Who's Selling Credit Cards From Target?

An anonymous reader writes "Brian Krebs has done some detective work to determine who is behind the recent Target credit card hack. Krebs sifted through posts from a series of shady forums, some dating back to 2008, to determine the likely real-life identity of one fraudster. He even turns down a $10,000 bribe offer to keep the information under wraps."

Comments

Good Journalsim, Good Article

[retroworks]

Took about 5 minutes to read it. Didn't see any "first posts!" in the interim. Either others find it as fascinating, or I lack a life reading /. at midnight on Christmas eve.

Re:Good Journalsim, Good Article

[Trepidity]

Spelling is not properly within the jurisdiction of the Grammar Nazis; we apologize for any overstepping of boundaries in this regard that may have occurred in the past.

Re:Good Journalsim, Good Article

[Samantha Wright]

Yeah, that's strictly the domain of the Orthografiejugend.

Re:Good Journalsim, Good Article

[Spy Handler]

Yes it was very good, Krebs writes well and he seems to know his stuff.

That being said, was it really that easy? His steps to finding the perpetrator was:

-Scan underground sites that sell stolen credit cards
-Do a small buy to get a sample
-Found cards that matched the ones stolen from Target
-Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)
-Contact the perp to see if he makes any incriminating statements (which he did by offering $10k bribe)

The perp may be an uber elite hacker, but he's very noob when it comes to hiding his tracks.

Re:Good Journalsim, Good Article

[SternisheFan]

This morning ABC-TV news reported that they are zeroing in on the thieves (it may be Ukranian hackers), who are having trouble selling the info since there is a glut on the market, not enough buyers. It also reported that phony Target emails are getting sent to affected card holders, customers are being told to go directly to the official Target site to be sure.

Re:Good Journalsim, Good Article

[phayes]

Krebs does know his stuff & much like J Edgar Hoover, he's been in the business accumulating files on all the underground criminal sites for years. It is this database of info & intimate knowledge of how it all fits together that allows him to dig up the info that budding criminals left online in forums where they let their hair down (assuming that the others were all thieves with honour) and then tie it together with public records. Even "elite hackers" (assuming that the lowlife Krebs exposed really is one) were young once & rare is the teenager who knows not to brag...

Go Brian, you inspire us all...

Re:Good Journalsim, Good Article

[berberine]

rare is the teenager who knows not to brag...

Not quite on the same level, but my local paper recently ran a story of a convenience store robbery. The person who did it stole a lot of junk food and close to $1000. The police admitted they had no leads and were clueless about who did it. They were basically saying that the perpetrator was going to get away with it. Two days later, they arrest a 16-year old male because he was bragging to his classmates at school about how dumb everyone was and how smart he was because no one knew it was him.

Re:Good Journalsim, Good Article

[wisnoskij]

They can, they even have a special name for them: Blackmailer.

Re:Good Journalsim, Good Article

[Anonymous Coward]

-Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)

That probably was the more difficult step. Most of these chats had been deleted or archived. And most of it was in Russian. He probaby was on these sites for a while, also note that a lot of these chats are private chats between 3rd parties, so getting ahold of this was probably some work.

Purview of NSA?

[OffTheLip]

If the NSA/FBI/CIA/... was really interested in doing some good with all of the data mining they could solve or at least contribute to resolving cases like this. Prevention would even be better.

Re:Purview of NSA?

[TechyImmigrant]

Or the banks could switch to chip and pin cards and upgrade the crypto sufficiently to make it secure.

Re:Purview of NSA?

[swb]

There's about a half-dozen ways to define this kind of crime as a legitimate national security concern, especially given the long history of criminal activity being used to finance insurgency (eg, drugs) or using economic means, such as counterfeiting, to disrupt economies.

It's not hard to make an argument that widespread credit fraud is more costly and economically damaging than counterfeiting in a modern economy even if the proceeds are only used by criminals for cocaine and hookers instead of funding armed insurgency. And that's not counting the collateral damage from other forms of cyber crime used to enable credit fraud activity.

It's really surprising there isn't more NSA focus on this stuff. If there was I think a lot of people who give the NSA a pass on some of their more intrusive surveillance (even though it's not warranted) -- it's kind of the same thing that happens when the local police beat the shit out of someone with a history of violent criminal activity; they might otherwise dislike heavy handed policing themselves, but so long as its used on the bad guy they're willing to overlook their own injustice.

Re: Purview of NSA?

[JWW]

This case could be a huge PR win for the NSA. If they could arrest 10-20 people involved in this using all their data, I think the country would be appreciative. At least they could make their case that their data collection is worth something.

Of course the NSA has done nothing about this because helping protect the citIzens isn't really their job, it's just their bogus excuse for their actions.

Re: Purview of NSA?

[Anonymous Coward]

I'm pretty sure you aren't being sarcastic, but its hard to believe you are being serious. People shouldn't appreciate spy agencies arresting people. Why not arrest 10-20 thousand people like the KGB used to for 1000X the appreciation? The NSA is part of the military. It has no business participating in law enforcement unless martial law has been declared. The "unless there is evidence of law being broken" exemption for whether spying on someone who is otherwise 51% likely to be a US person should be scrapped. Given the history of CIA involvement in narco-trafficking I'd like to keep our spy agencies as far away from crime as possible. Just think how much easier it would be for people in the NSA to pull this kind of heist than for some "elite hacker" from the Ukraine.

Re:Purview of NSA?

[TechyImmigrant]

My understand is not that they like card fraud, but they do *really really* like the current situation regarding liability. I.E. The banks carry none of the liability. If they are provisioning strong crypto and credentials to ensure secure transactions, the liability landscape changes in way that are bound to be worse than the current optimal (as far as the bank is concerned) situation.
 

Accepting money from a criminal

[hey!]

to do something that furthers his criminal enterprises has a name. It's called "conspiracy".

So if you ever try your hand at hunting down criminals like this, be aware of the potential danger of tying yourself to the criminal's legal fate. If you've done business withhim that's the least bit shady, and he's overseas beyond the reach of local authorities, things could get quite ugly for you.

That's an insult

[jbmartin6]

$10,000 to risk his career, professional reputation, etc.? Shows the inexperience of the would-be briber that the sum was so small. 10k doesn't go that far these days...

Interesting, but I heard another tale

[Nyder]

I game with someone who works in a high position at one of the top finical firm. And when stuff like this happens, they hear about it and discuss it, since it affects them.

I can not back this up, this is what is I was told:

The credit card fraud was because some of the CC scanners have an extra chip in them, put in at a factory, that allows backdoor access to those machines. Not all the CC scanners have this, only some.

And of course, the extra chip isn't spec.

The person who told me is out of town till the end of week, so I can't hear any more updates till probably next week on it.

 

Re:Simple solution

[__aajfby9338]

Put a law like that on the books, and I guarantee that retailers, hospitals, insurance companies, etc. will do everything they can to cover up breaches of their systems and these stories will all but disappear.

purview of banks investing in security

[swschrad]

seeing as how the chipped cards cost 5 times as much, I think we can consider this discussion closed :-D you know, the mantra of Wall Street is "screw the future, what are you doing for us this quarter?"