Attacks/Breaches
6/6/2013
12:16 PM
50%
50%

Police Bust $200 Million Data Theft Ring

U.S., British and Vietnamese authorities accuse men of selling 1.1 million stolen credit cards via Gmail and Facebook accounts.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
One of the world's largest underground "carder" forums for reselling stolen credit card data has been shut down.

That announcement was made Wednesday by the FBI, together with police in Britain and Vietnam, who have been conducting a joint investigation into the "Mattfeuter" website. Authorities have accused the site of selling harvested personal information, including 1.1 million stolen credit cards, which were used to make at least $200 million in fraudulent credit card charges.

In the past week, Vietnamese police have arrested eight men as part of the investigation, which is ongoing. Five were charged with being part of the gang that ran Mattfeuter, while three were charged with using information they'd obtained on the forum for ongoing gambling. A local news report named one of the arrested men, Van Tien Tu, as being the boss of the operation.

[ It's getting harder for cybercriminals to launder money without leaving a trail. Read Liberty Reserve Fallout: How Will Cybercrime Move Money? ]

"Although we haven't yet heard of many cases with Vietnamese cyber crime yet, the improvements in Vietnamese law passed in 2009 made it a criminal offense to fraudulently obtain card data from overseas targets, as well as from victims in Vietnam," said Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, in a blog post.

In the United States, a related investigation has focused on Vietnam resident Duy Hai Truong, 23, who was arrested last week by Vietnamese police on related charges filed by British authorities. The Department of Justice, in a criminal complaint filed Wednesday in federal court, charged Truong with being one of the leaders of the massive conspiracy to commit bank fraud, which began in 2007 and specialized in stealing the data from online retailers. If convicted, Truong faces up to 30 years in jail and a fine of $1 million, or two times the gain derived from the crimes or loss suffered by victims, whichever is greater.

Britain's Serious Organized Crime Agency (SOCA) announced Wednesday that they'd arrested three men in London who they accused of being "significant forum users." Related arrests reportedly also took place in Germany and Italy.

"One of the world's major facilitation networks for online card fraud has been dismantled by this operation," said SOCA's Andy Archibald, who's the interim deputy director of Britain's national cyber crime unit, in a statement. "Those engaged in this type of crime should know that that they are neither anonymous nor beyond the reach of law enforcement agencies."

SOCA is continuing to target more "Mattfeuter.ru" forum members and share related intelligence with international law enforcement agencies and said further arrests of forum members are likely to occur.

How did the forum operate? According to the U.S. criminal complaint, which was sworn by FBI Special Agent Russell Ficara, the forum sold data relating to an individual's personal identifying information (PII), which was known as a "dump." Each dump would fetch between $1 and $300, depending on the victim's country and the completeness of the data, which might include name, address, credit card details and social security number. Payments for dumps were made via wire-transfer services such as Western Union, as well as via Liberty Reserve. Buyers either used dumps to make fraudulent credit card charges, or else resold the dumps to other carders.

Forum users could email their requests to the hackers who ran "Mattfeuter" and would need to use a wire-transfer service to send payment, then provide the related money transfer control number (MTCN) as proof of purchase before receiving the requested data.

But approximately 16,000 users instead registered with the "www.mattfeuter.biz" or "www.mattfeuter.com" websites -- which required creating a username and password -- and could then browse available credit card numbers and search based on regions and different credit card issuers. The site offered discounts for bulk purchases. After selecting their desired dumps, users headed to a checkout screen, where they entered their Liberty Reserve number to finalize the transaction, according to the criminal complaint.

Ficara said that he reviewed more than 1,100 bank accounts during the course of the investigation, and that Truong controlled email accounts that received many of the MTCNs used to pay for dumps. He said that the vast majority of these MTCNs were cashed in at a single Western Union location in Ho Chi Minh City, Vietnam, and that they exceeded $1.9 million.

According to the complaint, in a related case, an unnamed individual plead guilty to credit card fraud and began working with an unnamed law enforcement agency. As part of that cooperation, the person met with others who claimed to have access to stolen credit card numbers offered for sale via Mattfeuter, and communicated with the site using a Gmail account that was controlled by Truong. According to Ficara, Truong also used a Facebook account -- in his own name, and with a photograph of himself -- to post messages to dump purchasers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
zerses
50%
50%
zerses,
User Rank: Apprentice
6/10/2013 | 1:06:08 AM
re: Police Bust $200 Million Data Theft Ring
...And Americans can't see that this is or will be happening a LOT because of the malfeasance and lack of CARE in OUR government's employees?

Right.

Close your eyes and wish, see what it gets you.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-5084
Published: 2015-08-02
The Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite applications before 01.00.01.00 for Android do not properly store passwords, which allows physically approximate attackers to obtain sensitive information via unspecified vectors.

CVE-2015-5352
Published: 2015-08-02
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time ...

CVE-2015-5537
Published: 2015-08-02
The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.

CVE-2015-5600
Published: 2015-08-02
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumptio...

CVE-2015-1009
Published: 2015-07-31
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!