Alleged business operation attacked security's weak link: retailers
The criminal network identified in federal indictments this week as having stolen tens of millions of credit card numbers used people with skills in technology, finance and black markets -- some whom were notably polite, attentive and productive.
In one chain of ICQ messages excerpted by federal authorities in the indictment, there is back-and-forth about the software used to get credit card data from the Dave & Buster's Inc. restaurant chain, which the U.S. Department of Justice says was one of nine retailers hit. The hackers gave the chain a positive review: "A very nice place, they have many locations," wrote Albert Gonzalez, of Miami, in an instant message.
But little time was wasted on chitchat: Tech support was needed to modify sniffer software for an intrusion. According to the DOJ, Maksym "Maksik" Yastremskiy, of Kharkov, Ukraine, in a message to Gonzalez, briefly discussed the need and finished by asking: "... could you, please recompile it :-) Thanks."
Gonzalez's alleged response: "I can compile right now." There was no tech support whining in these messages -- just professional interest, and perhaps some pride, in how the software worked: "Did your guy use or say anything about my sniffer for dandb [i.e., Dave & Buster's]?"
"My guy told me to tell you big thanks and etc. ;-)" was Yastremskiy's reply, the DOJ claimed. Some 5,000 credit card numbers were allegedly taken from the chain by the hacker group.
For some employees, praise is as important as money, and this group evidently had both, according to what's in the federal charging documents. They made millions until the feds closed their operations this year, according to the indictment.
"These guys collaborate," said Sam Curry, vice president of the identity access and assurance at RSA Security, a division of EMC Corp. "They even have [service-level agreements] and support numbers to reach other. They have specialized roles, sophisticated economics [and] worldwide reach."
It's the degree of specialization that's a tip-off as to how big these organizations are. It took focus and organization to allegedly attack nine major retailers, steal some 40 million credit and debit card numbers, decrypt PINs, withdraw cash and sell the numbers on black markets.
The main targets were retailers. The thieves parked their cars near retail outlets, searched for open networks and installed programs to capture the wanted data.
Retailers are particularly susceptible to theft because IT departments are kept lean, crucial technology improvements are deferred and people with the skills needed to configure systems aren't always on staff, said Paul Kocher, president and chief scientist of Cryptography Research Inc. in San Francisco.
Amit Sinha, vice president and chief technology officer at AirDefense Inc., a wireless security vendor in Alpharetta, Ga., said retail firms "have been lagging significantly," despite being a favorite target.
Retailers that lose data risk customer ill will, of course, but they also can face action by the Federal Trade Commission for letting it happen, said Richard Hackett, an adjunct professor at Boston University's School of Law.
DSW Inc. had its data stolen, allegedly by the same group of thieves, in 2005, prompting action against the shoe retailer by the FTC. In a settlement reached that same year, DSW agreed to security improvements and regular audits.
Along with Dave & Buster's and DSW, other retailers known to have been targeted include BJ's Wholesale Club, TJX, OfficeMax, Barnes & Noble, Boston Market, Sports Authority and Forever 21, according to the DOJ.
The FTC's view is that "it is unfair to consumers to take their information and place it in a system that is not reasonably secure from unauthorized access," said Hackett.
By Patrick Thibodeau
No comments:
Post a Comment