8 ms·

Who's Selling Credit Cards From Target

238 points by dkasper 13y ago

bri3d 13y ago
This is a a good illustration of how hard it can be to stay anonymous online. With that being said, I don't see how Krebs reaches the conclusion that this guy "probably" knows who stole the Target cards or how they were stolen. They were just posted on his crappy carding forum. It seems a bit disingenuous to me to plaster this person's dox under this headline; yes, he seems pretty scummy and runs several criminal enterprises but there's no actual evidence in the article linking him to the Target fraud beyond someone else using his forum to hawk their stolen goods.
- cycnusx 13y ago
  I think if you shine a light in the darkness, the darkness will go away (or find another corner).
- Dylan16807 13y ago
  It's more a lesson in how you can't take a non-anonymous account and turn it anonymous. If a pseudonym has ever linked to sensitive information, you have to abandon it entirely.
- d23 13y ago
  Krebs doxxes people frequently and it seriously undermines any moral argument he may have, since a good deal of his time has been spent complaining about people doxxing him. There's a fine line between exposing crime and opening someone up to vigilante justice. Send the information to the police, but the public has no need for it.
  - uchi 13y ago
    Who has Krebs doxxed before exactly? This is the first time I'm hearing about this.
    - deleted 13y ago
      [deleted]
andy10 13y ago
Unfortunately, I was one of the shoppers at Target. It's fascinating how different issuers are dealing with the problem. It seems that many are waiting to reissue the cards, so the consumer can continue to shop during the busy time.
ck2 13y ago
How on earth are the sellers "cashing out" and how are they taking payments? Why can't the money be followed? If the NSA is such a powerhouse with billions of dollars of assets to track every electronic communication, why aren't they focusing their entire resources on people like the sellers? Or is it like the TSA where they just hassle the completely innocent people at the airport for show while the real criminals take other paths.
- guyht 13y ago
  It pains me to say this, but most of the time the hackers will ask for payment in bitcoin which makes tracking much harder.
  - gizmo686 13y ago
    You mean the bitcoin that maintains a public record of every transaction ever made on the network? There are still ways to anonomously cash out (payments to an anonomous account that forwards the funds to a mixing service, for example), but bitcoin is not a silver bullet for getting away with it.
    - deleted 13y ago
      [deleted]
- dasil003 13y ago
  > If the NSA is such a powerhouse with billions of dollars of assets to track every electronic communication, why aren't they focusing their entire resources on people like the sellers? Because they didn't invest that kind of money to find the logs in a haystack that are eastern bloc cyber criminals. They are looking for a needle in a haystack dammit. A needle. (and possibly if some of their wives are cheating on them).
  - Datsundere 13y ago
    "Is your wife cheating on you? Well you have the opportunity to figure out by joining the NSA today!"
lstamour 13y ago
Of course all this hinges on the admission that he was Hel in the first place .... which seems plausible to the amateur but requires more evidence for courts, I suspect. Though the name-clash of that service and the bribery is intriguing. As to Target, there had to be a group. Somebody funding, someone inside, and then you've distribution networks for what effectively ends up as money laundering. At least that's the way I imagine it :)
belluchan 13y ago
I was in line and made a short conversation (short so as to not hold up the line) with the cashier at Target. The elderly lady behind me was pretty worried about the credit card theft, and the cashier knew about it too. It's cool at least that news about this stuff is reaching more people. In my opinion just get a new card, don't wait for suspicious activity. Check it to see if it was already used. Also given that the 3 letter pins weren't from the back are not included I'm not sure if it's going to be very easy to make use of this card data. Having said, still get a new card if you used it at Target recently.
- bri3d 13y ago
  The magnetic track data was compromised, which means once the data trickles back through the black market crooks can write the cards back out and use them as card-present. Definitely harder than sitting around ordering things online, but there's no reason to need the CSC to use the data they stole.
- liuhenry 13y ago
  By 3 letter pin, do you mean the CVC code? Many merchants require the CVC code to protect themselves against fraud/chargebacks and because they can get lower processing fees, but strictly speaking, it's not necessary to make a transaction (IIRC, the only thing you need is the card number and expiration date). Notably, Amazon does this for their 1-click checkout. Saving CVC codes is against PCI compliance, so in order to provide that low-friction experience, they simply post the saved card information without it.
  - larrys 13y ago
    "the only thing you need is the card number and expiration date" If the dollar amount charged is low enough you don't even need the expiration date. You just use the current month. We've frequently have to charge expired customer credit cards (expired by years in many cases) and as long as the dollar amount is low enough (off the top +- $40 [1]) and the card number hasn't been changed the charge will go through. Very convenient instead of having to contact the customer to get a new credit card expiration date. Also helps because that way you don't give the customer a chance to rethink what they are paying for and whether they need it or not. [1] May be higher but I'm not certain if it's $60 or $100 so I will go with an amount that I know works.
yeukhon 13y ago
I am fascinated how the black market operates. With law enforcement probing every corner, going undercover, I can't imagine myself getting involved in a blackmarket at all. Well, I guess there is always the risk which says high risk yields high return.
- dobbsbob 13y ago
  Russia and CIS countries don't care about US fraud so won't allow citizens to be extradited. FBI/Secret Service prob know who they are and will just wait until they go on vacation somewhere and kidnap them like they usually do.
  - bananacurve 13y ago
    >kidnap them like they usually do Although that would be impressive, I'm sure you know you are full of shit, but other people don't.
    - dobbsbob 13y ago
      Derp dey derp http://rt.com/news/extradite-russian-national-panin-901/ http://rt.com/news/extradite-russian-national-panin-901/ Also Maksim Yastremsky (sp?) who the SS had Turkey work over for his FDE key because when they broke into his hotel room in Dubai couldn't extract info. That was from the 2007 big TJmax carding heist.
      - AnotherDesigner 13y ago
        I'm confused, are you implying it's not okay for these criminals to be brought to justice, in accordance with various international laws, when their parent state acts belligerent and refuses to cooperate? These people hurt others for a living. They deserve punishment.
        dobbsbob 13y ago
        So does the Pentagon but you never see them punished for blowing up a wedding. US does not act within international law if they did CIS/Russia wouldn't be complaining about these kidnappings
x0054 13y ago
This is a fascinating bit of research. Has any one posted yet information on how the actual card info was stollen? I read somewhere that the point of sale units were infected, but with no evidence to back that claim up.
- wallflower 13y ago
  Not the details of how it was done - but Bob Cringely has an interesting bit of conjecture on how the attack might have been introduced. It is a bit controversial because it hypothesizes that it was a lack of proper change control processes and possible outsourcing. http://www.cringely.com/2013/12/20/thoughts-grinch-stole-targets-christmas/ http://www.cringely.com/2013/12/20/thoughts-grinch-stole-tar...
  - MichaelGG 13y ago
    That article is pretty worthless. First, he says "clearly the terminals had access to the Internet", and that if they used a private network, it'd not have been a problem. That's just wrong. Let's assume the POS terminals connected via IPSec over a frame relay linkup to several datacenters. A compromise in the processing center could cause an issue. Or, you could attack the POSes and have them record data to some internal site which you can access from another point in the intranet. Second, his only actual argument is: "Someone probably made an out of process change to Target’s POS system and nobody noticed." Sure, maybe. Or maybe someone subverted some other security system first. Who knows. Useless conjecture is just that. Then he goes on about how the NSA should be fixing these issues. Okie dokie. This is the same guy that doesn't understand how search engines work, and asked Eric Schmidt to manually fix his sister's website ranking in Google. I wouldn't take him as a useful source.
- pyre 13y ago
  I (half-)heard on the radio a couple of days ago something about the infection being at (or getting into) a processing center for Target, which was why so much was able to be taken. Sorry I don't have more info, I only caught the tail-end of what they were saying (and I haven't looked it up elsewhere).
- 13y ago
falcolas 13y ago
So, granted the perpetrator can easily be considered to be a scumbag, but is doxxing him really the best way to address this situation? What if this guy ends up lynched by a vindictive mob? What if this information is wrong?
- pyre 13y ago
  If he gets lynched, then it becomes news, and generates more pageviews. It's good for business. /s
  - chronic25 13y ago
    10/10 would read again
ghoul2 13y ago
A lot of value of stolen credit cards comes from the reluctance of businesses and law enforcement to go after the users of such stolen cards, as the transactions are "small" - sub-1000$. Last year, I had four fraudulent transactions appear on my card. I am a very cautious user - Linux on the desktop, seperate user and browser profile for e-shopping etc. This was the first time it happened in over 15 years of extensive online card-use. Two of the transactions were with Netflix to register new streaming accounts. I called up Netflix, and within a couple minutes had a block placed on my card and both the accounts deleted with refunds to my card. The other two transactions were on frys.com. One was for a laptop and the other, much higher value, for a smartphone. Shockingly enough, while one transaction got security flagged and did not go thru, the laptop one cleared and the laptop had been shipped out before I contacted frys. Frys rep told me on the phone that the information submitted was very clearly and obviously phony - the email address was a string of random letters @gmail.com, name etc everything was fake. Even with the credit card info, the only piece of correct info was the credit card number. No CVV was submitted, no correct billing address, not even the name on the card was correct. Heck, as my credit card is NOT US based, even the country of the card was not correct. Yet Frys shipped it. I tried to get more information about the fraud but frys refused: they told me point blank, that they will not give me information, they will not initiate a police case, and they will not refund my money even though they were clearly at fault for having the transaction to go thru. I, not being based in the US, had few options. I filed an online police report with San Jose police, where Frys is based. I also filed an online report with the FBI online fraud division. Both of them assumed I was filing these reports for insurance/reporting purposes, but told me outright that no investigation would take place. Later, when my bank provided me with more info about the fraud I found out that frys actually challenged my chargeback and provided the transactions details to my bank. As expected they had no case, but I found out from the details that the laptop had been shipped to an address in Abilene, TX. I immediately registered an online report with the Abilene PD as well. None of the authorities were interested in following up. Considering how trivial it would have been to atleast checkup on the address, this seems like a bad lapse. I believe it creates a moral hazard: In the end, frys was the one that was out a few hundred dollars, and they refuse to prosecute. Police does not act on my complaint. Once it becomes known that a company has such lax policies, its open season.
- 13y ago
ginko 13y ago
Is it just me or is anyone else surprised that the first screenshot contains a (working) .su URL? .su was the TLD of the Soviet Union.
- alcari 13y ago
  Russia still controls the .su tld and allows registering new domains under it.
seivan 13y ago
I tend to create temporary e-cards for online purchases outside of subscriptions...
tzs 13y ago
Several years ago I received an email offering to sell me 100k stolen credit cards, and it included a sample of 12k cards. They had card number, issuing bank, customer name, expiration date, customer address, and I think phone number. I don't remember if they had the CSC or not. Some of these were from banks that would let you try to login given a card number and password, and told you on failure if you got the card number wrong or the password wrong, so I was able to do a check using that on some of the cards and found they were legit card numbers for accounts at those banks. This was on a Friday late afternoon Pacific time. I called the FBI to see if they were interested. They were not, and suggested that the Secret Service might be more appropriate. The Secret Service was also not interested. I then tried the credit card associations, and most of them told me that this would be an issue for their security department and suggested that I call back Monday morning as the security department had gone home for the weekend. One did give me the email I could forward the mail to. I had thought someone would be interested in this, at least enough to want to look at the card numbers I had to determine if they came from a known breach or were from something new.
- MichaelGG 13y ago
  Is this due to the CC processors fraud detection? They just figure it's the cost of business and most of the time, the merchant ends up footing the bill, right? Is it possible the CC companies are worried that if the government steps in, it reduces their role in anti-fraud and helps their competitors?

238 points by dkasper 13y ago

bri3d 13y ago

This is a a good illustration of how hard it can be to stay anonymous online. With that being said, I don't see how Krebs reaches the conclusion that this guy "probably" knows who stole the Target cards or how they were stolen. They were just posted on his crappy carding forum. It seems a bit disingenuous to me to plaster this person's dox under this headline; yes, he seems pretty scummy and runs several criminal enterprises but there's no actual evidence in the article linking him to the Target fraud beyond someone else using his forum to hawk their stolen goods.

cycnusx 13y ago
I think if you shine a light in the darkness, the darkness will go away (or find another corner).
Dylan16807 13y ago
It's more a lesson in how you can't take a non-anonymous account and turn it anonymous. If a pseudonym has ever linked to sensitive information, you have to abandon it entirely.
d23 13y ago
Krebs doxxes people frequently and it seriously undermines any moral argument he may have, since a good deal of his time has been spent complaining about people doxxing him. There's a fine line between exposing crime and opening someone up to vigilante justice. Send the information to the police, but the public has no need for it.
- uchi 13y ago
  Who has Krebs doxxed before exactly? This is the first time I'm hearing about this.
  - deleted 13y ago
    [deleted]

andy10 13y ago

Unfortunately, I was one of the shoppers at Target. It's fascinating how different issuers are dealing with the problem. It seems that many are waiting to reissue the cards, so the consumer can continue to shop during the busy time.

ck2 13y ago

How on earth are the sellers "cashing out" and how are they taking payments? Why can't the money be followed? If the NSA is such a powerhouse with billions of dollars of assets to track every electronic communication, why aren't they focusing their entire resources on people like the sellers? Or is it like the TSA where they just hassle the completely innocent people at the airport for show while the real criminals take other paths.

guyht 13y ago
It pains me to say this, but most of the time the hackers will ask for payment in bitcoin which makes tracking much harder.
- gizmo686 13y ago
  You mean the bitcoin that maintains a public record of every transaction ever made on the network? There are still ways to anonomously cash out (payments to an anonomous account that forwards the funds to a mixing service, for example), but bitcoin is not a silver bullet for getting away with it.
  - deleted 13y ago
    [deleted]
dasil003 13y ago
> If the NSA is such a powerhouse with billions of dollars of assets to track every electronic communication, why aren't they focusing their entire resources on people like the sellers? Because they didn't invest that kind of money to find the logs in a haystack that are eastern bloc cyber criminals. They are looking for a needle in a haystack dammit. A needle. (and possibly if some of their wives are cheating on them).
- Datsundere 13y ago
  "Is your wife cheating on you? Well you have the opportunity to figure out by joining the NSA today!"

lstamour 13y ago

Of course all this hinges on the admission that he was Hel in the first place .... which seems plausible to the amateur but requires more evidence for courts, I suspect. Though the name-clash of that service and the bribery is intriguing. As to Target, there had to be a group. Somebody funding, someone inside, and then you've distribution networks for what effectively ends up as money laundering. At least that's the way I imagine it :)

belluchan 13y ago

I was in line and made a short conversation (short so as to not hold up the line) with the cashier at Target. The elderly lady behind me was pretty worried about the credit card theft, and the cashier knew about it too. It's cool at least that news about this stuff is reaching more people. In my opinion just get a new card, don't wait for suspicious activity. Check it to see if it was already used. Also given that the 3 letter pins weren't from the back are not included I'm not sure if it's going to be very easy to make use of this card data. Having said, still get a new card if you used it at Target recently.

bri3d 13y ago
The magnetic track data was compromised, which means once the data trickles back through the black market crooks can write the cards back out and use them as card-present. Definitely harder than sitting around ordering things online, but there's no reason to need the CSC to use the data they stole.
liuhenry 13y ago
By 3 letter pin, do you mean the CVC code? Many merchants require the CVC code to protect themselves against fraud/chargebacks and because they can get lower processing fees, but strictly speaking, it's not necessary to make a transaction (IIRC, the only thing you need is the card number and expiration date). Notably, Amazon does this for their 1-click checkout. Saving CVC codes is against PCI compliance, so in order to provide that low-friction experience, they simply post the saved card information without it.
- larrys 13y ago
  "the only thing you need is the card number and expiration date" If the dollar amount charged is low enough you don't even need the expiration date. You just use the current month. We've frequently have to charge expired customer credit cards (expired by years in many cases) and as long as the dollar amount is low enough (off the top +- $40 [1]) and the card number hasn't been changed the charge will go through. Very convenient instead of having to contact the customer to get a new credit card expiration date. Also helps because that way you don't give the customer a chance to rethink what they are paying for and whether they need it or not. [1] May be higher but I'm not certain if it's $60 or $100 so I will go with an amount that I know works.

yeukhon 13y ago

I am fascinated how the black market operates. With law enforcement probing every corner, going undercover, I can't imagine myself getting involved in a blackmarket at all. Well, I guess there is always the risk which says high risk yields high return.

dobbsbob 13y ago
Russia and CIS countries don't care about US fraud so won't allow citizens to be extradited. FBI/Secret Service prob know who they are and will just wait until they go on vacation somewhere and kidnap them like they usually do.
- bananacurve 13y ago
  >kidnap them like they usually do Although that would be impressive, I'm sure you know you are full of shit, but other people don't.
  - dobbsbob 13y ago
    Derp dey derp http://rt.com/news/extradite-russian-national-panin-901/ http://rt.com/news/extradite-russian-national-panin-901/ Also Maksim Yastremsky (sp?) who the SS had Turkey work over for his FDE key because when they broke into his hotel room in Dubai couldn't extract info. That was from the 2007 big TJmax carding heist.
    - AnotherDesigner 13y ago
      I'm confused, are you implying it's not okay for these criminals to be brought to justice, in accordance with various international laws, when their parent state acts belligerent and refuses to cooperate? These people hurt others for a living. They deserve punishment.
      - dobbsbob 13y ago
        So does the Pentagon but you never see them punished for blowing up a wedding. US does not act within international law if they did CIS/Russia wouldn't be complaining about these kidnappings

x0054 13y ago

This is a fascinating bit of research. Has any one posted yet information on how the actual card info was stollen? I read somewhere that the point of sale units were infected, but with no evidence to back that claim up.

wallflower 13y ago
Not the details of how it was done - but Bob Cringely has an interesting bit of conjecture on how the attack might have been introduced. It is a bit controversial because it hypothesizes that it was a lack of proper change control processes and possible outsourcing. http://www.cringely.com/2013/12/20/thoughts-grinch-stole-targets-christmas/ http://www.cringely.com/2013/12/20/thoughts-grinch-stole-tar...
- MichaelGG 13y ago
  That article is pretty worthless. First, he says "clearly the terminals had access to the Internet", and that if they used a private network, it'd not have been a problem. That's just wrong. Let's assume the POS terminals connected via IPSec over a frame relay linkup to several datacenters. A compromise in the processing center could cause an issue. Or, you could attack the POSes and have them record data to some internal site which you can access from another point in the intranet. Second, his only actual argument is: "Someone probably made an out of process change to Target’s POS system and nobody noticed." Sure, maybe. Or maybe someone subverted some other security system first. Who knows. Useless conjecture is just that. Then he goes on about how the NSA should be fixing these issues. Okie dokie. This is the same guy that doesn't understand how search engines work, and asked Eric Schmidt to manually fix his sister's website ranking in Google. I wouldn't take him as a useful source.
pyre 13y ago
I (half-)heard on the radio a couple of days ago something about the infection being at (or getting into) a processing center for Target, which was why so much was able to be taken. Sorry I don't have more info, I only caught the tail-end of what they were saying (and I haven't looked it up elsewhere).
13y ago

falcolas 13y ago

So, granted the perpetrator can easily be considered to be a scumbag, but is doxxing him really the best way to address this situation? What if this guy ends up lynched by a vindictive mob? What if this information is wrong?

pyre 13y ago
If he gets lynched, then it becomes news, and generates more pageviews. It's good for business. /s
- chronic25 13y ago
  10/10 would read again

ghoul2 13y ago

A lot of value of stolen credit cards comes from the reluctance of businesses and law enforcement to go after the users of such stolen cards, as the transactions are "small" - sub-1000$. Last year, I had four fraudulent transactions appear on my card. I am a very cautious user - Linux on the desktop, seperate user and browser profile for e-shopping etc. This was the first time it happened in over 15 years of extensive online card-use. Two of the transactions were with Netflix to register new streaming accounts. I called up Netflix, and within a couple minutes had a block placed on my card and both the accounts deleted with refunds to my card. The other two transactions were on frys.com. One was for a laptop and the other, much higher value, for a smartphone. Shockingly enough, while one transaction got security flagged and did not go thru, the laptop one cleared and the laptop had been shipped out before I contacted frys. Frys rep told me on the phone that the information submitted was very clearly and obviously phony - the email address was a string of random letters @gmail.com, name etc everything was fake. Even with the credit card info, the only piece of correct info was the credit card number. No CVV was submitted, no correct billing address, not even the name on the card was correct. Heck, as my credit card is NOT US based, even the country of the card was not correct. Yet Frys shipped it. I tried to get more information about the fraud but frys refused: they told me point blank, that they will not give me information, they will not initiate a police case, and they will not refund my money even though they were clearly at fault for having the transaction to go thru. I, not being based in the US, had few options. I filed an online police report with San Jose police, where Frys is based. I also filed an online report with the FBI online fraud division. Both of them assumed I was filing these reports for insurance/reporting purposes, but told me outright that no investigation would take place. Later, when my bank provided me with more info about the fraud I found out that frys actually challenged my chargeback and provided the transactions details to my bank. As expected they had no case, but I found out from the details that the laptop had been shipped to an address in Abilene, TX. I immediately registered an online report with the Abilene PD as well. None of the authorities were interested in following up. Considering how trivial it would have been to atleast checkup on the address, this seems like a bad lapse. I believe it creates a moral hazard: In the end, frys was the one that was out a few hundred dollars, and they refuse to prosecute. Police does not act on my complaint. Once it becomes known that a company has such lax policies, its open season.

13y ago

ginko 13y ago

Is it just me or is anyone else surprised that the first screenshot contains a (working) .su URL? .su was the TLD of the Soviet Union.

alcari 13y ago
Russia still controls the .su tld and allows registering new domains under it.

seivan 13y ago

I tend to create temporary e-cards for online purchases outside of subscriptions...

tzs 13y ago

Several years ago I received an email offering to sell me 100k stolen credit cards, and it included a sample of 12k cards. They had card number, issuing bank, customer name, expiration date, customer address, and I think phone number. I don't remember if they had the CSC or not. Some of these were from banks that would let you try to login given a card number and password, and told you on failure if you got the card number wrong or the password wrong, so I was able to do a check using that on some of the cards and found they were legit card numbers for accounts at those banks. This was on a Friday late afternoon Pacific time. I called the FBI to see if they were interested. They were not, and suggested that the Secret Service might be more appropriate. The Secret Service was also not interested. I then tried the credit card associations, and most of them told me that this would be an issue for their security department and suggested that I call back Monday morning as the security department had gone home for the weekend. One did give me the email I could forward the mail to. I had thought someone would be interested in this, at least enough to want to look at the card numbers I had to determine if they came from a known breach or were from something new.

MichaelGG 13y ago
Is this due to the CC processors fraud detection? They just figure it's the cost of business and most of the time, the merchant ends up footing the bill, right? Is it possible the CC companies are worried that if the government steps in, it reduces their role in anti-fraud and helps their competitors?