Slashdot Mirror
11 Charged In TJX, Other Breaches
coondoggie writes "The Justice Department has charged 11 people in connection with the massive theft of credit card numbers from various retailers, including TJX, BJs and OfficeMax. Authorities say the group charged was involved in the theft of more than 40 million credit and debit card numbers. In an indictment returned today by a federal grand jury in Boston, Albert 'Segvec' Gonzalez, of Miami, was charged with computer fraud, wire fraud, access device fraud, aggravated identity theft, and conspiracy for his role in the scheme. Others indicted are from the US, Estonia, China, and Belarus." We've been following the TJX breach since the beginning.
Seems nobody cares.
Thinking I'm silly for not having a credit card.
I kind of need one nowadays, but this kind of thing scares me shartless. How easy would it be to get fiscally wiped out by this kind of thing?
A learning experience is one of those things that say, 'You know that thing you just did? Don't do that.' - D. Adams
guys like this get caught, this is why I seldom do anything important off wire, even on my own wireless network...
"The indictment alleges that during the course of the sophisticated conspiracy, Gonzalez and his co-conspirators obtained the credit and debit card numbers by "wardriving" and hacking into the wireless computer networks of major retailers - including TJX Companies, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW."
If your going to offer a service for the love of God do at least something to make it safe, wide open wireless as a 'perk' is like led tainted lemon aid.
"Ahh! Arrogance and stupidity in the same package, how efficient of you!" --Londo Molari
Because they transmitted customers credit card information in plaintext over an unsecured wireless connection. Not saying they shouldn't be held responsible for their incompetence, but I'm shocked that they actually had to pay out $60,000,000 for it instead of just passing the blame.
Seriously. WTF is "aggravated identity theft"? The only logical thing I can come up with is that he held someone up with a gun or something to steal their credentials. But then wouldn't this in fact BE "aggravated assault" + "identity theft"? My comprehension that they actually made one law by merging two other already illegal things just doesn't sit well.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
let me guess, not a lawyer?
http://www4.law.cornell.edu/uscode/18/usc_sec_18_00001028---A000-.html
(a) Offenses.--
(1) In general.-- Whoever, during and in relation to any felony violation enumerated in subsection (c), knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person shall, in addition to the punishment provided for such felony, be sentenced to a term of imprisonment of 2 years.
(2) Terrorism offense.-- Whoever, during and in relation to any felony violation enumerated in section 2332b (g)(5)(B), knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person or a false identification document shall, in addition to the punishment provided for such felony, be sentenced to a term of imprisonment of 5 years.
(c) Definition.-- For purposes of this section, the term "felony violation enumerated in subsection (c)" means any offense that is a felony violation of--
(1) section 641 (relating to theft of public money, property, or rewards [1]), section 656 (relating to theft, embezzlement, or misapplication by bank officer or employee), or section 664 (relating to theft from employee benefit plans);
(2) section 911 (relating to false personation of citizenship);
(3) section 922 (a)(6) (relating to false statements in connection with the acquisition of a firearm);
(4) any provision contained in this chapter (relating to fraud and false statements), other than this section or section 1028 (a)(7);
(5) any provision contained in chapter 63 (relating to mail, bank, and wire fraud);
(6) any provision contained in chapter 69 (relating to nationality and citizenship);
(7) any provision contained in chapter 75 (relating to passports and visas);
(8) section 523 of the Gramm-Leach-Bliley Act (15 U.S.C. 6823) (relating to obtaining customer information by false pretenses);
(9) section 243 or 266 of the Immigration and Nationality Act (8 U.S.C. 1253 and 1306) (relating to willfully failing to leave the United States after deportation and creating a counterfeit alien registration card);
(10) any provision contained in chapter 8 of title II of the Immigration and Nationality Act (8 U.S.C. 1321 et seq.) (relating to various immigration offenses); or
(11) section 208, 811, 1107(b), 1128B(a), or 1632 of the Social Security Act (42 U.S.C. 408, 1011, 1307 (b), 1320a-7b (a), and 1383a) (relating to false statements relating to programs under the Act).
There's nothing Intelligent about Intelligent Design.
Now. Time to make an example of the fraudsters. Give them the longest time in jail possible by law, preferably in cells shared by men who call themselves Bubba. Then. Time the credit card companies sued TJX and other companies with insufficient concern for customers' online security.
http://en.wikipedia.org/wiki/Aggravation_(legal_concept)
Aggravation, in law, is "any circumstance attending the commission of a crime or tort which increases its guilt or enormity or adds to its injurious consequences, but which is above and beyond the essential constituents of the crime or tort itself."[1]
"Ahh! Arrogance and stupidity in the same package, how efficient of you!" --Londo Molari
Does that mean it won't heal by just spending a blood point or two? Maybe they should call it, aggravating identity theft.(not serious)
What makes a crime aggravated? (serious)
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
Pun intended. I wonder if they can be charged for each INSTANCE of a fraudulent charge. Several thousand years behind bars, consecutive would suit my taste for vengeance. Yes, I know that prison is supposed to be about rehabilitation, not revenge, but still...
Gonzalez and others were allegedly able to conceal and launder their fraud proceeds by using anonymous Internet-based currencies both within the United States and abroad, and by channeling funds through bank accounts in Eastern Europe, the DOJ said.
...WoW gold?
From TFA:"Others indicted are from the US, Estonia, China, and Belarus". Yeah, good luck with that. I'm sure those countries will have no problem handing people over.
Insert witty comment here
And still work in retail security. At least two of these companies did not transmit data in the clear, and in the case of debit pins, none of them did. The debit PIN standard was developed after the old ISO 8583 clear text credit transmission standard. (Yes the iso credit auth format was unencrypted. http://en.wikipedia.org/wiki/ISO_8583. Some credit processors still require it.)
Your processor has to verify your setup before it goes into production, and debit card readers all require the hardware injection of keys. All PAPB verified hardware has to be injected in a secure facility, so itâ(TM)s not possible to buy debit pin pads that fail to meet the standard without collusion between the manufacturer, acquiring bank, and the merchant.
This really scares the crap out of me, since it implies either the keys were compromised, or the debit card readers have a hidden debug mode. Possibly the corporate credit switch which re-encrypts the data before sending it to the authorizing bank was compromised, but most of these things run on obscure platforms like Tandem mid frames with self-destructing Attalla encryption processors and are purpose built. We used no wireless, we had no cleartext.
Skimmers are not possible for the pin pad like they are for the swipe (that's why ATMs now have a "tounge", so you can't stick on a skimmer) We looked for cameras, but the cards were used in hundred of stores in a 13 state or so region. I suspect it appeared to be regional because bank are regional and not all banks noticed.
I worked with the security firm sent out by VISA to clean up these sorts of things, and some 3 letter agencies and we never found a breach. It scares me that you can manage a thing by best practices, to the state of the art, and still not know what happened. I know we did some things poorly, but we handled debit pins in a textbook perfect way.
I hope the method used to capture the debit pins becomes known, I still have retail networks to secure.
This is exactly the sort of case where I wish the US had hard labor as a form of punishment. Let them work off the money they stole.
We need authenticated transactions using public key technology so that an account number or routing number is not sufficient to charge an account. The technology is dirt cheap now and could be built into cell phones. When you make a purchase the vendor should send a payment request with a transaction number to you. You send a signed authorization back to the vendor who then checks it against your balance and public key at the finacial institution. Approval comes back and you're done. If someone uses the store records to get your account number they still don't have your authorization for further purchases.
I seldom do anything important off wire, even on my own wireless network...
Because you run Windows, right? :)
My advice is to use a secure proxy (e.g. over OpenVPN) if you are concerned about local eavesdropping (residence, ISP). I use a VPN for all browsing and email, even from home, but this is particularly advised when travelling and using unknown residential/hotel/office networks.
you had me at #!
Pun intended. I wonder if they can be charged for each INSTANCE of a fraudulent charge. Several thousand years behind bars, consecutive would suit my taste for vengeance. Yes, I know that prison is supposed to be about rehabilitation, not revenge, but still...
My wife's card got stung by the TJ Max fiasco. Hers was the one we use for automatic payments on various accounts. Since none of the vendors with whom we deal sent notice of expiration, and I wasn't keeping close track, between proactively and reactively dealing with this, I probably spent about 12 hours on it. If I were to bill that time @$150/hr, they'd owe me $1800. A 3x multiple ($5400) for recompense due to those loses being incurred through the commission of a crime seems fair to me.
So, multiply something like that by the number of aggrieved (take an average if necessary) and let them pay it back or work it off.
Go ahead and credit mine to my account. Well, the $2 left after the lawyers take their cut anyway.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
It is a different place.
Slashdot editors are fuckless wonders !
Can someone explain where the money comes from? The cardholders aren't responsible for the charges as long as they report them in time, the card company probably won't cover the charges, and the criminals won't be paying full restitution even if it's part of their sentence. So who pays for all this? Is it like counterfeit money added to the economy?
TJ Maxx and BJs Warehouse club are essentially sibling companies, both having been spawned by the same parent company, the old Zayre department store chain.
Zayre was kind of like a shabbier version of K-Mart, maybe something like today's Family Dollar. Zayre died about 20 years ago thanks to Walmart's relentless pressure.
Anyway, Zayre was reknowned for their idiotic management and piss-poor operations. It was a pathetic store that deserved to die, and did. But not before spinning off BJs and then mutating Zayre corporate itself into TJX.
There is a LOT of old Zayre blood in both companies so I'd look there for some common flaw in the way they handle credit cards. I bet it's there.
... this guy isn't going to be the next Kevin Mitnick.
"Yes, I have a Disaster Recovery Plan. It's called my Resume"
The cheapskate CEOs, CFOs, CTOs, CIOs, and PHBs should also be indicted for aiding and abetting, maybe a RICO charge for unintentional co-conspirators in stupidity.
I am sure that these corporations went to the top of the list as targets of opportunity for "security consultants", hardware vendors and other information solution providers.
An ounce of prevention ...
I hope he suffers the same fate as the spam king
Shameless plug alert: Game server control panel
Geeks + bikes always makes me a bit nervous, one of my high school math teachers was killed by a traffic accident he had while biking to school; and then as an adult I read about Jerry Keiper dying similarly.
And yes, being a fan of Bruce Schneier, I understand that this nervousness is probably not commensurate with the actual risks involved in traveling by bicycle.