Slashdot Mirror
$9 Million ATM Hacking Ring Indicted
Trailrunner7 writes "US and international prosecutors have indicted a criminal ring that they allege was responsible for an ATM scam last November that stole about $9 million from RBS WorldPay. The criminals cracked payroll debit cards and withdrew money from ATMs in hundreds of cities around the world. A federal grand jury in Atlanta has indicted eight men in connection with the scheme, including five Estonians, one Russian, one Moldovan, and one unidentified man. Prosecutors allege that the men 'used sophisticated hacking techniques' to defeat the company's encryption system. The scam involved an elaborate plan in which the attackers first bypassed the encryption on the debit cards, which RBS WorldPay issues to customers for employee payroll purposes. They then raised the limits on the accounts attached to the cards, then provided a network of 'cashers' with 44 counterfeit payroll debit cards, which were used to withdraw more than $9 million from more than 2,100 ATMs in at least 280 cities worldwide, including cities in the United States, Russia, Ukraine, Estonia, Italy, Japan and Canada. The $9 million loss occurred within a span of less than 12 hours; 130 different ATMs in 49 cities were hit within one 30-minute period."
Just earlier, we heard about a hole in Bing cash-back program and many people rightfully stated that not enough care is taken when developing and more importantly, designing secure systems.
This is one more case that proves them right. Bright hackers usually pick the easiest target. Due to the hit and run nature of the theft, I believe that proper real-time monitoring of the system could have prevented most of the attack. Maybe half an hour or less instead of 12 hours time span before it would have been stopped.
Everything I write is lies, read between the lines.
You mean some company doesn't either do direct deposit, or cut you a check?
I don't think I'd like something not going to my checking account...do you have to pay bills and stuff out of this debit card account I'm guessing that the company owns?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
When will banks start upgrading their security?
Me think its the same syndicate as these guys.
Apparently crime DOES pay.
If you are worried that your laptop containing sensitive data might get stolen and thief would there by get the passwords stored in your firefox browser, then here is my suggestion.
Use the finger print or retina recognition so that the laptop operates only when it recognizes you. These are becoming standard these days with IBM T400 series having finger print recognition and Dell Inspiron 15 series having retina recognition.
If you are worried that there are so many passwords to maintain, then yes, I am worried about that too. Open IDs are coming up for help, but there are not there yet.
I, whenever possible use OpenID. then I store my passwords in firefox sxipper (with not all the values default, like I wont store my expiry date of the card, but would have input card number and password) and I dont use finger print recognition as I did not feel the need for it.
Senthil
Well, this is how I see it.
First of all, alleged is an understatement. How they would link bogus accounts, addresses and phone numbers to these 9 people I think would be very hard to do. (i.e. impossible.)
Secondly, really? The most advanced criminal ring in the world? If so, how did they get caught if they are that good? I would be more inclined to believe that they are amateurs.
Why would I think that?
1) Well, first of all, the government cannot look like a putz in public, which is strictly an image problem. So best to dress up the criminals to be world class.
2) #1 reenforces number two, which is, they have NO CHOICE but to capture SOMEONE. The public cannot know that the electronic banking system is so easy to steal money, without direct authorization of course from Congress or the Federal Reserve. (Who by the way, make laws that are illegal (Constitutionally), so they can steal your money legally.)
Loss of confidence in the electronic banking system simply cannot be permitted.
3) Finally as in all fascist states where business and government are basically the same, crimes of this fashion are not considered illegal, they are considered a threat to power.
So keep in mind if you do steal money from the crooks themselves, be aware they may imprison someone who is innocent just because they can't catch you.
Which means you might want to pick a different target.
FYI.
-Hackus
Got Geometrodynamics? Awe, too hard to figure out? Too bad.
But the Moldovan put the decimal in the wrong place. He always misses some mundane detail like this.
The original and much more informative article, written by someone that at least has basic understandings of technology at wired One of the keys to why this is so big can be found in the following... "The hack involved reverse-engineering PINs for payroll debit card accounts" and "Tsurikov conducted reconnaissance of the RBS network after Covelin provided him with information about vulnerabilities in the system. Pleshchuk and Covelin then worked on exploiting the vulnerabilities to obtain access on November 4. Pleschuk allegedly developed the method for reverse-engineering the encrypted PINs." So what it boils down to is that usually something happens to a bank, and it is some stupid CIO or consultant that leaves unencrypted info on a laptop or something similarly stupid, while this seems to be a "legitimate" hack/crack. This involves all the steps of classic vulnerability assesment a pro security consultant would do, but with blackhat intent, including passive recon, 0 days, etc. It should be noted that in the Credit Card fraud underworld, the biggest problem is not getting cards info, including PIN's. The problem is called "cashing out". Often internet currencies (e-gold, etc) and offshore gambling sites are used to launder money, but this is why the "cashiers" usually charge 50 points. They got caught because of how they got the money, and the real special thing here is that they targeted only a few high level payroll accounts. Making their indicment only on 16 counts. I highly doubt they would be expected to pay back every bit of it, and if they are smart they had a contigency plan, hide a million or two in a hole in the ground, and will only serve a handful of years in jail, but my entire last statement is pure speculation as I know very little about how the justice system works in regard to this stuff, barring to say that I have a friend who spent 5 years in prison for non-malicious haking of government computers, while the local young girl murderer gets 3 years....ahh i need to drink less, or maybe more, before posting to /.!
"It's ok, I'm completely secure as long as my iron is off"
Is he the unidentified man? Why does Glen Beck not deny his involvement?
Want some coke?
Um, okay..
For justice, we must go to Don Corleone
http://www.wired.com/threatlevel/2009/11/rbs-worldpay/
"It's ok, I'm completely secure as long as my iron is off"
and a person the prosecutors identified only as "Hacker3."
Hacker 3, a three year old child, was already suspected by the RIAA of copywrite infringement.
Bank Robber: thousands of dollars stolen, but they go to a maximum security prison
ATM fraud ring: millions of dollars stolen, but they go to a medium security prison
Ponzi scheme: billions of dollars stolen, but they go to a minimum security prison.
Bankers: trillions of dollars stolen, and they're given more by the government with a bonus on top
i am always amazed when ring like that is discovered. It must be some incredible especially when it is worldwide coordinated. Makes you wonder that in real world there are doch few cops like you see in cinemas.
God's gift to chicks
used sophisticated hacking techniques
They just opened the machines. Shhh! But don't tell anyone.
One of these characters is already under indictment for similar shenanigans http://www.wired.com/threatlevel/2009/11/rbs-worldpay , so a good bet is that the Feds have a rat, sorry, a cooperative concerned citizen, big deal. The real story, not these unfortunate Estonian freelance security consultants, but that if RBS was stupid enough to get nailed like this, who else is this sloppy with their security? A decent amount of work and planning went into this ( except for the exit strategy), and no one noticed all of the poking and prodding that was going on in RBS' network. Banking regulators have their own IT security compliance audit, that is a lot more serious than PCI certification, so did RBS have a few holes that got covered up for the audit, then put back in production later? We may never know.
On the basis of this post, I propose a new IM-style abbreviation: COL (Chuckle Out Loud).
As in, I just COL'd (because I just did).
Good form, sir!
( Redundancy is ) ^ n
easy money!
Considering the $9 million was taken from 2,100 ATMs, that's over $4,200 per transaction... Most ATMs only have 20's to dispense, so that would be a pretty big pile of cash to carry out of the store/bank/gas station.
I spent 3 years going after someone who defrauded my company for quite some money, and frankly, I wish it was in a different country. The guy was quite bright financially, but instead of using it for honest gain he really HAD to do something shady even if more profitable, honest options were available. This is why we eventually took the lid of the finances he managed and found a large hole where our revenue was supposed to be - hidden by falsified statements.
He was a national, but he played the woefully inadequately trained UK judges for all it was worth. We had all sorts of bizarre lawsuits he started just to keep us too busy to go after him, one even involved his alleging we had his laptop, which he managed to win by wailing at the judge for 3 hours (the judge said that "there must be something to it is he jammered that long" which gives you an idea of how resistant these people are to conmen). He produced some receipts into evidence which were CANCELLED purchases (and of the wrong date) - it was like reading a book and thinking "boy, that could never happen in real life".
Eventually we managed to trip him on one of those lawsuits so he ended up having to pay (which is something he appears not to do on principle) so we managed to bankrupt him and start a global search for his assets. We'll never get our money back, but he'll never get me off his back either, he's become my little pet project - as is the bank that handed him our money after the lawyers had warned him he was no longer on the mandate or an authorised company representative. He had a guy in the bank who waited until he fraudulently changed company records and then quickly closed the account, handing him the money. Thank you, big global bank starting with "H" - you know who you are and I'm about to come after you big time.
I'm a nice guy. You have to go very, very far to piss me off. However, there is a point of no return and then you'll learn a wholly different side to me, on the principle that you had plenty of chance to stop.
Why did I wish it happened in a different country? Well, the police isn't interested to go after fraud, the company registry isn't interested to correct anything unless the police is involved (nice bit of practical recursion here), the judges can be waylaid by the most pathetic arguments known to man because they don't know what the real world looks like and you can't then shoot the f*cker as last resource to functional justice because they've taken the guns away. And if by some unimaginable event you DO manage to get a conviction.. .. you'll discover the jails are full, and he'll walk anyway.
I'd say that in the list of thoroughly f*cked up countries the US certainly doesn't come at the top. The UK is far higher up..
Does anyone have more information on the Hong Kong and Netherlands roles in this case? I blogged a summary of charges, including some of the SQL Statements the baddies were using to monitor, change limits on, and monitor "their" cards from the indictment here: CyberCrime & Doing Time. The part I'm trying to find more data on comes from this bit from the FBI Press Release: Cooperation between the Hong Kong Police Force and the FBI also led to a parallel investigation, resulting in the identification and arrest of two individuals who were responsible for withdrawing RBS WorldPay funds from ATM terminals in Hong Kong. The Netherlands Police Agency National Crime Squad High Tech Crime Unit and the Netherlands National Prosecutor’s Office provided key assistance in the investigation. Does anyone know what the Netherlands Police Agency contributed to the case? Does anyone have information on possible related arrests in Hong Kong? Thanks! GarWarner
This sounds like a LOT of effort! I'd be willing to bet that if they put that much effort and thought into a legal enterprise they likely would have made 10 times as much.
If only they had just taken the fractions of a cent on every transaction they would have gotten away with it.
>The $9 million loss occurred within a span of less than 12 hours; 130 different ATMs in 49 cities were hit within one 30-minute period
This is where being a programmer, it makes sense that it is physically impossible to have that many cards to 1 account used in that many cities, so after the first 4 or 5 like this, you would think you stop the transactions from going on, unless the crime was committed on a realtime schedule where everybody was synched to do the withdrawals all at the exact time (almost to the second)
If this was the case then cuddos to the criminals for now giving the idea to the banks to put all transactions in a queue.
Then again this is the police nabbing the crooks, the banks didnt bother spending their own money to catch the bad guys,
lets use tax payer money for our shortfalls. I guess you could say this was a nicely planned crime, but how did they get caught?
I don't think that an idiot blow-hard crybaby like Glenn Beck would be capable of staging or participating in something so elaborate, but it *is* telling that he hasn't denied his involvement either. I know that a lot of Americans must feel that this is suspicious, and I do too. It's just the way I feel, and I think that Glenn owes it to his supporters to prove that he wasn't involved.
Loans are harder to find than ever before in America. Even small cash boosts for last minute emergencies, holiday shopping, kids, classes, bills and others. The family still deserves a great holiday season even though the economy is slow. The SAFEST and FASTEST way is 60 MINUTE PAYDAY! They get you up to $1500 wired right into your account! It took me less than an hour, although everyone is a little different. You should check it out rather than going through a drawn out credit approval. Plus, it's a %100 Secured Site. What are you waiting for...? www.GetRecessionFree.com