Credit card thieves ran a polite, professional help desk

The criminal network identified in the Justice Department indictments this week as having stole tens of millions of credit card numbers used people with skills in technology, finance and black markets -- some whom were notably polite, attentive and productive.

In one chain of ICQ messages excerpted by federal authorities in an indictment, there is back-and-forth about the software used to get credit card data from Dave and Buster's Inc. restaurant chain. The U.S. says it was one of nine retailers hit. The hackers gave the chain a positive review: "A very nice place, they have many locations," wrote Albert Gonzalez, of Miami in an instant message.

But little time was wasted on chitchat. Tech support was needed to modify sniffer software for an intrusion. Maksym "Maksik" Yastremskiy, of Kharkov, Ukraine, in a message to Gonzalez, briefly discussed the need and finished by asking: "...could you, please recompile it :-) Thanks."

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

The criminal network identified in the Justice Department indictments this week as having stole tens of millions of credit card numbers used people with skills in technology, finance and black markets -- some whom were notably polite, attentive and productive.

In one chain of ICQ messages excerpted by federal authorities in an indictment, there is back-and-forth about the software used to get credit card data from Dave and Buster's Inc. restaurant chain. The U.S. says it was one of nine retailers hit. The hackers gave the chain a positive review: "A very nice place, they have many locations," wrote Albert Gonzalez, of Miami in an instant message.

But little time was wasted on chitchat. Tech support was needed to modify sniffer software for an intrusion. Maksym "Maksik" Yastremskiy, of Kharkov, Ukraine, in a message to Gonzalez, briefly discussed the need and finished by asking: "...could you, please recompile it :-) Thanks."

Gonzalez's response: "I can compile right now." There was no tech support whining in these messages -- just professional interest, and perhaps some pride, in how the software worked: "Did your guy use or say anything about my sniffer for dandb [Dave and Buster's]?"

"My guy told me to tell you big thanks and etc ;-)" was Yastremskiy's reply. Some 5,000 credit card numbers were taken from the chain.

For some employees, praise is as important as money, and this group evidently had both, according to what's in the federal charging documents. They made millions until the feds closed their operations this year.

"These guys collaborate," said Sam Curry, vice president of the identity access and assurance at RSA Security, a division of EMC Corp. "They even have SLAs (service level agreements) and support numbers to reach other. They have specialized roles, sophisticated economics, [and] worldwide reach," he said.

It's the degree of specialization that's a tip-off as to how big these organizations are. It took focus and organization to attack nine major retailers, steal some 40 million credit and debit card numbers, decrypt PIN numbers, withdraw cash and sell the numbers on black markets.

The main targets were retailers. The thieves parked their cars near retail outlets, searched for open networks, and installed programs to capture the wanted data.

Retailers are particularly susceptible to theft because IT departments are kept lean, crucial technology improvements are deferred, and people with the skills needed to configure systems aren't always on staff, said Paul Kocher, president and chief scientist of Cryptography Research Inc. in San Francisco.

Amit Sinha, vice president and chief technology officer of AirDefense, Inc., a wireless security firm in Atlanta, said retail firms "have been lagging significantly," despite being a favorite target.

Retailers who lose data risk customer ill will, of course, but they also can face also action by the Federal Trade Commission for letting it happen, said Richard Hackett, an adjunct professor at Boston University School Law.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.