Scary: Meth addicts' other habit: Online theft

Check this out - scary, but good reading - by good I mean how to watch out for yourselves and organizations, not to try out. Notice that what can be done to help prevent this from happening to you and yours requires a little bit of knowledge, common sense, execution and regular reviews of what you are doing:

Link: http://www.usatoday.com/tech/news/in...ne-theft_x.htm

Summary from the story:

Quote:

---

How meth addicts contribute to Cybercrime

Methamphetamine users and traffickers often form localized identity-theft rings, in which addicts take on defined roles based on boldness and skills. Local identity-theft scams often revolve around use of computers and the Internet — and increasingly involve foreign cybercrime groups.

How meth addicts collect data:

Dumpster diving
Businesses that don't shred discarded paperwork are prime targets, especially financial firms, customer service call centers, car-rental agencies, large retail chain stores and hotels.

Mailbox theft
Residents who leave outgoing letters for their mail carrier to pick up are vulnerable. Thieves go after credit and checking account information. Incoming mail also is sought after, especially credit card balance transfer promotions.

Car break-ins
Driver's licenses, credit cards, cameras and laptop computers left in parked cars are prime targets. Credit cards are often used quickly at casinos or convenience stores. Laptops holding client or employee databases are highly prized.

How meth addicts use stolen data:

Creating bogus checks Using software such as Versa-Check, addicts can create checks imprinted with a stolen checking account number and a random name, backed up by fake ID.

Manipulating bank accounts
Addicts can change a billing address, order new debit and credit cards, raise credit limits and make cash transfers to other accounts under their control.

Selling bank account access to cybercrooks
Meth rings pitch bank account access to foreign crime groups looking to launder funds. Cash is extracted at the local level, then routed to the foreign group.

Overseas connections:
Global cybercrime groups use e-mail phishing scams, viruses, spyware and database theft to steal credit card numbers and Social Security numbers and to hijack online accounts. Local theft rings help them cash in.

Communications
Local theft rings buy, sell and trade identity data and negotiate other ventures with global groups via private instantmessaging lines, called Internet Relay Chat channels.

The marketplace:
Daily transactions: Local and global rings sell to, and buy from, the market for identity profiles containing account access details and other personal data. Example: A local ring can buy a full profile of a U.S. citizen — supplied by a global group — for $200.

Partnerships:
Local rings can help global groups launder hijacked funds through local bank accounts. Example: $2,000 in stolen money is transferred to an online account controlled by a local ring. A street addict withdraws the cash. $500 is routed back to the global group; $1,500 is payment to the local ring.

Payments
Many deals culminate with cash changing hands. Most often, cash gets wired via Western Union or online payment services, such as PayPal or Neteller, which bypass restrictions on bank-tobank transfers.

---

People trying to escape reality, causing others pain.

Very good article. I was going to make a joke about how your summary of the USA Today (what I call McPaper) was probably almost the whole article.

Yeah, scarey.

Quote:

---

How meth addicts contribute to Cybercrime

---

LOL their was just an epidsode on television about this last week. Cold case.

Quote:

---

Very good article. I was going to make a joke about how your summary of the USA Today (what I call McPaper) was probably almost the whole article.

---

Heh - yes - I probably should have stated "Extreme-Summary" or "Summary+" - kinda in college - I would start highlighting all of the "important" stuff and realize I ended up highlighting damn near the whole text... too bad I used that black highlighter. Heh.

Quote:

---

LOL their was just an epidsode on television about this last week. Cold case.

---

Heh - well this way they can make sure that the people engaged in these activities see what the general public now knows, and then the criminals can change their methodology in confidence.

Yeah, they had a similar article in the communications of the acm mag this month.

Wow that is scary


And to think i thought all meth addicts were cooks

Great read,

One thing I always love is the deniability from companies when there might have been a data breach.

Quote:

---

Neiman Marcus spokeswoman Ginger Reeder says no records of sensitive customer information are printed out at the call center. If any such information made it into the trash, "It would be a breach of company policy and an isolated incident," says Reeder.

---

Quote:

---

Convergys spokeswoman Lauri Roderick disputes Mary's account. The Cincinnati-based company has a "strict clean-desk policy" that requires shredding of any sensitive paperwork, she says. And Sprint customer-service calls, she says, were never handled by the 1,200 workers at the Mill Woods facility, one of 14 in Canada. "We're confident there has been no breach in security of our customers' data," Roderick says.

---

What's actually more scary is that this activity isn't specific to meth addicts. The McArticle (love that) doesn't state this though.

The true root cause is motivation and the understanding that opportunity exists simply because most people aren't concerned with creative ways to feed bad habbits.

Quote:

---

One thing I always love is the deniability from companies when there might have been a data breach.

---

Of course they are going to deny it. They do not want the general public knowing about a data breach within their company. They know it will HURT if not, kill business. 90% of companies that have been breached (data migration, data lost etc...) go to the wall within 12-24 months. Theirs an old saying in which I live by

silence is golden. ;)

Quote:

---

Of course they are going to deny it. They do not want the general public knowing about a data breach within their company

---

Not true, although some companies will deny any data breaches until faced with the legalities of the situation, most companies will not when faced with media and public relations. This changes when the a PR situation transfers into crisis management at which point your policies regarding those PR situations no longer apply.

When there are small breaches in the security of data, as quoted in the article, most companies will try and save face by applying an isotropy of modeling. Lets look at the quotes I used from the article.

Quote:

---

Neiman Marcus spokeswoman Ginger Reeder says no records of sensitive customer information are printed out at the call center. If any such information made it into the trash, "It would be a breach of company policy and an isolated incident," says Reeder.

---

This is nothing more than good standard PR situational management. If the company has in place policy to prevent such incidents from occurring, quote that policy. Then relate that such situations are rare and a breach of policy while never denying nor admitting the incident occurred.

Quote:

---

Convergys spokeswoman Lauri Roderick disputes Mary's account. The Cincinnati-based company has a "strict clean-desk policy" that requires shredding of any sensitive paperwork, she says. And Sprint customer-service calls, she says, were never handled by the 1,200 workers at the Mill Woods facility, one of 14 in Canada. "We're confident there has been no breach in security of our customers' data," Roderick says.

---

PR situational management in this case is “deny, deny, deny” not a very good policy if you are not 100% positive that a data breach could not have occurred. If they should find security easily breached at this facility you now have a PR nightmare on your hands.

Quote:

---

They know it will HURT if not, kill business.

---

In my experience it all depends on how the company handles the situation. If a company has a great reputation with there customers and the customers are loyal then there is no reason why the company cannot save itself from most situations. It all depends on the situation and how the situation is handled.

Quote:

---

90% of companies that have been breached (data migration, data lost etc...) go to the wall within 12-24 months.

---

Do you have hard data to prove this if so I would like to see it. I have not seen any data that proves companies “go to the wall within 12-24 months”. As I said before it all depends on the situation and how the company handles that situation.

I'm not surprised by this (meth addicts using cybercrime to fund their habbit) - as I've said to people 'Anything crime in the physical world will happen in the cyberworld...and new ones'. You can go nuts comparing physical with cyber anologies...I'm too tired to put any here but there are lots of them.

What I find more fascinating is that for some reason, people still have a hard time letting go of old perceptions. That perception being that only educated people have computers. Reality is that a computer is very much like a car - *everyone* has access to one, even the dirt bags, criminals, sexual preditors, freaks, snake oil salemen, etc.

--Th13

I was just slightly surprised that meth addicts would still have enough brains left to run a scheme like this. 'Course when one gets desperate or the need is strong enough - then I would surmise that a lot can be accomplished... except kicking the habit and moving on with life.

What do you get when you mix a former and disgruntled IT guy who is broke, a heavy meth user, and a company he helped to create?:confused:

A sorry excuse for a human being who looks to tarnish a companies image by robbing it of customer information so he can profit from it and buy more meth to support his endless habit. His only concern seems to be how he can obtain more drugs to feed his addiction. Since he still knows some of the names and passwords at the company he helped to build, he decides to do a line or two of meth, throw basic human decency to the wind and sets off on a data mining bindge of the servers he helped to set up. After which he runs credit on the unknowing public and sets out to destroy their fragile lives without any consideration for anyone other than his drug addict self. What a low life, scum of the earth!

If computers run the world what happens when those in charge of the computers run on meth? :confused:

Those poor masses of people, unaware of the drug addict handling their personal information.

:mad: Need to get out some anger....beat a meth addict sensless! I know I want to!

If these guys are good informational gathers... I bet the CIA could use some tips ;)