Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
The Courts Government Security News

Hacking Ring Nabbed By US Authorities 146

Posted by samzenpus from the go-directly-to-jail dept.
Slatterz writes "The members of a hacking ring responsible for stealing more than 40 million credit and debit card numbers from retail organizations in the US have been caught and charged. The case before the US Department of Justice is believed to be the largest hacking and identity theft case ever prosecuted. The criminals allegedly obtained bank details by hacking into the retailers' computer networks and then installing 'sniffer' programs to capture card numbers and password details as the customers moved through the retailers' credit and debit processing networks."
This discussion has been archived. No new comments can be posted.

Hacking Ring Nabbed By US Authorities More

Hacking Ring Nabbed By US Authorities

Comments Filter:

  • will there be changes? (Score:5, Informative)

    by CaptainNerdCave ( 982411 ) on Thursday August 07, 2008 @03:26AM (#24507197)
    are security measures going to be changed with this revelation to the public? having seen the inner-workings of various bank and investment facilities, i can safely say that one doesn't need to go through any really complicated work to take financial information from consumers: most wiring closets aren't even locked.

    • Re:will there be changes? (Score:5, Funny)

      by El_Muerte_TDS ( 592157 ) on Thursday August 07, 2008 @05:04AM (#24507645) Homepage

      are security measures going to be changed with this revelation to the public?

      Of course not. After all, they caught the people that abused it. Why waste money to protect something from criminals when the criminals were already caught. Nobody would dare to try it again.

    • Re:will there be changes? (Score:5, Interesting)

      by Strilanc ( 1077197 ) on Thursday August 07, 2008 @07:00AM (#24507995)

      I'm going to go out on a limb and say the core of the problem isn't the security of the computers, it's the fact that in order to use a credit card number you have to reveal it. There will always be some retailer or customer without a secure system. _We can't change this, it's too hard_.

      I think the solution is a small device with an embedded secret key. All it has to do is sign data [secondary: show text, wireless, usb, etc].

      For example, to complete a transaction, a store asks you to sign this:
      [
            VISA Credit Transfer
            "here's a one-line ad because we just can't help it!"
            amount: 12.34$us
            buyer: John Doe
            seller: Matt's Grocery Store
            date: August 7, 2008
            buyer public key: 09 f9 11 02 9d 74 e3 5b d8 41 56 c5 63 56 88 c0
            seller public key: 4B 3D BA 71 3B D8 56 43 2B A7 E8 F4 69 CA C5 5A
            seller transaction id: 594864purplebunnies
            protocol version: 1
      ]
      Then the store also signs it, and sends it and the signatures to VISA, or whoever.

      The beauty here is that the security is now entirely encapsulated in a) the signing device, and b) the plaintext format for requesting credit.

      In the example I have given the buyer only has to check that the amount is correct because all other modifications give them free groceries. The store only needs to ensure they match the format specified by VISA, and that the buyer's signature is valid. VISA takes most of the work, checking that the format is correct, the signatures are valid, the transaction id is unique for the seller, the buyer has enough credit, etc.

      I'm sure there are holes, but it's a hell of a lot better than what we have now.

      • Re: (Score:1, Informative)

        by Anonymous Coward

        already done, patented and on the way for deployment (at least in Switzerland):

        http://www.zurich.ibm.com/ztic/

      • Re: (Score:3, Interesting)

        by Iamthecheese ( 1264298 )
        hash clash

      • Re: (Score:3, Insightful)

        by kabocox ( 199019 )

        In the example I have given the buyer only has to check that the amount is correct because all other modifications give them free groceries. The store only needs to ensure they match the format specified by VISA, and that the buyer's signature is valid. VISA takes most of the work, checking that the format is correct, the signatures are valid, the transaction id is unique for the seller, the buyer has enough credit, etc.

        I'm sure there are holes, but it's a hell of a lot better than what we have now.

        I'm surp

        • Re:will there be changes? (Score:5, Interesting)

          by tlhIngan ( 30335 ) <slashdot.worf@net> on Thursday August 07, 2008 @11:40AM (#24510795)

          I'm surprised that we even still use signatures now. It seems like no cashier actually looks at them, or could tell if there is even a difference. There is a strong part of me that would like the credit/debit card industry to add various biometrics that would at least be scanned by a machine so we'd actually have some ID verification other than the damn PIN number.

          Actually, it's a misconception that the signature has meaning to the retailer if they match. If you look at the slip you sign, it says something to the effect of "I agree to pay this debt according to the terms of the cardholder agreement" or similar.

          SIgning your card is an indication that you accept the cardholder agreement (i.e., the card is valid). Technically, a store can refuse to accept any card that is unsigned, says "CHECK ID" or similar because those cards are invalid (because you haven't indicated you accept the cardholder agreement, which covers things like... repayment of debt). The slip is used to indicate that you, the cardholder, will pay the issuer the amount listed, who will then pay the merchant that amount.

          During a dispute, the best proof a merchant has is the signed slip. What makes life interesting are those places where signing the slip isn't necessary (e.g., some for transactions under $25).

      • Re:will there be changes? (Score:5, Informative)

        by bberens ( 965711 ) on Thursday August 07, 2008 @09:37AM (#24509123)
        Or you could.. ya know.. discover that there's vulnerabilities inherent in the system and just use cash instead. Using cards (even debit) causes price inflation. Cash is king.

        • There's a demand for credit cards, people aren't going to "just use cash". Not to mention cash doesn't work nearly as well as credit over the internet. The idea is to fix the system, not throw it out.

        • Re: (Score:3, Insightful)

          by blair1q ( 305137 )

          Or you could.. ya know.. discover that there's vulnerabilities inherent in the system and just use cash instead. Using cards (even debit) causes price inflation. Cash is king.

          But your cash is counterfeit. Please step to the side and speak with the nice policeman. Thank you.

      • Re: (Score:3, Interesting)

        by gcatullus ( 810326 )

        Will not happen because credit card companies are NOT The ones on the hook for the losses. The charade of PCI compliance has foisted all responsibility back to the merchant. The Visa/Mastercard cartel actually make MORE money from fraud because there are many more transactions, and they profit from every single transaction. Visa/mastercard took approximately $40 Billion last year in interchange fees, this is in addition to any customer interest or late penalties. They have no incentive to change and teh mer

      • I'm going to go out on a limb and say the core of the problem isn't the security of the computers, it's the fact that in order to use a credit card number you have to reveal it. There will always be some retailer or customer without a secure system. _We can't change this, it's too hard_.

        Bullshit. Banks certify payment systems before allowing retailers to authorize through them. For smaller operations they may delegate to a payment processor that certifies devices on the network, such as mom and pop stores

        • Afaict all you need to put a transaction through is the card number, other stuff helps if the transaction is challanged but afaict is not needed to put the transaction through.

          All the information most online retailers ask for is either printed on the card or availible to anyone who knows or stalks the victim. The pin is only used for face to face transactions (which helps keep it secure but also means it is no help in many situations).

          Also the chips aren't particularlly reliable. So at least in the uk if yo

    • Re:will there be changes? (Score:4, Insightful)

      by dsginter ( 104154 ) on Thursday August 07, 2008 @07:16AM (#24508063)

      are security measures going to be changed with this revelation to the public?

      If they secured credit cards so that there was no fraud, then how would the providers justify their exorbitant [unfaircreditcardfees.com] fees?

    • You're correct about the wiring closets. How many have additional items, such as janitorial and office supplies stored in the same location? As a result, the staff says it's "too hard" to keep the door locked. Not to mention the risk of social engineering. How many employees would really question anyone appearing on site that looked "official" - in retail locations, not just financial.

    • ...i can safely say that one doesn't need to go through any really complicated work to take financial information from consumers...

      This week I personally stopped what could have been a major breach of credit card security. My company works for retail companies, and one of our clients emailed us a transaction log containing full credit card data for a day's worth of transactions. I don't mean masked data, times, etc. I mean full numbers, expiration dates, CCV numbers, names, everything. They just handed it

  • More details (Score:5, Informative)

    by hattable ( 981637 ) on Thursday August 07, 2008 @03:28AM (#24507209) Journal
    If you felt a little cheated by the lack of info in the 'article' the DOJ site [usdoj.gov] has more.
  • I heard that they went around to stores using wireless networks to process purchases at checkout. Basically any store that thought they were being high tech by using wireless registers. Guess they forgot to encrypt the data...anyone have a better link?
    • In whatever newspaper I read about this in, they said that it was sent to the server with WEP, but I'm sure that took them what, a whole 20 minutes to break. They just backdoored the reception system so they didn't just get the card numbers that were being used in that store, but in all of whatever chain of stores.

      • They just backdoored the reception system so they didn't just get the card numbers that were being used in that store, but in all of whatever chain of stores.

        A month or so ago I heard of a bust of a team that had done a similar "backdoor the server" crack that got the card numbers and PINs of essentially everybody who had used the ATMs at 7-11 nationally for several months.

        Does anybody know if that crime and this one are related (other than by compromising the server)?

  • indictment links (Score:5, Informative)

    by ya really ( 1257084 ) on Thursday August 07, 2008 @03:36AM (#24507261)

    Links to the indictments of the top two suspects:

    suspect 1 [usdoj.gov]
    suspect 2 [usdoj.gov]

  • Better Article (Score:5, Informative)

    by FSWKU ( 551325 ) on Thursday August 07, 2008 @03:48AM (#24507321)
    http://news.bbc.co.uk/2/hi/business/7545212.stm [bbc.co.uk] has a much better write-up.

    So now we will get even MORE draconian measures to stop the "evil hackers" when in reality, it was a combination of bad intentions, and old-fashioned stupidity. The article specifically mentions looking for "vulnerable" access points. This means that whoever set the network up for these stores did not do a proper job in securing said network. Also, why the HELL were the systems used to process credit card transactions on the same insecure wireless network? There is NO excuse for that. I'm not excusing what these guys did, but once again we have a case where whoever setup the hardware in these places needs to be held for criminal negligence.

    • Re:Better Article (Score:5, Insightful)

      by elnico ( 1290430 ) on Thursday August 07, 2008 @04:19AM (#24507481)

      whoever setup the hardware in these places needs to be held for criminal negligence

      IANA(legal scholar), but this doesn't seem to fit the definition of criminal negligence for two reasons:

      1) Doing a bad job at something and allowing others to come to harm isn't enough. Essentially, you must be aware of the risk of your actions (or inaction), or you must intentionally allow yourself too little information to make a proper decision.

      2) I'm pretty sure that once you commit a negligent act, it has to be nature that takes something "the rest of the way." If your act simply allows someone else to commit a crime, then the crime falls the perpetrator, not you.

      Keep in mind too, that I'm talking about criminal negligence. You can sue in civil courts on a much broader basis.

      In fact, I find your entire comment rather ironic, since you imply that the recent crimes will be an excuse for some 1984-state to implement "MORE draconian measures," but then go on to suggest criminalizing what is essentially poor job performance.

      • While in principle what you say may be correct, I think using insecure wireless to transfer credit information is a crime in and of itself. That literally amounts to broadcasting the numbers to anyone nearby the store. I'd almost say that goes beyond negligence. That's hitting golf balls off your roof and then claiming you didn't know anyone was down there. Granted, you may not have known - I suppose to take this metaphor to the proper extent we'll say you live in a field in the middle of nowhere. However,

      • 1) Doing a bad job at something and allowing others to come to harm isn't enough. Essentially, you must be aware of the risk of your actions (or inaction), or you must intentionally allow yourself too little information to make a proper decision.

        As I understand the case, the criminals installed network sniffers at the retail network headquarters of these companies, and simply sniffed the unencrypted cleartext credit card numbers going across the wire.

        I don't think it would be unreasonable to prove that the

    • If you think it's scary for banks, fire up kismet near a doctor's or lawyer's office sometime.

  • I've always wondered how safe you are when paying utility bills over the phone using a tone phone, like if someone finds a connection at the call centre which takes the card number and listens to tones of card numbers/expiry dates/verification numbers flowing through the line. Maybe it's a little more secure than my paranoid mind thinks, maybe someone knows a little detail on what's involved with these systems?

    • Re:Billing department infiltration (Score:4, Interesting)

      by unfasten ( 1335957 ) on Thursday August 07, 2008 @04:34AM (#24507549)
      Well if you can record the call (and phone boxes aren't hard to tap, though I'm not sure how exactly it would work at a call center) then it's easy to convert the DTMF tones into numbers using a tone decoder.

      Here's a link to a DIY hardware version: http://www.bobblick.com/techref/projects/tonedec/tonedec.html [bobblick.com] And a quick search should turn up software solutions, or you could write one yourself since the tones are standard. Wiki lists all the tones: http://en.wikipedia.org/wiki/DTMF#Keypad [wikipedia.org]

      • Re: (Score:2)

        by nbert ( 785663 )
        Reminds me of the early 90's when the Chaos Computer Club [www.ccc.de] had its own radio show (I don't know if are still on air). They had this game were you could win a price if you were the first to call a number which was given to the listeners in DTMF tones. Since this show was in the late evening I don't want to know how many people got it wrong and woke someone with a similar number. But usually it only took a minute for someone to figure out the real number with the help of an Amiga (sound cards were not that com

  • Slashdot is days behind the news (Score:5, Insightful)

    by Xenna ( 37238 ) on Thursday August 07, 2008 @04:02AM (#24507383)

    There used to be a time when you read tech-news first on slashdot. Nowadays I read it in my (Dutch) newspaper first (yep, the paper one that they actually have to print and deliver first) end a few days later it appears in /.

    What the hell is wrong?

  • Was the ring working in a windowless environment? (Score:5, Funny)

    by hansraj ( 458504 ) * on Thursday August 07, 2008 @04:40AM (#24507567)

    ;-)

  • Who foots the bill? (Score:3, Interesting)

    by brucmack ( 572780 ) on Thursday August 07, 2008 @05:01AM (#24507637)

    So, who foots the bill for this? The retailer, the credit card comany / debit card issuer, or the customer?

    • Re:Who foots the bill? (Score:5, Funny)

      by Bravoc ( 771258 ) on Thursday August 07, 2008 @06:21AM (#24507859) Journal

      So, who foots the bill for this? The retailer, the credit card comany / debit card issuer, or the customer?

      The credit card company raises my rates to cover their expenses, the government uses my taxes to pay for the investigation and prosecution, looks like I'm paying for it!

      Drinks for everyone! Here, use my card!

      • Re:Who foots the bill? (Score:4, Insightful)

        by Stanislav_J ( 947290 ) on Thursday August 07, 2008 @08:20AM (#24508399)

        So, who foots the bill for this? The retailer, the credit card comany / debit card issuer, or the customer?

        The credit card company raises my rates to cover their expenses, the government uses my taxes to pay for the investigation and prosecution, looks like I'm paying for it!

        Dude, the customer pays for everything one way or another -- haven't you figured that out by now?

    • Re: (Score:3, Insightful)

      by budword ( 680846 )
      The customer always foots the bill, sooner or later.

  • Defendant worked for the Secret Service (Score:5, Interesting)

    by unfasten ( 1335957 ) on Thursday August 07, 2008 @05:19AM (#24507697)
    The main defendant in this case, Albert Gonzalez, used to be a informant for the Secret Service and cooperated in the Operation: Firewall [usdoj.gov] case 4 years ago. Apparently they didn't keep a very good eye on him while he was working for them or after they were done with him. He became an informant after he was arrested around mid-2003 and the case lasted until the end of October, 2004. So according to this Washington Post article [washingtonpost.com] (which got the informantion from the indictment [usdoj.gov] someone linked above) he was actively committing crimes at the same time he was an informant:

    -- In about 2003, Gonzalez and others found an unencrypted wireless access point at a BJ's Wholesale Club store. BJ's reported a breach of its computer networks in early 2004.

    -- In 2004, other members of the ID theft ring compromised an OfficeMax wireless access point in Miami, and they were able to steal credit card data. After law enforcement officials in 2006 identified OfficeMax as the victim of a data breach, the company said it hired an outside auditor to conduct an investigation and found no evidence of a security breach. An OfficeMax spokesman didn't immediately return a message seeking comment.

    So either the Secret Service was letting this go on just so they could make one bust, or they had no idea that their own informant was committing major breaches while under their supervision. Also, how stupid is this guy that he didn't even stop breaking the law after getting busted and becoming an informant? Some people are just begging to be sent to prison, and it looks like the prosecuters are going to grant his wish. For the rest of his life if they have their way.

    P.S.: The Threat Level post [wired.com] with the info about him being an informant also contains a link [wired.com] to another case about another informant who was stealing social security numbers while working on a computer inside the Secret Service offices.

    The usdoj.gov website seems to be down for me at the moment but should come back up eventually.

    • Re: (Score:2)

      by u38cg ( 607297 )
      I'm not really getting the thrust of your argument. Informants are, by definition, most likely to be criminals or criminal accessories. What's your point?

      • Re:Defendant worked for the Secret Service (Score:5, Informative)

        by ya really ( 1257084 ) on Thursday August 07, 2008 @07:33AM (#24508125)

        I'm not really getting the thrust of your argument. Informants are, by definition, most likely to be criminals or criminal accessories. What's your point?

        I believe his point is, they were supposed to be former criminals, in the past tense. Law enforcement's job is to see that they stay that way, not to go run amok with 40+ million credit cards.

        In the case of the other informant he linked, the guy stole information directly from the Secret Service office's computers while the agents are on duty (though probably off viewing porn while the informant conducts non-authorized criminal activity). Mind you, they had a huge monitor displaying whatever the informant was doing on there aside from keylogging. Seriously, that's a huge lax on monitoring, if they can't even watch an informant in their own office. Makes you wonder if they are even capable of doing their jobs.

        He's basically saying that this bust is just a front for the US government cleaning up a mess they created in 2003 by not initially locking this guy up or restricting his computer access/monitoring him more closely.

        One other thing, the informant did absolutely no time for all previous criminal activity he conducted before turning informant, after his initial arrest in 2003 (which according to the FBOP inmate tracker [bop.gov], he is 27). Thus, he could have been doing this for some time. Basically, he got a free pass on whatever crime he did before his intial arrest, plus almost five more years of reeking havoc on the banking system. This is in sharp contrast to what most people would assume "informing" is, where a criminal cuts a deal for reduced time or perhaps probation/house arrest, but still gets charged. This guy however has not been charged, until now.

        • Re: (Score:3, Interesting)

          by phayes ( 202222 )

          Time to wakey wakey young one, the world is more complicated than your parents told you...

          In order to catch a thief, law enforcement officials will use people who are criminals themselves. When, in the course of an investigation, they have enough evidence to put away suspect A, A will often turn over information on other people the government wants to put away more. As the leaders of criminal organizations usually protect themselves by passing orders on to underlings & often do not commit overtly illega

        • Re: (Score:3, Insightful)

          by Oligonicella ( 659917 )
          "Law enforcement's job is to see that they stay that way,..."

          Uh, no. It is law enforcement's job to apprehend people who have committed a crime. It is not their job to ride shotgun on people who have in the past committed crimes, only to catch them again if they repeat.
          • Note when I said "they," that was a pronoun for the 2 INFORMANTS, not criminals in general, jeeze. And seriously, you can't obviously say they should have allowed the one informant to have basically "free reign" of law enforcment computers and databases to conduct his own personal criminal activity. There is a line between allowing some criminal activity to catch other criminals and then there's just outright crime (in this case, the later). Both were obviously conducting criminal activity while informing,

  • priceless (Score:5, Funny)

    by dbcad7 ( 771464 ) on Thursday August 07, 2008 @05:24AM (#24507705)

    hacking ring responsible for stealing more than 40 million credit and debit card numbers from retail organizations in the US have been caught and charged.

    To which they replied.. "put it on the card"

  • This was in Wednesdays newspaper!

    Kill some trees! Better than Slashdot!

  • I mean, Heart was a bit of a stretch, but Hacking?

  • one time CC numbers (Score:3, Insightful)

    by timmarhy ( 659436 ) on Thursday August 07, 2008 @07:30AM (#24508109)
    ALL of this could be ended if visa and mastercard changed to single use CC numbers. if they gave me a token that created a new CC number with each transaction it might actually justify that annual fee the assholes charge me.

    • Re:one time CC numbers (Score:4, Informative)

      by maxume ( 22995 ) on Thursday August 07, 2008 @08:15AM (#24508361)

      If you don't feel you are getting your money's worth from the annual fee, you should consider switching to one of the hundreds (thousands?) of cards available without an annual fee.

      • Re: (Score:2, Insightful)

        by AvitarX ( 172628 )

        Maybe he/she was referring to the merchant fees (the part that actually goes to VISA). These are (for me) $0.50 transaction and 2% of gross.

        Don't worry though, it's the customers, credit cards or no, that pay these fees in the end. SInce profits are low enough and it is a competitive business, without the fees, prices would be lower.

    • Re: (Score:2)

      by barzok ( 26681 )

      How's that going to work when you're out at a store? For online shopping it's real easy, but when you're waiting in line at the supermarket?

    • Apparently one-time use credit card numbers don't protect you either [slickdeals.net]. I'd been wondering how a thief managed to charge something to my replacement credit card after I'd reported the old one stolen and had it canceled. If a merchant makes a manual (instead of electronic) claim with the credit card vendor, it will go through even if the credit card numbers are expired, the amount is over the limit, or you've been issued a card with new numbers. You can of course dispute the charge, but you have to spot the
  • But they'll probably just end up going to club fed for 2 years

  • Wow, Ring of Hacking +3 (Score:1, Funny)

    by Anonymous Coward

    Is this something I can buy in World of Whorecraft?

    (I hope this isn't about golf hackers...)

  • I feel like I read this somewhere before. Oh, that's right, on Tuesday [slashdot.org]. I think it was plainly obvious that the 11 charged were in a hacking ring whether the verbage was included previously or not. Why don't we start tagging these as repeat news?

  • Sort of Frightening (Score:4, Insightful)

    by b4upoo ( 166390 ) on Thursday August 07, 2008 @09:17AM (#24508843)

    The people arrested were in several nations. What is unusual and a bit frightening is that it seems like they were able to get arrest warrants or whatever was needed crossing international lines really quickly. It almost seems like some uber government organization was at work on this affair.

    • What is unusual and a bit frightening is that it seems like they were able to get arrest warrants or whatever was needed crossing international lines really quickly.

      What makes you think it was quick. It doesn't hit the news until after the announcement, which is after the bust. If it takes two hours, two weeks, or two months to push the paper the visible timing is the same.

      Until more information comes out the only date you have to put a limit on how much time it took is the time of the crime.

      It almost see

    • The people arrested were in several nations. What is unusual and a bit frightening is that it seems like they were able to get arrest warrants or whatever was needed crossing international lines really quickly. It almost seems like some uber government organization was at work on this affair.

      Only seems to be the case if they happen to cross over into a pro-western country. If you want to break the law, appearently it's relative safe in the former Soviet states.

      Suspects seem to be relatively safe so far in m

  • Innocent until proven guilty? (Score:1, Interesting)

    by Anonymous Coward

    The members of a hacking ring responsible for stealing more than 40 million credit and debit card numbers from retail organizations in the US have been caught and charged.

    You wouldn't think so from the summary. So much for the presumption of innocence.

  • This really is entirely for show politically. There are too many strategic positions up for grabs in November that just spoke volumes of "We need to look good"... Yea, I'm speaking to some republicans out there! You know who you are. Who's eyes are you trying to pull wool over??

    Fact is there is too much of this out there and these guys are not the only fish out there.

  • which they promptly paid by credit card.

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close