kirkswig
Sep 20, 2004, 2:16 AM
Post #5 of 8
(735 views)
Shortcut
|
Key loggers require some kind of script to scan for likely sequences...
Agreed. Perl, or any language supporting the extraction of text based on regular-expressions would do.
...it would be impossible to do by hand.
No, you could do this by hand. It would be slow, that's all. I've seen computer professionals manually indent multi-page documents by clicking at the beginning of the line of text and then pressing the tab key, then clicking at the beginning of the next line of text and pressing the tab key again, and so on and so forth, until they reach the end of the document, when all they had to do was a "Select All" and then issue an indent command. There's no reason why the hacker responsible for the keylogger should be any more sophisticated. Remember, he's likely not the same person who created the trojan horse in the first place: he's probably just a script-kiddie who copied-and-pasted the source from some bulletin-board somewhere and changed the email/IP address so that the credit card numbers were directed to him instead of the original author.
It is an automated kind of theft and I find it hard to believe that having stolen something using such automation, you would then use it manually - and 6 months later.
Acquiring the credit card numbers is probably automated, but their use? How do you propose automating that?
If you are accepting the fact that the acquisition of these numbers is automated, then aren't you also accepting the fact that we're talking about a huge quantity of such numbers? This is a trojan horse that could conceivably be installed on millions of computers. How do you use so many numbers without calling attention to yourself?
Well, one way is by selling those numbers. It's less risk and you profit from the exploit almost immediately. What do the people who buy the numbers do? They likely sell them too!
The more hands the numbers pass through, the longer the delay between their originally being acquired and their finally being exploited.
There is also the question of how best to cover your tracks. In the case involving my neighbors, the detective work was easy... they had only used this credit card number ONCE. I think that's probably the exception rather than the rule, and I'd bet that the hackers/thieves think so too.
So if they're under the impression that the card is being frequently used, separating the occasion when the card number was first obtained from when it is finally used is a good thing. And six months sounds like a really good number to use here, given that the standard expiration date is two years from the date the card was originally issued.
It just doesn't make sense.
How exactly is that? We know for a fact that these trojan horse/keylogger combinations exist. We know for a fact a that these things infest public terminals, often coexisting with one another, i.e., you will have multiple numbers of keyloggers running on the same machine. We know for a fact that these hackers have put these programs out there for the purpose of acquiring credit card numbers. We know for a fact that once acquired, these hackers will then sell these numbers to the highest bidder. And we know for a fact that the buyers will often turn around and sell these numbers to others.
We can assume that this process of buying and selling credit card numbers takes time, since the buying and selling of any service or merchandise takes time, and we can also assume that the buyers, sellers, or the hackers themselves, are willing to introduce delays in the processing of these numbers in an effort to cover their tracks, i.e., make it more difficult to know when and where the number was originally stolen.
I think I have a pretty good case here.
And I think I can describe why you and others feel the way you do...
A lot of you have been doing financial transactions using public terminals while SOB and have been doing so for some time. This is not my first post on this subject, and it is not the first time such a posting has been ill-received. A lot of you are still, to this very day, using public terminals to conduct your financial transactions, and you don't want to change the way you're doing business because to do so means that not only are you going to have to change your habits but that you're also going to have to spend money making these changes. There's probably also an element of feeling foolish about having exposed yourself to so much risk for so long when the hallmark of a serious trader/investor is understanding how to manage such risk.
It is a fact that using a public terminal to send *any* vital information is a risk. Indeed, unless you really know what you're doing, using *any* terminal, public or not, is a risk. The exploits involving workers who steal credit card numbers in the course of their employment are almost always solved, because the workers almost always are greedy, and law enforcement can easily identify the company, and then finally the workers responsible for the fraud.
And the banks are quick to credit your account for such losses.
But what we're seeing now with computer-based fraud, the banks are not being so quick, because it's becoming more and more difficult to determine who exactly is responsible for these exploits. In other words, the bank has no way of knowing whether it isn't you who is trying to exploit the bank.
And banks today are under all kinds of pressure. They can build a voice-mail system that gives you your account balance on demand, but dealing with fraud isn't something they can buy a machine for. It's very human-intensive.
Which means that it costs them money.
Which means that, of course, they're looking for ways to pass the cost on to you.
I've alluded to this on another forum, but since moving to Mexico, I've noticed what must be at least a 10,000% increase in efforts to break into my network. Mexico is literally crawling with virii and worms, and the reason why is because so many people here rely on public terminals to conduct their business. The administration of these public terminals -- in my experience -- ranges from poor to bad.
What's the problem with refraining from using public terminals as if your financial security depended on it? There are other ways of accessing you account info and/or purchasing services or merchandise from distant vendors. Why dispute the obvious risks here?
Why put yourself in harm's way?
To boldly go where no wig has gone before.
|
Forums Index
Search Posts
Who's Online
Log In or Sign Up
