Operacion Bitcoins: Login to HELL 9798688138023
My name is Alberto Daniel Hill. I am the first hacker that served time in prison in Uruguay for a computer-related crime
288 10 10MB
English Pages 247 Year 2020
Polecaj historie
Citation preview
Page |1
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
Page |2
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
Page |3
Operacion Bitcoins: Login To HELL
Operación Bitcoins: Login To HELL THE TRUE STORY OF A HACKER This version of the book does not include many parts of the story, to protect my loved ones, and to respect certain codes.
"You never know what worse luck your bad luck has saved you from." Cormac McCarthy, No Country for Old Men
OPERACION BITCOINS: Login To HELL - ISBN: 9798688138023
[AlbertoHill.com] [[email protected]] [@ADanielHill] Send an email to [email protected] to request permission to completely or partially reproduce this book.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
Page |4
1.
Operacion Bitcoins: Login To HELL
CONTENTS
1.
CONTENTS
4
2.
DEDICATION
7
3.
PROLOGUE
8
4.
ABOUT ME
13
ACT ONE
19
5.
THE BEGINNING OF MY END
20
6.
IT WAS IN OCTOBER 2014
26
7.
IT WAS IN APRIL 2015
31
8.
TWO SEARCH AND ARREST WARRANTS
36
9.
HANDLING THE “ATTACK” BY THE KIDS
43
10.
THE “EVIDENCE”
46
11.
A CHILDREN’S HACKING TALE
49
12.
THE SUPPOSED EXTORTIONATE EMAIL
52
13.
EXECUTING THE SEARCH WARRANT
60
14.
SATOSHI NAKAMOTO IS URUGUAYAN!
79
15.
BACK TO INTERPOL
80
16.
THE OTHER GUY
98
17.
MY 9/11
101
18.
THE PRESS RELEASE
104
19.
A POSSIBLE SCENARIO…
106
20.
PRISON
108
21.
BEHIND BARS
113
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
Page |5
Operacion Bitcoins: Login To HELL
ACT TWO
115
22.
THE DECISION
116
23.
ON THE RADIO
121
24.
LOVE IN PRISON
123
25.
DRUGS AND ROCK AND ROLL
124
26.
THE HEAT OF THE SUMMER
126
27.
FEBRUARY 9th, 2018
127
28.
NEW FRIENDS
128
29.
AN UNEXPECTED VISIT
129
30.
AN OFFER I COULD NOT REFUSE
132
31.
THAT WAS NOT A DAY TO DIE
135
32.
DEAD, HANDCUFFED, IMPRISONED, AND AT BURGER KING
139
33.
THERE WAS MORE YET TO COME
142
34.
THERE IS STILL MORE!
144
35.
RETURNING TO MY HOUSE—SURPRISE!
146
36.
"SO, BUCKLE UP DOROTHY, KANSAS IS GOING BYE-BYE"
151
37.
EVERYTHING WENT WRONG
152
38.
DRUG DEALERS HAVE MORE GUARANTEES
157
39.
TO LAUGH OR TO CRY
160
40. ECONOMIC LOSSES (PART ONE)
165
41. ECONOMIC LOSSES (PART TWO)
168
42. ANATOMY OF A RANSOMWARE HACK
173
43. MY REAL “ATTACK”
175
44. QUESTIONS WITHOUT ANSWERS
177
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
Page |6
Operacion Bitcoins: Login To HELL
45. THE MOST IMPORTANT QUESTION WITHOUT ANSWERS
181
40.
LIES, LIES, LIES, YEAH
187
41.
MY STORY AROUND THE WORLD
190
42.
ARTICLE FROM THE GERMAN MEDIA
194
43.
REFLECTIONS FROM JACK RHYSIDER
195
44.
REFLECTIONS FROM MACIEJ MAKOWSKI
197
45.
REFLECTIONS FROM END OF DAYS RADIO
199
46.
THE END OF MY STORY
201
47.
HOW WILL MY FUTURE FAIRY TALE UNFOLD?
203
48.
THE ONLINE SURVEY
205
ACT THREE
210
49.
THE AFTERMATH OF THE STORY
211
50.
FORGET ALL THE SADNESS TOLD IN THIS BOOK
216
51.
RESOURCES
217
52.
SPECIAL THANKS
221
53.
FEEDBACK
223
BONUS TRACKS
246
Bonus Track 1: THE GIRL.
246
Bonus Track 2: AGAINST THE ODDS.
246
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
Page |7
2.
Operacion Bitcoins: Login To HELL
DEDICATION
This book is dedicated to my mother, the only one left in my life.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
Page |8
3.
Operacion Bitcoins: Login To HELL
PROLOGUE
My name is Alberto Daniel Hill. I am the first hacker that served time in prison in Uruguay for a computer-related crime. I was prosecuted for a crime I never committed. A crime that probably never happened. Irregularities, illegalities, and verdicts based on ridiculous arguments were, and are, part of a process lacking any guarantees of fairness.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
Page |9
Operacion Bitcoins: Login To HELL
2016 and 2017
In mid-2017, I hacked the website of one of the world’s leading security organizations and immediately contacted the organization and reported the problem they had.
In November 2016, I found a security problem on the web site of the stock exchange of Asunción, Paraguay. When I did not find a channel to report directly to the system administrators, I reported to the Community Emergency Response Team (CERT)1 of Uruguay so they would do their best to contact them and inform them of the problem.
In December 2016, I had a profoundly serious car accident in the early hours of the morning. In the afternoon, I received an SMS from my insurance company with a code to track insurance procedures online. After five minutes of accessing the site, I detected a serious problem with the security checks and could see all the insurer’s claims, including personal customer information, medical details, police information, claims photographs, etc. Within 15 minutes, I was reporting to the CERT of Uruguay.
1
A computer emergency response team is a historic term for an expert group that handles computer security incidents. '"CERT"' should not be generically used as an acronym for this term as it is registered as a trademark in the United States Patent and Trademark Office, as well as other jurisdictions around the world. Alternative names for such groups include computer emergency readiness team and computer security incident response team (CSIRT). https://en.wikipedia.org/wiki/Computer_emergency_response_team
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 10
Operacion Bitcoins: Login To HELL
FIGURE 1 - CRASH, BOOM, BANG
Oh! And by the way, also in 2016, I informed YouTube of a weakness in its YouTube TV system.
I do not trust words, I even question actions. But I never doubt patterns.
I mention those things to show a pattern in my behavior. I have always made reports with the sole purpose of helping to improve the security of vulnerable
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 11
Operacion Bitcoins: Login To HELL
sites and prevent malicious people from finding them in the same way I did, by using faults to cause some harm or illegal behavior.
I never requested or received anything for these reports. For ethical reasons, I believed that I should proceed in this way. I could have looked away and not taken any action after finding these problems, but I did not think it was the right thing to do. I believe in consistency when it comes to acting. People typically follow certain patterns of behavior systematically and do not change how they act in certain situations overnight.
Before the media gave me the title of “hacker," I was an expert in cybersecurity, and was specializing in both cryptocurrencies and blockchain technology, and I was doing very well. I do not care whether I'm called a hacker or a cybersecurity expert. Being a hacker is not an insult—it is in fact a compliment.
This book tells the story that changed me forever. It was a totally unexpected turning point in my life and affected the lives of my loved ones. There is a “before” but not an “after” in my story. The word “sad” is used 22 times in this book. That might give you an idea that you are not going to read a beautiful, lovely, and magical fairy tale...
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 12
Operacion Bitcoins: Login To HELL
This book is for anyone interested in a real story about a criminal case where everything went wrong, and where somebody wants to trigger changes to avoid those wrong things from happening again, for people from the information security community, and in particular for those working or interested in computer forensics to learn what should not be done. In my case, everything was done incorrectly without any consequences for those in charge of the investigation, as I mention in the chapter “Drug Dealers Have More Guarantees.”
I tried hard for months to get a person with English as their first language and writing skills to write this book. I even signed two contracts with a couple of people to do it that initially were extremely excited about it, but things did not work out; they basically disappeared without any explanation. This book should be written and nobody, nor anything, was going to stop me from doing that, so I decided to write it myself. After having a draft, I could get four beta readers that pointed out many issues to fix. I did not want to use a ghostwriter. After that, I hired somebody to edit the book and make it ready to be published. I must thank the beta readers that provided me useful feedback. I deeply appreciate that support. That was basically how this book was born, grew up, and became mature enough to be published. This is a tremendous triumph for me and is another example that nothing is impossible when you desperately want it.
Do not forget to check out the last page of this book to have access to the bonus chapters!
Alberto Daniel Hill -
June 2020
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 13
4.
Operacion Bitcoins: Login To HELL
ABOUT ME
I was born in 1975 in Cardona, a small town in Uruguay. I lived there until I was six years old, then I moved to Montevideo, the capital of the country. I do not know what would have been my life if I had not moved to Montevideo, as the possibilities available in that small town of Cardona were almost zero. My parents kept the house in Cardona, but I seldom go there.
I had my first computer when I was about 10 years old. A Sinclair spectrum plus with 48kb of RAM. At that moment I knew that my future was going to be related to computers. I can say that my first hack was when I was 14, I learnt some basic assembler and started playing modified games.
Figure 1 - My first computer
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 14
Operacion Bitcoins: Login To HELL
I managed to alter a soccer game named “Emilio Butragueño” and I sent the hack to a Spanish magazine and they published it. That was cool. Then I took some courses in basic and kept learning by myself about assembler.
It is funny that nowadays I do not touch assembler, I find it too complicated and not especially useful for the things that I do.
Living in Montevideo I was able to go to the university and in 2003 I became a computer engineer, but in the University I did not learnt anything about security or hacking, I had to learn everything on my own, reading, investigating, and my love for that along with a lot of curiosity and patience gave me a lot of knowledge you could not had learnt in college. For almost 20 years I have been working and gaining experience related to Information Security (Consulting, Computer Forensics, Ethical Hacking, Computer Security). I worked in many large companies in Uruguay and provided services for companies in other countries.
In 2011, I specialized in ISO / IEC-27000 standard as well as ethical hacking and passed various courses related to a wide range of IT security fields. Then in 2012, I specialized in the ISO / IEC-20000 norm.
I am a certified project management professional (PMP) and have led many information security projects since 2011. I also have the Cybersecurity Fundamentals Certificate (CSX) from ISACA, an organization that awarded me PLATINUM membership recognition.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 15
Operacion Bitcoins: Login To HELL
The CSX certification in cybersecurity demonstrates knowledge aligned with the National Institute of Standards and Technology (NIST), National Initiative for Cybersecurity Education (NICE), which is compatible with global cybersecurity topics, activities, and job functions.
I have been part of the volunteer team of the Open Web Application Security Project (OWASP) Uruguay chapter since 2012. I have been recognized all over the world for my knowledge of blockchain and cryptocurrencies, as well as all aspects of their security.
My professional profile on LinkedIn is at the following address: https://www.linkedin.com/in/nofear75
FIGURE 2 - MY LINKEDIN PROFILE
Curiously, I was not only the first hacker to be sent to prison in Uruguay, but I was also the one who carried out the first computer forensics procedure in 2004 after the enactment of the "production of child pornographic material" law. That was my first job after becoming a computer engineer. It was an
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 16
Operacion Bitcoins: Login To HELL
honorable job. I collaborated several times on similar topics until 2007, while I was at the Interpol offices, I overheard a conversation that made me decide not to carry out these types of tasks anymore. I heard some laughter from a group of people who were laughing at a procedure in which, for an issue related to child pornography, they raided the home of a person in a remote place from Montevideo. They were pressuring the person who lived there until he admitted his guilt, almost crying, and urinating on himself. Then, when completing the paperwork associated with the case, they noticed that they had made a mistake in an IP number associated with the investigation and from which they had requested information from the Internet Service Provider (ISP). The person had nothing to do with the matter. We are all human beings, and we deserve to be treated with respect. I did not find what made these people laugh funny at all. I was not and will never be willing to be part of something like that.
I am considered an expert in both cybersecurity and cryptocurrencies. It is not a job—those fields are my passion. I have written articles for different publications. Cointelegraph is among the most respected and known portals dedicated to cryptocurrencies, and they have contacted me a couple of times to give my opinion regarding cybersecurity and cryptocurrencies.
Isn’t it ironic and ridiculous that being respected and recognized worldwide in those topics, they are the same ones that defined my tragedy?
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 17
Operacion Bitcoins: Login To HELL
FIGURE 3 - MY OPINION IN COINTELEGRAPH2
I was a speaker at several congresses, and in all of them I covered topics related to both security and blockchain or cryptocurrency technologies.
I was told that this chapter appears to be a resume. It is true; above all I am a person, with feelings, emotions, and sensations that can hardly be expressed in words. Like everyone else, I have a story that makes me who I 2
https://es.cointelegraph.com/news/ransomware-attacks-demanding-crypto-areunfortunately-here-to-stay
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 18
Operacion Bitcoins: Login To HELL
am today, as well as a lot of expectations, wishes, hopes, and dreams. In the end, everything comes down to feelings and emotions; they can lead to priceless and beautiful moments in our lives, or they can lead to extreme moments of feeling like one is living a meaningless life. Why am I mentioning all that? It is because the true story that I am about to tell you is a roller-coaster of those feelings, emotions, and sensations.
In the next chapter I describe how everything began. My life, my feelings, and emotions were wonderful, to the point I did not realize how lucky I was. And what is it like when you lose everything in just a moment, an unexpected moment that knocks you out without warning?
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 19
Operacion Bitcoins: Login To HELL
ACT ONE
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 20
5.
Operacion Bitcoins: Login To HELL
THE BEGINNING OF MY END
September 2017
The following text was published in one of the most prestigious podcasts in the world of hacking, “Darknet Diaries,3” where my story was told in episode 25.
“In Feb 2017, a medical provider in Uruguay got hacked. The attacker stole a bunch of patient records and then used that to conduct extortion on the provider. They said they would release the records of everyone with HIV unless they get $60,000 worth of bitcoin.
The medical provider worked with the police to catch and arrest Alberto Hill, a 41-year-old Uruguayan. Alberto had a ton of hacker paraphernalia and electronic devices at his house.
We’re talking dozens of credit cards, a bunch of hardware bitcoin wallets, thumb drives galore with hacking tools and viruses on them, a credit card writer with a bunch of blank cards, numerous hard drives, computers, routers, printers, and an anonymous mask.
Alberto Hill admitted to hacking into the medical provider, admitted to owning all this equipment, and even admitted to the police he sent the 3
https://darknetdiaries.com/episode/25/
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 21
Operacion Bitcoins: Login To HELL
email. But he claims he is innocent. Listen to his story and you be the judge on whether he is guilty or not.””4
FIGURE 4 - SEIZED "BITCOINS"
Additionally, Interpol told the press that the person cloned credit cards.
4
https://darknetdiaries.com/episode/25/
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 22
Operacion Bitcoins: Login To HELL
FIGURE 5 - THE HACKER WAS CARDING
And not only that, but he also accessed other people’s bank accounts, stealing money from them.
FIGURE 6 - THE HACKER STOLE MONEY FROM BANK ACCOUNTS
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 23
Operacion Bitcoins: Login To HELL
With that information, assuming it was correct, the police did a great job arresting a dangerous cybercriminal. He would have to pay for all those crimes. The offender was causing a lot of harm to innocent people.
According to police, they tracked down the IP address of the extortionate email to the person who had sent it.
RED ALERT! Actually, there were two arrests in this case. They traced two IPs from the email to locate the criminal... When reading the press release, I hope that most people raise an alert about the credibility of the (mis) information provided—something they said is clearly false.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 24
Operacion Bitcoins: Login To HELL
I am Alberto Hill, the person who was arrested, and this book is about that story. The facts released by the police were only lies, and at one point I realized that I should not believe anything about them. Everything they told the media and all the things they told me were lies. They destroyed my exgirlfriend's life without any justification. She has been trying to recover, but after three years, it is still extremely hard for her to cope with the brutal psychological damage they caused her. That is indefensible.
As I said, everything the police told me was a lie, and everything the police told my ex-girlfriend were lies that hurt her, made her suffer, made her think I was a monster. They had no mercy for her. The worst thing they told her was that I confessed that she was the one who had the idea for the extortion. That destroyed her and made her cry. I also cried, and I keep on crying.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 25
Operacion Bitcoins: Login To HELL
FIGURE 7 - EVERYTHING PERFECT FOR THE PICTURE
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 26
6.
Operacion Bitcoins: Login To HELL
IT WAS IN OCTOBER 2014
“Have you ever thought that if you could go back in time, you might not make the decisions yourself? We all make our snowballs with our bad decisions, balls that become gigantic, like the rock in Indiana Jones, and it chases us down the slope to crush us. All the decisions we make in the past lead us inexorably into the future.5” And it was with the best of intentions that I made decisions that made the rock from Indiana Jones crush me and ruin my life.
October 2014
On a divine spring Saturday in October 2014, when my life was still beautiful—and today I realize that I did not value it as I should have—I made decisions that led me to carry out actions that I regret today. It was at that moment that the most unusual, unexpected, incredible, yet sad story that I had to live began.
I was with my girlfriend at her apartment, and she asked me to visit the website of her medical provider, Círculo Católico, to find information about a doctor. She gave me the website's address, and before she could tell me her login credentials, I was already logged into the website. That was my LOGIN TO HELL.
5
La casa de papel
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 27
Operacion Bitcoins: Login To HELL
The login page had an annoying CAPTCHA, and I started looking at the source code. I quickly found out that all I had to do to get rid of that capture mechanism was remove a parameter in the login form URL, and bingo!
FIGURE 8 - HERE IS THE LOGIN TO HELL
The website's security features were terrible. I think insecurity was probably sold as feature for that system. I found out that by using "admin" as the username and password to login, I could not just log into the system, but I could log into the website with administrator privileges. It was a terrible thing! I had logged into a medical provider.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 28
Operacion Bitcoins: Login To HELL
But was that a “hack?” You can tell me your point of view via Twitter: @ADanielHill. From my point of view, it was complete unawareness of information security when creating and installing the system. When it comes to hardening6, default and most used credentials should not be allowed. Anybody could—and might have—accessed the system that way. And maybe they did. And probably they did.
I could theoretically have accessed and altered patient health records, added new patients, delved into the company's financial reports, and much more.
I immediately sent an email to the CERT and reported the security issue. It was a RED if I had to do a triage, which is an evaluation of the severity of the situation to prioritize resources according to the conditions. It is a term normally used in medicine, in the emergency room or any site with many injured people. Health care workers categorize each person and focus their attention and resources not on those who are so bad that they are unlikely to survive, but on those who can be saved by treating them immediately. Those whose life is not at risk are not a priority.
6
In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically includes changing default passwords, the removal of unnecessary software, unnecessary usernames or logins, and the disabling or removal of unnecessary services. https://en.wikipedia.org/wiki/Hardening_(computing)
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 29
Operacion Bitcoins: Login To HELL
In the case of the security incident, entering a medical provider's system with “admin” as the username and password requires immediate action to solve, as it is a time bomb in terms of security.
FIGURE 9 - TRACKING NUMBER #10445 In less than two hours, I received a reply saying that they had verified that I was right. The answer came from the CERT's director.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 30
Operacion Bitcoins: Login To HELL
FIGURE 10 - LOGGED IN AS ADMINISTRATOR IN THE MEDICAL PROVIDER 'S SYSTEM
I forgot about the website and its vulnerabilities. After reporting the issue, it was the medical institution and the CERT's problem.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 31
7.
Operacion Bitcoins: Login To HELL
IT WAS IN APRIL 2015
April 2015 A year later, in 2015, I visited the website again and decided to check for vulnerabilities again. And guess what?
Yes, you are right. In 15 minutes, I was able to access all kinds of information stored by the medical provider. I just modified some parameters of the URL. It was déjà vu.
A couple of years later, after the supposed “attack,” a company hired for hardening the systems mentioned that the attacks required extremely high hacking skills. That to me is funny, ridiculous.
Entering a system with the username “admin” and password “admin” isn't even a hack. Modifying an obvious parameter in a URL and gaining access directly to information to the system is not a “hack” either. Again, feel free to leave me your opinion about that: @ADanielHill—I strongly believe that you don't have to be a genius to access a site that way. All it takes for that is nothing more than a little bit of curiosity.
One more time, within five minutes I sent another email to the national CERT and informed them of the problem. Once again, I forgot about it.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 32
Operacion Bitcoins: Login To HELL
FIGURE 11 - TRACKING NUMBER #15521
The security issues were detected in a non-invasive way. I do not consider it hacking a system. Anyone with minimal security knowledge could have found what I found, and perhaps over the course of three years I was not the only one who discovered what I reported.
It was clear the facts around the case were never fully understood by anyone. The medical provider hired a company to solve the security issues and the information security experts, according to the transcript of the file,
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 33
Operacion Bitcoins: Login To HELL
mentioned that high skills in hacking were required for the attack I supposedly did. Another person from the CERT interviewed by the judge also mentioned that the attack was something that an average person could not have done and could only be performed by somebody with special knowledge of hacking.
I had those mentioned skills required for such a hack. I was the perfect person to be blamed for it.
So, I have high skills and special knowledge in hacking and information security, and they then claim that I sent an extortionate email from my house without hiding my real IP? Isn’t that strange? I did not send that email.
What I did was out of professional curiosity. I am a certified cybersecurity professional, after all. Curiosity is a key attribute to work in the field. Infinite curiosity and patience are a combination that, combined with appropriate training, make a good cybersecurity professional. In this story, curiosity does indeed kill the cat.
In the case of the medical company, once I discovered the first minor defect I decided to report it because I thought about the medical information of hundreds of thousands of people. Sensitive data like this must be properly protected. It did not affect me. Why the hell did I have to get involved just to help strangers? They were not going to thank me or protect me during the nightmare that was waiting.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 34
Operacion Bitcoins: Login To HELL
What I did was "responsible disclosure7," which means that if you want to help resolve a cybersecurity vulnerability, you must act in a way that will not make the initial problem bigger or affect the system in a more negative way.
The following definition of “responsible disclosure” was taken from Wikipedia : "In computer security or elsewhere, responsible disclosure is a
vulnerability disclosure model in which a vulnerability or an issue is disclosed only after a period of time that allows for the vulnerability or issue to be patched or mended. This period distinguishes the model from full disclosure.
Developers of hardware and software often require time and resources to repair their mistakes. Hackers and computer security scientists have the opinion that it is their social responsibility to make the public aware of vulnerabilities with a high impact. Hiding these problems could cause a feeling of false security. To avoid this, the involved parties join forces and agree on a period for repairing the vulnerability and preventing any future damage. Depending on the potential impact of the vulnerability, the expected time needed for an emergency fix or workaround to be developed and applied and other factors, this period may vary between a few days and several months. It is easier to patch software by using the Internet as a distribution channel.”
7
https://en.wikipedia.org/wiki/Responsible_disclosure
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 35
Operacion Bitcoins: Login To HELL
I reported the issues correctly and responsibly. I did not take advantage of the vulnerability for any benefit. That is not something that ever crossed my mind.
I must admit that I now deeply regret trying to help. It destroyed my life and caused a lot of damage and pain to my loved ones. That damage and pain was due to the way the investigation was handled, as well as the judicial process that I will discuss later. Believe me, due to these facts, many nights, and days I have cried alone. Despite all of that, I still hack, and I will always do it, just for fun or as a job. For me, hacking is a passion.
I must clarify that I never contacted the medical provider regarding any of these issues. I thought the
CERT
had the expertise to handle the security
problems I had reported.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 36
8.
Operacion Bitcoins: Login To HELL
TWO SEARCH AND ARREST WARRANTS
September 7th, 2017
On a cold and rainy morning in September 2017, the police came to my apartment, but there was no one there. My doorman, not knowing what was going to happen, told me that the police wanted to talk to me, so I went to the local police station.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 37
Operacion Bitcoins: Login To HELL
September 9th, 2017
It was about 7 or 8 p.m. It was pouring rain. I can still remember the scent of the raindrops that day. I could not imagine what was going to happen. Among other things, I was going to be away from my apartment for many months, and I would end up in a hospital's intensive care unit.
Not expecting anything bad (I was so naive!), I went to the police station. The policemen did not know what had happened and they did not know who I was. So, I gave them my details and waited patiently.
After a couple of hours in the police station, they radioed their colleagues in the Interpol office and everything changed.
Interpol agents arrived at the police station, and they arrested me. They handcuffed me, told me to hand over everything that belonged to me, to take off my belt, my shoelaces... I suppose it is standard protocol.
Curiously, the police did not read me my rights or tell me the reason for the arrest. I strongly believe they did not follow any of the established protocols when arresting a person.
They took me to the Interpol facilities in Montevideo. The policemen asked me if I knew why they took me there and I said “no.”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 38
Operacion Bitcoins: Login To HELL
So, they told me the name of the Círculo Católico, the health institution, and that the arrest was related to a cybercrime committed against that company. Wait, “arrest?” Why was I was being arrested?
I immediately felt great relief, because I remembered everything I did and knew that it had helped to improve the security of that website—or so I thought. I took for granted they were aware of all my security reports, including the ones about the medical provider. But I was completely wrong; they had no clue about anything. The context was unknown to the people in charge of the investigation, which is so ironic as they, as investigators, did not bother to investigate me, my profile, my formation, my experience, my security reports—in particular those about the medical provider. They sadly knew nothing about me, and it's something that still surprises me. Why didn't they spend at least ten minutes to look at my LinkedIn profile?
I took for granted that all my interactions with the CERT about the medical provider's security issues were known by Interpol's agents.
That was until December 2019 (two years after being arrested and being sent to prison) when I could access the file and read that the director of the CERT said he did not recall that I had made any report about a security
problem with the medical provider. That was probably the hit that hurt me the most during the whole process. Telling the judge that obviously made the her not believe anything I was saying. That blew my mind.
During the first night of my arrest, on September 9th, 2017, they interrogated me for about two hours, and I was honest in all my answers. Some of them were ridiculous. It was absurd that they asked me, "What is your Facebook
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 39
Operacion Bitcoins: Login To HELL
profile?" (I decided not to answer, “I do not use Facebook,” as they would ask me why not, and I would have to answer, “Because I hate Facebook.”) The perfect answer to that question in that scenario was “Meh.” All that took me aback as I mentioned. I was sure that Interpol's agents knew everything about the medical provider's security issues, as well as my reports. But they knew nothing about it, or at least that was what they wanted me to believe. In this story, nothing is what it seems. I could not believe what they were asking me. It did not take many questions for me to realize that the questioner didn't know anything about the topics he was asking about. You cannot ask someone if they accessed a certain Genexus8 object that has a name that is impossible to remember, unless you have designed the system and/or work on its maintenance on a regular basis.
When I was answering these questions by saying, “It could be, I don't remember exactly the names,” one of the officials intervened and said, “Don't you remember? I'm going to help you with your memory.” So brave was that person that, when I asked his name after that threat, he laughed and did not answer me. I believed that these officials should identify themselves when a person who has been arrested by them ask for their name. I also did not know that crossing your legs during an interrogation was prohibited. The same person from the threat, throughout the interrogation, kept yelling at me every time I unconsciously crossed my legs.
It was by itself an extremely uncomfortable situation, but this person, whom I later learned was named Winston Rodríguez, behaved like a bully. There was 8
Software used to develop the medical provider's system.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 40
Operacion Bitcoins: Login To HELL
no need to treat someone who was cooperating as much as possible like that who was cooperating as much as possible.
At one point during the interrogation, one of the Interpol agents told me that they had records from my ISP showing that the extortionate email was sent from an IP address that was assigned to me when the email was sent.
Apparently, there was also a connection to the website from the IP address that was assigned to me at the time. I knew that the Interpol officer was lying to me.
The final question of the interrogation was whether I had sent an email (or more than one) asking to be paid in bitcoins for not disclosing sensitive medical records from the medical institution. That took me by surprise and of course I said "no."
FIGURE 12 - I ANSWER I DID NOT SEN D THE EMAIL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 41
Operacion Bitcoins: Login To HELL
Then on the file, a record referring to my arrest and the first interrogation mentions I accepted all the accusations! That is a huge lie!
FIGURE 13 - RECORD FOR THE JUDGE AFTER FIRST INTERROGATION
It is interesting that many of the questions they asked me during the interrogation were not included in its transcript. I just signed it to avoid more aggression.
I wanted to have a lawyer with me... I didn't want to be alone and at the mercy of a group of "thugs" and arrogant people who only spoke nonsense and did not stop yelling at me with that attitude of power. Anybody can do that with a badge and a gun to somebody handcuffed. That feeling of power is just an illusion.
It was after two years that I could see that, according to the paper prints of the firewall logs supplied by the medical provider, a port scan was carried out against their website from my IP address, checking whether certain ports were open or not. It is worth clarifying that this is called "port scanning" and is not a crime. The bare records also show that the firewall did what is called a "drop" of the connections from that port scan.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 42
Operacion Bitcoins: Login To HELL
That means that no system was violated, and nothing happened. The logs show that the alerts about that were false positives that occur all the time when the tool generates alerts about certain events. There was no detailed information, so I cannot say more.
More than a year after being released from prison, when I finally got a copy of the 1,000-page case file, I read that the CERT's director told the judge he did not recall that I had reported any security problem with the medical provider. Can you imagine what I felt when I read that?
Yes, the person that was interviewed for my report back in October 2014 did not remember anything about that. All the reasons I can think of for that declaration are alarming. Why did he do that? For me, it was nothing more than one more of the large amount of lies included in the case file.
If I had known that when I was arrested, I would have had the opportunity to show the evidence of my reports of the medical provider's security problems, but no, I had to wait more than a year to find out. This is not acceptable—it is not fair.
Let the arrested person and their lawyer review all the files of the case, and let them clarify wrong information included there. Even if it is a 1,000-page file. In this scenario size does not matter; what matters is the truth and relevant information to solve the case.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 43
Operacion Bitcoins: Login To HELL
FIGURE 14 - "I DID NOT FIND ANY REPORT FROM ALBERTO HILL"
Above is the director of the CERT's declaration saying he doesn't recall that I reported any issue about the medical provider. That is something that still makes no sense to me. I wonder if I will ever understand that. At that point everything related to the case that had made no sense for me, made even less sense.
9.
HANDLING THE “ATTACK” BY THE KIDS
February 2017
The medical provider reported the "computer attack" to the police. Apparently, they took the logs from their firewall and delivered them to the CERT by email, without any verification of their integrity or veracity. Can you
believe it? The documents were not digitally signed or encrypted. They just exchanged plain text with information that I have no idea where it was taken from and the procedures used to do it, and that should have been
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 44
Operacion Bitcoins: Login To HELL
documented by a specialized professional. Evidently, experts or specialized professionals are lacking in Uruguay.
Digital evidence must be kept as is and stored in its original format. The evidence must be properly preserved, the chain of custody of the evidence must be intact and certified by a competent person who guarantees its integrity. None of this happened. It was all based on the exchange of emails and impressions of supposed logs or audit trails of the medical institution's firewall. No notary certified what was done.
When you think about it, what is a LOG printout? You could be “printing logs” right now and accusing half of Uruguay's population of cybercrimes!
Without retaining the original digital records, no data can be extracted, the IP address cannot be traced, nothing can be proven. The worst thing is not being able to ask for an expert opinion by an independent third party to determine if things were as reported. That is a must to ensure all the guarantees of a fair process. The guarantees are just like specialized professionals; there are no guarantees of a fair process.
I do not see how this links me to the crime. But the CERT had the two emails that I previously sent them in 2014 and 2015, and I assume there were no other people who informed them of the website's security flaws. Or maybe not. I will never know that.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 45
Operacion Bitcoins: Login To HELL
I guess, and this is the most frustrating thing, that they decided to go for the easy win and focus on me.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 46
10.
Operacion Bitcoins: Login To HELL
THE “EVIDENCE”
This is a copy of the supposed log of the medical provider's firewall with the false positive.
I could only gain access to it more than two years after my arrest.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 47
Operacion Bitcoins: Login To HELL
FIGURE 15 - LOG OF THE FIREWALL – ACTION “DROPPED”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 48
Operacion Bitcoins: Login To HELL
This only proves that I did not do anything. If the IP that appears was mine, the connections were all “dropped” by the firewall, so the conclusion is that nothing happened from my IP, there was no connection, no access to the system, no stolen information.
FIGURE 16 - COMMENT ABOUT THE "EVIDENCE"
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 49
11.
Operacion Bitcoins: Login To HELL
A CHILDREN’S HACKING TALE
I am far from being a cybercriminal. I am a person who was arrested and destroyed by "justice" and by the misinformation of the media for the alleged hacking. If I were really a criminal, I would be living a great life and I would not have such high levels of anxiety and depression. If I were a criminal, I would have accepted the innumerable "job proposals" from the dozens of people I met in jail. All the prisoners wanted to work with me, and they did not want to do legal things.
This is my side of the story. All the things mentioned by the police and the people from the CERT are false, and there is nothing in the investigation record to support the statements about the case. The only thing true is my confession about sending the email. But it remains to be clarified that it was a false confession, since I made it under a lot of pressure and anguish, seeking to protect my loved ones. You can go directly to the chapter “Lies, Lies, Lies, Yeah” to see a list of 13 lies about the case.
Having fulfilled my part of the deal by confessing something that I did not do, they still psychologically destroyed my ex-girlfriend, causing terrible damage that she still suffers today, and caused me a lot of sadness and guilt. What they did to my ex-partner is unforgivable and it was something without sense, without necessity, without coherence, and only shows the incompetence of the investigators of the case. The adjective to describe their behaviors is “bestial.” Only bestial people do that.
This is the story of someone who was used as a scapegoat in a situation that could and should have been avoided. Perhaps it was not meant to be
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 50
Operacion Bitcoins: Login To HELL
avoided. The CERT of Uruguay, despite denying it before the courts, was aware of certain serious security problems in the allegedly hacked system, and could eventually at least force or collaborate with the service provider to solve the critical existing security problems. Working with sensitive data such as medicine deserves maximum security measures, and it should not be allowed to operate without security being managed with the utmost rigor.
If the service provider's database was compromised, they should have notified all potential partners about the fact. This is established in current regulations.
I should say that nobody questioned the omissions of the Uruguayan CERT or the way in which the medical provider acted. They did an excellent job of making everybody look away from them and making all eyes only look at the hacker.
I will not get tired of repeating that what happened was due and could have been perfectly avoided. If you have the window of your house open for three years and someone tells you that it is risky, but you do nothing, it is only a matter of time before someone breaks in through it.
This is the story of a shameful job, where everything seems to be nothing more than a media show, rather than a crime related to information technology.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 51
Operacion Bitcoins: Login To HELL
I have no answers for everything that happened. As an example, I do not know why the police told the press that I had a criminal past and was accessing and stealing money from other people's bank accounts. Making such statements implies the possibility of being sued civilly and I find no need to destroy a person's name in such a cheap and cowardly way. (See chapter "Unanswered Questions").
These pages tell a story that is coherent and consistent with the evidence that exists (let us try to call “evidence” what was supplied and collected for this case).
The initial story told by the communications unit of the Ministry of the Interior seems to be taken from a show business magazine where everything is set up for photos, averting eyes from anything else. I grab my head when referring to the "evidence," since it is nothing more than a pile of papers that does not meet the minimum conditions to be considered "evidence." I do not understand how justice takes it as absolute truth, instead of putting in doubt its validity, which is totally questionable with common sense.
Furthermore, the "evidence" shows that in the alleged "attack," I did not access or alter anything at all in the medical service provider's systems. What is presented is proof of not having done anything in the system.
This is how anyone with basic analytical skills could find inconsistencies in the police story, and in the whole story in which I was involved by acting with only the best of intentions.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 52
12.
Operacion Bitcoins: Login To HELL
THE SUPPOSED EXTORTIONATE EMAIL
February 2017
This is the supposed extortionate email which is printed in the case file:
It is not possible to clearly see the sheet that contains an impression of the alleged mail with the extortion attempt, but it is possible to read in the subject of the "FWD" (forwarded) mail that the impression of an email,
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 53
Operacion Bitcoins: Login To HELL
supposedly extortionate, is not even original but a forward from one address to another. Where is the original email in its digital format? Or did the alleged extortioner send an email forwarded to the service provider? These are all incoherent elements. What causes me the most concern is that these key elements were not mentioned in any instance: neither in the interrogations with Interpol, nor by the prosecution, when they are aspects of which an explanation should be sought since they raise many questions about what is reported and what is really true.
FIGURE 17 - EMAIL FORWARDED ? FROM WHERE? ´
FIGURE 18 - REAL RANSOMWARE
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 54
Operacion Bitcoins: Login To HELL
The image presented corresponds to a real ransomware attack, the email supposedly received is a joke. The alleged extortionate email did not indicate the address where the requested payment should be sent...
FIGURE 19 - NO PAYMENT WALLET IN THE EMAIL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 55
Operacion Bitcoins: Login To HELL
There is something else that blows my mind, and I cannot understand it. Below is the report made by the company in the division of computer crimes of Interpol in Uruguay.
The complaint is dated February 8th, 2017. The email printed with the alleged extortion is also dated February 8 th, 2017, local time 22:22. Was the complaint made before receiving the email? There is just one more thing very strange about this. I feel that everything the file is not consistent.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 56
Operacion Bitcoins: Login To HELL
FIGURE 20 - EMAIL SENT FEBRUARY 8TH, 2017, 22:22 GMT-3
FIGURE 21 - REPORT OF THE MEDICAL PROVIDER. FEBRUARY 8TH, 2017
This part is so unclear to me. I doubt they reported the incident an hour before midnight of February 8th, 2017. I will not express my opinion about this as it would sound completely crazy. Make your own conclusions about this event.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 57
Operacion Bitcoins: Login To HELL
It is for me hard to believe that nowhere in the file appears the fact that there was no bitcoin wallet address to deposit the requested payment. It is not a minor detail, and obviously nobody noticed due to their lack of knowledge about how cryptocurrencies work. I am the only one who pointed it out after I got the file in my hands, but it is not reflected anywhere in the file. The prosecutor should have asked me about that instead of asking me about a “USB Killer.”
It is frustrating, and it doesn't seem minor, and that is why I repeat that with both reports, the access that was obtained to the company's information was achieved without "hacking" the system. The first report was the use of a trivial password and then access through the sequential modification of numbers in URLs. It could even have been indexed by Google, and the medical records could have appeared in the search engine. Hacking is too strong a word for something so silly. As I already mentioned, someone with basic computer skills and a little curiosity could have detected the same thing that I detected and reported. Who is to say that was not what happened?
The main crime the police were investigating was “ransomware” with an extortion attempt. The attempt was futile, as the company did not pay any bitcoin, so the person who sent the email did not receive anything. Nor was any information about the institution disclosed. From what I will explain later, nothing was revealed as nothing was stolen.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 58
Operacion Bitcoins: Login To HELL
The supposed crime was attempted extortion and fraudulent knowledge of secret information. The crime of extortion has a minimum of four years in prison. The fraudulent knowledge of secret information is not punishable by prison time but with a fine.
Interestingly, I was not being investigated for hacking or unauthorized access to the computer system.
It's hard to believe, but these things at the time were not real crimes! The penal code of this country didn't punish them.
The disclosure of confidential or sensitive information, whether by photocopying documents or accessing a computer system, is perceived by the law in the same way.
FIGURE 22 - INTERPOL URUGUAY
I spent the whole day in custody. I was confused. I didn't know what my situation was.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 59
Operacion Bitcoins: Login To HELL
If I had to give an opinion on this, I would say that the medical provider's officials did not have the experience to interpret the program. Perhaps the firewall was something that had been installed recently. For a correct administration of this type of equipment, adequate training, and above all, a lot of experience is required, which is acquired with many hours using the program.
In what was presented, there was no evidence of any login to the system (access to the system), there was no download of information, nothing. Nothing but a false positive emerges from the paper prints.
Anyway, those prints presented as evidence of an attack were the beginning of my worst nightmare.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 60
13.
Operacion Bitcoins: Login To HELL
EXECUTING THE SEARCH WARRANT
September 10th, 2017
The search warrant was this:
FIGURE 23 - SEARCH WARRANT The date of execution of the warrant was September 7th, 2017 (in the morning). It was executed on September 10th. My name is wrong, it says “Alvaro” instead of “Alberto.” It mentions the scope of seizure is “electronic
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 61
Operacion Bitcoins: Login To HELL
media.” Nothing was respected. They did whatever they wanted despite what was stated in the warrant.
The result and documentation of the six hours of “work” during the seizure was this “page”:
FIGURE 24 - SEIZURE RECORD
It mentions “many pen drives, many SIM cards, many HDDs” were seized (and the agents should have been fired for not knowing how to make a record of seized equipment).
The time in the record says the procedure began at 1:30 p.m. That is not true. They left a document on the floor of my house that they had apparently
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 62
Operacion Bitcoins: Login To HELL
started to fill in when they entered. It mentions the time was 11:45 a.m. That is the actual time they entered my house.
What happened in the window of almost two hours that was not documented by the Interpol agents? I can guarantee you that we did not sit down to drink tea and talk about soccer. Why didn't they include the right time in the record? It should reflect the facts as they happened exactly. The fact that they included deliberately false information in the record is a profoundly serious act. And at the same time, I wonder, why would they do that?
It was during that window of time that one of them approached me and told me that if I did not confess to having sent the extortionate email, they would
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 63
Operacion Bitcoins: Login To HELL
go to my mother’s house and my girlfriend’s house and cause them a lot of trouble.
I know that if I confessed, I would be able to prove that it was a false confession as they had no evidence to support that I had done it. But I did not have any chance to give my version of the story anytime during the process. I just wanted to protect my loved ones and ended up in a nightmare because of that. I said, "OK, I sent the email.” Those words were the keys to the door of hell.
They were surprised by what they found in my house. I suppose if they had done their homework, they would have known what to find in the home of someone who spent most of their life in computer security.
When they entered my apartment, the police officers could not believe the number of devices, computers, gadgets, digital storage media, computer parts, and other things that they saw.
And most of them had no idea what they were looking at. The following is a photo of my office taken in June 2020, where I worked when my health allowed me to.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 64
Operacion Bitcoins: Login To HELL
FIGURE 25 - MY HOUSE IN JUNE 2020
I think that, due to ignorance, something unknown or atypical made the officials think that everything I had was a threat and an instrument to commit a crime. It is sad they had such limited ability to understand a person with a certain well-defined profile and tools with which he worked on issues that were, and are, incomprehensible to the officials who participated in the procedure. I have no doubts that they were not competent for a case like that.
I reiterate that I love all computer gadgets, particularly those related to security. If I remember correctly, I had all the gadgets that were available in the Hak5 store at the time. Several "disappeared" and do not appear in the seized equipment or in my house. I wonder if “stolen” and “disappeared” are synonyms.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 65
Operacion Bitcoins: Login To HELL
So, I had more than seven laptops of different ages and specs, over five cell phones and SIM cards, a few Arduino single board microcontrollers, two Raspberry Pis, tons of hard drives, and a lot of old technology. I even had the three-inch floppy disks used by the Amstrads in the 1980s.
I also had a Spectrum +3, a couple of Sinclair computers, all kinds of floppy disks, SanDisk compact flash drives—basically any piece of technology that was used throughout the last few decades.
The police even seized an Iomega 250 tape drive. I do not know how they thought they were going to analyze that. They left all the floppy disks, of which there were about 500.
They probably also considered taking the old Blonder Tongue modulator for TV broadcasts, but they dropped it because they could not figure out what it was for...
I had some bitcoins, but not all of them were mine. Some belonged to my ex-girlfriend. I stored our bitcoins in a Ledger Nano S hardware wallet.
I had numerous Ledger brand hardware cryptocurrency wallets, a box of them, since I was working with the French company that produced them. I was an official distributor of Ledger products for Uruguay and Paraguay.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 66
Operacion Bitcoins: Login To HELL
FIGURE 26 - MY INFORMATION ON THE LEDGER SITE.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 67
Operacion Bitcoins: Login To HELL
FIGURE 27 - MY INFORMATION ON LEDGER'S SITE
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 68
Operacion Bitcoins: Login To HELL
FIGURE 28 - LEDGER WALLETS
FIGURE 29 - LEDGER WALLETS
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 69
Operacion Bitcoins: Login To HELL
FIGURE 30 - LEDGER WALLETS
The information regarding that was on Ledger's website. And as you know, bitcoins are not illegal, even though they are being abused by criminals, like any other technology: smartphones, cars, the Internet in general.
Everything had an explanation, and nothing could have been explicitly related to illegal activities.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 70
Operacion Bitcoins: Login To HELL
The problem, however, was that the police officers did not want to hear any explanation. They wanted to send someone to jail and close a case. For them, everything had a link with criminality. Bitcoins were mentioned in the alleged extortion email to the medical provider. So, the police put two and two together and got five.
As mentioned, the police had a warrant for the search and seizure of "electronic media." They interpreted that definition in a very liberal and selective way. I had no idea that a MASK was electronic media, but it surely looks great in a picture for the press release of the arrest. I also learned that bitcoin stickers and key chains were also “electronic media.”
They had no storage media, no evidence bags—nothing. I think they were hoping to find a desktop PC in my apartment that they could carry under their arm. So, they started taking bags, backpacks, suitcases, and cardboard boxes from my apartment to carry all the seized equipment. Hey! You're taking things from my house to carry what was seized? That's stealing!
Can you imagine this level of ineptitude? Sending people who had no idea what to do to do that job? Not a single bag of evidence, not a single antistatic bag for hard drives, not a single Faraday Bag for mobile devices. Not even a proper record of the items seized.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 71
Operacion Bitcoins: Login To HELL
This shows gross incompetence, this and the seizure of unrelated random items such as bitcoin stickers, physical collectible bitcoin coins, a plastic mask that they called "an Anonymous mask," a paper slicer, an LED flashlight, a paper shredder... There were two Fellowes document shredders at my house. They took the most expensive model and left the other shredder. I do not know the criteria to take one and leave the other. The answer is simple: they had none. I mention again that it is not possible to clearly see the sheet that contains an impression of the alleged mail with the extortion attempt, but it is possible to read in the subject (marked in yellow) of the "FWD" (forwarded) mail so that the supposed impression of the email, supposedly extortionate, is not even original but a forwarding from one address to another. Where is the original email in its digital format? Or did the alleged extortioner send an email forwarded to the service provider? These are all incoherent factors. What causes me the most concern is the fact that these key elements were not mentioned in any instance: neither in the interrogations with Interpol, nor by the prosecution, when they are aspects of which an explanation should be sought since they raise many questions about what is reported and what really happened.
The image presented corresponds to a real ransomware attack, the email supposedly received is a joke. The alleged extortion email didn't even indicate the address where the requested payment should be sent...
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 72
Operacion Bitcoins: Login To HELL
FIGURE 36, ANONYMOUS MASK - EVIDENCE OF WHAT, EXACTLY?
The police relied on the Uruguayan CERT report. The email was presented in paper form only, with no details on how they retrieved it, or when, from where, by whom, and with what tools they used.
No steps of any kind were taken to ensure a robust forensic process and to ensure the integrity of the information. The same happened with the medical provider's firewall where the records were not presented or preserved in their original format—that is, digital—but were printed on sheets of paper without any guarantee of authenticity or integrity. This is not how electronic evidence collection works and something like that should not be accepted as legally admissible evidence anywhere in the world.
Rule number one of evidence is to preserve it. The evidence was hosted on the servers and in the medical provider's system. If a legal path was to be taken for what they interpreted as an attack, all the medical provider's equipment should have been preserved, and it should have been guarded by
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 73
Operacion Bitcoins: Login To HELL
the police. That gives the basic guarantee that someone accused of a crime can ask for a second opinion about the actions and the findings. But rights were not things that had. On the other hand, everything was taken away from me, my home was looted—how can that be explained? The evidence from the organization was the key to the investigation and it was not preserved, information from servers was not cloned. All there is are sheets, sheets with inconsistencies that do not link me or anyone with the "attack."
During the raid, when I was taken to my bedroom in handcuffs, an Interpol officer approached and grabbed a book from my nightstand. He laughed and asked me, "Did you learn anything from this book?" I was devastated, everything was going wrong, everything was against me. I replied, "No, I already knew everything that book is about." The book was The Wisdom of
Psychopaths by Kevin Dutton.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 74
Operacion Bitcoins: Login To HELL
FIGURE 37 - THE WISDOM OF PSYCHOPATHS BY KEVIN DUTTON
I thought they were going to include the book in the case file.
Every minute that passed, every word I said, sank me deeper into the situation I was living. I could not believe the bad luck that I experienced during the process. The preservation of the medical provider's equipment should have been ensured and maintained until the process was complete, considering any appeal—that is stipulated by good practices worldwide.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 75
Operacion Bitcoins: Login To HELL
The police, CERT, or the Medical Institution could have calculated at least one part of the email as a digital file to show that it was the original. There was no evidential chain of custody. Nothing.
The most relevant part of the email, which is in English, says:
ALL MEDICAL RECORDS HAVE BEEN COPIED AND VARIOUS TYPES OF MALWARE HAVE BEEN INSTALLED, AND CAN BE ACTIVATED AT ANY TIME TO ENCRYPT THE SYSTEMS SO THAT YOU CANNOT ACCESS THEM. IF YOU WANT TO REMOVE ALL MALWARE, SEND US WITHIN 24 HOURS 15 BITCOINS TO THE FOLLOWING ADDRESS: (blank space)
Maybe the criminal forgot to copy and paste it there? Perhaps the address for the payment was irrelevant for the same reason that my house raid resulted in more than 30 hard drives not being seized?
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 76
Operacion Bitcoins: Login To HELL
It was impossible for me to explain anything to the police officers during questioning. They clearly were not the right guys for the job. They had no knowledge or understanding of the technology and the specifics about cryptocurrencies, information hacking, etc. Those were things which they were completely unaware of. What angered me the most was that despite that, they spoke to me and shouted with enormous arrogance, trying to pretend they were experts on the subject.
Their other questions were something along the lines of:
●
"Where did you get all the money from?"
●
"Why did you have so many computers?"
●
"Why did you have so many monitors?"
●
"Do you work for the Russian/Argentine mafia?"
They asked me the last question repeatedly. At one point I was so tired of being asked that question, that I was about to make them happy and tell them yes, I work with both Russian and Argentine people. I am glad I did not do that as I would probably still be in prison.
An audio file linked to the press release footnote on the case mentions that I was "visiting bitcoin-related sites, so they were well on track with their investigation..."9
9
https://anchor.fm/dashboard/episode/e7a1bm
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 77
Operacion Bitcoins: Login To HELL
You can also find the link to the Ministry of the Interior's press release in the “Press Release” chapter.
From that it can be concluded that they were monitoring my Internet activity for some time. Nothing about that is in the file.
The claim that “I was accessing bitcoin-related sites, so they were after the right person” is presented as an argument that reinforces my alleged guilt, and surely was an important factor in the treatment that I was later. But I have no way of showing my downloads and explaining that I was accessing dozens of cryptocurrency sites daily because I was working with that, and trading daily. It was my full-time job. There is no relationship between accessing cryptocurrency sites with possible crimes where cryptocurrencies are involved. Again, another way in how the police could not correctly interpret or visualize the true meaning of certain actions or behaviors.
But what frustrates me the most is the invasion of my privacy without there being a court order involved or there being a record of it in the file. It is assumed that the items included in the file are all those that make up the process and if they are not there, they cannot have any value or relevance.
It is also reasonable to think that they have reviewed everything related to my bank accounts, money movements, etc. In that case, it surprises me that
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 78
Operacion Bitcoins: Login To HELL
none of the people with whom I regularly made transactions of thousands of dollars to buy or sell cryptocurrencies have been investigated. ´ Additionally, in June 2017, two talks of mine were selected to be presented at the most important security event in Latin America, the (ISC) 2 LATAM 2017 Security Congress. One of my talks talked about bitcoin security and another was called “From Crime to Cybercrime.”
To obtain material for the talks, I needed to browse the dark web and investigate. I needed access to software and technology that is not sold elsewhere in order to study it, understand it, and be able to be protected from it, and thus improve security in general.
So, access to bitcoin sites and dark web sites was an everyday thing for me. But the geniuses of Interpol interpreted only what their ability allowed them to.
As a major factor in this situation, I believe that the records about my Internet connections—that were undoubtedly used against me and do not appear in the file—are evidence to which my defense did not have access. That should have led to the invalidity of the process. I am not a lawyer, but common sense tells me that the famous guarantees of a fair process did not occur in this scenario.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 79
14.
Operacion Bitcoins: Login To HELL
SATOSHI NAKAMOTO10 IS URUGUAYAN!
During the raid and in the midst of all the screams of the Interpol people asking me questions about everything they found—questions that were mostly ridiculous—the official, Winston Rodríguez, the one who seemed more aggressive in his way of speaking and would not stop yelling at me to “stop lying,” demanded that I tell him where I got the bitcoins from. My answer to the question was that I did it in different ways, the most common of which was on the website LocalBitcoins. When I gave him that answer, he yelled at me not to tease him anymore and tell him the truth, since I could not lie to him on that matter. “I’ve known bitcoins for ten years,” Agent Rodríguez yelled at me (it was September 2017—bitcoins had only existed for eight years). This was a display of arrogance combined with ignorance at its best.
It is scary to know that such people can determine and mark the future of a person with their actions.
10 Satoshi Nakamoto is the name used by the presumed pseudonymous person or persons who developed bitcoin, authored the bitcoin white paper, and created and deployed bitcoin's original reference implementation. As part of the implementation, Nakamoto also devised the first blockchain database. In the process, Nakamoto was the first to solve the double-spending problem for digital currency using a peer-to-peer network. Nakamoto was active in the development of bitcoin up until December 2010. Many people have claimed, or have been claimed, to be Satoshi Nakamoto.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 80
15.
Operacion Bitcoins: Login To HELL
BACK TO INTERPOL
September 10th, 2017
They took me from my apartment to court for the first interview with the prosecutor, while still executing the warrant. Meanwhile, my ex-girlfriend stayed in my apartment as a “witness” to the process. She was not treated with respect.
Court was horrible for me. The place, the questions, my anxiety, my lack of defense made me feel I was lost.
While waiting for the interview, I saw my ex-girlfriend appear, and they put her in a cell. I could not understand anything. I could not believe she had been arrested.
After that terrible moment, they took me back to the Interpol offices.
During the search, the police found, apart from what was already mentioned, more than 100 blank magnetic cards and a writing device/card reader.
So, they were certain that I was in the "carding" business, which meant I was cloning people's credit cards and using them to steal money from their bank accounts.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 81
Operacion Bitcoins: Login To HELL
They did not consider, not even for a second, that there might be other explanations. In fact, there are, and they do not require more than a bit of analytical skill and solid foundations in computer security issues to understand them as more reasonable and less simplistic alternatives.
I am not going to go into the details here so as not to downplay my story, but you can look at the project's technical note in the footnote 11.
You could load these Uquid cards with cryptocurrencies that could then be used as a universal means of payment.
All the equipment I had related to cards was for research purposes. I needed to understand how the cards worked and test their security features. It is not illegal to have blank magnetic cards, and the card reader/writing device can be purchased openly on the Internet. What is more, most hotels have these devices to give access to the rooms using magnetic cards.
I had a good time with the Uquid team, and that is also why the police found several real credit and debit cards. All were valid and all were in my name, many of them expired, but also many active and with significant balances that, after almost three years after the raid, were not returned to me.
The police prepared a press release related to the investigation, which influenced what was later published and broadcast through the mass media.
11
https://uquidcoin.com/pdf/UQC%20-%20Whitepaper.pdf
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 82
Operacion Bitcoins: Login To HELL
This included the most important newspaper in Uruguay, which published the story accompanied by a photograph of the cards, the equipment, and statement: “The hacker also cloned credit cards.”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 83
Operacion Bitcoins: Login To HELL
FIGURE 31 - UQUID TEAM
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 84
Operacion Bitcoins: Login To HELL
Posting these things and doing it that way was very irresponsible and unethical. People who knew me left me after everything was spread about me.
Basically, it was a trial through the media before anything was proven or disproved—a conclusive statement with which I could not debate or show my side of the story. I had no way to clear my name, which caused me deep pain that lasts to this day.
Now, after they found nothing illegal and everything was ordered returned to me, do you know how many fraudulent cards were found?
Zero, none.
I never cloned credit cards other than my own for research purposes.
They seized the following amount of money in the apartment:
● 8,000 euros; ● 1,400 US dollars; ● 3,000 Uruguayan pesos; ● 150 Brazilian reals.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 85
Operacion Bitcoins: Login To HELL
And they left other money from other countries lying on the floor or in boxes, and some couple thousand Uruguayan pesos in coins that they refused to confiscate, as they said they would have to spend too much time to count it. There was the equivalent of hundreds of dollars in coins from Uruguay. They did not want to work too much.
If the police had done some profiling or any investigation, they would have discovered that I was the Uquid debit card distributor for Latin America.
FIGURE 32 - UQUID DEBIT CARD
Uquid, at the time I was involved, was a cryptocurrency payment system project.
What they left behind were small amounts of Argentine, Paraguayan, and Chilean coins. This money was not seized for any reason and was left in the apartment.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 86
Operacion Bitcoins: Login To HELL
I got that cash from the photo because of buying/selling cryptocurrencies on LocalBitcoins.
Again, there was a perfectly normal explanation for this money, and I tried to communicate that to the police.
Here are my LocalBitcoins profiles that I used at the time:
● https://localbitcoins.com/accounts/profile/nofear75/ ● https://localbitcoins.com/accounts/profile/nofear1975/
The money in my apartment was not a large amount. Most of it was in bitcoins and other cryptocurrencies, in secure wallets or in cryptocurrency exchange accounts.
The police did not think to investigate this and didn't understand the value of storage mechanisms in the blockchain.
However, they caused me irreparable harm. I lost a large amount of money from exchange wallets after my cell phone with 2FA (Two Factor Authentication) for those online accounts was seized.
I offered them all my PIN codes, credentials, etc. I had a lot of evidence to justify the origin of the funds. Once again, no one wanted to listen.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 87
Operacion Bitcoins: Login To HELL
I only got my 2FA cell phone back in November 2019. The exchange where I had all my cryptocurrencies online had disappeared a year ago. The cell phone was never appraised, so the loss suffered could be totally avoidable if justice had been willing to avoid such great damage to me. I cannot describe in words how I feel about this situation.
The phone itself is currently in the hands of a notary as evidence for any legal action against the police or the judiciary.
I do not know exactly what happened to the phone while the police had it, but I know it was still on while it was in the police evidence room. That was the length of my effort to preserve digital evidence.
The following is one of the most serious errors when it comes to handling digital evidence. The phone was seized on September 10th, but from September 11th to September 15th, 2017, it was still powered on and connected to Google. I took a screenshot of the timeline from my Google account.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 88
Operacion Bitcoins: Login To HELL
FIGURE 33 - NOT RECORDED ACTIVITY OF ONE SEIZED CELL “POLICE HEADQUARTERS”
Absolutely everything that is done with seized material must be recorded in such a way that an independent third party can take the record and reproduce the action, with the aim of confirming whether the result is the same as that initially obtained. Actions cannot be taken without proper registration.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 89
Operacion Bitcoins: Login To HELL
Anywhere in the world, having the cell phone in that state without any record that justifies it, or worse, without any record stating the situation, would make the device lose any value as possible evidence. In such a scenario, the lack of collateral makes it easy to plant evidence on the seized equipment. It's profoundly serious. The documentation of everything that is done with the evidence is the most important thing in a process of these characteristics after rule number one, which is its preservation, never working on electronic media but on images of the information stored in them.
In addition to the connection of the cell phone to the Internet, I could check its activity from my Google account, and I could see they had accessed my WhatsApp and Telegram accounts, among other things. Of course, that was not part of any record or report in the file. If they had wanted, they could have included, for example, child pornography in my equipment. They could have done anything they wanted, and that is what they did.
I had my Samsung Galaxy S7 charging and turned off when they went to my apartment, and one of the officers, doing exactly the opposite of what the best practices in computers forensics establish, turned it on. Later my girlfriend gave them the code to access it. They surely had no clue about computer forensics. A rule that is a must in these procedures is: if the device is off, keep it off.
Personally, I feel aggrieved that they did not take care of my computers and the information stored in them, information of which I am not the owner but the custodian, such as endorsements of my mother's work and the lifelong work of Allan Jay Friedman who lives in the United States.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 90
Operacion Bitcoins: Login To HELL
Because of the brightness of these people, I lost everything stored on a Corsair pen drive that hardware-encrypts information using a battery that is recharged when regularly connected to a computer. After two years the battery is completely discharged and there is no way to recover what is stored.
A letter was presented to the judge where I volunteered to provide the technical police with all my passwords, PINs, system access credentials, etc. Incredibly, it was not accepted. If they had acted logically, I would not have suffered this irreparable damage. Said damage goes beyond the economic, as they damaged my image and the trust of the people who trusted me to protect their information. That is irrecoverable.
Investigating and consulting with world leaders in computer forensics, they do not know of cases where a proposal like the one I made has been rejected. I would very much like to know the arguments on which the judicial actors relied to reach the resolution they did.
Despite all this, I was still being held in a cell at Interpol. I was there for almost 48 hours—two long, endless, and traumatic days.
And they were much longer for me, since during all that time they did not give me any of the medications that I take, medication for anxiety and for my attention deficit disorder, all of which, without medication, put me in a confused state. The lack of medication made me really anxious, nervous, and agitated. I also suffer from asthma, and being in stressful conditions that trigger attacks where I can't breathe caused my bronchial tubes to become even
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 91
Operacion Bitcoins: Login To HELL
more clogged. The days were very cold and I did not have a suitable coat. All of this not only prevented me from thinking clearly, but also let me get carried away by the situation for fear of suffering a serious health problem.
I just wanted it all to end. But the interrogation continued.
The police officers were, I guess the proper word here is "playing," with some of the seized computers and I had to warn them that there were two USB Killers between my devices (one of them “disappeared” when they had returned to me everything they had seized, like other equipment, tools, ID cards, cell SIM cards, etc.—and all those things were legal and my property.)
I asked them to be incredibly careful and explained that if they plugged a USB Killer into any device, the motherboard circuity would be destroyed.
USB Killers are basically USB sticks that generate a power surge every time they are plugged into a powered USB port. They are designed to test the surge protection circuits of digital devices, but they are not compatible with home computers.
These USB killers are widely used by penetration testers, hardware testers, various government agencies, law enforcement organizations, etc. They can be bought openly on the Internet.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 92
Operacion Bitcoins: Login To HELL
FIGURE 34 - ONE OF MY USB KILLERS
I tried to explain that to the officers, but it fell on deaf ears. They clearly had no understanding of the technology and seemed uninterested, even if it meant accidentally damaging potential evidence.
Later that Sunday, they took me to court where I met the prosecutor, who asked me some irrelevant questions. Then they transferred me back to the Interpol premises, where I spent my second night under arrest. Another night dying of cold, with anguish and anxiety that made it difficult for me to breathe, without having access to any medicine. That is something that I repeat because it seems to me something basic to preserve the health of a person in such a situation. It seems that once they put handcuffs on us, we stop being people. They only remove our belt and laces so that we cannot commit suicide and be a problem for them.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 93
Operacion Bitcoins: Login To HELL
FIGURE 35 -USB KILLER, EVIDENCE OF WHAT , EXACTLY ?
September 11th, 2017 On Monday morning they took me back to court. Luckily, my mother was able to get me a great lawyer who was confident that it would all be over that day. That was the first time I had access to legal representation. The day before, I felt no one was defending me.
My lawyer was a criminal judge, but he had left that job a few months before my case. I was one of his first clients as an independent attorney. I knew
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 94
Operacion Bitcoins: Login To HELL
how the system worked, I knew the other judges, so I was hopeful or, rather, reassured that that night I was going to sleep at my house.
The prosecutor took some notes out of the file and asked me why I had a device called USB Killer. I wanted the earth to swallow me up and I felt stupid for alerting the police about these devices. I cannot remember what I said; I was probably trying to explain what the device was, but it was like talking to a wall. Why was he asking me that question?
Then he presented another page with the image of a USB drive next to a ruler and asked if I knew that the USB drive had 12 viruses. He said it in such a way, like he was not sure if he was wondering if this was correct or if he was making a factual statement. What link existed between the prosecutor's questions with the case? It is sad, but the answer is "none."
I tried to tell them that I worked with Metasploit, which is a popularly used penetration testing framework. It includes creating payloads for exploits that could be detected as viruses.
But honestly, I was so tired that all I wanted was to go to bed and sleep.
My answer was an inarticulate and disappointing,
"Yes...? Meh...”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 95
Operacion Bitcoins: Login To HELL
It lasted a couple of hours. My attorney listed all the reasons why prison was not an appropriate measure for my case, conveying a huge range of substitute measures to prison. I didn't have a criminal record, I was not a dangerous or violent person, I did not fit the profile of someone who was going to escape. They hadn't accused me of violent crimes. They hadn't even officially charged me with anything at that stage in the process. But the judge did not hear any of these arguments. While my lawyer was arguing in my defense, the judge entered where we were and the first thing she said to him was, "Don't contradict me."
I have absolute conviction that the decision to send me to prison had already been made before going to court. Testifying was just a ritual in this case. My future had already been decided.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 96
Operacion Bitcoins: Login To HELL
The judge said that there was a risk of escape and that my knowledge of computers could potentially affect the ongoing investigation. She said she would send me to prison as a preventive measure. My eyes were full of tears, and I felt like the world had come to an end. Both arguments were ridiculous.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 97
Operacion Bitcoins: Login To HELL
Even if found guilty, my case would not be punishable with prison time, so why would I escape? And regarding using my skills to alter the investigation, it's basically saying that I had telepathic access to equipment stored and locked in the police's facility. I do not have that skill.
It's what I said before—I was already sent to prison before going to court.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 98
16.
Operacion Bitcoins: Login To HELL
THE OTHER GUY
Sometime after my arrest and incarceration, I found out that there was another person who was also arrested for the same case. They executed a search warrant at his home. He was arrested for a few hours for the same investigation, because his IP address apparently appeared during the alleged attack. It was from this IP address that, according to the records, information was downloaded that resembled the size of a movie in DVD format, and it is impossible for it to correspond to the size of the supposedly “stolen” database.
In the press, Interpol once again revealed its inability to analyze and read a situation like this, stating that they supposed that I had hacked into said
person's WIFI network. It is a very naive and simplistic conclusion, as well as inconsistent with "my high knowledge." I have the knowledge to connect from my home to anywhere on the planet, making my tracking impossible. I have the training and the tools to do it. I don't know the other person; I don't know where he lives, and I never hacked anyone's WiFi network except my own for learning purposes.
The password to access his wireless network was released because, again, Interpol showed its inability to measure what it did. When it comes to managing information, they are almost as bad as investigating computerrelated crimes
My professional opinion on this point is that any connection to other countries should have been heeded and investigated. If I had had to carry out the alleged attack, I would have done it with connections from other
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 99
Operacion Bitcoins: Login To HELL
places that would make it difficult, if not impossible, to reach its origin. I would never have considered hacking from Uruguay. In the papers provided by the medical provider, nothing is mentioned about that. The supplied papers with the supposed logs are worthless as "evidence.”
Anyway, this information is funny to me since one day I connected from my home and was registered with the service provider, and the next day I supposedly accessed the service provider from a WiFi network's IP by hacking its password. Why didn't I just stay at home and do everything from there? Nobody thought Interpol's conclusion was ridiculous.
By the way, this guy was taken to the Interpol facilities for interrogation and he went there with a lawyer, a privilege I did not have. I wonder why that was.
The saddest thing is that I can understand how this person came to such an unfortunate situation. Obviously, I cannot go to court and talk about it. I always tell the truth and end up in a bad way, suffering negative consequences. If you ask me now, I pretend not to know. I already learned how the system works.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 100
Operacion Bitcoins: Login To HELL
Yes, you read correctly, I can explain with a high degree of accuracy the involvement of the other arrested person, but I am not going to do the police's homework. I prefer that they continue with their theories that only demonstrate incompetence. Not to mention that telling the truth again could potentially cause even more trouble. No way, not in this lifetime will I say anything. I have slowly learned how the system works.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 101
17.
Operacion Bitcoins: Login To HELL
MY 9/11
September 11th, 2017
It was September 11th, 2017. It was my September 11th. We probably all have one: a day that we will never forget and will leave a scar forever in our lives; a day where there is nothing you can do to avoid the inevitable.
I was going to prison. That was surely the hardest moment of my entire life. That was my September 11th, the day the world fell apart without being able to do something to prevent it, being a simple spectator of something that would change my life. Nobody was going to change that.
FIGURE 38 - JUDGE'S RESOLUTION TO SEND ME TO PRISON.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 102
Operacion Bitcoins: Login To HELL
With that news, all my dreams, plans, and hopes collapsed. I felt my whole world fall apart, and a lifetime of effort, work, risky decisions that had paid off and allowed me to be where I had wanted to be one day, ended up depriving me forever. I experienced a turning point in my life, a time of negative changes that made me question so many things. Being sent to prison was inevitable, and there was no going back. I wondered what my new life would be like there, and for the first time I did not envision any way to recover and regain it. That was the cause of great anguish, sadness, and so many indescribable feelings and emotions.
Only by living what I experienced can one feel what a human being feels in a situation like that. A situation that should never have happened, and was something totally unnecessary and could have been avoided. I still do not have the answer to the question "how do I recover?" Today I do not see any way for me to recover. What is more, I often feel like I keep falling instead of getting ahead.
I detected and reported security problems on a regular basis. At the beginning of the story, I had already commented on the ones I found between 2016 and 2017. I always made reports with the sole objective of helping solve the security vulnerabilities of systems and prevent malicious people from finding them in the same way I did, by using the flaws to cause harm or to commit crimes. I never requested or received anything for these reports. For ethical reasons, I believed that I should proceed in this way. I could have looked to the side and taken no action when finding these problems, but I didn't think it was the right thing to do.
The judge was never made aware of my conduct and behavior as far as information security is concerned. They just stuffed her head with masks and
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 103
Operacion Bitcoins: Login To HELL
guillotines that clearly made me a dangerous criminal. The real danger was those in charge of the investigation.
The court not only received embarrassingly bad advice, but they never knew about information security's aid and professionalism. They never knew that frequently—and for years—infosec reports and helps improve the security of many systems, both from the government and private companies in Uruguay, and in the rest of the world. The court didn't understand that the crime was impossible to judge due to lack of basic knowledge in cryptocurrencies. Knowledge that I had humbly mastered.
Once I heard a phrase that has been etched in my memory: "The most stressful events in a person's life are three: when he changes jobs, when he gets married, and when he gets divorced." I have no doubt that the author of that phrase was never imprisoned. That is a moment where stress is so high that it's not even comparable with any other event in a human being's life.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 104
18.
Operacion Bitcoins: Login To HELL
THE PRESS RELEASE
FIGURE 39 - PRESS RELEASE FROM THE POLICE12
12
https://www.minterior.gub.uy/index.php/unicom/noticias/4971-operacion-bitcoins
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 105
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 106
Operacion Bitcoins: Login To HELL
FIGURE 40- PRESS RELEASE FROM THE POLICE
19.
A POSSIBLE SCENARIO…
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 107
Operacion Bitcoins: Login To HELL
"What we do not see conditions our lives much more than it seems.”
A possible scenario... “This guy hacked the site twice, let´s say there are no records of that. Let’s use one of his IP addresses from a harmless connection to the site, and make him look like a terrorist, and then finally throw him in prison, close the high technology-related case, and take the photos for the press release.”
“What we do not see is also what most obsesses us.”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 108
20.
Operacion Bitcoins: Login To HELL
PRISON
September 11th, 2017
My first impression was bad. It was awfully bad. "This is going to be complicated..." I said to myself as I entered the cell where I would spend the first few days. On the other hand, I felt a little relief during the short period in which I was alone in my cell upon arrival, after having gone through so much stress in the previous hours. I remember how cold it was. The cell had a small barred window through which a lot of cold air and rain entered, which was constant in those days.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 109
Operacion Bitcoins: Login To HELL
Two hours after entering, they put another person in my cell, who had stabbed his partner to death a few days ago during an attack of jealousy. Imagine your first night in jail, sharing a cell with a murderer! It was not easy to fall asleep.
After the justice determined my preventive detention, I spent five days in a local jail—Carcel Central—where I was subjected to various evaluations, profiling, medical check-ups, etc.
My profile was reviewed by the Transfer Committee, a committee that decides which prison to send you to. I ended up being sent to INR UNIDAD 18 DURAZNO, a small prison near a city called Durazno, 200 kilometers from Montevideo. It is a minimum-security prison.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 110
Operacion Bitcoins: Login To HELL
FIGURE 41 - PRISON IN DURAZNO
FIGURE 42 - PRISON FROM GOOGLE EARTH
September 15th, 2017
After five days in jail, after all the interviews by psychologists, psychiatrists, and doctors, I was sent to Durazno. I arrived on September 15th, 2017 at
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 111
Operacion Bitcoins: Login To HELL
about 8 p.m. (we left Montevideo around 4 p.m., but the police had to take another inmate that was going to another prison).
My first impressions were those of a person who is 40 years old and is taken to the sea for the first time in his life. You knew that the sea was something that existed, you saw it many times in the movies. But when you find yourself in front of it, the reality hits you and it's overwhelming. It's like a "Mike Tyson" who has no mercy on you, nor does he follow the rules, biting you and pulling off a piece of your ear at any moment.
Prison, even minimal security, is a nightmare. The cell I was in at the beginning had 12 other inmates. When I arrived I was number 13. The person who received me in the cell was nicknamed “THE BULL,” and I could understand why. That was a nice way of entering prison. Initially he was always next to me, telling me what to do, what not to do, who to talk to, who to ask things. He also “invited me” to join his boxing classes. Now that was torture inside another torture. I was not in shape, and taking boxing classes was not something I would consider doing, but honestly, I was scared about rejecting an invitation from “THE BULL.”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 112
Operacion Bitcoins: Login To HELL
So not only was I suffering in prison, but I was also being tortured every morning for weeks during the boxing classes, until “THE BULL” was transferred to a higher security prison for bad behavior. He was transferred on October 13th, 2017. That day was also my birthday. As I write these lines I notice that the number 13 keeps repeating.
When I arrived in prison, there was no bed available for me, so initially I had to sleep on the floor. It was not pleasant, and I knew I had to adapt to that place and to those people. I did not belong there. That was their world, and they were not going to change to suit me. It was a world of violence, drugs, and a school of crime.
The prison was depressing. It wasn't dirty or anything, but it was extremely uncomfortable.
For me it's over, I survived, but if you are smart and skilled, use that to be productive, help your family and your community. Do not be tempted to go down the road of easy money and crime, be it cybercrime or traditional crime. Not worth it.
Of course, more than anything, I feel so frustrated because I was sentenced to prison as an innocent person. There was no need or any purpose for me to spend time behind bars.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 113
21.
Operacion Bitcoins: Login To HELL
BEHIND BARS
The first thing I did was make a mistake, as another inmate later explained to me. I used to count the hours (I literally did) for the two months that my attorney told me was the length of time he was going to wait before requesting my bail. The anxiety, the desire to be outside, was so great that I just wanted to end the nightmare of deprivation of liberty.
Then I followed the advice of Eduardo, an inmate who had been in the worst prisons in Uruguay and had served two sentences. Basically, he told me to live from day to day, and not to desperately count the hours or the days.
Anyway, he was used to being active all day, multitasking all the time, especially with anything that involved technology. But being there I felt empty. The days dragged on and on and I just wanted every day to end so I could sleep. It may sound stupid, but that is how I looked at things.
Nobody starved in prison. The food was fine and there was something for everyone. Food from family was also allowed, so most of us were given a package of food, clothing, and other items each week.
Cell phones without cameras were allowed. That really helped a lot as I could spend hours on the phone with my mother.
We also had satellite TV and an old PlayStation 2. After the first week where I had to sleep on the floor with inmates who were violent, I was transferred to
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 114
Operacion Bitcoins: Login To HELL
a cell equipped with all the things I just mentioned. It was like going from living on the street to moving to a five-star hotel.
Despite everything, the days were endless, and it was quite easy to get into low spirits. Luckily, there was camaraderie among the members of the cell, and they tried to encourage those who were down. It was not my case, but there were a lot of personal problems among the inmates for different reasons, and at times there was a lot of tension. I didn't experience any violence, but I witnessed a few situations. Drugs and violence are impossible to avoid in an environment like that.
After a week of being in prison, another inmate lent me a cell phone, and for the first time, I was able to speak with my girlfriend. She could not stop crying, and she told me that after all the pain that I caused her, she preferred that we didn't continue our relationship, after eight years together. It was something that hurt me a lot and I still cry when I remember it. On that Sunday when they took me to court, I was hoping to return home, and I was going to tell her for the first time in eight years that I loved her. Why didn't I do it before? You don't value what you have until you lose it.
The summer was cruel due to the heat. In the middle of the summer of 2018, to keep myself busy, the prison authorities asked me if I would be interested in giving basic computer classes, as it was the only task I could perform there. So, I accepted, and I gave computer classes to nearly 50 inmates. It was a nice experience. The implicit message that the prison authorities sent me was "we trust you." It meant a lot to me. Even more so, considering that at the time of my arrival at prison, the director gave the order to keep me away from any electronic device because of the reason I was there. Obviously, I was not going to
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 115
Operacion Bitcoins: Login To HELL
betray that trust. In prison, as in any environment, your act in a way to make you fit into the environment where you can adapt, and I had managed to place myself in a relatively privileged place.
The level of trust reached such a point that, in the last days of incarceration, they asked me for help in computer matters from the establishment's legal office! Even the day after I was released they called me on the phone for a technical consultation!
ACT TWO
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 116
22.
Operacion Bitcoins: Login To HELL
THE DECISION
The first days in prison were complicated, and endless, with fear and uncertainty. In order to cope, I tried to keep my mind blank, not to think about what I was living or why I was living it, but to repress those thoughts and basically become an entity that lived minute by minute. That blockage in my mind and concentration on acting to survive was part of what would later cause me PTSD (post-traumatic stress disorder).
I suppose that what happened to me must happen to everyone who is sent to prison. In the first days one concentrates on the day to day. Then a state of depression can come, but after a couple of weeks, the minds of those who enter the prison system ask a key question: am I going to let this ruin my life and destroy me, or am I going to take this situation and use it to strengthen myself and leave this place with more strength than ever, and with the ability to eat the world in two pieces when I am free?
"Fight until the last breath." There, at that point, at that moment, in that reflection was when I chose the second option. I was going to adapt to prison, I was going to integrate with the other inmates, and I would not let anything, or anyone, prevent me from achieving my goal.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 117
Operacion Bitcoins: Login To HELL
"The sun is weak when it rises first, and gains strength and courage as the day progresses"
I spent my 42nd birthday in prison, as well as Christmas and New Year’s Eve. Those were moments that unfortunately I cannot describe with words. And if I could, you would not believe what I was saying—that is another story.
After “THE BULL” was transferred, I established a friendship with Eduardo. He was in his early 30s and it was the second time he had been to prison. He basically always ended up in prison because of his addiction that made him commit crimes to get money for the drugs. But that didn't make him a bad person. We used to talk for hours and hours. I don't usually feel comfortable with long conversations, but I could listen to him all day.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 118
Operacion Bitcoins: Login To HELL
FIGURE 43 - TRUNK GIFT FROM EDUARDO
Above you can see a trunk that was a gift from Eduardo. He did the artwork and another friend, Fernando, made the trunk.
FIGURE 44 - GIFT FROM BARBE This was another gift I received from another old inmate who used to build houses when he was young. He was in prison for dealing drugs.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 119
Operacion Bitcoins: Login To HELL
There was a schedule to clear the cell every week, and there was somebody designated to clean the cell each day. The first time I had to do it, Eduardo looked at me using the broom and calmly asked me, “You never used a broom in your life, right?” He was right and that was really embarrassing.
I experienced so many strange situations. As I said, violence was part of being in prison, but there were crazy exceptions.
There was another inmate in my cell that had problems with all the other inmates, including myself (while I was taking a shower he walked in— naked). That would have normally ended with a fight. But all the inmates of the cell I was in called the guy over and told him that his behavior was bothering everybody. No, we did not beat him. We voted to decide whether he could stay, or if he had to move to another cell. Yes, we did vote to take a decision about a problem we were experiencing. There was absolutely no violence involved in that situation.
Most inmates have many virtues. They are very smart and can easily find excuses or lies to get what they want, or to get out of trouble with the police.
During my eight months behind bars, three inmates escaped from prison. Two were recaptured within hours, while the third was never found. An inmate that had the benefit of leaving prison three days a week was murdered while he was outside the prison. They think it was drug-related.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 120
Operacion Bitcoins: Login To HELL
A few weeks after I was released, a guy that I used to call “my little brother” died of natural causes. He was only 21 and had to serve about 15 years for murder—a murder he said he did not commit.
There are things I will never forget, things that were probably so associated to being in prison, that once outside, certain events can trigger memories of those moments, such as the metallic sound of the keys, or the lights at 4 a.m. when they counted the inmates.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 121
23.
Operacion Bitcoins: Login To HELL
ON THE RADIO
Patricia Madrid, an incredible, recognized and respected journalist, was the last person I saw on TV the Saturday I went to the police station and got arrested. The reason I saw her on TV was because it was the day the vice president of Uruguay resigned. It was Patricia's investigation that triggered the process that ended with his resignation. And then Patricia was the first person that was interested in my case, and she visited me as a journalist in the Durazno jail, where we spent a couple of hours or more talking about my case and all the inconsistencies and irregularities in the process. I already knew Patricia as I helped her in something I cannot talk about. Yes, you guessed, it is another story within a story.
Soon after, the program aired. The prison authorities were very satisfied with the interview, and asked me to give an interview to the announcer of the most popular program in Durazno. That is how at the end of 2017 they gave me a telephone interview from prison.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 122
Operacion Bitcoins: Login To HELL
A few months after being released, the same Durazno radio show interviewed me to learn what “the life of a hacker after prison” was like.
All of the interviews' audio files can be found here: https://soundcloud.com/alberto-daniel-hill
Later, I was invited to other radio shows, and a few more media outlets contacted me to discuss my case, but on the advice of my attorney, I did not accept the invitations.
That was until October 2019, when the producer of a television program contacted me to be a guest for a television program, to which I agreed. A journalist and a cameraman came to my apartment and I spent almost two hours talking about my case, the process, and the incompetence of the police in dealing with cases like mine.
The show never aired. I contacted the production company to ask them why my interview was never played, and they replied that they did everything possible to get someone from the Ministry of the Interior to respond to my statements from the interview, but no one wanted to talk about my case. That silence said a lot. My declarations could not be questioned as they were the truth—impossible to justify—about the case and about my story.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 123
24.
Operacion Bitcoins: Login To HELL
LOVE IN PRISON
I must mention that it is true that some women have something I cannot understand that makes them attracted to men in prison.
For respect, I will only mention that and clarify that I was not involved in that, but if I wanted to, it would have been easy. This is a censored version of the book so I will have to skip that topic.
I just could not understand why sex was so important for every inmate. Being in prison is not something that turns me on at all.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 124
25.
Operacion Bitcoins: Login To HELL
DRUGS AND ROCK AND ROLL
The title of this chapter was almost “Sex, Drugs, and Rock and Roll.” Too bad I already covered the sex part in the previous chapter.
There were plenty of drugs in prison. Other inmates and visitors got the drugs into prison in highly creative ways. It was mostly weed. Because of its low price, “freebase cocaine,” a cheap and highly addictive substance obtained from cocaine—and made with all kind of toxic elements—was also present, and it was heartbreaking to see the effects of that drug on people. Despite what is usually said, I did not ever hear that the police brought any kind of prohibited items into the prison.
If you had the money, getting a smart phone was easier and faster than buying one in a cellular shop (money is not allowed in prison). The only thing that was a little bit hard to get were the SIM cards. As almost 100% of the cells were prepaid, charging a cell phone with money was used as an easy way to get other things into the prison. Somebody outside prison had to just put money on a certain phone number—as simple as that. Then, for example, the person who charged the cell would get drugs in exchange for that.
This is the censored version of the book so I will not give details about those topics and my connection with them. I will also not give more details to respect the codes of the prison and not betray the guys who were my family for eight months.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 125
Operacion Bitcoins: Login To HELL
I will only mention that I was caught by the police with a Samsung Galaxy S5. But that is another long story. That almost caused me a heart attack, but ended up in a crazy story where the police did not even seize or keep it. I still have that phone with me. Remember:
"You never know what worse luck your bad luck has saved you from."
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 126
26.
Operacion Bitcoins: Login To HELL
THE HEAT OF THE SUMMER
It's summer in this hemisphere from December to March. A hot summer in prison is extra punishment while you serve time.
And it was a hot summer. The cells were like an oven, and everybody who could got a fan to try to cool themselves. My mother bought me one that should still be in the prison. When you get those kinds of gifts, you do not bring them with you when you are released. You leave them, as well as clothes and anything else another inmate could use.
January 2018
On January 6th, 2018, Martin, a friend of the family who lives in Paraguay and came to spend the end of the year with his family, passed through jail to visit and encourage me. He left me the fan my mom had bought for me to cope with the unbearable heat of the summer. My mother bought that fan for me with all the love in the world. Even though I only saw her once while in prison, she was strong and took energy from God only knows where to be my angel.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 127
27.
Operacion Bitcoins: Login To HELL
FEBRUARY 9TH, 2018
On February 9th, I was taken to Montevideo. I did not know why, but I had to be in court at 9 in the morning. Later I found out that it was due to an extension of the declaration that my lawyer had requested in October of the previous year.
What I'm about to say sounds like a joke. 15 minutes after I arrived and was waiting in a cell, one of the policemen who had driven me there came and told me that we must go back to jail because the file was not in the court. My lawyer, after the three rejected requests for release, appealed, and the file was in the hands of the appeals court (the wrong court, but that, as you might have guessed, is another story).
My mother was in court dying to see me, since she had not seen me for five months. Furthermore, that day was her birthday and she wanted to kiss me, which the judge did not allow. It was incredibly sad for both my mom and me. It became even more clear to me that once you are a prisoner, you lose the quality of being human to others. It was yet another of the sad instances that I experienced.
This event was a heartbreaking. It was another emotional punch in my face. It is clear what I said: after they put you in handcuffs, you are not a person anymore.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 128
28.
Operacion Bitcoins: Login To HELL
NEW FRIENDS
At the end of January 2018, thanks to the intervention of my mother's close friend Beatriz, a couple that lives in Durazno, Marisa and Miguel began to visit me weekly, bringing me food, clothes, and everything I needed, in addition to providing me with their company during the endless days of that summer.
My lawyer had requested prison furlough, and Miguel agreed to act as my chaperone if the benefit were provided.
Marisa and Miguel are people with huge hearts who became part of my family because of the affection, love, and concern that they always showed me.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 129
29.
Operacion Bitcoins: Login To HELL
AN UNEXPECTED VISIT
February 2018
Out of the blue, I had a visit that I did not expect, and the events that it unleashed were incredible. It was three in the afternoon on the last Sunday in February 2018. It was a really hot day; I was feeling really down because of the heat in the cell. A guard came to my cell, yelled my last name, and said, "Visit."
I was surprised since I was not expecting anyone. Also, before visiting me, they always let me know by phone. What was life preparing for me?
I went out to the visitor’s space (in the prison yard, where I can still close my eyes and smell the aroma of the grass), and an unknown person, tall, thin, apparently 50-something years old, asked me if I was Alberto Hill, to which I answered yes. The person introduced himself: "My name is Javier Orlando13." Those words began a story that would become a new nightmare within the nightmare I was living. There are many stories inside the main story narrated in this book, and this is one of them.
He told me that he was an entrepreneur, that my story intrigued him, and he wanted to know more about me. We talked about everything for a bit, and he was extremely interested when I told him that I didn't know when I would
13
Name has been changed.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 130
Operacion Bitcoins: Login To HELL
achieve freedom, but that as something in between, I could eventually get prison furlough for some hours weekly or monthly, or even for some days.
From that day on, he was communicating daily with me and my mother to see how my freedom could be achieved. He even gave us a letter stating that his company would hire me when I was released, something that my lawyer said was a particularly important factor in being released from prison.
It had been four days since he visited me in jail when the police came to my cell looking for me and told me to stop by the legal office. To my astonishment, there they informed me that the judge had authorized 72 hours a week of prison furlough time.
I assumed there was a mistake. That was just too good to be true, and good things were not happening to me. It was totally atypical. The temporary departure regimen is progressive. Initially they grant 12 hours per month, then it goes to 24 hours for one day a month, until after a long time to 72 hours. But obtaining the legal maximum in the first instance was something so atypical that from prison they called the court to verify that there had not been an error. But no, there was no mistake.
As much as my incarceration was justified by the high probability that I would escape and my high knowledge that could interfere with the process, they were allowing me to be three days a week out of jail, where perhaps could I not escape and interfere with the process? It was a very strange resolution, even more considering that my requests for freedom were all categorically denied by both the judge and prosecutor.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 131
Operacion Bitcoins: Login To HELL
Why that benevolence then? Something was off. What was going on? “Nothing is for free unless you are the product.” What did they want from me? I had so many questions and spent a lot of time wondering what was behind all this.
Javier heard the good news, and the next day he traveled to Durazno to pick me up on my first outing and brought me to Montevideo. Knowing that all my equipment was seized, he also gave me a notebook of his own and an iPhone to use during my temporary outings. I could not be so naive and think this person was just a good guy who cared about me. What did he really want from me?
I am not lucky, I was not lucky, something like that could not be true. There had to be another nightmare behind all this.
The second Saturday of March was my fist Saturday out of prison after six months of incarceration. I spent the morning with my mother and had lunch with her. In the afternoon I met Javier in my apartment.
Nothing is for free, and what was about to happen next was like something out of a movie, and it explains the unique situation of my 72 hours a week of prison furlough. It was a “movie” I was part of without having to audition...
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 132
30.
Operacion Bitcoins: Login To HELL
AN OFFER I COULD NOT REFUSE
In my apartment's living room, Javier told me that his financial situation was critical and that he was about to lose everything. He made me promise that I would never tell anyone what he was about to tell me. I just said “OK,” and then... (it was a promise that I am breaking now, as James Blunt says, “Don't buy the promises, because there are no promises I keep and my
reflection troubles me.14”) OK, I am not just breaking the promise now—it was a promise I could only keep for about a week.
He told me that he wanted me to hack into Banco República, the most important bank in Uruguay. He had the whole strategy in mind. He wanted me to find the accounts with the highest balances and those belonging to people with serious health problems and terminal illnesses, who had many relatives. Once these accounts were detected, I had to withdraw a significant amount of money, but leave a reasonable balance in them to make it difficult for them to immediately realize what had happened.
Initially he needed about $ 200,000 to cover debts with lenders. He was extremely nervous because he could not meet the repayment and those people were capable of anything to get the money back. He told me he was worried about himself and his family.
14
James Blunt, "Same Mistake"
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 133
Operacion Bitcoins: Login To HELL
I checked his credit score in Uruguay's central bank and in all the other banks he worked with. His score was the worst it could be in most of them; basically the banks considered his debt would never be paid.
As the second stage of his master plan to hack the bank, he wanted us to "get" two million dollars to ensure a quiet and relaxed life.
It was crazy, something that under no circumstances would I get involved in. I am not a criminal.
Seeing that I did not want to carry out his plan, he told me that he managed to get me the prison furlough. According to him, he was a friend of the judge's husband and he had asked her to authorize the benefit I had been granted.
I wanted to believe that he was lying to me, but it would explain how strange the authorization for furlough was. Within four days of meeting him, I was granted what my lawyer had requested more than three months ago. They gave me the maximum time to be out of jail. If what he told me was true, I was at the mercy of a power that could set me free immediately or could keep me in prison indefinitely. If I did what Javier asked me to do, I lose, and if I did not, I was also going to lose. In any scenario I was going to lose. If I had to choose, hacking the bank and stealing money was not something I was going to do.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 134
Operacion Bitcoins: Login To HELL
All that pressure and the dilemma of having to decide something, knowing that I would have to cope with the consequences of my choice, put me in a state of nervousness, anxiety, anguish, and fear that caused me to abuse my antianxiety medication. The number of benzodiazepines I took to calm myself was enormous. My head kept thinking and suffering. I was so taken aback that on Monday morning I went to take out the garbage from my apartment, and not only threw the garbage in the dumpster, but I also threw out Javier's iPhone. I spent an hour trying to get it back, almost getting into the dumpster. My body was so full of bruises, it looked like I had been beaten.
On Monday afternoon, Javier picked me up to take me back to jail. We drove in his truck at high speed along Route 5 that connects Montevideo with Durazno. He was not going to arrive in time to comply with the provisions of the temporary leave. In the middle of the journey, Javier told me that I looked very tired and to rest a bit. My eyes closed, while in the distance I could see a beautiful sunset. The next thing that happened is something that they told me, since I have no memory after closing my eyes.
What they told me was that Javier arrived at Marisa and Miguel's house and very calmly told them that I was not waking up. Marisa went into a panic, and Miguel got incredibly angry with Javier. My body did not respond. I gave no sign of life.
Desperate, Marisa called an ambulance which took me to the hospital. On the way, they cut the clothes I was wearing to get tubes in, put me on lines, connect the devices to measure my pulse, pressure, etc. But that day apparently...
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 135
31.
Operacion Bitcoins: Login To HELL
THAT WAS NOT A DAY TO DIE
I heard distant noises that gradually got closer and louder. Those noises were transformed into various people's words. I opened my eyes and was blinded by a white light. I felt lost. I had no idea what was going on. The last thing I remembered was closing my eyes in Javier's car.
Someone yelled, "He's back!" and it was then that I realized that I was in a hospital. A woman came up to me and asked if I know where I was. I tried to say no, but I had a tube that could not let me speak, so I barely shook my head "no."
She told me that I was in the Durazno hospital in the intensive care unit and that I had been in coma for two hours. I mentally tried to process those words and concluded that I was basically dead for two hours and had been revived. I thought maybe we had been in a car accident.
In the distance I heard very loud voices. Two doctors were arguing, almost shouting. One expressed that my state was very delicate, that I could go back into a coma at any moment. He did not want my death to be in his hospital; he wanted me to be transferred to another place immediately.
It was strange to hear how two people having a heated discussion about my eventual passing, and that it did not cause me any feelings of fear or panic. Whatever it was, I had hit rock bottom so many times in the last two years that I thought if it was my time, it was fine.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 136
Operacion Bitcoins: Login To HELL
They say that when we are at death's door, we are finally able to see our life clearly. In my case, my life just lacked clarity, and the events that were happening were like punches in a boxing match when you are being beaten up and you cannot help but resisting until you get the inevitable knockout blow.
It was the first Monday in March 2018 and I was just living one more in a long list of unusual, difficult to believe, extreme, incredible situations and events, where nothing surprised me anymore.
Under the influence of the medication, I remembered old times, when I was in high school, where it was common for someone to make a phone call at the time of an exam, saying that there was a bomb in the study center. With that, an evacuation, fire, and police inspection were achieved, and thus, the exam was canceled. The "bombs" never existed. Was the person who made the call liable for charges of "attempted assault"? It was a meaningless thought, in the air.
Then images of my life came to mind in reverse chronological order. I got chills as I clearly saw the beginning of my free fall in September of the previous year.
Suddenly I heard an unmistakable voice. My mom! "Poor Mom, I cause her trouble even when I'm about to die," I thought. At that moment I realized that there were police officers in the intensive care unit. My mother greeted them, and they let her give me a kiss.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 137
Operacion Bitcoins: Login To HELL
At that moment I knew that heaven or hell should wait—that would not be the day that I would stop suffering. I could not help thinking, “I am in the intensive care unit of a hospital with guards who watch me because not only am I almost dead, but I am also a prisoner. I should consider writing a book about this!” Then I thought, “What a silly idea. Forget it, I will never write a book.”
I wonder if we make choices or choices make us.
At a certain point, the deputy director of the jail approached, and together with a doctor, they commented that my chest was full of bruises, as if I had suffered a beating. When I heard that, I said that no one had hit me, and while saying those words, I remembered what caused it. I did not know how to tell them what really happened without it looking like I was making up a story.
Let us say that eight hours ago, under a lot of stress and in oversight, I threw an iPhone into a dumpster.
That was not my first visit to the hospital during my time in prison. Just two weeks after arriving, I was transferred with a bloody forehead, and the wound was sutured with four stitches, leaving me with a scar that I carry as a souvenir. The injury was not the result of a prison fight. It was my first night sleeping in a bed after almost two weeks of sleeping on the floor on a piece of foam. It was also my first time sleeping on a top bunk. At six in the morning I took a turn and fell, hitting my head on the floor. I felt miserable at
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 138
Operacion Bitcoins: Login To HELL
that moment. Blood was everywhere, all over my body and the sheet that fell with me. I can still smell the blood covering my face. For a moment I was quite sure I had lost vision in my left eye, but it was just covered with blood.
A few seconds after I fell, Eduardo came over, took my bloody sheet, pressed it hard on my wound and told me, "Take it easy, bro. You're going to be fine."
It was not the only time I fell off my bunk during my time in prison. A couple of months after my first blow, I rolled over in my sleep again, falling about six feet. With the second fall there was no blood because of the way I fell, but it caused me very severe pain in my hip that lasted for a couple of weeks. This second time I no longer felt unhappy. I felt as if what happened, being hit hard frequently, was something normal and part of my life.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 139
32.
Operacion Bitcoins: Login To HELL
DEAD, HANDCUFFED, IMPRISONED, AND AT BURGER KING
In the end, as I expected, I did not die at that moment in the hospital. I spent the night in intensive care, always guarded. The next day they made arrangements with my medical provider to move me to Montevideo so that I could receive better treatment and undergo additional tests. It had its delays for being something relatively inexpensive. They just got an ambulance to travel 200 kilometers between Montevideo and Durazno to find me, and then travel another 200 kilometers back to Durazno.
I suppose that the experience of consciously traveling 200 kilometers on a stretcher inside an ambulance is something that very few have experienced. It is not pleasant at all. I felt like I was being tortured or paying for all the sins I'd committed in my life.
For the prison, the situation involved a headache from a logistical point of view, since my custody had to be relieved every certain number of hours, and to find someone to travel from Durazno to Montevideo for that was not easy.
The one who guarded me was Liliana. Later she confessed to me that the prison management's perception of me in terms of danger was so low that she said, "For me to be assigned to guard a man, you have to be a saint."
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 140
Operacion Bitcoins: Login To HELL
Inmates who have been in the world of crime for a while are not stupid at all. Most of them are very sharp. They can smell a person and understand their personality. One of the inmates, at one point, in the middle of a conversation in the courtyard, told me, "Your degree of violence must be 0.001%."
I think it was approximately 6 p.m. on Tuesday when we arrived at the hospital in Montevideo. My stay there was shorter than the time it took for the ambulance to transfer me. They did some tests and a psychiatrist interviewed me. I think that what they usually try to see is if a case like mine is a suicide attempt or not, since the suicide rate of people deprived of liberty is ten times higher than that of the general population.
At a certain point, police support arrived from Montevideo, and then more from Durazno. Right away my mother arrived, who despite her mobility issues, traveled by bus from Montevideo to Durazno and then from Durazno to Montevideo. In short, in the emergency room, where they normally only allow the presence of one companion at most, I had four people. It was amusing to imagine what the rest of the people in the room would think of me, having three police officers guarding me. That person with a violence rate of 0.001% surely made people think that he was an extremely dangerous criminal.
I thought that if my life had followed a normal course, I would be quietly at home. But no, I was in a hospital emergency room with three policemen guarding me.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 141
Operacion Bitcoins: Login To HELL
The tests gave normal results and my condition was good, so I would have to return to jail quickly, that is, I would be traveling another 200 kilometers in the same day. In addition, the protocol indicated that the trip should be done in handcuffs.
At around 11 p.m., I arrived at the jail and my cell. The exhaustion that I felt was enormous. Everything is known in prison and everyone was aware of the extreme situation that I had experienced, and they had been genuinely concerned about me. They were glad to see me back and alive. And that is a fact—there are no secrets in prison and the walls can hear. I can assure you that.
Anyway, those were two normal days of my life. When I was being transferred back to the Durazno jail, the truck stopped in the middle of the road and the agents bought hamburgers at a Burger King restaurant near the route. It was a nice and tasty way to end the ride! My mother had given the officers the money for the hamburgers, since prisoners cannot have cash with them.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 142
33.
Operacion Bitcoins: Login To HELL
THERE WAS MORE YET TO COME
I slept peacefully, but on Wednesday morning they woke me up long before the time the cells were opened to get medication and then have breakfast. I thought I wasn't going to have any more shocks, but obviously I hadn't learned anything about life yet and I was still an innocent little kid. That's what I thought when I saw half a dozen policemen with masks pass through the window. The masks they were wearing were not from Anonymous.
Yes, less than 48 hours after being almost dead, I was in the middle of a search carried out by a special group that was sent from Montevideo. IT WAS ANOTHER COMMON, TYPICAL DAY IN MY UNLUCKY LIFE!
When the search came to my area, we all had to go out into the corridor and kneel against the wall with our hands behind our heads. In addition to basically destroying the entire cell, they examined us one by one, making us undress, and even made us open our mouths to verify that we hadn't hidden anything in there.
When my turn came, the deputy director of the establishment, Rodolfo Ortega, passed over the people of the Montevideo team, who had a higher rank than his, and gave me a chair to sit down, explaining that I had just come out of a very serious health problem. That was an example of the human quality of the prison's management.
Although the fact of going to prison is a difficult experience to imagine and one that very few people live, and though it's something that could never be
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 143
Operacion Bitcoins: Login To HELL
fully described with words, being a prisoner and also living the experience of a search like the one I told you is like living in a movie. In total, there were three searches during the time I was in prison. Even in one of them, my colleagues left me as an observer of the procedure to carefully scrutinize what was done during it, so that there are guarantees that they act appropriately. It's amazing what the police can find during those procedures.
Well, nothing more could happen, right? We know that isn't right, there were plenty of more surprises waiting for me. This story makes me feel miserable, but at the same time I was not living a boring life.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 144
34.
Operacion Bitcoins: Login To HELL
THERE IS STILL MORE!
After my near-death experience thanks to Javier's pressure on me, he kept calling me. Every week I went on furlough, he was waiting for me either at my house, or outside the prison. It was scary. I then knew how it felt to be stalked.
I told my lawyer about the situation and he told me that it was probably a cop that told Javier about me and wanted to use me for a crime. That's quite common.
If Javier didn't stop acting like that, I was going to report him to the police. The prison authorities found out about the situation because Marisa was a close friend of theirs. They called me and told me that they knew something was going on, and they expected me to tell them about it.
I was completely honest, as usual, and the authorities told me they were going to report the situation to the general prosecutor. It was the first time that telling the truth hadn't caused me any problems; instead it brought me a solution.
Incredibly, after that, Javier vanished—well, just for a couple of months as he then started following me on Twitter after I was released from prison!
Off-topic, but I must say that I have something that makes people become obsessed with me. Javier is just one case, but there are many more, though what I'm telling you is for another book, as that is another story...
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 145
Operacion Bitcoins: Login To HELL
It was incredible that the bank Javier wanted me to hack was hacked a few months after my release from prison. The prison authorities did the right thing reporting my situation to the general prosecutor.
Imagine a scenario where the director and other prison authorities knew about the request to hack the bank, and then the bank ended up being hacked! With my endless period of hard luck I was living in, it would not have surprised me if the police were again knocking at my door.
This is a perfect example of when bad luck can save you from worse luck!
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 146
35.
Operacion Bitcoins: Login To HELL
RETURNING TO MY HOUSE—SURPRISE!
May 2018 It was May 22nd, 2018. It was a nice day, but it was going to become wonderful. My lawyer called me and told me he was in court to learn the outcome of the appeal. It was in my favor! The only tiny detail is that they set a $10,000 dollar bail, but I was released. Is that justice? If you can pay to go your house, but if not, you stay in prison? Imagine the frustration of a situation like this where the person could not get the $10,000. For me, that is not justice. If I couldn't get that money I would probably still be in prison. If you are poor you have one kind of “justice.” And if you are not, another “justice” applies to you.
Mom could get the money, and in the afternoon of May 23 rd, 2018, I left the prison in a police car without being handcuffed. I could not believe it; the nightmare was over. I was released from prison after eight endless months. I felt like I was in heaven.
When I returned home, I thought nothing could surprise me more, but of course, I was wrong. When I opened the door to my apartment, I saw boxes on the floor. What was in them?
Over 30 hard drives, ranging from 20GB to 3TB in size. They were not all in one place; they were scattered around my apartment. As if the police forgot about them (or just didn't care about them).
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 147
Operacion Bitcoins: Login To HELL
The other things they left behind included some foreign coins, around 20 blank magnetic and RFID cards, blank cards with chips, as well as three readers for those cards.
Not to mention an iPhone 6S, an ASIC cryptocurrency miner, a drone, some graphics cards, computer components, over 1,000 DVDs and CDs, an Android TV box... The list goes on.
This was an inappropriate, horrendous execution of a search warrant. It was something that shouldn't have been accepted by justice. The way I understand it is that the police cannot be selective in gathering evidence. Not only anything that is proof of a crime but also anything that can absolve someone or play in their favor should be taken as evidence.
This approach is based on internationally accepted standards and best practices in computer forensics. What was the reason for messing up my apartment to try and find as many items as possible, only to leave a large quantity of them behind?
I could understand it if they forgot to carry a couple of swipe cards or loose bills around, but most of the things that were left prevented me from leaving my house without kicking or tripping over a hard drive lying on the floor.
I had two document shredders in my house. They took one and left the other. What type of electronic medium is a document shredder? What role could it play in the case? What criteria was used to carry one and leave another? They took a new, unused "guillotine.” What were they planning to
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 148
Operacion Bitcoins: Login To HELL
get out of the guillotine? The reason I use the word “guillotine” is part of another story, but I am referring to trimmers. They seized the “electronic media” Fellowes Electron rotary trimmer. They also took a $ 2 flashlight that runs on two AAA batteries.
I'm not afraid to repeat what I have already said: in the procedure various items were stolen from my home. Perfumes, a watch, a digital camera, and a carry-on suitcase are some of the things that disappeared from my home on the day of the raid. Lots of people told me that these events are unfortunately extremely common in Uruguay. As an anecdote, the $ 2 flashlight was not returned to me, but it appears in the photos published by the Interior Ministry's communications unit in the press release about the operation. It amuses me to imagine what the Interpol officials thought when they saw the simple flashlight. I suppose it was a cutting-edge hacking weapon for them.
They also left three notebooks at my house, as well as three cell phones. It was not a raid; it was a media spectacle! The problem is that nobody told them this isn't Hollywood—the same way nobody taught them how to perform a proper investigation of a computer-related crime. I don't know which nightmare is worse, being sent to prison or being investigated by these guys. I guess the latter leads to the former.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 149
Operacion Bitcoins: Login To HELL
FIGURE 45 - SOME OF THE HDDS INTERPOL LEFT IN MY HOUSE
FIGURE 46 - MORE HDDS AND CD AND DVDS LEFT IN MY HOUSE
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 150
Operacion Bitcoins: Login To HELL
There were also devices, media, and other elements that they should have seized, but not knowing what they were (or not caring), they left them in my apartment.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 151
36.
Operacion Bitcoins: Login To HELL
"SO, BUCKLE UP DOROTHY, KANSAS IS GOING BYE-BYE"
Bye-bye Kansas. The next chapter details the tornado that was captured here—a tornado of lies, mistakes, and wrong procedures (or lack thereof) that are part of this case.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 152
37.
Operacion Bitcoins: Login To HELL
EVERYTHING WENT WRONG
"You never know what worse luck your bad luck has saved you from."
If you prepared a list of everything that went wrong with this investigation from the point of view of preserving digital evidence in a suspected cybercrime, what would be on it?
It would be a long list! Furthermore, everything that could go wrong not only went wrong, but it also went from wrong to worse.
To begin with, in Uruguay, the identity of any processed person without a prior record must be protected. I didn't have a record, but my identity wasn't protected, and just by looking at the Ministry of the Interior's photos, you can see my name and photo on the identification cards of places where I worked. You could see my name, in addition to the numbers, on the credit cards. That was deliberate to ruthlessly destroy me.
During the raid, an Interpol official took my Samsung Galaxy S7 cell phone that was off and charging, and turned it on. Good practices in computer forensics are forceful in these cases. If the cell phone is off, it is seized off. Turning it on contaminates the evidence. Checking Google logs on cell phone activity, I was able to verify that my WhatsApp and Telegram conversations were reviewed, as they were able to gain access after my expartner gave them the password to unlock it. These "inspections" on already
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 153
Operacion Bitcoins: Login To HELL
contaminated equipment were not recorded in any part of the file, again, contrary to the reference standards and good practices in computer forensics accepted worldwide. By doing that, they further contaminated the evidence. In a real country, that would make it not legally admissible. But in Uruguay, things work differently.
1) The email that was apparently used to send the message was not a disposable one, it was from a provider that supplies email addresses to their customers. The first thing that should have be done was request information from the company about the address used with a court order. That was never done and was not mentioned anywhere in the file. That's weird.
2) No evidence of any connection from my home IP address to the victim’s website other than on one count, on January 31st, 2017. So, years after the insinuated crime. The medical provider's firewall apparently rejected that connection, so nothing happened on that occasion. As an analogy, it would be as if Shodan was used to scan their IP address. No intrusion!
In the investigation file there is no evidence or statement from anybody from my ISP.
3) The medical provider tasked an employee with gathering server logs and sending them to CERT.
It should have been the other way around, it should have been somebody from CERT or the police who went to the medical provider's facilities in order to obtain a witness statement and secure any potential digital evidence.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 154
Operacion Bitcoins: Login To HELL
4) Server logs were exchanged in plain text via emails between the medical provider and CERT. These email exchanges were deemed sufficient from an evidential point of view. They should not have been.
5) Police officers were not adequately prepared to execute a search warrant in my house. In fact, the paper with the search warrant did not have correct key information and they did not do what was established there.
They were untrained, ill-equipped, and incompetent. They didn't build an intelligence profile, and did not know what to expect once they gained entry. They could not and did not secure digital evidence properly and left a lot of potential evidence behind.
6) The police communicated the arrest of a cybercriminal to the state prosecutor and to the press.
One thing that was wrong was the trial by media before any proceedings started, but more importantly, I was portrayed to the prosecutor as somebody who not only committed extortion but was also into carding or hacking bank accounts.
That chain of communication between the police and the state prosecutor was full of noise and bias.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 155
Operacion Bitcoins: Login To HELL
In September 2019, a judge ordered that all the items seized during the search had to be returned to me. None of them were identified as tools or products of any crime.
So basically, all the things displayed in a nice array as evidence on that table photograph, ready for the media to take pictures of, had to be returned.
You know, ironically, this fact did not appear in any media, for whom I will always be the cybercriminal.
I guess judicial mistakes do not make for great newspaper stories.
I am extremely upset with what happened in my case, and obviously with other cases. The police arrests somebody suspected of having committed a crime, within a few hours the person is in court, and they send the person to prison. The don't take care of the person's health by not giving them their medication, and not even a glass of water. You are not considered a person anymore, and they just file the reports and send you to prison.
Imagine my situation. That happened to me, and I had no idea what was included in the case file until November 2019, when I could get a copy of it. It looked like the product of kids playing cops.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 156
Operacion Bitcoins: Login To HELL
The person MUST have access and read the file before taking any action, and enough time to study it with the support of their lawyer.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 157
38.
Operacion Bitcoins: Login To HELL
DRUG DEALERS HAVE MORE GUARANTEES
Drug dealers have more guarantees than me.
An organization facing a computer security incident must act according to an action plan created before any incident occurs.
In short, in the face of an event that may be a security incident, the way to proceed has already been decided and approved much earlier by the company’s management in a risk-based approach. They are factors that are not defined when faced with a possible attack.
There are two paths to follow when a security incident is detected. It must be decided whether the continuity of operations is more important than stopping them, and depending on the decision, the paths to follow are different.
If the importance of the continuity of operations is the one that prevails, the treatment of the incident sacrifices the possibility of taking a legal path before the incident, since the operational continuity alters all the evidence that may exist to take criminal action.
On the other hand, if what is sought is to take legal action in the face of the situation, sacrificing operations, all evidence of what is happening must be preserved by following reference standards in the matter.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 158
Operacion Bitcoins: Login To HELL
One of my companions in prison, imprisoned for a drug-related cause, explained to me that the seized drug, like all evidence, is preserved. This person was accused of a crime associated with the drug “base paste,” but the person appealed the accusation and requested a study from the forensic technical institute to confirm that what was seized was base paste. In Uruguay, there are no reagents that can differentiate cocaine alkaloid base paste, so from the drug seized, preserved and analyzed, its cause happened to be due to a cocaine issue which is much milder than “freebase cocaine.”
In my case, the evidence to preserve were the servers and all the infrastructure related to the case, which should have been seized and preserved, as well as all my equipment and work tools that were seized for two years.
Unlike my case, I have no possibility of an analysis of what was done in the case by an independent third party, something basic for a process with due guarantees to be fair.
In my case, incredibly, I have fewer guarantees and transparency than a drug trafficker has.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 159
Operacion Bitcoins: Login To HELL
How can it be explained that the evidence had not been preserved? Why did they allow that to happen? It doesn't make sense and it's scary that due to the lack of guarantees that they give for “a review” of what was done, to verify that what was done is what is shown in the printed papers, of which no analysis can be made to verify it.
At this point I reiterate: my destiny was already defined long before I was taken to court.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 160
39.
Operacion Bitcoins: Login To HELL
TO LAUGH OR TO CRY
The following should be included in the Guinness Book of World Records for slowest and most foolish way to access an email account.
On the day of her arrest, my ex-partner voluntarily provided Interpol's agents access to her email account. The sheet that records this is the following:
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 161
Operacion Bitcoins: Login To HELL
1. My ex-partner uses the domain GMAIL.COM. I do not know if I should laugh or cry. But I do know that this is a clear example of the lack of basic knowledge of computers and issues related to the Internet. 2. Her address after her name is shown as @gamail.com. This would simply merit the inadmissibility of such a ridiculous document.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 162
Operacion Bitcoins: Login To HELL
3. Analysis Objective: Ridiculous, unintelligible.
4. Analysis Log: Each simple action took them more than 30 minutes.
5. I have the right for the justice to request information from Google about all my communications via email addressed to the domain @gamail.com. There will be no registry and that would invalidate the disastrous work of the Uruguayan agents.
6. Where do you connect to the email server? What device was used for that connection? Where did the Internet go? Who was the person responsible for the procedure?
7. Look at the time of each action in the record. They entered the email account at 16:30 and at 17:10 (40 minutes after the login), they searched for information. How could you explain how it took them 40 minutes to do that? The record says that they “searched for information about the medical provider." Anywhere else in the world, they would have recorded how they did that. As mentioned before, what type of queries did they use to look for information? That document is garbage. They got the results of the search at 17:50. Once again, 40 minutes between both simple actions!
8. All the pages, records, etc., written by the Interpol agents of were just like that page: full of flaws, obvious incompetence when it comes to writing a
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 163
Operacion Bitcoins: Login To HELL
document or expressing any concept or describing any situation. I am sure most of them did not complete secondary school (seriously).
9. It is not worth destroying the draft document on access to my expartner's email any further. Although they should do it for having destroyed her, the nicest person I ever knew. Among other things, they told her that I had confessed that she was the intellectual author of the alleged crime. They called her work, she was threatened, they told her that she would lose her job if she did not acknowledge her participation. I guess that's the only way they can close cases—psychological violence and lies everywhere. It doesn't matter who they have in front of them, they only know how to be thugs and inhuman.
I could not talk to her while in detention. A couple of weeks after being in prison, I was finally able to talk to her. She thought that what they had told her was true, and crying, she told me that what they expressed made her world fall apart since they never denied the false information they gave her. She thought that she had been with someone for eight years who had committed crimes, and instead of protecting her, testified against her. Those Interpol beasts are just that, beasts. They are far from human. THE DAY OF THE ARREST, THEY DESTROYED TWO LIVES.
There are many irregularities and wrong—as well as unacceptable—actions in the case. All digital evidence to have legal value must be signed by means of an advanced electronic signature according to law 18600 in Uruguay. Not a single document was digitally signed.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 164
Operacion Bitcoins: Login To HELL
How can someone properly and fairly defend himself against so many errors in handling the case?
The answer is simple: one cannot have a proper defense in such a case.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 165
40.
Operacion Bitcoins: Login To HELL
ECONOMIC LOSSES (PART ONE)
“Our lives are defined by opportunities, even the ones we lose.”
I had bitcoins in an exchange with a website called WEX.nz.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 166
Operacion Bitcoins: Login To HELL
One of the things that kept me strong, with hope and tranquility, was that when I left prison, I would have the fruit of my savings and investments in cryptocurrencies to resume my life in a calm and smooth way.
But "trouble" was surely the second name of "Operation Bitcoins." On the exchange WEX.nz, I had the equivalent of more than 100,000 USD with the value of cryptocurrencies at the end of 2017. I am not going to explain the history of BTC-e.com and WEX.nz, but it was vital for me to remove all my assets from that exchange because everything indicated that its life was limited.
But damn the security. I could not move a damn cryptocurrency without my cell phone with Google Authenticator, a Lenovo seized by the police. My desperation came to the point of offering the justice all my passwords, PINs, credentials, etc., so that they could see the contents and be returned to me as soon as possible, in particular said cell phone. My offer, the dream of any computer forensics team in the world, was denied by the prosecutor. At the end of 2018, WEX.nz disappeared from the planet and there went my savings, my mother’s, and my ex-girlfriend's.
That event threw my morale to the ground and I began to enter a depressed state when I saw how the outlook of my life had radically changed. My health collapsed.
I had another alternative. Prior to my arrest, I had withdrawn all my cryptocurrencies from the approximately ten exchanges in which I operated, except in BTC-e.com, since they weren't providing services after legal
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 167
Operacion Bitcoins: Login To HELL
problems, and would start operating again on September 15 th, 2017 (the day I was transferred to jail).
Everything that was not in BTC-e was in my Ledger Nano S e-wallet, which was seized in the proceedings. All the e-wallet boxes can be seen in the Ministry of the Interior's press release photos.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 168
41.
Operacion Bitcoins: Login To HELL
ECONOMIC LOSSES (PART TWO)
September 2019
In September 2019, the judge gave the order for the return of everything seized as they weren't related to any crimes. I wanted the wallet and the rest was secondary.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 169
Operacion Bitcoins: Login To HELL
FIGURE 47 - JUDGE’S ORDER TO RETURN EVERYTHING SEIZED TO ME
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 170
Operacion Bitcoins: Login To HELL
When they gave me the box with my Ledger Nano S, I opened it and to my amazement, it was empty! I said, “What the hell!” They told me, "We only seized the box."
In the case file, there are about 50 pages of technical information about those wallets. They downloaded them from the Ledger website and included it all in the file. Do you understand that 5% of the files contain all kinds of information about that model of wallet, a model that was the only one among those I possessed? Why would they print 50 pages about a device that they did not seize?
They never realized during the process and recording that the box was empty? No, because obviously it wasn't.
In 2018, I had offered all the PINs, passwords, etc., to access all my devices, including that wallet.
The wallet contained all my savings, and the savings of my ex-girlfriend. The cryptocurrencies were bought using insurance my father left for my mother and I when he died, where we received 30,000 USD. I lost all the money my father left for my mom and I. That is frightening.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 171
Operacion Bitcoins: Login To HELL
The contents of that wallet were: ●
27 bitcoins,
●
30 bitcoins cash,
●
1,000 Litecoins,
●
100 Ethereums,
●
5,000 Ripple.
Do the math to know how much I lost.
They also seized the recovery cards. My best guess is that they were not aware that after three wrong PINs trying to access those wallets, the contents are deleted. The simple explanation was that they tried to access it and ended up destroying the contents of the wallets, and then they made them disappear, with no one responsible, as no chain of custody was implemented. Why did they seize the cards—they were obviously not “electronic media?”
That was my knockout. From there I crashed and went into a severe depression. I lost all my assets, and third-party assets, which were also my work instruments. Now I neither work nor am I able to work because everything I had to experience had a serious impact on my health. After all the sacrifices that I made and that allowed me to reach a point where I could lead a life with complete peace of mind and finally be able to settle down, to no avail, and in an instant, I was stripped of everything. I am in a scenario where common sense indicates that there is no possibility of recovery. It is sad and depressing. I am having an awfully bad time, like never before in my life, and I do not see a way out for improvement.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 172
Operacion Bitcoins: Login To HELL
The “funniest,” not to say “terrible” thing of what I express is that, in the file of 1,000 sheets, 5% of it contains the printing of all the Ledger technical information on the Ledger Nano S. Yes, 5% of the file is dedicated to all of the device's manuals from which they only seized the empty box. No comment. The theft of that wallet, along with the $100,000 lost due to not having access to the cell phone with Google Authenticator (a cell phone that was two years old and returned to me without expertise), were the hardest blows of this whole process, and my physical and mental health came crashing down. My life was destroyed. All my present and future had been stripped from me.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 173
42.
Operacion Bitcoins: Login To HELL
ANATOMY OF A RANSOMWARE HACK
The anatomy of a ransomware attack is relatively clear. The attack vector (the way used to enter the computer or system to infect it) is basically phishing. The victims usually get an email with a file attached to it, normally with a name that generates curiosity in the receiver, and when they open it, they get infected.
After that, the malicious software spreads over the network that computer is part of and infects as many computers in the system as it can.
Finally, the malicious software is installed everywhere, it encrypts all the information stored on each computer and shows a message requesting a certain amount of cryptocurrency to recover the encrypted files. If they do not pay within a certain period, they will lose all the files in the infected computer.
In the case of the medical provider, there wasn't an address to send payment to, which is ridiculous. The guys that worked in the system after the attack didn't find any malicious software.
Let me put it this way: when you kidnap somebody to make money, you first kidnap the person and then you ask for the money. You do not ask for the money first and then kidnap the person.
So, what was said in the supposed email is completely ridiculous as well as inconsistent with everything else. It was a crime that was impossible to
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 174
Operacion Bitcoins: Login To HELL
commit under the given conditions. This is just one more of the dozens of lies, inconsistencies, and mistakes that took place during this supposed crime.
I have the knowledge, tools, and everything needed to perform a successful ransomware attack. I would have never done what is described in this case.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 175
43.
Operacion Bitcoins: Login To HELL
MY REAL “ATTACK”
In December 2016, my ex-girlfriend asked me to look for some information, a certificate that she needed to be able to donate blood. She was without Internet access, so she asked me to do it.
So, I entered the website with her credentials and looked for the information. The range for searches was only six months. I had to look with a range of years, so I modified from the client the range for the search. I then understood why the six months restriction was set up. I crashed the system with my query. Yes, the system crashed, and after a couple of hours it was online again.
I wonder, why didn’t that action trigger anything to detect the “attack” on the availability of the information stored in the system? What I had done was much more intrusive than the port scanning that they used to trace my IP address.
Everything is hard to understand and there is nothing coherent or consistent in this story. So, I accidentally put their service offline for hours using my real IP as I was not committing any crime, and nobody cared?
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 176
Operacion Bitcoins: Login To HELL
By the way, I could not find the document I was looking for. And do you think the reported security issues were solved in December 2016? I am not going to answer that, as you already know the answer to that question. And I could not care less about that.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 177
44.
Operacion Bitcoins: Login To HELL
QUESTIONS WITHOUT ANSWERS
Investigating a crime is like putting together a puzzle. At some point you may have enough pieces to figure it out, but in an investigation you hardly ever have all the pieces. There are many parts or questions to which there are no answers. Well, there are always answers, but for some reason you do not have access to them.
Why did the police tell everywhere lies about how they found me and the other person who was also arrested and searched?
In ALL the sites it is said the IP of the alleged extortion mail was traced to the address from which it was sent.
● Tracking an IP under the conditions reported takes five minutes. It is all a matter of picking up a phone and getting the information. It does not take eight months. By the way, I know how they work, and they did actually make that phone call and got the information in five minutes without the judge's order.
● The origin of an email can never be traced to two different addresses. An IP is assigned to a single client at a certain time.
● No IP address of any mail appears in the file. There is no IP to track the alleged extortionate email.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 178
Operacion Bitcoins: Login To HELL
● Why did the search of my home leave more than 30 hard drives, 1,000 CDs and DVDs, magnetic cards, money, computers, cell phones, and other equipment?
● The cards, or some money, can be understood not being seized due to the disorder of the scene. But with more than 30 hard drives lying on the floor, it is impossible that they had been forgotten. The only thing that goes through my mind is that the raid was just a scene from the show that they were putting me through.
● Why at no time, either during interrogation at Interpol or in court, was I asked how I planned to collect the ransom without having put in a wallet? That was THE QUESTION of the case. The sentence "12 viruses were found on a pen drive" is ridiculous and the possession of a USB Killer is not linked to the investigation. The payment of the ransom, if we are talking about extortion, is key. The prosecutor had no idea what to ask as he did not understand anything about the case and trusted the technical support from the enemy of justice, the Interpol agents.
I was not given my anxiety and attention deficit medication for 48 hours. After spending a night in a dungeon and not taking my medication, in the morning I was left in a lethargic state with no energy to argue and too confused to answer questions. I just wanted it to be over so I could take my medication. If they had given it to me, the result would probably have been different, and in the face of the Interpol officer's attempt to break me, I would have stood up, demanding the presence of a lawyer. I was at a tremendous disadvantage and not in a state to have properly defended myself from the brilliant cybercrime brains. It was my first—and I hope last— time in a situation like that, but I took it for granted that in these cases there
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 179
Operacion Bitcoins: Login To HELL
were protocols to preserve the health of people who may eventually be under different treatments.
My psychological state was not of someone with adequate mental clarity to understand the consequences of their actions when it came to recognizing the email that was sent. I will never forget the second day in court: the anxiety about the lack of my medication had caused me a lot of thirst and dry mouth, to which I asked for a glass of water before I entered to testify. They never gave me a glass of water. The way they treated me was already humiliating, and they were destroying me. I find such an inhuman system shameful. It gives the impression that when one enters a process like this, one is no longer a human being and becomes something without value, without needs, without feelings, and who does not deserve to be treated with respect. It is incredibly sad.
Why were there so many lies from the police regarding this case? Why wasn't the truth told? Do they have any clue what the real facts were? Or were a couple of bitcoins souvenirs, stickers, and an Anonymous mask all they needed to close a case?
Why did they seize a mask, bitcoin stickers, key chains, and a router, leaving four other routers at my house? The router they took was unused. They also took a WiFi signal repeater that isn't in the seized inventory or in my house. Who knows who has it at their home? Along with my Casio watch, my Carolina Herrera perfumes, and my Calvin Klein carry-on suitcase in which they took the electronic wallets from my apartment. They laughed at me with
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 180
Operacion Bitcoins: Login To HELL
an air of arrogance when I asked for them. They responded with offense that they did not take them. What case were cybercrime experts planning to make with the mask, stickers, and key chains?
It's not worth going into detail about the “expertise” of the police on the seized objects. I'm just saying it was consistent with all their research. If the work were graded, they would undoubtedly fail.
If I had wanted to perform a ransomware attack on the medical provider, they would never even consider me a suspect. Among the seized, not all the malware and tools such as kits to create ransomware were detected as I must analyze and understand this type of malicious software. I need to have this software to understand it and to be able to find ways to protect against attacks. And I would never have missed the payment address in the ransom request. Also, the system is infected first and then the ransom is asked to be paid. No one asks for the ransom first and then "hacks" the system. What is handled as "extortion," "data hijacking," etc., are concepts that do not close with the elements that are counted. But before all the above, I would never have reported the service provider's security problems and then hacked it. Why would you report security problems in the system and then violate it? It doesn't make sense.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 181
Operacion Bitcoins: Login To HELL
THE MOST IMPORTANT QUESTION WITHOUT ANSWERS 45.
The following is the most important part of this story. It is a question that only requires common sense to answer.
During the first questioning, I flatly denied sending the email. Maintaining that statement, the next day I would have returned to my house, to my life. There was and will never be anything that links me to said email, simply because there is no link. I just did not send it!
1. Why did I change my answer the next day and accept the sentence? 2. Did I want to go to jail? 3. What happened to make me change the statement and thus be sentenced to prison?
Some reason must exist. I told them that going to jail wasn't something I wanted to experience. Possibly some kind of suggestion about what was best for my loved ones could have played a role. That would be an explanation for the change of statement instead of going back to my house. (For the record, I am not bipolar.)
What I know is that in this story I almost lost my life, in addition to the economic and emotional losses. "When we are at death's door we see our
lives more clearly." I reiterate that clarity is an attribute that my life lacks, but I do have enough clarity to not believe in anything or anyone, and
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 182
Operacion Bitcoins: Login To HELL
perhaps that is why I walk through the dark and empty streets of my life the way I do.
The answer to the question is obvious. I refuse to think that the judge has not questioned anything about the investigators' behavior and that the facts were not consistent with my way of acting or my knowledge.
And that is how things turned out, and I continue to suffer the consequences of the disaster. I was taught that books should have an introduction, a middle, and a closing. Here the closure is suspended. It was a sad story and I end this book still sad. Undoubtedly, the word that best describes this story that I have told you is: sad.
In conclusion, the only extortion victim was me. Factors such as threats were neither possible nor imminent. It was not an ideal setting for extortion. Furthermore, since I have read what makes up “traditional” extortion, I consider that it's too strong to be equated with something like what apparently happened with the medical provider, where psychological pressure, and other violent, manipulative elements, etc. are not present. I was subjected to psychological pressure and manipulation—that is extortion.
Just after the complaint, and the hearing of the medical provider's authorities by the judge, the service provider went from not considering the stored data important, until then just sometime later, the light bulb went on, and they finally understood that the data was particularly important.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 183
Operacion Bitcoins: Login To HELL
So, in what way were the psychological pressure, threats, etc., linked to extortion? What I understand is a victim breaks down and agrees because he cannot bear the consequences of not complying with what is requested because of how valuable and important it is. They tell me that if I don't confess a certain crime, they will cause a lot of pain and suffering to a certain person. If that person has no meaning for me, that pressure to confess something that I did not do does not cause me anything. Now, if that person is the only thing I have in the world, then yes, they psychologically break me in a second, and I agree to give them what they ask. I think that is an interesting analogy with the psychological factors and pressures of extortion between what happened with the medical provider, and what could happen to get someone to access something that harms them, but if not, that person will suffer a lot, and not because of him, but because of what they said would happen if he did not agree.
All of this seems very strange to me, much more so when my request for a Change.org petition disappeared and my username was removed. The Change.org support never responded to my query on the matter. A criminal complaint in this regard would be pertinent. But am I going to report something to those who treated me like trash so that I can be their trophy?
The point I am trying to make with my relating of the above-mentioned situation is that, in this process, I realize that the real VICTIM OF EXTORTION THAT FITS PERFECTLY WITH WHAT IS DEFINED IN THE PENAL CODE OF URUGUAY WAS ME.
Due to the arguments I mentioned, the medical provider gave it a value that was far from being the very important value it has, as defined in current
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 184
Operacion Bitcoins: Login To HELL
regulations in relation to controls and security, etc., that sensitive data such as clinical records should have, but they didn't think they were very important. Pressures to grant what was requested, psychological manipulation, etc., are not things that have suffered in the medical world. In addition to the execution of such "pseudo-extortion," there are flaws that are obvious to those who understand the matter, which made it impossible to achieve the objective that was set. The execution of the "crime" was incredibly sad. Your planning leaves much to be desired!
The fact that malware was installed in the institution and that they could have lost all their information is false.
By evaluation the medical provider's equipment, I doubt that their database was stolen. But the evidence was never treated according to its number one rule, as I have stressed several times:
The evidence must be preserved.
And it is expected that it should be analyzed. If it is not on the record, is it that this study is carried out and the results are attached to the file? Maybe I'm totally wrong and yes, the medical provider was a victim of extortion without the slightest doubt, and I was just a perfect culprit when agreeing to declare something I did not do, to act the way I acted. How could I change my position knowing that I was going to spend one more night in Interpol facilities, where, yes, psychologically they managed to break me to answer yes to everything, because I did not know what they could do with me that night, and I did not know if I was going to have to return again.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 185
Operacion Bitcoins: Login To HELL
It is simple, they broke me, and to protect what I value most in life, I answered yes to everything.
I don't know if it is possible to understand the suffering, anguish, uncertainty, and fear that they caused me, that it did not cross my mind not to do what they told me I should do because I felt more vulnerable than ever in my life. There was also the welfare of my mother and my ex-partner. The latter broke my heart when several months after being released she told me that she constantly suffered from nightmares where she dreamed that the police were entering her house. She still suffers the consequences of the brutal and unnecessarily cruel behavior she was subjected to.
I infer that all those feelings that they generated in me with their words, with their proposals, and extreme psychological pressure are those that are presented in a "real" extortion.
Suffering, anguish, uncertainty, fear, paralysis, and fear are things that I doubt were experienced by the medical provider. I was the victim of extortion.
My initial statement flatly denied having committed extortion, and I had maintained that statement, I would not have spent a day in jail. It is impossible to prove that I was guilty of that unless I admitted it. What did I gain by changing my statement? Nothing—all I won was jail. Maintaining my initial statement, my freedom was assured.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 186
Operacion Bitcoins: Login To HELL
Could it be that life is a wheel and I can write the THIRD ACT, that is, the continuation and closing of the story, with joy, having achieved justice and having been able to find a path in my life again? I hope so, but maybe there are still punches waiting for me in this process, or maybe I have already received a knockout from which I will never be able to recover.
Good and evil, right, and wrong, are relative. Before trying to do "what you think is right," consider that you may be triggering actions that can greatly harm or even destroy you.
After eight years of being together, this incident caused me to lose my girlfriend. This was simply too bad an experience for her and she had to leave me to go help herself. So far I have been out of prison for a couple of years and I am still working with my attorney on the case. Life is exceedingly difficult for me because of the collateral damage that should never have happened.
Think of yourself and your loved ones first, and do not try to save the world. You cannot do it in a wild world. You might have problems just trying to help others.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 187
40.
Operacion Bitcoins: Login To HELL
LIES, LIES, LIES, YEAH
"Twisted truth and half the news15”
The following is just a short list of the LIES told by the police during the process. I was so naive; it is only now that I understand that lying as well as silence are key when being interrogated in situations like this one.
[1] LIE: They could trace the origin of the email address to the arrested hacker's house. No email address was traced. Why would they lie about that?
[2] LIE: In some places it is mentioned that the medical provider received three emails. That contradicts what's in the case file where only one email is included.
[3] LIE: They executed a search warrant in two places, my apartment, and another person's house. How could they trace two different places based upon the IP address of an email? The origin of any email could be only linked to one IP address, not two.
[4] LIE: During the first interrogation, they grabbed a piece of paper and told me, “I have this document that says the email was sent from your house.” I answered, “OK, arrest me then.” Of course, I knew the guy was bluffing.
15
Thompson Twins, “Lies”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 188
Operacion Bitcoins: Login To HELL
[5] LIE: They told me that if I did not confess to having sent the email, they were going to go after my mother and ex-girlfriend. They basically destroyed my ex-girlfriend emotionally and psychologically. They lied to me about not messing with her.
[6] LIE: They told my ex-girlfriend that I had confessed and that I had told them she was the one who had the idea to commit the crime.
[7] LIE: The agents shouted at her, saying I had never worked for Interpol. Those guys didn't even check my LinkedIn account—I helped Interpol in child pornography cases between 2004 and 2007.
[8] LIE: At that point, my ex-girlfriend was destroyed, thinking to herself that she had been with a criminal and a liar for almost eight years. Why did they have to do that to the poor woman?
[9] LIE: I was cloning credit cards. That aggravates me.
[10] LIE: I was accessing people's bank accounts, and I was stealing money from them. That is a serious crime! Why didn't they send me to prison for that? Or maybe they watch too many movies about bad hackers. I am not one of them.
[11] LIE: They told my ex-girlfriend I was on drugs. I was not on drugs, just my medication for my anxiety and attention deficit disorder. And I wonder
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 189
Operacion Bitcoins: Login To HELL
what this statement has to do with the case; it only made my ex-girlfriend sadder. [12] LIE: In the police's press release, it's mentioned that they were going to investigate if there were other similar cases not reported to them. That was another lie. They did not investigate any more about the case. For them, the case was closed, and they were not going to do anything more about it.
[13] LIE: Interpol sent a report to the judge about my first interrogation, stating that I had admitted all the facts related to the case. That is a lie. I clearly answered “no” when they asked me if I had sent an extortionate email.
I could continue with the list of lies about this case but those are the most relevant ones.
I cannot help thinking that there were probably other “ALBERTOS” that lived nightmares like mine (or are living them right now) in criminal cases that were never made public, due to the person's lack of knowledge, resources, a good lawyer, etc., and they were not able to spread their case to the world, and were pushed to keep it to themselves.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 190
41.
Operacion Bitcoins: Login To HELL
MY STORY AROUND THE WORLD
To date, my story has reached around one million people around the world, most of them related to computer security. 250,000 people heard my story on Darknet Diaries. At the 35C3 conference16 (never underestimate the stupidity of law enforcement), my story reached 650,000 people. Thousands more learned about my story through other means such as magazine publications, interviews, video casts, etc. The Spanish version of this book has reached about 1,000 readers.
FIGURE 48 - HTTPS://DARKNETDIARIES.COM/TRANSCRIPT/25/
16
My case in the 35C3 was presented by Linus Neumann. https://de.wikipedia.org/wiki/Linus_Neumann
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 191
Operacion Bitcoins: Login To HELL
FIGURE 49 - 35C3 CONGRESS
Still, a million people is only a small fraction of the people I am determined to reach. I am not mentioning my goal, but it is extremely ambitious yet extremely possible due to the actions I am taking, and not due to “luck.” I do not believe in luck. Luck for me is finding a good parking place in the mall; the things I am doing just give results. It is all about determination and hard work.
The most used adjective in this book is "sad". I used it 22 times. And it is true, I cannot deny it, sadness was the strongest feeling I felt and still feel. I wonder why the Spanish edition of the book only had that word 18 times.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 192
Operacion Bitcoins: Login To HELL
FIGURE 50 - 35C3 CONGRESS. SOMETHING IS MISSING.
Everything was wrong, everything had been done incorrectly, but nothing was considered illegal or not legally admissible evidence. You can contact me and tell me what was correctly done. They could not even put the handcuffs on me correctly when they put me in the police car for the four hour trip to the prison. After ten minutes, one side of the handcuffs opened... (Yeah, this sounds like complete fiction, I know.)
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 193
Operacion Bitcoins: Login To HELL
FIGURE 51 - MY STORY FEATURED IN DIGITAL FORENSICS MAGAZINE
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 194
42.
17
Operacion Bitcoins: Login To HELL
ARTICLE FROM THE GERMAN MEDIA17
https://www.heise.de/newsticker/meldung/35C3-OpSec-fuer-Hacker-Vertraue-
niemand-4260223.html
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 195
43.
Operacion Bitcoins: Login To HELL
REFLECTIONS FROM JACK RHYSIDER18
Jack Rhysider is the host of the podcast “Darknet Diaries,” the best and most famous podcast related to hacker stories with more than eight million downloads (July 2020). There were 250,000 downloads of my story's episode.
“This whole story certainly puts Alberto in a really weird situation. He absolutely has all the opportunity, capability, and knowhow to commit this crime which is what was used to convict him. But what really made him look bad in court was all the hacker stuff he had like the rubber ducky, the Anonymous mask, and the hacker t-shirts and stickers. It poses a question to me at least; why do security professionals who are there to stop hackers
18
https://darknetdiaries.com/transcript/25/
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 196
Operacion Bitcoins: Login To HELL
embrace the hacker culture? I’ve spent my whole professional career keeping hackers out of my client’s networks so you’d th2nk that I would absolutely abhor the hacker communities and would work towards breaking them up, but instead I love going to hacker conferences where I get to meet seriously scary hackers and swap tactics and skills with them.
I blog about how to hack and teach others and I wear hacker shirts myself. Why do I play on both sides of the fence? I’m not exactly sure. I guess it’s the same reason why law enforcement likes watching bloody and violent movies or why that firefighter that lives down the street from me has stickers of flames on his truck, because fire is badass. We all got into these professions because it is exciting to be so close to the action. The only way to be effective at stopping it is to embrace it and to be part of it. [...]
To truly stop hackers we must become hackers, the very thing we hate and the thing that scares us the most. Because of this philosophy it is a thin gray line between an illegal hacker and a security professional. It is not that easy to just call someone good or bad. We all have a little bit of both inside of us, but the truth is, nobody should be convicted of a crime because of what stickers they have or clothes they wear. They should only be convicted because they actually committed a crime, and in Alberto’s case the justice system wasn’t prepared and had a pre-determined idea of what a hacker looks like, and wasn’t capable of looking at the evidence with clear eyes. In some ways, illegal hackers and security professionals are long lost twins. We have the same skills and the same endless curiosity, and in many cases we look the same. I guess it is one of those relationships that is truly complicated, too complicated for this judge in Uruguay to fully understand. As for Alberto, he learned a valuable lesson from all this.”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 197
44.
Operacion Bitcoins: Login To HELL
REFLECTIONS FROM MACIEJ MAKOWSKI19
Maciej, or Matt, is a former cop from the Garda National Cyber Crime Bureau in Ireland.
“Three years later he found himself arrested and subsequently imprisoned after being the target of Operation Bitcoins – a joint operation of the Uruguayan police and the national CERT, aimed at bringing the suspect for the hacking attack to justice.
Except, it did not happen that way...
This story finale took much longer to complete than Part 1 and 2 because, as Alberto told me, he spent some time dealing with his PTSD and depression issues that arose as result of what happened to him.
19
https://www.osintme.com/index.php/who-am-i/
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 198
Operacion Bitcoins: Login To HELL
He said he could not get out of bed for days and spent some time in a clinic, receiving treatment.
To me, this is the true aftermath of Operation Bitcoins – whatever the legal outcome is, there is the human drama and the personal tragedy of somebody who was not afforded the due process and whose name, reputation, health and wellbeing were irreparably affected”20
20
https://www.osintme.com/index.php/tag/alberto-hill/
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 199
45.
Operacion Bitcoins: Login To HELL
REFLECTIONS FROM END OF DAYS RADIO21
Alberto Daniel Hill is a writer, hacker, and cryptocurrency expert who is involved in some serious cryptocurrency projects. He is here today to discuss his imprisonment and the media manipulation surrounding the event.
Daniel starts off by riffing a bit with Alberto. We learn a little bit about his spirit, philosophy, and his approach. They talk back and forth a bit about things like Daniel's favorite show Mr. Robot.
Then Alberto begins his story. A story that includes some very foolish behavior by government and media who seemed to know extraordinarily little about cybersecurity. Alberto was working as a security consultant in the past and was basically bullied into a false confession by police that were using his closest loved ones as leverage. Alberto not only never committed the crime but was trying to help in the first place. The evidence was never presented but Alberto was still imprisoned.
21
https://www.youtube.com/watch?v=wb_3H-vqrZA&
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 200
Operacion Bitcoins: Login To HELL
As Daniel listens to the story a picture begins to form in his head. Combined with the fact that information online about Alberto is disappearing, Daniel connects the dots and blurts out what Alberto already knew, that there are some powerful people involved in possibly framing Alberto!
They talk a bit about hacking, the future of cryptocurrency and what we can all do to help ensure a better tomorrow.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 201
46.
Operacion Bitcoins: Login To HELL
THE END OF MY STORY
It's not the end of my story, but I couldn't find another title for this section of the book.
I lost the love of my life. I lost all my savings and other people's savings. I cannot say I lost friends, as I cannot consider “friends” those who disappeared due to my case, but some people appeared out of the blue and were there for me, giving me all their love and support.
The process took everything from me and destroyed my life.
What I experienced should never have happened. I was mercilessly punished for something that never happened. The cost I paid was total, I lost everything I had, and I only obtained monetary problems and serious health problems (that I prefer not to comment on) because of what I experienced.
I already mentioned the innocent way in which I tried to help solve computer security problems without ever obtaining or requesting anything in exchange for my reports—reports that were told to the judge but were never sent. I wonder what is so wicked behind all these situations.
One day I got up and decided to try to extort money from a company in which I had detected and reported two serious security problems?
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 202
Operacion Bitcoins: Login To HELL
If you were you considered a pioneer and expert in cryptocurrencies, why would you send an extortionate email without including the address of the bitcoin wallet to deposit the requested money? I would be very suspicious of something like that.
I made the confession to protect my mother and my ex-partner, having full certainty that it would be impossible for the police to link me with the alleged email that, according to them, had left my apartment. I had that reassurance. But no, they never tracked any email. They always lied to me about the relevant aspects of the case and I innocently believed them.
The resolution to be sent to prison was very unfortunate and their arguments are indefensible. But the "justice" here can take those indefensible measures; they have the power to basically do what they want and take actions that are not supported by any evidence.
My life was put at risk, and I was on the verge of death. I almost paid the death penalty without being convicted. I was sent to a school of crime, where those who enter, sadly for the most part, come out as better criminals. You must be strong to resist associating with the wrong people and taking their path. And trust me, the pressure and temptation are huge, much more than you could ever imagine.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 203
47.
Operacion Bitcoins: Login To HELL
HOW WILL MY FUTURE FAIRY TALE UNFOLD?
One thing is for sure, what I had to live is anything but a “fairy tale.”
I do not know what life is preparing for me in the future. This story might have a good ending or not. I hope for the best but expect the worse. Will I have the resources to keep looking for justice? How will my future fairy tale unfold?22
For the second time, I published a petition on Change.org to change the way in which computer crimes are investigated and the way evidence is treated, with the aim of raising awareness so that there are no more cases like mine. You can sign the petition here: http://chng.it/P9zTLBpdWN
"You never know what worse luck your bad luck has saved you from."
22
Mr. Robot
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 204
Operacion Bitcoins: Login To HELL
There is no “justice.” There is only corruption and abuse of power—and justice is far from being identical for everyone. I was arrested and sentenced even before being arrested.
Shortly after being released from prison, I discovered two serious security problems in two systems. I smiled, took a snapshot, and left the systems. And I keep finding flaws in systems, but I will surely not report them to anyone, not in this lifetime.
I was contacted by a LOT of people who also found security problems in systems but refused to report them due to what had happened to me.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 205
48.
Operacion Bitcoins: Login To HELL
THE ONLINE SURVEY
I conducted an online survey about my story/case to see how people felt about my it, and these are the questions and the answers:
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 206
Operacion Bitcoins: Login To HELL
The results
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 207
Operacion Bitcoins: Login To HELL
Latest Responses
1.
"Alberto's story just proves how someone who was just trying to the right thing, ended up paying the consequences of something he did not do. It's just sad."
2.
"Sad story"
3.
"Inspiring" "Sad" "Inspiration!"
4.
"Your story is so powerful Alberto. No one should ever have to go through something so horrific for a false charge. “
5.
“The authorities turned your life into rubble but courageously you are climbing out of the debris and rebuilding what they destroyed.”
6.
“You are a trailblazer in revealing cracks to cyber security in your Country. “
7.
“Your story will be legendary long after we are long gone from this world."
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 208
8.
Operacion Bitcoins: Login To HELL
“Perhaps put some more detail of how the charges were dropped, how it's affected your security career and how people can protect themselves against the charges which were brought against you. Stay safe, buddy 😁”
9.
“Felt So Bad...Innocent Went To Jail. Because Of A Bad Police Officer. Because He/She Wanted Fame."
10. “Sad story”
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 209
Operacion Bitcoins: Login To HELL
Words used to describe the story
For me, so much love and support from so many people who listened to my story makes me feel good. It is gratifying knowing that the people who are in the infosec community consider the story I was forced to live stupid, and it shows the incompetency of the police and “justice.” It's not just me that sees that, but everybody else see things the same way I do.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 210
Operacion Bitcoins: Login To HELL
ACT THREE
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 211
49.
Operacion Bitcoins: Login To HELL
THE AFTERMATH OF THE STORY
The “third act” is where the “hero” (the hacker) should face his final battle, beating the enemy (the system) against all odds, getting his life back, and returning with the girl he loves, living happily ever after.
He also triggers a series of actions to improve the way computer crimes are investigated in Uruguay, as well as making the judicial system fairer in these cases.
The hacker who was initially the trophy of both the police and judge makes them become a trophy for him.
But this book is not fiction. The third act of this story is still being written, and I will publish the outcome when the story ends. I am fighting to end the story the way it was related above, as a real third act of a story like this one. The process is not over yet, and I am still fighting for “justice.”
Not everything is so bad, and the following really is like it was taken from a book of fiction. Everything is bad except for...
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 212
Operacion Bitcoins: Login To HELL
I felt it was impossible, but it is not. Magically, out of the blue, something happened to me related to my story. I cannot give details about it now due to a non-disclosure agreement, but it is something in part related to a beautiful friendship and trust.
It is incredible and it can change everything about my case, my life, and the lives of other people. But that phenomenon I am talking about is a story inside another story that began in 1996. That would compensate and shatter every negative situation lived in this story, except losing my girlfriend. I am anxious to make this opportunity a reality. If It does, I will forever believe in miracles. I should have updates about this by the first part of 2021.
If I survived this experience, I assure you that you can also cope with extreme obstacles in your life. You can. Those situations will certainly leave scars that might never heal, but you will learn to live with them, and you will survive... If you want to.
All I want is my life back and to logout from HELL, but I know that even if I logout, things will never be the same and there are things that I will never recover. There are things money cannot bring me back, and it cannot give me back my life. I must assume that, and that I will have to start from zero at 45 years old. This incident was awfully expensive for me in every aspect of my life.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 213
Operacion Bitcoins: Login To HELL
Civil and criminal actions are being taken for all the damage caused to me. If the police committed crimes, they should have to face the consequences. If I lost all my savings because of the actions of the police and justice system, then the government will have to return that to me. If I suffer from PTSD and a deep depression that does not allow me to work, and hasn't allowed me to for three years, then the government will have to pay for all the income I was not able to earn for those three years.
Despite the judge's verdict, society's verdict is clear, and you know what it is, because it is YOUR verdict after reading this book or learning my story from other sources.
None of my close friends ever asked me if I sent the email. They already knew me, and they already knew the answer to that question.
I hope reading these pages was positive for you despite all the sad and complicated situations I had to cope with. The good part is that I somehow prevailed over each obstacle, and I survived extreme conditions. Many people have told me my story is “inspiring.” If I have inspired only one person, then I think all I had to live was worth it.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 214
Operacion Bitcoins: Login To HELL
These pages contain much more accurate events of the case than the 1,000 pages of noise and lies included in the case file. I wish somebody from the police would answer the 13 lies in the chapter “Lies, Lies, Lies, Yeah.” And I would like to know why they were so brutal with my ex-girlfriend. It has been three years and it still breaks my heart.
Feel free to contact me on Twitter: @ADanielHill and tell me what you think about my story, and if you follow me you can keep updated about the outcome of the “third act.”
I hope to write the third act of this sad, incredible, yet true story with a great and unexpected, wonderful outcome for me. I am working hard to make that happen, and I want to believe in miracles. My silver bullet to beat the system is something huge that I expect to begin this year or early in 2021, and that silver bullet will blow everybody’s mind and will knockout the case against me. It will be me who turns into Mike Tyson and punches them in their faces.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 215
Operacion Bitcoins: Login To HELL
This book is my best defense as I could not express anything included here during the process. But more than one million people in the world know what the police and justice in Uruguay do not. A copy of the version in Spanish of this book is going to be included in the case file so they will clearly see how they screwed up everything. Or they might decide not to read the book and just keep their verdicts, despite having all the evidence that proves the police and "justice's" actions were wrong, and that their understanding of the case was wrong.
As they, as individuals, are not subject to criminal or civil actions by doing things incorrectly, the most likely and expected action would be the second one. I am fighting in a case where everything is against me.
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 216
50.
Operacion Bitcoins: Login To HELL
FORGET ALL THE SADNESS TOLD IN THIS BOOK
“When you come out of the storm, you won't be the same person who walked in. That's what this storm's all about.” Haruki Murakami.
Now, I want you to forget about all the sadness I mentioned in this book. Turn something sad into something better. Forget about the past, live the present, and do not overthink the future. You can also be the hero of your own story.
There are no ordinary lives. We all have moments of heroism. We all face situations that many other people must overcome as well. We make highly inspiring decisions for others more often than we think. I hope you find my story inspiring.
Alberto Daniel Hill
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 217
51.
Operacion Bitcoins: Login To HELL
RESOURCES
DARKNETDIARIES https://darknetdiaries.com/episode/25/
OPERACIÓN BITCOINS: Login to HELL (Kindle Spanish Edition) http://amazon.albertohill.com OPERACIÓN BITCOINS: Login to HELL (Paperback Spanish Edition) http://amazon.albertohill.com
OSINTME.COM https://www.osintme.com/index.php/tag/alberto-hill/ Admin Admin, Part 1: From responsible disclosure to a prison cell Admin Admin, Part 2: The case against Alberto Admin Admin, Part 3: The aftermath of Operation Bitcoins
Arepa Digital: Operación Bitcoins: Del Infierno a la Resurrección http://www.arepadigital.com/operacion-bitcoins-del-infierno-a-laresurreccion/
Myhackertech.com https://myhackertech.com/blogs/news/the-wrong-cuckoo-s-egg-an-interview-withuruguay-s-first-jailed-hacker-alberto-hill
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 218
Operacion Bitcoins: Login To HELL
Moonbooks Publishing https://moonbooks.net/authors/alberto-daniel-hill/
Figure 2 - My Twitter account
Alberto Daniel Hill https://albertohill.com/ https://twitter.com/ADanielHill https://www.linkedin.com/in/nofear75/ https://imdb.com/name/nm11317072
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 219
Operacion Bitcoins: Login To HELL
https://www.instagram.com/whois.albertohill/ http://amazon.albertohill.com
Digital Forensics Magazine Issue 38 http://digitalforensicsmagazine.com/index.php?option=com_content&view=article&id=1 277&Itemid=99
Digital Forensics Magazine Issue 39
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 220
Operacion Bitcoins: Login To HELL
http://www.digitalforensicsmagazine.com/index.php?option=com_content&view=article &id=1293
35c3 Alberto's story of hacking, love, near death experience and prison https://www.youtube.com/watch?v=gBtynT_dhJc
YouTube videos about the case https://www.youtube.com/channel/UCJxLpOe53KjJwlpRdTDz08g?view_as=subscriber
La historia del primer hacker procesado con prisión en Uruguay https://soundcloud.com/radio-carve/la-historia-del-primer-hacker-procesado-conprision-en-uruguay?in=alberto-daniel-hill/sets/operacion-bitcoins
All the audio files with the interviews for the radio can be found here: https://soundcloud.com/alberto-daniel-hill
Podcast - Contains tales from prison https://anchor.fm/darkwebtoday
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 221
52.
Operacion Bitcoins: Login To HELL
SPECIAL THANKS
My mother Dr. Juan Carlos Fernández Lecchini and his family Marisa and Miguel Motta Evelyn Fajardo Martín Romano Beatriz Ferrari Nicolás Arévalo David Diaz Mateo Martínez Manuel Rangel Linus Neumann Martín Priliac (Review of the Spanish edition) Daniel Rodríguez (divirus) Jack Rhysider Allan Jay Friedman and Mazie Rodolfo Ortega Jesús Gerez Nicole Elizabeth Eggert, Christy, Sammy, Tiff, Nancy, Ethel and Lonnie Russell Davis Brandon Mullins
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 222
Operacion Bitcoins: Login To HELL
Pilar Abbate Courtney Toth (beta reader) Joanna Joniec (beta reader) R3mnasa (beta reader) Node Chomsky Daniel from “END OF DAYS RADIO” Everybody from prison All my Friends from Twitter Everybody who was by my side during the hardest moments of my life Graham
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 223
53.
Operacion Bitcoins: Login To HELL
FEEDBACK
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 224
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 225
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 226
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 227
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 228
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 229
Operacion Bitcoins: Login To HELL
´
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 230
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 231
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 232
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 233
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 234
Operacion Bitcoins: Login To HELL
23
23
https://youtu.be/6qpudAhYhpc ALGORITHM: The Hacker Movie
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 235
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 236
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 237
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 238
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 239
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 240
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 241
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 242
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 243
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 244
Operacion Bitcoins: Login To HELL
Much more feedback can be found here:
https://albertohillhome.wordpress.com/testimonial/
Figure 3 - QR CODE TO READ MORE FEEDBACK ABOUT MY STORY
"You never know what worse luck your bad luck has saved you from."
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 245
Operacion Bitcoins: Login To HELL
CAN I ASK A FAVOR? If you enjoyed this book, found it useful or otherwise then I would really appreciate it if you would post a short review on Amazon. I do read all the reviews personally so that I can continually write what people are wanting.
If you would like to leave a review then please visit the link below:
http://amazon.albertohill.com
Thanks for your support!
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 246
Operacion Bitcoins: Login To HELL
BONUS TRACKS Would you like to read parts of the story that were not included deliberately in this book? Well, here you have access to about 10 pages of material about the story that I decided not to publish in this book.
Using the password “Login2Hell” Check out these pages: Contact me via Twitter @ADanielHill if you have any problem trying to access.
BONUS TRACK 1: THE GIRL. https://albertohill.com/?page_id=11048
BONUS TRACK 2: AGAINST THE ODDS. https://albertohill.com/?page_id=11059
I will be posting much more stories from my crazy experience, so I recommend you sign up for my newsletter to be notified whenever I post something new. Newsletter: https://albertohill.com/?page_id=8349
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]
P a g e | 247
Operacion Bitcoins: Login To HELL
[AlbertoHill.com] [@ADanielHill]
[The true story of a hacker]