FBI fights back against cybercrime
Date: August 25, 2011Source: Guardian.co.uk
An attractive brunette in a business suit is making her online pitch. "Are you tired of searching for legit CVV shops?" her animated form asks from the corner of the website. "Search no more," she promises. This site has "handpicked cards" with "high balances". "What are you waiting for? Register now."
It looks like a legitimate business website, one for small business financing perhaps. But I'm being shown this site — and asked not to identify it — by FBI special agent Keith Mularski in the offices of the National Cyber-Forensics &Training Alliance, a Pittsburgh-based alliance between international law enforcement agencies, business and academia that has been charged with tackling the growing menace of cybercrime. This is a site at the cutting edge of crime.
CVV stands for card verification value. This site, and its equally professional rivals, are selling stolen credit card information to criminals who snap them up like songs on iTunes. A dollar buys enough information to use someone else's card online, $30 buys a "dump," all the information you need to copy a card and set off on your own real-world shopping spree with somebody else's plastic.
There are millions of stolen accounts available, hacked from banks and online sellers, or swiped at cash machines. The FBI recently reclaimed 1.5m numbers from one seller alone. You can sort by type, MasterCard, Visa, or American Express, by geography, or just stick to business cards for their higher balances. There's no need to fear getting ripped off. Criminals peer-review each other's sites. It's eBay for crooks.
Mularski knows a thing or two about cybercrime. For two years he ran one of the biggest underworld crime sites in the world. Using the pseudonym Master Splynter (a nod to the cartoon Teenage Mutant Ninja Turtles) Mularski masqueraded as a spammer, winning the confidence of online crooks and eventually taking over as host of Dark Market, at the time the largest online forum for cybercriminals. The sting was a big victory for the US authorities, which, along with other governments, have struggled to keep up with the rapidly spreading threat.
Police officers from the UK, Germany, Netherlands, Australia and other countries work alongside the FBI at the NCFTA. The organisation also has about 500 business partners, from the big banks to technology companies and links with academics at local universities Carnegie Mellon and Pittsburgh.
The scale of the problem they are tackling is dizzying. According to a recent study by the British government, cybercrime is endemic and costs UK businesses an estimated £27bn a year. The criminals who buy this information operate a vast, international enterprise that employs teams of "mules" to buy goods either in person or online and yet more mules to launder their cash. They pay each other via digital currencies. "Would you take a credit card if you were one of these guys?" asks Mularski. These are multimillion-dollar businesses with serious costs. "This is serious money," says Mularski.
Serious skills
And it is serious criminals who are doing it. Mularski says he hates the term "hacker". "It's so generic," he says. "Traditionally we have thought of this cybercriminal as a geek. When I first started in cybercrime, the impression I got was [of] the movie War Games, Matthew Broderick sitting in his parents' basement. That's not the case any more. These are serious businessmen with serious skills."
One man arrested as part of a recent FBI investigation had contracts with a factory in China to mass produce fake credit card readers that could steal people's details. There's violence. Rivals have been kidnapped and tortured, and one spammer tried to take out a hit on a witness. "Very traditional organised crime is moving into the cyber realm," Mularski says.
Traditional organised crime activities such as racketeering or prostitution are not going away, he says, but the new generation of criminals is as excited about online growth as their legitimate business rivals. But there are major differences. "This isn't the Sopranos, or gangs," he says. "You don't have the same physical interaction. Here you do your transactions with the push of button, click of a mouse."
Internet crime also attracts people who would never get involved in a bank robbery. "When you are behind a keyboard, you're anonymous, you have more bravado. You need a lot of chutzpah to go into a bank and rob it. You do things online that you may not do in ordinary life. People don't start out thinking they will be a cybercriminal. They start out exploring. And before you know it, the line is crossed from curiosity to crime," says Mularski.
Mularski's high profile makes him a target for hackers. His office has also been working on tackling Anonymous, the hacker collective that has humiliated US government departments and big business on numerous occasions. He won't comment on them except to say: "Hacking into a company, whether it's to put information on the web for everyone to see or if you're going to make money, is still hacking, it's still a crime."
So does he feel vulnerable? "I was worried for a bit, I'll be honest," he says knocking on wood. "I'm very careful now. But the best protection of all is to turn your computer off."
Add comment
Email to a Friend
