Slashdot Mirror
The Great Cyberheist
theodp writes "In this week's cover story, the NY Times Magazine delves into the mind of Albert Gonzalez, the hacker who is currently doing time (the longest sentence ever handed down for computer crime in the US) for masterminding attacks on the nation's leading retailers, reportedly costing TJ Maxx, Heartland, and other victimized companies more than $400 million. And that may just be the tip of the iceberg. 'The majority of the stuff I hacked was never brought into public light,' said one of Gonzalez's partners-in-crime. Another claims there 'were major chains and big hacks that would dwarf TJX. I'm just waiting for them to indict us for the rest of them.' Online fraud is still rampant in the US, but statistics show a major drop in 2009 from previous years when Gonzalez was active. While reportedly not a gifted programmer, even the Feds that Gonzalez two-timed admired his ingenuity, likening him to top CEOs. When asked how Gonzalez rated among criminal hackers, a prosecutor replied: 'As a leader? Unparalleled. Unparalleled in his ability to coordinate contacts and continents and expertise. Unparalleled in that he didn't just get a hack done — he got a hack done, he got the exfiltration of the data done, he got the laundering of the funds done. He was a five-tool player.' Accounting for time served and good behavior, Gonzalez is expected to get out of prison in 2025." Last June Rolling Stone ran a long profile of Albert Gonzalez written by Sabrina Rubin Erdely; they have dusted it off now that producer Eric Eisner has embarked on the development of a feature film based on Erdely's piece.
Yet another 'journalist who thinks he's the new Tom Wolfe :)
:)
Biggest Cybercrime of All Time
"Albert Gonzalez remained focused on business — checking his laptop constantly, keeping tabs on the rogue operators he employed in Turkey and Latvia and China, pushing, haranguing, issuing orders into his cellphone in a steady voice. "Let's see if this Russian asshole has what I need," he'd say calmly. Then he would help himself to glass plates of powder, each thoughtfully cut into letters for easy identification: "E" for Ecstasy, "C" for coke" link
"Dude," he wailed, "I can't fucking read!"
Dude, you can't write
The hack consisted of accessing wireless POS terminals from the car park and then going on to access the internal CC database for over eighteen months, without anyone noticing. They only took action when the banks phones them up and asked about all the fraudelent activity out TJX stores.
"TJX admit that 45.7 million credit and debit cards was stolen from the company in a computer data security breach over an 18-month period" link
You could be forgiven for thinking that the world of the cyber-criminal is wholly populated by geniuses who have "gone bad", or the sorts of people that James Bond regularly vanquishes. Where are all the averagely intelligent, nondescript, stupid-but-lucky criminals who stalk the world of online, as they do the ordinary underworld?
The answer, I suspect, is that they're the very same people who are described above, but who's skills are exaggerated by police forces all over the world in an attempt at self-aggrandisement. To make their own lucky breaks appear to be much more significant than they actually were. Just as anglers everywhere have stories about the "massive" catches they made when no-one else was around I reckon the police are pursuing the same policy to try and convince the public that they, too are masterminds. Hmmm.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
If he was so poorly educated and not a particularly well-skilled hacker, and it still took the FBI so long to figure out it was him and bring a conviction, what are they doing against hackers who are actually good? How are they fairing against highly intelligent, well-organized, and well-funded teams of hackers being employed by other nations to the infiltrate US government, commercial, and industrial systems. We know those bad guys exist. Where are all the arrests and front-page stories?
Uneducated and under-resourced petty criminals like Gonzalez are the EASY fish. What is the FBI doing against the real bad guys? Unfortunately, our press is so lazy and dumb they cannot see the writing on the wall. The story of the decade and the one that will ultimately change the US forever. nope.....they're going to chase the Gonzalez story, because that's what the FBI gave them. Online fraud. A few hundred million? 1 Billion?
All while 100s of billions of dollars in research and development across every sector of our economy walks out the door. While every facet of our government is attacked daily. Great catch guys.
"BY THE SPRING of 2007, Gonzalez .. was also tired of war driving. He wanted a new challenge. He found one in a promising technique called SQL injection ..
..
.. link
When you log on to the Web site of a clothing store to buy a sweater, for example, the site sends your commands in SQL back to the databases where the images and descriptions of clothing are stored. The requested information is returned in SQL, and then translated into words, so you can find the sweater you want
SQL is the lingua franca of online commerce. A hacker who learns to manipulate it can penetrate a company with frightening dependability. And he doesn't need to be anywhere near a store or a company's headquarters to do so. Since SQL injections go through a Web site, they can be done from anywhere"
He is a thief, and thieves are parasites
who should be exterminated.
Of course, I'd be willing to settle for all of his fingers being cut off
and both of his eyes being removed.
"The Great Cyberheist", based on a true story. I see a future movie being made soon.
People think cybercrime is about misbegotten geniuses launch attacks using incomprehensible methods. They think cyberwar is about vast arrays of foreign hackers breaking into our high tech military systems and stealing our secrets. However, that's not what cybercrime and cyberwarfare are about. Cybercrime and cyberwarfare are about people bruteforcing some bigshot's low strength password. It's about some stupid spyware program exploiting some obvious old bug in windows and emailing your credit card to the former USSR. It's about your grandma downloading a set of "kitty" icons and infecting her computer with a botnet virus. It's about some small-time hacker calling up one secretary and getting the CEO's username, and then calling another and getting the CEO's password. These problems can't be solved by advanced security systems. They have to be solved by people. It's kind of like trying to fight cave-dwelling terrorists with a high-tech stealth bomber.
Responsibility is an addiction
Virtue is a temptation
Community is a cartel
I see the "$400 million" price tag and the righteous furor with which they necessarily prosecuted this guy and I have to wonder: when will someone be prosecuted for the trillions of dollars lost and the countless lives sacrificed for the Iraqi war over pretend WMDs? Why is it right to prosecute this kid and "not so much" to investigate those who pillaged our Treasury in the name of "national security"?
Off-topic, maybe - but probably just as important, if not more so. The Feds are holding this kid out as an example, but completely ignoring those who did even worse things.
Funny how "Eckis" ratted him out, especially considering how many people he stepped on for the USSS. :)
I wonder how the #phrack high council feels
Oh BTW back in 2002-2003 the source of all his data was from Phishing. He is the stereotypical Script Kiddie.
when I read that last bit about him being expected to get out of prison in 2025, I had the mental image of Simon Phoenix hacking into the public terminal in demolition man....
"People don't want to learn linux" hasn't been a valid excuse since '03.
The thing is that the FBI has basically diverted all their white collar crime resources, and probably whatever might be used to track hacking / financial crime stuff, into stupid counter-terror campaigns. This whole mess is really a permutation of white-collar crime.
They haven't sent a single greater-than-pawn level obvious fraudulent white collar criminal to prison in like a decade. They catch a couple hackers running large creditcard schemes but they haven't done jack about the industrial espionage, which as you note is going 'all the while.'
I am mainly just sad that all this context is lost, the one primary thing feds are good at is 'making an example' and making sure that it appears to be a broad enough example that they are getting to the core of the matter.
--hongpong.com
Hah, this got modded down? The NY Times article is paywalled off, and nobody else posted it, so I fail to see how the fact that I potentially saved a bunch of people from going to bugmenot to grab a username/password for nytimes.com is redundant.
Oh, wait. This is Slashdot. Nobody reads the articles, and very few even read the summaries. My bad. In Soviet Russia, etc, etc.
>Another claims there 'were major chains and big hacks that would dwarf TJX. I'm just waiting for them to indict us for the rest of them
This leads me to believe the rumors that we are never really told what is going on behind the scenes of these fraud cases by the banks themselves, so how are we to know what is what, and if the banks are doing an adequate job ? Maybe some regulations for this specifics might be in order?
The companies knew of the risk of this but their officers made the decision that leaving it open to facilitate other processes rather than securing their systems. They saved hundreds of thousands of dollars by not securing this hole and utilizing it for their other business processes. This decision should be criminal negligence.