4 ms·

How is http://rescator.cc/ http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in R

How is http://rescator.cc/ http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps, and proactively blacklisted cards before the issuing banks notice and decline.

jacquesm 12y ago
> Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards. Wouldn't purchasing them create just one more incentive? Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).
- deleted 12y ago
  [deleted]
- diafygi 12y ago
  > If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers. Source: http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt Video: https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s
  - ptwiggens 12y ago
    I think that the intelligence agencies would rather have the vulnerabilities for their own use and roll the dice on being on the receiving end rather than buy up everything and close it, making it so they can't use it either.
clarkm 12y ago
Well the FAQ on the homepage says "Do NOT contact us about Bitcoin transfer that has status of Unconfirmed Transaction on Blockchain.info" so I'm guessing they don't use PayPal.
MichaelApproved 12y ago
In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge. Now, these charges are clearly fraudulent. Without going into details, we can 100% detect the fraudulent transactions from real ones. I've suggested to Stripe that this could be a honey-pot setup to identify stolen cards but they've told me that there card processing doesn't have that type of infrastructure. Even if I know a credit card number has been compromised, there is no way to alert the card holder. It's a shame really. It's not the fault of Stripe that we can't alert the card holder but it's important to know that there is no mechanism to protect card holders, even if you know their card has been compromised.
- hayksaakian 12y ago
  Could you do a frontend validation? At the point of accepting a card, before it is tokenized?
  - jacquesm 12y ago
    What do you mean with 'tokenized'?
    - ceejayoz 12y ago
      Stripe turns a card number into a token, which you can store without needing to worry about PCI compliance. That token can be used with Stripe to use the card from their secure store.
  - MichaelApproved 12y ago
    Yes, I just need time to write the code. It's quicker to refund the money right now. I should have some time to write the code in the next few months.
- jacquesm 12y ago
abrkn 12y ago
Why do they use ICQ?
- listic 12y ago
  You mean, while the rest of the world have moved on to something else? It is popular in Russia. For some reason, it became popular way back then and that's what nearly everyone uses ever since. Why did the rest of the world switch?
  - TheCraiggers 12y ago
    Probably because the other services let you have a handle easier to remember than "5767576". Although the fact I still remember mine, more than a decade after I've last used it, discredits my claim somewhat.

jacquesm 12y ago

> Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards. Wouldn't purchasing them create just one more incentive? Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).

deleted 12y ago
[deleted]
diafygi 12y ago
> If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers. Source: http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt Video: https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s
- ptwiggens 12y ago
  I think that the intelligence agencies would rather have the vulnerabilities for their own use and roll the dice on being on the receiving end rather than buy up everything and close it, making it so they can't use it either.

clarkm 12y ago

Well the FAQ on the homepage says "Do NOT contact us about Bitcoin transfer that has status of Unconfirmed Transaction on Blockchain.info" so I'm guessing they don't use PayPal.

MichaelApproved 12y ago

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge. Now, these charges are clearly fraudulent. Without going into details, we can 100% detect the fraudulent transactions from real ones. I've suggested to Stripe that this could be a honey-pot setup to identify stolen cards but they've told me that there card processing doesn't have that type of infrastructure. Even if I know a credit card number has been compromised, there is no way to alert the card holder. It's a shame really. It's not the fault of Stripe that we can't alert the card holder but it's important to know that there is no mechanism to protect card holders, even if you know their card has been compromised.

hayksaakian 12y ago
Could you do a frontend validation? At the point of accepting a card, before it is tokenized?
- jacquesm 12y ago
  What do you mean with 'tokenized'?
  - ceejayoz 12y ago
    Stripe turns a card number into a token, which you can store without needing to worry about PCI compliance. That token can be used with Stripe to use the card from their secure store.
- MichaelApproved 12y ago
  Yes, I just need time to write the code. It's quicker to refund the money right now. I should have some time to write the code in the next few months.
jacquesm 12y ago

abrkn 12y ago

Why do they use ICQ?

listic 12y ago
You mean, while the rest of the world have moved on to something else? It is popular in Russia. For some reason, it became popular way back then and that's what nearly everyone uses ever since. Why did the rest of the world switch?
- TheCraiggers 12y ago
  Probably because the other services let you have a handle easier to remember than "5767576". Although the fact I still remember mine, more than a decade after I've last used it, discredits my claim somewhat.