Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IAmA a malware coder and botnet operator, AMA

reddit.com

Post reply on HN
Print view View original

61–70 of 203 posts

Re: IAmA a malware coder and botnet operator, AMA

#61

Post by idonthack »

Jach wrote: post #18
corin_ wrote: post #14

Earlier quoted context omitted.

From what he says I agree that he seems either stupid or a liar, but I'm not sure about your premise, it's not hard to post an AMA that can't be linked to you.

For the average cyber-stalker, that's true. But I'd wager if some government agency actually wanted to track him down (he's probably too low-value of a target), he's revealed more than enough bits of information about his personal life for them to do so.

all we know about him is he's german, he doesn't have a degree, and he likes ponies. he's explicitly avoided answering questions about his personal life, even just about his day job.

Re: IAmA a malware coder and botnet operator, AMA

#62

Post by darksaga »

The thing that's scary is how easy it is for these people to get away with what they're doing. I wonder how much money is lost every year and how many hackers you never hear about going to jail for this stuff. I'm pretty sure this is the motivation to do a lot of this stuff. The risk/reward level is completely slanted.

I see a LOT of stories on HN and other Tech sites about these kinds of attacks. Unfortunately, I rarely, if ever, hear about hackers getting arrested for this sort of activity.

Re: IAmA a malware coder and botnet operator, AMA

#63

Post by ajross »

raverbashing wrote: post #58
ajross wrote: post #8

Earlier quoted context omitted.

Credit card fraud is actually a fairly small problem in the US. Wikipedia tells me that the total cost of fraud is 0.07% of the transaction value. And I suspect (without evidence) that the bulk of this is made up of remote purchases, not swiped activity. Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat. No, they're probably not actually wort…

"Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat" Absolutely not! In the US fraud may be small (but it's increasing). But magnetic stripes are very unsafe Chip'n'Pin may have some issues, but it's much safer to most common attacks such as - card stripers (very inconspicuous) - physical theft of the card (because it requires a pin) And, as s…

You're missing the point entirely. I'm not saying that chip & pin has no value. I'm saying that the value it has is finite (i.e. it saves money equal to the amount of fraud it eliminates) and needs to be weight against the cost of replacing all the card reader infrastructure. And I argue that the fact the US has not upgraded is an existence proof that the upgrade cost[1] outweighs the savings.

[1] Really the amortized upgrade cost. Remember that chips are dinosaur technology already, and have known problems. What's the point of doing an upgrade if you need to dump it all and start over in 6 years anyway?

Re: IAmA a malware coder and botnet operator, AMA

#64

Post by 16s »

smackfu wrote: post #46
bediger4000 wrote: post #38

Earlier quoted context omitted.

So, if you don't care about violating the terms of PCI-DSS, you can store the CVV2/CVC/whatever. I bet lots of places do. In fact, I worked for a Visa Level-1 merchant that had a card processing system that used an Oracle DB table as a queue for outgoing authorization requests. The table held the CVV2/CVC/whatever for as long as it took to get an authorization or a timeout, whichever came first. We passed the PCI aud…

The point is that even if someone steals your order database with credit card numbers and expiration dates, they need to try every number 1000 times. That's a decent speedbump. If you store CVV2 in your database against your merchant agreement, and someone steals it, I'm sure the credit card comp will come after you for the losses.

Not only will they be sued, but they'll no longer be able to accept credit cards. They'll most likely go out of business. It's a serious matter to be non-PCI compliant.

Re: IAmA a malware coder and botnet operator, AMA

#65

Post by farnsworth »

ajross wrote: post #8
JWhiteaker wrote: post #2

Magnetic stripes are the most hilarious thing ever, but still work almost everywhere on the globe. I am amazed that magnetic stripes are still the norm for credit cards in the US. Europe has managed to move all but completely to chip-based cards, but the US hasn't. Does the cost of fraud due to magnetic stripes outweigh the cost to upgrade the entire US system, or is the market just too fragmented to coordinate such…

Credit card fraud is actually a fairly small problem in the US. Wikipedia tells me that the total cost of fraud is 0.07% of the transaction value. And I suspect (without evidence) that the bulk of this is made up of remote purchases, not swiped activity. Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat. No, they're probably not actually wort…

It's not fair to just look at it in terms of the cost of fraud vs. profit. Consumers whose CC info is stolen aren't liable for fraudulent charges but it can still be very expensive and time-consuming for them to correct everything, not to mention the affect it can have on a credit score. And obviously, the consumers don't get any say in whether the costs to upgrade the infrastructure are worth it.

Re: IAmA a malware coder and botnet operator, AMA

#66

Post by dclowd9901 »

sycr wrote: post #51
16s wrote: post #13

Earlier quoted context omitted.

They can't store the CVV2 either. Doing so, even encrypted, violates PCI-DSS.

You'd be surprised how many vendors and merchants simply do not care. I was employed with an e-commerce vendor that indefinitely stored CVV2 in plaintext (among other numbers).

When I see claims like this, why is it there's never any additional information about this company so I can avoid the hell out of it?

Re: IAmA a malware coder and botnet operator, AMA

#67

Post by sage_joch »

reidmain wrote: post #57

"Protip against driveby infections (the ones in the browsers): Disable addons in your browser and only activate the ones you need. Chromium and Chrome for example let you disable all additional content like flash, html5, pdf and java in the options, you will see a grey box instead of the content and can manually run it using right-click -> Run. Chrome options -> Content options -> Plug-Ins -> Disable all or Click-to-…

I've actually stopped using Firefox because it re-enables plugins that I've disabled (maybe it's more accurate to say it allows 3rd-party software updates to re-enable them).

Re: IAmA a malware coder and botnet operator, AMA

#68

Post by bediger4000 »

smackfu wrote: post #46
bediger4000 wrote: post #38

Earlier quoted context omitted.

So, if you don't care about violating the terms of PCI-DSS, you can store the CVV2/CVC/whatever. I bet lots of places do. In fact, I worked for a Visa Level-1 merchant that had a card processing system that used an Oracle DB table as a queue for outgoing authorization requests. The table held the CVV2/CVC/whatever for as long as it took to get an authorization or a timeout, whichever came first. We passed the PCI aud…

The point is that even if someone steals your order database with credit card numbers and expiration dates, they need to try every number 1000 times. That's a decent speedbump. If you store CVV2 in your database against your merchant agreement, and someone steals it, I'm sure the credit card comp will come after you for the losses.

If you're a "Carder", and you've got 1,000 cards, you just try them once a day. You'll get 2 CVV2's a day, average. And a bet that a once-a-day wrong CVV2 doesn't trip very many, if any, fraud checks. How much more is a card worth to a carder with CVV2/CVC than one without? Another niche service to provide in the cybercriminal underground, I guess.

As far as being non-PCI compliant, you as a merchant are only compliant right at the time of the audit. And maybe not even then, given Heartland's experience. The whole PCI thing is to give Visa and MasterCard a way to do some CYA.

Re: IAmA a malware coder and botnet operator, AMA

#70

Post by jacquesm »

citricsquid wrote: post #4

Most of what he says is obvious stuff and the emphasis he puts on how much he modifies stuff makes me assume he's someone that just runs programs and doesn't have any unique insight, but he does make one interesting point: > Try to use "Verified-By-Visa" and "Mastercard-Securecode" as rarely as possible. If only your CVV2 code is getting sniffed, you are not liable for any damage, because the code is physicly printed…

VBV (or 3D secure as it is called today) is part of a move by the credit card companies and the banks to push the risk to the most vulnerable party, the consumer.

The idea is that this absolutely crack proof scheme requires you to authenticate yourself to your bank in a fairly complex three way handshake.

In the old (read pre-VBV) days the card companies and issuing banks would saddle the merchants with any charges that were disputed using the chargeback mechanmism.

Verified-by-Visa removes this safeguard by adding an additional layer of authentication which supposedly has the same strength as you being on-premise and signing on the dotted line to authorize your purchase. This will effectively remove a lot of the excuses that you might have had such as 'it wasn't me', 'I wasn't there' and 'I never meant to buy this', which were the most common excuses consumers would come up with after using a service for anywhere up to 6 months and then yanking back all 6 months worth of payments and saddling the merchants with the loss of income, pay-outs to affiliates already made and additional charge-back fees on top of that.

So even if the goal was a fairly noble one it looks as though the whole idea is predicated on one tiny little detail, which is that VBV is supposedly hack-proof, but in fact this is highly dependent on both your bank and the security of their implementation. Neither of those are as ironclad as they should be to remove all doubt.

But of course the banks/card companies are not willing to end up holding the bag if there is trouble so it falls to the consumer to prove that they really were not involved in the transaction and that is very hard.

On the positive side in this whole debate: Even if a consumer is defrauded there is always someone who benefits and following the money usually leads to the perp. That's why it is hard to order stuff online with credit cards that were not issued in the country that the person using them is from, that's why it is hard to spend your money on three different continents with the same credit card within a single day and so on.

Lots and lots of money goes in to early warning fraud detection (before the fraud happens) and this nips a very large percentage of potential fraud in the bud.

Post reply on HN