Max Butler

Max Ray Vision (formerly Max Ray Butler, alias Iceman, born 1972),^[1][2] a former computer security consultant,^[3] was an online hacker charged with two counts of wire fraud and theft of nearly 2 million credit card numbers as well as approximately $86 million in fraudulent charges.^[4]

Early life

Butler grew up in Meridian, Idaho and had a younger sibling; his parents divorced when he was 14.^[2] His father was a Vietnam War veteran and computer store owner and married a daughter of Ukrainian immigrants.^[5] As a teenager, Max Butler became interested in bulletin board systems and hacking.^[2] After a parent reported a theft of chemicals from a lab room, Meridian High School expelled Butler, and Butler pled guilty to malicious injury to property, first-degree burglary, and grand theft. Butler was diagnosed as bipolar in a two-week psychiatric evaluation at an in-care facility and ultimately received probation for his crimes, live with his father, and transfer to Bishop Kelly High School.^[6]

First offence

Butler attended Boise State University for a year.^[7] In 1991, Butler was convicted of assault during his freshman year of college.^[2] His appeal was unsuccessful on procedural grounds, as a judge ruled that Butler's defense attorney did not raise the issue in an earlier appeal. The Idaho State Penitentiary paroled Butler on April 26, 1995.^[8]

Life after prison

Butler moved with his father near Seattle and worked in part-time technical support positions in various companies. He rediscovered Internet relay chat and frequently downloaded warez, or illegally downloaded software or media. After an Internet service provider in Littleton, Colorado traced Butler's uploads of warez to an unprotected file transfer protocol–the uploads were consuming excessive bandwidth–to the CompuServe corporate offices in Bellevue, Washington, CompuServe fired Butler.^[9]

Moving to Half Moon Bay, California, Butler changed his last name to Vision and lived in a rented mansion "Hungry Manor" with a group of other computer enthusiasts.^[10] Butler became a system administrator at computer gaming start-up MPath Interactive.^[11] The Software Publishers Association filed a $300,000 lawsuit against Butler for pirating software from CompuServe's office and later settled the case for $3,500 and free computer consulting. In March 1997, Butler became an informant for the Federal Bureau of Investigation; the first report that he wrote for the FBI covered unprotected FTPs like the one in Colorado in which he uploaded the warez.^[12]

After marrying Kimi Winters, he moved to Berkeley, California, and worked as a freelance pentester and security consultant. During this time, he developed the arachNIDS database, 'an online community resource called the “advanced reference archive of current heuristics for network intrusion detection systems,” or arachNIDS.'^[13]

FBI Target

In the spring of 1998, Butler installed a backdoor onto American federal government websites while trying to fix a security hole in the BIND server daemon. However, an investigator with the United States Air Force found Butler via pop-up notifications and his FBI handlers.^[2] The FBI had Butler infiltrate a group of hackers who hijacked 3Com's telephone system for personal teleconference use.^[14] Butler attended the annual DEF CON hacker convention the following summer and by then had second thoughts about his work with the FBI.^[15] He hired attorney Jennifer Granick for legal representation after hearing Granick speak at DEF CON, and the FBI terminated Butler consequently.^[16] On September 25, 2000, Butler pled guilty to gaining unauthorized access to Defense Department computers.^[1] Starting in May 2001, Butler served an 18 month federal prison sentence handed down by federal judge James Ware.^[17]

After his release from prison in 2003 on supervised release, Butler exploited Wi-Fi technology to commit cyberattacks anonymously along with Chris Aragon from San Francisco.^[18] He advanced to programming malware, such as allowing the Bifrost trojan horse to evade virus scanner programs and exploited the HTML Application feature of Internet Explorer to steal American Express credit card information.^[19] Butler also targeted Citibank by using a Trojan horse towards a credit card identity thief and began distributing PINs to Aragon, who would have others withdraw the maximum daily amount of cash from ATMs until the compromised account was empty.^[20]

Arrested in 2007, Vision was accused of operating Carders Market, a forum where cyber criminals bought and sold sensitive data such as credit card numbers. After pleading guilty to two counts of wire fraud from stealing nearly 2 million credit card numbers and spending $86 million in fraudulent purchases, Max Ray Vision was sentenced to 13 years in prison, which is the longest sentence ever given for hacking charges. After prison, he will also face 5 years of supervised release and is ordered to pay $27.5 million in restitution to his victims.^[4][21]

References

1. ^ ^{a b} Evans, Will (27 September 2000). "Berkeley Hacker Admits To Government Infiltration". The Daily Californian. http://www.dailycal.org/article/3328/berkeley_hacker_admits_to_government_infiltration_. Retrieved 4 March 2011. 
2. ^ ^{a b c d e} Poulsen, Kevin (22 December 2008). "One Hacker's Audacious Plan to Rule the Black Market in Stolen Credit Cards". Wired. http://www.wired.com/techbiz/people/magazine/17-01/ff_max_butler?currentPage=all. Retrieved 4 March 2011. 
3. ^ "Case File: Cybercrime: Max Butler". http://www.cnbc.com/id/35988327/. Retrieved 28 October 2010. 
4. ^ ^{a b} Mills, Elinor. "'Iceman' pleads guilty in credit card theft case". CNET News. http://news.cnet.com/8301-1009_3-10275442-83.html. Retrieved 25 September 2010. 
5. ^ Poulsen, Kevin (2011). Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground. Crown Publishers. pp. 2. ISBN 9780307588685. http://books.google.com/books?id=SStemNQZV80C. 
6. ^ Poulsen, pp. 4-5.
7. ^ "Computer Hacker Masterminds". American Greed. CNBC. 5 May 2010. http://www.livedash.com/transcript/american_greed-%28computer_hacker_masterminds%29/5406/CNBC/Wednesday_May_05_2010/286140/. 
8. ^ Poulsen 2011, p. 15.
9. ^ Poulsen 2011, p. 16.
10. ^ Poulsen 2011, pp. 14, 16.
11. ^ Poulsen 2011, p. 17.
12. ^ Poulsen, pp. 17-18.
13. ^ "McGraw Hill - Intrusion Detection and Prevention". Intrusion Detection and Prevention. McGraw Hill/intrusion-detect.com. http://intrusion-detect.com/McGraw.Hill-Intrusion.Detectio/7210final/LiB0111.html. Retrieved 16 March 2011. 
14. ^ Poulsen 2011, p. 35.
15. ^ Poulsen, pp. 35-39.
16. ^ Poulsen 2011, pp. 39-41.
17. ^ Delio, Michelle (22 May 2001). "A 'White Hat' Goes to Jail". Wired. http://www.wired.com/politics/law/news/2001/05/44007. Retrieved 16 March 2011. 
18. ^ Poulsen 2011, pp. 68-71.
19. ^ Poulsen 2011, pp. 80-84.
20. ^ Poulsen, pp. 101-104.
21. ^ McMillan, Robert. "Hacker Iceman gets record 13 year sentence". http://news.techworld.com/security/3212722/hacker-iceman-gets-record-13-year-sentence/. Retrieved 28 October 2010. 

Further reading

• Kevin Poulsen, Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground, 2011, publisher: Crown. ISBN 0307588688

Persondata
Name	Butler, Max
Alternative names
Short description
Date of birth	1972
Place of birth
Date of death
Place of death