CyberJackers & Hackers steal credit card data from safe havens in Europe & Asia.
Katherine Karastamatis of
Redwood City had no idea how the
charges had been billed to her
credit card. "I didn't know who
had gotten my credit card number
or how," she said. "This person
(using the card) had my home
phone number, my home address,
which I never give to anybody. .
. . I thought somebody had
broken into my house, or was
watching me." Karastamatis
learned that she was one of 139
Babygear.com customers whose
credit card information was
stolen by computer hackers in
Belgrade late last year.
They charged $500 before she could cancel the card.
The hackers were a new breed of sophisticated criminals some call
"cyberjackers," who commit such crimes as stealing sensitive corporate computer
data and threatening to make it public unless the company pays thousands of dollars in
hush money.
Many recent incidents have been the work of cyberjackers based in Eastern Europe, China
and former Soviet republics. Former communist countries have long been a hotbed of
hackers, and have been the source of a number of major computer viruses. Some of the most
disruptive "denial of service" attacks of the past were committed by hackers in
former Soviet-bloc nations.
What is different about the most recent break-ins is that the hackers behind them have
ties to various organized crime groups, and are penetrating computers in the United States
and elsewhere to obtain illegal profits.
"The new technology allows people to commit crimes in the United States from
anywhere else in the world," said John Collingwood, FBI assistant director for public
affairs, during a briefing at FBI headquarters in Washington, D.C., last month. "For
the foreseeable future, we are going to see an explosion in this area. It's literally a
brand new area for us. And it is one where no one is sure of what the implications will
be."
Among the recent incidents:
-- In March, Bibliofind.com, an Amazon.com subsidiary that deals in rare books,
revealed that cyberjackers had broken into its Web site and downloaded files containing
confidential information, including credit card data, for about 98,000 customers.
-- In February, a hacker who appears to have been operating from China broke into the
computers of RealNames, an Internet company that registers Web site names. The hackers
gained access to customer records, credit card numbers and passwords.
-- In January, CD Universe, an Internet business that sells music, DVDs, videotapes and
games, reported that a Russian hacker had broken into its Web site and stolen 300,000
credit card numbers in connection with a $300,000 extortion plot. When the company refused
to cooperate, the hackers posted some of the credit card numbers on the Internet.
According to a survey of 538 computer security specialists conducted by the FBI and San
Francisco's Computer Security Institute, both the number of computer penetrations and the
economic losses associated with them have soared during the last year.
The financial cost of cyber-crime -- the money stolen by Internet hackers or spent
repairing damage caused by unauthorized system entries -- has climbed as well.
Participants in the survey reported losses of nearly $266 million in 1999 and $378 million
in 2000.
In addition to the economic losses, cyber-crime also erodes confidence in e- commerce
-- and in the businesses whose computers are compromised.
"I only used my credit card once on the Internet," Karastamatis said. "I
am not using it (on the Internet) again. I am not going to take the risk."
Cyberjacking seems to be increasing at an alarming pace. Pilot Network Services, an
Alameda company that makes firewall security software, does a monthly statistical report
about attempts to hack machines using its programs.
In April, the company reported that 95 million attempted entries had been detected on
computers using Pilot's protective programs, a 220 percent increase over the number
detected the previous month.
Computer security experts have expressed concern that cyberjacking will become more
widespread.
On May 1, Microsoft alerted customers to software problems in its Windows 2000 server
and published a software patch designed to prevent outsiders from exploiting the weakness
to take over entire systems.
"Clearly, this is a very serious vulnerability, and Microsoft strongly recommends
that all . . . administrators install the patch immediately," the company's advisory
said.
Cyberjackers have previously exploited similar vulnerabilities on the Windows NT
operating system, one of the most commonly used in e-commerce, and on Unix-based systems.
Two months ago, Forseti Technologies Inc., a software development company near Chicago
that lists Panasonic, Magellan Information Systems, Rand McNally and the U.S. Department
of Transportation among its clients, was the target of cyberjackers who penetrated its
Unix-based operating system and created an account for a fake system administrator.
If not for a mysterious outgoing e-mail to Yahoo.com, sent when nobody was in the
office, the company's systems operators would never have discovered the breach.
"I don't know how they got in," said Ramesh Ramakrishnan, Forseti'spresident
and chief executive officer. "I think they were looking around, and they found a weak
place in our Unix server."
The cyberjackers opened a data "trap door" that would capture sensitive
information and retain it in a file that could be retrieved later.
"(The trap door) told them stuff like which site you were going to, the user name
and password," Ramakrishnan said. "They were sniffing every packet (of
information) that went out through the firewall."
Fortunately, Forseti discovered the data trap before the hackers were able to retrieve
the information it had captured. Although the company was unable to determine who was
responsible, they were able to trace it to an Internet domain name originating in Romania.
"We were very lucky to have found them and stopped it before they were able to
transfer the data," Ramakrishnan said. "They could have retrieved all that
sensitive information and wiped out all the traces of the entry. We would never have known
what happened."
Last December, the National Infrastructure Protection Center, a division of the FBI,
issued an advisory warning of the problem to companies engaged in e- commerce.
A second advisory was issued in March, because many firms had still not fixed software
problems that give hackers access to confidential data.
At the time, the FBI said that 40 companies in 20 states had been identified as targets
of the attacks and more than 1 million credit card numbers had been compromised.
Law enforcement agencies have initiated investigations of many of these attacks, but
because a large number of the cyberjackers operate outside the United States -- and
because businesses are reluctant to acknowledge that crooks have broken into their systems
-- the cases are difficult to prove and prosecute.
"Companies don't like to admit that they've been hacked into, that there are
technical glitches in their systems that allow people to get into them," said the
FBI's Collingwood. "That's one of the hurdles we've got to get over."
How to limit cyber-thieves
Although cyberjackers are focusing on companies that sell goods and services over the
Internet, and not individual consumers, anyone whose personal credit card or commercial
account information is stolen can end up stuck with the bill. Experts say there are some
steps e-commerce customers can take to limit the damage:
-- Save e-mails of your online receipts or purchase confirmations to check against your
monthly credit statement.
-- Check your credit statement carefully and contact the card company about any
purchases you do not recognize. Some merchants' phone numbers are included on credit card
statements, and they can be contacted directly about questionable purchases. Many
companies have toll-free numbers and 24-hour customer service operators to deal with such
emergencies.
-- Your credit card company may ask you to sign a statement under oath that you did not
make the purchase in question. Under federal law, once you have reported a credit card
loss or theft, you have no further responsibility for unauthorized charges. In any event,
your maximum liability is $50 per credit card.
