#AntiLeaks claims they are behind DDoS attack on Wikileaks

Wikileaks was down around 10 days after massive DDoS attack. WikiLeaks says that they’ve been under attack since revealing TrapWire. But the hacker group called Antileaks claims responsibility for this attack.

They said the attacks were in protest over the role of Julian Assange, who is currently the guest of the Ecuadorian embassy while waiting for his plea for political asylum to be decided.

"I want to make it clear to all the conspiracy theorists out there that we have nothing to do with the United States Government or Trapwire," DietPepsi ,head of the AntiLeaks hacking group said.  "We find it quite humorous to read all these Twitter comments from people who suspect us of being NSA/CIA/FBI/or even WikiLeaks themself,"

"We gave @wlpress a 5 minute advanced notice of our next attack to take down there backup mirror(http://mirror2.wikileaks-press.org) on August 10th. We also gave a 30 minute advanced notice of our attack on the President of Ecuador's website to the german tech publication Gulli . The logs of both servers will show an attack precisely when we said it would occur. These are irrefutable facts. "

"In the end we cannot prove individually to every person that doubts our claims that we are behind these attacks. There are a lot of people who still don't believe we landed on the moon. We feel we have nothing left to prove to anybody."

Read more

400 websites hacked by 3xp1r3 Cyber Army

The Bangladeshi Hacker group known as '3xp1r3 Cyber Army' hacked and defaced around 400 websites after breaching a server belonging to a hosting company.

A representative of the hacker group said that although many of the sites belong to Indian organizations, the breached server is located in Canada.

According to the hacker, there isn’t a specific reason for which the sites have been defaced. They simply did it to demonstrate the lack of security measures.

One of the hackers has revealed that the team is planning to declare cyberwar on a country. They couldn’t reveal the country’s name since the final decision hasn’t been taken yet.

They also plan on releasing their own hacking forum within the next 20 days. The complete list of affected websites can be found here - most of which are still defaced.

Read more

Google, YouTube may aid Indonesia in porn curb

Indonesia's communication and information ministry says it plans to collaborate with Google and YouTube to block pornographic Web sites.

The Jakarta Post reported on Monday that the ministry has been in discussions with YouTube regarding plans for the Indonesian government to provide keywords to the search giant to block sites promoting pornography.

Google has yet to join in the discussions, but Azhar Hasyim, business director of the ministry's directorate general for applications and information, said in the report that its participation is expected.

The Jakarta Post noted that 12 major local Internet service providers (ISPs) have each reported 2.5 million attempts to access pornographic Web sites a month, and the ministry had received some "100 million" public complaints on Internet pornography.

The Indonesian ministry in July shut down more than one million pornographic Web sites ahead of the Islamic holy month of Ramadan, as observers of the Muslim month had to refrain from eating, drinking, and sexual relations from dawn until sunset.

Read more

"TrapWire" Possible Reason for the massive DDoS Attack on WikiLeaks

Wikileaks has been under massive Distributed-denial-of-service (DDoS) attack since August 3rd. Wikileaks says that it is 'DNS amplification attack', a type of DDoS attack that takes advantage of the fact that a small DNS query can generate a much larger response.

The attack came after Wikileaks published the latest of its Global Intelligence Files (GIF), discussing the implementation of mass surveillance program called TrapWire in public spaces in the US.

“Attacks on wikileaks-press.org escalated after Wikileaks retweeted links to our mirrors of leaked files from WikiLeaks on a newly discovered mass surveillance program known as TrapWire,” WikiLeaks representatives explained.

“With that in mind, these attacks appear at a first glance to be part of an intimidation campaign; in the absence of any statements by the attackers, we are left only with speculation.”

In the meantime, Anonymous has revealed the start of Operation TrapWire. According to the hacktivists, the system uses facial recognition and complex artificial intelligence to monitor individuals, its official purpose being to prevent terrorism.

However, the hackers highlight that the system gives governments and corporation “unprecedented data-mining capabilities” that violate human rights.

Apparently, TrapWire doesn’t only monitor social media, but it also utilizes a number of CCTV cameras located in various places around New York, Los Angeles, Las Vegas, Texas, Washington, London and other cities in the United States.

"The more we learn about TrapWire and similar systems, it becomes absolutely clear that we must at all costs shut this system down and render it useless."Anonymous said in the press release.

"A giant AI electronic brain able to monitor us through a combination of access to all the CCTV cameras as well as all the online social media feeds is monstrous and Orwellian in it's implications and possibilities. The Peoples Liberation Front and Anonymous will now put forth a call to arms, and initiate the doom of this evil and misbegotten program."

Read more

Torrent Site ScanBits.org Hacked, 9000 Accounts Leaked

A torrent site has fallen victim to hackers who have obtained access to its database and grabbed a copy of it totalling over 300mb.

The torrent site is scanbits.org and along with the dump comes 9000+ user accounts with full account information, emails, encrypted passwords and more.

The leaked data has also shown that they website is logging current and old IP Addresses of all users to its database and putting them alongside user accounts.

Now while we understand for a private torrent tracker to work it must know if the downloader is a registered/active user of that tracker. How ever there should be different methods in storing the data so it can not be so easily matched to user accounts. The leak also shows that alot of torrent history logging is being done as well as errors and site administration logging from users site actions.

The leaked data isn’t really that critical but it does just go to show that even these services that are well known and used are not secure and that insecurity on such websites could caused a headache for thousands of people.

The leak which was sent to us anonymously has not been published online yet and we do not plan to. We have entered all breached emails within ozdc.net so if you are a user of the scanbits.org website then you may want to check and change ur user credentials.

Read more

Mitchell Rangers Soccer Club Hacked, Defaced, Restored

Yet another Australian based website has been attacked and left with a defacing on it. The website belongs to the Mitchell Rangers Soccer Club mitchellrangers.org.au/ and the attack has been carried out by “Hack-School”.

The defacing was mirrored on the well know zone-h website by “The Dark Hacker” and was logged earlier today and has just recently been restored by administration.

Attacks like these are becoming all to common and showing that a lot of websites out there are insecure and could be defaced or worse at any time regardless of its contents. We hope the administration fixes this issue before it becomes a common problem for them.

Screenshot of the defacement:

Read more

New Zealand Developer & Hosting WebMate Hacked, Defaced

New Zealand based web development and hosting company has become victims to hackers after its main site and webhost site was hacked and left defaced.

New Zealand based web development and hosting company has become victims to hackers after its main site and webhost site was hacked and left defaced.

The company is web mate www.webmate.co.nz and the hosting website appeared to look just like the main website but on a different domain /webmatehost.co.nz.

The attack happened earlier today some time and was uploaded to the zone-h website along with 2 other NewZealand based websites. The attacks have been carried out by a hacker using the handle NoEntryPhc.

***Opps !***

Your site is down!!!

C:> Cls.exe . . . . . . I’m in your site now  ..

[+] Hacked By NoEntryPhc

[-] 3-M4!l3 :NoEntryPhc@gmail.com !! o_0 !!

[+] Dont panic Admin !.

[-] Your website is not secure !!!!

[+] Die Like The Rest ..!!!

[+] Gr33tz : PhantomCrews, Dragonforce, Defacer terminal and YOU !!! |

[+] Thx to admin because read this message 

NoEntryPhcWas Here …

=====================================================================
The other sites that have been hacked are thedetail.co.nz which appeared to be a empty index before the defacement, walknz.co.nz which appears to redirect to a government information site about walks around New Zealand.

All sites have the same defacements and all were still active at time of publishing.

Read more

Anonymous targets global surveillance system: Operation TrapWire

Anonymous targets global system of surveillance: Operation TrapWire engaged. The new operation is motivated by recent disclosures made by WikiLeaks concerning TrapWire, a global system of surveillance run by the U.S. government.

In a press release issued August 12 via AnonPaste, Anonymous introduced Operation TrapWire, and issued “a call to arms” in order to “initiate the doom of this evil and misbegotten program (TrapWire).”

Earlier this month, Wikileaks published documents from the strategic intelligence firm Stratfor detailing a massive electronic spying system run by the U.S. government, a system known as “TrapWire.” A 2007 whitepaper [PDF] describes TrapWire as "a unique, predictive software system designed to detect patterns of pre-attack surveillance."

According to Anonymous, TrapWire is already used in New York, Los Angeles, Las Vegas, Texas, DC, London, and other locales around the USA. The system uses facial recognition and other techniques including high-end artificial intelligence to track and monitor individuals using countless different closed-circuit cameras operated by cities and other institutions, including private businesses.

Anonymous warns that while the software is billed as a method by which to prevent terrorism, it can also be used to provide unprecedented surveillance and data-mining capabilities to governments and corporations - including many with a history of using new technologies to violate the rights of citizens.

The following is an excerpt from the August 12 press release:

The more we learn about TrapWire and similar systems, it becomes absolutely clear that we must at all costs shut this system down and render it useless. A giant AI electronic brain able to monitor us through a combination of access to all the CCTV cameras as well as all the online social media feeds is monstrous and Orwellian in it's implications and possibilities. The Peoples Liberation Front and Anonymous will now put forth a call to arms, and initiate the doom of this evil and misbegotten program.

For more news, art and information about Anonymous, check out Anonymous Examiner on Facebook.

Read more

WikiLeaks suffers massive DDoS attack

Controversial whistleblower site WikiLeaks was taken down last week following a week-long and massive distributed denial-of-service (DDoS) attack.

The attacks coincided with WikiLeaks' release of new information on the Trapwire surveillance system discussed by Stratfor, the US-based global intelligence firm that hacker collective Anonymous infiltrated late last year to steal roughly five million emails.

"The emails show Stratfor's web of informers, pay-off structure, payment-laundering techniques and psychological methods," WikiLeaks wrote at the time

On Wednesday, WikiLeak's official Twitter account speculated the timing of the DDoS attack may be related to the Olympics; the ongoing releases of Stratfor and Syria documents, which also were handed over to WikiLeaks for publishing by Anonymous; or unspecified future releases.

A group calling itself AntiLeaks has taken credit for the DDoS campaign.

WikiLeaks, in a series of tweets on Friday, described the prolonged attack it is facing, which also is going after its "donation infrastructure." The organisation said the assaults are measuring more than 10 gigabits per second, and are being delivered in a way that is impossible to deflect.

"The bandwidth [being] used is so huge it is impossible to filter without specialised hardware," the tweets said.

"The DDoS is not simple bulk UDP or ICMP packet flooding, so most hardware filters won't work either. The [range] of IPs used is huge. Whoever is running it controls thousands of machines or is able to simulate them."

To respond, WikiLeaks has created a number of "mirror" sites, but most of those have been knocked offline as well.

WikiLeaks said it tried to move its servers to CloudFlare, a California-based start-up that specialises in DDoS protection and website acceleration. However, WikiLeaks said it was turned away.

CloudFlare is no stranger to protecting targeted websites. In fact, the company called LulzSec a customer during a roughly three-week period last summer when the close-knit hacktivist group was embarking on its rampage of breaches against companies like Sony and PBS.

LulzSec, however, never violated CloudFlare's terms of service.

When asked Friday about WikiLeaks seeking CloudFlare's assistance, Matthew Prince, the company's co-founder and CEO, said the organisation wasn't denied service.

"We restrict all high-traffic sites from the automatic sign-up process," he told SC in an email.

"The purpose for this is to make sure a big site signing up has a great experience and that we're prepared so they don't overwhelm our network. You'd see the exact same error for the same reason if you tried to sign up Google.com. The list of high-traffic sites is pulled automatically -- it wasn't purposefully directed at WikiLeaks.

"Someone alleging to be from WikiLeaks wrote in to our support [department]," Prince continued.

"We've responded to them to understand the nature of their attack and whether we can help. Stay tuned."

WikiLeaks has run into trouble with US -based companies before, however.

In late 2010, it began publishing secret diplomatic cables, which resulted in a number of major brands, including Amazon, PayPal and MasterCard, cutting off server hosting or payment processing ties with WikiLeaks in response to U.S. political pressure.

WikiLeaks' embattled leader, Julian Assange, remains at the Ecuador's London embassy. He is seeking asylum to the South American nation to avoid extradition to Sweden to face alleged sexual offenses. But he has not been charged with any crimes.

The AntiLeaks group said its claimed attacks are specifically against Assange and his attempt to seek asylum.

Read more

Demonoid operators arrested in Mexico, Anonymous plans revenge attack

Demonoid was taken down by a DDoS attack on July 24, with early reports suggesting that the site's downtime was temporary. But, it has gotten a lot worse: Ukranian authorities have announced they ordered ColoCall, the nation's largest datacenter and host of Demonoid, to disable to site and hand over data.

This would've been a coordinated, international effort, but it wasn't clear if Demonoid was being used as a "gift" from the Ukraine to the US. We've seen how the US wants to play dirty against MegaUpload, and founder Kim Dotcom, but this is crazy. London-based international record label consortium, IFPI, and INTERPOL have since revealed they were involved in organizing the strike, which wasn't limited to Ukraine.
It seems as though Mexican authorities are involved, too, as they have reportedly made more than one arrest as well as seizing assets. IFPI anti-piracy director, Jeremy Banks has said:

Demonoid was a leading global player in digital music piracy which acted as unfair competition to the more than 500 licensed digital music services that offer great value music to consumers while respecting the rights of artists, songwriters and record companies.

John Newton of INTERPOL has said:

In this instance police forces on different sides of the world worked together with INTERPOL and the music industry to successfully disrupt the distribution chain for illicit digital music products.

Last, but not least, Anonymous are pissed. They aren't happy with the above news, and have vowed revenge against those involved in the takedown of Demonoid. Anonymous have already said they're on the offensive, launching DDoS attacks against multiple Ukraine government-owned sites. Anonymous also plan to restore Demonoid by "any means necessary".

Read more

Demonoid domains up for sale

The domains of Ukrainian-based file-sharing site Demonoid have gone up for sale, just over a week after authorities pulled down the website.

Early in August, Demonoid was hit with a massive Distributed Denial-of-Service (DDoS) attack that took the site offline. Shortly after, the website's internet service provider, ColoCall, was approached by authorities and asked to shut down the sites servers, which the company complied with.

ZDNet's sister site CNET today reported that three key domains for the site — Demonoid.me, Demonoid.com and Demonoid.ph — are now all up for sale on domain marketplace Sedo.

Since the closure, hacktivist collective Anonymous has begun targeting Ukrainian Government websites with DDoS attacks, calling for Demonoid to be reactivated.

The news comes as Google announced plans to begin demoting websites that have had legitimate copyright claims filed against them from the internet giant's search results.

Read more

Hacker sentenced to 7 years in prison for stealing credit card information

A 21-year-old Maryland man who was part of a credit card hacking ring that targeted businesses in Seattle and across the country has been sentenced to seven years in prison.

The U.S. Attorney's Office in Seattle says Christopher A. Schroebel partnered with 21-year-old Dutch computer hacker David Benjamin Schrooten to steal credit card numbers from businesses across the country and sell them in bulk through websites.

In their charges, prosecutors say Schroebel had in his possession 84,000 credit card numbers he had stolen or bought from other hackers. The two hackers operated "point of sale" operations, in which spy software is installed in computers used by businesses for transactions. The software records credit card numbers used.

Schroebel pleaded guilty in May to charges of bank fraud, obtaining information from a protected computer, access device fraud, among others.

Schrooten, who was arrested in Romania, is set to stand trial next month.

Read more

Hackers accessed private,nude Photobucket pics, then posted on Reddit

Hackers have managed to gain access to a number of women's private, nude photos on Photobucket, then posted in public Web forums.

An entire thread on Reddit is devoted to posting X-rated pics stolen from Photobucket, an online photo-hosting platform. Some pose in underwear or completely nude, some hide their faces while others stare directly into the camera — but none intended to share the photos.

Unbelievably, another thread takes requests. Reddit users post names of girls whose private photos they want to see.

Skilled hackers are bypassing Photobucket's security settings and scouring for naked photos users wanted to keep private. They use software to retrieve the hidden snaps, a disturbing trend known as "fusking."

Photobucket users have the option of making their albums or individual photos private, but every single photo still has its own URL.

The image title is part of the URL, and even if the URL is private, the title isn’t hard to find.

For example, if a user has an image titled IMG_03 that is made public, they likely have an IMG_04, even if it’s not public. Frisking programs essentially speed up the guessing process and produce URLs for someone’s hidden photos, something like: http://www.photobucket/com/image/username/IMG_04.jpg.

Photobucket says it’s aware of fusking and provides a URL scrambling service that makes photos harder to hack.

“Scrambled URLs have been an option for the past two years and will be the default for all new uploads,” Photobucket spokesman David Toner said. “The company is in the process of reminding users about the option to scramble URLs to prevent fusking.”

Toner added that the breach of privacy is “very rare” and said it has “only affected a small number of Photobucket’s users.”

Experts say the best way to avoid starring in your own X-rated Reddit show is to keep nude photos off the Internet altogether — private or not.

“Privacy settings on social media sites just can’t keep up with how fast technology is adapting,” social media attorney Ethan Wall said

 “As sites get more private, hackers and people who want to get more information will continue to get more sophisticated.”Wall added.

Read more

Tasmania Police Site + 8 Others Attacked for #OpAustralia by Anonymous

Tonight was a very quite night, being very relaxing until about 30minutes ago when a user entered the #OpAustralia IRC channel on anonops.com and started taking down Australian based websites.

As well as this the operation has taken sight to Tasmainian police http://www.police.tas.gov.au/ tonite with all “fire power” going towards them which has resulted in the website being offline for the past hour or so.

The user that took down the other sites started out the attack by showing everyone that the sites was up and active and then within a few minutes all 9 sites had been taken offline for a very short period of time before the user left the irc.

List of other sites that were attacked, see below for images from screen caps.

http://www.durachrome.com.au/
http://www.muswellbrook.nsw.gov.au/
http://www.pyrosteel.com.au/
http://www.leeclarke.com.au/
http://www.act.gov.au/
http://www.canberraconnect.act.gov.au/
http://ccprod.stg.hyro.net.au/
http://www.moretonbay.qld.gov.au/

Also it has come to our attention that main media and Australian government has made claims that some websites, mainly the dsd website was not attacked. We covered this story right here.

Gallery of attacks so far.

Read more

AFP issues hacking warning after ASIO attack

Federal Police have issued a stern warning to computer hackers who have been trying to crash Australian government websites.

Hacking movement Anonymous has been credited with infiltrating government and company websites across the world, and now members of the group have set their sights on Australia.

Acting under the banner of the Anonymous movement, hackers yesterday unsuccessfully tried to bring down the Australian Security Intelligence Organisation and the Defence Signals Directorate websites.

Both agencies say their websites have not been infiltrated and they do not store classified information there.

Federal Police are warning hacking-related offences can carry a jail term of up to 10 years.

“The difficulty is finding this loosely-based group who advertise their activism online but have been notoriously difficult to pin down in person,” a spokesperson said.

Anonymous says the hacking aims to protest against the Federal Government’s plans for surveillance powers it claims would allow more personal details to be stored on web servers.

The group is already facing a police investigation into allegations its members have taken 40 gigabytes of confidential customer data from AAPT, one of Australia’s biggest phone companies.

Read more

Suzuki, JEEP and Fiat websites hacked by Over-X & Invectus

The Two Hackers known as Over-X & Invectus have managed to break into the automotive based websites and defaced them.

The website that have been attack are the suzuki India site(http://www.suzuki.co.in/index.html), Israeli and Republic of Macedonia Fiat Websites(http://fiat.com.mk/dz.html) as well as multiple subdomains from the French based JEEP website( http://jeep.fr)

"For peace and safety. What protection do you think .? Algeria will continue and will not stop to fight the enemies Because our religion is Islam " Hackers wrote in the defacement page.

A the time of writing, we are still able to see the defacement in those websites. You can also find the mirror of those sites here:
http://www.zone-h.org/archive/notifier=Over-X

Read more

Thieves Virus Data Bank Customers Roam

Lebanon - A new virus is found wandering in Iran. That said, the malicious program is specifically designed to collect data of bank customers.

Virus was found and then dissected by Kaspersky. Contents, which claimed a series of lines of code identical to the Flame, a virus that in May 2011 and was arrested wandering to gather data and peer computer users in Iran. But the difference, the virus is taking more specific data.

The virus, named Gauss was found to have been circulating on the 2500 computer in the Lebanon. Of all the victims can be seen if this malicious program is specifically collected data on the user login to email, instant messaging, social networking and certain bank accounts.

Kaspersky also said some banks targeted by the virus, including the Bank of Beirut, Blom Bank, Byblos Bank and Credit Libanais.

"We have never seen malware like this, which only target a specific bank. Usually they (the manufacturer-ed) will attack the bank as much as possible to maximize their profits," said Costin Raiu, Director of Global Research and Analysis Kaspersky.

Meanwhile, one expert in Lebanon said that the attacks it was likely carried out by the United States, because many banks in this region is used as a means of channeling money to the governments of Syria and Hezbollah, the Lebanese militant group and political party.

"The United States has a number of banks in Lebanon who are under supervision and work like a Swiss bank in secrecy. A virus can only damage it," said Y. Saab experts from the Monterey Institute of International Studies, Lebanon.

Gauss-related virus in common with the Flame, Kaspersky is very sure if they are made by the same person. Moreover, the structure of the programming language in it were identical.

"No doubt, both made in the same factory," said Raiu, Friday (10/08/2012).

Read more

Conceded Blizzard Game Server

United States - Blizzard Entertainment, which has some claim to have conceded a famous game. One of their servers infiltrated by hackers who managed to steal their users.

Blizzard has a lot of interesting online game, call it World of Warcraft, Diablo and Starcraft that if the collected amount of players can reach tens of millions. No wonder if their services as one of the targets of rogue hackers.

Not mentioned exactly when successfully hacked Blizzard's servers, but the alleged perpetrator managed to retrieve data gamers who live in North America, Latin America, Australia, New Zealand and Southeast Asia. While the players in China are not touched.

Even so, Blizzard managed to ensure that the data stolen was not important data, and can not be used to enter the Battle.net service.

"We have not found any evidence of theft of financial data like credit card, billing address, and the user's real name," said Mike Morhaime, Co-Founder and President of Blizzard.

To protect its users from the thieves password Blizzard claims to use the technique Secure Remote Password (SRP) which claimed to be very difficult to penetrate. Still, users are encouraged to immediately change their password.

"We keep all your personal data very carefully, I am sorry this happened," added Morhaime, as quoted by game informer, Friday (10/08/2012).

Read more

Nepalese Government Sites hacked and serves Zegost RAT

Researchers have detected that two Nepalese government websites, the National Information Technology Center (NITC) and the Office of the Prime Minister and Council Minister (nitc.gov.np and opmcm.gov.np respectively), have been compromised and serves Zegost(Gh0st RAT) malware.

The site injected with malicious code that tries to exploit the Java vulnerability CVE-2012-0507. After successul exploitation, it will infect the visitor system with the Zegost.

Interestingly, the binary installed on infected machines as part of the attack is signed by a valid certificate issued by VeriSign.

"The main page was injected with a Java JAR file loader which once rendered by the Web browser is executed and attempts to exploit the CVE-2012-0507 vulnerability. The name used for the Java class name ("msf.x.Exploit.class") and the content of the file confirmed that the code was taken from the Metasploit framework" Gianluca Giuliani of Websense said in an analysis of the attack.



"If the exploit code in the JAR file has been successfully executed, the exploit shellcode downloads and runs the executable file named "tools.exe" on the impacted system (MD5: 3c7b7124f84cc4d29aa067eca6110e2f),"

Zegost is a known Remote-Administration Tool(RAT) that's been used in other targeted attacks, specifically in Asia. Once on an infected machine, the backdoor used in the attack on the Nepalese sites initiates an outbound connection to a C&C server hosted on a domain in China at "who.xhhow4.com".


That same Java vulnerability was used in attacks earlier this year on Amnesty International and the Institute for National Security Studies in Israel, Websense said.

Read more

Interview: A "malicious hacker" making over $10K a week

It remains to be seen just how much actual hacking is to be had behind online ID theft and credit card scams - and the details in this story are likely to remain indefinitely unverifiable.

The results of one blogger's recent three-day IRC chat with an alleged Romanian credit card scammer give a peek into just how trivial the process could be.

Much like with the recent, now infamous "Epic Hack" of tech writer Mat Honan (where Amazon and Apple password reset were played off one another to gain account access), it appears that these techniques are performed by using available systems and playing their weaknesses off one another to get a desired result.

The methods are neither elegant nor particularly sophisticated. Still, the bar for entry isn't low enough to admit just anyone: it seems that some scammers will trade stolen identities or credit card information on IRC, but we're told that now most of this business looks to be conducted on a number of underground websites.

Freelance writer Patrick Lambert (Dendory) writes,

The purpose of writing this article isn't to incite anyone to do this, these acts are still obviously against the law, and any investigator that would have the resources and time to dedicate to catching these people could probably do it, but instead it's to show how incredibly widespread it is, and how trivial the whole process appears to be.
The interview underscores the notion that it's not all organized crime networks or malware coders doing the dirty ID deeds, but also fairly ordinary individuals who simply spend around 90% of their efforts in covering their tracks - and have no problem with breaking laws to make easy money.

Overall, the whole process for these people takes just minutes every day, and again, most of the time is spent covering their tracks by creating new accounts, switching to new VPNs, and going to anonymous cash sending and receiving stores, while the actual time spent doing any type of coding or interacting with other hackers is minimal. It's very easy to use, very tempting, and unfortunately, it still seems very low risk for them.
In IRC, Lambert met someone that identified themself as male, under 20, and Romanian who was willing to give select details about his alleged money making scams.

Taking to "d0g" Lambert said,

While some of them will trade stolen identities or full CC info on IRC, now most of that business seems to be done on a large number of underground web sites. This one for example shows a never ending list of items that get sold for as little as $3 each, available to anyone who registers for an account.
"d0g" explained to Lambert that after getting cheap European access to IP's (or getting hooked up otherwise for covering his tracks), the next step was to get money online and into an account (to purchase credit card numbers), and then money can be transferred from reputable entities such as Western Union.

After that, it's simply a matter of buying CC numbers, and then posting items for sale on eBay using fake identities.
Then according to "d0g" it was a matter of online money laundering in a sort of "matchmaking" exchange for goods, but without divulging an address:

(...) The way I was explained is that all he has to do is post ads on eBay for popular items that he doesn't actually have. Then, when someone buys it, he turns around and buys that same item from some online store with the bought CC numbers, and puts the eBay buyer's address as the shipping location.

He makes those stores send the products directly to his buyers, and gets clean cash for them, which he can spend any way he wants. It's a type of online money laundering.

And apparently, the reason why these stolen numbers are sold so cheaply is because a vast majority of them are either already canceled, or maxed out.
The interview concludes before explaining how the money is finally extracted, so we are once again reminded that we'll never know how much of this is true.

Read more