Hacker Stories: The Hacker Who Ruled the Criminal Underworld

This chapter details the rise and fall of Max Butler (also known as "Max Ray Vision" and "Iceman"), a premier cybersecurity expert and FBI informant who built and ran Carders Market—one of the largest dark web illicit credit card operations in history. It explores the psychological drivers, technical exploits, physical carding operations, and law enforcement interventions that ultimately dismantled an $86.4 million cybercrime empire.

1. Early Life and Psychological Roots

Max Butler’s path into cybercrime was shaped by early exposure to hardware technology, combined with personal instability and impulsive behavior.

• Early Technological Exposure: Growing up in Boise, Idaho, during the 1980s, Butler gained early access to microcomputers through his father’s computer repair shop, building advanced technical literacy at a young age.
• Psychological Volatility: Following his parents' divorce when he was 14, Butler experienced severe emotional distress. As documented in Kevin Poulsen’s book Kingpin, Butler's behavioral profile shifted between two extreme states: "relaxed, and full-bore insane."
• Initial Legal Escalations:
  • High School Expulsion: Butler obtained a master key to Meridian High School, raided the chemistry lab, and discharged fire extinguishers in the hallways.
  • Aggravated Assault Conviction: While attending Boise State University, an online dispute in a text-based Multi-User Dungeon (MUD) led to a violent domestic altercation with his girlfriend. A jury convicted him of aggravated assault with a deadly weapon (his hands), resulting in a four-year prison sentence.

Mental Model: Butler's early incarceration created a deep-seated resentment toward the judicial system and traditional authority, establishing a psychological pattern where technical mastery was repeatedly paired with high-risk, impulsive decision-making.

2. The Transition to FBI Informant and Security Consultant

Following his release from prison in 1995, Butler attempted to establish a legitimate career in San Francisco, adopting the alias Max Ray Vision.

• IRC Piracy & Legal Compromise: Butler hosted unauthorized software, games, and music channels on Internet Relay Chat (IRC). This led to a $300,000 civil lawsuit from the Software Publishers Association (SPA). He settled the suit for$3,500 by agreeing to work as a security consultant.
• Dual Identity as a White-Hat:
  • FBI Informant (1997): The FBI recruited Butler to monitor digital communication channels, identify illicit file-sharing networks, and flag underground criminal activities.
  • Corporate Penetration Tester: Employed by former hacker Matt Harrigan's cybersecurity firm at rates between $100 and$150 per hour, Butler conducted authorized penetration tests to help enterprise clients patch system vulnerabilities.

3. The BIND Vulnerability and Dual-Life Escalation

While working as a white-hat consultant, Butler uncovered a critical security vulnerability in BIND (Berkeley Internet Name Domain), the core software responsible for mapping human-readable domain names (e.g., google.com) to numerical IP addresses.

Technical Breakdown: Memory Buffer Overflow Exploit

The flaw existed in BIND's packet processing logic. By sending an intentionally oversized domain query, an attacker could force a memory buffer overflow, overwriting adjacent system memory and executing arbitrary remote code with elevated privileges.

• The Double Game:
  • Public/Official Response: Butler notified authorities and released an official patch to fix the BIND vulnerability.
  • Covert Exploitation: Butler simultaneously deployed a custom rootkit into patched systems, maintaining a secret backdoor for persistent remote access.
• Targeting Military & Government Infrastructure: Butler used this backdoor to compromise defense and government networks, tracking his illegal breaches like high-score achievements in a video game.
• Detection & Law Enforcement Intervention:
  • Security researchers at Lawrence Berkeley National Laboratory detected anomalous activity originating from his backdoors.
  • An Air Force investigator traced the intrusions after discovering that Butler had configured real-time pop-up notification alerts that alerted him whenever a system was compromised. These alerts routed through his San Jose dial-up ISP account, yielding a direct subpoena match to his home phone line.
• Refusal to Cooperate & Second Sentence: The FBI offered Butler leniency if he would record incriminating evidence against his employer, Matt Harrigan. Butler refused. Before serving his sentence, he launched whitehats.com and created arachNIDS (an open-source intrusion detection signature database). In 2001, he pled guilty to wire fraud and was sentenced to 18 months in federal prison.

4. Second Incarceration and the Shift to Carding

While serving his 18-month sentence, Butler met Jeff Norminton, a seasoned con man who introduced him to the financial mechanics of cyber fraud. Unable to secure legitimate employment upon his release due to his escalating criminal record, Butler joined forces with Chris Aragon, a former bank robber and drug smuggler.

The Operational Split: Physical Fraud vs. Technical Intrusion

• Technical Asset Acquisition: Aragon supplied high-performance laptops, high-gain long-range Wi-Fi antennas, and magnetic stripe programmers.
• Wardriving & Wi-Fi Interception: Butler drove through commercial districts using long-range directional antennas to intercept unencrypted point-of-sale traffic over vulnerable corporate Wi-Fi networks.
• Card Clones & Physical Fencing:
  • Aragon used magnetic stripe encoders to write stolen credit card data ("dumps") onto blank or existing payment cards.
  • Aragon created counterfeit photo identification cards matching the stolen profiles.
  • Teams of associates bought high-end luxury merchandise (e.g., designer handbags) at major department stores, which were then resold through legitimate online storefronts (such as eBay), generating over $780,000 in gross sales over three years.

5. Hacking the Hackers & The Birth of Carders Market

Initially, credit card numbers were bought and sold across digital underground channels like Carder Planet and Shadow Crew. Seeking greater control and supply, Butler developed techniques to steal data directly from rival cybercriminals.

Technique 1: Trojanized Dump Offerings

Butler posed as a top-tier vendor offering free high-value American Express card dumps. He distributed links containing custom malware that, once executed by rival sellers, compromised their systems and exfiltrated their private card databases directly to him.

Technique 2: Hostile Forum Mergers via SQL Injection

In late 2005, operating under the alias Iceman, Butler launched Carders Market, hosting its core infrastructure on a compromised server hidden inside a hijacked Florida data center. To eliminate competition and consolidate market share, he launched automated SQL injection attacks against competing carding forums.

Impact: Through these database takeovers, Iceman unilaterally seized control of rival user bases and consolidated thousands of global cybercriminals onto Carders Market, which peaked at over 4,500 active members.

Unencrypted Commercial Target Example: Pizza Schmizza

In one intrusion cited in court documents, Butler breached a server belonging to a Pizza Schmizza franchise in Vancouver, Washington. The restaurant's system stored customer transaction records in unencrypted plain text, allowing Butler to exfiltrate 2,000 credit card records instantly.

6. Law Enforcement Infiltration and Counter-Operations

As Carders Market grew, multiple federal agencies launched undercover counter-operations to penetrate the digital credit card ecosystem.

FBI Operation: "Master Splyntr" and DarkMarket

• Infiltration: FBI Special Agent Keith Mularski created the online persona Master Splyntr, posing as a high-profile Polish spammer. To build authenticity, Mularski arranged to have his handle publicly listed on legitimate anti-spam blacklists.
• Gaining Operational Control: Master Splyntr gained the trust of JiLsi, the administrator of DarkMarket (Carders Market's primary rival). Mularski convinced JiLsi to migrate DarkMarket’s entire server infrastructure onto a machine directly owned and monitored by the FBI.

7. Unraveling the Ring and Forensics of the Raid

Despite maintaining advanced operational security on Carders Market, Butler’s physical operational network contained critical vulnerabilities.

1. The Bank Trail: John Giannone, an associate of Chris Aragon, sold stolen card dumps to Brett Johnson (alias GOllumfun), a co-founder of ShadowCrew who was secretly acting as an undercover informant for the U.S. Secret Service. Federal agents traced the transaction payments directly to Giannone's corporate Bank of America account.
2. Aragon's Arrest: Upon his arrest, Giannone identified Chris Aragon. The Secret Service arrested Aragon following a $13,000 retail spending spree. Search warrants executed at Aragon's residence uncovered counterfeit payment cards throughout the property.
3. The Betrayal: Facing severe federal penalties, Aragon cooperated with law enforcement, identifying Max Butler as the operational mind behind Carders Market and revealing his real-world identity as "Iceman."

Forensic Recovery: Volatile Memory (RAM) Extraction

On September 5, 2007, federal agents executed a raid on Butler's apartment in San Francisco. Although Butler had configured full-disk encryption across his local workstations, agents executed the warrant while his hardware was running.

Key Forensic Takeaway: Full-disk encryption protects data at rest when a system is powered down. Because the machines were powered on and operating during the raid, the encryption keys resided in volatile System RAM. Analysts from Carnegie Mellon University’s Computer Emergency Response Team (CERT) extracted the live memory contents, securing the master passphrase: !!One man can make a difference!.

The resulting search yielded 1.8 million stolen credit card numbers, tied to an estimated $86.4 million in fraudulent charges.

8. Judicial Outcome, Prison Life, and Re-entry

In June 2009, Max Butler pled guilty to wire fraud charges. During pre-sentencing proceedings, he reflected on his loss of moral perspective when operating behind online anonymity:

"I lost touch with the accountability and responsibility that comes with being a member of society... when I was invisible, I forgot all about this advice. I know now that we can't be invisible, and that it's dangerous thinking."

• Sentencing: Butler received a 13-year federal prison sentence (156 months), while his partner Chris Aragon received a 25-year sentence due to an extensive prior criminal record.
• In-Prison Contraband Infraction: While incarcerated, Butler was implicated in an illicit plot involving a drone used to drop contraband into the prison yard.
• Release: Butler was officially released from federal custody in 2021.

9. Technical & Operational Synthesis

Profiles of Key Figures and Entities

Comparison of Primary Hacking & Fraud Vectors

Summary and Key Takeaways

• The Danger of Dual Identities: Max Butler demonstrated how technical skills can be misused, moving fluidly between legitimate penetration testing, law enforcement assistance, and high-level cybercrime.
• Systemic Vulnerabilities in Core Infrastructure: Single line-of-code flaws in foundational software like BIND can compromise large segments of global internet infrastructure when exploited for unauthorized access.
• Hostile Takeovers in the Digital Underworld: Butler established market dominance not through business growth, but by launching SQL injection attacks against competitors to steal their databases and user bases.
• The Limits of Disk Encryption: Full-disk encryption only protects static offline data. Forensic capture of volatile System RAM on running machines allows investigators to recover active decryption keys directly from memory.
• The Physical Vulnerability of Digital Crime: Despite advanced digital operational security, Butler's empire was brought down by physical trace points—specifically, traditional bank transactions and retail fencing activities.
• Undercover Counter-Operations: Law enforcement agencies effectively counter dark web networks by adopting online personas, gaining administrative control, and taking over criminal server hosting infrastructure directly.