Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Credit card thieves ran a polite, professional help desk

Alleged business operation attacked security's weak link: retailers

August 6, 2008 12:00 PM ET

Active Comments
StanS says: The Feds will have to fine the retailers and make them provide 3 years of unlimited credit protection to all...
Anonymous says: now they can go to jail where they can put to test their "polite" and "professional" mannerisms....


Computerworld - The criminal network identified in federal indictments this week as having stolen tens of millions of credit card numbers used people with skills in technology, finance and black markets -- some whom were notably polite, attentive and productive.

In one chain of ICQ messages excerpted by federal authorities in the indictment, there is back-and-forth about the software used to get credit card data from the Dave & Buster's Inc. restaurant chain, which the U.S. Department of Justice says was one of nine retailers hit. The hackers gave the chain a positive review: "A very nice place, they have many locations," wrote Albert Gonzalez, of Miami, in an instant message.

But little time was wasted on chitchat: Tech support was needed to modify sniffer software for an intrusion. According to the DOJ, Maksym "Maksik" Yastremskiy, of Kharkov, Ukraine, in a message to Gonzalez, briefly discussed the need and finished by asking: "... could you, please recompile it :-) Thanks."

Gonzalez's alleged response: "I can compile right now." There was no tech support whining in these messages -- just professional interest, and perhaps some pride, in how the software worked: "Did your guy use or say anything about my sniffer for dandb [i.e., Dave & Buster's]?"

"My guy told me to tell you big thanks and etc. ;-)" was Yastremskiy's reply, the DOJ claimed. Some 5,000 credit card numbers were allegedly taken from the chain by the hacker group.

For some employees, praise is as important as money, and this group evidently had both, according to what's in the federal charging documents. They made millions until the feds closed their operations this year, according to the indictment.

"These guys collaborate," said Sam Curry, vice president of the identity access and assurance at RSA Security, a division of EMC Corp. "They even have [service-level agreements] and support numbers to reach other. They have specialized roles, sophisticated economics [and] worldwide reach."

It's the degree of specialization that's a tip-off as to how big these organizations are. It took focus and organization to allegedly attack nine major retailers, steal some 40 million credit and debit card numbers, decrypt PINs, withdraw cash and sell the numbers on black markets.

The main targets were retailers. The thieves parked their cars near retail outlets, searched for open networks and installed programs to capture the wanted data.

Retailers are particularly susceptible to theft because IT departments are kept lean, crucial technology improvements are deferred and people with the skills needed to configure systems aren't always on staff, said Paul Kocher, president and chief scientist of Cryptography Research Inc. in San Francisco.



Jump to comments

criminal network

Additional Resources

EFD vs. HDD - What You Need to Know
WHITE PAPER
Enterprise flash drives provide a new Tier 0 storage layer capable of delivering high I/O performance at a very low latency. Proper use of EFDs in an Oracle environment can deliver increased performance compared to fibre channel drives. Read the recommendations for identification of the best DB components for EFDs.
Gartner Research Report: Magic Quadrant for Application Delivery Controllers, 2009
WHITE PAPER
The market for products to improve the delivery of application software over networks remains dynamic and innovative. Vendors focused on solving enterprises' most-pressing application problems have become the top players.
Eight Criteria for Server Load Balancing
WHITE PAPER
Server load balancers are a simple yet highly effective means to scale an application environment while ensuring its availability. Today's solutions should also address application performance and security. Read about the top eight criteria you should consider when choosing a server load balancer and how Citrix NetScaler meets those requirements.

What People Are Saying

White Papers & Webcasts

Gene Kim's Practical Steps to Achieve and Maintain NERC Compliance
Learn seven steps operators can take to meet IT configuration requirements set forth in the NERC-CIP standards.  

The Workday User Experience Video
Watch Workday's Creative Director, Scott Lietzke, discuss the business-centered design philosophy at Workday.

Business Process Framework Demo
Learn about Configurable Business Processes and Calculated Fields. Watch Now!

Manager Experience Demo
Go beyond self-service solutions to perform more effectively. Watch Now.


IT Jobs