Slashdot Mirror


Who's Selling Credit Cards From Target?

An anonymous reader writes "Brian Krebs has done some detective work to determine who is behind the recent Target credit card hack. Krebs sifted through posts from a series of shady forums, some dating back to 2008, to determine the likely real-life identity of one fraudster. He even turns down a $10,000 bribe offer to keep the information under wraps."

68 comments

  1. Good Journalsim, Good Article by retroworks · · Score: 4, Interesting

    Took about 5 minutes to read it. Didn't see any "first posts!" in the interim. Either others find it as fascinating, or I lack a life reading /. at midnight on Christmas eve.

    --
    Gently reply
    1. Re:Good Journalsim, Good Article by eWarz · · Score: 1

      Primarily number two, it's been eerily quiet tonight..especially given your poor spelling of journalism. I expected the grammar Nazis to be out in full force.

    2. Re:Good Journalsim, Good Article by Trepidity · · Score: 4, Insightful

      Spelling is not properly within the jurisdiction of the Grammar Nazis; we apologize for any overstepping of boundaries in this regard that may have occurred in the past.

    3. Re:Good Journalsim, Good Article by Samantha+Wright · · Score: 2

      Yeah, that's strictly the domain of the Orthografiejugend.

      --
      Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
    4. Re:Good Journalsim, Good Article by Belial6 · · Score: 1

      Does that apply to its/it's? Since technically "Its Christmas." would be grammatically incorrect.

    5. Re:Good Journalsim, Good Article by Spy+Handler · · Score: 5, Insightful

      Yes it was very good, Krebs writes well and he seems to know his stuff.

      That being said, was it really that easy? His steps to finding the perpetrator was:

      -Scan underground sites that sell stolen credit cards
      -Do a small buy to get a sample
      -Found cards that matched the ones stolen from Target
      -Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)
      -Contact the perp to see if he makes any incriminating statements (which he did by offering $10k bribe)

      The perp may be an uber elite hacker, but he's very noob when it comes to hiding his tracks.

    6. Re:Good Journalsim, Good Article by Anonymous Coward · · Score: 0

      Only if you celebrate xmas like some kind of religious and/or superficial nutjob..

    7. Re:Good Journalsim, Good Article by TechyImmigrant · · Score: 1

      Not since Noddy Holder verbally omitted the apostrophe in a song.
      .

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    8. Re:Good Journalsim, Good Article by SternisheFan · · Score: 3, Informative

      This morning ABC-TV news reported that they are zeroing in on the thieves (it may be Ukranian hackers), who are having trouble selling the info since there is a glut on the market, not enough buyers. It also reported that phony Target emails are getting sent to affected card holders, customers are being told to go directly to the official Target site to be sure.

    9. Re:Good Journalsim, Good Article by Anonymous Coward · · Score: 1

      -Contact the perp to see if he makes any incriminating statements (which he did by offering $10k bribe)

      That actually made me wonder if a journalist could make a living by not posting articles.

    10. Re:Good Journalsim, Good Article by ls671 · · Score: 1

      You've been so long
      Well, it's been so long
      And I've been putting out fire
      with gasoline
      putting out fire with gasoline

      It's is a contraction for it is or it has.
      http://garyes.stormloader.com/its.html

      --
      Everything I write is lies, read between the lines.
    11. Re:Good Journalsim, Good Article by phayes · · Score: 4, Insightful

      Krebs does know his stuff & much like J Edgar Hoover, he's been in the business accumulating files on all the underground criminal sites for years. It is this database of info & intimate knowledge of how it all fits together that allows him to dig up the info that budding criminals left online in forums where they let their hair down (assuming that the others were all thieves with honour) and then tie it together with public records. Even "elite hackers" (assuming that the lowlife Krebs exposed really is one) were young once & rare is the teenager who knows not to brag...

      Go Brian, you inspire us all...

      --
      Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
    12. Re:Good Journalsim, Good Article by mcneely.mike · · Score: 0

      Gesundheit! :)

      --
      soylentnews.org Go there to enjoy the people!
    13. Re:Good Journalsim, Good Article by berberine · · Score: 3, Interesting

      rare is the teenager who knows not to brag...

      Not quite on the same level, but my local paper recently ran a story of a convenience store robbery. The person who did it stole a lot of junk food and close to $1000. The police admitted they had no leads and were clueless about who did it. They were basically saying that the perpetrator was going to get away with it. Two days later, they arrest a 16-year old male because he was bragging to his classmates at school about how dumb everyone was and how smart he was because no one knew it was him.

    14. Re:Good Journalsim, Good Article by wisnoskij · · Score: 2

      They can, they even have a special name for them: Blackmailer.

      --
      Troll is not a replacement for I disagree.
    15. Re:Good Journalsim, Good Article by Anonymous Coward · · Score: 0, Informative

      I expected the grammar Nazis to be out in full force.

      An ellipsis is 3 dots, not 2, and it has a space before and after.

    16. Re:Good Journalsim, Good Article by mark-t · · Score: 1

      In most nations, celebration of Christmas is fairly ubiquitous and a person's recognition of that has nothing to do with that particular person's religious or materialistic views.

    17. Re:Good Journalsim, Good Article by K.+S.+Kyosuke · · Score: 1

      That could depend on your POV. One might argue that the result happens to be ungrammatical in the written language, but since "it's" and "its" are homophones in spoken English, how do you propose to differentiate it from any other typo? It doesn't seem to be distinguishable without further knowledge of the mental process that led to it.

      --
      Ezekiel 23:20
    18. Re:Good Journalsim, Good Article by Anonymous Coward · · Score: 3, Interesting

      -Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)

      That probably was the more difficult step. Most of these chats had been deleted or archived. And most of it was in Russian. He probaby was on these sites for a while, also note that a lot of these chats are private chats between 3rd parties, so getting ahold of this was probably some work.

    19. Re:Good Journalsim, Good Article by Belial6 · · Score: 1

      Which doesn't answer the question. Does it fall under the jurisdiction of the Grammar Nazis?

    20. Re:Good Journalsim, Good Article by Bite+The+Pillow · · Score: 1

      The "inside job" nutters are not posting here, but they seem to be alive in other threads. That cut down on the normal useless chatter, leaving it open for this useless chatter.

    21. Re:Good Journalsim, Good Article by Anonymous Coward · · Score: 0

      Yes it was very good, Krebs writes well and he seems to know his stuff.

      That being said, was it really that easy? His steps to finding the perpetrator was:

      -Scan underground sites that sell stolen credit cards
      -Do a small buy to get a sample
      -Found cards that matched the ones stolen from Target
      -Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)
      -Contact the perp to see if he makes any incriminating statements (which he did by offering $10k bribe)

      The perp may be an uber elite hacker, but he's very noob when it comes to hiding his tracks.

      What makes this even more funny, and even more simple minded, is how the target Krebs tracks down is dumb enough to ignore the basics of underground criminal 101. Never use photos or avatars, and never use the same fkin alias for anything, never use social websites then post your (what is guessed to be) a real name, and try not to just use basic Jane/John public internet in which you can be traced.

      Seriously if Krebs could track the idiot down why is there no outrage or any police effort to nab the guy!!

      That alone is what I found disturbing!!

    22. Re: Good Journalsim, Good Article by cusco · · Score: 1

      Really, they don't become cops because they like working with computers. I don't know of a single large metropolitan police department that actually has a computer crimes division, even here in Seattle.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    23. Re:Good Journalsim, Good Article by godel_56 · · Score: 1

      Seriously if Krebs could track the idiot down why is there no outrage or any police effort to nab the guy!!

      Um, possibly because he's in the Ukraine and paying the local cops a shedload of money to look the other way, and no-one expects any different.

    24. Re:Good Journalsim, Good Article by Anonymous Coward · · Score: 0

      Yes it was very good, Krebs writes well and he seems to know his stuff.

      That being said, was it really that easy? His steps to finding the perpetrator was:

      -Scan underground sites that sell stolen credit cards
      -Do a small buy to get a sample
      -Found cards that matched the ones stolen from Target
      -Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)
      -Contact the perp to see if he makes any incriminating statements (which he did by offering $10k bribe)

      The perp may be an uber elite hacker, but he's very noob when it comes to hiding his tracks.

      It's possible that this is actually a second or third tier re-seller, and not the original perp..

    25. Re:Good Journalsim, Good Article by mrmeval · · Score: 1

      LOL

      I fiddled with gtranslate and got

      Rechtschreibung Jugendkorps

      I'll use both. :)

      --
      I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
    26. Re:Good Journalsim, Good Article by Anonymous Coward · · Score: 0

      I googled too, it's two words, Orthografie jugend, "youth writing correctly" which is hilariously seldom seen.

    27. Re:Good Journalsim, Good Article by Anonymous Coward · · Score: 0

      The sentence structure will always clue you as to whether it's a posessive or a contraction. E.g., "Its hands are cold because its only ten degrees" should obviously be "Its hands are cold because it's only ten degrees" (he's, she's, it's; his, hers, its). It's the author showing his/her ignorance of his/her own language. Sad, but what's annoying is those other homophones that make you read the damned sentence three times to ficure out WTF the writer was saying. "Here the kittens purr" has a completely different meaning than "hear the kittens purr". It's amazing how many people at a nerd site, of all places, where you would expect bibliophiles to hang out who don't know the difference between lose and loose, and there their and they're. Now that's just sad.

      Lysdexics untie!

  2. Purview of NSA? by OffTheLip · · Score: 4, Insightful

    If the NSA/FBI/CIA/... was really interested in doing some good with all of the data mining they could solve or at least contribute to resolving cases like this. Prevention would even be better.

    1. Re:Purview of NSA? by TechyImmigrant · · Score: 5, Informative

      Or the banks could switch to chip and pin cards and upgrade the crypto sufficiently to make it secure.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    2. Re:Purview of NSA? by swb · · Score: 2

      There's about a half-dozen ways to define this kind of crime as a legitimate national security concern, especially given the long history of criminal activity being used to finance insurgency (eg, drugs) or using economic means, such as counterfeiting, to disrupt economies.

      It's not hard to make an argument that widespread credit fraud is more costly and economically damaging than counterfeiting in a modern economy even if the proceeds are only used by criminals for cocaine and hookers instead of funding armed insurgency. And that's not counting the collateral damage from other forms of cyber crime used to enable credit fraud activity.

      It's really surprising there isn't more NSA focus on this stuff. If there was I think a lot of people who give the NSA a pass on some of their more intrusive surveillance (even though it's not warranted) -- it's kind of the same thing that happens when the local police beat the shit out of someone with a history of violent criminal activity; they might otherwise dislike heavy handed policing themselves, but so long as its used on the bad guy they're willing to overlook their own injustice.

    3. Re: Purview of NSA? by JWW · · Score: 2

      This case could be a huge PR win for the NSA. If they could arrest 10-20 people involved in this using all their data, I think the country would be appreciative. At least they could make their case that their data collection is worth something.

      Of course the NSA has done nothing about this because helping protect the citIzens isn't really their job, it's just their bogus excuse for their actions.

    4. Re: Purview of NSA? by Anonymous Coward · · Score: 2

      I'm pretty sure you aren't being sarcastic, but its hard to believe you are being serious. People shouldn't appreciate spy agencies arresting people. Why not arrest 10-20 thousand people like the KGB used to for 1000X the appreciation? The NSA is part of the military. It has no business participating in law enforcement unless martial law has been declared. The "unless there is evidence of law being broken" exemption for whether spying on someone who is otherwise 51% likely to be a US person should be scrapped. Given the history of CIA involvement in narco-trafficking I'd like to keep our spy agencies as far away from crime as possible. Just think how much easier it would be for people in the NSA to pull this kind of heist than for some "elite hacker" from the Ukraine.

    5. Re:Purview of NSA? by bzipitidoo · · Score: 1

      Just what I was thinking. I don't know if the banks are stupid, or if their cold calculations really do show that writing off a steady stream of fraudulent transactions is less expensive than upgrading the security. But given their recent track record, such as crashing the economy and causing the Great Recession, I'm of the opinion that smart cards would be less costly in the long run, and that banks are stupid and greedy for not using them. They might have to hire a few software engineers, maybe even some experts in crypto! And we just know there aren't any available, thanks to H1B limits. Seems Ukraine's system produces many such experts.

      --
      Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
    6. Re:Purview of NSA? by TechyImmigrant · · Score: 3, Interesting

      My understand is not that they like card fraud, but they do *really really* like the current situation regarding liability. I.E. The banks carry none of the liability. If they are provisioning strong crypto and credentials to ensure secure transactions, the liability landscape changes in way that are bound to be worse than the current optimal (as far as the bank is concerned) situation.
       

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    7. Re:Purview of NSA? by Anonymous Coward · · Score: 0

      Or the banks could switch to chip and pin cards and upgrade the crypto sufficiently to make it secure.

      Europe has been using chip & pin for some time.

      Based on their experience, it does make card fraud more difficult, but not impossible.

    8. Re: Purview of NSA? by Anonymous Coward · · Score: 1

      It is against the law to use military forces for law enforcement purposes domestically.

      it's called the 'Posse Comitatus Act

      http://en.wikipedia.org/wiki/Posse_Comitatus_Act'

      The NSA is a military organization ... therefore it is against the rules.

      ADDITIONALLY because of this, none of the information that they collect can be used as evidence in any trial in the US.

      NSA = Tempest in a teapot.

    9. Re: Purview of NSA? by Mabhatter · · Score: 1

      The problem is that "terrorism" is more flashy for them. Data breeches of millions of people are just bait for their tracking units. I suppose that means "good for us" that they are spending more effort on "national security" and not misuse of credit cards.

    10. Re:Purview of NSA? by interkin3tic · · Score: 1

      MORE secure, not just secure. Thieves won't commit suicide in frustration: there will still be thefts. They'll evolve. It's pedantic, but I think we all know the dangers of giving a false sense of security, even accidentally through word choices.

    11. Re:Purview of NSA? by TechyImmigrant · · Score: 1

      The whole process will never be secure, since humans are involved and implementations will always have holes, but we do have the mathematics to define algorithms that are known secure in very specific ways and we know how to turn that math into algorithms that we can implement. The least we could do is the crypto bit, since it's not that hard to get right just once for the security of everyone using payment cards. Instead we get a whole bunch of stupid PCI-DSS rules that do nothing to enhance the security of payment card transactions.

       

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    12. Re:Purview of NSA? by Anonymous Coward · · Score: 0

      Europe has been using chip & pin for some time.

      Europe actually looks after it's citizens.

    13. Re:Purview of NSA? by tomhath · · Score: 1

      There's a good chance NSA does share some of what they find with the FBI and Interpol. They would never admit it though.

    14. Re:Purview of NSA? by DeSigna · · Score: 1

      I thought this was already the case.

      At least here (AU), it's been practically impossible to get a MasterCard or Visa-backed card without a smartchip for half a decade, and in 2014 signatures will no longer be accepted to validate identity on credit purchases. There's been ads running for about a year requesting that people create a PIN for each of their cards. (AFR rundown)

      Bank-issued cards (not store cards) always come with NFC as well now (doesn't seem to be any way to request otherwise). The last non-NFC card I had just expired and was replaced with a Visa PayWave. NFC & RFID is also very popular for specialist stuff : cabcharge cards, fuel cards, public transport.

    15. Re:Purview of NSA? by thejynxed · · Score: 1

      What is disturbing, is that NFC/RFID chipped cards are basically just a band-aid, and fall to the exact same pitfalls of being able to be read and copied with relative ease using parts you can purchase and assemble at your local equivalent of Radioshack as your average NFC/RFID employee badge or door keycard.

      The funny thing is, is that some of these parts are illegal to sell to the general public in the EU, but Canada, AUS, US, Mexico, etc all have them widely available.

      There's already been demonstrations by university students & their professors, etc about the dangers of relying on chip & pin for anything (witness the fiasco a few years ago when they showed how easy it was to ride the tube in London for free by exploiting the inherent weaknesses in this particular combo).

      --
      @Mindless Drivel: 100% of Twitter posts ever Tweeted.
    16. Re: Purview of NSA? by colinnwn · · Score: 1

      And it is against the law for them to spy on Americans on US soil. Didn't slow them down.

    17. Re:Purview of NSA? by JamieIanMacgregor · · Score: 1

      that is weird, my CC was just replaced with a chip+pin non nfc (in NZ) but I was in Sydney the other week with my nearly expired chip+pin CC and when using it I was asked to sign instead of using pin...also, New Zealand McDonalds can take purchases under about $15 or something with no authentication whatsoever, I thought that was a bit off.

  3. Accepting money from a criminal by hey! · · Score: 2

    to do something that furthers his criminal enterprises has a name. It's called "conspiracy".

    So if you ever try your hand at hunting down criminals like this, be aware of the potential danger of tying yourself to the criminal's legal fate. If you've done business withhim that's the least bit shady, and he's overseas beyond the reach of local authorities, things could get quite ugly for you.

    --
    Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  4. That's an insult by jbmartin6 · · Score: 2

    $10,000 to risk his career, professional reputation, etc.? Shows the inexperience of the would-be briber that the sum was so small. 10k doesn't go that far these days...

    --
    This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    1. Re:That's an insult by mysidia · · Score: 1

      $10k. is still a pretty sum.... after income taxes, you can almost afford a trip to disneyworld with it.

    2. Re:That's an insult by interkin3tic · · Score: 1

      I read it as desperation, or possibly being used to giving people bribes to make problems go away, not an insult. And perhaps $10K goes a lot further wherever the person offering the bribe is from than wherever Krebbs is from.

    3. Re:That's an insult by Anonymous Coward · · Score: 0

      $10k. is still a pretty sum.... after income taxes, you can almost afford a trip to disneyworld with it.

      I think about this every time I see one of those Disney "resort" commercials.

      Only 1%'ers can afford it.

    4. Re:That's an insult by Anonymous Coward · · Score: 0

      Considering that the goal in life of the bribing criminal is to buy a $30K celica, I would say that $10K is very generous from him.

  5. even turns down by Anonymous Coward · · Score: 0

    Hehe. What do you mean 'even' turns down. Is that supposed to be above the standard? Probably not entirely thought out as it would be 'of course'. If you have any integrity you would never let some crim buy you off.

  6. I wonder what would happen if by Anonymous Coward · · Score: 0

    he took the $10k & then still released the info anyway.

    No honor among thieves, right?

  7. Interesting, but I heard another tale by Nyder · · Score: 2, Interesting

    I game with someone who works in a high position at one of the top finical firm. And when stuff like this happens, they hear about it and discuss it, since it affects them.

    I can not back this up, this is what is I was told:

    The credit card fraud was because some of the CC scanners have an extra chip in them, put in at a factory, that allows backdoor access to those machines. Not all the CC scanners have this, only some.

    And of course, the extra chip isn't spec.

    The person who told me is out of town till the end of week, so I can't hear any more updates till probably next week on it.

     

    --
    Be seeing you...
    1. Re:Interesting, but I heard another tale by wytcld · · Score: 1

      If that's the case, that it's an extra chip in some of the scanners, how many other retailers use scanners from the same factory? Will it be Walmart's CC scans that get dumped on the market next time around?

      --
      "with their freedom lost all virtue lose" - Milton
    2. Re:Interesting, but I heard another tale by Anonymous Coward · · Score: 0

      I heard a story from my sister's husband's uncle's cousin that was very similar. I confirm this as true!

  8. Simple solution by Anonymous Coward · · Score: 0

    Every time something like this happens there's all this rending of clothes and wailing about it, but almost no one offers the simplest, most direct way to fix it: Impose high financial penalties on the companies who lose customer or patient data. Something like: If you, as a customer/patient incur any expense because of a breech you're entitled to reimbursement of 5 to 10 times the actual out of pocket cost.

    Put a law like that on the books, and I guarantee that retailers, hospitals, insurance companies, etc. will lock down their systems and these stories will all but disappear.

    1. Re:Simple solution by __aajfby9338 · · Score: 2

      Put a law like that on the books, and I guarantee that retailers, hospitals, insurance companies, etc. will do everything they can to cover up breaches of their systems and these stories will all but disappear.

  9. purview of banks investing in security by swschrad · · Score: 4, Insightful

    seeing as how the chipped cards cost 5 times as much, I think we can consider this discussion closed :-D you know, the mantra of Wall Street is "screw the future, what are you doing for us this quarter?"

    --
    if this is supposed to be a new economy, how come they still want my old fashioned money?
  10. Caveat Emptor! by Anonymous Coward · · Score: 1

    I pity the sucker who buys my credit card number.

  11. How I counter these assholes... by Anonymous Coward · · Score: 0

    Simple. Pay with cash.

    Quite frankly, I'd love to see all parties involved in this theft caught and executed live on f*cking PPV television.

  12. but who actually cracked the Target network? by WindBourne · · Score: 1

    Just because this guy and others are selling them, does not mean that they did the work.

    --
    I prefer the "u" in honour as it seems to be missing these days.