Jun 292012
 

Two Dozen Arrested in Global Credit Card Fraud Sting

 

Bloomberg Business Week

By Bob Van Voris & Patricia Hurtado

June 27, 2012

 

 

 

 

Two dozen people in 13 countries, including the U.S., Bosnia and Japan, were arrested in a global undercover sting operation targeting credit-card hackers said to have affected hundreds of thousands of customers.

The investigation involved computer breaches at dozens of companies and educational institutions, U.S. Attorney Preet Bharara said in a statement. Two New York suspects caught through an undercover website set up by the Federal Bureau of Investigation were charged yesterday in Manhattan federal court.

The allegations unsealed yesterday “chronicle a breathtaking spectrum of cyber schemes and scams,” Bharara said. “Individuals sold credit cards by the thousands and took the private information of untold numbers of people,” he said.

Bharara’s office said the arrests were part of the largest- ever international enforcement action targeting online trafficking in stolen cards and financial information. They are the result of a two-year undercover operation led by the FBI.

The two New York men, Joshua Hicks and Mir Islam, were presented in federal court yesterday. Hicks, 19, who is charged with access-device fraud, was released on a $20,000 bond. Islam, 18, who is charged with access-device fraud and attempted access-device fraud, was released on a $50,000 bond.

Their lawyers declined to comment on the charges after the hearing.

 

‘Carder Profit’

The FBI established the website, called “Carder Profit,” in June 2010 “as an online meeting place where the FBI could locate cybercriminals, investigate and identify them and disrupt their activities,” prosecutors said in a criminal complaint unsealed yesterday.

The undercover operation prevented potential losses of more than $205 million, according to the statement from Bharara’s office. The FBI notified credit card companies of more than 411,000 compromised credit and debit cards. The agency informed 47 businesses, government entities and schools that their computer networks had been breached, according to the statement.

Hicks, who used the online name OxideDox, passed 15 stolen credit card numbers to an undercover agent in exchange for a camera and $250, according to the complaint. Assistant U.S. Attorney Thomas Brown said in the hearing that Hicks admitted to additional computer crimes, including so-called SQL injection attacks, a technique to access customers’ financial data through a firm’s website, and infecting computers with malicious software.

 

Card Data

The government claims Islam, who used names including “JoshTheGod” and “Ijew,” trafficked in stolen credit card data and possessed information for more than 50,000 cards. He claimed to be a member of the hacking group UGNazi and a founder of Carders.Org, a forum for people who deal in stolen credit cards, according to the government.

In addition to Hicks and Islam, U.S. authorities arrested nine people, in California, Georgia, New Mexico, Florida, Arizona, Massachusetts and Wisconsin, Bharara’s office said in the statement. Six people were arrested in the U.K., two in Bosnia and one each in Bulgaria, Norway, Germany, Italy and Japan. Four defendants remain at large, according to prosecutors.

Authorities in the U.S. and other countries yesterday executed more than 30 search warrants and interviewed more than 30 subjects, according to the statement.

 

Undercover Website

The website set up by the FBI allowed users to discuss topics relating to “carding,” or stealing credit and debit card data and other financial information to get money, services and merchandise, according to the complaint against Hicks.

The FBI monitored discussions and recorded the Internet addresses of the users’ computers, according to the complaint. The site was taken offline in May, prosecutors said in the statement.

According to the complaint, Hicks on Feb. 22 agreed to trade stolen data from the credit cards for a digital single- lens reflex camera. A FBI agent sent the money electronically to a website user who acted as an escrow agent, according to the complaint.

The FBI agent then agreed to meet OxideDox in lower Manhattan on Feb. 28 and provide the camera, according to the complaint.

Later, the agent chatted online with OxideDox, asking him if he liked the camera, according to the complaint.

“Hey, a free camera is a free camera,” OxideDox replied, according to the complaint.

 

The case is U.S. v. Hicks, 12-mg-1639, U.S. District Court, Southern District of New York (Manhattan).

 

Direct Link:  http://www.businessweek.com/news/2012-06-26/u-dot-s-dot-said-to-make-arrests-in-global-bank-data-theft-operation

Mar 082012
 

LulzSec Arrests Hurt Hacker Groups, Anonymous Movement Hard To Kill

 

Huffington Post

By Peter Apps, Political Risk Correspondent

Posted: 03/ 8/2012


 

Anonymous Hackers

 

 

 
LONDON (Reuters) –

In turning one of its best-known hackers into an informant and breaking open the highest profile elements of the “Anonymous” movement, authorities have dealt a serious blow to a group they found a growing irritant.

But as the broader “Anonymous” label – complete with its iconic Guy Fawkes mask imagery – is used by ever more disparate causes worldwide, it may be all but impossible to shut it down for good.

U.S. authorities revealed on Wednesday that leading Anonymous hacker “Sabu” – real name Hector Xavier Monsegur, aged 28 – had been arrested last June in his apartment in a Manhattan housing complex.

According to a newly released court transcript, he agreed to cooperate with authorities in return for likely leniency – helping U.S. prosecutors bring charges against five more men, including two in Britain and two in Ireland. All had also been previously arrested.

“Sabu was seen as a leader,” said Mikko Hypponen, chief research officer of Finnish security firm f-secure. “Just yesterday people were looking up to him… it’s a very serious blow. It’s probably not going to be the end of Anonymous but it’s going to take a while for them to recover, particularly from the paranoia.”

All six were said to be senior members of LulzSec, an offshoot of Anonymous that took credit for a range of hacking attacks on government and private sector websites. Targets included the CIA, Britain’s Serious Organized Crime Agency, Japan’s Sony Corp and a host of others including in Ireland and Mexico.

Taking inspiration from the hacking and Internet community as well as popular culture – particularly the 2005 film “V for Vendetta” in which a masked hero fights a dystopian government – Anonymous emerged in the middle of the last decade.

Initially focused on fighting attempts at Internet regulation and blocking free illegal downloads, it has since taken on a range of other targets including Scientology and the global banking system. Governments have been a growing target, both Western and in more autocratic states such as China and Iran. Websites have been attacked and occasionally shut down.

But Anonymous – and LulzSec in particular – leapt to much greater prominence in late 2010 when they launched what they described as the “first cyber war” in retaliation for attempts to shut down the Wikileaks website.

They attacked websites such as MasterCard that tried to block payments to Wikileaks after apparent pressure from the US government following the release of thousands of diplomatic cables.

“NO HONOUR AMONG THIEVES”?

“This is probably the end of this particular group,” said Tim Hardy, a British activist and computer scientist who runs the blog “Beyond Clicktivism. ” But… part of the point of Anonymous is that it’s a group that anyone can say they are part of, whether they are attacking a website or wearing a mask outside the Church of Scientology.”

Those masks became an increasingly frequent sight on Western streets in 2011, increasingly adopted by more radical, libertarian and sometimes anarchist elements of European and U.S. protest groups.

They became a frequent sight at demonstrations such as “Occupy Wall Street” and its spin-offs elsewhere in the U.S. and Britain. They were also heavily used by the “indignados” anti-austerity protesters in Spain, where fancy dress shops ran out of stock and had to import them from abroad.

Such popular usage will likely continue, but the loss of some of the movement’s highest profile stars and technical experts will still hurt.

Web forums frequented by Anonymous were frothing with abuse and anger following the arrests on Tuesday. “Sabu” had been occasionally suspected of being a mole, but had continued to operate as an effective leader advising other hackers on the importance of maintaining anonymity and security.

“No honor among thieves,” said Tony Dyhouse, a computer security expert at UK defense firm QinetiQ who has long studied hackers. “Any further (Anonymous) actions are likely to be much more low-key. Fear is in the ranks. However, there will be many that see some of the casualties as martyrs and empty footprints to be filled.”

Computer security experts say the hackers of LulzSec appeared much more technically adept than had been usual for Anonymous, which has often relied on simple – if illegal – software that can be downloaded by any potential hacker regardless of their technical skills.

“FEATHER IN CAP FOR FEDS”

While many of its attacks – often direct denial of service (DDOS) attacks designed to overload websites – were relatively simple, LulzSec penetrated secure commercial systems to steal highly sensitive information.

These included credit card details of users of Sony’s latest PlayStation platform as well as client details and some 5 million e-mails from U.S. specialist geopolitical publisher and sometime private intelligence firm Stratfor. The Stratfor e-mails were then passed on to Wikileaks, which is now publishing them.

U.S. authorities said one of those arrested this week, Jeremy Hammond – a Chicago resident who styled himself “Anarchaos” – had been charged with the Stratfor hack. Another of those arrested, 19-year-old Donncha O’ Cearrbhail, was charged with another recent high profile success – the hacking of a conference call between the FBI and London detectives discussing action against hackers.

“Undoubtedly this is a big feather in the cap for the Feds,” said QinetiQ’s Dyhouse. “But the Scotland Yard/FBI leak shows how simple mistakes can have a huge impact on any operation. Interceptions can be so easy these days.”

Ultimately, Anonymous and LulzSec in particular may have been the victims of their own success and over ambition. Whatever the technical mistakes and personal weaknesses that led to their undoing, security experts say their fate was sealed once they became so high profile that authorities made them a priority.

The success of Anonymous in the last two years may also have itself driven greater emphasis on computer security and fuelled demands for regulation – the opposite of their intent.

Even for a global activist community infused with new energy and political significance in the aftermath of the financial crisis, Anonymous remains controversial and divisive.

While some members may be admired for their actions and beliefs – albeit often varied and extreme – others are seen as simply in it for the “lulz”, the plural of the Internet abbreviation LOL for “laugh out loud”.

“There are those who see them as banner carriers for the revolutionary left,” says Beyond Clicktivism’s Hardy. “But there are also those who see them just as consumerists who don’t want to pay (for)… music and videos.”

(Additional reporting by Georgina Prodhan)

(Reporting By Peter Apps)

(Replaces reference to “leniency” with “likely leniency” in paragraph 4, corrects spelling of suspect in paragraph 20 to Hammond from Hammonds)

 

Direct Link:  http://www.huffingtonpost.com/2012/03/08/lulzsec-arrests-anonymous_n_1331982.html

Feb 292012
 

Hackers publish private information about L.A. police officers

Los Angeles Times

By Andrew Blankstein 

Twitter.com/anblanx

February 24, 2012

http://latimesphoto.files.wordpress.com/2011/05/police-memorial01.jpg

 

Photo: LAPD officers outisde police headquarters.

Credit: Los Angeles Times

 

 

The FBI is probing an Internet breach in which hackers publicly posted private information belonging to more than 100 local law enforcement officers who are part of the Los Angeles County Police Canine Assn.

Tony Vairo, a San Fernando police officer, who is president of the group, told The Times that they were contacted by the FBI Tuesday morning informing them that information belonging to its members, who include the Los Angeles police and Los Angeles County Sheriff’s deputies, had been compromised.

“I’m appalled that our website was breached,” Vairo said. “It’s not right and we will pursue it [a case] on every level, state or federal.”

Vairo described the FBI probe into the hacking incident as being part of an ongoing criminal investigation. FBI spokeswoman Laura Eimiller would not comment on what, if any, involvement the agency had in the case.

The incident, first reported Tuesday by CNET.com, comes two months after personal information about more than two dozen members of the Los Angeles Police Department’s command staff was anonymously posted on an Internet site.

In that case, the hackers posted officers’ property records, campaign contributions, biographical information and, in a few cases, the names of family members, including children. But that information was gleaned from public records.

Authorities said the current intrusion is different because the information gleaned from the association’s website was not available to the public.

Marshall E. McClain, president of the Los Angeles Airport Peace Officer’s Assn., which has three members whose information was compromised, said his association has contacted the Los Angeles County District Attorney’s office to ask for a criminal investigation.

The postings were linked to from a publicly available Twitter account, where unnamed activists claimed responsibility for the information dump. The information was posted on a site that allows users to anonymously input data. This type of site has increasingly been used to post personal information of individuals who raise the ire of online activists. The practice is known as “doxing.”

 

ALSO:

Teen didn’t mention bullying in suicide notes, authorities say

Roosevelt High teacher accused of having sex with two students

Security probed after teens found having sex at O.C. Juvenile Hall

 

Direct Link: