Who's Selling Credit Cards From Target

http://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/

by dkasper • 13 years ago

238 83 13 years ago

bri3d2• 13 years ago

This is a a good illustration of how hard it can be to stay anonymous online.

With that being said, I don't see how Krebs reaches the conclusion that this guy "probably" knows who stole the Target cards or how they were stolen. They were just posted on his crappy carding forum.

It seems a bit disingenuous to me to plaster this person's dox under this headline; yes, he seems pretty scummy and runs several criminal enterprises but there's no actual evidence in the article linking him to the Target fraud beyond someone else using his forum to hawk their stolen goods.

cycnusx• 13 years ago

I think if you shine a light in the darkness, the darkness will go away (or find another corner).

Dylan16807• 13 years ago

It's more a lesson in how you can't take a non-anonymous account and turn it anonymous. If a pseudonym has ever linked to sensitive information, you have to abandon it entirely.

d23• 13 years ago

Krebs doxxes people frequently and it seriously undermines any moral argument he may have, since a good deal of his time has been spent complaining about people doxxing him. There's a fine line between exposing crime and opening someone up to vigilante justice. Send the information to the police, but the public has no need for it.

uchi• 13 years ago

Who has Krebs doxxed before exactly? This is the first time I'm hearing about this.

ck2• 13 years ago

How on earth are the sellers "cashing out" and how are they taking payments?

Why can't the money be followed?

If the NSA is such a powerhouse with billions of dollars of assets to track every electronic communication, why aren't they focusing their entire resources on people like the sellers?

Or is it like the TSA where they just hassle the completely innocent people at the airport for show while the real criminals take other paths.

guyht• 13 years ago

It pains me to say this, but most of the time the hackers will ask for payment in bitcoin which makes tracking much harder.

gizmo686• 13 years ago

You mean the bitcoin that maintains a public record of every transaction ever made on the network? There are still ways to anonomously cash out (payments to an anonomous account that forwards the funds to a mixing service, for example), but bitcoin is not a silver bullet for getting away with it.

dasil003• 13 years ago

If the NSA is such a powerhouse with billions of dollars of assets to track every electronic communication, why aren't they focusing their entire resources on people like the sellers?

Because they didn't invest that kind of money to find the logs in a haystack that are eastern bloc cyber criminals. They are looking for a needle in a haystack dammit. A needle. (and possibly if some of their wives are cheating on them).

Datsundere• 13 years ago

"Is your wife cheating on you? Well you have the opportunity to figure out by joining the NSA today!"

dzink• 13 years ago

How are they "cashing out"? Once upon a time eastern european hackers used to run a IRC chats under a .CC domain. They would post a bunch of CC numbers with their info and random forum members would grab and test/empty the cards. If the responsibility for cashing out is distributed, likely the culprits can stay hidden in the crowd of purchasers. However a kid in Eastern Europe did get arrested at a shipping port because he was waiting on a Ferrari he ordered with stolen credit cards.

patmcguire• 13 years ago

They know who the people are, but if the perpetrator's home governments don't want to give them up (article refers to Ukraine) there isn't a lot that can be done. Do we know that they aren't cooperating? No, but you can just look at the forums in question without an invitation so it's not like it would be hard if they wanted to.

snowwrestler• 13 years ago

The NSA does not investigate crimes. It is part of the U.S. national intelligence apparatus, so it focuses on targets and topics of interest to military and diplomatic leaders.

The FBI would be investigating this, and they are probably actively following these transactions right now. But since they are a criminal investigation agency, they will be focused mostly on carefully collecting evidence, so that it can be used in trials to obtain convictions.

So: this exposes a gap in how the U.S. federal government approaches the Internet. The NSA is willing to react in real time to threats, but they don't care about crimes like carding. The FBI cares, but they seek to collect evidence, not react in real time.

The result is that when it comes to real-time reaction to cybercrime, companies are largely on their own. I'm sure Target is spending a good bit of money on cybercrime and cybersecurity consulting firms right now.

lstamour• 13 years ago

Of course all this hinges on the admission that he was Hel in the first place .... which seems plausible to the amateur but requires more evidence for courts, I suspect. Though the name-clash of that service and the bribery is intriguing.

As to Target, there had to be a group. Somebody funding, someone inside, and then you've distribution networks for what effectively ends up as money laundering. At least that's the way I imagine it :)

belluchan• 13 years ago

I was in line and made a short conversation (short so as to not hold up the line) with the cashier at Target. The elderly lady behind me was pretty worried about the credit card theft, and the cashier knew about it too. It's cool at least that news about this stuff is reaching more people.

In my opinion just get a new card, don't wait for suspicious activity. Check it to see if it was already used. Also given that the 3 letter pins weren't from the back are not included I'm not sure if it's going to be very easy to make use of this card data. Having said, still get a new card if you used it at Target recently.

bri3d2• 13 years ago

The magnetic track data was compromised, which means once the data trickles back through the black market crooks can write the cards back out and use them as card-present. Definitely harder than sitting around ordering things online, but there's no reason to need the CSC to use the data they stole.

liuhenry• 13 years ago

By 3 letter pin, do you mean the CVC code?

Many merchants require the CVC code to protect themselves against fraud/chargebacks and because they can get lower processing fees, but strictly speaking, it's not necessary to make a transaction (IIRC, the only thing you need is the card number and expiration date).

Notably, Amazon does this for their 1-click checkout. Saving CVC codes is against PCI compliance, so in order to provide that low-friction experience, they simply post the saved card information without it.

larrys3• 13 years ago

"the only thing you need is the card number and expiration date"

If the dollar amount charged is low enough you don't even need the expiration date. You just use the current month.

We've frequently have to charge expired customer credit cards (expired by years in many cases) and as long as the dollar amount is low enough (off the top +- $40 [1]) and the card number hasn't been changed the charge will go through. Very convenient instead of having to contact the customer to get a new credit card expiration date. Also helps because that way you don't give the customer a chance to rethink what they are paying for and whether they need it or not.

[1] May be higher but I'm not certain if it's $60 or $100 so I will go with an amount that I know works.

yeukhon• 13 years ago

I am fascinated how the black market operates. With law enforcement probing every corner, going undercover, I can't imagine myself getting involved in a blackmarket at all. Well, I guess there is always the risk which says high risk yields high return.

dobbsbob4• 13 years ago

Russia and CIS countries don't care about US fraud so won't allow citizens to be extradited. FBI/Secret Service prob know who they are and will just wait until they go on vacation somewhere and kidnap them like they usually do.

bananacurve• 13 years ago

kidnap them like they usually do

Although that would be impressive, I'm sure you know you are full of shit, but other people don't.

prostoalex• 13 years ago

Ukraine will extradite on a case-by-case basis http://www.crime-research.org/news/15.05.2004/275/

smackfu2• 13 years ago

Not just law enforcement, but the credit card companies themselves have a very high incentive to stop the trafficking of these numbers. They won't get you thrown in jail, but they can render all your hard work useless.

x0054• 13 years ago

This is a fascinating bit of research. Has any one posted yet information on how the actual card info was stollen? I read somewhere that the point of sale units were infected, but with no evidence to back that claim up.

wallflower• 13 years ago

Not the details of how it was done - but Bob Cringely has an interesting bit of conjecture on how the attack might have been introduced. It is a bit controversial because it hypothesizes that it was a lack of proper change control processes and possible outsourcing.

http://www.cringely.com/2013/12/20/thoughts-grinch-stole-tar...

MichaelGG2• 13 years ago

That article is pretty worthless. First, he says "clearly the terminals had access to the Internet", and that if they used a private network, it'd not have been a problem. That's just wrong. Let's assume the POS terminals connected via IPSec over a frame relay linkup to several datacenters. A compromise in the processing center could cause an issue. Or, you could attack the POSes and have them record data to some internal site which you can access from another point in the intranet.

Second, his only actual argument is: "Someone probably made an out of process change to Target’s POS system and nobody noticed."

Sure, maybe. Or maybe someone subverted some other security system first. Who knows. Useless conjecture is just that.

Then he goes on about how the NSA should be fixing these issues. Okie dokie.

This is the same guy that doesn't understand how search engines work, and asked Eric Schmidt to manually fix his sister's website ranking in Google. I wouldn't take him as a useful source.

pyre2• 13 years ago

I (half-)heard on the radio a couple of days ago something about the infection being at (or getting into) a processing center for Target, which was why so much was able to be taken. Sorry I don't have more info, I only caught the tail-end of what they were saying (and I haven't looked it up elsewhere).

smackfu2• 13 years ago

Target hasn't said, and Target is the only one who know the "how". I believe the credit card processors were independently able to determine that Target was hacked by buying some of these card numbers and determining their commonality, and then telling Target.

falcolas• 13 years ago

So, granted the perpetrator can easily be considered to be a scumbag, but is doxxing him really the best way to address this situation? What if this guy ends up lynched by a vindictive mob? What if this information is wrong?

pyre2• 13 years ago

If he gets lynched, then it becomes news, and generates more pageviews. It's good for business. /s

ghoul22• 13 years ago

A lot of value of stolen credit cards comes from the reluctance of businesses and law enforcement to go after the users of such stolen cards, as the transactions are "small" - sub-1000$.

Last year, I had four fraudulent transactions appear on my card. I am a very cautious user - Linux on the desktop, seperate user and browser profile for e-shopping etc. This was the first time it happened in over 15 years of extensive online card-use.

Two of the transactions were with Netflix to register new streaming accounts. I called up Netflix, and within a couple minutes had a block placed on my card and both the accounts deleted with refunds to my card.

The other two transactions were on frys.com. One was for a laptop and the other, much higher value, for a smartphone. Shockingly enough, while one transaction got security flagged and did not go thru, the laptop one cleared and the laptop had been shipped out before I contacted frys. Frys rep told me on the phone that the information submitted was very clearly and obviously phony - the email address was a string of random letters @gmail.com, name etc everything was fake. Even with the credit card info, the only piece of correct info was the credit card number. No CVV was submitted, no correct billing address, not even the name on the card was correct. Heck, as my credit card is NOT US based, even the country of the card was not correct. Yet Frys shipped it.

I tried to get more information about the fraud but frys refused: they told me point blank, that they will not give me information, they will not initiate a police case, and they will not refund my money even though they were clearly at fault for having the transaction to go thru.

I, not being based in the US, had few options. I filed an online police report with San Jose police, where Frys is based. I also filed an online report with the FBI online fraud division. Both of them assumed I was filing these reports for insurance/reporting purposes, but told me outright that no investigation would take place.

Later, when my bank provided me with more info about the fraud I found out that frys actually challenged my chargeback and provided the transactions details to my bank. As expected they had no case, but I found out from the details that the laptop had been shipped to an address in Abilene, TX. I immediately registered an online report with the Abilene PD as well.

None of the authorities were interested in following up. Considering how trivial it would have been to atleast checkup on the address, this seems like a bad lapse.

I believe it creates a moral hazard: In the end, frys was the one that was out a few hundred dollars, and they refuse to prosecute. Police does not act on my complaint. Once it becomes known that a company has such lax policies, its open season.

larrys3• 13 years ago

"Last year, I had four fraudulent transactions appear on my card. I am a very cautious user - Linux on the desktop, seperate user and browser profile for e-shopping etc. This was the first time it happened in over 15 years of extensive online card-use."

As a merchant who frequently gets bogus credit card order over the net I will confirm that nobody seems to particularly care about being notified that we feel it's highly probably that a credit card has been stolen. In other words there isn't a system in place even where a merchant who notices they have a stolen card being used can say "hey you should freeze this card or at least look into it".

apaprocki• 13 years ago

It probably differs from issuer to issuer. In my experience Amex is very on top of it and they have always flagged every transaction I have not made myself, immediately sending push notification and SMS where I can ack/nak an automated transaction prompt. If I nak it they freeze the card and overnight a new one. I suppose they don't really care about handling it manually because that would be prohibitively expensive and they prefer to act on the patterns in an automated way. Would be interesting to see aggregate stats by card issuer of how good they are at detecting it.

djchen2• 13 years ago

This is only the tip of the iceberg. I would say the bigger issue and thr lower hanging fruit is that we don't use Chip+Pin or Chip+Signature here in the US. Using either tech will go much further than just having police departments investigate after the fact.

pmjordan• 13 years ago

That doesn't really help for online transactions. I'm not aware of any 2-factor authentication being used for online credit card transactions anywhere.

ejdyksen• 13 years ago

...frys actually challenged my chargeback...

Side note: if you have a fraudulent transaction on your credit card, don't call your credit card company and "dispute" a charge or ask for a "chargeback". Instead, call them and tell them you had a fraudulent transaction.

I had a clearly fraudulent charge on my Amex a few years ago (a Wal-Mart gift card was shipped to somewhere in Central California). I called Amex and asked to dispute the charge. Wal-Mart then provided Amex with the tracking info showing the package was signed for, and so they said that they had rendered the services paid for, and the case was closed in the merchant's favor.

It turns out that "fraud" is the magic word, not "dispute". I called Amex back and got into the fraud process instead, which of course fixed the issue.

ghoul22• 13 years ago

Sorry, you are right, of course. Here, I used "chargeback" as a shortcut for saying I asked the bank to not pay out. My banks dispute form - a simple 1-pager - essentially leaves very little room for confusion in the nature of the dispute in any event. They have some 10-odd descriptions and one is supposed to pick the right, or closest one. I picked "I did not authorize nor was involved in this transaction".

In my country the "terminology" of credit card use isn't as evolved as it is in the US - we don't actually have well defined terms like "chargeback", "dispute" etc.

dminor4• 13 years ago

Amex is also in general more likely to side with a merchant than Visa/Mastercard, who pretty much never do.

systematical2• 13 years ago

So ten years ago I was fresh out of high school. Not a lot of money and I had accidentally left my debit card at a fast food joint. Fraud services called me later that day to inform me of various odd charges, none of which were mine.

Enraged I asked for the places and date/time stamps of transactions. I tracked the persons footsteps, some business owners allowed me to see security camera footage.

There she was, in her fast food uniform (the place I had ordered from earlier that day) in 3 different businesses at the exact same time of the debit card time stamps.

I took this information directly to the police were I was dismissed saying that my bank would do the investigation and not too worry about it. I went a head and spoke with the manager of the fast food joint as well. Morale of the story, the police don't do shit.

ronnier• 13 years ago

Try driving 40 mph in a 30 mph zone and see how quickly you are pulled over. It can't be in any area though; it needs to be in a mostly white middle to upper class area.

My theory is that police know that people pulled over in those areas are likely to be the responsible type who would pay for a ticket. And the person who stole and used your credit card is likely the type who would not pay tickets or fines but would end up having to spend time in jail. So, they target those who will pay tickets (a source of revenue) and ignore cases like yours that would result in no revenue.

dba7dba• 13 years ago

> I filed an online police report with San Jose police, where Frys is based.

You can forget about police doing anything to catch the criminals. The only good you get out of contacting police of such ID theft cases is that you can use the resulting paperwork to file claim with credit card company. Forget about police doing anything to actually go out to look for the criminals.

IMO, US police departments are firmly stuck in the mode of 'only-criminal-we-go-after-is-someone-with-a-gun-or-drug'.

It's been a while so the sequence of events is a bit fuzzy but basically I was a victim of ID theft a few years ago. A few checking/credit accounts opened using my name. 2 iPhones purchased using my name (not approved by me of course) at an official phone company store (meaning they were captured on security camera in the store). On Credit Report I pulled immediately after I learned what was happening, I saw my actual addresses and the criminals' addresses on the report. Interestingly the criminals were living in a 'dump' 1 year earlier but had since moved into a rental in a brand new condo complex. I mean a brand new, nice condo complex, also in San Jose area. I found out through Google Street View.

Now I had leads on their addresses and VIDEO FOOTAGE (in possession of the phone store in San Jose) of them existed. I was excited as I was headed to police station to file report. Well, what a disappointment. It seemed no one seemed interested in seeing the video footage. They just took my report (took me about 1+ hours in there). I got a generic confirmation letter from my police dept weeks later. I heard nothing from the police in San Jose. Weeks (or months later ?) I got a call from a US Postal Inspection Service investigator. He gave me names of 2 suspects and asked again if I knew them. I did not and am pretty sure they were the criminals. Thus the crime was being investigated by US Postal Inspection Service. So a potentially slam dunk case was being pushed around between 2 local police departments and a Federal agency. And the result was I was actually interviewed on the phone weeks/months after the crimes had occurred.

These pulps committed a crime that potentially cost someone else a few thousands bucks (cost of phone and fee and late fee), not to mention hours I had to spend to clean up the mess. But because the victim and criminals are in separate/distant jurisdictions, the police essentially did not do much on their own. They simply pushed the case off to a federal agency.

Had someone in my police department called San Jose police department to go look at a video foorage at a phone store and visit a local address up there, they could've caught the guys in a matter of hours or days.

Interestinly, months later I got a letter from landlord of the condo rental the criminals had rented. The landlord was demanding unpaid rent. The pulps had rented the complex using my name and when the fraudulent accounts were cut off and their money dried up, they fled without paying rent. The landlord's collector of course searched for my name and found the real 'me'.

The US police seems helpless with these crimes that cross multiple jurisdictions.

jauer• 13 years ago

This might be a midwest thing but the police departments around me (Milwaukee, WI suburbs) will chase down something as insignificant as a kid using their friend's parent's credit card to buy a hundred dollars of Xbox points online.

saryant• 13 years ago

Anecdotal counterpoint: when a waiter started skimming cards in a town I used to live in, the county sheriff actually did track them down and arrest them. Charges were filed but I don't remember what happened after that.

Of course, they also tracked down someone who stole a pair of sunglasses out of my car so my experience is likely atypical.

systematical2• 13 years ago

Yep I had a very similar experience

Negitivefrags• 13 years ago

As a business accepting credit card payments, we attempted to be good citizens at first. We would try to notify the credit card company or the banks when an obviously fraudulent transaction came in and that kind of thing. We even tried calling the police at one point with IP logs and so on.

Nobody gave a shit.

We asked our credit card processor, Stripe, what to do about fraudulent transactions. They told us that they had no way of notifying a bank about that kind of thing and to just refund it.

So now our policy is just to refund fraud and forget about it. It's a position we were forced in to. This means that the person whose credit card was stolen will continue to be abused and there really isn't anything we can do about it.

dcc1• 13 years ago

Same experience (Stripe) also had an increase in orders the days after target thing came out.

All very obviously fraudulent for example user in indonesia but cards from us

allochthon• 13 years ago

It seems that everyone has plenty reason to be irritated with credit card technology except the thieves. Hopefully there will be sufficient incentive to replace credit cards with something more secure in the next 5-10 years.

dhughes• 13 years ago

Two of the transactions were with Netflix to register new streaming accounts.

I had Netflix and one day noticed I was billed twice on my credit card for Netflix service, one was OK but the other just appeared on my bill.

I used the online chat to talk to a Netflix rep who seemed unimpressed and not the least bit concerned (no frowny emoticon). I asked how a new charge I didn't authorize could appear on my credit card, she had no idea and just kept repeating the company line their system is unable to credit me, so I said but somehow it can magically take double the money? Nice.

Anyway, no apology, no concern so no Netflix.

auctiontheory• 13 years ago

In these situations, where it's pretty black and white, writing or emailing a senior executive, such as the EVP of Customer Relations (contact into on company website) typically will get the result you want.

andy102• 13 years ago

Unfortunately, I was one of the shoppers at Target. It's fascinating how different issuers are dealing with the problem. It seems that many are waiting to reissue the cards, so the consumer can continue to shop during the busy time.

ginko• 13 years ago

Is it just me or is anyone else surprised that the first screenshot contains a (working) .su URL?

.su was the TLD of the Soviet Union.

alcari• 13 years ago

Russia still controls the .su tld and allows registering new domains under it.

seivan• 13 years ago

I tend to create temporary e-cards for online purchases outside of subscriptions...

tzs• 13 years ago

Several years ago I received an email offering to sell me 100k stolen credit cards, and it included a sample of 12k cards. They had card number, issuing bank, customer name, expiration date, customer address, and I think phone number. I don't remember if they had the CSC or not.

Some of these were from banks that would let you try to login given a card number and password, and told you on failure if you got the card number wrong or the password wrong, so I was able to do a check using that on some of the cards and found they were legit card numbers for accounts at those banks.

This was on a Friday late afternoon Pacific time.

I called the FBI to see if they were interested. They were not, and suggested that the Secret Service might be more appropriate. The Secret Service was also not interested. I then tried the credit card associations, and most of them told me that this would be an issue for their security department and suggested that I call back Monday morning as the security department had gone home for the weekend. One did give me the email I could forward the mail to.

I had thought someone would be interested in this, at least enough to want to look at the card numbers I had to determine if they came from a known breach or were from something new.

MichaelGG2• 13 years ago

Is this due to the CC processors fraud detection? They just figure it's the cost of business and most of the time, the merchant ends up footing the bill, right?

Is it possible the CC companies are worried that if the government steps in, it reduces their role in anti-fraud and helps their competitors?

Who's Selling Credit Cards From Target

Related Stories