Who's Selling Credit Cards From Target? 68
An anonymous reader writes "Brian Krebs has done some detective work to determine who is behind the recent Target credit card hack. Krebs sifted through posts from a series of shady forums, some dating back to 2008, to determine the likely real-life identity of one fraudster. He even turns down a $10,000 bribe offer to keep the information under wraps."
Good Journalsim, Good Article (Score:5, Interesting)
Re: (Score:2)
Re:Good Journalsim, Good Article (Score:4, Insightful)
Spelling is not properly within the jurisdiction of the Grammar Nazis; we apologize for any overstepping of boundaries in this regard that may have occurred in the past.
Re: (Score:3)
Re: (Score:2)
LOL
I fiddled with gtranslate and got
Rechtschreibung Jugendkorps
I'll use both. :)
Re: (Score:2)
Re: (Score:2)
Not since Noddy Holder verbally omitted the apostrophe in a song.
.
Re: (Score:2)
You've been so long
Well, it's been so long
And I've been putting out fire
with gasoline
putting out fire with gasoline
It's is a contraction for it is or it has.
http://garyes.stormloader.com/its.html [stormloader.com]
Re: (Score:2)
Re: (Score:2)
Re:Good Journalsim, Good Article (Score:5, Insightful)
Yes it was very good, Krebs writes well and he seems to know his stuff.
That being said, was it really that easy? His steps to finding the perpetrator was:
-Scan underground sites that sell stolen credit cards
-Do a small buy to get a sample
-Found cards that matched the ones stolen from Target
-Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)
-Contact the perp to see if he makes any incriminating statements (which he did by offering $10k bribe)
The perp may be an uber elite hacker, but he's very noob when it comes to hiding his tracks.
Comment removed (Score:4, Informative)
Re: (Score:1)
That actually made me wonder if a journalist could make a living by not posting articles.
Re: (Score:3)
They can, they even have a special name for them: Blackmailer.
Re:Good Journalsim, Good Article (Score:5, Insightful)
Krebs does know his stuff & much like J Edgar Hoover, he's been in the business accumulating files on all the underground criminal sites for years. It is this database of info & intimate knowledge of how it all fits together that allows him to dig up the info that budding criminals left online in forums where they let their hair down (assuming that the others were all thieves with honour) and then tie it together with public records. Even "elite hackers" (assuming that the lowlife Krebs exposed really is one) were young once & rare is the teenager who knows not to brag...
Go Brian, you inspire us all...
Re:Good Journalsim, Good Article (Score:4, Interesting)
rare is the teenager who knows not to brag...
Not quite on the same level, but my local paper recently ran a story of a convenience store robbery. The person who did it stole a lot of junk food and close to $1000. The police admitted they had no leads and were clueless about who did it. They were basically saying that the perpetrator was going to get away with it. Two days later, they arrest a 16-year old male because he was bragging to his classmates at school about how dumb everyone was and how smart he was because no one knew it was him.
Re: (Score:3, Interesting)
-Dig through various forum/social network archives to see if any matched the owner of the underground site (from step #1)
That probably was the more difficult step. Most of these chats had been deleted or archived. And most of it was in Russian. He probaby was on these sites for a while, also note that a lot of these chats are private chats between 3rd parties, so getting ahold of this was probably some work.
Re: Good Journalsim, Good Article (Score:2)
Really, they don't become cops because they like working with computers. I don't know of a single large metropolitan police department that actually has a computer crimes division, even here in Seattle.
Re: (Score:2)
Seriously if Krebs could track the idiot down why is there no outrage or any police effort to nab the guy!!
Um, possibly because he's in the Ukraine and paying the local cops a shedload of money to look the other way, and no-one expects any different.
Re: (Score:2)
Re: (Score:2)
The "inside job" nutters are not posting here, but they seem to be alive in other threads. That cut down on the normal useless chatter, leaving it open for this useless chatter.
Purview of NSA? (Score:5, Insightful)
Re:Purview of NSA? (Score:5, Informative)
Or the banks could switch to chip and pin cards and upgrade the crypto sufficiently to make it secure.
Re: (Score:2)
Just what I was thinking. I don't know if the banks are stupid, or if their cold calculations really do show that writing off a steady stream of fraudulent transactions is less expensive than upgrading the security. But given their recent track record, such as crashing the economy and causing the Great Recession, I'm of the opinion that smart cards would be less costly in the long run, and that banks are stupid and greedy for not using them. They might have to hire a few software engineers, maybe even so
Re:Purview of NSA? (Score:4, Interesting)
My understand is not that they like card fraud, but they do *really really* like the current situation regarding liability. I.E. The banks carry none of the liability. If they are provisioning strong crypto and credentials to ensure secure transactions, the liability landscape changes in way that are bound to be worse than the current optimal (as far as the bank is concerned) situation.
purview of banks investing in security (Score:5, Insightful)
seeing as how the chipped cards cost 5 times as much, I think we can consider this discussion closed :-D you know, the mantra of Wall Street is "screw the future, what are you doing for us this quarter?"
Re: (Score:2)
I thought this was already the case.
At least here (AU), it's been practically impossible to get a MasterCard or Visa-backed card without a smartchip for half a decade, and in 2014 signatures will no longer be accepted to validate identity on credit purchases. There's been ads running for about a year requesting that people create a PIN for each of their cards. (AFR rundown [afr.com])
Bank-issued cards (not store cards) always come with NFC as well now (doesn't seem to be any way to request otherwise). The last non-NFC
Re: (Score:1)
What is disturbing, is that NFC/RFID chipped cards are basically just a band-aid, and fall to the exact same pitfalls of being able to be read and copied with relative ease using parts you can purchase and assemble at your local equivalent of Radioshack as your average NFC/RFID employee badge or door keycard.
The funny thing is, is that some of these parts are illegal to sell to the general public in the EU, but Canada, AUS, US, Mexico, etc all have them widely available.
There's already been demonstrations b
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
The whole process will never be secure, since humans are involved and implementations will always have holes, but we do have the mathematics to define algorithms that are known secure in very specific ways and we know how to turn that math into algorithms that we can implement. The least we could do is the crypto bit, since it's not that hard to get right just once for the security of everyone using payment cards. Instead we get a whole bunch of stupid PCI-DSS rules that do nothing to enhance the security o
Re: (Score:3)
There's about a half-dozen ways to define this kind of crime as a legitimate national security concern, especially given the long history of criminal activity being used to finance insurgency (eg, drugs) or using economic means, such as counterfeiting, to disrupt economies.
It's not hard to make an argument that widespread credit fraud is more costly and economically damaging than counterfeiting in a modern economy even if the proceeds are only used by criminals for cocaine and hookers instead of funding arm
Re: Purview of NSA? (Score:3)
This case could be a huge PR win for the NSA. If they could arrest 10-20 people involved in this using all their data, I think the country would be appreciative. At least they could make their case that their data collection is worth something.
Of course the NSA has done nothing about this because helping protect the citIzens isn't really their job, it's just their bogus excuse for their actions.
Re: (Score:2)
I'm pretty sure you aren't being sarcastic, but its hard to believe you are being serious. People shouldn't appreciate spy agencies arresting people. Why not arrest 10-20 thousand people like the KGB used to for 1000X the appreciation? The NSA is part of the military. It has no business participating in law enforcement unless martial law has been declared. The "unless there is evidence of law being broken" exemption for whether spying on someone who is otherwise 51% likely to be a US person should be s
Re: (Score:1)
It is against the law to use military forces for law enforcement purposes domestically.
it's called the 'Posse Comitatus Act
http://en.wikipedia.org/wiki/Posse_Comitatus_Act'
The NSA is a military organization ... therefore it is against the rules.
ADDITIONALLY because of this, none of the information that they collect can be used as evidence in any trial in the US.
NSA = Tempest in a teapot.
Re: Purview of NSA? (Score:2)
Re: Purview of NSA? (Score:2)
The problem is that "terrorism" is more flashy for them. Data breeches of millions of people are just bait for their tracking units. I suppose that means "good for us" that they are spending more effort on "national security" and not misuse of credit cards.
Re: (Score:2)
Accepting money from a criminal (Score:3)
to do something that furthers his criminal enterprises has a name. It's called "conspiracy".
So if you ever try your hand at hunting down criminals like this, be aware of the potential danger of tying yourself to the criminal's legal fate. If you've done business withhim that's the least bit shady, and he's overseas beyond the reach of local authorities, things could get quite ugly for you.
That's an insult (Score:3)
Re: (Score:2)
$10k. is still a pretty sum.... after income taxes, you can almost afford a trip to disneyworld with it.
Re: (Score:2)
Interesting, but I heard another tale (Score:3, Interesting)
I game with someone who works in a high position at one of the top finical firm. And when stuff like this happens, they hear about it and discuss it, since it affects them.
I can not back this up, this is what is I was told:
The credit card fraud was because some of the CC scanners have an extra chip in them, put in at a factory, that allows backdoor access to those machines. Not all the CC scanners have this, only some.
And of course, the extra chip isn't spec.
The person who told me is out of town till the end of week, so I can't hear any more updates till probably next week on it.
Re: (Score:2)
If that's the case, that it's an extra chip in some of the scanners, how many other retailers use scanners from the same factory? Will it be Walmart's CC scans that get dumped on the market next time around?
Re: (Score:3)
Caveat Emptor! (Score:1)
I pity the sucker who buys my credit card number.
but who actually cracked the Target network? (Score:2)