Slashdot Mirror
178 Arrested In US/EU Credit Card Cloning Ops
eldavojohn writes with this report from Brian Krebs: "Authorities have moved in on 178 people accused of working in credit card cloning labs across the USA and Europe, but with the bulk of the work apparently operating out of Spain. The source states that 'Police in 14 countries participated in a two-year investigation, initiated in Spain, where police have discovered 120,000 stolen credit card numbers and 5,000 cloned cards, and arrested 76 people and dismantled six cloning labs. The raids were made primarily in Romania, France, Italy, Germany, Ireland, and the United States, with arrests also made in Australia, Sweden, Greece, Finland, and Hungary. The detainees are also suspected of armed robbery, blackmail, sexual exploitation, and money-laundering, the police said.' Krebs notes a new credit card debuting at Turkish banks that appears to have a built-in LCD that has a random six-digit number associated with each transaction much like RSA SecurID keys used for computer logins."
if you are going to steal from someone, don't steal from professional thieves.
Close to 200 employees spanning multiple countries. And they take in only 25mil? Not just that but getting cash out of credit card companies I thought was a pain in the ass. Is it 25 mil per year or total? Because if it is total that seems like a shitty business investment. They should just stick to guns, drugs, and prostitution.
Terrific. 6 more ways for a mouth-breathing cash-register operator to fuck up your transaction...
178 people. Remember that number.
Unless the card is radioactive it's not "random"... it's pseudorandom, and therefore based on an algorithm. Figure out the seed (initial vector) and other inputs, and you're right where you started, only your clients feel more secure and the criminals have to spend an extra few bucks. Given that there are multinational laboratories churning out thousands of dup cards, and assuming they have an active distribution network... it's safe to say these aren't the only guys or the first.
#fuckbeta #iamslashdot #dicemustdie
Er, a reasonable working definition of "random" is "you can't predict it." The card changes its displayed number every N seconds. The card's pseudo-random number generator has an algorithm and a seed value which are generally unknown to the user, and unknown to the merchant. It was produced in sync with the server, and continues to compute the numbers in parallel with the server. Even if the thief knows the algorithm, they would require significant time (an understatement) to acquire enough samples to accurately predict the next number that the server is expecting. So, for all practical purposes, yes, it's random.
[
Actually, innovating with new forms of income is why nations are going broke these days.
They're pretending that speculation is investment, borrowing is income, and money-multiplication through circular lending is economic growth.
And hidden among these obvious insanities is a much more subtle one that will snap the rubber band: they track money borrowed to speculate as risk at the interest rate of the loan, not at the rate-of-ruin of the speculation.
The United States was as usual the most innovative, and therefore led the world. To a precipice and beyond. As usual by setting a good example.
Except that it's not a random number or a random number generator.
It's a cipher generator, which is what Stradenko is getting at -- it's also what you're getting at, ironically. If the numbers were totally random, they would be useless. What it's doing is applying the downside of PRNGs - namely, their predictability - to create a sequence that is known to the computers in question, but appears random to the observer. If you seed multiple generators, all with the same algorithm, then you'll get the same sequence. That's terrible if you're running a lotto, but pretty good if you're trying to get two things to sync up.
People have won millions by successfully outguessing PRNGs. I am not sure if this will add more security or if this is just security theater. Given the banking industry's track record, I'm going to go out on a limb and suggest that it's WIWTF security.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
"Even if the thief knows the algorithm, they would require significant time (an understatement) to acquire enough samples to accurately predict the next number that the server is expecting. So, for all practical purposes, yes, it's random."
Yep, digital security, almost always infallible. When was the last time a digitally secure system was broken? About 15 minutes ago? Well, I'll be sleeping easier tonight, surely.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
"This short paper will examine several discovered statistical irregularities
in functions used within the SecurID algorithm: the time
computation and final conversion routines. Where and how these irregularities
can be mitigated by usage and policy are explored."
http://www.linuxsecurity.com/resource_files/cryptography/initial_securid_analysis.pdf
My point is just because it is encased in plastic does not mean that the number can not be determined.
- SR
Hi. SecurID tokencode is calculated from current time + seed fed to the (AES) crypto algorithm. I believe that without knowing the seed it is quite hard to predict next tokencode...
No, it's that nobody can predict it.
You haven't got a hope in hell of predicting the next number I write down, but for me it's a certainty.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
TFA is to PC to say it outright, but putting Romania at the head or the list says it is a Gypsy operation.
These are multi-generational career criminal families. And the Spanish police seem unable to do anything about it.
There was a good documentary on the BBC:
How Gypsy gangs use child thieves