Peek Inside a Professional Carding Shop

http://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/

by acdanger • 12 years ago

170 54 12 years ago

seanccox2• 12 years ago

Well if this isn't the most timely post I've ever found. I just had the details from my debit card stolen on Sunday and the attached account completely drained. It's so cool to be reading about how part of this process works.

dublinben4• 12 years ago

Sorry to hear that. In the future, I suggest not using your debit card online or anywhere else it could get stolen. As you've seen, you have much less protection than with a credit card.

I even have two completely separate checking accounts, at two different banks. One is only used at ATMs, and the other is only used to pay my CC bill. Neither are ever used online or at any physical merchant.

arecurrence• 12 years ago

Are you saying they wont be able to easily recover their money? I thought there were guarantees behind this.

ufmace• 12 years ago

I've taken to never carrying the debit card attached to my primary checking account, the one that I receive paychecks in and pay most bills from. I opened a separate account to carry the debit/ATM card from, and periodically transfer extra money into that. I figure that limits the potential damage and hassle in case the card is ever lost or stolen. Even with that, I never use that card anywhere but the ATM.

I suppose you have to be a bit more careful about these things with how easy the internet makes it to steal cards and sell the info to somebody else who can exploit the stolen card info with less risk.

bitJericho• 12 years ago

Alternatively you can just keep two bank accounts one for online transactions. You're not liable for overdraft fees or anything if your details were stolen.

What you do gotta look out for is forgetting to add money in, but if you get a bank that is good about not allowing overdrafts to occur you can mitigate overdraft fees.

Anyway, yeah you might be safer with a credit card, but then you have a credit card.

seanccox2• 12 years ago

Thing is, I'm in Turkey, where you can't actually use debit cards for online transactions. It was my Turkish lira account, the only one attached to the card and the one that was running low anyhow, because it was the end of the month and I hadn't bother exchanging foreign currency for lira recently. There was no way to access the other accounts via the card at an ATM.

A conversation with a banker revealed that the common trick here is for thieves to attach cameras to ATMs to grab details, and then build mimic cards to drain accounts. The bank was pretty cooperative in processing my claim, and said they should have the money back to me in about 45-180 days. So, that's kinda lucky.

I'm going to be extra observant at ATMs from now on though.

panarky• 12 years ago

ATMs aren't safe either. The ATM at my local Chase branch got skimmed and $8,500 taken from my account.

The branch manager showed me photos of the skimmer gear and the police report. It was made to look like part of the ATM housing. She said over 200 customers were ripped off in one weekend.

Even though they knew it was their own machine that was compromised, it still took almost a month and many hours of phone calls and letter-writing to get my money back.

drcode• 12 years ago

I wonder why someone would trust "McDumpals" with their payment information to subscribe and purchase items, given that it is a site dedicated to stealing payment information?

(Just kidding, I know it's obviously because they aren't using a broken, insecure payment mechanism for transactions, like our credit card system.)

squeaky-clean• 12 years ago

Because they're using bitcoins, you don't have to give them your payment information. They gave you their address, and you send the money over.

I feel like that's the point you were making with that last sentence, but I missed the sarcasm until typing all the above out.

newaccountfool5• 12 years ago

Bitcoins, WebMoney, WesternUnion, Liberty Reserve, although most of them have been phased out for BTC.

boobsbr• 12 years ago

How is this kind of information stolen? Only on ATMs with card reader and keyboard covers?

dublinben4• 12 years ago

Most of the card dumps discussed in this article come from compromised merchants (retail stores, restaurants, etc.) not ATMs. They are credit card numbers after all, not debit cards.

aquadrop2• 12 years ago

Looks like good decision would be to have dedicated card for physical stores, restaurants etc. and to disable internet transactions for that card.

Zikes• 12 years ago

And broken retailer POS systems, like Target's.

bpackard• 12 years ago

.....where the massive data breach didn't seem to impact the CEO's wallet in the end http://money.cnn.com/2014/05/19/news/companies/target-ceo-pa...

ambiate2• 12 years ago

With the fruitless/mindless attacks from the comments, I can see the crowd is still about the same. Lots of low hanging fruit with a few guys getting rich (like most schemes).

It is funny how this business has not changed since 1998. The communication channels changed, but the ideas and market is still the same. My first introduction to this was with the Windows RPC remote exploit vulnerabilities. I setup some honeypots to determine what the botnets were up to (most were manual B/C class scans at that time, the good old days before decentralized command). I ended up following the trail of controllers up to a random efnet IRC chatroom and finally to a more private area. That's where they sold/traded data from the botnets. This was prior to the 'rent a botnet to DDoS' era.

Back then, credit cards without CVV2s (from Windows IIS Servers exploited with that long string bug leaking out plain text documents) were worth about 50 cents a piece. CVV2 brought it up to around $2-3 for US, $4-6 for UK/CA. Address information was around $15. It seems the market has deflated a lot, the credit cards are probably from targeted companies rather than scripted botnets looking for vulnerable boxes, and the data can just be bought from a website rather than having to get a third party to moderate the exchange.

Once again,the comments reminded me the most of that community. Someone mentioned about entering CC info on a CC theft site. There used to be a RTF document exploit where you could execute something or another from them, the dump sellers would infect their dump files (RTF docs) and steal the client's data. These communities are cutthroat.

darksim9052• 12 years ago

How does* Krebs get into these sites? How many alternative names does he have? Does he spend months gaining people's trust to get into these sites? It amazes me, he does such a great job for the community. Does he take donations? I want to give back for all the stuff I've learned from him.

blhack• 12 years ago

I don't think they're that scrutinous about who joins. You pay the $100 deposit (in BTC), and you're in.

acdanger• 12 years ago

He takes donations, both PayPal and Bitcoin. See the right sidebar on his site.

dueprocess• 12 years ago

I haven't read much of Krebs before, but I will now. This piece was amazingly informative for me, and well written.

darksim9052• 12 years ago

You should see his writeups on ATM skimmers, fascinating stuff.

newaccountfool5• 12 years ago

All of these websites are easy to get access to, once you find the URL thats it, pay a processing fee and your in.

http://validshop.su/usercp/auth/login

That's one of the biggest CVV websites, they sell the CC#/CVV/FirstName/LastName/Address

These websites are not hard to find, just have a look on a few 'underground' forums and you'll see the advertisements.

nikcub• 12 years ago

10% of users on these sites are actual crooks. 40% are wannabe crooks who heard about it on the news and thinking carding is both easy and will make them millions. The other 50% are people working for security companies, banks, retailers, law enforcement etc. pretending to be crooks so they blend in.

Krebs gets invited in, vouched for, and shown new forums by that last group.

dobbsbob• 12 years ago

Competition also gives him this info to bring heat to their rivals in the game. One forum used a unique marker that appeared to be a benign msg count number so they could identify krebs from screenshots he puts on his site and ban his account but he figured out what the marker was, cropped it out and was back with a new account.

damian2000• 12 years ago

Not to mention the crap he puts up with, like being SWATted twice. Luckily, the 16 yo kid who did it has been recently caught ... http://krebsonsecurity.com/2014/05/teen-arrested-for-30-swat...

espennilsen• 12 years ago

And this is why I only got some spending money on my debit card. The question isn't when you get skimmed, it's when.

jacquesm• 12 years ago

Chip + pin debit cards are reasonably safe. Credit cards are much less safe, essentially every time you enter your details there is one more party in on the secret.

I try to use my CC online as little as possible and in the real world only when I have the card in view at all times and the pin verification terminal is under my control while I enter the pin, and crucially, contains the card (so I won't use it if the terminal is in one spot and the card in another).

I never use swipe.

melvinmt• 12 years ago

You must be European.

Scoundreller• 12 years ago

How did the "Professional Carding Shop" infringe on McDonald's Inc's Trademarks? Can I buy credit card numbers at their fast food restaurants?

Did people think they could buy Big Mac Hamburgers online with bitcoins and get delivery over email?

croggle3• 12 years ago

Good timing. Someone skimmed by credit card and took $1600 AUD out of two cash machines in $800 batches.

I've never used this card in an ATM so it must be from a store that swiped my card.

Here's my questions though, how did the fraudster know my pin number to be able to use the cloned credit card in an ATM?

consideranon• 12 years ago

It's common to have cameras mounted to record you typing your PIN along with skimming your card. It's good practice to cover the pad with your other hand.

croggle3• 12 years ago

I have never put this card in an ATM. It must have been skimmed from a swipe machine in a restaurant.

I still don't know how they got my pin. I can't imagine anyone looking at my pin in a restaurant. It seems like such a hard and non-scalable way to do this kind of thing.

callmeed• 12 years ago

My card was skimmed at a gas station a few months back. What impressed me was the speed with which it was used. The charges started maybe 2 hours after visiting the gas station in Los Angeles. But I live 3 hours North of LA.

How are people capturing the numbers, transferring them, and (I assume) creating fake cards to use in-store so fast?

newaccountfool5• 12 years ago

GSM skimmers are used, meaning the criminals get the details through a device on the skimmer that sends the details via text message.

confluence• 12 years ago

Install blue tooth enabled skimmers. Get runners to drive around and go near hit machines, from where the data is pushed over mobile. Or maybe, the skimmers have an embedded mobile chip that pushes the data as soon as it's skimmed.

thefreeman2• 12 years ago

They could be connecting the accounts to some sort of mobile NFC payment system, like google wallet's "tap and pay".

lectrick• 12 years ago

Fuck everything about these people.

Peek Inside a Professional Carding Shop

Related Stories