Stories
Slash Boxes
Comments
typodupeerror delete not in

Comments: 196 +-   An FBI Agent's 3 Years Undercover With Identity Thieves on Wednesday January 21 2009, @03:25PM

Posted by timothy on Wednesday January 21 2009, @03:25PM
from the doing-my-best-nelson-laugh dept.
security
privacy
snydeq writes "InfoWorld offers the inside story of how FBI Supervisory Special Agent J. Keith Mularski, aka Master Splynter, penetrated and took over DarkMarket.ws, the infamous underground carding board hacked by Max Butler and later transformed by Mularski into an FBI sting operation. The three-year tour sent Mularski deeper into the world of online computer fraud than any FBI agent before, resulting in 59 arrests and preventing an estimated $70 million in bank fraud before the FBI pulled the plug on the operation in October."
story

Related Stories

This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • Actually (Score:5, Funny)

    by DoofusOfDeath (636671) on Wednesday January 21 2009, @03:29PM (#26551349)

    InfoWorld offers the inside story of how FBI Supervisory Special Agent J. Keith Mularski, aka Master Splynter, penetrated and took over DarkMarket.ws,

    How on earth are we supposed to believe it's the real Agent Mularski now?

  • by jollyreaper (513215) on Wednesday January 21 2009, @03:30PM (#26551363)

    Cool hacker name = geek culture reference + creative misspellings/capitalizations

    Sample names:
    Dark JedEYE
    FeloniouS MonK
    POPP3R SMRF
    TERRORByTE
    G\/\/B

    I predict you will hear of these handles in future busts.

  • Fencing (Score:5, Insightful)

    by planckscale (579258) on Wednesday January 21 2009, @03:44PM (#26551577) Journal
    From an article I read on Wired what seemed to have brought the downfall upon Butler was some of his associates got nabbed for trying to use stolen cards to buy expensive retail items and then fence them on Ebay for cash. Seems to me that old fashioned F**k-ups are the way these guys usually get taken down. Also from the article I read that corrupt retailers and waiters use portable card readers to steal all mag data on the card. How would you protect yourself against that kind of attack?
    • Re:Fencing (Score:4, Insightful)

      by CannonballHead (842625) on Wednesday January 21 2009, @03:48PM (#26551643)

      Don't ever buy anything, and never eat out?

      • Patience (Score:4, Interesting)

        by copponex (13876) on Wednesday January 21 2009, @04:22PM (#26552113) Homepage

        Buy things at small retailers unlikely to have complicated security policies or good video surveillance. Use local criminals to do the deal for you, promising a cut if they are successful getting the item out of the store. Keep the purchases under $2,000.00

        Sell those things for cash on the street. Don't sell in the same area that you bought the items. Stick to big cities, as the police have way more to deal with than small-time theft. Once you get a big enough stash, use it to start a cash friendly business or find a way to get it to a trusted party in the third world and do the same thing.

        The object is to not piss one person off to the point where they dedicate themselves to finding you. As long as the victim has the credit card company to turn to for a refund, and the police don't think the fraud is connected, no one will even bother opening up a case number.

        • Re:Patience (Score:5, Insightful)

          by Otter (3800) on Wednesday January 21 2009, @05:08PM (#26552753) Journal

          Sell those things for cash on the street. Don't sell in the same area that you bought the items. Stick to big cities, as the police have way more to deal with than small-time theft. Once you get a big enough stash, use it to start a cash friendly business or find a way to get it to a trusted party in the third world and do the same thing.

          In other words, crime is more work with less reward than just keeping your day job writing Java middleware.

          • Sure (Score:4, Funny)

            by copponex (13876) on Wednesday January 21 2009, @06:20PM (#26553759) Homepage

            If you can make 1,000 a day, tax free, working thirty hours a week. And if they throw you in prison, you can take some classes and write J# middleware when you get out.

            The downside is the anal raping. For most people, I mean.

      • by Grimbleton (1034446) on Wednesday January 21 2009, @04:27PM (#26552201)

        My girlfriend would NOT approve if I stopped eating out.

        • by Bemopolis (698691) on Wednesday January 21 2009, @05:50PM (#26553345)
          Does it really take that many calories to reinflate her?
        • Re:Fencing (Score:4, Interesting)

          by garett_spencley (193892) on Wednesday January 21 2009, @08:06PM (#26554815) Journal

          I have a serious solution to that problem: learn how to cook. As in, learn how to cook SERIOUSLY GOOD food.

          I can spend more on raw ingredients for a single meal than it would cost to take my wife out to a fancy restaurant (not that I do often, just saying that I can), or I can make something amazing for cheaper. And girls dig guys who can cook! Most geeks should like cooking too because there's tons of science involved and most of us like to tinker and make things. Plus when you're done you've got the most amazing meal that, unless you live in New York or LA, can afford to eat at a fine dining restaurant and are lucky enough to get a reservation, you're not going to get eating out.

          My wife and I never eat out any more. We're in a mid-sized town and every time we eat out it's always disappointing. Over priced and something I could make way better at home.

          I recommend "Zingerman's Guide to Good Eating" as a starting point for anyone looking to get into cooking. It explains how to choose the best ingredients, gives you the history of food's as well, and has some simple recipes too.

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      Cash

        • Re:Fencing (Score:5, Insightful)

          by vux984 (928602) on Wednesday January 21 2009, @04:55PM (#26552591)

          Mod parent +5 insightful. Cash is accepted everywhere and stolen cash can't be used for identity theft.

          1) Tons of places won't accept 50's or 100's anymore. And carrying enough cash to live in 20's gets bulky.

          2) Carrying lots of cash (see above) gets noticed (see below).

          3) If you get robbed of cash its gone. No, phoning your bank to let them know your card was stolen. No contesting the purchases made with your stolen cash. Your insurance company won't even replace stolen cash. Its just gone.

          While having my card lifted is a hassle, it won't actually likely cost me anything, even if my identity is stolen it will most likely be a hassle more than anything else. Getting robbed however is much more permanent.

    • Re:Fencing (Score:5, Interesting)

      by AKAImBatman (238306) * <akaimbatman@ g m a i l . com> on Wednesday January 21 2009, @04:00PM (#26551825) Homepage Journal

      Also from the article I read that corrupt retailers and waiters use portable card readers to steal all mag data on the card. How would you protect yourself against that kind of attack?

      As long as we use credit cards, you and I can't protect ourselves. However, the credit card companies could. Using public key authentication via smartcard technology would make it easy to verify physical access to a credit card. Yet the only instance I can think of, of anyone trying to roll this out is American Express's Blue card. Even that was mostly ineffective as the smart card circuitry appears to go mostly unused.

      • Reloadable cards. (Score:5, Interesting)

        by khasim (1285) <brandioch.conner@gmail.com> on Wednesday January 21 2009, @04:28PM (#26552217)

        I'm still wondering why the various banks don't offer reloadable cards for their customers. Why wander around with your ENTIRE credit limit in your wallet?

        And for debit cards, your ENTIRE checking account balance.

        Instead, allow the user to transfer the amount that he thinks he will need to a secondary card. That way, if anything compromises that card, the MOST they can get is whatever he put on that card.

        As for online purchases, how about one-use card numbers? Just go to the bank site, put in how much you want to pay and the bank will give you a one use number for that amount. Then the maximum you lose if the online site is fake is that specific amount. They never get the real numbers to your real accounts.

      • Re:Fencing (Score:5, Informative)

        by samkass (174571) on Wednesday January 21 2009, @04:30PM (#26552243) Homepage Journal

        I think you're right here in the US. When I visited London last year, though, it seemed like every single person had chips in their cards. I felt like a Luddite asking the guy to actually swipe the magnetic strip on a card (and him having to try a couple times before it took), then go find a pen, sign it, then find a place to put the paper signature. Us old-fashioned Americans.

        • Re:Fencing (Score:5, Interesting)

          by atamido (1020905) on Wednesday January 21 2009, @04:38PM (#26552353)

          I had an experience nearly identical to this in London when a shop clerk asking if we had a card with a chip in it to use. The friend I was with didn't even know what he was talking about. I explained things to her, and then told the clerk we didn't, but could wander off and find an ATM to use instead. He dug around some and found a card reader, but it was obvious he hadn't used it in a while.

        • Re:Fencing (Score:4, Insightful)

          by pjt33 (739471) on Wednesday January 21 2009, @05:41PM (#26553233)

          The problem with that system is that it protects the banks and not the customers. Before you could contest the signature: now all they have is a PIN, and there's no way of proving who typed it in. It would be better to use chip, PIN and signature, but people will usually choose convenience over security.

          • Re:Fencing (Score:4, Informative)

            by dotancohen (1015143) on Thursday January 22 2009, @02:46AM (#26557299) Homepage

            The problem with that system is that it protects the banks and not the customers. Before you could contest the signature: now all they have is a PIN, and there's no way of proving who typed it in. It would be better to use chip, PIN and signature, but people will usually choose convenience over security.

            I had to contest a cash withdrawl recently, and because the PIN was entered correctly the bank concluded that it was an authorized purchase and would not be covered. They treat the 4-digit PIN just as they treat a signature.

      • Re:Fencing (Score:4, Interesting)

        by halcyon1234 (834388) on Wednesday January 21 2009, @06:40PM (#26553975) Journal

        It's coming to North America, but slowly. Mainly because it will be expensive, and only serves to protect the consumer.

        Contrast that with the UK banks that have implemented the "chip and pin", where the courts ruled that due to the PIN, they aren't responsible for theft. The banks practically orgasamed all over themselves to get it going.

        It still doesn't offer complete protection. You can take the UK card to Germany, where merchants have not implemented the PIN. Or you can still shop inside the UK; just damage the chip. The card will fallback into "swipe and sign" mode that is used for cards without a PIN (such as those visiting from America).

        Or, even with the chip and pin, all one needs to do is some shoulder surfing. Everyone covers their PIN at an ATM. In other situations, people aren't used to doing that (restaurant, etc). Once you've identified a PIN, pick the person's pocket.

        Or buy things online.

        Or steal a lot of cards, and attempt to brute-force the PIN.

        Or there's an interesting relay attack:

        Consider the following scenario: You go for lunch in a small restaurant in London, and pay using your chipcard at the end of the meal. What you don't know is that the waiter at the restaurant is corrupt. You ask for the bill, and the waiter goes off to fetch a handheld Chip and PIN machine that he brings over to you. Meanwhile, on the other side of town, his accomplice is loitering in a jeweller's store. The waiter sends an SMS message to his accomplice, who goes up to make a purchase. Just as you insert your card into the waiter's terminal, the accomplice puts a fake card into the jeweller's terminal. The waiter's sabotaged reader simply forwards all the traffic from your card wirelessly to the card in the reader at the jewellers, and pretends to ask you to pay for lunch. You enter the PIN, thinking you're paying for lunch, but in fact you're buying the crooks a diamond!

        - "Chip and Spin", http://www.chipandspin.co.uk/ [chipandspin.co.uk]

      • Re: (Score:3, Interesting)

        There's a very cool british TV program called "The Real Hustle" in which they perform popular cons with a hidden camera and then explain them.

        In one episode they show how a waiter can hide a card reader stuck to the side of their leg or under an apron and swipe it after purposely dropping it to the floor and then either picking it up or cleaning it. In this cases the waiters were using the portable reader that goes to your table, and they still were able to steal data.

        • Re:Fencing (Score:5, Interesting)

          by Creepy Crawler (680178) on Wednesday January 21 2009, @04:36PM (#26552327)

          Or if you hand your CC to a drive-thru to pay for food/drink.. Our receipt paper is thin enough to easily take an imprint of a CC. All you'd need to do is remember 3-4 numbers, the CVV2.

          I found out this accidently, while holding a customer CC while rubbing it: it indented the CC, expr, and name perfectly.

          Good thing im honest in dealings... They wouldnt catch me if I wasnt. I know decent stat to calculate my danger, and how to mitigate any possible repercussions.

      • Re: (Score:3, Interesting)

        I have eaten at places that get mobile credit card readers and swipe it at your table. This way, the card never leaves your sight.

        Sure... they'll just swipe over at the server those mobile readers upload to instead. :)

        I've wondered if people with photographic memories get involved with crimes like these since all they'd have to do is glance at a card in passing and they'll catch it.

  • It's like being an undercover mob boss. Except you don't get to: Bang models on their way to the street, Drown rats or wear a cool ring.

    Here is my question: Now that Darkmarket is all busted and closed, will this cop just enjoy a 2nd honeymoon before starting again with a new alias and hitting on a different set of crooks.

    Hell, if he plays his cards right he could enter the private sector and make millions off the MPAA and RIAA.
    • by betterunixthanunix (980855) on Wednesday January 21 2009, @04:14PM (#26552017)
      He probably wants a new assignment that involves less time at a computer. Did you RTFA? He was spending 18 hours a day on his computer, and was online every day of the week. His relationship with his wife was strained because he had to be available on his computer as often as possible to avoid suspicion and to keep his credibility up. He had to report his vacations to the people he was trying to bust weeks ahead of time, to keep up that reputation. To me, that sounds like the sort of assignment that you only participate in once, if only to keep your heart healthy.
      • So Agent Mularski got a taste of what it's like to be a SysAdmin? I think it's a good thing, now he would understand what it's like to work in IT, he'll (hopefully) be more sympathetic to IT staff that he works with... We should get more Law-Enforcement officers into undercover IT "busts"!!!

        Now, if he had a pager that would buzz him in the 6 hours he got "off" from the computer, that would be JUST like being a SysAdmin ;)

    • Re: (Score:3, Insightful)

      How much more such operations could they conduct if they weren't so clueless by having agents investigate peaceful protesters and non-criminal **HACKERS**

      All crimes or suspected crimes deserve thorough investigation. Ruling certain kinds of crimes out-of-reach of the FBI simply due to resource-constraints is equivalent to encouraging the said crimes.

      • Re: (Score:3, Insightful)

        Sure. But, given finite resources, should there not be some rational priorities set?

        -Peter

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        Ruling certain kinds of crimes out-of-reach of the FBI simply due to resource-constraints is equivalent to encouraging the said crimes.

        Crimes like peaceful protesting, you mean?

      • All crimes or suspected crimes deserve thorough investigation. Ruling certain kinds of crimes out-of-reach of the FBI simply due to resource-constraints is equivalent to encouraging the said crimes.

        Right. Because the FBI is out investigating every single federal crime within their jurisdiction, right?

        No. Because the FBI does have limited resources, cases not specifically brought to their attention by promising, credible leads -- or at least serious media attention -- don't get investigated. Those with credible leads that may not look so promising might sit on the backburner -- often for months or years.

        While the FBI does investigate people who turn out to not have been criminals, that's more the exception than the rule.

            • by beav007 (746004) on Wednesday January 21 2009, @06:56PM (#26554161) Journal

              FBI does do some drug crimes I guess, but usually by accident. They're more into the "cool" crimes like Murder, Sex, and Cyber.

              This post is so much entertaining (and possibly accurate) when read without context...

    • by TheRealMindChild (743925) on Wednesday January 21 2009, @03:35PM (#26551423) Homepage Journal
      FYI man, alright. You could sit at home, and do like absolutely nothing, and your name goes through like 17 computers a day. 1984? Yeah right, man. That's a typo. Orwell is here now. He's livin' large. We have no names, man. No names. We are nameless!

      HACK THE PLANET!
    • How much more such operations could they conduct if they weren't so clueless by having agents investigate peaceful protesters and non-criminal **HACKERS** (in the original sense, that is, not meaning "cracker")????

      Sixteen

        • Re: (Score:2, Interesting)

          by Anonymous Coward
          Stopping 70million in bank fraud is useless? Allow me to ask... what then does it take to be usefull?
    • Re:oh lord (Score:5, Insightful)

      by oodaloop (1229816) on Wednesday January 21 2009, @03:36PM (#26551439) Homepage
      I had heard about this at a law enforcement/fraud analysis/intelligence analysis conference a while back. Basically, ALL the major sites were running in the open. Before all the crackdowns, I guess they thought the anonymity of the web meant they were untouchable. After the FBI cracked down on a bunch, they got wise and went underground.
    • Re:oh lord (Score:4, Interesting)

      by betterunixthanunix (980855) on Wednesday January 21 2009, @04:00PM (#26551823)
      As far as I know, the general idea was that the transactions would happen so quickly that even if someone was watching, the money would be long gone before anyone could track it. Keep in mind that these stories are published long after the arrest occurs, so by the time you learn about what happened, the criminals have moved deeper underground.
    • by Achromatic1978 (916097) <robert@@@pennyonthesidewalk...com> on Wednesday January 21 2009, @06:08PM (#26553603)
      Because the merchant agreement specifically states that they are not to use the "Ask For ID" thing as a credit card processing mechanism. In fact they can have their merchant account revoked if sufficient complaints are received about requesting ID for CC transactions and not others (though I know in your case you're asking for it).

      TECHNICALLY, under YOUR agreement with Mastercard, Visa, or Amex, NOT signing your card with your signature is a breach of your cardholder agreement. In fact (though granted, in practice rarely), Visa requires merchants who come across an unsigned / ASK FOR ID card are supposed to not finish the transaction until the card is signed. If you refuse to sign, at least up until recently, the last time I looked at a merchant contract, they're meant to retain your card (uh oh, you do remember the clause in your cardholder agreement that states that the card remains the property of the issuer, not you, right?).

      Not good advice.

Without love intelligence is dangerous; without intelligence love is not enough. -- Ashley Montagu