Pyotr Levashov: "I don't believe in the existence of Putin's 'hacker troops'"

Brother

Professional
Messages
2,565
Reputation
3
Reaction score
362
Points
83
Retired black hacker on cyber partisan battles in the SVO, the death of banks and his arrest in the United States.

"If the cyber war goes into a hot phase, you won't miss it. Foreign websites will no longer open, underground and underwater cables will be cut, and all traffic will pass through Asia with a long delay. As long as your bank is working, all resources are available — there is no cyber war, " says hacker and crypto trader Peter Levashov, known as Peter Severa. Five years ago, he was accused by the US Department of Justice of creating the most famous botnets in the history of cybercrime, and today he is engaged in cryptotrading and artificial intelligence, as well as writing books on cybersecurity. In an interview with BUSINESS Online, he assessed the balance of cyber forces on the SVO, predicted that due to AI, lies will become almost indistinguishable from the truth, and explained why he believes that the future is in the "crypt".

Pyotr Levashov: It is quite possible that there are processes of power sharing in Ukraine itself. Or maybe it was a Russian action


Pyotr Levashov: "It is quite possible that there are processes of power sharing in Ukraine itself. Or maybe it was a Russian action"Photo courtesy of Peter Levashov

About Cyberwarfare​

— Peter, today we are increasingly hearing the thesis that a cyber war is being waged against Russia. And if we can assess the balance of power in a real combat conflict, how can we do it at the cyber level?

— In fact, the real cyber war hasn't even begun. Now a kind of cyber-partisan battle is being waged, both on the part of the Russian Federation and on the part of its opponents. The objects under attack are usually enterprises, companies, government agencies, and so on. Each of these objects protects itself from uncoordinated activists, that is, it is such a small bastion. On a global scale, neither Russia, the United States, nor the EU are engaged in any cyber warfare, at least at this stage, although the first signs of such a conflict are already showing.

— What are these signs?"

— For example, Google recently stopped opening Gmail accounts using a Russian phone number — this is a vivid example of the" cold " cyber war. But when it goes into the "hot" phase, believe me, you will not miss it. You will no longer be able to open YouTube and other foreign websites, and you will start physically cutting off the underground and underwater optical cables that go to our country. All traffic will go through Asia with a long delay. As long as your bank is working, all the resources of interest are available — consider that there is no cyber war.

If (or when) our country is attacked in cyberspace, we will defend ourselves. I think that some preparations for this are already underway. However, there are no thousands of secret hackers of the president, in any case, I do not believe in the existence of "hacker troops" of Putin or the Russian Federation. Everything that will be done in the framework of a possible cyber conflict will be created on the basis of existing military structures.

Even if you take my example: I've always been a patriot, all my hacking career. You could always find me on dozens of forums, and everyone knew that I had the world's largest botnet (a <em>network of infected bot computers that is used by hackers, as a rule, to organize DDoS attacks and mass spam </em>mailing<strong>).</strong> However, since 2000 and until 2017, when I was arrested in Spain, no one has ever contacted me. There were no messages from the series: "Peter, your country needs you!" Although I think they were aware that I have access to various networks around the world. But I have never received any offers to hand it over to any Russian special services. And I can say the same about my hacker friends-no one ever told me that they tried to recruit him

Who is Peter Levashov?
Peter Levashov
(Peter Severa) was the creator of the largest botnets used for various spam mailings. It was reported that the Kelihos botnet, which was attributed to Levashov, was capable of sending out up to 4 billion spam messages per day. The hacker was among the top 10 global spammers according to the Spamhaus Project resource.
Western intelligence agencies closely monitored the activities of the Russian hacker. In March 2017, he was detained while on vacation with his family in Barcelona, and later extradited to the United States. Levashov spent 33 months in custody in Connecticut. The prosecution demanded to impose a sentence of at least 12 years in prison, but the court found that the announced financial damage from the hacker's actions was exaggerated. As a result, instead of more than 10 years in prison, Levashov was given less than 3 years, which he had already served while under arrest. Now he positions himself as a cybersecurity specialist, crypto trader, investor, and futurologist. He runs his own projects and writes books.

— What do you think is the reason?

— This is partly logical: how are you going to manage such black hackers? You don't know where they are located, many of them are subject to various dependencies. You give them some kind of order, and they get drunk and put everything in the public, in general access. And what will you do about it?

Therefore, such "hacker armies" exist only in newspapers and in the minds of journalists. But in fact, there are officers who serve, perform some cyber tasks. But so far this is not a war, but one-time, subtle operations to probe the enemy's defenses and prepare for a possible real collision.

— And who is better prepared now?

— In cyber warfare, you need to evaluate the number of specialists, the amount of hardware, servers that are under your control, the availability of network devices, routers that can generate traffic, process it, and filter it. Well, probably, the total capacity of the country's channels matters.

The question is who plans to fight with whom. Is it Russia and America? Russia and the EU? If we take all the forces of NATO, then it may make sense to take into account China and Iran on our side — also rather big states with a fairly developed infrastructure. If we compare Russia and the United States, we will overtake the United States in terms of the number of specialists, especially those who can be quickly trained for the necessary goals, but we will lose out in terms of hardware and channels. What will be more important — infantry or cyber artillery, is still unknown. That is, now we can talk about a certain parity: none of the parties will be able to quickly suppress or capture all the enemy's networks.

But we must remember that the military infrastructure has nothing to do with the Internet. Then why make an attack? So that the VKontakte resource stops working for you? Or to send out false information in social networks? Yes, it will cause some panic, but no more. Neither side is willing to do such ridiculous harm. And defending is much easier than attacking.

— Then what goals can our opponents face in cyber warfare?

— You know, the actions that are now being actively conducted by electronic warfare equipment on the line of contact can also be partially called cyber warfare. We use certain devices to influence the enemy's drones and communication networks. They do the same thing. Nevertheless, I would remove the prefix "cyber" here, we are seeing a real modern collision.

As for "working in the rear", in my opinion, the main targets of hackers could be communications, banking and medical systems. That is, the task is to disable and prevent the enemy from restoring all vital communication and life support organs for a long time. Next — sow panic. At the same time, it is not enough just to capture the enemy's means of communication, you also need to try to place false information. For example, hack the website of the President of the United States, publish something there that is not relevant to reality, and do not allow it to be quickly removed.

But this is all, frankly, on the verge of fiction. As I said, the defense works much better than the attack in this case. You have a physical server, so you can quickly fix everything and go back to backups. That's why I don't believe in such full-scale actions.

AI and other cyberspace weapons​

— To the question of false information. You recently gave a very convincing example with artificial intelligence (AI) generated images of infants in the Gaza Strip. How actively is AI being used in information wars right now? Can it already be considered among other tools?

— AI as a dual-use tool is neither good nor bad in itself. Yes, deepfakes (i.e. fake images, videos, audio sequences, and sometimes all of them together) can affect people's thoughts and feelings. Yes, they will be used for such propaganda. And it will be much easier for government agencies that control the press to get an image confirming their position with AI.

To be honest, I don't know how we will distinguish real information from fake information in the future. Probably only based on the source. Eventually, people will realize that not every resource can be trusted. But while many people will have cognitive dissonance, there's nothing you can do about it. In the modern world, there is nothing more stupid than endless scrolling through Telegram channels and YouTube videos in an attempt to understand the world. In both cases, 90 percent of the information is untrue.

— Have you seen similar cases of disinformation in the context of the SVO?

— In the framework of information stuffing, this is used with might and main. Zaluzhny has already made many statements. We don't know who organized it. It is quite possible that there are processes of power sharing in Ukraine itself. Or maybe it was a Russian action.

So far, to be honest, I don't see this as a big threat.

— Has the arsenal of cybercriminals changed now in terms of the software used?

— It hasn't changed in any way. Basically, the entire arsenal of a cybercriminal is free software. Now any operating system leaks so much information about you that doing something illegal with the same Windows or OS is fraught with big problems. For many years, software has been written by cybercriminals (and not only them) independently and for their own purposes. You need to understand that a large number of software has a dual purpose. It's like equipment: until it's used by the military, it's not considered military. It's the same with software, and it's not just programmers who create it for hackers.

There are actually very few extremely malicious programs. Most of the entire hacking arsenal is also used by those who protect networks, hundreds of researchers, and so on. The software is in constant development: it exists in source codes, so each user can create their own version from its initial state. Educate yourself and write whatever you need.

— How do you assess the overall level of Russia's cyber security after the start of the Free Trade Zone? They say that the import substitution of Western software has had a positive impact on it.

— The more actively we switch to our own software, the safer it becomes. But there is a downside. When Western companies stop supporting SAP tools and other powerful solutions that have already been debugged, at this point, for large firms and structures, switching to their own software is more likely to lower the level of cyber security. But in the future, the development of their own network and business process management tools is only a plus.

Take the example of a national processing center. Until we introduced it, bank card processing took place abroad. In fact, unfriendly countries could, if desired, paralyze the entire financial and economic system of the Russian Federation. This is not possible right now.

About the anti-hacking law and ethics of cybercriminals​

— There is an opinion that the "Russian hackers" were given a free hand after the start of the SVO in a certain sense: their attacks on Western countries practically do not cause persecution in the Russian Federation. Moreover, representatives of the US Department of Justice have repeatedly called Russia a " haven for cybercriminals." Is this really the case?

— Until recently, I would have agreed with this, but this year Vladimir Putin signed a new law on cybercrime. It is not yet actively used, and it is still being looked at. But the point of it is to introduce a penalty even for a hacker whose actions did not lead to any victims or financial losses in the Russian Federation. That is, this law allows you to put a person who, for example, hacks US banks, does not take a single ruble for himself, but transfers all the money to his own account. And he can still get into a criminal case. One gets the impression that the law was specifically adopted in order to be able to put pressure on Russian patriots who help their own country, let's say, with their hacking activities.

I would very much like to get some new explanations to this law, but so far all this looks extremely strange. On the other hand, it is not our way to fight our opponents using criminal methods. Russia has always faced its enemies head-on. Because, probably, to declare: "Look, we have pirates! Go ahead, everyone attack! " is also wrong. Nevertheless, it seems to me that it would be logical to suspend such a law until the end of its term and somehow show more political activity in such a sensitive issue as cyber defense.

— In general, Russian hackers do not welcome the practice of "working onru", that is, they practice refusing to attack objects in Russia and the CIS countries?

"Historically, yes. And this is in the roots of our nation — " do not steal from your own people." There are, of course, other reasons. First, decades ago, credit cards were more developed abroad, and it was believed that it was possible to steal more and safer there. And in the Russian Federation, no cases were initiated against hackers without victims in the country itself. Because it was just common sense: why steal where you might be locked up? This morality was inculcated, including by young market participants. Until now, "working on ru" is considered shameful. I personally have never done this in my long practice. My botnet didn't work at all on Russian IP addresses. Therefore, I fully encourage this ideology.

Stealing, but not from your own country, does not make your Homeland weaker, although, of course, theft is theft. But the desire to help the state in this way is no longer enough. This is no longer a reason not to go to jail. And why such strange laws are signed by the president at such a difficult time for our country is, frankly, a good question.

But all the same, despite the fact that in Russia you can now go to prison without even working for the Russian Federation, I urge you not to" attack " your own state. Most of the foreign accounts are insured, and the bank will refund the money to the victims. This is far from the case here. Therefore, do not work "on ru". As the saying goes: "Who" works in the morning", they come to him in the morning."

— So, in your opinion, in the current conditions, being such a "Russian hacker" and participating in attacks on Western countries is a good thing?

— If a person is a patriot of Russia and for one reason or another cannot defend his Homeland with weapons in his hands, I believe that he should protect it as best he can. Therefore, I am convinced that it is not a crime to make money, even if it is done in criminal ways in unfriendly countries. Although, of course, it is better to consult a lawyer first.

Perhaps I am wrong in my heretical assessments and will be judged. But for me personally, taking money from the enemy and giving it to a good cause, for example, to support a special military operation, is a blessing. You save the lives of your own people, don't let this money kill our guys…

But here everyone should understand the risks and make their own decisions. You know, defending your Homeland with weapons in your hands is undoubtedly a heroic act. But to steal a million dollars, and then donate it to the Russian army... there is a chance that the Russian court will not see this as great heroism.

— We often learn about high-profile detentions in the West of those who were also classified as "Russian hackers". What causes them to be arrested in third countries and extradited to the United States?

— Recently, I don't see a large number of detentions. I think this is due to the fact that people began to travel less. Well, they probably become smarter, learn to protect their anonymity.

As for extradition, America has assumed the role of the world's policeman. I was arrested in 2017 when I was on vacation in Spain, and a lot of other people were taken in the same year. In 2016, the US presidential election was held, which was won by Donald Trump. The FBI-which is more of a Democratic structure-had a team to take everyone they knew and try to shake them out that the election was hacked by Russian hackers. As far as I know, no such mass arrests have been made since 2017.

Each detainee had his own criminal case. I was accused of sending spam, hacking computers, and creating botnets. And everyone solves the problem as best they can. In the United States, as you know, the legal system is very different. Therefore, I can advise you that if you are arrested in a third country, like me, for example, in Spain, you do not need to refuse extradition. All the same, 99 percent of those arrested at the request of the States are eventually brought there, as a rule, there are no exceptions. The remaining 1 percent are those who either died while waiting for extradition or were killed. At the same time, according to American laws, the term begins from the moment you cross their airspace in handcuffs on an airplane. The time you spent in other countries during your arrest while fighting extradition may not be counted.

We didn't know that at the time. I've never been to the United States. I am arrested in Spain, where I came for a two-week vacation from Russia, and they say: "That's it, you are flying to America for 100 years, here are the charges." And there they usually immediately prescribe the maximum terms — they sum everything up, they get some wild numbers that have nothing to do with the real state of affairs. But at first, hearing this is very scary.

About cryptocurrencies​

— Today, in addition to AI, you are actively engaged in cryptotrading. Do you believe in the future of cryptocurrencies in the white zone?

— I believe that the future belongs to cryptocurrencies, and traditional state currencies are becoming a thing of the past. No matter how much the state fights against this, this process is still unstoppable. We are all moving towards a world where currencies are not controlled by any entities or are controlled to a minimum extent. Of course, there is still a lot of fraud in this market, but this does not mean that you need to give up the crypt, you just need to figure out how and what to work with.

I hope that Russia will issue a good package of laws in this area, which will help it become a leader in promoting cryptocurrencies, in controlling them so that they are not used, for example, by terrorists and so on. We need to adapt. Unfortunately or fortunately, we are entering the world of independent financial instruments. And the sooner all states accept it, the more comfortable they will be in it.

— Can digital currency be a step towards this? Can any cryptocurrency hypothetically appear, for example, in the BRICS countries?

— It is necessary to draw a strict line between independent cryptocurrencies, such as bitcoin, and digital currencies of central banks, which are now launched by everyone who is not lazy. And if crypto is the future, then central bank digital currencies are the past. They are worse than cash. They do not take innovations from cryptocurrencies, only add to the money the option of checking each bill. You can track how the bill "changed hands", you can "color money": for example, digital money allocated only for food, you can not spend on anything else. Therefore, digital currencies — in my opinion, are absolutely evil.

Those banks that adapt quickly, introduce new tools, get new customers, and all the others will leave. Banks also die, just like people. I generally believe that the more banks die, the easier it is to live. In the modern world, they are not needed, this is a vestige. Therefore, they will simply die out like mammoths.

(c) Ekaterina Kobits
 
Top