Slashdot Mirror
Cybercriminals Learning To Filter Out Undercover Cops (krebsonsecurity.com)
An anonymous reader writes: Credit card numbers are constantly being stolen, but the people who take them don't usually use them. Instead, they sell them to others who will. Many cards are traded at online forums and markets. Law enforcement investigators know this, and they use these forums to gather intelligence on breaches. But Brian Krebs writes that one of the biggest markets, Rescator, has implemented methods to screen out suspected law enforcement agents. Krebs says of a law enforcement source of his: "The criminals running the fraud shop seized his carding store account and bitcoin balance after the pig alert flashed on my source's screen — effectively stealing hundreds of taxpayer dollars directly from the authorities. .. I found his case fascinating and yet another example of the growing sophistication of large-scale cybercrime operations."
I wonder how many false positives this system has.
Dirty feebs get what they deserve...
Krebs says of a law enforcement source of his: "The criminals running the fraud shop seized his carding store account and bitcoin balance after the pig alert flashed on my source's screen — effectively stealing hundreds of taxpayer dollars directly from the authorities..."
I think it's hilarious that the angle they took was the seizing of the police's resources committed to the transaction system. The point wasn't to steal the police's resources, that was a drop in the bucket compared to the size of the operation. The point was to prevent the suspected law enforcement agency from continuing to play and to preserve the information that might be linked with the account to use that information to help spot other law enforcement accounts.
If anything, the lack of size of the law enforcement operation was probably the initial red flag. Sure, actual criminals will start out small too, but usually an unwillingness to go all-in is a warning flag. Flat out, usually the, "good guys," have limits on their behavior either because they're attempting to do as little harm as possible or being limited in funding since they're not actually running a criminal for-profit enterprise, or a combination thereof.
It'll probably take a turned-insider to break this stuff. That's what it usually takes. Actually find a person involved, use the carrot-and-stick approach to give them reduced charges or some degree of immunity in exchange for breaking the organization from within, and let that person both take the risks associated with data collection and give them time to build up enough information to make further prosecution possible.
Do not look into laser with remaining eye.
Has a carding store account with money in it meant to be used to be given to criminals -- complains that they take it
When you detect the unwanted customer, don't block them ... sell them randomized fake CC info. Their evil genius is weak sauce.
So there is a sophisticated ecosystem of criminals and undercover cops that exists because credit card transactions are insecure. Make credit card transactions secure using cryptography available in 1980 and it all goes away.
Maybe have it such that taking a credit card number is not as easy as getting a number. Let me explain: Someone commented getting a credit card even using someone else's name and address, all you have to do is fill out a form and put down a bunch of numbers. Unlike getting a car, you have to show them that it is really you is you getting the car. But I guess credit cards are becoming more commonplace (damned as I see someone buying lousy cup of coffee for $1.25 with their credit card), so with more of these but less of honest jobs that pay a livable wage only bound to have more credit card number thefts.
mfwright@batnet.com
Heck, just throw that up on every (new) account.
If they don't come back cussing at you then block em. Did they act all insulted or just logout?
If it was a 'legit' customer, you got they money they were going to spend anyway!
....exactly what countermeasures beyond them mentioning they used to use IP range blacklists, exactly?
Where are the details?
This is like some old story about a guy he used to know who did some thing one time...
Capital One actually called my parents when I got a card from them to confirm that I was myself. Never told em any information on my parents.
Dirty pigfuckers...
I'm serious by the way, this isn't an attempt to be funny. Appending the cyber- prefix automatically sets them apart and I think that's a bad thing. They're thieves, and we already have plenty of words for those.
So there is a sophisticated ecosystem of criminals and undercover cops that exists because credit card transactions are insecure. Make credit card transactions secure using cryptography available in 1980 and it all goes away.
Nearly all cryptography in use in 1980 would be trivially breakable from even a brute-force attack today.
We humans are very poor at building secure systems. We don't really have any theoretical basis for building cryptographic algorithms. The methodology used is basically propose some idea and if enough people look at it and can't compromise it generally after a few years we figure it is good to go. In practice what happens with most public-key systems is that some special cases are discovered where the system is easily breakable. This translates into an ever-growing stop list of mathematical properties to search at key generation time. Note that won't help you if you generated your key thee years ago and you are unlucky.
The fun really begins when we implement systems using cryptography. Think about the guy in the cubicle down the hall. The one you'd never trust with sharp objects. The one who can't debug his way out of a paper bag. That's the guy who will implement the major security holes in your product. And you only need one. Given some of the boneheaded stuff I have seen (e.g. cleartext left laying around where it is easily located, "key generators" for 128-bit session keys that only have around 16 bits of entropy, &c) I really don't believe we humans are smart enough for this.
And that is just the stupid and incompetent. What about the smart and lazy person on deadline? What about someone genuinely malicious implementing something "secure" that you depend on?
I'd recommend buying a tinfoil hat and hoping for the best.
Unfortunately, this is just horrible. It doesn't even help the little guy who cannot himself check through the forums and have to wait for second-third hand information to stop this nonsense.
civil forfeiture? lol
or should this have another name?
and ironically this presents the same problems for the 'legitimate' clientele who now have to be worried about being falsely 'forfeited'.
Your credit reports contain that information: past addresses, known family members, etc.
(So never use that kind of info as an answer for a secret security question.)
I can see the fnords!
they are criminals. they'd take your money even if you were not a pig
But I guess credit cards are becoming more commonplace (damned as I see someone buying lousy cup of coffee for $1.25
Yeah, so? You should be able to make small purchases with them, because the real costs to provide the service are 1) reliably communicate an almost vanishingly small amount of data over a vast network that is mostly used for streaming video, 2) production of the cards themselves.
Why should you have to carry cash around and make change and carry that any more if you don't want to? Because some people don't get finances and will overspend, therefore all uses of credit cards are irresponsible?
Can you be Even More Awesome?!
Credit card fraud is an easy problem to solve, one simple solution. Gather biometrics of the purchaser at point of sale or product receipt (for online sales). Fraudulent purchase and they have given themselves away and even if they use a gullible mule, that mule will turn them in. So easiest way to gather biometric data, require a finger print on a seal able adhesive material along with a photo, that is kept and turned in at end of shift and stored (you gain the print and skin cells and an image of the person making the purchase or taking receipt of goods). You could even just do the photo but not as effective as skin cell samples.
Chaos - everything, everywhere, everywhen
Has Anyone Really Been Far Even as Decided to Use Even Go Want to do Look More Like?
I live in northern Europe. I never carry cash around. Stores and coffee shops don't want to handle cash. They want me to pay by card. And I want to pay by card, using chip and PIN, because that is safer for me than carrying around cash.
I can't even pay for the bus in my town using cash. There was one attempted robbery of a bus driver, and all buses went cashless overnight.
Oh I see how it is, when someone steals from the cops, it's theft.
But when cops steal from anyone else, it's civil asset forfeiture.
Have you ever fallen asleep at the keybhanusdiog?
In the U.S. it is illegal to sell fake illegal goods. So selling fake credit card numbers is still illegal just as selling oregano as pot is illegal. Then there's the add-ons like conspiracy to defraud and who knows what else.
damned as I see someone buying lousy cup of coffee for $1.25 with their credit card
I think this insinuates that people are using credit for small things because they lack funds, but there's plenty of other good reasons for this. I don't carry a lot of cash, particularly small change. I'm Canadian so mine might vary from yours a bit:
a) In Canada, small change ($0.5, $0.10, $0.25, $1.00, $2.00) comes in the form of coins. These are heavy, bulky, and frankly most wallets don't even have a coin purse in them anymore (I've yet to find a decent wallet that does, sadly). They're even considering a $5 coin.
b) Credit is safer than debit in terms of fraud. As a relative of mine experienced, a stolen CC # means getting the card cancelled, tracking down some bad purchases, and waiting for a new card. Having your debit card compromised can involve you account being drained, then locked for an extended period while the bank (maybe) does something to recover your funds
c) Many credit cards come without fees so long as you pay them off in a timely manner. Debit accounts often do come with fees, limits on the number of "free" transactions, etc (not mine, because I do my banking somewhere sane, but most major banks are like this). Banks also like to change the terms on the debit accounts, so your free-if-you-keep-$1000-balance account may suddenly start getting fees when they raise the minimum to $2000.
d) Paypass (paywave, tap-to-pay, etc). I have mixed feelings about this. From a security perspective it's pretty awful. For small items like a coffee or a donut, it's damn convenient, and faster than any other method. I've come to accept that so long as its limited to small purchases it's not that bad (if somebody steals my RFID they can't buy much) so long as one watches one's account.
So personally, I don't have space for a lot of spare change. Plus that $1.25 coffee is pretty quick with my CC and not worth potentially compromising my main bank account. Bring on the plastic.
Essentially this boils down to the police lack the skills and sophistication of the people they're trying to stop, and in the process they're getting their asses handed to them and losing the money they have as bait.
You have to admire the audacity, but you can't go around thinking law enforcement has the right skillset to fight these people on their own turf.
In an ever on-going arms race, the bad guys are more numerous, likely have more resources and time, and are quite motivated.
I mean, it's not like in the real world you'd grab an officer, give him some slouchy shorts, a wallet chain and a beanie cap and send him in to pretend like he fits in with who you're looking for.
So, yeah, organized crooks using the intertubes know more about the intertubes than the police trying to stop them. Film at 11.
I absolutely LOVE the Pig Alert ... it's just so damned hilarious in a vaguely kind of cyberpunk sort of way.
Lost at C:>. Found at C.
Learning to detect, avoid, and occasionally fuck over the police is something that everybody should master. At the end of the day they're just another gang, filled with criminals, murderers, and rapists (the numbers don't lie!)