Attacks/Breaches

2/16/2018
09:50 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Russian Hackers Sentenced in Heartland Payment Systems Breach Case

Two more men involved in the massive payment card theft from multiple major US corporations that began in 2007 now sent to federal prison.

It's been 10 years since the historic and widespread payment card data breaches at Heartland Payment Systems, NASDAQ, and other major US companies, and this week two members of the group of cybercriminals that pulled off those hacks were sentenced to federal prison.

Russian citizens Vladimir Drinkman, 37, of Syktyvkar and Moscow, Russia, and Dmitriy Smilianets, 34, of Moscow, both of whom had pleaded guilty in 2013, were part of a team working with the infamous Albert Gonzalez that stole data from Heartland, NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Dow Jones, Wet Seal, Commidea, Dexia, JetBlue, Euronet, Visa Jordan, Global Payment, Diners Singapore, and Ingenicard.

Drinkman was sentenced to 12 years in prison for conspiracy to commit unauthorized access of protected computers as well as one count of conspiracy to commit wire fraud. Smilianets, who had pleaded guilty to conspiracy to commit wire fraud that affected a financial institution, will face 51 months and 21 days in prison. Each also faces three years of supervised release at the end of their prison terms. They were arrested in the Netherlands in June of 2012; Smilianets was extradited to the US in September of that year, and Drinkman, in 2015.

The cyberattacks resulted in the theft of some 160 million credit card numbers and over $300 million in losses, and it's the largest such cybercrime case ever prosecuted in the US. Two other men who were indicted remain at large: Roman Kotov, 36, of Moscow, and Mikhail Rytikov, 30, of Odessa, Ukraine.

Drinkman and Kalinin hacked into the targeted companies' networks and infiltrated their systems, and then with the help of Kotov, Drinkman exfiltrated the payment card and other sensitive data, including user credentials and personal information. Rytikov provided anonymous Web hosting services to the hackers to hide their activity. Smilianets then sold the stolen information and paid the attackers their cut.

The attackers used encrypted channels to communicate with one another, and in some cases met one another in person in case law enforcement was able to trace their electronic communications. They remained under the radar within the victim organization networks by evading security software and disabling electronic logging of their activities.

In 2009, Drinkman and Kalinin were charged as "Hacker 1" and "Hacker 2" in an indictment charging Gonzalez – who is serving a 20-year prison sentence - for breaches at Heartland, Hannaford's, 7-Eleven, TJX, and others. Gonzalez conducted most of his hacking during 2005 to 2008 while he served as a paid undercover informant for the US Secret Service. He called his cybercrime enterprise "Operation Get Rich Or Die Tryin.'" 

Acting US Attorney William E. Fitzpatrick said of Drinkman and Kalinin after their sentencing: "These defendants operated at the highest levels of illegal hacking and trafficking of stolen identities. They used their sophisticated computer skills to infiltrate computer networks, steal information and sell it for a profit. Perpetrators of some of the largest data breaches in history, these defendants posed a real threat to our economy, privacy and national security, and cannot be tolerated."

The pair did not receive the maximum sentencing penalties for their crimes, however. Marcus Christian, a partner in the Washington, DC office of law firm Mayer Brown, notes that Drinkman and Smilianets each entered plea deals, which explains their relatively light prison terms and the seemingly long time between their arrests and ultimate sentencing. "You rarely see someone [with Drinkman's high Sentencing Guidelines score] getting 12 years," Christian says. A person with no criminal record and Drinkman's score can receive a sentence of 360 months, he explains, so it may be that the two cooperated with authorities in the investigation.

The attackers mostly exploited SQL injection vulnerabilities in the targeted companies' computers, where they then planted backdoor malware that provided them a foothold in the network, in some cases for more than a year. They employed "sniffer" programs to root out and pilfer the data, storing the stolen information in systems scattered around the globe.

What this data breach case demonstrates, says Christian, is that "persistence matters" for law enforcement. "It also takes a lot of resources for some of the better and more elusive cybercriminals," says Christian, who handles cybercrime and white-collar crime investigation cases. "The case was initiated in 2009, and [some of the events] took place several years before that. It was quite an undertaking."

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.