Max Butler: From Security Research to CardersMarket
Max Butler was once the kind of hacker security teams were glad to have on their side. He built arachNIDS, a free database of attack signatures that intrusion detection systems leaned on, and he quietly fed tips to the FBI's computer crime squad in San Francisco.
Then he became Iceman: the carder who stole 1.8 million credit card accounts, ran the underground's busiest marketplace and hacked his rivals' forums out of existence in a single night.
The one forum that survived his takeover was secretly run by an FBI agent. Butler figured that out, told everyone, and nobody believed him.
Max Butler at a Glance
- Born in 1972 and raised in Meridian, Idaho, Butler was a gifted kid with a short fuse. A high school chemistry-lab theft earned him probation, and an assault conviction at 18 put him in state prison until 1995.
- Reinvented as Max Vision in the Bay Area, he worked as a penetration tester, built the arachNIDS signature database and passed intelligence to the FBI.
- In 1998 he released a worm that patched a BIND hole on hundreds of military and government systems while leaving himself a back door. He was sentenced to 18 months in 2001.
- Out of prison and unemployable, he teamed up with Christopher Aragon and began stealing card data as Iceman, opening the CardersMarket forum in 2005.
- On August 16, 2006, he hacked four rival carding forums and folded their members into his own site, which quadrupled overnight to about 6,000 members.
- The Secret Service arrested him on September 5, 2007, in a San Francisco safe house rented under a false name.
- He pleaded guilty to wire fraud in 2009, and in February 2010 was sentenced to 13 years and $27.5 million in restitution, then the longest hacking sentence in US history.
- Charged in 2018 with running a drone smuggling scheme from inside prison, he was released from federal custody on April 14, 2021.
The Life of Max Butler
Butler's Idaho Years
Max Ray Butler was born in 1972 and grew up in Meridian, Idaho, a small town outside Boise. His parents divorced when he was 14, and by then he'd already found computers, bulletin boards and a talent for getting into places he wasn't supposed to be.
He also had a temper. A theft of chemicals from the Meridian High School lab ended in guilty pleas to burglary and theft charges and a stretch on probation.
Worse followed. In 1991, during his first year at Boise State University, Butler was convicted of assault and handed a five-year sentence. He was paroled in April 1995 with a felony record and no obvious future.
Max Vision, White Hat
Butler drifted through tech support jobs near Seattle, then landed in the Bay Area, where he legally changed his surname to Vision and reinvented himself. He shared a house full of programmers, ran systems for a gaming startup and built a reputation as a penetration tester who could get into anything.
His biggest contribution was arachNIDS, an open catalog of attack signatures hosted at WhiteHats.com that intrusion detection systems around the world drew on. Security people liked him, and several would later write letters of support when he was in trouble.
From around 1996 he was also sending the FBI's San Francisco computer crime squad reports on vulnerabilities, piracy and password cracking. By every outward sign, Max Vision was one of the good guys.
The Worm That Patched the Pentagon
In 1998, CERT warned of a serious hole in BIND, the software behind most of the internet's domain name servers. Patches were available, but Air Force bases, national labs and several federal departments hadn't applied them.
A hacker group called ADM released a worm that exploited the flaw. Butler modified it so that it'd download the official patch and fix every system it reached, then set it loose on the government.
The catch was that his version also installed a back door on every machine it touched and reported their locations back to him. Air Force investigators traced it, and on July 2, 1998, agents searched his home.
Butler confessed and went to work for the FBI as an informant nicknamed "Equalizer," infiltrating phone phreaks who'd broken into 3Com's phone system and collecting hackers' PGP keys at DEF CON. The arrangement collapsed when he refused to wear a wire against a friend and hired a lawyer instead.
In March 2000 he was indicted on 15 counts. He pleaded guilty to a single count of computer fraud, and on May 21, 2001, Judge James Ware gave him 18 months in prison and a $60,000 restitution bill.
"What I did was reprehensible," Butler told the court. "I've hurt my reputation in the computer security field."
Iceman Is Born
Prison cost him his career and his standing in the security world. When he got out, few companies would let a felon test their networks, and the consulting work dried up.
Enter Christopher Aragon, an older partner who knew how to turn stolen data into cash. Butler did the hacking from rented apartments, riding other people's Wi-Fi so nothing traced back to him, and Aragon's crew pressed the stolen numbers onto counterfeit cards and went shopping.
- A Ukrainian immigrant in Canada starts stealing to help his parents and ends up in a vendetta against the banking system inside an online criminal organization. Callan McAuliffe stars in the 2016 thriller, streaming on Prime Video.
He broke into banks and credit card processors, and he robbed other thieves too, raiding rival carders' machines and taking their stolen card dumps for himself. When his lawyer was later asked why he hacked other hackers, the answer was "basically because he could."
In 2005 he launched CardersMarket, a forum where carders could trade dumps, buy counterfeit cards and find accomplices. Butler ran it as Iceman, and also dealt under the names Digits and Aphex.
The Night He Took Over the Underground
The carding scene in 2006 was split across competing forums, each full of rippers, feds and feuds. Butler's answer was consolidation, by force.
On August 16, 2006, he broke into the databases of four rival forums: DarkMarket, TalkCash, ScandinavianCarding and TheVouched. He copied their combined 4,500 members into CardersMarket, knocked the originals offline and announced the merger. His site quadrupled to about 6,000 members in a day.
- Glenny's book follows the carding forum from the inside, including the FBI agent posing as Master Splyntr whom Butler publicly exposed and nobody believed. The other side of the August 2006 takeover.
DarkMarket came back, run by an administrator called Master Splyntr. Butler dug into the site's hosting and declared that Splyntr was an FBI agent.
He was right. Splyntr was Supervisory Special Agent J. Keith Mularski, running DarkMarket as a sting out of Pittsburgh.
But in a world where everyone accused everyone of being a fed, and where Iceman had just hacked the people he was warning, the underground shrugged. Mularski kept DarkMarket running for two more years, and the operation led to dozens of arrests across several countries.
The Safe House With a Kill Switch
Butler was careful. His customers weren't.
In May 2007 Aragon was arrested in Newport Beach after a counterfeit-card shopping spree that ended at Bloomingdale's with more than $13,000 of Coach handbags. Butler announced he was retiring, shut CardersMarket down, and then quietly relaunched it under a new administrator persona that was also him.
Meanwhile a Secret Service informant in Pittsburgh had bought more than 100 stolen card records from Iceman, which handed prosecutors in Pennsylvania their case. On September 5, 2007, agents raided the San Francisco apartment he'd rented under a phony name. His computers were rigged with a kill switch to wipe the evidence if the police came through the door, but nobody threw it.
Six days later a grand jury in Pittsburgh indicted him on three counts of wire fraud and two counts of transferring stolen identity information.
Thirteen Years
Butler pleaded guilty to two counts of wire fraud in June 2009. The numbers prosecutors laid out were hard to argue with: 1.8 million stolen card accounts, more than 10,000 banks affected and about $86 million in fraudulent charges.
On February 12, 2010, Senior US District Judge Maurice Cohill Jr. sentenced him to 13 years in prison, five years of supervised release and $27.5 million in restitution. It was the longest sentence ever handed to a hacker in the United States, and the largest restitution order in a computer crime case.
Kevin Poulsen told the whole saga in Kingpin in 2011, and CNBC's American Greed put Iceman on television. Butler, meanwhile, went to prison with a lot of time to think.
- Poulsen built it from court records, interviews and the carders' own chat logs, and the result reads like a heist novel: the worm, the safe house, the night the forums fell and the kill switch nobody pressed.
Drones Over Oakdale
Prison didn't entirely end the story. According to a 2018 federal indictment, Butler got hold of a smuggled Android phone in October 2014, and by December 2015 was using it to pull stolen debit card numbers off the internet.
Prosecutors said the proceeds paid for a consumer drone, which in April 2016 dropped phones, tobacco and drugs over two layers of fence into the yard of the federal prison at Oakdale, Louisiana. Butler pleaded not guilty to the nine-count indictment and blamed a fellow inmate.
Whatever became of that case, the Bureau of Prisons records show him released on April 14, 2021, thirteen and a half years after the raid on his safe house. He's stayed out of public view since.
Max Butler: The Thief Who Robbed Thieves
Max Butler had the skills to be remembered the way the arachNIDS crowd first knew him: a brilliant, generous white hat. Instead his name is attached to a record sentence and a book about how one person briefly owned the cybercrime underground.
Today he's a free man in his fifties, still owing $27.5 million to the banks he robbed, and apparently content to let Iceman stay a character in other people's stories.
He spotted the FBI agent hiding in plain sight among the carders. He just never spotted the one coming for him.
Brian Krebs: The Reporter Who Learned Russian to Hunt Hackers
What Is Identity Fraud?
QUOTE:
"Amateurs hack systems, professionals hack people."