Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Analyst Calls Russian Teen Author of Target Malware

Soulskill posted about 8 months ago | from the get-off-my-lawn dept.

Security 107

Nerval's Lobster writes "A digital-activity data analytics firm called IntelCrawler, Inc. claims to have identified the author of the BlackPOS malware used in attacks against Target and Neiman Marcus, and spotted similar attacks that are still in progress against six other retailers. Andrey Komarov, CEO of the Los Angeles-based IntelCrawler, told Reuters Jan. 17 that his company had spotted the six ongoing attacks while analyzing Web traffic in search of the specific entry points and origin of the malware infection behind the Target data breach, which allowed hackers to steak magnetic card-strip data on 40 million debit- and credit cards and demographic data on 70 million additional customers. According to Komarov, BlackPOS was developed by a 17-year-old Russian who goes by the username Ree4 and lives in St. Petersburg. Ree4 probably did not participate in the attack on Target, but did sell the malware to the actual attackers, according to Komarov, who refused to identify the source of his information other than to say he had been monitoring forums on which he said Ree4 sells malware. In a series of chat clips Komarov said are exchanges between buyer and seller, Ree4 tells a potential customer that the price for the software is US$2,000 and that the malware grabs credit-card numbers from system memory as they're scanned, dumps them into a file called time.txt that is sent back to the controller. Ree4 also said the app works only on standalone point-of-sale terminals with a separate monitor that also runs Windows, but not on Verifone systems, which can be attached to PCs but secure credit-card data before it can be scraped by BlackPOS."

cancel ×

107 comments

Sorry! There are no comments related to the filter you selected.

What we should do (-1, Flamebait)

Anonymous Coward | about 8 months ago | (#46000531)

We should get laws passed to execute people for writing malware to send a clear message to criminals

Re:What we should do (4, Funny)

gmuslera (3436) | about 8 months ago | (#46000547)

That would clean up most of NSA staff

Re:What we should do (0)

Anonymous Coward | about 8 months ago | (#46000597)

Including authors of insecure software for purchase

Re:What we should do (4, Insightful)

nuonguy (264254) | about 8 months ago | (#46002737)

Even though what this AC said isn't very helpful, it expresses frustration with what happened. I think it deserves a better response.

Lots of posts here say we should punish the malware author very severely. I say punish him like a small town vandal. Give him a talking to, maybe make him give up his earnings, tell his parents, and then leave him alone.

You're missing the actual criminals here:
1. The people who installed this malware.
2. The people who sold the credit card records.
These guys deserve the full brunt of the law for damages done.

But even those guys don't deserve the strongest of punishment. The harshest criminal proceedings should be meted out to the CIO and CEO of Target (and Needless Markup et al :-). They should be held criminally liable for not securing customer credit card information. Surely with the myriad of laws that congress has passed there has to be some law or statute around storage and transmission of financial records that would stick. Sadly I feel like I'm deluding myself with that hope.

I imagine even one single CIO going to jail or merely facing a judge during criminal proceedings would make a much bigger change in how financial information is treated by officers of companies in the US.

This situation avoidable. We have technology that mitigates these risks enormously. What keeps theft of credit card information from ending is that the people who make decisions don't need to care. Make that change and the network effects might do the rest.

You could get laws that mandated the use of chip c (0)

Anonymous Coward | about 8 months ago | (#46003535)

21st century?

The Greatest Deal (-1)

Anonymous Coward | about 8 months ago | (#46000545)

Boy, do I have a deal for you! See this rancid-as-fuck rectum of mine? See how it's absolutely repulsive? See how every single molecule on and in this foul asshole of mine is rotten to the core? Yes, you do. I'm here to tell you... it's all yours! Your fetid, disease-ridden cock can do as it pleases to my smelly asshole! Oh, and there's a feces surprise waiting inside my asshole for your disgusting little friend. And there might also be a few hundred parasitic goodies hiding in my diseased feces. That's riiiiiiiiiiiiiiiiight... pin worms! Let's see what happens when you mix your cum with my feces. The feces fiesta of the ages has finally begun! What say you?

Re:The Greatest Deal (1)

Anonymous Coward | about 8 months ago | (#46000845)

I can't wait for the day you forget to click the check-mark by "Post Anonymously" before submitting your comment.

Re:The Greatest Deal (0)

Anonymous Coward | about 8 months ago | (#46001077)

NOW you're talkin' to me, BABY!!

Rumour has Walmart also (1)

SpaceLifeForm (228190) | about 8 months ago | (#46000557)

But who are the other three?

Re:Rumour has Walmart also (0)

Anonymous Coward | about 8 months ago | (#46001625)

JCP, neiman marcus, I forget the 3rd if not walmart.

Russia needs to pass better laws (0)

Anonymous Coward | about 8 months ago | (#46000561)

Russia needs to enact better laws so that criminals engaging in black hat hacking suffer far more prison time. Really. You can go to prison in Russia for "hooliganism", whatever the hell that is, but write some code that steals millions of dollars from customers and nothing happens to you. Should be some kind of CyberCrime provision at the UN that would engender more cooperation from Russia,and if there's not, someone should create one.

Its almost as if Russia possesses codified antipathy for capitalism, since these hackers only hurt corporations and their customers. Else, they just don't care. How else can anyone explain why the most harmful civilian cybercriminals hail from east of the Urals?

Re:Russia needs to pass better laws (0)

Anonymous Coward | about 8 months ago | (#46000581)

Should not have said "possesses". What a terrible word choice. But I'm tired and sick as hell and I don't really care.

Much.

Okay...some.

Re:Russia needs to pass better laws (0)

Anonymous Coward | about 8 months ago | (#46000641)

So how is that different from the U.S. of A?

Signed,
Goldmann Sachs, Ben Bernanke, Enron, CGI, Etc., Etc., Etc.

Re:Russia needs to pass better laws (0)

Anonymous Coward | about 8 months ago | (#46000761)

That's not the point. The point is...Russia exudes apathy towards cybercrimes in the form of lax internal laws, which forces the rest of the civilized world to pay (literarily).

Re:Russia needs to pass better laws (1)

ColdWetDog (752185) | about 8 months ago | (#46000973)

That's not the point. The point is...Russia exudes apathy towards cybercrimes in the form of lax internal laws, which forces the rest of the civilized world to pay (literarily).

So? That may well be of value to Russia. What's in it for them? It is a form of economic warfare - Russia right now can't compete with the US / China / Europe on a number of levels. They may see this sort of thing as a tactical advantage.

Re:Russia needs to pass better laws (1)

TarPitt (217247) | about 8 months ago | (#46001285)

Similar to how the English Crown supported piracy against the Spanish in the 17th and 18th centuries?

Re:Russia needs to pass better laws (1)

alexander_686 (957440) | about 8 months ago | (#46002089)

Alas, it is Alas, it is a sirens trap. At the end of the USSR their engineers were great at reverse engineering technology but not so good at inviting stuff.

Today why build something good, solid, legitimate that can take on the west? Because of the kleptocracy of the state. I mean yes, it is a form of economic warfare, and it may win battles but it is destine to lose the war.

Re:Russia needs to pass better laws (4, Insightful)

sjames (1099) | about 8 months ago | (#46001555)

I wouldn't throw too many stones. In the U.S. you can go to jail for plugging your EV in to the wall for 20 minutes but crash the global economy and we'll write you a bonus check.

Every theft perpetrated by every malware writer behind the former iron curtain put together is peanuts compared to the Wall Street bandits.

Values vs cash (1)

OffTheLip (636691) | about 8 months ago | (#46000571)

Seems like an easy call from my chair but I am not, possibly, disenfranchised, poor, abused, indifferent, whatever. For many the return on investment (hey Wall Street) is too good to pass on. Just sayin...

Teenagers (4, Insightful)

girlintraining (1395911) | about 8 months ago | (#46000583)

I love teenagers. Only they would ask $2,000 to sell software that, if he got caught, would net him decades in prison. He may be a good programmer, but he's an idiot businessman -- risk versus reward.

russan prison and then what? (1)

Joe_Dragon (2206452) | about 8 months ago | (#46000625)

Russian prison and then what? unlike to be able to work in the usa

Re:russan prison and then what? (0)

Anonymous Coward | about 8 months ago | (#46000649)

No, the US would give him an H1B, and then initiate charges against him when he arrives... And in the US he would then face 10 years for each incident...

Re:russan prison and then what? (0)

mjwalshe (1680392) | about 8 months ago | (#46000757)

for the average geek - Death probably - Russian prisons are not fluffy places like the USA's supermax or Gitmo

Re:Teenagers (0)

Anonymous Coward | about 8 months ago | (#46000635)

He should have done like I did. Hack before it was made illegal.

No, not time travel.

He should look for and exploit new technology before the authorities legislate it under submission.

Re:Teenagers (3, Interesting)

DigiShaman (671371) | about 8 months ago | (#46000765)

He's a teen!!! The brain of a teen has been demonstrated [google.com] time and time again to have an underdeveloped sense of risk.

Re:Teenagers (4, Funny)

wonkey_monkey (2592601) | about 8 months ago | (#46000777)

That's so evolution can weed out all the really stupid ones before they get to procreate.

It doesn't seem to be working these days...

Re:Teenagers (1)

AmiMoJo (196126) | about 8 months ago | (#46004013)

Except that until fairly recently procreation tended to happen in the early to mid teens, pretty much as soon as girls became fertile. The period of maximum risk taking stupidity coincides with the child's early life, which I suppose might have the same effect in that the offspring of stupid people would have died with them.

Re:Teenagers (0)

Anonymous Coward | about 8 months ago | (#46000797)

Doesn't seem to make much of a difference. Most adults are just overgrown children with barely any ability to think about the future more than a few days ahead. I can only shake my head in shame when I see the stupidity of my coworkers.

Re:Teenagers (-1)

Anonymous Coward | about 8 months ago | (#46001083)

If shaking your head isn't working try bringing in a gun.

That'll sharpen 'em up right quick.

Re:Teenagers (1)

girlintraining (1395911) | about 8 months ago | (#46000921)

He's a teen!!! The brain of a teen has been demonstrated time and time again to have an underdeveloped sense of risk.

Which begs the question... how is he hiding all that money from his parents? Surely they must know something is up. They should join him in jail... for a much longer time.

Re:Teenagers (1)

DigiShaman (671371) | about 8 months ago | (#46000945)

Who knows. Typically most teens with new-found-money will spend and flash it around. At which point his parents know and decided to just play along (if not outright helping him shelter the wealth). OTOH however, this is Russia. He could be scared shitless by whatever mob he's working for. They may have told him to lay low...or else! But yea, your guess is as good as mine.

Re:Teenagers (1)

alexander_686 (957440) | about 8 months ago | (#46002117)

There is a difference in having a adventurous youth, making a poor judgment on occasion, and a deliberate plan that too months to execute.

On one had we have things like the “ILOVEYOU” virus – that I am somewhat lenient on and would fall into what you are suggesting. This Russian teen seemed to have a more thought out plan.

Re:Teenagers (1)

Spy Handler (822350) | about 8 months ago | (#46000821)

why would that net him decades in prison? He's guilty of writing a virus program, not stealing 60 million credit cards.

Like if I sold a gun to Guido, and later Guido murders 5 people with it, am I going to prison for life? No, I am just going to get charged with selling a gun to a felon.

Re:Teenagers (1)

mcfedr (1081629) | about 8 months ago | (#46000983)

it will/would if the usa ever get their dirty hands on him - really for just being smart enough to point out the flaws in a multinational's software.

Re:Teenagers (0)

Anonymous Coward | about 8 months ago | (#46002503)

Selling a gun to Guido knowing that he is going to use that gun to murder 5 people can get you charged as an accomplice to that murder.

Re:Teenagers (0)

Anonymous Coward | about 8 months ago | (#46001041)

you, Sir are a moron. he wrote the program and didn't implement it. might as well jail all of the gun manufacturers because guns can be used to kill people.

Re: Teenagers (0)

tysonedwards (969693) | about 8 months ago | (#46001103)

In the words of Charleston Heston: "Guns don't kill people; apes with guns kill people."

Re: Teenagers (1)

PNutts (199112) | about 8 months ago | (#46002475)

And then birds, cows, and a slug maybe.

Re:Teenagers (1)

PNutts (199112) | about 8 months ago | (#46002447)

Bad analogy. His programs are designed to be used maliciously. Guns aren't.

Re: Teenagers (0)

Anonymous Coward | about 8 months ago | (#46002883)

Yes, because guns were designed for, what? Oh, the good guys!

Re: Teenagers (0)

Anonymous Coward | about 8 months ago | (#46003695)

Yes, because guns were designed for, what? Oh, the good guys!

Homer: But Marge, a gun is a tool. Like a butcher knife or a harpoon, or uhh... an alligator.

Re:Teenagers (0)

Anonymous Coward | about 8 months ago | (#46003643)

Very true and well put.

Re:Teenagers (0)

Anonymous Coward | about 8 months ago | (#46006107)

So? It's still the fault of the people who used it maliciously. I don't like this sort of logic, because it is wrong to blame the makers of the tool for the actions of other people. We've also seen scummy copyright holders try to use this logic against people (VHS, for example).

Game Plan (0)

Anonymous Coward | about 8 months ago | (#46001043)

At $2000 every anti-virus company and investigator, etc will be buying. He probably makes more money selling to government agents and anyone that wants to check out the code than thru selling to a few cyber criminals.

The Russians did it! (0)

Anonymous Coward | about 8 months ago | (#46000605)

Mr. teacher, the Russians stole my homework! Or maybe the Chinese!

Ah, Ok, Timmy, you're excused.

who would make such a choice? (1, Interesting)

Anonymous Coward | about 8 months ago | (#46000633)

Windows "security" has been well know to be a joke since the very beginning. Why would any sane person run it on POS systems or other important infrastructure, and then proceed to tie those systems to the open internet? Unix would only have been a little better, if it was used in the same way.

That seems ....... insane. Sure, the hackers are responsible for hacking in, but if you leave the door of your house wide open with a sign in the front yard saying, "I have an expensive TV!", maybe you also bear some responsibility if someone walks in and steals your expensive TV set?

Will there be ANY accountability here by the people who made those decisions?

Re:who would make such a choice? (0)

Anonymous Coward | about 8 months ago | (#46000679)

Wow, someone does not like facing the truth, that how you design a system matters to how secure that system is.

The truth hurts, I guess, because there's no other reason that should have got modded to -1.

Re:who would make such a choice? (0)

Anonymous Coward | about 8 months ago | (#46001109)

No. It got modded to -1 because it was a shit post.

Remember OCCAM'S RAZOR and maybe try again after you've sharpened up your skills a bit more, m'kay?

Re:who would make such a choice? (1)

Anonymous Coward | about 8 months ago | (#46001163)

It wasn't a shill post, it got modded down by Microsoft shills, who have been known to mod any post critical of Microsoft down on here.

The post itself made the point that Linux wouldn't have been much better.

Re:who would make such a choice? (1)

CastrTroy (595695) | about 8 months ago | (#46004499)

It doesn't matter which operating system is being used. Windows can be perfectly secured if you configure it properly. Linux can be just as easily owned if set up by someone who has no idea what they are doing. A weak root password and bind sash to a remotely accessible address (which seems quite convenient if you don't consider the security aspects) and the machine is trivially rootable. No matter which OS is used, there should be a hardware firewall in front with no open ports. Only way to communicate is over VPN. That, or not even store all those credit card numbers. They probably shouldn't have been storing them in the first place.

Who is better: IntelCrawler or NSA? (1)

Anonymous Coward | about 8 months ago | (#46000645)

IntelCrawler uncovers six active attacks on U.S. merchants and traced the Target attacks back to a specific person in Russia. How come IntelCrawler can figure it out? Is the NSA asleep at the wheel?

Re:Who is better: IntelCrawler or NSA? (1)

ganjadude (952775) | about 8 months ago | (#46000851)

seriously. We keep hearing about how the NSA NEEDS all the data traffic in the world yet it takes a 3rd party a few weeks to find the guy and the NSA hasnt done jack shit

Re:Who is better: IntelCrawler or NSA? (0)

Anonymous Coward | about 8 months ago | (#46000949)

,,,, and the NSA hasnt done jack shit

His number was not relevant....

Re:Who is better: IntelCrawler or NSA? (2)

ColdWetDog (752185) | about 8 months ago | (#46000995)

To be fair, all this guy has done is claim to know who the programmer is. He doesn't have any proof. He is, however, making himself famous for a few minutes.....

And, for all we know, the NSA wrote the damned thing themselves in order to infiltrate the Russian mafia. It's not like they tell us what they're doing.

Re:Who is better: IntelCrawler or NSA? (1)

davidhoude (1868300) | about 8 months ago | (#46002525)

How exactly do you know what the NSA is and is not doing? I get it, we gotta trash talk the NSA in every /. post.... Even if that means making wild assumptions about things we don't know anything about.

Re:Who is better: IntelCrawler or NSA? (1)

ganjadude (952775) | about 8 months ago | (#46004633)

I would say its a pretty good bet being that If I were running the NSA and I had absolutly zero public trust as they do right now, I would be screaming for his head so I can say see, we are useful. But they dont

NSA doesn't care (0)

Anonymous Coward | about 8 months ago | (#46001059)

It's NOT phone data so why does the NSA care.

Re:Who is better: IntelCrawler or NSA? (1)

scarboni888 (1122993) | about 8 months ago | (#46001111)

Who do you think GAVE IntelCrawler their data?

That's right, there is No Such Agency!

Re:Who is better: IntelCrawler or NSA? (0)

Anonymous Coward | about 8 months ago | (#46001279)

What makes you think IntelCrawler isn't an NSA front?

Enquring minds want to know... (4, Interesting)

jayveekay (735967) | about 8 months ago | (#46000653)

How did they get the malware deployed onto thousands of POS terminals without anyone noticing?
After the malware collected the data, how did the POS terminals report the stolen data back to the controller?
Are these POS terminals just directly connected to the internet?

Re:Enquring minds want to know... (1)

Joe_Dragon (2206452) | about 8 months ago | (#46000709)

did they hack the system on what an new image was being build on?

Re:Enquring minds want to know... (1)

Anonymous Coward | about 8 months ago | (#46000721)

Yeah, no second network for internet access at target.
The distribution method is not publicly known at this time. It is safe to assume a distributed update.

Re:Enquring minds want to know... (0)

Anonymous Coward | about 8 months ago | (#46000813)

How did they get the malware deployed onto thousands of POS terminals without anyone noticing?

Well they contracted out their IT operations to Durkadurkastan. When you pay someone the equivalent of US$2000 a year and you give them access on that magnitude, of course they're going to say yes when someone offers them US$20,000 to plant malware on the network. That's 10 years of paychecks for some nobody in Bangalore, just to install a trojan. Nothing but American corporate stockmarket-driven greed, business as usual led to the entire nightmare.

Re:Enquring minds want to know... (0)

Anonymous Coward | about 8 months ago | (#46001029)

That's the easy part. Target outsources its IT services.

Re: Enquring minds want to know... (0)

Anonymous Coward | about 8 months ago | (#46001117)

POS Stations such as these pxeboot.
All you need to do is infect one central server and all the stations are infected come start of business next day.

Re:Enquring minds want to know... (1)

AmiMoJo (196126) | about 8 months ago | (#46004019)

Yes, they are connected to the internet. It depends on the system, some have a server in the store which they talk to and it has a VPN connection back to head office. Some just connect directly to the internet via the store's router. They use encryption to secure the connection, of course.

It appears that the deployment was simply a case of adding the malware to the POS terminal firmware and rolling it out as an update. Data was reported back to servers at head office, which they had also compromised.

mmmm (4, Funny)

codepigeon (1202896) | about 8 months ago | (#46000657)

Steak magnetic card strips....mmm

publicity stunt (1)

Anonymous Coward | about 8 months ago | (#46000659)

How much did Verifone pay for this sparkling review?!?

Steak (2)

rossdee (243626) | about 8 months ago | (#46000681)

" which allowed hackers to steak magnetic card-strip data on 40 million debit- and credit cards"

Of course steak is very much a luxury food in Russia

two simple questions (1)

Anonymous Coward | about 8 months ago | (#46000741)

Why to use Windows?

Why to have network connection to outside?

Re:two simple questions (4, Interesting)

ganjadude (952775) | about 8 months ago | (#46000863)

the network connection to the outside is for the credit app. I work for a company who deals with verifone pinpads and no internet, no pinpads. I would like to think that something like that could be on a secure secondary line locked down from HTTP and other traffic but it does not seem like they set it up that way

Re:two simple questions (1)

ColdWetDog (752185) | about 8 months ago | (#46001009)

I work for a company who deals with verifone pinpads and no internet, no pinpads...

This company lets a guy with the nic 'gangadude' work on Internet enabled POS terminals?

They must be smoking something.

Re:two simple questions (1)

shutdown -p now (807394) | about 8 months ago | (#46003573)

Well, maybe they're selling the thing they're smoking.

Re:two simple questions (1)

ganjadude (952775) | about 8 months ago | (#46004627)

Because one cannot separate personal life and professional life. Let me guess you think no professionals ever do anything of the sort right?

Did he get a good price? (0)

Anonymous Coward | about 8 months ago | (#46000759)

Anyone here know whata the going rates are for exploits like this? Forzero-day exploits? For newly-discovered exploitable bugs?

I'm writing a story and it could help to get the facts right.

-- hendrik

Name Names Or STFU! (2)

Anonymous Coward | about 8 months ago | (#46000783)

spotted similar attacks that are still in progress against six other retailers. Andrey Komarov, CEO of the Los Angeles-based IntelCrawler, told Reuters Jan. 17 that his company had spotted the six ongoing attacks while analyzing Web traffic in search of the specific entry points and origin of the malware infection behind the Target data breach

I call bullshit! He claims to have spotted ongoing attacks on six other retails which he conveniently fails to name.

Name names or STFU!

Another needlessly ambiguous Slashdot headline... (3, Insightful)

wonkey_monkey (2592601) | about 8 months ago | (#46000785)

Analyst Calls Russian Teen Author of Target Malware

"Calls" as in calls him on the phone? Or "calls" in the more casual sense of "identifies"? Because there's a word for that - "identifies."

Re:Another needlessly ambiguous Slashdot headline. (0)

Anonymous Coward | about 8 months ago | (#46001093)

Identifies is more certain, "calls" is speculative. i can call you autistic but only because i have identified you as a pedant.

Re:Another needlessly ambiguous Slashdot headline. (1)

wonkey_monkey (2592601) | about 8 months ago | (#46002113)

Well, you'd be wrong, about the autistic part at least, with that sweeping piece of false equivalence. Still, call me that if you wish - it's an adjective and as such is not ambiguous the way this headline is.

Analyst calls Russian teen "author of Target malware"
Analyst calls "Russian teen author of Target malware"

Two different meanings from the same words. Sorry if you don't feel this is important in a news headline, but I'm not sure why it annoys you so much that I do feel it's important that you had to be a dick about it.

Re:Another needlessly ambiguous Slashdot headline. (0)

Anonymous Coward | about 8 months ago | (#46002245)

Sorry, unlike you I'm actually capable of understanding what is implied in human speech based on context. I'm sorry that your that your aspergers prevents you from this. Maybe one day there will be a cure and you will no longer have to live with a defective brain.

Re:Another needlessly ambiguous Slashdot headline. (1)

YumoolaJohn (3478173) | about 8 months ago | (#46006235)

Please, tell me more, Internet psychologist!

Credibility? (3, Interesting)

whoever57 (658626) | about 8 months ago | (#46000805)

IntelCrawler was registered late last year, and its address is a mailbox in a UPS store.

Has anyone heard of Andrey Komarov before this? Does he have any kind of track record? Or is he just another fame whore with a dubious story?

Re:Credibility? (1)

Anonymous Coward | about 8 months ago | (#46001251)

Like most Russian "security experts" he's really just the protection angle of the shakedown. His crew develops the malware and then he "discovers" it and sells you a solution. The Russians have been doing this shit for decades.

Re:Credibility? (0)

Anonymous Coward | about 8 months ago | (#46001465)

This is slashdot. You don't need credibility.

IN 17 years? (4, Informative)

scarboni888 (1122993) | about 8 months ago | (#46001069)

How in the world does a 17 year old get intimate detailed knowledge of the internal workings of POS systems??

Was I the only child who grew up in a home devoid of POS terminals to tinker with or something?

Re:IN 17 years? (1)

Anonymous Coward | about 8 months ago | (#46001189)

It was running Windows, which was part of the problem.

Witch-hunt (1)

zugedneb (601299) | about 8 months ago | (#46001351)

this is called witch-hunt.
Identify someone with godlike, impossibile knowledge and nail the fucker. Thusly, the righteous has won.

Say, you can prove that it is barely possibile to have that knowledge at age 17, unless, someone points it out to him. Now, if he is, quite possibly, an adept programmer, he might use this knowledge.
But in russia, all know about brutality of others... I dont think he would dare, not at 17...

Anyways, who will listen to the protest of the rational?

Re:IN 17 years? (0)

jader3rd (2222716) | about 8 months ago | (#46001551)

How in the world does a 17 year old get intimate detailed knowledge of the internal workings of POS systems??

They're the only ones that Target hires to run it's systems. Anybody older would be too expensive.

Re:IN 17 years? (1)

scarboni888 (1122993) | about 8 months ago | (#46001575)

Target has outlets in Russia?

I had no idea... well you learn something new every day, I suppose.

Re:IN 17 years? (3, Informative)

plover (150551) | about 8 months ago | (#46002473)

What makes you think he has " intimate detailed knowledge of the internal workings of POS systems"? Sorry, that was a trick question. He doesn't care how POS systems work, or how sophisticated they may be. He only cares what credit card mag stripe data looks like. His malware scrapes the RAM of the process looking for the tell-tale patterns of mag stripe data, and grabs it. See http://www.us-cert.gov/ncas/alerts/TA14-002A [us-cert.gov] , which says "There are several types of POS malware in use, many of which use a memory scraping technique to locate specific card data. Dexter, for example, parses memory dumps of specific POS software related processes looking for Track 1 and Track 2 data. "

The track data just has to be in the RAM of the process, and this software finds it and logs it.

So now we know: Russia is responsible for crap tha (1)

juliuszs (1269402) | about 8 months ago | (#46001369)

So now we know: Russia is responsible for crap that MS passes as "secure software". Bomb the Evil Empire (you select which one).

Why mention the age (1)

jader3rd (2222716) | about 8 months ago | (#46001545)

If he was a little bit older the news wouldn't be reporting the age. The age is just creating a bias where there doesn't need to be one. It's just playing on a certain group of peoples fears that all young people are out to get them. It probably stems from guilt about how they find certain people achieving more in life than they did, and at first you could handle that because they were older. But then as they got older the achievers became younger and they never learnt how to cope with that.

Re:Why mention the age (0)

Anonymous Coward | about 8 months ago | (#46004397)

Because demonizing teenagers is how the old media attracts views through sensationalism essentially. You can see it in contexts of when they identify as a teen. If they commit a crime, even if they're 19 they're called a teen by them. They dispropronately cover any youth crime as if they were the main source of crime. They're not, at all. They contribuite to stuff like the fascistic curfews by asserting that nothing good is done by teenagers out at night and implicit victim blaming teenaged rape and/or murder victims for being out then. Not like they had a dog to walk or anything, no. Even if they don't feel slighted it still sends a message that they're not welcome, surprise when they never show up.

Years later, the media suits panic. The newer generation won't buy or view them! They're adults, why aren't they buying! They're credible sources right? Oh wait, they already destroyed it long ago with moral panics about what "kids these days" are doing that the kids knew trivally were bullshit. Pharm parties where kids randomly mix prescription medications together in a bowl and pick randomly like candy! In addition to being a stupidly dangerous idea even by drunken party animal standards, asprin, antibotics, and heart meds won't get anyone high. Even the most desperate drug-seekers only seek out known classes, not everything in the fucking medicine cabinet! Rainbow parties where boys get blown by seven different girls with different lipstick? Butt chugging! Nah if they were illicitly consuming alcohol they'd just drink it! When you lie like the fucking Iraqi information administrator it is no wonder they don't see you as a less credible source of news than rumors and testimony of drunks!

The millenial bashing is just doubling down on an unsustainable business model in digging themselves deeper. The newspapers have recieved a slight repreeve if only for their classified sections.

ISR (0)

Anonymous Coward | about 8 months ago | (#46001635)

In Soviet Russia, teen author calls you ANALYST!

Typical pothead (0)

Anonymous Coward | about 8 months ago | (#46002505)

Any surprise that "Reefer" is both a drug addict and a credit-card stealing criminal? Fucking worthless potheads.

Re: Typical pothead (1)

Badblackdog (1211452) | about 8 months ago | (#46002645)

Fuck You!
Weed has nothing to do with it. Dick.

I worked on Target POS systems in ‘99 (4, Interesting)

Anonymous Coward | about 8 months ago | (#46002697)

Just before the dreaded Y2K doomsday event everyone, everywhere (well lots anyway) I was subcontracted to upgrade all the motherboards in area Target stores.
The motherboards were very simple, very basic units with pretty much everything integrated IE video, ethernet, etc.. They are diskless. Nothing plugged into the slots.
The cases were small, low profile and of course there is one at every register and several at the customer service desks.

At that time they were booting XP from LAN with PXE/TFTP.

ALL the POS terminals load the same, single image from a server. Infect the server and all terminals become infected.
Because everything is diskless, everything is piped back to backend servers in real time.

I did not go into the back of the store or see any hardware other than the POS terminals, I whored myself out as a screwdriver grunt for some easy cash.
I would assume that the OS image the terminals boot is standardized across all their stores and is sent down from corporate hive.
This leads me to believe that they somehow got to THAT image and compromised it, thus infecting all terminals nationwide.
So they didn't have to hack thousands of terminals, they just had to hack one boot image at corporate and they owned the nation.

A national shame on our government and capitalism (1)

asjk (569258) | about 8 months ago | (#46003131)

This is embarrassing if true. For me the target of ire is much closer to home. It has been said that the free market will produce the best product. Isn't it also true that we should deserve the national defense that we buy? Haven't these transgressions happened often enough now that our economic institutions should have more secure systems that protect the consumer from intrusions? How about the money spent on government surveillance? Shouldn't they secure us from threats that compromise enterprise and privacy? We should learn from the laboratories of other democratic societies to inform our transition to a system of capital exchange that is more appropriate of a world superpower. Securing our boarders also means safe money transfers.

He's prob. rich by now (0)

Anonymous Coward | about 8 months ago | (#46006363)

He's probably already got a $1M/year job offer from Kaspersky, who given their ties to the Russian govt. the kid will be a national hero, not go to jail.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?