Attacks/Breaches

2/16/2018
09:50 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Russian Hackers Sentenced in Heartland Payment Systems Breach Case

Two more men involved in the massive payment card theft from multiple major US corporations that began in 2007 now sent to federal prison.

It's been 10 years since the historic and widespread payment card data breaches at Heartland Payment Systems, NASDAQ, and other major US companies, and this week two members of the group of cybercriminals that pulled off those hacks were sentenced to federal prison.

Russian citizens Vladimir Drinkman, 37, of Syktyvkar and Moscow, Russia, and Dmitriy Smilianets, 34, of Moscow, both of whom had pleaded guilty in 2013, were part of a team working with the infamous Albert Gonzalez that stole data from Heartland, NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Dow Jones, Wet Seal, Commidea, Dexia, JetBlue, Euronet, Visa Jordan, Global Payment, Diners Singapore, and Ingenicard.

Drinkman was sentenced to 12 years in prison for conspiracy to commit unauthorized access of protected computers as well as one count of conspiracy to commit wire fraud. Smilianets, who had pleaded guilty to conspiracy to commit wire fraud that affected a financial institution, will face 51 months and 21 days in prison. Each also faces three years of supervised release at the end of their prison terms. They were arrested in the Netherlands in June of 2012; Smilianets was extradited to the US in September of that year, and Drinkman, in 2015.

The cyberattacks resulted in the theft of some 160 million credit card numbers and over $300 million in losses, and it's the largest such cybercrime case ever prosecuted in the US. Two other men who were indicted remain at large: Roman Kotov, 36, of Moscow, and Mikhail Rytikov, 30, of Odessa, Ukraine.

Drinkman and Kalinin hacked into the targeted companies' networks and infiltrated their systems, and then with the help of Kotov, Drinkman exfiltrated the payment card and other sensitive data, including user credentials and personal information. Rytikov provided anonymous Web hosting services to the hackers to hide their activity. Smilianets then sold the stolen information and paid the attackers their cut.

The attackers used encrypted channels to communicate with one another, and in some cases met one another in person in case law enforcement was able to trace their electronic communications. They remained under the radar within the victim organization networks by evading security software and disabling electronic logging of their activities.

In 2009, Drinkman and Kalinin were charged as "Hacker 1" and "Hacker 2" in an indictment charging Gonzalez – who is serving a 20-year prison sentence - for breaches at Heartland, Hannaford's, 7-Eleven, TJX, and others. Gonzalez conducted most of his hacking during 2005 to 2008 while he served as a paid undercover informant for the US Secret Service. He called his cybercrime enterprise "Operation Get Rich Or Die Tryin.'" 

Acting US Attorney William E. Fitzpatrick said of Drinkman and Kalinin after their sentencing: "These defendants operated at the highest levels of illegal hacking and trafficking of stolen identities. They used their sophisticated computer skills to infiltrate computer networks, steal information and sell it for a profit. Perpetrators of some of the largest data breaches in history, these defendants posed a real threat to our economy, privacy and national security, and cannot be tolerated."

The pair did not receive the maximum sentencing penalties for their crimes, however. Marcus Christian, a partner in the Washington, DC office of law firm Mayer Brown, notes that Drinkman and Smilianets each entered plea deals, which explains their relatively light prison terms and the seemingly long time between their arrests and ultimate sentencing. "You rarely see someone [with Drinkman's high Sentencing Guidelines score] getting 12 years," Christian says. A person with no criminal record and Drinkman's score can receive a sentence of 360 months, he explains, so it may be that the two cooperated with authorities in the investigation.

The attackers mostly exploited SQL injection vulnerabilities in the targeted companies' computers, where they then planted backdoor malware that provided them a foothold in the network, in some cases for more than a year. They employed "sniffer" programs to root out and pilfer the data, storing the stolen information in systems scattered around the globe.

What this data breach case demonstrates, says Christian, is that "persistence matters" for law enforcement. "It also takes a lot of resources for some of the better and more elusive cybercriminals," says Christian, who handles cybercrime and white-collar crime investigation cases. "The case was initiated in 2009, and [some of the events] took place several years before that. It was quite an undertaking."

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now about that mortgage refinance offer from Wells Fargo .....
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-4975
PUBLISHED: 2018-08-14
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (A...
CVE-2018-6970
PUBLISHED: 2018-08-13
VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privil...
CVE-2018-14781
PUBLISHED: 2018-08-13
Medtronic MMT 508 MiniMed insulin pump, 522 / MMT - 722 Paradigm REAL-TIME, 523 / MMT - 723 Paradigm Revel, 523K / MMT - 723K Paradigm Revel, and 551 / MMT - 751 MiniMed 530G The models identified above, when paired with a remote controller and having the "easy bolus" and "remote bolu...
CVE-2018-15123
PUBLISHED: 2018-08-13
Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home.
CVE-2018-15124
PUBLISHED: 2018-08-13
Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwords and get root access on the device.