

To keep your customers information private, I recommend enkrypting the hard drive and the files (woah, did you see that one coming?)

Drivecrypt lets you enkrypt the entire hard drive with very strong military 1344 bit enkryption. Keep your passphrases nice and long and never write them down or store them. I suggest NOT typing in your passwords. Use the built in windows keyboard. If a keylogger is installed, well, they cannot get passwords if keys are not TYPED onto the keyboard. Sure, if they have screen capture, maybe they can get some of the keys. But sure would slow down any trojans process.

I personally then also use another enkryption tool. I then enkrypt each file individually. Passphrases are again different. There are many great tools out there, that are small enkryption tools. Look for one that offers 128bit + enkryption, in popular algorythms like blowfish.

When deleting a file, use a program to erase it securely. A few good programs, are evidence eliminator, and a program called "eraser" both are excellent programs, and the second is available for free. Evidence eliminator has some additional functions that can clean up some of the computer history and file accesses.

Each program besides just deleting single files, can erase all the free space on the computer, and make any files deleted (or say like printer cache that was deleted after a print) is completely erased from the hard drive. DoD specs is three passes of 0, 1 then random. There was a statistic something like, it would cost $10,000 to recover 10kb of data after DoD specs. Unless you are doing something extremely bad, it is not worth the recovery efforts.

If you have to print anything, or you have a bad print and don't need it. I recomend a criss cross cut paper shredder. I think encourage either flushing it, or burning it. Teslin doesn't shred very well. So if it is teslin you are destroying,I recomend getting the large black markers, blacking everything out, and then running it through a cheap paper shredder that is only for teslin. Once through, tear the peices, (stretch them and snap them) at least once through it, and flush. Teslin doesn't burn very well, and stinks pretty damned bad.

If you have an offsite place you may not have internet access. So, you will have to transfer customer data from point a, to your work place. The item to use here, is most definitely a USB hard drive, thumb drive, or depending on the computers you are using, you may be able to use several of the compact flash/memory PayPal or such cards. Available in 32, 64 + through a couple of gigs of information. It should be plenty to even transfer templates, as well as lots of customer data.

When the files are transfered, be sure to enkrypt the data in case it ever got into the wrong hands. The small devices are also very easy to hide very quickly or even break between your fingers or with a hammer. Sure, the information may still be recoverable, but the cost would be extreme for them, and it's still enkrypted even if they are able to recover anything.

If that is not an option, burning a CD is another common choice or even just floppy disks if that is all that is available.


Okay, let's move onto step next.

Keeping yourself anonymous

Whenever getting online, make sure you use anonymous proxies. This is discussed many times in details, search for it if you are unsure.

You will need to contact your customers, so you need an email or something. When using email, or say ICQ/AIM etc. use a proxy still. Use email that does not require java or active x. There are many email providers out there that remove the IP and enkrypt the messages as well. Again, this has been discussed extensively, do a search to find the information. On IM services, use a socks proxy to keep your real IP hidden behind another one.

When mailing items, do not use a real return address. Get a drop set up, even a PO box anonymously. Have mail returned to that drop, check it once every few months to make sure you're not getting junk mail, or when that one package got returned for some reason.

When receiving items from customers (in trade, whatever) keep your anonimity. Why would you have something sent to your house? Why? Open a drop. A MBE costs $40 for 3 months (depending on location, size of course) a PO box in some rural areas, you can get a box for $75 for a year.

Very affordable, and keeps your anonimity. There is no reason to shout out your real address to anyone that could be a cop that is pissed at you for mocking them with your imaginary sales.


Conducting business

Okay, you took some precautions, and are ready to go. Don't forget your review. I don't care who you are, or what you have already done/proved yourself, you need a review for this, and any additional product you sell.

So get one. Ask for one when you are ready, and if you have some reviewers in mind, ask them to do the review, before you even post your offer. That saves you from getting tons of requests before you can even sell anything, and saves you from countless new people asking for it up front since you are not review. If they don't have the money upfront, don't count on them having them money if you front it for them.

If you don't know who should do the review ask. Either ask some respected people, or make a post asking for a review, and what it is that needs a review.

When you are ready to sell, and have your review posted, contact the moderator over the vendors/reviews section. Ask to be added to the vendors list, and to have permission to post in there.

Then make a post with a description of your products, prices, turn around time, and a link to your reviews.

Something that a lot of vendors do, is put a link to their review(s) in their signature and contact information.

Make sure people can contact you. If you prefer email, tell them that and make your contact address public. If you prefer PM or IM or whatever, tell them that.

Get yourself a system. Schedule whatever. Reply to customers questions. You may want to consider making an order form if you are to get lots of information from them that they can quickly email to you. You may want to write a FAQs as you go along if a lot of the questions are all the same.

But reply to your customers, and be honest. If your turn around time is getting longer, tell them that. There are many VERY impatient people here. You don't need to be defending yourself from accusations which just slows you down even more.

a subtitle to this, is accepting money.

You want to do this anonymously as well. Western Union with a test question and answer is popular. Completely anonymous. Go to a place that has no cameras, you won't ever be noticed again. I recommend changing the pick up locations. If you are constantly going to the same place, that may create a perfecet opportunity for you to be set up at some point. Downfall to WU is that it is expensive for the sender to send the money.

E-gold is another popular choice. Money can be moved easily, and keeps anonimity. It is really is not too hard to use or cash out. I will write an article on e-gold soon.

Paypal is not a very good choice for most people. You may have worries about it getting closed by paypal, peopleusing stolen accounts to pay, etc etc. Not a very popular choice.

If you have no problems accepting a physical funds, postal money orders are very easy to cash out. But that requires that you receive something at a drop. And although is an option if other things fall through, not the best for anonimity.

You may be the kindest person in the world, but I wouldn't recommend fronting people goods/services. Although there are many great people here, those that are begging for something, if you send it, count on it as being a freebie. My experience, simply they pay up front or nothing. If the really wanted it or needed it, they will get the money for it. You want to play the roll of a vendor, not a bill collector.

PICK UP your money before you send products. Sure WU may be sent, but what if there is no test question, etc. etc. They may drag their feet if you already sent them their stuff.

Well, of course, you complete their order. Lots of people like to see "proofs" so they can ensure all information is accurate, and that they will be happy with what is being sent. Of course this doesn't apply to everything, just some items. If the turn around time is a day, it does create delays. You should ask the customers upfront if they still want them though even if it causes a delay. Some people still want them.

Sending the goods
Okay, you were reviewed, took orders, got some money. Now what. Well, of course, send them their stuff. If you are shipping an item, use a trackable method so you both know when the items arrive to them.

If the information is able to be sent online, email them, PM whatever you have been using to communicate, or what they request. Remember to use proxies.

When shipping items, there are several things.

First, packaging. Although it is very simple to drop an item in an envelope, it may not always be the best. You want to protect the items, so inside another envelope, or something.

When shipping across international boarders, you may want to hide items even better. Putting items into something else, for example a toaster. There we go. Take it apart and put the items inside.

On customs, mark the item inside as a toaster, and it is a gift for your friend and his new wife. Ahhh how sweet. That way they should not have to pay duties or taxes either.

When shipping, you can go in person or there are a few other options. Many sites let you print of postage if you know the weight, right off their site, and drop it in a pick up box. This is fine if you have an anonymous credit card you can use.

Otherwise, going to anyplace, many that don't have cameras (small grocery stores now have a shipper at their customer service desk that they wweigh it, take your money, plus their fee)

This makes it so your face is never on camera, but may delay shipments up to a day, depending on the store and what not.

You could also set up a fedex or UPS account, and just drop items in to a drop off box that way as well.

After the sale

Get in contact with your customer. Ensure everything was to their expections and thank them for their order. Repeat customers are the best, you aren't dealing with someone, that has all the questions, a repeat customer has already asked and knows the answers.

When you get a lot of orders, be sure to send in a donation to the ShadowCrew server funds. The only reason shadowcrew is here is from donations. Without them, the place would be gone. If you are making some money, why not support the reason you are making that extra income.


A few extra hints, notes etc

Things not to offer: drops, bank accounts, credit cards with pins. The items are crazy. If you had any of them, you would use them yourself, and make 10x's as much yourself, then whatever you could possible sell them for.

If you try and offer such items, people will just scream at you, make fun of you, harass you until you understand how stupid it was for you to try and offer such things.

Don't offer your services in other vendors threads that offer similar items. It seems to just start fights. Make a new thread with your current offer if you need to, or bump your original offer up.


That's all there really is to being a vendor on this discussion forum. Many people enjoy it, and you will make many friends from those that will pretend to be your customers.

If you have a new product that has never been offered before, ask to see if there is intrest in it. There very well may be.

Copyright --enkrypt--
 

420biz

BANNED
Messages
32
Reputation
1
Reaction score
1
Points
8
Please note, if you want to make a deal with this user, that it is blocked.
here's some updates to that article

this is mainly for N. American vendors since overseas you can bribe WU agents and cops to escape detection/arrest in countries like Russia
_______________________________________________________



1) full drive encryption

is totally useless. you need to use truecrypt, and mount small partitions on your drive with your very sensitive information. then you encrypt the entire drive with truecrypt for plausible deniability. when they seize your comp, they see truecrypt in the boot loader and go to work on it, OR they demand by court order you open it. Ok no problem open it up and there's nothing to see because you have very cleverly hidden the rest of the encrypted partitions in regular files around your comp under 100megs to not attract attention. full disk encryption can be broken through indirect means (just ask Max Ray Vision, superhacker admin of cardersmarket who had his full disk broken by the feds in under a day)

** note encryption is pointless if your comp is left ON. your key is stored in RAM, so as long as there's power (laptop in sleep mode, comp left turned on) they can extract your key and decode everything. you always have to power down your equipment, or use something like OpenBSD which encrypts virtual memory and RAM.

2) 'proxies'

are totally useless. get an encrypted VPN service (not from anybody on a carder forum, they could be informants and have snoopwarez to record what you're doing), and use a prepaid dongle service or something to log into it. blackVPN is a good one. lot's of others available but only ever use OpenVPN, and make sure IP6 is TURNED OFF or else you are open to data leakage/exploits. if paranoid, you can mix a bunch of cheap socks proxies with your VPN for further anonymity. google for 'browser footprint'. another way to identify you is comparing your browser info such as plugins, drivers, size of drivers and a million other indicators to pinpoint which browser accessed what. EFF set up a site to check yours, to see how unique it is: hXXps://panopticlick.eff.org/

I also use mesh wifi routers to route traffic through dozens of insecure WEP networks i've broken into. This is simple to do with a free backtrack live CD or OpenBSD tools.

3) Western Union

is the most unsafe method of transferring money in most western countries. they work hand in hand with authorities worldwide so unless you know the agent or he's on the take you will get fucked. find a cashout service that exchanges WU to ATM card, or even better WU to anonymous digital gold currency like LR or Pecunix. WMZ is ok, but harder to work with unless you have russian biz friends who can set up accounts that can receive large amounts without notary services.

marc emery was busted by the feds because he accepted western union, so there was a paper trail proving he received money in exchange for illegal crossborder seed shipments. in fact the DEA seized his incoming mail, and replied to the buyers with a scam letter instructing them to resend payment via western union for entrapment because cash and blank money orders won't stand up in court as proven payment if mailed. this is what a DEA entrapment scam letter looks like (it was in his trial as evidence) hXXp://www.cannabisculture.com/library/images/uploads/4483-FakeSpam.jpg

4) Encrypted BlackBerry scams

are once again useless and dangerous. ever seen those ads where they promise 4096 encryption for your blackberry text messages and calls? usually a prepaid service. well when they get busted the authorities will be looking into everybody using the service. google 'the datalocking company' it was a drug cartel masquerading as an encrypted phone service. everybody was busted even though they claimed '100% military grade encryption'. encrypted blackberry is only safe if you set up your own personal enterprise server offshore and give it out to biz associates, not resell it to the general public hence attracting the full force of LE attention. even still, as with all encryption assume you are being monitored and don't give away personal information that can ID you and delete all read messages/emails. also be aware of tower spoofing where encryption is totally useless hXXp://www.wired.com/threatlevel/2010/07/intercepting-cell-phone-calls/

5) Shipping

The article recommends 'open a toaster and put stuff in there' which is outdated and sure to get you caught. You need to ship stuff as flat as possible, by regular mail only. A warrant is needed to open first class mail in N. America and most EU countries. UPS/Fedex/Dhl can open anything anytime they want to inspect. Parcels are scanned now at most customs inspection facilities whereas regular mail bypasses customs completely. I would ship MSR equip unassembled or by multiple stealth shipments unless its legal in your country. Also, never send something that has to be signed for on the other end. You can get out of problems if you receive drugs, or cards by mail without a sig because there's no proof you ordered it. Once you go somewhere and provide ID/sign, you are fucked.

6) Ratted out by your own crew

In the end, every single board, and group like Shadow Crew was brought down by their own members and associates spilling to the authorities once they were busted. Eventually somebody is gonna get sloppy and busted, then try to talk their way out with the LE. If you have business contacts never let them know your real identity or meet with them if possible. If they don't know who you are they can't rat you out. At anytime one of your associates can get busted, and LE will assume his/her identity. They then will try to send you traceable payments, or stuff to a drop to catch you picking up.

Albert Gonzales one of the so called 'founding members' of shadow crew who was given 20yrs was caught going back to the same restaurant with his laptop to inject his attack into a site to get their card info. Pretty stupid idea, since he already ratted out 19 of his associates and was on the SS radar and being followed everywhere. They just sat in the parkinglot with long lens cameras and photographed everything he was doing. His associate in the Ukraine has his laptop covertly copied by the secret service in a hotel and fully decrypted later revealing info about everything.
 
Last edited:

blockent

Professional
Messages
426
Reputation
7
Reaction score
18
Points
18
how do stop your browser from revealing plugin info becuase that seems to be biggest give away?

also what programs do u suggest for mac addresses switching /hardware id spoofing
 

420biz

BANNED
Messages
32
Reputation
1
Reaction score
1
Points
8
Please note, if you want to make a deal with this user, that it is blocked.
if you pirate VMware, you can spawn multiple operating systems in memory and use them temporarily, then delete or modify as needed hence eliminating any browser tracking. there's a faq around called the 'Dr. Who Security Faq' which explains how to spawn multiple OS/s with hidden truecrypt volumes.

an OpenBSD pf firewall will also prevent any info about you being leaked. Most openVPN anonymity services do the same but not as secure as your own pf firewall.

if possible, you should encrypt your sensitive data, then upload it to a file server somewhere that way it's not on your comp if seized. a cheap seedbox in EU would probably work for this or any russian hosting service

as for mac changers I just use commonly avail bsd/linux programs like macchanger but only when cracking networks. haven't heard of mac address being used to ID ppl through OpenVPN or TOR or BSD pf firewalls but I could be wrong. I also throw out old network cards and buy new one's they're only $25 each where I live for el cheapo taiwan cards.
 
Last edited:

ryck1z

BANNED
Messages
19
Reputation
0
Reaction score
0
Points
1
Please note, if you want to make a deal with this user, that it is blocked.
nice
 

420biz

BANNED
Messages
32
Reputation
1
Reaction score
1
Points
8
Please note, if you want to make a deal with this user, that it is blocked.
another method to protect full disc encryption is to leave a USB drive in while you install OpenBSD/FreeBSD or linux or whatever.

when you are partitioning the drive during install, do a manual partition. Make your USB PayPal hold /boot, and then make the rest a physical volume for encryption. Inside there, make a physical volume for LVM and put your root, swap and other partitions (/home ect.). Install grub to the master boot record of your USB PayPal, not the harddrive!!

Make a backup obviously of the USB PayPal somewhere so if it get's broken, you can still boot your harddrive. Obviously encrypt that backup in a hidden truecrypt container and upload it somewhere or clone the PayPal.

Then use truecrypt to encrypt the hard drive, and within that encrypted drive use the hidden volume feature to create small containers you will store sensitive information inside. now you are safe. The full disc encryption decoy will be very hard to break, as the boot loader is located somewhere else (and hopefully hidden inside your apartment in the most creative fashion) and even if you were forced to unlock the encrypted disc, well you still have your hidden truecrypt container files there squirreled away somewhere they will have to also break.

the problem is when you encrypt a regular drive some stuff in the boot loader must remain unencrypted so your processor can read it to launch the operating system like the file initrd.img, the /boot directory, grub ect. if an attacker (Interpol/FBI) has access to those unencrypted boot loaders, they can simply edit initrd.img to install a keylogger or rootkit to send your entire encryption key to them over the internet or just dump it to screen. even if you make a 'hidden operating system' with truecrypt it's still vulnerable to this attack.

in other news avoid using TOR with a VPN, it renders TOR useless. You can easily customize TOR to create 4 hops for additional security and choose which exit node you want, like the anonymizer.ccc.de nodes which are safe. obviously you have to worry about sniffers on the other side examining your traffic, which is why you shouldn't use TOR to connect to outside sites and type in any important information unless it's a hidden service.

to avoid java leakage potentially exposing your inner IP even through a double-VPN, rent a virtual desktop somewhere offshore.

also no matter what network you've broken into or VPN you are using always use the chaos computer club DNS servers instead of the default one's for that network. you never know when an adversary has poisoned the DNS cache of your regular ISP dns to re-route you to fake pages and feed you fake SSL certs.

run this into google translator and use their servers instead www.ccc.de/censorship/dns-howto/ in your browser's options.
 
Last edited:
Top