[nostrademons]

Uh, my recent experience is that "Some guy on Substack" is a significantly more reliable source than "The Literal New York Times".

Gel-Mann Amnesia affect applies here: every time I've seen mainstream media cover a subject that I have personal experience or expertise with, it's been shockingly inaccurate. This includes the NYTimes. It includes random guys on Substack too, but I've found that random guys on Substack when speaking about their area of expertise are actually pretty accurate. It's left to the reader to determine whether some random guy on Substack is actually speaking to an area of their expertise, but other comments here have attested that the author actually knows what he's talking about when it comes to SIM farms.

[deelowe]

And what exactly makes "Robert Graham" such an expert in this particular domain? I don't know who this person is or why I should trust their personal blog over the NYT. The article itself is rather hand-wavy in it's assessment of the report. The thesis is essentially "bot farms use lots of sims & this is an example of using lots of sims, therefore this is a bot farm and not espionage."

[nostrademons]

Here's his bio from the RSA conference:

https://www.rsaconference.com/experts/robert-graham

BlackICE was a big personal firewall 20 or so years ago - you can read all the CNet/ZDNet reviews if you search for it. You can also look at his code (for a port scanner that can scan the entire Internet in 5 minutes, whew) on GitHub:

https://github.com/robertdavidgraham/masscan

[deelowe]

Thank you for sharing. I recall blackice. I'm not seeing anything here would lead me to believe he's an expert in this particular domain though, which is more about nation state intelligence operations than it is anything technical.

[nostrademons]

I think his point is that it's not about nation-state intelligence operations, and that the capabilities claimed here are garden-variety cybercriminal operations. You or I could set up something very similar, if we were willing to participate in a dodgy business.

And by some basic napkin math and a few Google searches, he appears to be right. Prepaid sim cards are about $5/each [1]. A 16-port SimBerry server is $499 [2]; their full-fledged servers are "contact us" for pricing, but support up to 18,000 SIM cards [3]. Assuming their enterprise solutions are cheaper on a per-SIM basis than retail, that's about $35/SIM in hardware costs. For $100K in startup capital, you can run a 3000-SIM farm. And then, like this article suggests, once you get started you reinvest the profits: if you assume each SIM card gives you 1000 txts, then if you charge 2c/txt your $5 investment becomes $20 and you can expand your operations accordingly.

I wonder sometimes if, when it comes to cybercrime, "[Russia/North Korea/China/Iran] did it!" is actually code for "The FBI has no idea who did it, but if we said that it would encourage all sorts of script kiddies to do this for profit, so we might as well blame it on our nation-state level adversaries." Many of the hacks in question (eg. ransomware) are not out of reach of a lone malcontent in their 20s with some tech skills.

[1] https://www.google.com/search?q=prepaid+sim+card

[2] https://www.simberry.com/offers

[3] https://www.simberry.com/equipment/sim-server