OPERATION PHISH PHRY

This article discusses the effects of one of the most common forms of identity theft; phishing. A good one sentence definition of phishing is that it’s unsolicited requests for personal information (http://onecare.live.com/site/en-Us/article/phishing_what.htm). Operation Phish Phry is another example of international cyber crime involving 50 individuals in the US and 50 from Egypt which netted about $1.5 million. With cooperation from various US law enforcement offices along with Egyptian elements perpetrators of the fraud were charged with various crimes including aggravated identify theft. These last two postings are example of two of the biggest cyber crime related incidents that the US has been involved in to date.

Major Cyber Fraud Takedown   10/07/09

Nearly 100 people were charged today in the U.S. and Egypt as part of Operation Phish Phry, one the largest cyber fraud phishing cases to date. It’s the latest action in what Director Robert Mueller described in a major address today as a “cyber arms race,” where law enforcement and criminals compete to stay one step ahead of each other on the ever-expanding virtual frontier.

Cyber thieves “phish” for personal information such as usernames, passwords, and financial account details by tricking users into thinking their sensitive information is being given to trusted websites when, in fact, the sites are traps.

The defendants in Operation Phish Phry targeted U.S. banks and victimized hundreds and possibly thousands of account holders by stealing their financial information and using it to transfer about $1.5 million to bogus accounts they controlled. More than 50 individuals in California, Nevada, and North Carolina, and nearly 50 Egyptian citizens have been charged with crimes including computer fraud, conspiracy to commit bank fraud, money laundering, and aggravated identify theft.

During the two-year investigation led by our Los Angeles office, we worked closely with the Secret Service, the Electronics Crimes Task Force in Los Angeles, state and local law enforcement, and our Egyptian counterparts—the first joint cyber investigation between Egypt and the United States. Such a cooperative effort illustrates “the power of our global partnerships,” Mueller said during his speech in San Francisco to address the criminal cyber threat and what we’re doing to combat it.

While Phish Phry defendants were being rounded up, Mueller told his audience, “The FBI is both a law enforcement and national security agency, which means we can and must address every angle of a cyber case. This is critical, because what may start as a criminal investigation may lead to a national security threat. … At the start of a cyber investigation, we do not know whether we are dealing with a spy, a company insider, or an organized criminal group.” In the case of Operation Phish Phry, money appears to be the driving motive. But as Mueller pointed out, “Something that looks like an ordinary phishing scam may be an attempt by a terrorist group to raise funding for an operation.”

Mueller’s remarks came during National Cybersecurity Awareness Month, an annual event sponsored by the Department of Homeland Security to help educate the public on the shared responsibility of protecting cyberspace.

“Cyber crime might not seem real until it hits you,” Mueller said. “But every personal, academic, corporate, and government network plays a role in national security.” To help battle the cyber threat, the Bureau relies on strong partnerships—with law enforcement and intelligence communities worldwide, and with universities, corporations, small businesses, and citizens.

Within the government, we have established the National Cyber Investigative Joint Task Force, which brings together law enforcement, intelligence, and defense agencies to focus on high-priority cyber threats. Within the private sector we run InfraGard, where we exchange information with 32,000 partners from private industry.

But even with all our partnerships, Mueller added, “we are still outnumbered by cyber criminals.” Which is why it’s so important for people to do their fair share. That means protecting your home computer with firewalls, anti-virus software, and strong passwords.

“We all have a responsibility to protect the infrastructure that protects the world,” Mueller said.

$9 Million Stolen In Single Day

This article ties in with the posting that discusses globalization. It is an excellent example of the global reach and sophistication of skilled everyday computer users and the damage that they could enact.

HIGH-TECH HEIST
2,100 ATMs Worldwide Hit at Once   11/16/09

It was a highly sophisticated and cleverly orchestrated crime plot. And one unlike any we’ve (the FBI) ever seen before.

It culminated a year ago this month—on November 8, 2008—when a wave of thieves fanned out across the globe nearly simultaneously. With cloned or stolen debit cards in hand—and the PINs to go with them—they hit more than 2,100 money machines in at least 280 cities on three continents, in such countries as the U.S., Canada, Italy, Hong Kong, Japan, Estonia, Russia, and the Ukraine.

When it was all over—incredibly within 12 hours—the thieves walked off with a total of more than $9 million in cash. And that figure would’ve been more, had the targeted ATMs not been drained of all their money.

The alleged masterminds of this slick scheme—prosecutors charged earlier this month following an extensive FBI investigation assisted by other federal agencies and our partners around the globe—were three 20-something Eastern Europeans and an unnamed person called simply “Hacker 3.”

Working together, the four hackers cooked up “perhaps the most sophisticated and organized computer fraud attack ever conducted,” according to Acting U.S. Attorney Sally Quillian Yates of the Northern District of Georgia.

• It started when a 28-year-old Moldovan man learned of a vulnerability in the computer network of a major credit card processing company based in Atlanta. With an eye toward exploiting it, he passed that information to a hacker living in Estonia.
• The Estonian conducted “reconnaissance” on the network vulnerability and shared what he learned with a hacker in Russia.
• With the help of the three other hackers at varying times, the Russian busted into the electronic network, reverse-engineered the PIN codes from the encrypted system, and raised the limits on the amount of money that could be withdrawn from the prepaid payroll debit cards. (These cards, used by many companies, enable employees to withdrawal their salaries from an ATM.)
• In addition to providing computer support, Hacker 3 managed the network of thieves around the world—called “cashers”—who used a total of 44 counterfeit cards to withdrawal the $9 million. The Estonian also managed his own cashing group.
• As the cashers went to work, the Russian took the lead in monitoring the victim company’s database to track the illegal withdrawals. With the Estonian, he later deleted or tried to delete files on the computer network to cover their tracks.
• When the ATM thefts were complete, Hacker 3—with the help of the Estonian—gathered and divvied up the proceeds. The cashers got to keep 30 to 50 percent of the money they stole; the rest went to the four hackers.

Fortunately, the company reported the breach immediately, and  quickly got to work. Our ensuing case was made with a great deal of international cooperation and even led to joint investigations overseas. Suspected cashers, for example, have also been identified and arrested in Estonia and Hong Kong.

The case is a testament to both the globalized nature of crime in today’s world and the international reach of the FBI, which depends more and more on a network of 61 overseas offices worldwide to protect the U.S. from a range of national security and criminal threats.

Senate Judiciary Committee Hearing on FBI Oversight of cyber threats