Slashdot Mirror
Massive Online ID Fraud Ring Busted
Iphtashu Fitz writes "CNet News is reporting that the US Secret Service in conjunction with authorities in six foreign countries have arrested 28 people in the last 48 hours on charges of identity theft, computer fraud, credit card fraud and conspiracy. Dubbed Operation Firewall, the Secret Service identified a group of people who stole over 1.7 million credit card numbers as well as a passport-forging facility in Bulgaria. The investigation started in July 2003 when the Secret Service began investigating an unspecified financial crime. They identified the website Shadowcrew.com whose members traded tutorials and information about identity theft and forgery and exchanged sensitive personal and financial information. The Shadowcrew website has since undergone a makeover thanks to the Secret Service. A press release about the operation can also be found on their website."
Hey this is the kind of case law enforcement needs. Take down the big boys. As much as some of you like to flame the USSS, you gotta give them credit for this one!
Identity theft can destroy people, literally. Not to mention the years it could take to clean up the damage. This is excellent, and hopefully more busts will follow. :)
US businesses that currently accept chip and PIN/signature
The fed-version of their website is priceless. I especially like the music and the picture of hands reaching through the bars of a jail cell.
"Weapons should be hardy rather than decorative" - Miyamoto Musashi
I think that goes for OS's too
... how long before the US Secret Service gets served a writ by the RIAA for damages related to the use of the Mission Impossible theme tune? ;)
Life is like a sewer; what you get out of it depends on what you put into it...
Morons. If you want to conspire, wouldn't it be smart to do it somewhere with a wee bit less conspicuous name than shadow crew?
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
"...a group of people who stole ... a passport-forging facility in Bulgaria."
;)
Sorry, just had to nitpick.
I'm sorry if I haven't offended anyone
What makes that picture especially scary for the members when they visit it is that there is no computer in that jail cell. No computer for 10 years?!? That's worse than a death sentance to some of them!
I like the phrase: :-)
Aren't they supposed to be secret?
"CONTACT YOUR LOCAL UNITED STATES SECRET SERVICE FIELD OFFICE....BEFORE WE CONTACT YOU!!"
Yeah! like I know where the local offices are
Is it like a franchise? You get macdonalds and right next to it "your local us secret service office"!
Great!
READY.
PRINT ""+-0
I find the website hilarious, especially the bottom line:
"RECENT NEWS REPORTS SHOULD INFORM YOU THAT THE SECRET SERVICE IS INVESTIGATING YOUR CRIMINAL ACTIVITY. CONTACT YOUR LOCAL UNITED STATES SECRET SERVICE FIELD OFFICE....BEFORE WE CONTACT YOU!!"
That is a hilarious signature they have left, but this seems so funny that I'm actually surpised that the Secret Service is having this much of a ball on the website, not something I expect, but like to see!
What I would really like, more than the arrest of identity thieves, is the entire identification system become more immune to this kind of theft. By simply eliminating the suspects, the actual threats posed by them have only been reduced in number, not in level of threat. All those identity insecurities still exist in the system waiting to be taken advantage of the next time some palooka decides it's worth it to skim off a few credit card numbers.
I surely don't have the solution to fix the identity theft problem. In fact, I would leave it to my colleagues here at Slashdot who are much more knowledgable about security issues than I am to hammer out the fine details of a more secure system.
As we become more dependent upon our identification numbers, credit card numbers, social security numbers, and every other number which identifies and tracks us, we open ourselves up to this kind of identity theft threat. The solution is not simply to lock up the perpetrators, it must be a technical solution which makes it difficult or impossible to steal an identity.
Shame on you, Slashdot!.
My life is in despair because of you!
db
Cig:
ôô
One can only wonder who was responsible. A rival group of fraudsters perhaps, or someone trying to bring them into further disrepute?
... makes me want to commit some crimes of my own lol *hangs over desk, typing this message*
The Secret Service has not yet learnt how to decode the untold mysteries of the
apparently.
~.~
I'm a peripheral visionary.
From the source-code of the site --No wonder -- the word ShadowCrew does not render properly in Firefox =)
Come on you guys at Secret Service!!! Use a good browser guys
I'm not a US citizen, so I may well be mistaken, but the USSS is part of the Department of Treasury. One of their better known mission is to deal with couterfeit money (beside of protecting the POTUS).
Since ID theft has the potential of screwing up the financial system in a rather major way, I'm not too surprised they got involved on that case.
Anyway, the idea of "defacing" the site was bloddy brilliant. It gives the strong message that the Law can get to the frauders level in order to catch them. I'm pretty sure the message got through to a few people in a much stronger way than a simple press release would have.
How long will the will they take to check on all Slashdotters that clicked on the link? I think we just made their job just grew up a bit! :)
now watch the RIAA prosecute the secret service under the DMCA for illegally distributing copyrighted music through a website operated by the secret service...
Darkprofits and Shadowcrew.com? Come on.... they should have gone with shinyfunplace.com or fluffylegitimateactivity.com...
What do you expect to happen if you run imgoingtokillthepresident.com? Happy fun time?
yo.
the secret service investigate and prosecute forgery. read it on their web site:
m l
http://www.secretservice.gov/investigations.sht
"The Secret Service was established as a law enforcement agency in 1865. While most people associate the Secret Service with Presidential protection, our original mandate was to investigate the counterfeiting of U.S. currency--which we still do . Today our primary investigative mission is to safeguard the payment and financial systems of the United States. This has been historically accomplished through the enforcement of the counterfeiting statutes to preserve the integrity of United States currency, coin and financial obligations. Since 1984, our investigative responsibilities have expanded to include crimes that involve financial institution fraud, computer and telecommunications fraud, false identification documents, access device fraud, advance fee fraud, electronic funds transfers, and money laundering as it relates to our core violations."
I read it like a hint that when you're trying to conceal criminal activities behind a VPN, you'd better make sure the endpoint of the VPN has not been owned by the USSS.
The same goes for encrypted emails and the likes... There's little point in encrypting something if the recipient has had to surrender the key to a law enforcement agency.
But do you really think the secret service changed the website? Very unprofessional of them in that case... IMHO a more appropriate action would have been to just take it down.
Martin
Does it strike anyone else as odd that the Secret Service would deface a website in this manner?
Odd? Unthinkable. Unless you had already rounded up every single important person in the group, why on Earth would you signal to them that they were under investigation? The tone and design looks more like some kid-in-a-basement-circa 2001 than US Government Office circa 2004.
I call bullshit. More likely someone with the relevant passwords put that up when it became clear that they were under investigation.
well lets think about this. 1) Take it down: 3972 members thinking "oh the site's just down temporarily" 2) Put up the cool USSS site: 3972 members scared for their lives so that they stop their illegal activities and turn themselves in to USSS. (Not to mention have a mental breakdown next time they see Mission Impossible!) Hmm..I think it's a damn good decision.
So we can call them the "Hommies?"
They stole an entire facility? I'm not even mad, I'm impressed. wow.
The site seems to be slashdotted or something (doesn't load). Mirrordot to the rescue:8 15e933bda4b46bd/index.html.
http://www.mirrordot.com/stories/837e41d1433a2683
And as for the background sound, the site uses the nonstandard bgsound tag, which will work in IE. It's the theme from Mission: Impossible.
Classic stuff.
Now where am I going to get my passports?
oBet, oBkov, Vrat Vseki, zoV Gora, moDa, aDski, DZHob,
I can see the headline now:
"Hundreds of thousends of nerds arrested for suspicion of identity theft"
Yep - you are going to be arrested within an hour of visiting the site because of the Patriot Act and then you will be sent to Cuba within a day and held as an enemy combatant.
Here's a fun trick: Go to your friend's house and ask if you can check your email quick from their computer and visit the site. Sit across the street and laugh as unmarked vans take your friend away.
A nazdrave... :)
I think the site is now slashdotted, but the wayback machine reveals a bit of what it used to look like.
The title of this should be Department of Homeland Security busts computer users.
Then the 90% of the messages will consist of what is homeland security doing busting innocent computer users and how President Bush had a direct involvment.
Once they see that we were all referred from the same site...
Absolutely this is the kind of case the law enforcers need to investigate and crack down on it hard.
I'll wait with bated breath to see if they really did get the 'Mr Big's and can nail them.
Unfortunately, it has occasionally turned out, with big organised crime operations, that the big guys really got away, and the criminal evidence against the others had crucial flaws, so that in the end, after years of delays and millions of taxpayers money in investigation costs and lawyers fees, even the smaller guys got off too.
I really hope this isn't going to be another one of those. For the time being, we can hope that the cybercops have earned their credit here.
-wb-
Operations get named by pointy-headed bosses. I'm sure the Secret Service, being a governmental organization, has twice the number of PHBs as any corporation.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
AJ: Sir! Yes Sir!
Boss: I want you to go deep undercover, join this identity theft organisation and bring them to justice.
AJ: Sir! Yes Sir!
Boss: Agent Jones.
AJ: what. I'm busy, just one more compile, k.
Boss: Well done Agent Jones, the thieves are locked up and the world's a safer place.
AJ: yo! right on! My l33t undercover hax0r sk1lls roxs!
Boss: hmm. Let me have your mission report.
AJ: yeah yeah, mission documentation is for wimps. Read the source, luke dude.
Boss: such a pity. Yet another brave agent lost to the demands placed upon them. The world's such a cruel place.
In Soviet Russia, the Secret Service local field office contacts YOU before you contact them!
Back on topic, at my last job I worked with the FBI and Secret Service on bank fraud, kiddie porn, etc cases that were hosted on our web servers. Think what you may about them, but they really have their shit together on these types of events and are dead eager to get the offenders in question. The smart person, if they are trying to do anything highly illegal, would do well to go about their business without using the internet. Once you get the attention of the Feds, its usually lights out for the perp. One case I assisted with was a conspirancy ring involving the sale of illegal guns in the UK, using a US based hosting company (my old job). That case broke earlier this year with several arrests and the destruction of the ring. Scotland Yard was the lead on it with backup from the FBI, with cheerful cooperation from us. Our policy was not to go "fishing" for questionble content on our web servers, but once we were made of illegal activity we would preserve evidence and work with the authorities. I've seen pictures on some website that puts tubgirl to shame, usually involving kids. Made me happy when the Feds would follow up with us and would tell us that they got their man (or men)...
"As the intrepid kobold companion continues his journey, he begins to wonder... if priests raises dead, why anybody die?
It's probably cheaper for them to deter people from these actions than it is for them to arrest them.
There's a house around here that was originally used by a group of drug dealers and prostitutes that was located in a bad neighborhood. The police raided it and turned it into a police substation.
"It is better to risk sparing a guilty person than to condemn an innocent one." - Voltaire
I was recently brought on to an e-commerce project...day 1 was stopping the fraudulent orders being sent to Malaysia or to the drop sites in the US. All it takes is a 30 second call to the card company to get the issuing bank's number...99% of the bad cards were verified as stolen from the bank. One card wasn't reported as stolen yet...yay for me.
If Paypal, IIS, etc can figure out key encryption, why can't we?
1) Credit card company creates keys and issues it to the customer...the card number is replaced by a number identifying the key.
2) Payment request certificates are sent to the customer who either signs it or doesn't sign it.
3) Transactions are encrypted using keys....you, your bank, the merchant and the card company can decrypt the info, no one else.
Didn't I just describe SSL/GPG? Oh wait..I did.
It boils down to this: if you can't handle the technology (aka keep spyware off your machine, keep it updated, and keep your card number safe), DON'T USE THE TECHNOLOGY. Write a check...but of course, that's digitized now thanks to Check 21...that old technology will be deprecated very soon in favor of direct debit.
Shadowcrew. I knew I recognized that name.
These guys did some weird stuff. For example, they spammed our internal email addresses at the IRS with offers to host child porn sites. For example, here's one of the emails they sent to an IRS employee, namely me.
But here's where I run out of expertise in how these things work. What on earth were they hoping to accomplish by sending out these spams? Are people actually dumb enough to dial up a phone number sent to them in spam and say "I'd like to host a child porn site. Please set it up for me. Here's my credit card info."?
Or is that phone number one of those things that charges you outrageous sums just for calling it? I wouldn't know; I certainly didn't ring 'em up out of curiosity.
These shadowcrew folks just strike me as weird. I wish I understood their "business model." OTOH, I'm just glad I won't be getting any more emails from them that I have to forward to our investigators.
that probably depends on which "port" Bubba uses for input/output and at what baud rate...
Yes Francis, the world has gone crazy.
I just sent a complaint email to the abuse team responsible for Net access at a particular USA educational institution that is now hosting, at time of writing, a fake eBay 'phish' site. Presumably, it's just a compromised system cracked by outsiders--if not, then somebody there at said institution has got some 'splaning to do!
The Feds may pay lip service to the spam email problem with Band-Aid approaches like the CAN-SPAM Act, but fvck with the USA money supply (via ID theft in this case) and they will take notice!
Oh yeah, whenever a law enforcement agency makes a bust, they always like to keep it hush-hush. That way, the person they busted can't be made an example of and discourage additional people from getting into that illegal line of work.
I'm sure they knew exactly waht they were doing. They probably busted everyone involved in the Shadowcrew group and wanted to leave a nice message to every other group that you're probably being investigated too. It's a standard bluff, and will likely at least make other groups less brazen with what they do (hopefully limiting their harm) if not encourage them to find a more legal line of work.
I'm a big tall mofo.
Wouldn't the best way then to base the resulting hash off a combination of your CC# and the place of business (whatever name they register the charge with your CC company as).
That way, when 5555-5555-5555-5555 221 is mixed with "Denny's Seattle," and "2004-10-26-23-22-11" (time/date). the latter half of a verification code comes up with ID "EDJLLKJEWO-2."
The first part could be a MD5-style hash (semi-random), so that one can't generate your own hash by knowing the encoding method. The latter part, however, could be reversed back using your CC # to get "Denny's Seattle 2004-10-27 11:22:11pm" and bust the dude working front desk at Denny's during that time.
*Denny's is used purely as example, I've never known anyone to have their CC# hijacked from there.