Credit card thieves ran a polite, professional help desk

Computerworld - The criminal network identified in federal indictments this week as having stolen tens of millions of credit card numbers used people with skills in technology, finance and black markets -- some whom were notably polite, attentive and productive.

In one chain of ICQ messages excerpted by federal authorities in the indictment, there is back-and-forth about the software used to get credit card data from the Dave & Buster's Inc. restaurant chain, which the U.S. Department of Justice says was one of nine retailers hit. The hackers gave the chain a positive review: "A very nice place, they have many locations," wrote Albert Gonzalez, of Miami, in an instant message.

But little time was wasted on chitchat: Tech support was needed to modify sniffer software for an intrusion. According to the DOJ, Maksym "Maksik" Yastremskiy, of Kharkov, Ukraine, in a message to Gonzalez, briefly discussed the need and finished by asking: "... could you, please recompile it :-) Thanks."

Gonzalez's alleged response: "I can compile right now." There was no tech support whining in these messages -- just professional interest, and perhaps some pride, in how the software worked: "Did your guy use or say anything about my sniffer for dandb [i.e., Dave & Buster's]?"

"My guy told me to tell you big thanks and etc. ;-)" was Yastremskiy's reply, the DOJ claimed. Some 5,000 credit card numbers were allegedly taken from the chain by the hacker group.

For some employees, praise is as important as money, and this group evidently had both, according to what's in the federal charging documents. They made millions until the feds closed their operations this year, according to the indictment.

"These guys collaborate," said Sam Curry, vice president of the identity access and assurance at RSA Security, a division of EMC Corp. "They even have [service-level agreements] and support numbers to reach other. They have specialized roles, sophisticated economics [and] worldwide reach."

It's the degree of specialization that's a tip-off as to how big these organizations are. It took focus and organization to allegedly attack nine major retailers, steal some 40 million credit and debit card numbers, decrypt PINs, withdraw cash and sell the numbers on black markets.

The main targets were retailers. The thieves parked their cars near retail outlets, searched for open networks and installed programs to capture the wanted data.

Retailers are particularly susceptible to theft because IT departments are kept lean, crucial technology improvements are deferred and people with the skills needed to configure systems aren't always on staff, said Paul Kocher, president and chief scientist of Cryptography Research Inc. in San Francisco.