Attacks/Breaches
6/6/2013
12:16 PM
50%
50%

Police Bust $200 Million Data Theft Ring

U.S., British and Vietnamese authorities accuse men of selling 1.1 million stolen credit cards via Gmail and Facebook accounts.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
One of the world's largest underground "carder" forums for reselling stolen credit card data has been shut down.

That announcement was made Wednesday by the FBI, together with police in Britain and Vietnam, who have been conducting a joint investigation into the "Mattfeuter" website. Authorities have accused the site of selling harvested personal information, including 1.1 million stolen credit cards, which were used to make at least $200 million in fraudulent credit card charges.

In the past week, Vietnamese police have arrested eight men as part of the investigation, which is ongoing. Five were charged with being part of the gang that ran Mattfeuter, while three were charged with using information they'd obtained on the forum for ongoing gambling. A local news report named one of the arrested men, Van Tien Tu, as being the boss of the operation.

[ It's getting harder for cybercriminals to launder money without leaving a trail. Read Liberty Reserve Fallout: How Will Cybercrime Move Money? ]

"Although we haven't yet heard of many cases with Vietnamese cyber crime yet, the improvements in Vietnamese law passed in 2009 made it a criminal offense to fraudulently obtain card data from overseas targets, as well as from victims in Vietnam," said Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, in a blog post.

In the United States, a related investigation has focused on Vietnam resident Duy Hai Truong, 23, who was arrested last week by Vietnamese police on related charges filed by British authorities. The Department of Justice, in a criminal complaint filed Wednesday in federal court, charged Truong with being one of the leaders of the massive conspiracy to commit bank fraud, which began in 2007 and specialized in stealing the data from online retailers. If convicted, Truong faces up to 30 years in jail and a fine of $1 million, or two times the gain derived from the crimes or loss suffered by victims, whichever is greater.

Britain's Serious Organized Crime Agency (SOCA) announced Wednesday that they'd arrested three men in London who they accused of being "significant forum users." Related arrests reportedly also took place in Germany and Italy.

"One of the world's major facilitation networks for online card fraud has been dismantled by this operation," said SOCA's Andy Archibald, who's the interim deputy director of Britain's national cyber crime unit, in a statement. "Those engaged in this type of crime should know that that they are neither anonymous nor beyond the reach of law enforcement agencies."

SOCA is continuing to target more "Mattfeuter.ru" forum members and share related intelligence with international law enforcement agencies and said further arrests of forum members are likely to occur.

How did the forum operate? According to the U.S. criminal complaint, which was sworn by FBI Special Agent Russell Ficara, the forum sold data relating to an individual's personal identifying information (PII), which was known as a "dump." Each dump would fetch between $1 and $300, depending on the victim's country and the completeness of the data, which might include name, address, credit card details and social security number. Payments for dumps were made via wire-transfer services such as Western Union, as well as via Liberty Reserve. Buyers either used dumps to make fraudulent credit card charges, or else resold the dumps to other carders.

Forum users could email their requests to the hackers who ran "Mattfeuter" and would need to use a wire-transfer service to send payment, then provide the related money transfer control number (MTCN) as proof of purchase before receiving the requested data.

But approximately 16,000 users instead registered with the "www.mattfeuter.biz" or "www.mattfeuter.com" websites -- which required creating a username and password -- and could then browse available credit card numbers and search based on regions and different credit card issuers. The site offered discounts for bulk purchases. After selecting their desired dumps, users headed to a checkout screen, where they entered their Liberty Reserve number to finalize the transaction, according to the criminal complaint.

Ficara said that he reviewed more than 1,100 bank accounts during the course of the investigation, and that Truong controlled email accounts that received many of the MTCNs used to pay for dumps. He said that the vast majority of these MTCNs were cashed in at a single Western Union location in Ho Chi Minh City, Vietnam, and that they exceeded $1.9 million.

According to the complaint, in a related case, an unnamed individual plead guilty to credit card fraud and began working with an unnamed law enforcement agency. As part of that cooperation, the person met with others who claimed to have access to stolen credit card numbers offered for sale via Mattfeuter, and communicated with the site using a Gmail account that was controlled by Truong. According to Ficara, Truong also used a Facebook account -- in his own name, and with a photograph of himself -- to post messages to dump purchasers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
zerses
50%
50%
zerses,
User Rank: Apprentice
6/10/2013 | 1:06:08 AM
re: Police Bust $200 Million Data Theft Ring
...And Americans can't see that this is or will be happening a LOT because of the malfeasance and lack of CARE in OUR government's employees?

Right.

Close your eyes and wish, see what it gets you.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?