Police use hacker forum material as training manuals

NSW Police has appropriated material from criminal credit card trading forums as training manuals in its fight against credit card fraud.

Linked gallery: Photos: Security on the move comes to Sydney

Detective inspector Bruce van der Graaf described a thriving, organised marketplace for stolen identity and credit card details at SC Magazine’s ‘Security on the Move’ event in Sydney today.

Although international law enforcement has eyed credit card fraud, or ‘carding’, for the past decade, thieves continue to operate on private networks and overt online forums.

Van der Graff played a recruitment video by Russian hacker ‘PlayBoy’ that spruiked the ease, lifestyle and financial rewards of credit card fraud.

He highlighted alleged TJX hacker Albert Gonzalez’s $75,000 birthday party and Ukrainian carder Maksim Yastremskiy, whose criminal activities reportedly yielded more than $11 million.

“The money that this type of person can make – and [Gonzalez] wasn’t a particularly good coder himself, he got other people to do his technical work for him – is ridiculous,” van der Graaf said.

“What he was is a man with a hacking mentality who looked for exploits.”

Locally, NSW Police strike forces Keaver, Baywood and Cranbrook have uncovered carders who were linked to illegal drugs, outlaw motorcycle gangs and Eastern European carding cartels.

One Lithuanian hacker, arrested in March last year, had gained access to a medical records database that housed records for several healthcare providers in Sydney.

That database gave him access to Government-issued Medicare numbers, dates of birth, full names and addresses of patients.

“There are plenty of young Aussies out there – we’ve arrested a couple this year and have got a few on the boiler – who are involved in carding,” he said.

Law enforcement were challenged by decentralised, organised, international carding syndicates with Australian or American teams that went shopping with stolen card details within ten minutes of their theft.

Forums like carder.org, CarderPlanet and the International Association for the Advancement of Criminal Activity (IAACA) also offered “very good” manuals for identity theft

Van der Graaf said they made “very good Police training manuals”, noting that NSW Police’s cybercrime fighters had a few of those hacker documents in their offices.

“It’s that easy for a young person to find these [carding] sites with a little bit of guidance and get involved in it and try and avoid law enforcement attention,” he said.

“There is a market, and people involved in the hacking are not cashing out.”