Slashdot Mirror
Cracker Gains Access to 2.2 Million Credit Cards
Doctor Sbaitso writes "CNN reports that a hacker bypassed the security system of a company that processes credit card transactions and gained access to approximately 2.2 million Visa and MasterCard credit cards. Fortunately, none of them seem to have been used fraudulently."
2.2 million...it will be interesting to see what happends when who ever did this starts to sell them in bulk. Who is going to be responsible? The Credit Card companies or the site that got hosed?
Should prove interesting as these numbers start getting used. 2.2 is a little large of a block to just re-issue.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
Let's say this cracker e-mails off these credit card numbers to everyone in the world (those lists of e-mail addresses are only $20, ya' know), can you imagine the offices of Visa and Mastercard?
Actually, things probably wouldn't be that bad.
Who in there right mind would use credit card numbers fraudulently on such a high-profile case? Surely jail time or fines would ensue, and that alone would keep most Americans from jumping to use the numbers.
Then again, there is the chance that many Americans would use those numbers. How about a program that automatically used those numbers to make fraudulent purchases? It would take weeks or months just to sort out bills. Would Visa and Mastercard even be able to handle that amount of traffic? No, something like this could destroy these two companies; it would be almost impossible for them to handle.
Remember, Credit Cards companies use neural networks to analyse transactions and decide whether or not they may be faulty, and the success-rate of these babies is higher than you may suspect (okay, I don't have a web-link, I read it in a pop-sci book on maths, biology and AI). So you may be short a few dollars, which isn't good (don't get me wrong), but unless you normally spend $hitload$ of money, they won't be able to buy a Ferrari or anything (mind you, if they only took a few cents from each credit card account, they COULD buy a Ferrari ...)
This sig intentionally left bla... dammit!
Who's got the whiteout?
Nice informative article. No mention of which credit card processor this was. It'd be nice to know if it's one that one of my clients uses. Anyone know the identity of the victim?
SONY. Because caucasians are just too damn tall.
I do notice that sometimes, very rarely though, that sites will ask for that extra three digit code on the back of the card, to verify that you do in fact have the card in your hand. This the same concept as a PIN and I don't see why more web sites aren't doing it. It's not like they have to completely revamp their way of accepting credit cards, it should be a very simple fix.
Makes me want to go back to barder. Do you think ThinkGeek would accept two dead chickens and a half wheel of gouda for one of those mini tanks with the camera?
this report says 5 million cards
1 7/ rtr881826.html
http://www.forbes.com/markets/newswire/2003/02/
Of course, they don't know. They won't know for a while. But the answer is Nothing Stolen, and the answer will always be Nothing Stolen.
Credit card companies are like insurance companies, it's all about playing the odds, and statistics, and consumer behavioural models. Personally I've stopped trusting them a long time ago. While the public meme is that credit card theft is on the rise due to Internet transactions, I really wonder sometimes. As seen with other examples, the Internet is actually becoming an invaluable tool for revealing nefarious activity (patterns of activity that is) that would have been otherwise obfuscated by natural physical barriers. The media are hardly reliably objective in this sense.
If Jesus wants me it knows where to find me.
CC companies are constantly scanning there databases for "weird" purchases. Like buying gas in NYC at the same time as buying a DVD player in SF.
My dad and stepmom have a shared CC#. Last month, my dad went to San Diego on business, and she stayed home. If she went to Giant at the same time he was getting his rental car gassed up, that'd suck if they termed the card.
Only in slashdot are posts of solidarity modded at -1 Redundant, while posts of antagonism are modded as -1 Flamebait.
Credit cards weren't invented last year. Back when they were invented, this was some major technology. Can you imagine? A piece of plastic with a magnetic stripe on the back? Totally un-hackable! How could it possibly be hacked when most people didn't even have magnetic tapes at home? Most people were still using records to play music. This was state or the art technology. And to fake the card? No way, an "embosser" was probably something guarded as close as the mona lisa painting.
These days, you can buy blanks, printers, mag-stripe writers at most stores. Easily hackable. Too easy in fact.
Like the article mentioned, there are 500 millions cards in the US alone. If you calculate the cost to replace each card at $1, you've got 1/2 a billion $ fee. Companies are slowly going to the "smart (yeah right) card" but that just doesn't cut it. The whole system sucks, but companies don't really care because we're actually paying for it..! Wonder why you have a 21% interest fee while you can borrow at around 5-6% at the bank? The credit card companies simply balance their #'s every year... "ok we lost $X dollar, let's charge X% to customers". It's no magic... So why bother changing the system? It's perfect to the credit companies...!
-- Leeeter than leet
Inquiring minds want to know...
If they don't know who did it, not even the tiniest little hint, then how can they know it even happened ? There was a similar 'accident' some time ago where a disgruntled tech ran off with a hard drive full of bank account numbers from his workplace, but they knew who did it and they had the missing hard drive as 'proof'. The trouble was just finding the guy who had skipped the country or something. Much different.
-Billco, Fnarg.com
Or how about his: Why does the webserver box have the appropriate privileges to run a query on the database for all credit card numbers. Name one situation where the credit card's website would have to query and output an entire credit card number to an outside connection. Why are the systems for public access and confidential access on the same subnet and able to directly communicate.
Sounds like a stupid admin set-up an IIS box and had it access a database server with database administrator privileges. First, you'd have to be a moron to still be using IIS. Second, you'd have to be a total moron to not apply a security patch. Don't give me that "our administrator doesn't have time" bullshit. You do the five-alarm, red-alert security stuff first, the people who complain about lock-ups while playing solitaire can sit and spin. If the management doesn't understand that, fuck 'em. Might as well leave and go elsewhere, since you'll be canned anyway when the network is compromised.
It's pretty apparent to me that "easy to install and configure" is tailor-made for those who are fucking lazy morons who don't do any planning before implementation.
Passwords aren't stored "encrypted." They're stored using a one-way hash. When you type in your password, it's hashed and compared to the stored one-way hash. Idea being that if someone has access to the hashes, they can't (easily) get back the password and you actually need the password, not the hash, for authentication (assuming the authentication system/program hasn't been comprimised, which is really necessary).
You'll note that you always have to type in your password when you log in to your system. You'll note that when a credit card processor wants to make a transaction with a bank, they don't send a hash, but rather an account number. Therefore, they store the account number somewhere, cleartext. It wouldn't help if they stored and tramsmitted hashes - then someone could just steal the hashes and use them just like account numbers.
It would be possible to set up a trust system which uses public key crypto: a concatentation of (CC number + transaction amount + name of parties involved + timestamp) is encrypted using the bank's public key and only this ciphertext is stored and transmitted to the bank. Well, that would require some sort of infrastructure where the processors, merchants and banks interchange keys, and a really fucking big clue stick to convince merchants and processors not to store any of the original information, but instead just record the hash (bye-bye one-click patent). That ain't gonna happen.
Just think of all the plastic explosives terrorists could create with 2.2 million credit cards!
I know I'm going to be modded as a troll for this, but...
So we know that some terrorists were devoted enough to the cause of causing chaos that they actually enrolled themselves in flight school to learn how to do what they did. Is it that much of a stretch to think that they aren't aware that it is possible to steal credit cards numbers off the Internet? And do you think that by devoting the same amount of time to googling and reading some paint-by-numbers script kiddie how-to-steal-credit-cards blog someone dedicated to doing "very bad things" couldn't find a way to pull something like this off?
I'm not sure why everyone chose to mod the parent post as Funny. I find the prospect of Very Angry People stealing millions of credit cards quite frightening, myself...
I would have to say that explosives are the most abused technology in all of history.
Well, I'm betting that they checked to see if those 2.2 million cards had a stastically differing fraud rate, or statistically irregular purchasing patterns (an unusual percentage had bought some porn or something) Not a perfect system, but it'll give you an idea if somebody is trying to get $50 out of every card.
Ok so which CC processor got hacked? I am assume that when Visa/MC says 'processor' it means specifically a credit card processing network that receives and authorizes charges from merchants, not a consolidator like PayPal, and not an e-commerce gateway like CyberSource or VeriSign.
Was it Nova, Wells Fargo, Vital, BankAmerica, EFS, or ECHO? These are the only big non-regional credit-card processing networks in the US (AFAIK).
<Begin speculation>
Note that there was no mention of the Internet in the press release. This leads credence to the theory it was a private processor network (not TCP/IP or a web site) that got hacked somehow.
It must be a big processor, otherwise Visa/MC would finger them (and therefore shift the blame). It obviously wasn't Amex or Novus as they both offer competing plastic. And I doubt it was a bank-level processor like US Bancorp (again because they are smaller and would have been fingered.)
The people victimized are not just e-commerce shoppers but also customers at the grocery store, the shopping mall, etc. My worry is that it was a really big processor like Nova, which means that 2.2 million could be the tip of the iceberg.
<End speculation>
Wells Fargo Bank cancelled my debit/Visa card with no notice.. Why? Because I purchased groceries in Los Angeles, and then there was a $300 purchase in the mid west for a plane ticket a few hours later.
:)
Unfortunately, the $300 ticket was to get my 13 year old step-daughter on a plane to see her dad. We didn't know til we got to the airport and Delta told us my card was stolen..
I pulled out my card, and my ID, and showed it to them.. Didn't matter.. I called the bank. They had no record of who did it, only that it was reported as stolen.
Took me 8 hours on the phones with the bank, airline, and every vendor I had bought from in the surrounding days to find out what happened.
When the airline called to verify the card, the bank took the fact that I was buying a ticket for her to be fraud, and cancelled my card immediately.
I went to the bank to get it fixed. They said they tried to contact me. They had my correct number on file (my cell), but said it was disconnected. I had them call my cell from their desk. Amazingly enough, it rang, and I answered.
I've had banks call me before to verify transactions. I have no problem with that. But, lying about it pisses me off.
I wonder how badly they'd handle me on a road trip. I drive from Florida to California and back on a semi-regular basis.. It takes me three days, with very little sleep. That would probably get the card cancelled too.. I'd hate to be stuck in Kent Texas with no gas and a cancelled credit card, because they thought I had traveled too far.
I had a whole stack of returned items, and a whole lot of merchants to apologize to for the bank's error. I never received an apology from the bank.
A month later (a week before xmas), they accidently closed my bank account. I didn't find out til the ATM took my new card.. Their system said there was fraudulent activity. Another bank error. They put all my funds on hold til Jan 6. Good thing I have friends who would loan me money over Christmas. It really sucks to ask your friends to buy everything.. But, they all got paid back after I got my money back.
Every bill check I had sent out previous got bounced. Wells Fargo *ALSO* charged me $25 per check for NSF, even though the funds were in the account, but they erroniously put on fraud hold by them.
You wouldn't believe how pissed I was when I got to the bank. I was polite at first.. They continued to tell me how they were keeping my money.. So, I got louder.. They threatened to call the cops. I told them to. I *WANTED* a cop to hear them saying that they made a mistake and took my money, and wouldn't give it to me.
The bank security were the only nice people working there. One of the guards told me how they screwed him over too, so he was completely sympathetic. He was just standing around to make sure I didn't get physically violent. No problem there, I don't get physically violent, he doesn't have to do anything but stand there.
Warning! Never Use Wells Fargo Bank!
I finally got the second set of NSF fees dropped after a few hours of screaming.. Hopefully the customers who overheard the incident had second thoughts of keeping their account at Wells Fargo.
[Rant Mode Off]
I'm now using a nice small bank, that doesn't have the same problems. I told them all about it when I opened my new account. They had heard similiar stories before about them. I'm on a first name basis with the new bank, and they love me.
Serious? Seriousness is well above my pay grade.
"Credit cards weren't invented last year. Back when they were invented, this was some major technology. Can you imagine? A piece of plastic with a magnetic stripe on the back?"
No offense, but you have to look back a little farther than that for the roots of credit card technology.
Back when credit cards were REALLY invented (1950), there was no mag stripe, just the embossed account numbers on the plastic. When you presented your card to a merchant, they were supposed to check a book of closed/fraudulent account numbers to make sure yours wasn't listed (I think they mailed these out monthly). The account numbers, like many state's driver's licenses or physician's DEA numbers, could also be checked for internal validity by using an algorithm. (Big flaw in that system was that your clerks had to have passed ninth grade math -- digital calculators were still decades in the future.)
I agree with your point that credit card companies pass costs through rather than absorb them. Fraud is simply a cost of doing business to them, and they make a hell of lot more money if they paper over fraud and ID theft. Why? Because the key to the credit card issuing game is, well, issuing. If publicity about stolen accounts give potential new card holders the willies, then the pyramid starts to fall apart.
Credit cards are the crack cocaine of the financial world, and the card issuers are the guys selling the rocks. They know it's a statistical certainty that x-percent of people who get cards will spend them to the max and then be unable to pay the cards off, and so, prevent being kicked to the highest APR bracket. Your first rock is usually free, too... ID theft and computer fraud are simply a tax the card issuers are willing to pay to keep the crack house open.
So we hear about this cracker who stole two million numbers or whatever. For every one of these guys, how many do we NOT hear about?
Sincgle-use card numbers with all that you describe are already here. My bank here in Sweden offers this for their bank cards, and if your normal bank card includes a Visa function, your one-use number also is a Visa card number.
/Mattias Wadenstein
All the functions you say, first vendor, N transactions, N months. And also a charge limit, so that you can't lose too much money from a bad company either. I'm actually not afraid to give out a credit card number to companies I've never heard of anymore.
The bank? Föreningssparbanken in Sweden.
Too bad that isn't so secure after all. 1 in 150 of those cards can be guessed by simply testing them in ATM terminals.
So, if it didn't require an ATM terminal... wow. We're talking microseconds here?
" We found it astonishing that our MCI and AT&T calling cards had the PIN number stored in the magnetic stripe WITH NO ENCRYPTION! "
Yes, there's a lot of crappy PIN security out there. Best to avoid it.
Check if your card has crappy PIN security! Next time you swipe it through a POS debit machine at your local small store (which doesn't have a full-time linkup to the bank) enter the wrong PIN. If it tells you it's wrong without dialing out, and your bank is like mine and only supports PIN sizes between 4 and 6 digits, there's less than 1 million combinations to try. That shouldn't take a good computer more than a couple of minutes, and unless the debit machine has a demagnetizer, I don't think it can hurt your card. Of course, a smart person wouldn't take chances and would clone it first. Oh, look, now I can't enter the US. Oh well.
I think I'm going to buy the used POS debit machine I saw at the local junkshop. Could be piles of fun. I'll charge myself a dollar on it and see what happens...
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
They dont actually say somebody hacked into their network from the internet.
Manipulate the moderator system! Mod someone as "overrated" today.
I know Visa is a secretive company but I find the lack of information to be seriously annoying.
Which company was hacked?
How do I determine if my CC# is part of the 2.2 million obtained?
Can the same routine the hacker used be used against other companies that process CCs?
Did the hacker access the CCs from the internet site directly or use the internet to access the companies internal Intranet to get the CCs?
Of course, this is Visa/MC. They don't have to be nice to customers and give out good info. What are their customers going to do, cancel their cards? (snicker)
This makes me think that this wasn't just a simple human error by a $6/hr data entry clerk but in fact a serious flaw in some programming logic somewhere. Same thing happened to me in reverse. I got a new ATM card in the mail, started withdrawing money within a few days. I was using online banking so I realized by the end of the week that none of the money was coming out of my account. Called them up but they wouldn't tell me whose account my card was linked to for security reasons (despite sending the card and PIN to my address...can you spot which one is the real security risk?). In talking to the family, found out it was actually coming out of my (teenage) brother's account. They eventually straightened everything out by crediting his account but it wasn't easy. Could see a bad SQL statement causing something like this but not being detectable because it only happens within families...? The moral is find another bank.
if each card costs 25-50 cents to replace ... that's 550k-1.1m dollars.... that should have gone to the following:
... I think you get the point...
.... maybe someone who works there just mailed the database home.
TRAINING STAFF: The first line of defense is someone who won't just give 5 million credit card numbers out over the phone.
TRAINING STAFF: The second line of defense is someone who won't let leave their console logged on when they go to the bathroom.
TRAINING STAFF: The third line of defense is someone who doesn't give out his password to someone over the phone.
TRAINING STAFF:
Ok, so maybe it wasn't this easy,
Pfff... I could even make them by hand, before they started cracking down on correlating expiration date to card number.
Up until about 4 years ago, you could use the CCtest# (4111-1111-1111-1111) to use the credit card phones in LAX and a few other major airports.
I wonder if anybody knows which company does the actual transactions, a.k.a. who was actually hacked? I know of one large credit card transaction processer, Firepay, but I'm not sure if they're the official one for VISA/MC.
---
"The chances of a demonic possession spreading are remote -- relax."
This happened to me about a month back... not with a bank but with Netflix...
...and for some reason, they mailed a DVD with HIS name and account number to MY address and zip code.
Mod me offtopic if you want, but there is something WEIRD about it. My brother and I have totally different addresses, we haven't lived together in over 12 years now -- and that was back in WI -- and now we even live in different states. I've never had an account at Netflix, never even been on their mailing list
Weird.
The only thing we have in common is our SSN being almost identical... but seeing as how I shouldn't even have been in the Netflix DB in the first place, THAT couldn't be it...
Hmmmmm..........
I would have to say that explosives are the most abused technology in all of history.
This is a very interesting story. I would recomend sticking it on a website, so that search engines will index it, and people looking up info on Wells Fargo will find it.
Personally, when I was looking around for a bank, I checked out Wells Fargo. There were three warning signs that prevented me form using them:
1) To enter or exit you have to go through double-doors. Presumably, this should trigger an alarm if someone has a gun, and possibly lock them in. The doors didn't work well normally, and customers had a difficult time going in and out. I asked if the glass on the doors and windows was bullet-proof... When the answer was "no", I realized their double-doors were no security at all, and merely to lull customers into a false sense of security, and possibly deter moronic bank robbers.
2) I overheard a discussion, that one of the employees had refinaced a customer's home loan, but had simply not used the computer properly and signed the contract with the wrong percentage. The contract was signed, but the customer was going to get an unplesant surprise quite soon.
3) When I walked in, I glanced at a computer screen and saw the Windows NT sign-on screen... Nuff said.
I must say, for one single ~10 minute visit, that was more than enough to have me out of there as quickly as possible.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Uh... no. People who pay their bill in full monthly (hi, I'm one) are known in the industry as "deadbeats". That small percentage they take generally just offsets their costs for providing the money and services. There's some profit involved, but not much. Most of the money goes toward covering advertising costs and bad debt (see below).
On the otherhand, they really love people who never pay in full, but still make regular payments. A bit more than the minimum payment is best, since while they bleed you for more with minimum payment, it also increases risk. But 10-20% interest is better than 2% any day of the week, especially since it's compounding interest. Gotta love paying interest on unpaid interest. At least if you're the lender that is.
I used to work for a company that contracted with a sub-prime credit card company - they really wanted the accounts that garnered interest (the average interest on the cards was 28% - and yes, there were entire states they didn't market to because that interest rate is illegal in those states). The entire business model was trying to identify more consumers that had poor enough credit to need a card like this (did I mention the average $50 annual fee? Or the card with a $300 credit limit that had $250 in fees put on it when you signed up?) but wouldn't go delinquint -- which was a problem. The average prime lender has to right off 15%... which is why about a year ago they slashed their IT budget and my company laid off 60% of their staff. Last I heard they were going into debt collector status - buying up bad debt from other credit card companies to turn around and sell it to debt collection agencies. They're still in business last I checked, but barely.
Oh well... better job now anyway.
They have to do that when such things happen.
So people can effectively control their bank account.
Do they expect that all internet users check their bank account usage from now for 12 months or more?
A serious company would do that.
It is better to send 2 million people in panic than 40 million (or 560)
They're so poor they send a press note claiming nobody used the c.cards
mind you, if they only took a few cents from each credit card account, they COULD buy a Ferrari ...
There are ongoing frauds where small amounts in fraudulent "service fees" or subscriptions to porn sites are being charged on hundreds of thousands of cards every month. The charges are small enough that most card holders don't bother to track them down and get hit up month after month for years.
There is a web page about one of these frauds here In this particular fraud the card numbers were taken from a shady bank that did CC transactions for porn sites. The con men would make charges under a variety of entities posing as subscription based porn sites so the card holder would not only be paying for his original porn purchase but other fraudulent ones besides - pretty smart because it wouldn't set of any alarms at the card company (the guy is already making legitimate purchases of that particular product) and the numbers are small enough that the guy wouldn't bother doing anything about it if he even notices. Since it's porn, and some of it he really *did* sign up for, he might be too embarassed to do anything about it even if he realises some of the charges are fraudulent. This particular fraud ended up making between $40 and $50 million dollars off of about 900,000 card holders.
I've always wondered why they didn't make CCs like this:
A credit card sized 10-key (with decimal point, enter, and clear) with small one line LCD (or equivalent device) at top, with a thumbprint authentication utility on the side, and a printed circuit on the back for generating flux to simulate a magnetic strip for use in standard CC readers and maybe for automated amount entry(a circuit tuned to the GPS frequencies of the area where the card is allowed to be used could be embedded to charge small capacitors for power, and also possibly for use in theft detection). Embedded in the card is:
1) Account Private Key (encrypted by a reversible crypto with the key being the output of a perceptron neural net trained to recognize all authorized users thumbprints [or other biometric authentication could and should be used as it becomes viable] with a constant result set [this is much simpler than you would think])
2) Account Public Key (signed by institution [aka VISA or Verisign whichever gets to this idea first])
The card has 4 states:
Off, Amount query, thumbprint authorization, and encrypted transaction display and encrypted transaction activation of magnetic strip.
Essentially the card waits for an authorized thumbprint to activate the card going to the amount input, after the user enters the amount (or maybe the amount can automatically be transferred to the card using the strip or smart card interface or something), the transaction is signed by the private key, and then the signed transaction is made available on the LCD and the pseudo magnetic strip (which is cleared after swiping it or hitting the clear button). You get the point, its just like a remote cert mechanism for transactions. Just an idea.
Occam's razor is the blind faith in the natural selection of least resistance and in universal oversimplification. -- EF
I'm a deadbeat, then (guess I need to start saying dude...).
I agree with you on the credit limit thing - my wife had almost $33000 in debt, most on a single card (a Discover card) when I met her, and she only earned $32000/yr at that time. She was making minimal payments (yet nearly equal to my house payment) monthly and paying off very little principal.
I was just the opposite - I've only paid one interest payment ever, and that because mail took nearly two weeks to get to the CC company because of the Halloween blizzard of 1992 (and no, they didn't let it slide because of the weather - even though I bitched about it). I got my first and only increase ever about 4 months after that - from $3000 to $4250. My brother, with the exact same card and usually a standing balance, has the maximum $50000 limit. My credit rating is outstanding (when I applied for my home equity loan, the lady said she'd never seen one that high), so they sure aren't basing it on that.
Well yes, it is possible to use a credit card number that isn't yours to purchase items. The risk, though, is built into the cost of using the credit cards. And any decent credit card company will not make you pay for false charges. This is much of the reason it costs so much to use a credit card. This cost is usually eaten by the merchant, though, and the consumer rarely sees it.
There are new ways in place to make it a little more difficult for theives to make fradulaent purchases. Most places now make you give them the expiration date of the card and that is checked to be valid in real-time. Also, they can do real-time checks of the name of the card holder as well as the zip code. It's really up to the merchant as to how much risk they want to take. In fact, the merchant will usually get better rates if they implement these anti-fraud measures force the customer to give them their zip code or whatever.
The credit card system is vastly better than the check system as far as fraud goes. There exists a system called ACH (Automated Clearing House, I think) in which you only need the person's name, bank routing number, and bank account number, all of which are always printed right on the front of a personal check. And unlike a credit card that you only hand over temporarily to a merchant, you send checks to people all the time. There are a number of things you can buy online or mailorder using ACH (lots of bill-pay places, etc). Makes you think twice the next time you want to pay some stranger with a personal check.