Advertisement
Motherboard

Back from Hell? Hacking Site Founder Resurfaces After Going Missing

Meanwhile, the forum dwellers got a little paranoid.

by Lorenzo Franceschi-Bicchierai
Jul 3 2015, 6:10pm

More than two weeks ago, the founder and administrator of the dark web hacking site Hell, a self-described criminal hacker who goes by the name "Ping," was a little worried.

"If I am gone for over a day it means that I have been arrested," the hacker told me in an encrypted chat, adding that the "feds" were not very happy with him.

Hell had gained a certain notoriety after the hack of the hook up website Adult Friend Finder, which exposed the sexual secrets of almost four million people. The stolen data was first posted on Hell, and since then, the forum was full of law enforcement agents and security researchers, Ping told me.

Nevertheless, Ping promised he'd talk to me two days later, on June 18. But the hacker never showed up to our rendezvous over encrypted chat, and went missing. Now, more than two weeks after his last post on Hell, effectively the last trail he left online, Ping resurfaced on the forum.

"Hey, some shit happened but I am still here," Ping wrote on Thursday in a post titled "I am still alive."

"I am still alive [...] some shit happened but I am still here."

But it's unclear if this is really Ping, according to Bev Robb, an independent security researcher who's been visiting Hell for months, and was the first one to report the breach of Adult Friend Finder.

"There is no way to tell if the return of Ping on Hell is genuine or not," she told me in an email.

"He has not reappeared anywhere else that I am aware of," she added, referring to other websites that Ping frequents, which are also hosted on the deep web, a part of the internet only reachable using the anonymizing software Tor.

Interestingly enough, the hacker who took credit for the Adult Friend Finder breach, who goes by the nickname ROR[RG] replied to Ping's post, after he also went missing from the forum for weeks.

One forum member even pointed out this curious coincidence in another thread, writing that "Itsa [sic]little strange that both ping and that ROR guy show up within 20 mins of each other."

In the meantime, the administrators of the forum, perhaps Ping or perhaps another one whose nick is HA, removed all timestamps from the forum's posts on Thursday, according to Robb.

"This may be part of Hell's [operational security] strategy," she said.

Removing the timestamps could be a sign that the administrators are getting worried of investigators using them to figure out what timezone the users live in, or whether there's any patterns in their activities online.

"Glad to see I was not the only one worried about [law enforcement] linking our online times (post time) to time when they could verify I was sitting online," a user named cptcrnch wrote. "It would alone not be significant but linked with any other information they could make legal connection. Far fetched for some of you close to home for others."

"Am I the only one who sees fed everywhere I look?"

Cptcrnch isn't the only one who's a little paranoid on Hell. Another user actually started a thread titled "paranoid," referring to the fact that posts immediately get views as a sign that cops might be lurking.

"Am I the only one who sees fed everywhere I look?" iGYdHX wrote. "I mean simply being nice to me on this forum labels you as a fed in mind because everyone's a dick minus the fed who want you to download and run there warez so they can jail your ass."

I tried to reach out to Ping via email but he did not respond.