DOJ: Credit card thefts helped by 'well designed' software

Computerworld - The intruders whom the U.S. Department of Justice alleges stole tens of millions of credit and debit card numbers were bold, global, skilled and making millions of dollars, according to details in the charging documents.

And despite all the focus on security since the 9/11 terrorist attacks, the people alleged to be behind this network had little difficulty taking data from some nine businesses, all major retailers. They exploited vulnerabilities in networks, servers and databases, making the information they gleaned available worldwide to the underground economy that buys and sells such data.

All of this was detailed by the DOJ, which is charging 11 people in what is certainly one of the largest and most organized credit card theft operations ever. It extends back to 2003 and includes nationals from several countries — a true world-is-flat operation.

The U.S. alleges that the group decrypted PINs, made new cards and got cash from ATMs. They sold credit card data on Web sites that specialize in trading that information, the DOJ said. And, it claims, they operated globally, using offshore banks and other methods to turn stolen data into cash. ICQ instant messaging and e-mail kept everyone in touch.

Millions of dollars were involved, and the charging documents outline proceeds that were transferred in seven-digits amounts such as $3.8 million, $4.9 million, $1.9 million — to list but a few.

There was so much cash involved that among the things federal authorities seized from Albert Gonzalez of Miami, whom the U.S. alleges played a key role in the crime ring, was a currency counting machine. Gonzalez was captured in May; police also confiscated a Glock handgun and nearly $25,000 in cash from him at that time.

The retailers known to have been targeted are BJ's Wholesale Club, TJX, DSW Shoe Warehouse, OfficeMax, Barnes & Noble, Boston Market, Sports Authority and Forever 21.

One means of access of the retailers' networks was through a practice dubbed wardriving — driving around in a car with a Wi-Fi-enabled laptop computer seeking access.

The first details of the methods used in this extensive operation surfaced in May. In an indictment concerning the theft of credit and debit card data from Dave & Buster's Inc., a Dallas-based restaurant chain, the U.S. analyzed the software used to steal the credit card data. That indictment gives the software designer a nod as having created an effective tool.

The feds asked the CERT Coordinating Center to give an opinion of the software it found. CERT told the U.S. investigators that the "core sniffer program" is "efficient, well designed and uses some algorithms and data structures that reflect college-level knowledge of computer programming skills. ..."

The thieves were tenacious, too. When an effort to break into a restaurant's point-of-sale server in Arundel, Md., failed, the intruders went straight to the restaurant chain's corporate network in Dallas, and from there, they installed packet sniffers at some of the 49 Dave & Buster's restaurants, including one in Islandia, N.Y. From that store alone, data from more than 5,000 credit cards was obtained. Of those cards, 675 were used to make unauthorized purchases at various retail and online stores, running up losses of $600,000.

Gonzalez was named in the Dave & Buster's case. Others alleged to be involved in the crime ring include Aleksandr "Jonny Hell" Suvorov, of Sillamae, Estonia; Maksym "Maksik" Yastremskiy, of Kharkov, Ukraine; and Hung-Ming Chiu and Zhi Wang, both of the People's Republic of China.

Read more about cybercrime and hacking in Computerworld's Cybercrime and Hacking Knowledge Center.