DOJ: Credit Card Thefts Helped by 'Well Designed' Software
Currency counter, Glock, offshore banks and global players skated right past IT security.
Tue, August 05, 2008
Computerworld — The intruders whom the U.S. Department of Justice alleges stole tens of millions of credit and debit card numbers were bold, global, skilled and making millions of dollars, according to details in the charging documents.
And despite all the focus on security since the 9/11 terrorist attacks, the people alleged to be behind this network had little difficulty taking data from some nine businesses, all major retailers. They exploited vulnerabilities in networks, servers and databases, making the information they gleaned available worldwide to the underground economy that buys and sells such data.
All of this was detailed by the DOJ, which is charging 11 people in what is certainly one of the largest and most organized credit card theft operations ever. It extends back to 2003 and includes nationals from several countries—a true world-is-flat operation.
The U.S. alleges that the group decrypted PINs, made new cards and got cash from ATMs. They sold credit card data on Web sites that specialize in trading that information, the DOJ said. And, it claims, they operated globally, using offshore banks and other methods to turn stolen data into cash. ICQ instant messaging and e-mail kept everyone in touch.
Millions of dollars were involved, and the charging documents outline proceeds that were transferred in seven-digits amounts such as $3.8 million, $4.9 million, $1.9 million—to list but a few.
There was so much cash involved that among the things federal authorities seized from Albert Gonzalez of Miami, whom the U.S. alleges played a key role in the crime ring, was a currency counting machine. Gonzalez was captured in May; police also confiscated a Glock handgun and nearly $25,000 in cash from him at that time.
The retailers known to have been targeted are BJ's Wholesale Club, TJX, DSW Shoe Warehouse, OfficeMax, Barnes & Noble, Boston Market, Sports Authority and Forever 21.
One means of access of the retailers' networks was through a practice dubbed wardriving—driving around in a car with a Wi-Fi-enabled laptop computer seeking access.
The first details of the methods used in this extensive operation surfaced in May. In an indictment concerning the theft of credit and debit card data from Dave & Buster's Inc., a Dallas-based restaurant chain, the U.S. analyzed the software used to steal the credit card data. That indictment gives the software designer a nod as having created an effective tool.
