12 ms·
Credit card thieves using free-to-play apps to launder their ill-gotten gains
- mtkd 8y agoOriginal article: https://kromtech.com/blog/security-center/digital-laundry https://kromtech.com/blog/security-center/digital-laundry
- sctb 8y agoThank you, we've updated the link from https://www.bleepingcomputer.com/news/security/open-mongodb-database-exposes-mobile-games-money-laundering-operation/ https://www.bleepingcomputer.com/news/security/open-mongodb-....
- nemild 8y agoI'd be interested to know which version of MongoDB this was. This "no auth" was a default choice for MongoDB through at least 2013 (in this case, it helped to find nefarious actions). For more background, I wrote a three-part MongoDB[1]. These are the notes on auth behavior from the interview with MongoDB's CTO: > - Defaults: I feel like it’s playing with fire to set bad defaults in a database - with numerous data breaches due to 10gen’s early decisions on authentication, remote login, and encryption (see for example, https://snyk.io/blog/mongodb-hack-and-secure-defaults/ https://snyk.io/blog/mongodb-hack-and-secure-defaults/ ). For auth, Eliot argues that developers need to take responsibility for exposing MongoDB on public servers - and that the SLA for a self-hosted instance is different than a managed instance (at minimum, I have issues with users having their data exposed to the world through no fault of their own). He disagreed with 10gen’s decision to turn on auth by default in later self-hosted versions once MongoDB ignored remote connections by default (but thought this was the right choice for the managed Atlas service). (But before 2014, the default behavior was no auth - and accepting all remote connections, see https://snyk.io/blog/mongodb-hack-and-secure-defaults/ https://snyk.io/blog/mongodb-hack-and-secure-defaults/ ; Eliot notes that this took a while because changing the default would have caused issues for existing customers) ( https://news.ycombinator.com/item?id=14804765 https://news.ycombinator.com/item?id=14804765 ) [1] https://www.nemil.com/mongo/ https://www.nemil.com/mongo/
- Joeri 8y agoFor auth, Eliot argues that developers need to take responsibility for exposing MongoDB on public servers That’s like selling a car without preinstalled seat belts and then saying it is the responsibility of the driver if they take it on the road like that. It’s technically true, but it’s sort of missing the point.
- duxup 8y agoOr selling a gun without a safety. "Well just don't shoot yourself or the wrong people silly!" Dude that is not what happens in the real world!
- allthenews 8y agoMany guns are manufactured and sold without safeties. Personal responsibility transcends industry.
- patrickg_zill 8y agoName a handgun in current production, that you can buy in any Western country, that has no safety on it.
- UncleEntity 8y agoRevolvers. Fun fact: one of the bartenders at my old watering hole was playing with the "bar gun", flipping the cylinder closed by flicking his wrist, and shot a round into the wall. Luckily I wasn't there that night because accidental discharges are a beatable offence.
- toomanybeersies 8y agoI've had an ND only once in my life, and it was with a target rifle with a <1 lb trigger pointed downrange. It still scared the bejesus out of me. If someone shot a round into a wall at a bar, it would be more than a beatable offence for me.
- Y_Y 8y agoOf course the game makers aren't going to filter it, it makes them an "unwitting" benficiary of money laundering. It's not like their overt business purpose is any better.
- __jal 8y agoThey may not have any natural incentive, but whoever processes their credit card transactions could certainly provide one.
- duxup 8y agoI worry that they don't really "care" either outside of a baseline of plausible deniability.
- chatmasta 8y agoAnd why would they, if any fraud is insured? It’s priced into their business model. There are some interesting ethical debates to be had around stealing credit cards. At the end of the day, who is the thief really hurting? The consumer is inconvenienced at worst. The card companies are insured. The insurance companies already priced the risk into their actuarial models.
- gruez 8y agoAFAIK for card not present transactions, if a chargeback occurs, the merchant pays for the refund, plus a chargeback fee of ~$25. So unless the credit card victims are particularly clueless, this shouldn't be profitable for the merchant.
- aphextron 8y agoMy pet conspiracy theory: The vast majority of the CS:GO economy is a massive money laundering operation for the Russian government. You have skins for an AK47 selling for $40,000. Does anyone seriously think that's legit?
- Drakim 8y agoDo they regularly sell for $40,000 or is that just the top price that's posted?
- ceejayoz 8y ago$40k is probably a bit of an outlier, but there's still quite a bit of volume. For example, this gun https://opskins.com/?loc=shop_view_item&item=498470571 https://opskins.com/?loc=shop_view_item&item=498470571 sold 7 times yesterday for $200/pop. That's one item on one site.
- aphextron 8y agohttps://www.pcgamer.com/csgo-skins-most-expensive/ https://www.pcgamer.com/csgo-skins-most-expensive/ It seems the $40,000 one was an outlier, but still $4000+ is common. Total market volume is in the billions.
- darawk 8y agoMarket volume in the low billions is probably not enough for a government to do much serious money laundering. Maybe organized crime, but not a major national government.
- jbattle 8y agonorth korea
- jessaustin 8y agoWhy would a government need to launder money? Are there no banks in their jurisdiction? Can they not enforce their laws on those banks?
- GlitchMr 8y ago"They chose email providers with little to no protection against automated account creation." To be specific, go2.pl, o2.pl, prokonto.pl and tlen.pl are the exact same mail provider - in fact, those domains are aliases for each other after registering. This means that by registering a single time, they get four usable e-mail addresses. Interestingly, the same provider also provides a functionality to get more aliases if you want, but it doesn't seem like criminals used this functionality (the aliases cannot be in those four domains, rather they can be in another list of 18 domains).
- r00fus 8y agoDoesn't fastmail offer the same feature? I remember at least a dozen aliases when I used them a decade ago.
- deleted 8y ago[deleted]
- tlavoie 8y agoAnyone else wondering if the criminals read Neal Stephenson's novel, Reamde, as a how-to guide?
- wuliwong 8y agoI'm a little unclear on how they found this database and why it was left without security. It sounds like there is some well known vulnerabilities with older versions of Mongo and these people did some security audits where they found this particular database. Is the explanation for why this database was left vulnerable just a mistake on the part of the money launderers?
- shakna 8y agoMongoDB's defaults have no real authentication.
- mr_tristan 8y agoI wonder if we'll ever know where these tools originated from. Does the US DOJ have a history of halting this sort of fraud yet?
- justboxing 8y ago> "Money laundering through the Apple AppStore or Google Play isn’t a new idea and has been done before. In the 2011 the Danish part of the Apple App Store was flooded with expensive suspicious applications. More than 20 out of 25 of the most downloaded applications were from China. The price of the apps ranged from $50-$100. For example, one of them “LettersTeach”, was intended for children who are learning English letters, yet it cost nearly $78. This pointed to money laundering then, however, what we encountered now is much more sophisticated. I don't understand how the laundering part works. There was a similar link posted to an overpriced book on amazon yesterday on HN, which also alluded to money laundering. So if I understand correctly, the person(s) who want to launder their ill-gotten cash publish an app with an outrageous price, and then by the same app with their ill-gotten money, thereby turning it legitimate (buy way of the app company)? If yes, then how much money could you possibly launder this way? Won't purchase of the same app a 100 times (if that's even possible) raise suspicion? And even then you've only managed to launder 50 - 100 x 100 = max of 10,000 USD. This is peanuts for the real money launders who would be dealing with millions of $ monthly.
- duxup 8y agoIn the lower right they note selling an AppleID with some game currency on it. Is that of any use to a given gamer, a whole new AppleID?
- jsnell 8y agoGiven how off many of the details are in this article, I don't know that the authors have a very deep understanding of the f2p game economy. So it's hard to trust anything beyond "f2p games are used with stolen credit cards" part. Which is true, but not exactly news. Most importantly they keep harping on about how Supercell should be doing more to ban accounts that tranfer illicit gems between accounts, or how each gem should have an individual hash so that it could be tracked to the source, etc. Well, given that gems are not and never have been transferrable between accounts in those games, having it be a bannable offense would have no effect at all. And the chain of ownership is always going to be exactly one step long. (Yes, any game that makes the premium currency or items transferrable is inviting a lot of abuse. It's not just stolen credit cards, it'll also be account hijacks since they'd be very lucrative. Just drain all the victims items before they can recover the account. Optionally you can also buy more items with the victim's already registered CC at the same time. So if a game does support these kinds of transfers, it's good to be deeply suspicious about the motives of the creators. But afaik it's simply not the case for any of the Supercell games that this article talks about.) And then that table showing the scale of the problem is pretty bizarre. The stated revenue numbers must be off by around a factor of 5. I thought for a moment it was talking about the scale of the abuse they've deteted. But then that'd mean the scammers are using 100M Google accounts to wash 20k credit cards/month. That's too absurd to be true.