Attacks/Breaches
6/12/2012
01:10 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Feds Bust Credit Card Fraud Ring

A Dutch man, together with Maryland accomplice, is accused of running a site for buying and selling credit card data.

A Dutch man accused of running an underground website devoted to the buying and selling of debit and credit card data appeared in a Seattle federal courtroom Monday, where he plead not guilty to a 14-count indictment accusing him of crimes such as access device fraud, bank fraud, and aggravated identity theft.

The Department of Justice said that it had coordinated the arrest of David Benjamin Schrooten (a.k.a "Fortezza"), 21, in Romania this past March, before he was escorted back to the United States by agents from the U.S. Marshals Service, arriving Saturday in Seattle.

"This defendant has wrought havoc on victims and financial institutions around the world," said U.S. attorney Jenny A. Durkan, who chairs the Attorney General's advisory committee on cybercrime and intellectual property enforcement, at a news conference. "This indictment alleges that in just one transaction he trafficked in as many as 44,000 stolen credit card numbers resulting in millions of dollars in losses to financial institutions."

Authorities said the 44,000 credit card numbers stemmed from just one sale.

[ Is your database at risk? Read MySQL Database Flaw Leaves Passwords Vulnerable. ]

Authorities said they'd also arrested Maryland-based Christopher A. Schroebel, 21, on related charges--including bank fraud--in November 2011. In May, Schroebel plead guilty to the charges, and he's due to be sentenced in August.

Authorities have accused Schrooten and Schroebel of marketing stolen credit card numbers via Internet "carding" sites. They've also accused Schroebel of hacking into two Seattle-area businesses' networks, and stealing credit card data by installing malware that copied data from point-of-sale systems onto a server he controlled in Kansas.

According to court documents, "Schroebel stole at least 4,800 credit card numbers ... [and] conspired and worked with Schrooten to build 'carding websites,' in order to make the stolen credit card numbers available to criminals for fraud." Some of the stolen information relating to people's personal bank accounts was then used to commit bank fraud, authorities said.

The Seattle Police Department (SPD) said it began investigating the case after a business in Magnolia, Wash., reported that its customers had begun experiencing credit card fraud that seemed to have originated with the restaurant.

In a Monday news conference, the restaurant's owner, Corino Bonjrada, said some of his customers saw charges of $70 or $80, just minutes after using their credit card at his restaurant, reported CBS News.

"SPD detectives on loan to the Electronic Crimes Task Force quickly matched this case with other patterns and connected the dots to an international criminal enterprise," said assistant Seattle police chief Jim Pugel. "Solving this case would not have been possible without the assistance and cooperation of our partners in the Secret Service and the Romanian National Police."

Security information and event monitoring technology has been available for years, but the information can be hard to mine. In our SIEM Success report, we provide a step-by-step guide to make the most of your SIEM system. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-5704
Published: 2014-04-15
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

CVE-2013-5705
Published: 2014-04-15
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.

CVE-2014-0341
Published: 2014-04-15
Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to ob...

CVE-2014-0342
Published: 2014-04-15
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.

CVE-2014-0348
Published: 2014-04-15
The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding...

Best of the Web