Schneier on Security

RobertT • November 13, 2010 12:15 AM

It’s a pity that an inventive mind, got corrupted by a petty little scheme as this.

I know there is nothing new in SQL attacks nor with “war driving” and WiFi hacks, although I thought the corrupting the Point Of Sale terminals was an interesting twist. But putting it together and coordinating the effort is not to be trivialized.

What seems to set this fraud apart from say Berrni Madoff’s, is that many of the victims quickly realized that something was wrong, in contrast to Berrn’s where confidence in the underlying business relationship was maintained for decades. Bernie’s fraud was far more transparent, and obvious, the deceptions were not even backed by real numbers, the claimed trades didn’t even exist, which is something that any client could have easily established. Yet Bernie enjoyed $B’s and at least 30 years high life from illicit gains and Albert enjoyed a few million and less than 5 years high life. I think there is a lesson in there somewhere.

Now imagine Albert had never actually stolen money from the credit card accounts but rather had borrowed against the asset value associated with these accounts. If he had say followed a simple double down betting scheme, then given access to practically infinite capital( from the asset value of all the cards) he could always win these simple bets. Better still he would win without ever actually stealing from the accounts. Sure there would be some odd canceled transactions, requiring feeble apologies from an outsourced call center employee. BUT if no actual money is missing from the accounts then most people will not complain, or EVER get to the bottom of the unusual reimbursed transactions. Believe me I had some such transactions a few years ago and was hampered at every level, the “what’s your problem dude! nothing’s missing” attitude is epidemic within these organizations.

RobertT • November 13, 2010 3:23 AM

@davi
This whole thing reminds me of a post on a Hedge fund quant strategy site that I used read.

There was a long detailed post dissecting the trading strategy of a fund (interestingly in part formed by the GCHQ crypto great Nick P). The quant program, through the way it executed trades, was claimed to be breaking innumerable trading laws (mostly intended to control trading in live person to person sessions). Interestingly, at the time, very few Wall St’ers had the mathematical skills needed to analysis the trades and from the trade patterns establish the nature of the trading algorithm. So the fund went unpunished and amassed a fortune for all involved.

Now I have no knowledge of SEC laws, so I definitely cannot claim to understand the nature of any possible crimes committed, BUT the simple fact that the process involved complex cryptography like algorithms, based on extracting patterns from data, and the money shifting from here to there and lots of trades and and and …made the whole mess impenetrable and therefore legal, or more correctly impossible to prosecute.

It seems to me that Albert’s greatest error was that his system was the cyber equivalent of hitting little old ladies over the head and stealing there pension check’s. This sort of activity always attracts the interest of departments with real muscle rather than the toothless variety like the SEC. What Albert really needed was a way to obfuscate the process by which funds in his accounts were related to the stolen credit card details.

RobertT • November 16, 2010 3:28 AM

@Anton,
“someone will notice the immense number of transactions and it will blow up”

Maybe, but why would I need to limit myself to one account doing the betting. If I’m in control of the database than I can easily create say 1000 dummy accounts and transferred small amounts between real CC’s and these fake accounts. I can bet and loose on one account than bet same amount each account but with two accounts and so on. No house limits.

I don’t see excessive transactions as a problem. unless you get really greedy.

i was thinking that the bets would be done on the stock market, something simple like up / down tick on a ETF. So the bets will not be visible within the massive amount of HF trading that already happens.