Slashdot Mirror
Cracker Gains Access to 2.2 Million Credit Cards
Doctor Sbaitso writes "CNN reports that a hacker bypassed the security system of a company that processes credit card transactions and gained access to approximately 2.2 million Visa and MasterCard credit cards. Fortunately, none of them seem to have been used fraudulently."
pfft, back in my day, we could generate as many valid credit card numbers as we wanted. of course, those usually got used fraudulently....
Damn white boys need to stay away from them computers!!
I dont like the use of racial slurs like that on /.
So THATs why $5 was paid to Slashdot without me remembering!
Fortunately, none of them seem to have been used fraudulently.
And how exactly do they know that all 2.2 million credit card #'s haven't been used fraudulently? I'm sure that there are at least a small percent of any given set of 2.2 million credit card #'s that are used fraudulently.
damn kevin mitnick!
This is a great security threat for our nation! Just think of all the plastic explosives terrorists could create with 2.2 million credit cards!
---
Hello, Slashdot user. My name is Dr. Sbaitso. I am here to help you.
2.2 million...it will be interesting to see what happends when who ever did this starts to sell them in bulk. Who is going to be responsible? The Credit Card companies or the site that got hosed?
Should prove interesting as these numbers start getting used. 2.2 is a little large of a block to just re-issue.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
I guess tomorrow all the online pr0n stores will be sold out of everything!
You mean 'none of them seem to have been used fradulently YET'
Fortunately, none of them seem to have been used fraudulently
Uh, yeah, because it's so easy to verify that two MILLION credit card numbers haven't been used fraudulently.
I mean, come on, just through coincidence I'm sure some of the physical cards themselves have been stolen recently and used fraudulently.
Comment removed based on user account deletion
I heard on TV that they have contacted the issuing banks. I am going to call tomorrow and find out if mine was hijacked, then if I can get these charges to CompUSA removed
With 2.2 million credit card numbers to check, how do they know that the cards haven't been compromised?
Sure, their owners might not have reported any fraudulent use yet (and the card issuers themselves may not have spotted any) but all it takes is for this hacker/cracker to have made one copy of the records which he then disseminated to one or more friends for a problem to occur.
At the very least, the owners of the system that was broken into should be contacting their customers to let them know that there is a small but real risk that their cards numbers might be out there and that they should double check their statements for any unusual items.
But, given that most companies would see something as proactive as this as marketing suicide (rather than use it to enforce the fact that they do everything to protect the security of their customers), I doubt that they will be so bold.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
Let's say this cracker e-mails off these credit card numbers to everyone in the world (those lists of e-mail addresses are only $20, ya' know), can you imagine the offices of Visa and Mastercard?
Actually, things probably wouldn't be that bad.
Who in there right mind would use credit card numbers fraudulently on such a high-profile case? Surely jail time or fines would ensue, and that alone would keep most Americans from jumping to use the numbers.
Then again, there is the chance that many Americans would use those numbers. How about a program that automatically used those numbers to make fraudulent purchases? It would take weeks or months just to sort out bills. Would Visa and Mastercard even be able to handle that amount of traffic? No, something like this could destroy these two companies; it would be almost impossible for them to handle.
Remember, Credit Cards companies use neural networks to analyse transactions and decide whether or not they may be faulty, and the success-rate of these babies is higher than you may suspect (okay, I don't have a web-link, I read it in a pop-sci book on maths, biology and AI). So you may be short a few dollars, which isn't good (don't get me wrong), but unless you normally spend $hitload$ of money, they won't be able to buy a Ferrari or anything (mind you, if they only took a few cents from each credit card account, they COULD buy a Ferrari ...)
This sig intentionally left bla... dammit!
Who's got the whiteout?
New leaf my ass. Welcome back, Kevin ;-)
I like those odds - not a single fradulent use in 2.2 million cards.
Hell i've had 3 fradulent transactions and only own 3 credit cards and two debit cards.
One thing i've noticed is that my card company seem good at stopping me from spending when they think i'm fradulent. Just put 7 currencies on your card in as many days and alarm bells seem to ring somewhere.... but catching real theives is a little too tricky
Nice informative article. No mention of which credit card processor this was. It'd be nice to know if it's one that one of my clients uses. Anyone know the identity of the victim?
SONY. Because caucasians are just too damn tall.
I do notice that sometimes, very rarely though, that sites will ask for that extra three digit code on the back of the card, to verify that you do in fact have the card in your hand. This the same concept as a PIN and I don't see why more web sites aren't doing it. It's not like they have to completely revamp their way of accepting credit cards, it should be a very simple fix.
Makes me want to go back to barder. Do you think ThinkGeek would accept two dead chickens and a half wheel of gouda for one of those mini tanks with the camera?
this report says 5 million cards
1 7/ rtr881826.html
http://www.forbes.com/markets/newswire/2003/02/
Citizens Bank, a financial institution serving the Northeast, shut down the accounts of 8,800 customers whose card numbers had been accessed after being notified by MasterCard on Friday, bank spokeswoman Pamela Crawley said. All of those accounts were safe, she said.
I'll bet those people are just *thrilled* to have their accounts locked out. How many people are going to find their card mysteriously declined when doing their weekly grocery shop then ? I'm betting the bank hasn't made 8,800 phone calls to explain their position.
Hell of a way for VISA/MC to limit their liability - just cancel their cards ??Never, ever lose a file again. Ever.
You get the idea.
You'll have that sometimes...
How on earth do they know that none of 2.2 million credit cards has been used fradulently in the last 24 hours? Seems pretty impossible to me. I'll bet some of them have for reasons completely unrelated to this hacker anyway. How can you verify something like that on such a huge scale?
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
Your liability if someone steals and uses your debit card and it's provably your fault: every cent in your checking account, every cent in your linked savings, CD, brokerage accounts, and as many overdraw fees as your bank can stick you with.
Vista:XPSP2::ME:98SE
obviously the humor in the use of the word "cracker" in the article title was lost.
From the article, it appears that Visa is saying that none of the flagged numbers have actually been used after the specified date and time.
Here are a few things I'd like to see in the credit card infrastructure.
Some of these things would be a major overhaul. Some of them wouldn't. But any of them has to be doable for a lot less money than the credit industry claims it loses to fraud every year. I cannot comprehend why they don't do some of these things.
It's CRACKER not HACKER if anyone would read the headline. God, even on slashdot...I wonder how hackers get the bad name...
-------
"In times of universal deceit, telling the truth becomes a revolutionary act."
-- George Orwell
Inquiring minds want to know...
"Credit cards weren't invented last year. Back when they were invented, this was some major technology. Can you imagine? A piece of plastic with a magnetic stripe on the back?"
No offense, but you have to look back a little farther than that for the roots of credit card technology.
Back when credit cards were REALLY invented (1950), there was no mag stripe, just the embossed account numbers on the plastic. When you presented your card to a merchant, they were supposed to check a book of closed/fraudulent account numbers to make sure yours wasn't listed (I think they mailed these out monthly). The account numbers, like many state's driver's licenses or physician's DEA numbers, could also be checked for internal validity by using an algorithm. (Big flaw in that system was that your clerks had to have passed ninth grade math -- digital calculators were still decades in the future.)
I agree with your point that credit card companies pass costs through rather than absorb them. Fraud is simply a cost of doing business to them, and they make a hell of lot more money if they paper over fraud and ID theft. Why? Because the key to the credit card issuing game is, well, issuing. If publicity about stolen accounts give potential new card holders the willies, then the pyramid starts to fall apart.
Credit cards are the crack cocaine of the financial world, and the card issuers are the guys selling the rocks. They know it's a statistical certainty that x-percent of people who get cards will spend them to the max and then be unable to pay the cards off, and so, prevent being kicked to the highest APR bracket. Your first rock is usually free, too... ID theft and computer fraud are simply a tax the card issuers are willing to pay to keep the crack house open.
So we hear about this cracker who stole two million numbers or whatever. For every one of these guys, how many do we NOT hear about?
But what usually is ignored is that while the consumer might not have to pay, the merchant who sold the goodies does have to pay. The credit card issuer doesn't pay for fraudulent charges -- they get "charged back" to the merchant who made the charge, and the merchant pays, plus a "chargeback fee" of $15 - $50 per transaction. It's one thing for a software download to go unpaid, it's quite another for a merchant to ship actual physical goods and not get paid for them.
Eventually the consumer does end up paying for fraudulent credit card charges, but just like insurance premiums, where any individual charges or payments might be small relative to the total public cost of the incident, you can be sure that in the aggregate the fees, interest, and other charges imposed by the credit card issuing banks will cover their losses and still make a profit, and the prices merchants have to charge for goods will, in the long run, certainly have to cover their losses and still make a profit.
In other words, the cost of credit card fraud is shifted away from the consumer (who is innocent of any single fraudulent charge on their particular card, so of course should not be forced to pay it), and becomes instead just part of the cost of doing business for everyone on the other side of the transaction.
In theory, practice and theory are the same. In practice, they rarely are.
They dont actually say somebody hacked into their network from the internet.
Manipulate the moderator system! Mod someone as "overrated" today.
Hacking cash is called "counterfeiting". Its way old school. ;-)
Online Viagra purchase: $150
Trisexual Midget porn : $55
Buying it on someone elses credit card so that your wife never finds out: Priceless
There's somet things that money can buy but you'd rather it not be your own. For everything else, there's Mastercard.
Since I work for one, I'll be AC for now.
CC companies foot the bill for fraud, as long as there was no gross negiligence on the part of the merchant (and some other rules). That would translate into vastly dissimilar signatures, a white dude using a black dude's card (with a photo) and so forth.
There are several reasons why cc technology is slow to roll out. The current way liability is distributed between issuer and acquirer (you have your customer relationship to the issuer, while the merchant has their relationship to the acquirer), there is insufficient incentive to invest the billions of dollars a smart card rollout costs. There are even incentives in the system to underreport fraud. It is simply more cost effective to monitor the transactions, and use software+humans to identify fraud as early as possible. Remember, most fraud is "skimming" (copy the magstripe, put it onto a counterfeit card). Skimming will happen as long as we have a magstripe, and there is little incentive for developing nations to implement smart cards. That means that the magstripe will be around for a looong time. So, a smart card solution would only reduce the problems to an unknown degree (since the fraud would migrate across borders). The alternative is to make cards that only work in countries with interoperable smart cards.
Simply put, there are more cost effective ways of handling fraud without alienating your customers (PIN entry is really not an option, since people forget their PIN all the time on low-usage cards)
For online authorizations, I think the one-use cardnumber is a good solution, as well as the idea of a browser plug-in.
Of course, I have wet dreams of biometrics. We might actually see that sometime. There will be a rollout of smart cards at SOME point, and the longer that takes, the lower the extra cost of using biometrics. We'll see.
Personally, I can't even remember the last time I bought something on CC using anything other than an EFTPOS terminal - which automatically verifies every transaction with the bank operating it, as well as keeping an internal 'hotlist' of stolen cards, updated nightly. (Done properly, the call costs somewhere around 1p - at which point, even on a 50p transaction, the 2.5% cut will cover it. The modem racks and servers will cost more, of course, but you need most of that infrastructure in place anyway...)
Are you thinking of the "manual" verification procedures used on suspicious or very large transactions, where the store telephones the bank, who then ask you questions to confirm your identity??
If I were the issuing bank, I'd put a 'verify' flag on the cards immediately (vendor must confirm identity directly, i.e. have you call the bank to check it's really you), and rush a replacement card out to each cardholder. That way, the cardholders are only inconvenienced for the day or two it takes to FedEx (or whatever) the new card out - yes, it's expensive to repeat this for 2.2m people, but compared to the cost of having to honor a string of dishonest transactions you can't bill the cardholder for?
That's exactly what I'm talking about - EFTPOS. There is a myth that they clear every txn - they simply don't (I've worked in shops using them, and more recently in the financial sector). As I said, most shops (particularly large department stores and supermarkets) cannot clear the required number of txns quickly enough, so they set a limit - anything below that is just approved automatically provided the card is not on a watch list. The actual value of the limit varies by shop and by day and is secret (as knowledge of it would be useful to a fraudster).
---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"
Thank goodness my Visa Checkcard has a negative balance right now! :)
Denied!
Steve Magruder, Metro Foodist
Mine was stolen, but the thief's using it less than the wife did.
ba-dum ching!
I think my wife's card was part of this. She got a call from the bank last week telling her that her card was dead.
My father runs a men's wear store. Last month sometime, he was told that any transaction that he didn't call in would result in a $50 fee.
Joe
Joe Batt Solid Design
A third party processor could be, for example, Authorize.net, Verisign, Card Service Intl, or any of the other Payment Gateways, I believe.
I know it sucks that we can't find out which third party processor it is, so we can all stop using them, but I'll take the unpopular position that it's a good idea to not have that information disclosed to the public.
The bad publicity from a mess like this could put a struggling company out of business when everyone stops using them. Do they deserve to go out of business? Sure, but that's not the point.
If a company discovers someone has hacked into one of their servers with access to a database full of credit card numbers, and they know that notifying Visa, MasterCard, and the FBI is going to put them out of business with bad publicity, how many companies are going to report it?
They could rationalize that while there is evidence the server was cracked, there is no proof that someone actually downloaded credit card numbers from the server. Maybe it was a worm that just infected the server and tried to find more vulnerable servers, and did nothing more. Or maybe they were just setting up an ftp server for their mp3 collection.
Is it worth publicly releasing this information that right now only 3 people in the company know about, and all but guarantee they will go out of business? Or should they just rebuild the server, fix the problem, and hope that no credit card numbers were stolen, and if they were, that they don't get traced back to you if they are used fraudulently?
Personally, I was in that situation two years ago, and we opted to just rebuild the server and hope that the 10,000 credit card numbers sitting on the cracked server were never found. Was it the right thing to do? No. Was it illegal? Hard to say. But the negative impact to the company could have been devastating, so we decided to report nothing. We never heard about any of the credit cards being used fraudulently, which wasn't surprising, and we went out of business a year later anyway, which also wasn't surprising.
So my point is, if companies that get cracked can report it without having to go public, Visa and MasterCard would probably be able to stop a lot more fraud before it happens. I would guess the vast majority of known server compromises go unreported now because companies are afraid to come forward and tarnish their name.
They're not "profiling your consumption," because it's not your money you're spending - it's theirs. Until you pay your bill, you've spent THEIR money, and thus have every right to track what you buy and protect their money from being spent fraudulently.
If someone steals your card and charges up $10K, who do you think gets stuck with the loss? Certainly not you! So if you want them to stop watching what you buy, I'd suggest you agree to be liable for any and all fraudulent charges, without limitation.
Take a Valium, you paranoid, X-File watching, crop-circle worshipping, black-helicopter-fearing freedom-junkie. If you're so scared of it, then cut up your credit card and pay for everything with cash.
On a side note, is anyone else a little worried about how it is presently impossible to live without a bank? In Canada, stores are not obligated to accept cash. That surprised me. It seems to me that cash should be the one things stores should not be allowed to decline. If I choose to pay for my gas with cash, I should be allowed - but that right is not guaranteed in Canada. Think about all the bills you pay in a month. How many of them could be paid with cash? My car payment comes out of my bank account. So does my mortgage. None of my utilities accept cash; cheque or automatic withdrawl only (i.e., bank account required). Is it possible to carry on a normal life without a bank account in present day?
Like woodworking? Build your own picture frames.
pfft, back in my day, we could generate as many valid credit card numbers as we wanted. of course, those usually got used fraudulently....
I think the moral of the story is that CCs are *really* bad from an authentication point of view. For chrissake, the *number* is enough to let you bypass the thing.
A replacement (probably public key/smartcard) system would be a *much* better idea -- you'd have to physically steal a card to abuse it. No more grabbing a database or a recipt and having free rein.
There are only two drawbacks to this: first, there's a *huge* installed base of CC users and support, and second, anyone instituting it (VISA, whatever) is going to have to overcome temptation to try charging percentages of transactions (the reason we don't have e-cash now is because of overly greedy financial services companies who couldn't manage this).
May we never see th
Credit cards work both ways. Be intelligent, and they will be an asset. Be stupid, and they will be a liability.
Sticking feathers up your butt does not make you a chicken - Tyler Durden