Reporting From the Web’s Underbelly

Interesting sidenote in the Target hack. First, something that you might not know: not one of these breaches (that is Target, Neiman Marcus, Michaels, etc.) was discovered by the actual affected companies - they were all discovered by bank and security officials in the underground markets.

Bank and infosec people worked out a while ago that rather than wait for breaches to be discovered, it'd be best to set yourself up on the underground markets in the guise of a purchaser - buy up cards, correlate purchase history and work out who has been hacked. It is this type of reconstruction that lead back to Target, Neiman Marcus, et al.

Target was discovered not too long after the hackers had ramped up their sniffing, and with the response from banks and computers it meant the overall 'score' wasn't that great. A hack that should have provided enough dumps for the entire underground for more than a year ended up lasting weeks.

So score one for the good guys.

The problem now is that the black hat groups have wizened up to this. A few things are happening.

First, there has been a bit of a purge of users in the forums. It is harder than ever to get into the private forums.

Second, cards are now being 'laundered'. You take dumps from different sources and combine them together, to the point where it would be difficult to find out where the cards were stolen from. Being from a particular source used to be a selling point for the traders, but now they are blurring a lot of that info out and combining different dumps and then slicing them for sale in other ways (usually IBAN, State and Expiry).

The public 'auto sites' that sold these dumps have all been taken down, after getting a lot of attention over the Target attack. Many complete novices sought out the underground sites after the Target breach reporting in the mainstream media, flooding the forums with newbie questions and requests in a mini eternal september.

It is possible that with the underground adapting in this way and the state of security still being so poor that we won't even find out about the next big breaches.

As a security researcher I frequently find botnet command & control panels that have a picture of Krebs' face above the login form. Domain names similar to "briankrebsisachildmolestor.com" are sometimes used to host malware and botnets.

Considering all that, plus the real-life harassment he's gotten (death threats, the heroin framing attempt, SWATing), I hope he invests in a good home security system. Or a security guard.

As far as pranks go thats actually pretty good. Better than 4chan's pizzas.