Slashdot Mirror
Cracker Gains Access to 2.2 Million Credit Cards
Doctor Sbaitso writes "CNN reports that a hacker bypassed the security system of a company that processes credit card transactions and gained access to approximately 2.2 million Visa and MasterCard credit cards. Fortunately, none of them seem to have been used fraudulently."
I doubt the fact that none have been used will be true for very long. I'd better check my statement tomorrow.
pfft, back in my day, we could generate as many valid credit card numbers as we wanted. of course, those usually got used fraudulently....
Damn white boys need to stay away from them computers!!
I dont like the use of racial slurs like that on /.
I bet this "hacker" at least bought some candy with those cards...mabye like a snickers or something?
So THATs why $5 was paid to Slashdot without me remembering!
Fortunately, none of them seem to have been used fraudulently.
And how exactly do they know that all 2.2 million credit card #'s haven't been used fraudulently? I'm sure that there are at least a small percent of any given set of 2.2 million credit card #'s that are used fraudulently.
damn kevin mitnick!
This is a great security threat for our nation! Just think of all the plastic explosives terrorists could create with 2.2 million credit cards!
---
Hello, Slashdot user. My name is Dr. Sbaitso. I am here to help you.
2.2 million...it will be interesting to see what happends when who ever did this starts to sell them in bulk. Who is going to be responsible? The Credit Card companies or the site that got hosed?
Should prove interesting as these numbers start getting used. 2.2 is a little large of a block to just re-issue.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
I guess tomorrow all the online pr0n stores will be sold out of everything!
You mean 'none of them seem to have been used fradulently YET'
Fortunately, none of them seem to have been used fraudulently
Uh, yeah, because it's so easy to verify that two MILLION credit card numbers haven't been used fraudulently.
I mean, come on, just through coincidence I'm sure some of the physical cards themselves have been stolen recently and used fraudulently.
Comment removed based on user account deletion
That article was not written with many details... What credit group... who's the hacker?
||| I still can't believe Parkay's not butter.
No, I haven't done anything yet. I'm going to wait until this whole thing blows over, then... and only then... do we get a Free Ass 17" Powerbook, a Free Ass 12" Powerbook and a Free Ass dual G4 1ghz machine with two or three Free Ass 23" Cinema Displays.
Only in America, friends... Only in America
Why is it when I hit ^R that ZSH calls me a cocksucker?
With 2.2 million credit card numbers to check, how do they know that the cards haven't been compromised?
Sure, their owners might not have reported any fraudulent use yet (and the card issuers themselves may not have spotted any) but all it takes is for this hacker/cracker to have made one copy of the records which he then disseminated to one or more friends for a problem to occur.
At the very least, the owners of the system that was broken into should be contacting their customers to let them know that there is a small but real risk that their cards numbers might be out there and that they should double check their statements for any unusual items.
But, given that most companies would see something as proactive as this as marketing suicide (rather than use it to enforce the fact that they do everything to protect the security of their customers), I doubt that they will be so bold.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
Let's say this cracker e-mails off these credit card numbers to everyone in the world (those lists of e-mail addresses are only $20, ya' know), can you imagine the offices of Visa and Mastercard?
Actually, things probably wouldn't be that bad.
Who in there right mind would use credit card numbers fraudulently on such a high-profile case? Surely jail time or fines would ensue, and that alone would keep most Americans from jumping to use the numbers.
Then again, there is the chance that many Americans would use those numbers. How about a program that automatically used those numbers to make fraudulent purchases? It would take weeks or months just to sort out bills. Would Visa and Mastercard even be able to handle that amount of traffic? No, something like this could destroy these two companies; it would be almost impossible for them to handle.
credit cards aren't exactly open source now are they?
Remember, Credit Cards companies use neural networks to analyse transactions and decide whether or not they may be faulty, and the success-rate of these babies is higher than you may suspect (okay, I don't have a web-link, I read it in a pop-sci book on maths, biology and AI). So you may be short a few dollars, which isn't good (don't get me wrong), but unless you normally spend $hitload$ of money, they won't be able to buy a Ferrari or anything (mind you, if they only took a few cents from each credit card account, they COULD buy a Ferrari ...)
This sig intentionally left bla... dammit!
Who's got the whiteout?
Fortunately, none of them seem to have been used fraudulently.
In other news, it seems that slashdot's favorite non tech related website had a surge of 2.2 million account signups in the span of a week.
arcane for life
New leaf my ass. Welcome back, Kevin ;-)
http://www.cnn.com/2000/TECH/computing/03/13/credi tcard.steal.idg/
--------------------------------
Not all who wander, are lost.
you know...this really isn't anymore flame-bait that the parent.
think about it.
I like those odds - not a single fradulent use in 2.2 million cards.
Hell i've had 3 fradulent transactions and only own 3 credit cards and two debit cards.
One thing i've noticed is that my card company seem good at stopping me from spending when they think i'm fradulent. Just put 7 currencies on your card in as many days and alarm bells seem to ring somewhere.... but catching real theives is a little too tricky
The correct term is GNU/hacker and GNU/cracker. btw, let's use the term chracker from now on for clarity, please.
And what about the problem? How did the cracker get in? Wasn't Mitnick just allowed back on the Internet - how is his VC funding situation anyway? :-)
I used to work at an incredibly busy CompUSA back when I was putting myself through college, I worked behind the register and had to put up with any number of fucking (A)Assholes, (B)Jerks, (C)Fucklickers (D)Cunts and/or (E)Wastes of Meat every day of my miserable existance there. Every day, these pricks would come in, verbally abuse me and then give me their credit card number.
I cannot believe the amount of trust these dickheads put into me, a lowly redshirted laser-slinger. These were people who would verbally abuse me, harass me, scream, yell, pester and generally treat me as something beneath the lump of Fluffy's late night cat puke that they caked off of the designer argyle socks that cost more than they make in a day.
Every time one of those shits oh-so-respectfully tossed me their credit card (They'd never hand it to me, oh no... never just hand it to me) then get all indignant that I ask to check their ID, even though it says in big, block letters 'CHECK ID' on the little 'sign here' strip on the back... I'd just smile... You know the smile, the one that a pudgy Vincent D'Nofrio shot at the sergeant before putting one in his chest while I simply took their reciept and folded it in half and stuck it in a little slot on my register.
Had I been just a little dumber or a bit ballsier, I'd be rolling in all the pre-Pentium 3 generation hardware and pre-Kazaa generation illicit software that I could have purchased on their dimes.
Point being: Why why why do these people who are so abusive to those of us who (A)Handle Their Credit Cards and (B)Handle Their Food treat us in such a manner?
Why is it when I hit ^R that ZSH calls me a cocksucker?
Nice informative article. No mention of which credit card processor this was. It'd be nice to know if it's one that one of my clients uses. Anyone know the identity of the victim?
SONY. Because caucasians are just too damn tall.
I do notice that sometimes, very rarely though, that sites will ask for that extra three digit code on the back of the card, to verify that you do in fact have the card in your hand. This the same concept as a PIN and I don't see why more web sites aren't doing it. It's not like they have to completely revamp their way of accepting credit cards, it should be a very simple fix.
Makes me want to go back to barder. Do you think ThinkGeek would accept two dead chickens and a half wheel of gouda for one of those mini tanks with the camera?
If your credit card was stolen, the terrorist have already won! :)
I, for one, would like to know WHICH credit card processor it was that got hacked so that I know not to use them in the future. Leave it to CNN to leave out the important stuff.
Yeah he gained access to 2.2 million cards, but to bad they are all probably overdrawn! Just about everybody I know complains that their cards are maxed out. :D
I also agree, that out of 2.2 million cards, it's impossible for them to know that all of them are ok and haven't been used.
When all else fails, piss on it. At least you will feel better in some kind of way.
this report says 5 million cards
1 7/ rtr881826.html
http://www.forbes.com/markets/newswire/2003/02/
"Imagine a Beowulf cluster of those!"
Still, this might leave some folks short on cache.
Citizens Bank, a financial institution serving the Northeast, shut down the accounts of 8,800 customers whose card numbers had been accessed after being notified by MasterCard on Friday, bank spokeswoman Pamela Crawley said. All of those accounts were safe, she said.
I'll bet those people are just *thrilled* to have their accounts locked out. How many people are going to find their card mysteriously declined when doing their weekly grocery shop then ? I'm betting the bank hasn't made 8,800 phone calls to explain their position.
Hell of a way for VISA/MC to limit their liability - just cancel their cards ??Never, ever lose a file again. Ever.
If you had read the article, you'd know that the cardholders are not liable for any purchases that may be made with the stolen CC data. Visa and Mastercard have already been contacting banks to let them know which CC#s were stolen.
It's better to troll than karma-whore. It's better to troll than do ANYTHING, in fact.
My Friend recently bought something online for his motorcycle from a place in Spain, the bill came to something like $70, not to much I personally think.
within 10 minutes of him hitting the submit button he got a call from someone at his CC company asking him to verify the sale. We both thought that it was very cool for them to be monitoring apparently all the sales, even the small ones.
moo.
You get the idea.
You'll have that sometimes...
CNN reported today that everyone should panic. PANIC NOW. PANIC! You're not panicing, PANIC DAMMIT! Panic Code Red. PANIC PANIC PANIC AND TUNE INTO CNN AND PANIC!
_nfotxn
I think its time the whole CC system is overhauled!
The lack of authentication is the biggest problem with it. And no, the PVV is not good enough for authentication either, its also printed on the card and some online stores require that number but store it with the CC# anyway.
I'm sure the banks have a huge amount of fraud on cards and eventually these costs get passed on to the customers.
Debit cards with PINs / Smartcards are the way to go.
LOL!!!
Why are so many companies so foolish?
You encrypt the number like crazy when it's traveling to your server. You protect it with all the firewalls and whatnot you can muster. You limit who has legitimate access to it. And you don't encrypt it when it's stored on the server?
I don't get it. Passwords are stored encrypted. Why not credit cards?
For all the time I've spent reassuring my parents that it's okay to pay for things on the Internet because the encryption is impossible to break, things like this make me really nervous. I think we need legislation requiring all company databases that store credit cards to store them encrypted.
That way, if someone does break the encryption and get our credit card numbers, at least we can prosecute them under the DMCA!
I found the meaning of life the other day, but I had write-only access.
or black and maybe even other, it'll be interesting to see who.
obviously the humor in the use of the word "cracker" in the article title was lost.
when just one stolen credit card will buy more box cutters than you and all your friends can carry?
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
"...none of them seem to have been used fraudulently."
...sheeseh.
:) Let's place bets on how much longer c'cards survive, until another scheme comes along to shift the balance of buying power once again. I'm fed up with all the time I have to put in when it comes to monitoring for fraud like this.
What, we should expect a stolen c'card ## to be used legally?
The way things are going, I'd say my c'card info is safer in the hands of the [insert your favorite eastern block country name here] mafia, then with so called legitimate companies.
I just learned that some outfit was making unauthorized charges, based on the sole fact that someone answered the phone when they supposedly called! They seem to think this amounts to a second contact, the first being some junk mail the postperson brought, and this second contact equals opt-in??!!
I'll say it again...I beginning to trust crooks more than business...and don't make me agree that they're one and the same
...or just never there in the first place.
/me shakes his fist in Mitnicks general direction...
I work at a company that contracts out some IT stuff to a bank, USBANK in fact. Let me tell you, the fact that they are not hacked on a daily basis has more to say about the generosity of hackers than about the security that large banks use. It would be trivial to get into thier machines through ours (not that we do security any better) and completely wreak havoc inside thier networks.
You could just cut them all off. Are there any places left that don't call in credit card purchases? Of course, that would leave 2.2 million credit card users high and dry and they would have to issue 2.2 million new cards. It would cost hundreds of thousands of dollars and do incalculable PR damage. So what to do?
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
I know slashdot's really into using the term cracker for malicious hackers and all, but how malicious can this person really be if he didn't actually use the cards for anything?
When CompUSA comes up on /. as a topic it's usually trying to figure out which one of your possible selections the staff belong to.
Go figure.
KFG
Having read it :) I suspect this CNN article isn't much more than a paraphrase-the-press-release sort of thing. ("A hacker has gained access to as many as 2.2 million Visa and MasterCard accounts, the two companies announced Monday.") Someone else here cites an article saying FIVE million numbers were stolen! I think more probing work is needed.
Also, I love "Both card companies have zero-liability policies, which protect cardholders from being held responsible for unauthorized or fraudulent charges" -- as if they're so generous. For one thing, I think that "policy" is required by federal law, and if not it would be legally insane (and unenforceable) to hold subscribers liable for 3rd party mistakes. An interesting Q might be how long you could wait or fail to notice an ongoing fraudulent use of the card, assuming it didn't get maxed out within minutes.
Anyway, look for more probing articles. I'd like to know what *other* sensitive information might have been accessible? Wouldn't a list of social security numbers be nice? How'd you like to have to go get that number changed? I assume (hope, pray) SSN's weren't stored in the same sloppy way as these CC #'s, but it's perfectly possible at some other institution.
From the article:
The affected accounts make up about one-third of 1 percent of the 560 million MasterCard and Visa cards in the United States. Spokesmen for the two companies said they have notified the banks that issued the affected cards.
Can someone tell me what's so wrong about saying it is "slightly more than 0.3% of bla bla"...
Welley Corporation - SLM Scammers
The security would have had to have been REALLY weak for an inexperienced cracker to get in, and somehow I'm doubting that was the case, so... how exactly are they planning on catching the person (or more likely, group) that did this?
[insert witty comment here]
2.2 million
~280 million people in the country;
2.2
--- = one serious bunch of financial problems.
280
Need help treating your acne? Come here!
Credit cards weren't invented last year. Back when they were invented, this was some major technology. Can you imagine? A piece of plastic with a magnetic stripe on the back? Totally un-hackable! How could it possibly be hacked when most people didn't even have magnetic tapes at home? Most people were still using records to play music. This was state or the art technology. And to fake the card? No way, an "embosser" was probably something guarded as close as the mona lisa painting.
These days, you can buy blanks, printers, mag-stripe writers at most stores. Easily hackable. Too easy in fact.
Like the article mentioned, there are 500 millions cards in the US alone. If you calculate the cost to replace each card at $1, you've got 1/2 a billion $ fee. Companies are slowly going to the "smart (yeah right) card" but that just doesn't cut it. The whole system sucks, but companies don't really care because we're actually paying for it..! Wonder why you have a 21% interest fee while you can borrow at around 5-6% at the bank? The credit card companies simply balance their #'s every year... "ok we lost $X dollar, let's charge X% to customers". It's no magic... So why bother changing the system? It's perfect to the credit companies...!
-- Leeeter than leet
Here are a few things I'd like to see in the credit card infrastructure.
Some of these things would be a major overhaul. Some of them wouldn't. But any of them has to be doable for a lot less money than the credit industry claims it loses to fraud every year. I cannot comprehend why they don't do some of these things.
Hmm.. I wonder... If you had 2.2M card numbers and you took $0.2 from each card, would you be noticed ?
After that story with the RIAA claims about number of seized CD burners, I'm seriously wondering whether this "dangerous cracker" is not in fact some script kiddie who stumbled upon a computer that stored 275,000 CC#s, and the data is mirrored in 7 other computers... ;-)
The ENIAC Demo Competition
It's CRACKER not HACKER if anyone would read the headline. God, even on slashdot...I wonder how hackers get the bad name...
-------
"In times of universal deceit, telling the truth becomes a revolutionary act."
-- George Orwell
Inquiring minds want to know...
If they don't know who did it, not even the tiniest little hint, then how can they know it even happened ? There was a similar 'accident' some time ago where a disgruntled tech ran off with a hard drive full of bank account numbers from his workplace, but they knew who did it and they had the missing hard drive as 'proof'. The trouble was just finding the guy who had skipped the country or something. Much different.
-Billco, Fnarg.com
Maybe he couldn't sell enough CDs...
--
http://cheeser.blog-city.com
lol!
He was chatting in #linuxwarez on efnet last night, but not about cc hacking.
Its because they don't want to create mass panic. Same reason that sci-fi shows say they hide aliens. If people would know that they were affected, they would act inrationally and cancel their cards or whatever. (I dont have a CC, I hope not to either, so I dont know the system well)
I not sure that I agree with the policy, I, of course, believe the whole "Information must be free thing", but I can see their logic.
forget it.
By the Mitnick precedent this guys gonna be in jail for over 400 years. Probably over a hundred of it in solitary. I was happy about one thing.. the writer of the article didn't include a grossly exagerated damage figure. On a serious note though, what was he going to do with all those numbers anyway? It's easy to get the numbers, but how easy is it to come up with all those fake mailboxes.
My Blog
I thought the line item for "500 Britney Spears Collector Plates" looked suspicious.
Table-ized A.I.
I'm proud to say that, so far, it wasn't my debit card! The balance still reads $6.95, just like the last time I checked.
I don't keep a lid on my coffee so when I walk around I look busy -me
If I got 2.2 million credit cards, I might not do anything with them. That would keep the authorities guessing, no one would find me, and it would just prove that I could do it. Plus, after a new mansion, several big LAN parties, and the new European suit, someone might start asking questions.
"Alle reden vom wetter. Wir nicht." - SDS Sozialistischer Deutscher Studentenbund.
j00 4r3 3n73r1ng l337 w0r1d.
And how the stolen cards will be managed? put them in a list of banned card numbers? emit 2Millon free cards for each one of the involved users? What if anyone in that big number says that some buying was done by the cracker and not by him?
In the other hand, 2 Millon CC numbers that can't be used could be used to make jokes to Nigerian scammers... if they still don't learned which key is caps lock maybe they can be fooled with this big time.
Somebody collected 2.2 million AOL disks (not hard to do), and needed CC's to activate them all.
Table-ized A.I.
We (IT People) need to achieve more security, maybe more strict guidelines could help, because a importar part from our industry depends on CC trasactions. USA have a privileged seat on this, because people are used to buy with CC, but for example, in Mexico people are afraid to make an online trasaction, even if it's more risky doing this in person. The people needs to be educated and we need to stop this, crackers are a menace, but i bet lots of sysadmins, security experts now how to crack a server, we need to use this knowledge to get better security, i know it can't be 100% secure, but we need to minimize this problems. Don't get me wrong, i'm not angry, but i live in a country where this kind of problems scare so hard, that they don't want even to check their account balance online, they go to an ATM to do that.
cart.bamart.com is another payment gateway i believe
Lawyers, MBA's, RIAA? A jedi fears not these things!
... as soon as CC companies foot the bill for fraud. Smart card technology is very slowly being adopted, but it would be adopted within 6 months if the powerful CC companies rather than the pwerless merchants pad for the fraud, or at least split the cost of fraud with the merchants.
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
In other news, iBill reports record earnings this week, with 4 accounts charging $9.95 to 2.2 million users..
Mmmmm.. What I could do with $21,890,000.. hehe.
BTW, anyone looking to buy a nice slightly used list of 2.2 million credit cards, Email me..
(just kidding)
Serious? Seriousness is well above my pay grade.
Thats called a credit card identification code. As long as they haven't worn off, they can be usefull. Vendors can also use address verification checks. Problem is, the more strict you are with these checks, the more false negative checks you get. The vendor must balance thier fraud tollerance against lost sales do to over complicated checks.
No matter how subtle the wizard, a knife between the shoulder blades will seriously cramp his style.
Because remember, it's not the credit card processor's fault that your credit card got stolen, it's the evil hacker who bypassed the security. If we told you which credit card processor it was you might take your business elsewhere, therefore ensuring that security of your credit card is taken seriously -- and we don't want that, do we? I mean, that would be like punishing the credit card processor for the evil hacker's crime!
How we know is more important than what we know.
...one thing I should have added to my trollish sounding post above...
So what? Well, just because you think that "the same logic could be applied" to so many other things doesn't mean that a lot of average, reasonable people won't come to the conclusion above. Other people will pose the scenario ("...if this is a big security hole, then the terrorists could exploit it, too...") -- and they will present their own solutions to this problem. Once a problem is pointed out -- and people really start to perceive it as a problem -- people want answers... quick.
I'd say if anyone in the tech community has creative, non-intrusive, technical solutions to the holes that obviously exist in the credit card/online credit card number database model, now would be the time to start getting them talked about...
I would have to say that explosives are the most abused technology in all of history.
Ok so which CC processor got hacked? I am assume that when Visa/MC says 'processor' it means specifically a credit card processing network that receives and authorizes charges from merchants, not a consolidator like PayPal, and not an e-commerce gateway like CyberSource or VeriSign.
Was it Nova, Wells Fargo, Vital, BankAmerica, EFS, or ECHO? These are the only big non-regional credit-card processing networks in the US (AFAIK).
<Begin speculation>
Note that there was no mention of the Internet in the press release. This leads credence to the theory it was a private processor network (not TCP/IP or a web site) that got hacked somehow.
It must be a big processor, otherwise Visa/MC would finger them (and therefore shift the blame). It obviously wasn't Amex or Novus as they both offer competing plastic. And I doubt it was a bank-level processor like US Bancorp (again because they are smaller and would have been fingered.)
The people victimized are not just e-commerce shoppers but also customers at the grocery store, the shopping mall, etc. My worry is that it was a really big processor like Nova, which means that 2.2 million could be the tip of the iceberg.
<End speculation>
..turns out I had unauthorized charges of around $21 on my cc last week.
I am just plain unlucky.
-- bearclaw
This story would be more interesting if every last one of the stolen credit card numbers had been used fraudulently. Now that would be an exploit!
-kgj
It's not easy to get your money back.
I recently noticed a double charge on my account, except that one charge was in LA and the other was in NY...hmm.. I haven't been to either place in the last six months.So I called the Credit Card Co, they said "Based on our records, it appears the card was swiped at both locations."
"Interesting..cause it's right here in my goddamn wallet", came the reply.
I was then told to contact the merchant for the fastest resolution -e.g.10-20 business days. Or I could file a fraudulent activity claim with the Credit Card Co, which could take up to 4 months to be resolved.
At least I wouldn't have to pay interest on the disputed amount... BA!Moral of this story...well...I gues you're screwed either way...
Error encountered in IAWebSig.clsSig.Create: Last Procedure: sPrc_Ins_tblSig
500 kg of explosives have been stolen from the police evidence warehouse, but none has exploded yet so there's no danger.
And crackers and other salty biscuits are making plans to take over the world.
"I used to have that really cool,funny sig
Whew! It's a good thing employers don't use your credit history to determine employment, or we'd really be in-- um, guys? Guys..???
You need a FREE iPod Nano
Yeah of course if you are a fat, slobby, sweaty geek having sex (for 1 minute) with a fat, ugly female geek, of course you are going to wonder what the big deal is. Just because it sucks for you (not literally of course, ugly chicks probably won't do that), doesn't mean you have to be a little bitch about it. Other people are enjoying it. (shock!)
"Credit cards weren't invented last year. Back when they were invented, this was some major technology. Can you imagine? A piece of plastic with a magnetic stripe on the back?"
No offense, but you have to look back a little farther than that for the roots of credit card technology.
Back when credit cards were REALLY invented (1950), there was no mag stripe, just the embossed account numbers on the plastic. When you presented your card to a merchant, they were supposed to check a book of closed/fraudulent account numbers to make sure yours wasn't listed (I think they mailed these out monthly). The account numbers, like many state's driver's licenses or physician's DEA numbers, could also be checked for internal validity by using an algorithm. (Big flaw in that system was that your clerks had to have passed ninth grade math -- digital calculators were still decades in the future.)
I agree with your point that credit card companies pass costs through rather than absorb them. Fraud is simply a cost of doing business to them, and they make a hell of lot more money if they paper over fraud and ID theft. Why? Because the key to the credit card issuing game is, well, issuing. If publicity about stolen accounts give potential new card holders the willies, then the pyramid starts to fall apart.
Credit cards are the crack cocaine of the financial world, and the card issuers are the guys selling the rocks. They know it's a statistical certainty that x-percent of people who get cards will spend them to the max and then be unable to pay the cards off, and so, prevent being kicked to the highest APR bracket. Your first rock is usually free, too... ID theft and computer fraud are simply a tax the card issuers are willing to pay to keep the crack house open.
So we hear about this cracker who stole two million numbers or whatever. For every one of these guys, how many do we NOT hear about?
Next thing you know, Nilla Waifers will be phreaking...
Heh. I haven't read all the posts on this article yet, but I'm sure I'm not the only one thats thinking about this "coincidence" ...
Starting at the beginning of the month, and every 4 days since then, someone has been using my friends Visa card to buy Calcium Pills and have them shipped to his house. This is the first time this had ever happened to him.
The people made 3 orders using two different emails addresses. When the first orders arrived at the door, he called the Bank and had them put a stop on his card. There were two more attempts made, and the email addresses where the orders originated (at least the order confirmations weren't bounced back) were then delivered to the police, and our district attorney's office. We have yet to hear from anyone on the matter.
Whether this has anything to do with what has happened is beyond me, but its a little interesting that this happened at the same time.
400 Person LAN for Charity: Zion LAN 2005
I would be curious to know what operating system these people are using.
-- Note: If you don't agree with me, don't bother replying. I won't read it.
But what usually is ignored is that while the consumer might not have to pay, the merchant who sold the goodies does have to pay. The credit card issuer doesn't pay for fraudulent charges -- they get "charged back" to the merchant who made the charge, and the merchant pays, plus a "chargeback fee" of $15 - $50 per transaction. It's one thing for a software download to go unpaid, it's quite another for a merchant to ship actual physical goods and not get paid for them.
Eventually the consumer does end up paying for fraudulent credit card charges, but just like insurance premiums, where any individual charges or payments might be small relative to the total public cost of the incident, you can be sure that in the aggregate the fees, interest, and other charges imposed by the credit card issuing banks will cover their losses and still make a profit, and the prices merchants have to charge for goods will, in the long run, certainly have to cover their losses and still make a profit.
In other words, the cost of credit card fraud is shifted away from the consumer (who is innocent of any single fraudulent charge on their particular card, so of course should not be forced to pay it), and becomes instead just part of the cost of doing business for everyone on the other side of the transaction.
In theory, practice and theory are the same. In practice, they rarely are.
2.2 million cards isn't that many so I don't think it was a major gateway. I bet some vender kept credit cards on record and had lousy security. Also if there was a gateway problem we would see some missing AmEx and Discover. Lots of venders just accept Visa and Master (it's the basic package man)
We use a randomly generated code specific to each transaction, user, time, and credit card that only our bank (in theory) can track back to an actual credit card. We don't know and therefore don't have any of our customer's credit cards.
-888 Geek Help (888-433-5435)
How is it that a credit card company can determine (within hours!) that not a single one out of their +2 MILLION accounts have been tampered with, but yet, it takes them like 3 months to resolve a single dispute over an unauthorized charge to *my* account?
I used to have a pretty good bullshit detector.... Until this Timmy-riffic article came along and broke the fucking needle off, that is.
Bowie J. Poag
The number of cards is too large for any gateway IMHO. I will bet money that a private processor network got hacked, or the central database for said network, i.e., ECHO, EFS or something on that scale.
These networks are used for dialup and leased line access for authorizations. This means your grandmother's card used at the grocery store could now be in the hand of a hax0r.
Reuters is reporting 5 million cards.
"Finally I have to point out that I have no interest in obtaining these numbers (or any others, except my own :-) and I am certainly not advocating credit card fraud. Just saying that if an opportunity like you described (every email box got the list) came my way, I would be very tempted to try and enjoy myself with some humourous (to me) exploits from a safe place and that there would probably be tens or hundreds of thousands of other following suit. Damages would rack up pretty quickly."
An interesting mental excercise (BTW do you crack DirectTV cards?), but the majority of credit card transactions are electronic in nature (yes that includes mail order[1], and web sites). Anyone submitting such a number would be refused, and redflagged. Remember it's not only crime that can move at the speed of light.
[1] Yes I use to handle both.
I like this bit from the same article:
"...more than 2 million MasterCard accounts had been broken into after the processor told it about the problem."
So I was on IRC the other day and some guy messaged me asking if I wanted to buy a tricked out laptop for 250.00 -- I was skeptical and asked why it was so cheap. The guy's response "I use stolen credit card to purchase laptop." I then asked if he accepted COD. He said COD didn't work since the laptop was shipping out of Jersey City and he was located in Russia. Not shady at all.
Yeah, I think the cards have already been used fraudulently. Luckily I'm like the dude from "A Beautiful Mind" when it comes to my bank statements.
Doctor Sbaitso writes "CNN reports that a hacker bypassed the security system
That is NOT a hacker! C'mon, this is Slashdot. The "Doc" should know better, and the editors should too. Just because CNN calls them hackers doesn't mean we should within our community, as well. Doing so only validates their misuse of the term. We may not be able to change the mainstream, but we should set a better example and choose our wording more carefully within our own communities. Sheesh.
Repeat after me: hackers create, crackers break. Hackers create, crackers break.
"Wow, you're like some kind of superhero able to ward off happiness and success at every turn."
-- Ryan Stiles
It's everywhere you want to be, including some hackers hard drive
This whole thing is part of George W. Bush's new economic stimulus plan! Give everyone's credit card to some millionaire's son, and he spends it all on cars, porn, liquor, etc., and bit by bit the whole economy will recover!
Repeal the DMCA!
They dont actually say somebody hacked into their network from the internet.
Manipulate the moderator system! Mod someone as "overrated" today.
5 cards is not an only dude.
Banaaaana!
I find it very strange.
Visa still does not offer any sort of security for their credit cards. Their method of security is to add 4 more numbers on the end of the CC#, and act as if that is security. Those digits are not even required for 99% of CC sales anyhow, nevermind that anyone stealing the CC# will get the extra digits anyhow.
American Express offers web-based one-time CC#s, but doesn't seem to encourage it's use. It would be even better if CC companies would provide offline programs that ran on handheld computers to generate one-time CC#s, but since almost all banks are partnered with Visa instead, many people can't even take advantage of the online system...
And all the while, with quite a lack of security, identity theft at an all-time high, and more CC# thefts being highly publicised, companies are wondering why people don't buy more products online... Excuse me while I go buy a money order.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Well, I live in Ireland so no, I don't crack directTV cards. The only things I do crack are DVDs so I can watch them under Linux (and I would do this even if there was readily available legal (and hence commercial) software for linux that did this and games which I have purchased that I occassionally use noCD cracks on (not to play extra copies, but just so I don't have to have the CDs with me if I fancy a game). Now, the question is what odds is it to me if they redflag my bogus information from a net-cafe and are you not suggesting that these 2.2 million cards are being cancelled which is not the case (excluding 8000 afaik)? In the current state of affairs, if I had a copy of the list the only way they could stop me is if the purchases were unusual enough to catch the systems attention. A few greps of the list could easily get you a list of CC# that you should have a high success rate with quite easily (i.e. grep Seamus ccnums.txt would give me a high percentage of Irish results and grep Randy ccnums.txt a bunch of Americans).
Never underestimate the dark side of the Source
that way when someone uses your card in a store they have to also produce your drivers license with holograms and photo and of course the signature they're supposed to be checking :)
Hey it's not much but if someone steals my wallet, my credit card is useless to them before i cancel it.
Liberty.
Partially true.
Debit card facts
Unfounded assumptions of ethnicity! What if he/she was black or asian?
It should read ..."Write CHECK ID on it."
Liberty.
I know Visa is a secretive company but I find the lack of information to be seriously annoying.
Which company was hacked?
How do I determine if my CC# is part of the 2.2 million obtained?
Can the same routine the hacker used be used against other companies that process CCs?
Did the hacker access the CCs from the internet site directly or use the internet to access the companies internal Intranet to get the CCs?
Of course, this is Visa/MC. They don't have to be nice to customers and give out good info. What are their customers going to do, cancel their cards? (snicker)
... but the merchants that sell goods over the Internet. I used to run a mail order business. We got a lot of orders with people trying to use stolen credit cards. After a while we got really good at filtering these out. But the cost to learn the lessons was high. I can only sympathize with all the new businesses. If they think that matching the shipping/billing address and security code is enough, they are in for a rude awakening.
At the end of the day, the entire loss from these fraudulent transactions is passed down to the retailers, when clearly the morons who are handing out the credit cards to the thiefs have some responsibility to share.
i dunno... when i calculate:
"The affected accounts make up about one-third of 1 percent of the 560 million MasterCard and Visa cards in the United States"
i get: 1866666.66
seems they could be 400,000 is alot to be off by... i wonder which way..
if each card costs 25-50 cents to replace ... that's 550k-1.1m dollars.... that should have gone to the following:
... I think you get the point...
.... maybe someone who works there just mailed the database home.
TRAINING STAFF: The first line of defense is someone who won't just give 5 million credit card numbers out over the phone.
TRAINING STAFF: The second line of defense is someone who won't let leave their console logged on when they go to the bathroom.
TRAINING STAFF: The third line of defense is someone who doesn't give out his password to someone over the phone.
TRAINING STAFF:
Ok, so maybe it wasn't this easy,
Hacking cash is called "counterfeiting". Its way old school. ;-)
I don't want to be a saltine cracka...I want to be a sugar wafer. I don't know how to accomplish this, but dammit i'll try!
Why was it that the Tech industry Bubble Burst? Hmmmm.
This poster has it right on the head. I had a gas station charge my debit card twice for the same transaction, and my bank still hasn't fixed it. When it happened on my credit card, it was taken care of the next day. Use your credit cards!
I disable sigs...do you?
I wonder what operating systems the company was using?
This is not acceptable. I suggest we boycott the company!
Electronic Music Made Using Linux http://soundcloud.com/polyp
that cred card company to say: yes, they hacked our accounts and used the cc numbers? be serious.
I would like to see it overhauled too. However, I'd prefer to see credit cards that use strong cryptography. These days, we have the proper algorithms pretty much worked out, and we have enough very cheap computing devices available to do it.
Basically, crypto allows you do two helpful things with a good degree of certainty:
Now, the fundamental problem with credit card transactions these days is that, although signatures and photo IDs are used peripherally, fundamentally they are based on the idea (just like social security numbers) that they will be kept secret, because knowing the number allows you to exercise the privileges that come with holding the account. But, there is no way to use the account other than to give away the secret . And worse, you either seriously restrict your buying or you end up giving the secret away to people who you can't really trust and who have no big incentive to protect the secret. And even those who you legitimately want to have the secret (your insurance company) can screw up and overcharge, because they have the power (if not the legal right) to charge your account any amount any number of times once they have the secret.
Cryptography can basically eliminate all those problems.
Here's how I envision a future credit card transaction working:
There would be some drawbacks (big effort to change over, etc.), but the following benefits would, I think, outweigh them:
OK, I could go on, but basically the situation right now is that the system is horribly insecure, and we're relying on legal penalties to try and prevent fraud. But, with strong cryptography, we have the capability to do a million times better, and it really wouldn't be all that inconvenient. And the scary part is, a working prototype of this system can be built in maybe 24 hours using Perl and GPG or similar.
Read this entire discussion and take a drink every time you see a post that says:
Geeze... If only credit card security was as redundant!
...and for a when you want to get really plastered, play with this variation: Take an extra drink when the post has been modded up despite the redundancy.
Online Viagra purchase: $150
Trisexual Midget porn : $55
Buying it on someone elses credit card so that your wife never finds out: Priceless
There's somet things that money can buy but you'd rather it not be your own. For everything else, there's Mastercard.
> On a serious note though, what was he going to do with all those numbers anyway?
<sheepish>I'm sorry guys - I thought I was reading from the National Random Number Server!</sheepish>
Sheesh, evil *and* a jerk. -- Jade
Simple replace the word credit with debt.
Debt card.
Debt limit.
Debt rate.
Suddenly it all makes sense.
Get your own free personal location tracker
This must be widespread. A while ago, my mother told me a similar story about Wells Fargo. She said when we were living in California (so it was at least 20 years ago), they kept getting our account and this other guy's account mixed up--he had the same last name. I wonder if their system just looks at last names instead of account numbers? Either way, their system sucks!
I wonder if anybody knows which company does the actual transactions, a.k.a. who was actually hacked? I know of one large credit card transaction processer, Firepay, but I'm not sure if they're the official one for VISA/MC.
---
"The chances of a demonic possession spreading are remote -- relax."
I dont see anyone asking the obvious question. Why the fuck did a list of 2.2 million card numbers exist in the first place?
Since I work for one, I'll be AC for now.
CC companies foot the bill for fraud, as long as there was no gross negiligence on the part of the merchant (and some other rules). That would translate into vastly dissimilar signatures, a white dude using a black dude's card (with a photo) and so forth.
There are several reasons why cc technology is slow to roll out. The current way liability is distributed between issuer and acquirer (you have your customer relationship to the issuer, while the merchant has their relationship to the acquirer), there is insufficient incentive to invest the billions of dollars a smart card rollout costs. There are even incentives in the system to underreport fraud. It is simply more cost effective to monitor the transactions, and use software+humans to identify fraud as early as possible. Remember, most fraud is "skimming" (copy the magstripe, put it onto a counterfeit card). Skimming will happen as long as we have a magstripe, and there is little incentive for developing nations to implement smart cards. That means that the magstripe will be around for a looong time. So, a smart card solution would only reduce the problems to an unknown degree (since the fraud would migrate across borders). The alternative is to make cards that only work in countries with interoperable smart cards.
Simply put, there are more cost effective ways of handling fraud without alienating your customers (PIN entry is really not an option, since people forget their PIN all the time on low-usage cards)
For online authorizations, I think the one-use cardnumber is a good solution, as well as the idea of a browser plug-in.
Of course, I have wet dreams of biometrics. We might actually see that sometime. There will be a rollout of smart cards at SOME point, and the longer that takes, the lower the extra cost of using biometrics. We'll see.
Thank goodness my Visa Checkcard has a negative balance right now! :)
Denied!
Steve Magruder, Metro Foodist
# Important Stuff: Please try to keep posts on topic.
# Try to reply to other people's comments instead of starting new threads.
hax0r
A third party processor could be, for example, Authorize.net, Verisign, Card Service Intl, or any of the other Payment Gateways, I believe.
I know it sucks that we can't find out which third party processor it is, so we can all stop using them, but I'll take the unpopular position that it's a good idea to not have that information disclosed to the public.
The bad publicity from a mess like this could put a struggling company out of business when everyone stops using them. Do they deserve to go out of business? Sure, but that's not the point.
If a company discovers someone has hacked into one of their servers with access to a database full of credit card numbers, and they know that notifying Visa, MasterCard, and the FBI is going to put them out of business with bad publicity, how many companies are going to report it?
They could rationalize that while there is evidence the server was cracked, there is no proof that someone actually downloaded credit card numbers from the server. Maybe it was a worm that just infected the server and tried to find more vulnerable servers, and did nothing more. Or maybe they were just setting up an ftp server for their mp3 collection.
Is it worth publicly releasing this information that right now only 3 people in the company know about, and all but guarantee they will go out of business? Or should they just rebuild the server, fix the problem, and hope that no credit card numbers were stolen, and if they were, that they don't get traced back to you if they are used fraudulently?
Personally, I was in that situation two years ago, and we opted to just rebuild the server and hope that the 10,000 credit card numbers sitting on the cracked server were never found. Was it the right thing to do? No. Was it illegal? Hard to say. But the negative impact to the company could have been devastating, so we decided to report nothing. We never heard about any of the credit cards being used fraudulently, which wasn't surprising, and we went out of business a year later anyway, which also wasn't surprising.
So my point is, if companies that get cracked can report it without having to go public, Visa and MasterCard would probably be able to stop a lot more fraud before it happens. I would guess the vast majority of known server compromises go unreported now because companies are afraid to come forward and tarnish their name.
i mean, if a script kiddy roots an IIS server with an auto page defacer, technically, he had access to any credit card info stored on that comp, he probably didn't even know that he did, but it could be reported as "gaining access". i wonder if this cracker even found the numbers.
"Cracker Gains Access to 2.2 Million Credit Cards"
something like this happened they got encrypted, burnt to CD and sold to organised crime.
well the Fed was posing as a member of a cartel anyway....the encryption key was a passage from the godfather too... nice touch
In a perfect world, no one would lack anything, so there would be no motivation to steal. And even if you wanted to steal for stealing's sake, what you stole could be easily replaced, so it wouldn't hurt the person you stole it from anyway.
Dem you Saddam! I've told you not to steel from other people!
.... its all about your attitude. And frankly I don't like it. Ring this up for me, this $300 HD. I'm gonna give it to my kid sister for her birthday.... and I'll take 3 more for my Engineering workstation, thanks. And make it snappy, you show the competence of a small snail when it comes to flinging that laser scanner around.
They're not "profiling your consumption," because it's not your money you're spending - it's theirs. Until you pay your bill, you've spent THEIR money, and thus have every right to track what you buy and protect their money from being spent fraudulently.
If someone steals your card and charges up $10K, who do you think gets stuck with the loss? Certainly not you! So if you want them to stop watching what you buy, I'd suggest you agree to be liable for any and all fraudulent charges, without limitation.
Take a Valium, you paranoid, X-File watching, crop-circle worshipping, black-helicopter-fearing freedom-junkie. If you're so scared of it, then cut up your credit card and pay for everything with cash.
On a side note, is anyone else a little worried about how it is presently impossible to live without a bank? In Canada, stores are not obligated to accept cash. That surprised me. It seems to me that cash should be the one things stores should not be allowed to decline. If I choose to pay for my gas with cash, I should be allowed - but that right is not guaranteed in Canada. Think about all the bills you pay in a month. How many of them could be paid with cash? My car payment comes out of my bank account. So does my mortgage. None of my utilities accept cash; cheque or automatic withdrawl only (i.e., bank account required). Is it possible to carry on a normal life without a bank account in present day?
Like woodworking? Build your own picture frames.
Perhaps it's time credit cards went public key. That way you could sign the transaction rather than just handing out the magic number to you account.
KILL WHITEY!!!!!
oh...not that kind of Cracker.
pfft, back in my day, we could generate as many valid credit card numbers as we wanted. of course, those usually got used fraudulently....
I think the moral of the story is that CCs are *really* bad from an authentication point of view. For chrissake, the *number* is enough to let you bypass the thing.
A replacement (probably public key/smartcard) system would be a *much* better idea -- you'd have to physically steal a card to abuse it. No more grabbing a database or a recipt and having free rein.
There are only two drawbacks to this: first, there's a *huge* installed base of CC users and support, and second, anyone instituting it (VISA, whatever) is going to have to overcome temptation to try charging percentages of transactions (the reason we don't have e-cash now is because of overly greedy financial services companies who couldn't manage this).
May we never see th
Credit cards work both ways. Be intelligent, and they will be an asset. Be stupid, and they will be a liability.
Sticking feathers up your butt does not make you a chicken - Tyler Durden
This kind of thing is why I simply refuse to get the Fake Visa, a checking account debit card that has a Visa logo with none of the credit fraud protections of a real credit card, and no PIN like a real debit card.
If your credit card is misused, then a debt is recorded against you that you have not paid yet, and can refuse to pay, with laws to back you up. To misuse a regular debit (ATM) card, the PIN must be known. But the Fake Visa leaves you completly twisting in the wind. If it is misused your money is already gone. You can begin the process of trying to get it back, but any leagal eagle can tell you that getting money back is a completly different universe from refusing to pay it in the first place!
In short, we take comfort in reading this story that we all know the law protects these card owners fairly well. But I am afraid people get these Fake Visa debit cards thinking they have the same protection AND THEY DON'T!
-
-
Tim "The Tool Man" Taylor, my hero and nomination for Greatest System Engineer Of All Time!
Any technology distinguishable from magic is insufficiently advanced. - Geek's corollary to Clarke's law
Its a young industry, and it hasen't showed signs of maturity yet. After all, the most successfull software is also one of the worst.
"We are all geniuses when we dream"
- E.M. Cioran
They are not hackers.. true hackers don't profit or harm things they learn only.
Cracker is the correct term to use.
Gives all us old timers a bad name due to public association.
---- Booth was a patriot ----
Why are we automatically assuming the the guy was white?
Because niggers arent smart enough to pull something like this off
When only digital transactions are allowed due to 'security' and 'safety' reasons, things like this will take on even more ominous proportions.
would only take one bad apple to bring down the entire banking system at that point.
---- Booth was a patriot ----
Don't store your own credit cards, stash them someplace secure. You don't keep your money in a sock under your matress do you? You put it in a bank. Some deal here.
Credit cards are protected against fraud. Check cards, however, are not as well protected. In addition, it is a big hassle as the money is usually deducted from your account rather quickly. Just one more reason this company should be alerting its customers to problem.
/.er
Just another paranoid
I am not a lawyer. This post does not constitute any form of legal advice.
Neural Networks? Umm WHATEVER. Having worked for a credit card processor ranked 17th in the nation (when I left a few years ago), I can tell you that's probably crap.
Visa MIGHT use them, Mastercard is so fucked up, I highly doubt it. We did Merchant Processing. That's the type of company that got hacked, and I'm not surprised. The company I worked for did everything in FOXPRO. That's right. Everyone had full access to the datafiles. Not only that, but the programs were written so anyone could change a DOS variable, and 'become' any other user to the front-end software. VERY bad.
Sure there was a security program, but it wasn't there to protect the cardholder, it was there to protect the COMPANY. Each merchant has limits, and average sales. If the limit, or average sale is exceeded, the money isn't put into their account. If a card is charged twice, for the same amount, both transactions are stopped. Anything that will stop a chargeback from the customer is checked for.
Someone mentioned making sure a card wasn't used in NV and NJ at the same time... That MAY happen at the cardholder banks, but not at the processor. In fact, we did a little cardholder stuff there too. I'm quite sure the TWO people in that department weren't working on cardholder security.
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
While, of course, the person who accessed the numbers bears the bulk of the blame, I also see the bank and credit processing company as culpable.
Each person with a stolen # will have some work to do, if only to change the CC #s on file with eBay, PayPal, auto-mortgage payment systems, etc.
Best Buy can have you arrested
Is this a bad thing?
The retailer should be held accountable for not putting some sort of safety mesure in place. There are a number I know are actively used:
1. Ship to addresses that differ from the address on the account must be added to the account as a ship-to address. New Egg currently does this at least.
2. the 3 digit security code on the back of your card, though I dunno if that info is part of the DB stolen. This is becoming more promenent every day on line.
3. A PIN, visa is currently marketing this as Verified Visa.
One of my biggest problems with Walmart is that they almost never check ID when I write checks. If someone steals my check book and uses it at walmart successfully then walmart is partially to blame.
"Not knowing when the dawn will come, I open every door." - Emily Dickinson
How come CNN coudn't put that in the article? What crap.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
I used to work in a computer store and we resold a lot of badging stuff. A writer used to go for less than 300$ and a printer was around 2000$.
:)
Basically, a small investment for such a (possible) great return. Although, if you get caught... that's another story
-- Leeeter than leet
They have to do that when such things happen.
So people can effectively control their bank account.
Do they expect that all internet users check their bank account usage from now for 12 months or more?
A serious company would do that.
It is better to send 2 million people in panic than 40 million (or 560)
They're so poor they send a press note claiming nobody used the c.cards
Yep, gives me the warm and fuzzy. Give me a break!
mind you, if they only took a few cents from each credit card account, they COULD buy a Ferrari ...
There are ongoing frauds where small amounts in fraudulent "service fees" or subscriptions to porn sites are being charged on hundreds of thousands of cards every month. The charges are small enough that most card holders don't bother to track them down and get hit up month after month for years.
There is a web page about one of these frauds here In this particular fraud the card numbers were taken from a shady bank that did CC transactions for porn sites. The con men would make charges under a variety of entities posing as subscription based porn sites so the card holder would not only be paying for his original porn purchase but other fraudulent ones besides - pretty smart because it wouldn't set of any alarms at the card company (the guy is already making legitimate purchases of that particular product) and the numbers are small enough that the guy wouldn't bother doing anything about it if he even notices. Since it's porn, and some of it he really *did* sign up for, he might be too embarassed to do anything about it even if he realises some of the charges are fraudulent. This particular fraud ended up making between $40 and $50 million dollars off of about 900,000 card holders.
I have the perfect defense against credit fraud on me. I have bad credit.
I tried to buy milk a couple of days ago and they wouldn't take my visa card - now I know why.
Why should the various vendors have a database of CC#s at all? Sorry if this is a dim question, but I don't see it. Many financial transactions, like using your ATM card at the grocery store, get one-time-use transaction numbers that presumably include some encryption. The grocery store doesn't record my ATM card number and PIN (...at least, I don't think so...) all they want is that transaction number, which is only good once for exactly the ammount of sale. Even if you give the vendor's computer your CC# (via web or phone), they only need it long enough to get a valid transaction number from the CCCorp. Why should they keep it longer than that? Maybe this is the next generation of abstraction for these account numbers, a law that says a vendor can only use and store the CC# until they get a transaction/confirmation from the bank, then they have to drop it. I don't have a problem with refusing to do credit business with a vendor who insists on using one of those absurd hardcopy embossing machines to make a CC sale. Most resturants, stores, and gas pumps already print only the last four digits, or an abstract transaction number, on the receipt already.
Any technology distinguishable from magic is insufficiently advanced. - Geek's corollary to Clarke's law
I just love CNN. They even get the numbers wrong in their own articles.
Title: Hacker accesses 5.6 Million Credit cards
Story: Hacker has access to 2.2 Million Credit cards.
I wonder which it is.
Hhaha
Ninnle is as ON topic as can be in the /. world.
I got fraudulently charged last summer. Zero-liability, but big-time hassle. So I abandoned credit cards for life. Using the strength of my check-card credit, I now open an account everywhere I shop. Now, at least I'm not handing over my bank number or credit card number to the disgruntled employee performing service and needing his daily free-base crack doseage.
Emergency car repair? Grabbed a Goodyear card. Clothes? JCPenny account. Granted, this increases my chances for spam and telemarketing by 1000000 percent, but at least it's not an all-purpose charge account the dishonest get their hands on. And even better, I don't have to use my check-card visa to get these other accounts. For example, I got the Goodyear account simply from their calling a secret credit agency and looking me up. And I opened a Blockbuster account with my JCPenny's card! America is wonderful. Who has thoughts on this?
Just wait until the Palladium(tm) chip is in place! Then we don't have to worry about cc fraud ever again either.
Woo hoo!
I'm just wondering where they will attach the chip on my credit card though.
Latest estimates are 5.6 million card numbers...
source: CNN Money
I wonder if this estimate is bound to rise again?
Someone bought a brand new 23" apple cinema display at the CompUSA downtown with my card...
uhhh, DAMN those crooks...
-- Aaron
Now, PINs do not constitute a better security feature. They do help control fraud but you can still borrow a card and ask for the PIN. When was the last time a store clerk checked your card against some other form of photo ID? As for me, never.
Smartcard credit cards will have PINs, but the embossed thing will stay with us for quite a while, especially for cards that can be used abroad.
Could this be the reason I receive newly updated credit cards weekly... who am i kidding
I lay $10,000 that this hack will later be 'revealed' to have been the work of al-Qaeda operatives hailing from (yep) Iraq.
---- oh no - it's the RIAA and their $100000000 fine. I'm gonna take that so seriously...
Looks like my amex got hit with this. Someone from macmall.com called me this morning about two 120gig hard drives I bought that were not being shipped to my billing address. Thus began my morning.
It appears that these items were being shipped to:
Kenneth Beringer
10930 GuildFord Rd
New Orleans, LA 701627
In digging a bit deeper, it looks like this is a nursing home in New Orleans (I'm on in Oregon). My bet is on someone with family there or a worker in the facility.
I also got a call from bestbuy.com with someone attempting to buy a wireless access point and have it shipped to a different location. This guy would not give me the desination.
All in all, looks like about $3000 got dinged onto my Amex account.
"Jesus saves sinners...and redeems them for valuable coupons"
eom
Discover Financial Services and American Express Tuesday joined the list of credit-card companies saying a hacker breached a security system of a company that processes transactions on behalf of merchants... ...
http://money.cnn.com/2003/02/18/technology/creditError encountered in IAWebSig.clsSig.Create: Last Procedure: sPrc_Ins_tblSig
From what I understand, debit cards aren't covered by the same kind of credit protection (because they're not really) than actual personal-line credit cards do; even if they share the same logo.
Any thoughts on whether these cards were affected? I'd imagine the numbers all went through the same network...
I used to work for the 2nd largest CC company. I know the fruad levels and the fake strip stuff is no where near what the pay TV comapines are dealing with. Fake cards that get used are in the Evolis card printer and as far as I can tell, it will not make a card that a real EFTPos terminal will accept.
While a mag stripe writer (that might be able to write a credit card or not) lists for about $300, my bank just sent me a gemplus pc430 smart card writer. The serial version of this is what people used to make smart cards with for the TV market.
I currently work at a place that does point of sale gear. In theory we sell mag stripe writers but our sales of that is close to zero. If you look at the total number of mag stripe writers made and compare it to the the number of gemplus smart card writers, you will see that there are far more people with the gear to write smartcards than mag stripes.
So why does the truth about security always get moded -1 flamebait?
My own article was rejected that raised significant issues not even mentioned here, and this one article nearly off the front page, but just for the record, let me raise the following:
1. The number of disclosed credit cards in this case may be closer to 8 million.
2. If your credit card was compromised, it was the fault of the store for keeping the CC info forever in what amounts to a filing cabinet in a publicly-accessable area -- unless you are a technical person, who should have known better. Not all services have millions of credit card numbers just laying around like this -- only extremely incompetent ones, such as PayPal, who insist on storing your credit card information forever, even if you close the account. This is the only way you build up millions of credit card numbers in a weakly-protected database. Because of the logistics in this case, how many bits of key they use encoding it is typically irrelevant, because the order origination process, controlled by the web pages, has o be able to decrypt it. Why did you allow it to be held there by the merchant? It is sheer stupidity.
3. This is why brick and mortar stores seem more secure. They do not keep your credit card number in a filing cabinet in the show room in case you forget to bring your wallet. PayPal does, making it vulnerable to any burglar or employee with a little knowledge years later who compromises the database, which is not hard to do if it has to be available for automatic remembering of CC numbers during ordering.
4. As customers, we have a right to know which of the major incompetent CC processors, such as PayPal was compromised this time, so we can use it better as an example to ordinary users why not to deal with a company that would forever hold your CC info hostage to the Microsoft Security oxymoron.
I'm suprised that nobody has mentioned this (or at least nobody that I've seen) but the linked article on CNN indicates that 'Hacker accesses 5.6 million credit cards' while the article title is 2.2 million.
CNN Money is now reporting that the total is 8 million affected cards, since Discover and American Express have reported that their card numbers were in the batch stolen.
I find it frustrating that the number of cards stolen is a guess, yet that each company is claiming no instances of fraud as a result. How can they be so sure when they can't decide how many cards and of what type have been stolen?
And they still haven't named the company whose security was breached. Which means I will not be using my card in the near future until they do so. I do not wish to pass my card number through that company unwittingly while they sort out their security issues.
eskwayrd = m^2c^4
forgive the naivety but dont you need the name,expiration date and zip code of the owner of the card to be able to use it?..
im wondering that say,i even get a valid cc number what use is it gonna be since ill either use it on the internet or by phone and generally the above details are required for authentication. is this also the reason that the link claims none of the cc's were fraudulently used?..
-nitin
see subject
score: -1,Troll
penis size: 14,demigod
I pretty much strictly use cash, but I live and work in Las Vegas, where cash is king.
If I can't pay for it with cash, or a money order that was payed for with cash, I'll find somewhere else to buy it.
I don't buy much online, but I have enough friends with CC's, and I pay them cash to make the purchase for me.
I don't have a bank account because I have yet to find a bank where the monthly fees don't negate the interest you SHOULD be earning on YOUR MONEY. Banks make money by charging interest on YOUR MONEY that they loan to people buying a house/car/boat etc. You shouldn't have to pay for that as well.
I don't have a credit card. I learned about credit cards early, when I got my first and only credit card at age 18. I had a $300 limit on a "student" credit card that my then girlfriend ran up in one evening. 3 years and $1500 in fees later, I realized that CC's were nothing more than a scam played on those that had low income and were bad at math.
I now have 2 car payments (both at 1.9%), insurance, rent, cable, 3 telephone bills, water, student loans (the Wife's) and various other bills, all payed by money order.
Life without a bank is blissful. I may not be earning interest (who actually is?), but I'm not paying to spend my money.
oh yeah, I cash my paycheck at the casino, where I actually get MORE than my check is worth. It's usually just a drink, but sometimes it's an additional $10 in nickels :)
THAT's interest for ya....
It seems now that Discover and American Express are joining the list of compromised cards. Here is a report snipit from CNN.com's article... : "Discover and American Express would not disclose how many accounts were involved. In a statement, MasterCard put the overall security breach at about eight million accounts, including 2.2 million of its own cards. Visa said 3.4 million of its cards were affected." You do the math folks... that is 5.6 million from MC/VISA which leaves 2.4 million to be left for DISC and AMX. Fact is that until they knew the CC's were compromised, they couldn't very well verify the legitimacy of the use of the CC's especially if they were used for internet Purchases. Basically, they were covering their asses it seems...as to keep the general public from going into chaos. I know reading this report is somewhat comforting, but I know the reality...why? Because i'm a Geek. By this I mean I can see through the bullshit the media tries to put over on the idiots. but if I check my bank and it's wiped, then someone is going to have to fork out Rent money...and let's not forget the beer money too!! :-p
-IHW
Signatures aren't as big of deal as encryption of course. I want my transaction to be signed by my private key and encrypted to VISA/MC's public key so that the intermediaries only have the encrypted version of the transaction data, not the raw data.
- Michael T. Babcock (Yes, I blog)
The next-generation credit cards are actually being developed and will hit the streets in the next couple of years. The largest difference is that the cards use a chip instead of the old-fashioned magnetic strip (although the strip will also be on the card as a secondary method). The chips are reprogrammable and patches can be sent to the card via the payment network. (I wonder why creates the first credit card virus? :)
It's all based on public-key encryption. The standard's called EMV (website at www.emvco.org), as in Eurocard-Mastercard-Visa.