Double agent who 'stole 130 million card details'
Hacker who agreed to help nail his accomplices now accused of greatest identity theft spree in history
Wednesday 19 August 2009
He is handsome, he is rich – he reportedly splurged $75,000 (£45,000) on his own birthday one year – and has the kind of charm that could dazzle the hardest of men, says a federal secret service agent. But it's not your daughters you need to be locking up: it's your credit cards.
We have known for some time that the electronic identity-theft business is burgeoning. The US Treasury Department says it knows of 55,000 cases in just 10 years. But, as of now, it has its official poster boy. He is 28-year-old Albert Gonzalez, a man who allegedly has a special talent for this particular line.
That, at least, is the contention of the authorities in New Jersey, who late on Monday unveiled criminal charges against Mr Gonzalez identifying him as the leader of a three-man ring which, between October 2006 and May 2008, successfully siphoned off the data from no fewer than 130 million credit and debit cards in the US by hacking into the networks of several retail and financial giants including the 7-Eleven corner-shop chain.
The charges against Mr Gonzalez and two other unidentified men apparently working out of or close to Russia are causing considerable consternation for a multitude of reasons. For one, this may be the biggest criminal case involving the theft of credit card data ever uncovered. Second, some of the details of the alleged criminal career of Mr Gonzalez are raising eyebrows. For example: why didn't the Feds cotton on to all of this before?
It turns out that Mr Gonzalez was first detained in 2003 in connection with alleged nefarious hacking operations but was not prosecuted after he agreed to assist the secret service in trying to nail some of his accomplices. The authorities also agreed to allow him to move from the New York area to Miami.
Since May of last year, Mr Gonzalez has been a resident of a jail in Brooklyn awaiting trial on charges of hacking into the computer system of Dave & Buster's, a national restaurant chain based in Miami. He was allegedly trying to steal card numbers.
But later last year, the police were pointing to Mr Gonzalez again. In a separate case now pending in Boston, he was accused of being the ringleader of yet another data breach involving a series of companies, but most notably TJ Maxx retail in Massachusetts. On that occasion, prosecutors said, the ring had successfully purloined the details of 40 million cards and their activities had cost TJX – which owns TJ Maxx – about $200m (£120m).
The new set of charges eclipses all that came before, however. It also opens the window on a netherworld of electronic crime that will set off new alarm bells in capitals around the world. If one man can be responsible for this number of breaches, the problem may be bigger than anyone imagined.
If Mr Gonzalez is guilty it is also his chutzpah that shocks. He is "a very important player in a sophisticated ring that has real results at the street level of bank, retail, debit- and credit-card fraud," acknowledged Seth Kosto, an Assistant US Attorney in New Jersey who specialises in computer fraud.
According to court documents filed in the TJX case in Boston, Mr Gonzalez instigated what he called an "operation to get rich or die tryin'", which involved identifying some of the biggest companies in America and setting about assessing how vulnerable their payment systems were to being hacked.
It is alleged that, once Mr Gonzalez and his team had successfully penetrated a particular company's system, an electronic "back door" would be installed that in theory would allow them to return at any time to harvest even more credit card numbers.
The value of data from stolen credit cards depends on the market. But, according to the latest documents filed in the case, once the information was stolen it was immediately relayed to computers controlled by the ring in different parts of the world, including California and Ukraine.
Of course those least happy to hear details of Mr Gonzalez's alleged capers are the companies whose names feature in the latest charges, including a supermarket chain called Hannaford. "We're pleased that the authorities have aggressively pursued this case to be in a position to bring an indictment against the alleged perpetrators," said Michael Norton, a spokesman for Hannaford. 7-Eleven declined to comment.
Gonzalez allegedly used a technique known as an "SQL injection attack", a form of computer hacking which is designed to exploit security vulnerabilities in databases. This type of attack is said to have started in Russia, China and North Korea,but has become increasingly popular in the United States. So much so that computer giant IBM will later this month release a report which shows that instances of SQL injection attacks have increased by 50 per cent in the first quarter of 2009, compared with the final quarter of 2008.
SQL injection requires the hackers to gain access to the computer networks they wish to hack. The hacker would do this by somehow breaching the computer's firewall and then "injecting" software into the database, which is held in a computer programming language known as SQL. What type of software is not known, but it would search for pins or passwords or transaction records. The stolen data was then sent to computer servers to sell on.
New UK station Russia Today gives a very bizarre view of Britain
By performing as African Americans or Indians, white people get to play act a kind of 'imaginary liberation', writes Michael Mark Cohen
New essay by JK Rowling went live on Pottermore site this morning
Top Gear presenter is no stranger to foot-in-mouth controversy
- 1 Canadian actor punched in face after 'Islamophobia' experiment goes wrong in wake of Ottawa shooting
- 2 Topshop at centre of row over body image as 'shocking' skinny mannequin photo goes viral
- 3 Top Gear presenter Jeremy Clarkson criticised for beer tweet
- 4 The bubble bursts for Sodastream
- 5 If you think Russell Brand’s new book is confused, you should read what his critics have to say about it
'Nasa Confirms Six Days of Darkness in December': No, they don't - it's a hoax
Top Gear presenter Jeremy Clarkson criticised for beer tweet
The bubble bursts for Sodastream
Russian politician says Apple CEO Tim Cook should be 'banned' from country after coming out as gay
'Santa Claus' dead: John Moore starred in Coca Cola and Morrisons adverts
Pope Francis declares evolution and Big Bang theory are real and God is not 'a magician with a magic wand'
Huge surge in Ukip support after EU funding row, according to new poll
Ukip ‘exploiting grooming scandal’ to secure party’s first police chief
Nigel Farage: 'There’s nothing wrong with white people blacking up'
Maureen Lipman says 'she can't vote Labour while Ed Miliband is leader'
Muslims, immigration and teenage pregnancy: British people are ignorant about almost everything
£40000 - £65000 per annum + bonus + benefits + OT: Ampersand Consulting LLP: M...
£22800 - £33600 per annum: Randstad Education Manchester Secondary: The JobAt ...
£22800 - £33600 per annum: Randstad Education Manchester Secondary: Calling al...
£100 - £125 per day: Randstad Education Chelmsford: EYFS Teachers - East Essex...