Target Hackers Have More Data Than They Can Sell 118
itwbennett writes "The hackers who stole millions of credit card numbers from Target customers are probably 'laying low knowing that everyone is looking for them,' says Alex Holden, who runs cybercrime consultancy Hold Security. But it's also likely that they can't sell them: 'You can imagine that having a lot of stolen credit cards will not net the hackers, say $35 per card for all 40 million,' said Holden. 'Even if the hackers are willing to sell cards for $1 a card, no one will buy the stolen goods in these amounts.'"
Proposal for new *coin (Score:2, Funny)
Re: (Score:2)
Don't they already offer The Red Coin?
Paranoid much? (Score:2, Insightful)
What kind of awful bank / credit card company do you have that charges you a replacement fee? I literally replaced my debit card and credit card without any fee, and my debit card was even replaced with a temporary one free of charge.
Furthermore, most of them would likely prefer to send out a card rather than have to deal with claims of account fraud, which costs them money to investigate as well as to eventually replace.
I'm no fan of the banks, but this is ridiculous.
Re: (Score:2)
My bank sent me a replacement debit card in the mail without charge and without even asking. I just got a letter apologizing saying that my card may have been compromised, so they sent me a replacement the same way they would have if my card had expired, so no charge and a new card with a new number.
Re: (Score:2)
Re: (Score:2)
Hmmmm...
So, do I pay $50 to the bank right now, or do I risk possibly, maybe being liable for up to $50 later on? I can't decide.
Stupid People (Score:4, Insightful)
You can always reduce things. They can sell a smaller subsets.
Re:Stupid People (Score:4, Insightful)
But the buyers know (roughly) how many cards are available. The media has seen to that. So they know its a buyers' market.
Re: Stupid People (Score:4, Interesting)
I'm surprised I haven't seen anyone mention this, but I think they single-handedly killed the market. Think about it...no one knows all of the CC numbers yet. Not only should no one buy off of those guys, but no one knows who those guys are. So if say 80% of the cards are cancelled there are now 32 million legitimate useless credit card numbers out there.
No one is going to trust anyone. I have a feeling this is going to do the blackhat community quite a blow.
Re: Stupid People (Score:4, Interesting)
As some one who deals with security on a daily basis, I have seen tools to prevent this.
What happens is someone advertises say 10 K cards for sale. They actually package 15 K cards in the pack, when the user gets the pack they have a robot ap that goes and makes purchases from shops that are on the internet and are known to be able to easycard fraud friendly. The robots order something quickly like a $20 cable or piece of merchandise. If its declined the card is dropped from the database.
Once all the cards are checked if the buy has close to 10 K they don't care. If less then say 8 K they get another chunk of 4 K to go at again. Until they get close to the 10 K they were promised. This is how the good groups do it. The ones who don't care just sell in chunks of 5 K to 10 K with no guarantees.
Now they also can use another system for cards to do quick transactions checks just like paypal would do to check if the card is valid. Small bump purchase then issue a refund if they want to hide from the owner of the card.
I have to monitor these "groups" as I need to make sure that none of my servers are being used in their scams. A good security guy keeps his eye on everything ! And yes we monitor IRC and other methods of chatter to see if any of our servers have been compromised.
Re: (Score:2)
There is still the initial transaction. It's not hard to anonymize on the internet.
Re: (Score:2)
Especially if they have a lot of smurfs selling for them.
Re: (Score:1)
This is so fucking obvious that it is really really sad somebody had to point it out.
Re: (Score:1)
It's also fucking obvious that the second set they sell will be worth about 10 cents since everyone will have canceled their cards by then.
Re:Stupid People (Score:5, Informative)
You can always reduce things. They can sell a smaller subsets.
This. Thefuck is this article? The guy who broke the breach [krebsonsecurity.com] also pointed out where the cards were getting sold at [krebsonsecurity.com] too. This article is a muse on a blog by a supposed "pundit" (pundit, n.: one whose insistence of credibility is the only thing greater than their ignorance).
Re: (Score:2)
Cybercriminals often advertise the kind of data they've captured from the card's magnetic stripe, which has three so-called "tracks," each containing data.
News flash. They are called tracks because they are tracks on a magnetic recording tape. Nothing "so called" about it.
Re: (Score:2)
FTFY
So what? (Score:1)
Seeing that (Score:5, Insightful)
next to everybody's card has been stolen, is it time for everybody to get a new card? It'll make the stolen database worthless, as well as all other databases of stolen credit cards...
Spoiler alert (Score:5, Funny)
Re: (Score:3)
Probably not worth a dollar... (Score:5, Interesting)
Re: (Score:1)
This is not true. Chase has not sent everyone a card. My wife had two transactions at target on two different debit cards and has not received a new card from either bank.
Re: (Score:3, Insightful)
Whereas if they were credit cards, if stuff happens it's the bank/merchant's money that's gone and they'd have to try to get the money from her or their insurer or eat the loss.
See the difference in urgency?
Re: (Score:2)
Re: (Score:2)
That depends on your bank. A lot of reasonable institutions don't have different policies regarding credit/debit regarding fraud. If your bank sucks like this, time for a new bank.
A lot of banks CLAIM to have the same policy (zero liability for debits cards, etc.), the reality of the matter is that getting the money back into your account with debit card fraud can be a significant hassle (and can take awhile). With credit, the money has never officially left YOUR account yet.
Absolutely no reason to use a debit card unless you're literally taking cash out of your account at an ATM. The protections just aren't as good as credit cards, plus if you always pay them off, it doesn't cos
Re: (Score:2)
Because the bank still has to cover it if it's stolen. The only thing that makes debit cards more painful is that you can bounce checks not realizing someone has made charges against it.
Re: (Score:3)
Re: (Score:2)
The value of the purloined data is heading towards nil quickly.
I just got a robo call today that I'll be getting a new credit card (number) soon.
My current number will still be good till the end of the month.
So at least for my issuer, that's how long the criminals have to commit some fraud.
Re: (Score:2)
Re: (Score:1)
De Beers and OPEC (Score:3, Insightful)
What me worry? (Score:2)
So they dump a small portion of them for free all over the place. If some who use it get busted it's a smoke screen but they can claim they're freedom fighting Robyn Hoods or something. My bank can only dock me $50 except that I have a plan that is free which means I don't get docked squat the bank eats it.
Re: (Score:1)
So they dump a small portion of them for free all over the place. If some who use it get busted it's a smoke screen but they can claim they're freedom fighting Robyn Hoods or something.
You took that right out of the Ed Snowden game plan, didn't you? ;)
Re:What me worry? (Score:5, Informative)
Actually, the merchant eats it - at least that's been my experience as a merchant. The ingestion process is called a chargeback [wikipedia.org]. It's one reason why credit card issuers are so glad to make refunds to consumers. Merchants live in fear of chargebacks because not only do they lose the revenue, they also have to pay a penalty.
As a merchant, you quickly figure out that it's best to accommodate any request for a refund, even if you think you're being treated unfairly. For example, I recently had a customer in another country who asked me to pay his local taxes on the sale I had just made to him. So I gave him a refund for the amount of the tax. Easy decision.
(I shouldn't be telling you folks this, it's supposed to be a dirty little secret. Don't tell anybody else.)
Re: (Score:1)
Chargebacks are definitely annoying for physical merchants, but are even worse if you're selling stuff online or have a presence in more than one state. I did some work for a company that sells specialized sports equipment and has stores in four or five states, as well as selling things at various events. The problem was that due to the way their payment system worked, they had to present their physical location - their main store in my state - on every transaction. So many people who bought things on the r
Re:What me worry? (Score:4, Interesting)
Somehow, as a favor to someone, I ended up managing the operations of a service based company for a short period of time. We would have customers that constantly were saying: "Do you know who I am?" Usually the past, past, past president of some condo association. Or customers who thought we'd starve without their business and make all kinds of unreasonable demands that would result in a loss to us. We'd let that happen maybe two or three times and when it became apparent that the customer's behavior was chronic I would simply tell them that our goal was to satisfy our customers in every way and obviously we were unable to meet their needs. We valued their satisfaction and felt they would be better served by another company. I'd then suggest a competitor for them to call. The reactions were priceless! They couldn't believe they were being "fired". It helped us two ways. First, it freed up our resources to service the customers who appreciated being treated fairly (and we really were service oriented, money back guarantee on everything.) Second, by the time our competitor figured out what kind of customer they just took on they had suffered the loss.
This was a service industry where there was more work to do than we had people to do it so there really was no loss to us in culling the bad ones. Offtopic I know but maybe someone will benefit from our experience.
Re: (Score:1)
Re: (Score:2)
From a merchant's point of view, a system like Bitcoin that puts the merchants back in control of refunds sure sounds appealing. However, I believe most customers appreciate the security of having a third party like a credit-card issuer to go to when there is a dispute. In starker terms, customers enjoy the power they currently hold. So, if the use of Bitcoin eliminates fraudulent chargebacks but reduces overall sales, it still may not be in the merchant's best interest.
Also, from the merchant's point of
Re: (Score:3)
For online transactions, you're pretty much SOL. The credit card companies provide tools to let you try to confirm the cardholder is legit before completing the transact
Re: (Score:3)
The onus is upon the merchant to prove the charge was legit. For an in-store transaction, this usually means a copy of the signature on the credit card receipt. You send that to the credit card clearinghouse, they compare it to the signature the credit card company provides, and decide if the cardholder really made the purchase or not.
In light of that, it fascinates me that those electronic signature gizmos at stores work so badly. Half the time, I can't even recognize my own signature because half of it's missing. I guess signature comparisons to dispute chargebacks must not happen very often - I assume that merchants just roll over and die most of the time. The fact that we're all faithfully made to sign on those things probably is just psychology to make us feel like we can't commit friendly fraud [wikipedia.org] by disputing our own purchases.
only in theory. call the customer (Score:3)
Theoretically, yes. Practically, it doesn't happen.
You sell something. 40 days later, the customer calls their bank. The bank mails a form, which the customer receives 10 days later. They fill it in and mail it back. 14 days later, the bank deducts the amount from the merchant's receipts. Ten days after that, the merchant receives a letter saying they've been charged back for a transaction that occurred over two months ago. They money has already been taken from them, subtracted from recent sales.
IF the
Re: (Score:2)
As a consumer, please keep in mind your credit card provides strong protection from FRAUD. When you call the bank and charge back, you are accusing someone of fraud.
Or (unrealted to the Target hacks) of having an unreasonable returns policy that is not consistent with what the sales guy promised. So yes, I suppose that is fraud, though incompetence is a more likely explanation.
It has arrived! (Score:5, Funny)
Re:It has arrived! (Score:4, Informative)
That's the latter day corollary to hiding something in plain sight.
Uh, it's not 40 million... (Score:4, Interesting)
Comment removed (Score:5, Interesting)
Re:Uh, it's not 40 million... (Score:5, Interesting)
Wait, American's aren't using chip and pin yet?
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Same-sex and weed have fuck all to do with establishing standards of measurement.
You saw all the trees and asked where the forest is. That happens far too often on this site because too many of you want to find fault with the other guy so you can feel clever.
The (slightly) abstract principle here is that overcoming inertia in order to effect change is often difficult no matter what that change may be or how overdue it is. That's what the otherwise unrelated issues of same-sex couples, legalization of marijuana, and implementing the metric system all have in common. You'd have noti
Re: (Score:2)
Re:Uh, it's not 40 million... (Score:5, Insightful)
Our banks are run by people who play "executive musical chairs". If something will save the bank a million dollars over the next ten years, but nothing for the first three years, it won't get implemented because the executives will have rotated out to another company by the time the savings could affect their quarterly bonuses. Chip and pin would cost the banks money to implement, so it won't happen until you get a set of executives who can see further than the next board meeting.
Re: (Score:2)
The 110m number is comprised of 40m credit and debit cards as well as personal data of 70m individuals. The latter includes names, addresses, phone, and email records but not credit/debit card.
The 40m cards is not 40m customers, as customers may have used multiple cards during the breach. The 70m customer with stolen personal data also likely has a huge overlap with the 40m cards.
I can guarantee that almost all of that personal data is very readily available on public lists already, diminishing the impact
lying low (Score:3)
ugh! lying low not laying low.
I thought card data was already being sold (Score:1)
Supposedly one bank had already figured out the Target hack happened before Target announced it by buying back some of their own card data and checking the common point of purchase:
http://krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/
Plastic is the past (Score:2)
Re: (Score:2)
"in at least one large retailer's case, regular customers will be able to walk out of the door without ever approaching a cash register."
rfid tags and 'walk through' charging is dubious at best. imagine a small smartphone app that jams the rfid tag signal with its own, at close range quite a bit can be stolen.
Really? (Score:2)
Re: (Score:2)
Moreover the data has to be sold in chunks anyway. The card info pretty much has to be used in the region in which it was purloined. They don't have the CCV codes, so mostly they will need to make counterfeit cards and use them at physical locations, online will be difficult. There is already evidence the cards are being used in the region they were stolen from, and that makes sense to do otherwise would trip everyone's fraud monitoring.
So they are not trying to sell the whole grab to anyone to begin wit
They're doing it wrong (Score:2)
Since it sounds like we are near the point where everybody's credit card will need replacing anywayâ¦. how about this?
Under the current credit card system, when I want to purchase something from Target (or from anybody else), I send them my name, credit card number, billing address, and security code. Anyone who has this information is able to bill any number of charges to my account, in any amount, for as long as they want to (or until I catch on and cancel the card).
That seems like a bit too mu
An embarrassment of riches (Score:2)
Not a bad problem to have from a hacker's point of view. As Mae West said, "Too much of a good thing can be wonderful."
garbage (Score:2)
"Target Hackers Have More Data Than They Can Sell" - so what? And based on what? Any guarantees?
"But it's also likely that they can't sell them" - but that leaves the possibility that they can, right?
"no one will buy the stolen goods in these amount" - why not? And why would they need to sell ALL to the same buyer? Couldn't they sell them in batches?
.
Re: (Score:2)
We need to think of this like spam, where the cost of sending the second and subsequent spam messages is negligible. Even if these guys can't sell 95% of the card numbers they collected, it did not cost them much to collect them. Even to sell 1% of their take at $35 ea. is a lot of money. The volume is key here.
Implying (Score:1)
Implying they haven't been selling them in smaller batches.
What is the point of this article? (Score:2)
I mean, if you are in business of stealing something to sell, you can never have "too much". You just have to sell in packets or whatever is the usual instead of advertizing "hey! Anybody wanna buy 110 million CCs wink, wink, nudge, nudge!".
But most importantly, they had been stealing at least since November. And CCs are a "commodity" with an expiration date. You think if they wanted to sell them they have sat on them for all these months (when there was supposedly no "problem" finding buyers), waiting for
LOL (Score:1)
Bull. They will be selling these numbers for months. Many of the people who were impacted by this will never follow up by changing credit cards and pins. A large percentage of these numbers will remain valid until used.
What we are going to see is more large scale attacks because these gray and black hat hackers have access to vast resources. Stolen credit cards are a favorite for buying cloud hosting.
Chip and PIN instead of BitCoin (Score:2)
I think that the current US magnetic strip EMV credit card days are numbered.
Some form of two factor authentication should follow, which limits the vulnerability of the card information. Most european EMV credit cards use a Chip and PIN method of authentication, but the expense of these cards have been a deal breaker so far.
The heist is so big, I sometimes wonder, if it was done to destabilize the current US credit card system.
Re: (Score:2)
The Credit "industry" is one of the few big industries the USA still has. Cheap bastards never had a legitimate excuse - they simply do not want to spend the money or be the 1st one and compete with that extra overhead.
If they really cared about the issue and their losses (which I'm sure they have clever uses for,) they would LOBBY the US Government and regulation mandating chips would have happened already. The losses have to be significant enough.
Given the CIA was involved a while ago already and it lik
Nothing's changed... (Score:2)
Let's face it - credit cards are insecure. They always have been, and they still are. I have long operated under the assumption that all of my cards are compromised, but that someone hasn't gotten around to making use of them yet. Even 20+ years ago when I was trading cards using stolen voicemail boxes, we had more cards than we knew what to do with. Sure, there are organized gangs now using smurfs to work the cards, but they're still few in number. When you have say, 1/2 of all credit cards at your di
The Silver Lining (Score:2)
www.buyastolencreditcard.com (Score:2)
Now you too can own stolen credit card to buy all your online pr0n! All for the limited cost of $1. Nothing could be easier! Simply pay by Credit Card! No hassle!
Check my card number (Score:1)
Re: (Score:2)
Sure, reply to this message and I'll look it up for you.
Of course, you might want to really consider what you're asking here... if a website claimed to have a list, they could use your lookup to verify your data. If they don't, they could use your lookup to add it to the list.
If you're not sure, call your bank. They'll issue you a new
Get the whole bundle for $35? (Score:2)
Does the stolen-card pusher take plastic?
1. Buy 1 stolen card for $35
2. Buy x stolen cards using a previously acquired stolen card
3. Wash/Rinse/Repeat
4. ???
5. Profit