178 Arrested In US/EU Credit Card Cloning Ops 103
eldavojohn writes with this report from Brian Krebs: "Authorities have moved in on 178 people accused of working in credit card cloning labs across the USA and Europe, but with the bulk of the work apparently operating out of Spain. The source states that 'Police in 14 countries participated in a two-year investigation, initiated in Spain, where police have discovered 120,000 stolen credit card numbers and 5,000 cloned cards, and arrested 76 people and dismantled six cloning labs. The raids were made primarily in Romania, France, Italy, Germany, Ireland, and the United States, with arrests also made in Australia, Sweden, Greece, Finland, and Hungary. The detainees are also suspected of armed robbery, blackmail, sexual exploitation, and money-laundering, the police said.' Krebs notes a new credit card debuting at Turkish banks that appears to have a built-in LCD that has a random six-digit number associated with each transaction much like RSA SecurID keys used for computer logins."
lol stealing from investment banks (Score:2, Funny)
if you are going to steal from someone, don't steal from professional thieves.
Doesnt sound very profitable. (Score:4, Insightful)
Close to 200 employees spanning multiple countries. And they take in only 25mil? Not just that but getting cash out of credit card companies I thought was a pain in the ass. Is it 25 mil per year or total? Because if it is total that seems like a shitty business investment. They should just stick to guns, drugs, and prostitution.
Re:Doesnt sound very profitable. (Score:5, Funny)
They should just stick to guns, drugs, and prostitution.
Intrigued, newsletter, etc., etc.
Re: (Score:1, Informative)
No wonder they lacked profitability.
sexual exploitation
First rule: Don't use your own product
Re: (Score:1, Insightful)
Number one is: Don't underestimate the other guy's greed.
The latter lesson may also have played a role in them only netting 25M, tough.
Re: (Score:1)
The greed of the credit card companies?
Re:Doesnt sound very profitable. (Score:5, Insightful)
Most of these people aren't doing it because it's lucrative. They do it because they have no legitimate options. The lowest rungs of any criminal enterprise gets paid shit wages just like any business. 200 people at 20k a year is 4 million for payroll. That leaves over 20 million for the boss.
Re:Doesnt sound very profitable. (Score:5, Insightful)
For many people in those ops 20k a year might be actually a quite decent level of income; compared to, say, the average at the place they are or from which they are.
Re:Doesnt sound very profitable. But is. (Score:1, Informative)
You can win 10k month easily if you do the business by yourself, I'm talking about steal ccs using spam-scams, botnets etc and selling some bds, hacked host and logins you wont use.
Anyway if you to do that you have to discover so vulns to enter in some servers and have so hacked host to do spam and have scams, the mainserver for the botnet and the bds to have emails and eventually some ccs.
EgoPL
Re: (Score:3, Interesting)
I'm on less than £20k per year and it's plenty enough to live on.
Re: (Score:3, Interesting)
Which in Europe is still pretty good wages though. If you don't work (or don't report that you work), you still get paid a minimum wage, your housing and utility costs become subsidized and healthcare is practically free. If you have kids, you get free food and clothing for them. So you get 20k on top of that.
Re: (Score:2)
Re: (Score:3, Interesting)
Perhaps their conscience feels better stealing from credit card companies instead of average taxpayers.
Re:Doesnt sound very profitable. (Score:4, Interesting)
Any countries let you flee from the USA yet?
T'riffic. (Score:3, Interesting)
Terrific. 6 more ways for a mouth-breathing cash-register operator to fuck up your transaction...
Re: (Score:3, Insightful)
Terrific. 6 more ways for a mouth-breathing cash-register operator to fuck up your transaction...
You're perfectly welcome to do the job yourself and do it better than they do. Step right up.
What's that? You're not willing to lower yourself to their level? That work's beneath you? You've got too much dignity? You're not willing to see what the little guy has to do to get by? You never had to work a day of retail in your pampered, high-class life? Well, by all means, you can STFU, ass.
Re: (Score:1)
take over the register of every place he ever wants to ever do business at using a credit card?
Challenge:: ACCEPTED Now I only need to get every register (running Windows XP) to stop by a certain website [slashdot.org]....
Re: (Score:2)
You could also put strychnine in the guacamole! There was salt, big grains of salt...
Re: (Score:2)
Nerd rage much?
This isn't the 90s anymore where if you could spell "TCP/IP", you could get a top tier job in some dot-com startup selling IPX socket wrenches. A college education is no guarantee of anything now. It is pure luck if someone has a job or not unless they are at a peak of their career where their name is their CV. So, count blessings. All it takes is one PHB saying, "OMG, we can offshore this department to Elbonia and I can take credit for the cost savings and buy myself a new BMW!1!1one!"
based on your attitude towards those who serve you (Score:2, Flamebait)
i applaud and endorse them ripping you off, and spitting in your food
be gracious to other human beings, no matter what their socioeconomic status, or suffer, and deserve, the same fate as marie antoinette, for the same reasons
Re: (Score:1)
the stupidity gene has some uncanny survival factor
stupid people are less selective during the breeding process
Agreed. That, and for some reason we have to warning labels on EVERYTHING. Granted, some of them are a bit misleading
"CAUTION: Do not iron while wearing shirt" [middlezonemusings.com]
Seriously, people?!?!
Re: (Score:2)
This reminds me of when I was working at a Fortune 100 company. My boss and I were at a restaurant and were talking to a salesperson about some new gizmo which was very expensive, but we had multiple bids for.
This salesperson was rude as hell to the maitre d' and waitstaff. He ordered one thing, said he ordered something else, yelled at her with choice epithets, demanded another alcoholic drink because the last one wasn't good, then finally stiffed her on the tip. It was so bad that my boss and I both we
Re: (Score:2)
heya,
Err, I've worked some pretty "low-end" jobs. I've done various retail stints for a few years, and I actually still work at a local pool on the weekends now, teaching little kids how to swim. The pay there is terrible, but the work is actually pretty fun.
However, I have to agree with the parent - people who are stuck in low-end retails jobs, year after year, are often there because they're got no other choice. (I'm not talking high-school or college kids getting extra allowance on the side here - I mean
Random? (Score:2)
SecurID is pretty much the exact opposite of a random number.
Re:Random? (Score:5, Informative)
Er, a reasonable working definition of "random" is "you can't predict it." The card changes its displayed number every N seconds. The card's pseudo-random number generator has an algorithm and a seed value which are generally unknown to the user, and unknown to the merchant. It was produced in sync with the server, and continues to compute the numbers in parallel with the server. Even if the thief knows the algorithm, they would require significant time (an understatement) to acquire enough samples to accurately predict the next number that the server is expecting. So, for all practical purposes, yes, it's random.
Re: (Score:3, Informative)
Except that it's not a random number or a random number generator.
It's a cipher generator, which is what Stradenko is getting at -- it's also what you're getting at, ironically. If the numbers were totally random, they would be useless. What it's doing is applying the downside of PRNGs - namely, their predictability - to create a sequence that is known to the computers in question, but appears random to the observer. If you seed multiple generators, all with the same algorithm, then you'll get the same s
Re: (Score:1, Insightful)
There is no requirement that it use a PRNG. A simple LUT containing a list of predetermined values could be used instead. In this case, they would act as one-time pads and there would be no way to crack them.
16MB gets you 1 256-bit key every minute for a year.
Re: (Score:2)
16MB gets you 1 256-bit key every minute for a year.
Given that you can get microSD cards in 32GB capacities now, at least from a size point of view that is definitely not a problem.
Re: (Score:3, Funny)
"Even if the thief knows the algorithm, they would require significant time (an understatement) to acquire enough samples to accurately predict the next number that the server is expecting. So, for all practical purposes, yes, it's random."
Yep, digital security, almost always infallible. When was the last time a digitally secure system was broken? About 15 minutes ago? Well, I'll be sleeping easier tonight, surely.
Re: (Score:2)
Joe Crackhead might not be able to do much on his own, but an organized crime ring can use people like Joe to deliver a stream of stolen cards. If a smart crook can find a way to exploit them in batches, Joe will continue to steal them as long as he gets paid.
Regardless, the risks to ordinary people still drop by an order of magnitude or four.
Re: (Score:3, Interesting)
"This short paper will examine several discovered statistical irregularities
in functions used within the SecurID algorithm: the time
computation and final conversion routines. Where and how these irregularities
can be mitigated by usage and policy are explored."
http://www.linuxsecurity.com/resource_files/cryptography/initial_securid_analysis.pdf [linuxsecurity.com]
My point is just because it is encased in plastic does not mean that the number can not be determined.
- SR
Re: (Score:2)
Great explanation. The way I like to think about it is that randomness is not a property of the number, but of the generator.
> a random six-digit number associated with each transaction
Validating transactions. It's about damn time.
Dilbert comments (Score:2)
http://clipmarks.com/clipmark/4905F106-063A-401C-8631-392E2E49652A/ [clipmarks.com]
Re:Random? (Score:4, Funny)
No, it's that nobody can predict it.
You haven't got a hope in hell of predicting the next number I write down, but for me it's a certainty.
Re: (Score:2, Informative)
Spain, Really? (Score:2)
Re:Spain, Really? (Score:5, Insightful)
Actually, innovating with new forms of income is why nations are going broke these days.
They're pretending that speculation is investment, borrowing is income, and money-multiplication through circular lending is economic growth.
And hidden among these obvious insanities is a much more subtle one that will snap the rubber band: they track money borrowed to speculate as risk at the interest rate of the loan, not at the rate-of-ruin of the speculation.
The United States was as usual the most innovative, and therefore led the world. To a precipice and beyond. As usual by setting a good example.
Very good (Score:1)
One of the best and simplest and clearest descriptions of this huge ripoff economy I have read, mucho props to you.
The sad part is, millions of otherwise intelligent people are still defending those thieves, the thieve's political sockpuppets, and this conjob-based economic system in general.
Re: (Score:3, Interesting)
TFA is to PC to say it outright, but putting Romania at the head or the list says it is a Gypsy operation.
These are multi-generational career criminal families. And the Spanish police seem unable to do anything about it.
There was a good documentary on the BBC:
How Gypsy gangs use child thieves [bbc.co.uk]
Re: (Score:1)
TFA is to PC to say it outright, but putting Romania at the head or the list says it is a Gypsy operation. These are multi-generational career criminal families. And the Spanish police seem unable to do anything about it. There was a good documentary on the BBC:
How Gypsy gangs use child thieves [bbc.co.uk]
really? bet you never had contact with a gypsy your whole life.
I am a big fan of BBC documentaries almost all are very well done. The problem with those is that not any dummy can understand. Sometimes I cannot believe what some ppl get from such documentaries. And although I have not seen this one, sounds like it was your case too.
Gypsies are "low-tech" crime experts .. small time thieves, children/women exploitation, etc.
The vast majority are illiterate and the bosses make no exception. And probab
False security (Score:3, Insightful)
178 people. Remember that number.
Unless the card is radioactive it's not "random"... it's pseudorandom, and therefore based on an algorithm. Figure out the seed (initial vector) and other inputs, and you're right where you started, only your clients feel more secure and the criminals have to spend an extra few bucks. Given that there are multinational laboratories churning out thousands of dup cards, and assuming they have an active distribution network... it's safe to say these aren't the only guys or the first.
Re: (Score:1)
And no excellent karma yet? I thought they handed out karma to everyone...
Re: (Score:2)
Apparently it's more complicated than some hand waving at "other inputs" or nobody would use the RSA security cards that operate on the same principal.
Re: (Score:3, Informative)
Apparently it's more complicated than some hand waving at "other inputs" or nobody would use the RSA security cards that operate on the same principal.
No, it is not complicated: There's a number being displayed on the card every six seconds. For it to have any value in authentication, that number needs to be somewhere else every six seconds too. Which means it's not "random". It might pass every test for random, but it isn't. Which means there is an algorithm in place. That algorithm requires two things: First, that it stay syncronized (time), and second that there's a reference point shared between the circuitry on the card and the bank where that number
Re: (Score:1, Insightful)
Those requirements all lead to one conclusion: PRNG. The seed is probably a key of some kind plus time. There are at least two places that key is kept: On the card, and at the bank
Congratulations, you have just deduced the information available in a SecurID brochure. The "key of some kind" is a 128 bit key associated with the serial number of the device. It is stored on the device, and on the RSA authentication server. If you're talking about cracking open a stolen device and *voila* extracting the key, you may have a matter of hours to a long weekend to do so before it is reported stolen; thus negating any benefit of cloning it. If your goal is to steal it from the server, well,
Re: (Score:2)
There's millions of RSA cards in use now that work basically like that, many are in the hands of business accounting folks who use them to manage cash accounts of $100,000 or more. Consumer credit cards are peanuts in comparison; why haven't the RSA cards been compromised if its so easy?
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
And yet my family in colombia are having their accounts emptied by thieves who always find a way around anything magnetic based.
My card with it's number generator has been fine. It is so common down there that they actually have a number you call when you have used the card in what they consider a "shady" place.
I have seen the cards get skimmed first hand , they are not to good at it. And the cards are literally turned out in hours and being used to buy stuff.
Re: (Score:1)
Re: (Score:2)
You could, however, sell it as a service with an app that displayed all 'hot' card #s and validation codes as they got intercepted, allowing your clients access to a sort of aggregate-clone card. You could even track the compromised cards usage statistics to offer up cards
Re: (Score:2)
In an age where stocks are traded in millisecond timescales, I expect that some MITM attack that has "only" 60 seconds to take advantage of a number will indeed find a way to do so. Particularly if the MITM takes place on the internet. The information is already in a computer. There's even traffic going out *almost* concurrently with the attack, to cover the tracks.
Re: (Score:1)
Re: (Score:2)
Sorry, but the magtek "solution" is a band-aid at best, and far more likely to be snake oil. It's expensive to deploy the fancy proprietary hardware to every single merchant, and as soon as the cloners improve their technology the whole thing fails epically.
The entire "security" of the magtek system comes from a technical difficulty that nobody's had the economic incentive to try to break, not that it's technically unbreakable.
If adopted, I predict that magtek will make their money, then collapse under the
Re: (Score:2)
Why would merchants need need new hardware? AFAIK the auth code from the card is checked on the back end; merchant systems may need new software to process the transactions so that they can include the auth code from the card.
Like any other security solution, it doesn't have to be perfect, it only has to make it complex and expensive enough that crooks move along to some other form of crime.
Re: (Score:2)
You missed that I was replying to the GP poster who said that the magtek solution (a discriminating read head is installed on the POS terminals) was a good one. It is not. The magtek solution is a terrible solution for all the reasons I mentioned.
This new card solution mentioned in the article has an actual basis in cryptography for being more secure than mag stripes. Yes, it can still be MITM and browser hijacked, and will still be susceptible to unauthorized stored reuse (keeping your card on file for aut
Re: (Score:1)
Re: (Score:2)
Once criminals get a hold of the new read heads, and learn how to measure the "fingerprints" they will be able to clone the mag stripes. If you can read it magnetically, you can copy it digitally, and you can create a clone that passes the digital tests perfectly. I am not saying I can personally clone the cards yet, but it is inevitable that if this new technology becomes the standard, it will be broken by criminals with the resources to do so. It has not been broken yet simply because it is not widely
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
TFA is discussing the Maestro card being tested by MasterCard in Turkey that has an on-card display of an authorization number. This is identical in practice to an RSA SecurID token. The number proves that the card is authentic and not a clone. Since this number can be keyed by the customer in place of the PIN, the mechanisms exist today for authenticating it. That's a weakness in usability, but a serious improvement in security. It also has the potential to cost the merchants nothing, as it can be use
Re: (Score:2)
Now here's the kicker: 100,000 credit cards linked to a random cross-section of the population is worth a fair amount of money. Probably more than the cost of cracking that protection. And that means it's still profitable and practical to crack it.
No, it certainly does not. Assumptions about ROI do not prove a venture is profitable. Facts about the cost to obtain and crack one RSA token, and how much you could sell it for (which would be a fraction of it's value)*, might prove this venture feasible; but the current, dependable state of RSA-token-based security suggests that it is not.
Re: (Score:2)
Facts about the cost to obtain and crack one RSA token...
Why do people on slashdot invariably assume that the most difficult to attack component is the measure of the security of the system? O_o
Re: (Score:2)
Re: (Score:2)
Assuming there isn't a weakness in the key, or how it's stored on the chip. Perhaps simply having physical possession of the card for a minute is enough to 'scan' it and reveal the key.
Re: (Score:2)
Modern cryptographic (RSA-based) smart cards have demonstrated a consistently high cost of attack, and attacks currently require the destructive opening of the chip and a high resolution microscope and probe, or that they be hooked up to a precision power supply and are subjected to thousands of attacks on the power and timing, not to mention requiring the presence of a PhD to interpret the results. There is some speculation of an RF based attack on the timing as well, but that hasn't been demonstrated yet
Re: (Score:1)
Re: (Score:2)
The problem is you still cannot prove that you are paying your money to Ikea or to Big Tony's House of Theft. You personally don't know Ikea's account number, so you could still be falling victim to a spoofed site. The likely avenue of attack for Big Tony is to find a patsy to register a legitimate looking business with the banks, generate a usable account number, run a few fast scams, and tale off with the money once enough suckers have fallen for the bait.
The only truly secure way to avoid this kind of MI
Re: (Score:1)
Wouldn't it be funny... (Score:2)
...if the bank card wasn't using some RSA-style system but instead just had an LCD display in the card that changed numbers and just made it LOOK like the numbers were used for some kind of high-strength cryptography?
It might even be half-assed effective if it made it all the more complicated to manufacture/obtain card blanks. Bonus points for the numbers displayed on the LCD display meaning something halfway useful (some kind of hash representing the card number and the current date) but not really repres
T-Spam (Score:1, Interesting)
In a couple years, 90% of all financial transactions will be fraudulent, like spam e-mail.
Electronic OTP card is highly vulnerable (Score:1)
Re: (Score:2)
I have followed PassWindow ever since it was seen on The New Inventors on Australian TV and I think its a GREAT idea. I for one would LOVE to see my bank offer this on my Visa Debit card.
Re: (Score:1)
Re: (Score:2)
There is a potential issue with your system in situations where the user makes multiple transactions over time.
The following assumes that a passive trojan is acting as a MITB (man in the browser) and can access both the outbound images and inbound responses. That is obviously not trivial, but possible none-the-less.
After a single transaction, it should still be theoretically impossible to deduce with 100% certainty the pattern on the user's card.
However, as the user performs more and more transactions, the
Re: (Score:1)
Re: (Score:2)
The concept is excellent. It's great to see that your cryptanalysis suggests that there is more than sufficient security margin in the animated challenge / static key generator algorithms that you've created.
Although, they aren't immune from active attackers as you've described, the primary benefit of the OTP secure token is that passive evesdropping at any single point is insufficient to compromise the system.
Whereas, while PassWindow is immune to trojan interception, it doesn't solve the problem of the pr
Re: (Score:1)
Re: (Score:2)
One great idea after the next!
Out of interest, how did you come up with your figure of 10000 interceptions?
After thinking about it for a bit, I get the impression that 10000 is quite high for this type of cipher.
The method boils down to a boolean 'OR' of two inputs to produce an output. Only one of the inputs and a section of the output pattern are known. The output pattern is known to exist, but at one of a few possible locations within the combined field. This implies that all other valid outputs do not e
Re: (Score:1)
Re: (Score:2)
Sounds like some decent security analysis has been done. Very impressive that such simplicity can be so effective. I hope it takes off sooner than later.