The bank-card hackers and their army of cashers

*Twenty-something guys from Tallin, Petersburg and Chisinau. I wonder if they ever met physically or even knew each other’s real names.

http://www.wired.com/threatlevel/2009/11/rbs-worldpay/

(…)

“According to the indictment, Tsurikov conducted reconnaissance of the RBS network after Covelin provided him with information about vulnerabilities in the system. Pleshchuk and Covelin then worked on exploiting the vulnerabilities to obtain access on November ...

4. Pleschuk allegedly developed the method for reverse-engineering the encrypted PINs.

“Once the hackers raised the account limits, they provided an army of cashers with 44 cards embedded with the account details for a coordinated, simultaneous attack on ATMs around the world. On November 8, the cashers were instructed to begin siphoning money, and they hit more than 2,000 ATMs in less than 12 hours, netting about $9.5 million. Three Estonian defendants charged for their role in cashing — Ronald Tso, Evelin Tsoi and Mihhail Jevgenov — allegedly were responsible for withdrawing about $289,000 from ATMs in Tallinn, Estonia.

“The cashers kept 30 to 50 percent of the loot before transmitting the remainder back to the hackers in Eastern Europe through Western Union and Web Money, a Russia-based digital currency service. The hackers, still in RBS’s network, were able to observe the withdrawals of funds from ATMs as they occurred in real time in order to monitor the amounts being taken by cashers and lock the accounts to prevent further withdrawals. (((I had really wondered how on earth they managed that.)))

“Once the mission was completed, the hackers tried to erase their tracks on the RBS network.

“Tsurikov was arrested earlier this year in Estonia and is being held there pending extradition to the United States. The Justice Department will not comment at this time on the status of Pleshchuk and Covelin, a spokesman told Threat Level.

“Tsurikov, Pleshchuk, Covelin and “Hacker 3″ face a maximum sentence of up to 20 years in prison for conspiracy to commit wire fraud and other wire-fraud counts, and up to five years in prison for conspiracy to commit computer fraud as well as up to five or 10 years for each count of computer fraud. They also face a two-year mandatory minimum sentence for aggravated identity theft and fines up to $3.5 million dollars….”

Hide