How the Credit Card Thief Ring Worked

The intruders whom the U.S. Department of Justice alleges stole tens of millions of credit and debit card numbers were bold, global, skilled and making millions of dollars, according to details in charging documents.

And despite all the focus on security since Sept. 11, the people alleged to be behind this network had little difficulty taking data from some nine businesses, all major retailers. They accomplished this by exploiting vulnerabilities in networks, servers and databases, making the information they gleaned available worldwide to the underground economy that buys and sells such data.

All of this was detailed by the Justice Department, which is charging 11 people in what is certainly one of the largest and most organized credit card theft operations ever. It extends back to 2003 and included nationals from a number of countries -- a true world-is-flat operation.

The U.S. alleges that the group decrypted PIN numbers, made new cards, and got cash from ATMs. They sold credit-card data on Web sites that specialize in trading that information. And they operated globally, using offshore banks and other methods to turn stolen data into cash. ICQ instant messaging and e-mail kept everyone in touch.

Millions of dollars were involved, and the charging documents outline proceeds in seven-digits amounts such as $3.8 million, $4.9 million, $1.9 million -- to list but a few -- that were transferred.

There was so much cash involved that among the things federal authorities seized from Albert Gonzalez of Miami, whom the U.S. alleges played a key role in the crime ring, was a currency counting machine. Gonzalez was captured in May; police also confiscated a Glock handgun and nearly $25,000 in cash from him at that time.

The retailers known to have been targeted are BJ's Wholesale Club, TJX, DSW Shoe Warehouse, OfficeMax, Barnes & Noble, Boston Market, Sports Authority and Forever 21.

One means of access of the retailers' networks was through a practice dubbed wardriving -- driving around in a car with a Wi-Fi-enabled laptop computer seeking access.

The first details of the methods used in this extensive operation surfaced in May. In an indictment concerning the theft of credit and debit card data from Dave & Buster's Inc., a Dallas-based restaurant chain, the U.S. analyzed the software used to steal the credit card data. That government indictment gives the software designer a nod as having created an effective tool.

The feds asked the Computer Emergency Response Teams Coordinating Center (CERT) to give an opinion of the software they found. CERT told the U.S. investigators that the "core sniffer program" is "efficient, well designed, and uses some algorithms and data structures that reflect college-level knowledge of computer programming skills..."

The thieves were tenacious, too. When an effort in to break into the restaurant's point of server sales in Arundel, Md., failed, the intruders went straight to the restaurant chain's corporate network in Dallas, and from there installed packet sniffers at some of the store's 49 restaurants, including one in Islandia, NY. From that store alone, more than data from more than 5,000 credit cards was obtained. Of those cards, 675 were used to make unauthorized purchases at various retail and online stores, running up losses of $600,000.

Gonzalez was named in the Dave & Buster's case. Others alleged to be involved in the crime ring include Aleksandr "Jonny Hell" Suvorov, of Sillamae, Estonia; Maksym "Maksik" Yastremskiy, of Kharkov, Ukraine; and Hung-Ming Chiu and Zhi Wang, both of the People's Republic of China.

This story, "How the Credit Card Thief Ring Worked" was originally published by Computerworld.

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed.
Shop Tech Products at Amazon