Attacks/Breaches
6/12/2012
01:10 PM
Connect Directly
RSS
E-Mail
50%
50%

Feds Bust Credit Card Fraud Ring

A Dutch man, together with Maryland accomplice, is accused of running a site for buying and selling credit card data.

A Dutch man accused of running an underground website devoted to the buying and selling of debit and credit card data appeared in a Seattle federal courtroom Monday, where he plead not guilty to a 14-count indictment accusing him of crimes such as access device fraud, bank fraud, and aggravated identity theft.

The Department of Justice said that it had coordinated the arrest of David Benjamin Schrooten (a.k.a "Fortezza"), 21, in Romania this past March, before he was escorted back to the United States by agents from the U.S. Marshals Service, arriving Saturday in Seattle.

"This defendant has wrought havoc on victims and financial institutions around the world," said U.S. attorney Jenny A. Durkan, who chairs the Attorney General's advisory committee on cybercrime and intellectual property enforcement, at a news conference. "This indictment alleges that in just one transaction he trafficked in as many as 44,000 stolen credit card numbers resulting in millions of dollars in losses to financial institutions."

Authorities said the 44,000 credit card numbers stemmed from just one sale.

[ Is your database at risk? Read MySQL Database Flaw Leaves Passwords Vulnerable. ]

Authorities said they'd also arrested Maryland-based Christopher A. Schroebel, 21, on related charges--including bank fraud--in November 2011. In May, Schroebel plead guilty to the charges, and he's due to be sentenced in August.

Authorities have accused Schrooten and Schroebel of marketing stolen credit card numbers via Internet "carding" sites. They've also accused Schroebel of hacking into two Seattle-area businesses' networks, and stealing credit card data by installing malware that copied data from point-of-sale systems onto a server he controlled in Kansas.

According to court documents, "Schroebel stole at least 4,800 credit card numbers ... [and] conspired and worked with Schrooten to build 'carding websites,' in order to make the stolen credit card numbers available to criminals for fraud." Some of the stolen information relating to people's personal bank accounts was then used to commit bank fraud, authorities said.

The Seattle Police Department (SPD) said it began investigating the case after a business in Magnolia, Wash., reported that its customers had begun experiencing credit card fraud that seemed to have originated with the restaurant.

In a Monday news conference, the restaurant's owner, Corino Bonjrada, said some of his customers saw charges of $70 or $80, just minutes after using their credit card at his restaurant, reported CBS News.

"SPD detectives on loan to the Electronic Crimes Task Force quickly matched this case with other patterns and connected the dots to an international criminal enterprise," said assistant Seattle police chief Jim Pugel. "Solving this case would not have been possible without the assistance and cooperation of our partners in the Secret Service and the Romanian National Police."

Security information and event monitoring technology has been available for years, but the information can be hard to mine. In our SIEM Success report, we provide a step-by-step guide to make the most of your SIEM system. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5142
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

CVE-2010-5302
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.

CVE-2010-5303
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to $errorString.

CVE-2014-0965
Published: 2014-08-21
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.

CVE-2014-3022
Published: 2014-08-21
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.