Forgot your password?
typodupeerror
Security Crime

Who's Selling Credit Cards From Target? 68

Posted by Soulskill
from the it's-the-grinch dept.
An anonymous reader writes "Brian Krebs has done some detective work to determine who is behind the recent Target credit card hack. Krebs sifted through posts from a series of shady forums, some dating back to 2008, to determine the likely real-life identity of one fraudster. He even turns down a $10,000 bribe offer to keep the information under wraps."
This discussion has been archived. No new comments can be posted.

Who's Selling Credit Cards From Target?

Comments Filter:
  • by retroworks (652802) on Wednesday December 25, 2013 @03:50AM (#45780903) Homepage Journal
    Took about 5 minutes to read it. Didn't see any "first posts!" in the interim. Either others find it as fascinating, or I lack a life reading /. at midnight on Christmas eve.
    • by eWarz (610883)
      Primarily number two, it's been eerily quiet tonight..especially given your poor spelling of journalism. I expected the grammar Nazis to be out in full force.
    • by Spy Handler (822350) on Wednesday December 25, 2013 @04:47AM (#45780993) Homepage Journal

      Yes it was very good, Krebs writes well and he seems to know his stuff.

      That being said, was it really that easy? His steps to finding the perpetrator was:

      -Scan underground sites that sell stolen credit cards
      -Do a small buy to get a sample
      -Found cards that matched the ones stolen from Target
      -Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)
      -Contact the perp to see if he makes any incriminating statements (which he did by offering $10k bribe)

      The perp may be an uber elite hacker, but he's very noob when it comes to hiding his tracks.

      • by SternisheFan (2529412) on Wednesday December 25, 2013 @05:57AM (#45781081)
        This morning ABC-TV news reported that they are zeroing in on the thieves (it may be Ukranian hackers), who are having trouble selling the info since there is a glut on the market, not enough buyers. It also reported that phony Target emails are getting sent to affected card holders, customers are being told to go directly to the official Target site to be sure.
      • by Anonymous Coward

        -Contact the perp to see if he makes any incriminating statements (which he did by offering $10k bribe)

        That actually made me wonder if a journalist could make a living by not posting articles.

      • by phayes (202222) on Wednesday December 25, 2013 @07:31AM (#45781245) Homepage

        Krebs does know his stuff & much like J Edgar Hoover, he's been in the business accumulating files on all the underground criminal sites for years. It is this database of info & intimate knowledge of how it all fits together that allows him to dig up the info that budding criminals left online in forums where they let their hair down (assuming that the others were all thieves with honour) and then tie it together with public records. Even "elite hackers" (assuming that the lowlife Krebs exposed really is one) were young once & rare is the teenager who knows not to brag...

        Go Brian, you inspire us all...

        • by berberine (1001975) on Wednesday December 25, 2013 @08:16AM (#45781377) Homepage

          rare is the teenager who knows not to brag...

          Not quite on the same level, but my local paper recently ran a story of a convenience store robbery. The person who did it stole a lot of junk food and close to $1000. The police admitted they had no leads and were clueless about who did it. They were basically saying that the perpetrator was going to get away with it. Two days later, they arrest a 16-year old male because he was bragging to his classmates at school about how dumb everyone was and how smart he was because no one knew it was him.

      • Re: (Score:3, Interesting)

        by Anonymous Coward

        -Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)

        That probably was the more difficult step. Most of these chats had been deleted or archived. And most of it was in Russian. He probaby was on these sites for a while, also note that a lot of these chats are private chats between 3rd parties, so getting ahold of this was probably some work.

    • The "inside job" nutters are not posting here, but they seem to be alive in other threads. That cut down on the normal useless chatter, leaving it open for this useless chatter.

  • Purview of NSA? (Score:5, Insightful)

    by OffTheLip (636691) on Wednesday December 25, 2013 @05:33AM (#45781045)
    If the NSA/FBI/CIA/... was really interested in doing some good with all of the data mining they could solve or at least contribute to resolving cases like this. Prevention would even be better.
    • Re:Purview of NSA? (Score:5, Informative)

      by TechyImmigrant (175943) on Wednesday December 25, 2013 @07:55AM (#45781323) Journal

      Or the banks could switch to chip and pin cards and upgrade the crypto sufficiently to make it secure.

      • Just what I was thinking. I don't know if the banks are stupid, or if their cold calculations really do show that writing off a steady stream of fraudulent transactions is less expensive than upgrading the security. But given their recent track record, such as crashing the economy and causing the Great Recession, I'm of the opinion that smart cards would be less costly in the long run, and that banks are stupid and greedy for not using them. They might have to hire a few software engineers, maybe even so

        • Re:Purview of NSA? (Score:4, Interesting)

          by TechyImmigrant (175943) on Wednesday December 25, 2013 @12:41PM (#45782277) Journal

          My understand is not that they like card fraud, but they do *really really* like the current situation regarding liability. I.E. The banks carry none of the liability. If they are provisioning strong crypto and credentials to ensure secure transactions, the liability landscape changes in way that are bound to be worse than the current optimal (as far as the bank is concerned) situation.
           

        • by swschrad (312009) on Wednesday December 25, 2013 @04:30PM (#45783365) Homepage Journal

          seeing as how the chipped cards cost 5 times as much, I think we can consider this discussion closed :-D you know, the mantra of Wall Street is "screw the future, what are you doing for us this quarter?"

        • by DeSigna (522207)

          I thought this was already the case.

          At least here (AU), it's been practically impossible to get a MasterCard or Visa-backed card without a smartchip for half a decade, and in 2014 signatures will no longer be accepted to validate identity on credit purchases. There's been ads running for about a year requesting that people create a PIN for each of their cards. (AFR rundown [afr.com])

          Bank-issued cards (not store cards) always come with NFC as well now (doesn't seem to be any way to request otherwise). The last non-NFC

          • by thejynxed (831517)

            What is disturbing, is that NFC/RFID chipped cards are basically just a band-aid, and fall to the exact same pitfalls of being able to be read and copied with relative ease using parts you can purchase and assemble at your local equivalent of Radioshack as your average NFC/RFID employee badge or door keycard.

            The funny thing is, is that some of these parts are illegal to sell to the general public in the EU, but Canada, AUS, US, Mexico, etc all have them widely available.

            There's already been demonstrations b

          • that is weird, my CC was just replaced with a chip+pin non nfc (in NZ) but I was in Sydney the other week with my nearly expired chip+pin CC and when using it I was asked to sign instead of using pin...also, New Zealand McDonalds can take purchases under about $15 or something with no authentication whatsoever, I thought that was a bit off.
      • MORE secure, not just secure. Thieves won't commit suicide in frustration: there will still be thefts. They'll evolve. It's pedantic, but I think we all know the dangers of giving a false sense of security, even accidentally through word choices.
        • The whole process will never be secure, since humans are involved and implementations will always have holes, but we do have the mathematics to define algorithms that are known secure in very specific ways and we know how to turn that math into algorithms that we can implement. The least we could do is the crypto bit, since it's not that hard to get right just once for the security of everyone using payment cards. Instead we get a whole bunch of stupid PCI-DSS rules that do nothing to enhance the security o

    • by swb (14022)

      There's about a half-dozen ways to define this kind of crime as a legitimate national security concern, especially given the long history of criminal activity being used to finance insurgency (eg, drugs) or using economic means, such as counterfeiting, to disrupt economies.

      It's not hard to make an argument that widespread credit fraud is more costly and economically damaging than counterfeiting in a modern economy even if the proceeds are only used by criminals for cocaine and hookers instead of funding arm

    • This case could be a huge PR win for the NSA. If they could arrest 10-20 people involved in this using all their data, I think the country would be appreciative. At least they could make their case that their data collection is worth something.

      Of course the NSA has done nothing about this because helping protect the citIzens isn't really their job, it's just their bogus excuse for their actions.

      • by Anonymous Coward

        I'm pretty sure you aren't being sarcastic, but its hard to believe you are being serious. People shouldn't appreciate spy agencies arresting people. Why not arrest 10-20 thousand people like the KGB used to for 1000X the appreciation? The NSA is part of the military. It has no business participating in law enforcement unless martial law has been declared. The "unless there is evidence of law being broken" exemption for whether spying on someone who is otherwise 51% likely to be a US person should be s

      • by Anonymous Coward

        It is against the law to use military forces for law enforcement purposes domestically.

        it's called the 'Posse Comitatus Act

        http://en.wikipedia.org/wiki/Posse_Comitatus_Act'

        The NSA is a military organization ... therefore it is against the rules.

        ADDITIONALLY because of this, none of the information that they collect can be used as evidence in any trial in the US.

        NSA = Tempest in a teapot.

    • The problem is that "terrorism" is more flashy for them. Data breeches of millions of people are just bait for their tracking units. I suppose that means "good for us" that they are spending more effort on "national security" and not misuse of credit cards.

    • by tomhath (637240)
      There's a good chance NSA does share some of what they find with the FBI and Interpol. They would never admit it though.
  • by hey! (33014) on Wednesday December 25, 2013 @08:05AM (#45781343) Homepage Journal

    to do something that furthers his criminal enterprises has a name. It's called "conspiracy".

    So if you ever try your hand at hunting down criminals like this, be aware of the potential danger of tying yourself to the criminal's legal fate. If you've done business withhim that's the least bit shady, and he's overseas beyond the reach of local authorities, things could get quite ugly for you.

  • by jbmartin6 (1232050) on Wednesday December 25, 2013 @09:27AM (#45781561)
    $10,000 to risk his career, professional reputation, etc.? Shows the inexperience of the would-be briber that the sum was so small. 10k doesn't go that far these days...
    • by mysidia (191772)

      $10k. is still a pretty sum.... after income taxes, you can almost afford a trip to disneyworld with it.

    • I read it as desperation, or possibly being used to giving people bribes to make problems go away, not an insult. And perhaps $10K goes a lot further wherever the person offering the bribe is from than wherever Krebbs is from.
  • by Nyder (754090) on Wednesday December 25, 2013 @10:51AM (#45781827) Journal

    I game with someone who works in a high position at one of the top finical firm. And when stuff like this happens, they hear about it and discuss it, since it affects them.

    I can not back this up, this is what is I was told:

    The credit card fraud was because some of the CC scanners have an extra chip in them, put in at a factory, that allows backdoor access to those machines. Not all the CC scanners have this, only some.

    And of course, the extra chip isn't spec.

    The person who told me is out of town till the end of week, so I can't hear any more updates till probably next week on it.

     

    • by wytcld (179112)

      If that's the case, that it's an extra chip in some of the scanners, how many other retailers use scanners from the same factory? Will it be Walmart's CC scans that get dumped on the market next time around?

  • by Anonymous Coward

    I pity the sucker who buys my credit card number.

  • Just because this guy and others are selling them, does not mean that they did the work.

Wherever you go...There you are. - Buckaroo Banzai

Working...