Slashdot Mirror
Huge Credit Fraud Ring Sends Europeans' Data To Pakistan
marshotel excerpts from a story at the Wall Street Journal: "European law-enforcement officials uncovered a highly sophisticated credit-card fraud ring that funnels account data to Pakistan from hundreds of grocery-store card machines across Europe, according to U.S. intelligence officials and other people familiar with the case. Specialists say the theft technology is the most advanced they have seen, and a person close to British law enforcement said it has affected big retailers including a British unit of Wal-Mart Stores Inc. and Tesco Ltd."
Walmart & Tesco are the same thing. If it means making more money they'd happily sell the info to Pakistan
big retailers including a British unit of Wal-Mart Stores Inc.
Meaning Asda, I guess?
The ONLY reason you actually need one is to travel.
"Once a grocer, always a grocer."
Said by Penelope Keith (as Audrey fforbes-Hamilton) in "To The Manor Born" (http://en.wikipedia.org/wiki/To_the_Manor_Born) to Marjory Frobisher (played by Angela Thorne) about Richard DeVere (played by Peter Bowles) a nouveau riche millionaire supermarket owner.
How that applies here too!
"a British unit of Wal-Mart Stores Inc." means Asda to any Brits reading this.
Milkpowder or card readers, the lesson stays the same: Don't trust the Chinese.
Well, I'm just glad that my current bank provides free insurance up to 50k EUR (while maximum I had on my account is 10 times less than that ;). This insurance works in a very nice way - I can come at a maximum a week later and tell them that some transaction was bogus (means that I discovered that some money disappeared from my account without my authorization). And they will revert that transaction if it's below 50k EUR. I don't know how it works - never tried. Probably I will need to prove it somehow, otherwise I could be buying stuff all around and revert those transactions all time.
But that's in fact my temporary bank account, and for my primary bank account I will never allow to have an online-capable credit card. It's just too easy to get id stolen. Buying stuff online is very useful, but (unfortunately) for safety it requires a separate bank account (in my case with VISA) which has less money and is easier to control.
#
#\ @ ? Colonize Mars
#
To hell with credit cards and plastic. This kind of danger is why I only use cash and keep all my money in a Washington Mutual bank account, where it's safe...
A-Bomb
Seems a small compensation for 150 years of British Grand theivery of India among many other nations. Britain is built upon stolen loot mainly from India, so let them bring the wealth back one credit card at a time.
btw while you all are at it, can you try to recover the Koh-i-Noor diamonds stolen by the Queen of thieves.
ttfn
Well obviously every European is a terrorist. Excuse me, I have go go get myself a firing squad appointment.
A learning experience is one of those things that say, 'You know that thing you just did? Don't do that.' - D. Adams
... why my local Tesco changed every one of its chip-and-PIN readers to a new make and model about 2 months ago. At this point you're probably wonding which make the old devices were, and I can't for the life of me remember. Sorry.
...shame my RSS feed still has it as "European's". I was wondering who this poor unlucky chap was, why defrauding him was so huge and quite how it managed to be a ring with only one person..
--- Band: Joey Ultra
Why bother summarising the article if you're not going to do an actual summary?
I've been saying for years, since I first saw one in the 1990s here in NYC, that giving my PIN to some random ATM in some random "convenience" store to get quick cash is an unacceptable security risk. Especially some random ATM that I use at 2AM after running out of cash drinking in a bar, lost among all the ATMs in the neighborhood in my hazy hangover recollection, to be searched for months or years later when they, or someone else along the line, replay my PIN.
Every login to my account from an insecure location (which might exclude my home and office PC, if they've got certificates installed) should consume a one-time password that cannot be replayed for some later, unauthorized transaction. In fact each OTP should be attached to a specific dollar amount and recipient, with an expiration on the transaction after which even that transaction cannot claim money, or get any access at all.
Attempts to replay the transaction should automatically notify the FBI and the bank's security. I should get a notice of any risk warning above some level that I set, and a security statement listing the notices and their resolution with each monthly bill.
Eventually, people whose ID has been pirated will routinely get that security regime alternative after finding someone liable to pay for it. We should all move to that regime ASAP, rather than wait for the damage to force our hands.
--
make install -not war
So, it's better that the technology they have in place?
In the UK. We're fine. Most of our data has already been stored in a government hard drive and left on a train seat somewhere, and it's not like we have any money in our bank accounts anyway.
I love how the bankers and politicians and other utter cunts of this world are now rushing to accuse t3h 3val h4x0rz in China and Pakistan for the fuck-ups of bankers, politicians and other utter cunts. The Global Economic Meltdown was caused by those yellow and brown people over there, not by our own greedy, irresponsible and predatory financial practices! Seriously!
This theft incident sounds cooler than the TJX one. That was just some guys in a van in the parking lot to a TJ Maxx or Marshalls cracking the WEP key on the Wi-Fi. This actually makes me imagine a whole covert operation to get the technology into the card readers. I wonder what's next!
I remember a year or two ago where some old terminals(which were only used with a local debit card) were fitted with a cell phone and a interface to it and then transmitted the information for each card.(at least that was what they said in the news)
The shops had breakins but not much if anything were missing. There were reports that some had their terminals stolen. And even once it was returned, again this was what the news said, but it sounds strange if people would not catch on.
It was in a old terminal which where about 25 years old. I don't know if the hardware inside had been upgraded in that time, perhaps to something taking up less space. I know the big shield over the keypad was added many years later.
Picture here: http://www.point.dk/upload/Denmark/Billeder/Gamle%20terminaler/DKT_1.jpg
These terminals are not used anymore, the new ones seems to compact to pull the same stunt.
fucking euros are too dumb to see that islam has it's claws in their society. they will succumb to mohammad.
Cash is easier and anonymous too.
Deleted
...it was Diebold?
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
From the article:
"Pretty small but intelligent criminal organizations are pulling off transnational, multicontinent heists that only a foreign intelligence service would have been able to do a few years ago," said Joel F. Brenner, the U.S. government's top counterintelligence officer.
And your willing to believe what the U.S. government's top counterintelligence officer said.
WEB SITE:(under construction)
Political Power in the U.S.
http://tinyurl.com/2sdtvk
My credit card has been ripped in the past. I lost £50 and the rest was refunded. I get the distinct impression that the banks do not care to catch the perpetrators or in fact, stop fraud. It is more cost effective to do the minimum required and get us to fund the losses. Think about it, spend wads of cash on security or just increase bank charges etc to pay for loses. Banks are not interested in fraud. They have already run the numbers.
Don't make your problems my problems!
A quote in the WSJ article says the hackers are performing at a level of sophistication that rivals foreign intelligence services. The implication: Payment card data security requires much, much more than just forcing merchants to lock down data and comply with the PCI (payment card industry data security standard). Card data security is a national security issue. It requires wholesale rethinking of the credit card system. The Federal Trade Commission misunderstands the magnitude of the problem. The FTC is locked in an old-fashioned belief that data in-security is due to stupid merchants (like TJX) treating consumers (and their privacy) "unfairly" by failing to secure their systems. We need fresh thinking and better leadership on this issue from the FTC. --Ben
Benjamin Wright, Dallas, Texas, benjaminwright.us
To be on such a large scale they must have been inserted by someone closely involved - perhaps a distributor but more likely the factory? They are supposed to be tamper resistant.
Of course this is one reason that chip-and-pin is coming, because smartcard data can't be intercepted so easily. OTOH, as they say: if you have physical access other security is irrelevant...
For every expert, there is an equal and opposite expert. - Arthur C. Clarke
We had this happen here in RI about a year or so ago. Except in our case the ring was being run by Armenians.
In that case they had posed as repairmen and then rigged the card machines. It forced Stop & Shop to replace all their credit card readers. But then it brings up another point.
What if these rings manage to get to the card readers before they're delivered to the merchants. I bet that is what happened here.
At what point will the card issuers finally go to 2-factor authentication? The fact that credit cards still "mean" something in 2008 is a joke. It could be fixed, it would be expensive, but it's going to be less expensive than these multi-billion dollar losses.
There's no excuse for this lack of sophitication today. We could do so much better.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Something you have, something you know, and something you are. Security means using at least two out of the three security factors. ATM cards are supposed to be "something you know" (a PIN number) and "something you have" (a card), but unfortunately, the card's only purpose is to hold another number, so it's really "two things you know, one of which must be written in invisible ink". Until we replace all bank and credit cards with electronics that can do public-key cryptography, fraud will continue to rise.
By the way, there's no evidence that anyone from Pakistan has anything to do with this. Most likely, the information is being sent to a compromised server, to conceal the real perpetrators, who could be anywhere.
There are trojans in the wild, that hijack the HTML renderer component. The certificate matches, the secure connection matches, the OTP code matches, it's just the amount entered and the target account number that differs between what is displayed on the confirmation screen and what is being sent over the net. You think you're signing a $10 ebay transaction, while what you just signed is $10k for an account in Philippines.
In other words: computer display and keyboard are not trusted devices anymore. You type one thing, see the same thing appear, but a different thing is being sent.
The solution is one-time confirmation code sent as SMS, including some signed transaction details (amount and some digits from the target account number). It's about impossible to hijack both the computer and the GSM transmission.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
This is the shill with 20+ Slashdot accounts that works for Roy Schestowitz and his corporate overlords. Pay no attention to him.
I can only assume so. This stuff keeps happening over and over again and they don't seem to be bothered enough to keep it from occurring.
There are plenty of ways to stop this sort of thing as other posters have mentioned... but no, the CC industry just can't be bothered.
Of course since most of the banks running them seem to be going out of business, maybe they have more important things on their minds nowadays.
"There are laws that enslave men, and laws that set them free. " - Sean Connery as King Arthur
> they don't seem to be bothered enough
> to keep it from occurring
They will do something about it when customers start to walk away.
I originally got an AMEX Blue card because it had an embedded security chip in it, and AMEX claimed vendors would be required to add chip readers, then you could set your account to only allow transactions on presentation of the physical card. They also promised a USB reader dongle for home use that would verify your physical possession of the card when making online purchases.
None of it went anywhere, as far as I know. I've never seen a device that can read the chip.
Nuke 'em, nuke 'em now. Get india involved. They'll wipe out those pesky pakstaners.
This is very interesting if you start thinking about how they have accomplished this. "Examining the store's credit-card readers, investigators discovered a high-tech bug tucked behind the motherboard. It was small card containing wireless communication technology. The bug would read an individual's card number and the corresponding personal identification number, then package and store the data. The device would once a day call a number in Lahore to upload the data to servers there and obtain instructions on what to steal next." So it was wireless - definitely cellular. So each of these bugs would have a subset of a cell phone capable of sending and receiving text/SMS messages and must have a SIM card(as GSM is universal in Europe) to communicate over the local network perhaps using roaming capabilities. Its extremely inexpensive to buy a SIM card in Pakistan with roaming capabilities - I believe its just a couple of dollars and if the attacker can top up the card remotely so it can sustain these devices forever. Though I do not understand how a cellular device will create strange noises in an other cellular device? "Meanwhile, a security guard at a U.K. grocery store noticed suspicious static on his cellphone and alerted authorities."
A much simpler solution:
1. No more magnetic stripe
2. Make the chip in the card (not the ATM) sign a transaction with a private key stored in the chip and the bank will check with a public key stored in their DB.
3. Sign the transaction with the correct key only when the correct PIN is used or else sign it with a dummy key. This is done for avoiding a rogue machine attempt a brute force attack on your card. Checking if signing was OK a request to the bank is needed and repeated requests will trigger an alarm. This can be done also with a small delay for the response in the chip itself.
Advantages over one time password:
- you don't carry around a one time password generator.
- even if somebody is stealing the data from the bank they do not know the private key only the public one.
- nobody is able to clone your card and the PIN is useless without the card
Is still possible to have a rogue machine that is charging you more than what is displayed but the situation is like this now anyway.
But when the Chip & Pin system came into force Patrick Stewart himself was assuring us on TV ads that there was 'Safety in Numbers'!
He was Jean-Luc Picard in Star Trek and Gurney Halleck in Dune! HOW CAN HE BE WRONG?
props to that guy.
Walk away to where exactly? They are all the same.
Some cards here do offer no-questions-asked protection plans (I know American Express does) against defective goods.
A couple of decades ago, American Express pioneered the concept of "money back, no questions asked" if a product bought with AmEx became broken for any reason during the first 30 days after purchase. They had some dumb commercial on TV featuring a kid feeding porridge into a VCR, and a refund being given for the gummed-up VCR.
A colleague of mine perpetually travelled and regularly put more than $20k per month through his AmEx, so they automatically accepted almost any charge from him. Skipping a long and tortuous story, he bought a used airplane in Australia as part of some hare-brained get-rich-quick scheme (probably caused by alcohol). It was charged to his AmEx! His partner in the scheme was the pilot, who pranged the airplane on the first take-off. He survived, but the plane was a complete write-off.
Rather than accept the partial payment from their basic insurance coverage, my colleague called American Express, since the plane had been bought only a week or so previously. Contrary to their advertising, they asked a great many questions, and wriggled like mad in vain attempts to avoid the refund. Eventually, they cancelled the charge.
American Express tried to impose an inadequate monthly charge limit on him after that, but our mutual boss stood up to them, by threatening to cancel the corporate reliance on AmEx if there were any restrictions. We had almost a hundred perpetual travellers and a couple of hundred regular travellers (I occasionally exceeded US$10k on AmEx in a month). AmEx backed down.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Quite a few things don't make much sense.
Like needing sensitive scales to detect a "small bug" weighing 4oz (possibly they actually ment 4 grammes).
There's also the issue of the wireless communications. Are there really this many unsecured wireless access points near supermarkets?
As well as these communications can't exactly be described as "untraceable" when it's possible to track the destinations down to one city.
Two obvious law enforcement approaches spring to mind.
The first is to block (or at least monitor) communications to the destination IPs. i.e. instead of random/comprehensive monitoring of Joe Public use the appropriate tools against machines used by criminals. Or are ISP's only interested in doing this sort of thing for big entertainment companies, rather than the likes of Scotland Yard.
The other thing to do is to use criminals' own system to put some card details into the system which will be flagged if anyone attempts to use them. Maybe without any warning to the person using them except that instead of a courier delivering their stuff from Amazon they find they have instead won a "free ride in a real police car" or that they enjoy a nice flight (or at least as nice as flying can be these days) but find that when they arrive at their destination there's an interrogation room waiting for them.
Credit card companies also have their own fraud detection systems, which have been known to give holiday makers who have not told their card company where they are going problems. As well as checking if the delivery address for a "cardholder not present" transaction is an address the cardholder has told the issuer about. Since the transactions being bugged are "cardholder" present where are the crooks going to get this information from?
It seems like only last week when they forced us all to use chip & pin, telling us how it would be soooo much better than the old magnetic swipe system. I even heard some people saying it would *reduce* credit card fraud. In fact, I think the level of non-Internet fraud hasn't changed much - may have even gone up a bit since then.
"And the meaning of words; when they cease to function; when will it start worrying you?"
I was just at the store the other day wondering just how much damage could be caused if a wage slave strategically installed a wifi point on the network. I guess I have the answer.
"prang" is a verb meaning crash. It originated in Britain in the early days of aviation to describe an airplane coming into contact with the ground (crashing or landing poorly) such that the airplane is damaged or destroyed. It's commonly used in aviation circles, but is also encountered in Britain in connection with crashing other types of vehicle.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
In the case of keylogging trojans, it's not strictly speaking the banks fault that your PIN was captured. Similarly, it's not necessarily their fault you used a hacked card reader, like the Ingenico 3300 ones widely used in the UK recently found to be fitted with internal cellular data devices for sniffing.
Sure, you can say that they should have higher standards of device certification and maybe a SecurID-RSA-type online bank security system, but that's not going to help you if you're hit by either scenario and your bank decides to play hardball.
Thanks!
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
The National Counterintelligence Executive and Mission Manager for Counterintelligence Joel Brenner is the only source for the whole story. The Times of London writes: "The bugs transmit the information by wireless technology to Lahore, Pakistan, according to a senior American counter-intelligence official. (...) The fraud was revealed by Joel Brenner, the American government's top counter-intelligence officer." The British on the other hand say: Lahore is unconfirmed; Chinese link is unconfirmed, issues with chip and pin machines being compromised at the point of manufacture unconfirmed alltogether (see Times and Telegraph). A contradiction?