US authorities have charged four men with orchestrating “the largest theft of customer data from a US financial institution in history” in indictments unsealed on Tuesday.
The “massive computer hacking crimes” affected 100 million people and targeted employees, databases and customers of JP Morgan Chase, Dow Jones and Fidelity Investments. Fidelity has said that no customer information or related systems were breached. Twelve victims spanning the globe are identified by pseudonym (“Victim-1, Victim-9”) in the indictment.
The accused are Israelis Gery Shalon, the self-described founder of the group, and Ziv Orenstein, along with Americans Joshua Aaron, who is still at large, and Anthony Murgio.
Manhattan US attorney Preet Bharara said the three were responsible for “one of the largest cyber hacking schemes ever uncovered”. He said their hacking was “breathtaking” in size and scope.
Shalon, who allegedly called his stock-inflation scheme “a small step towards a large empire”, ran what officials describe as “a sprawling cybercriminal enterprise” with “hundreds of employees, co-conspirators and infrastructure in over a dozen countries”.
Shalon is said to have described the plot himself to an unnamed co-conspirator: “We buy [stocks] very cheap, perform machinations, then play with them.” But, wondered the anonymous confederate, is playing the market really that popular in the US? “It’s like drinking freaking vodka in Russia,” Shalon answered.
The vast organization sold counterfeit pharmaceuticals, malware, and ran an elaborate and technical con to bypass checks on illicit debit and credit card transactions in order to shield their customers from the law, disguising criminals giving and receiving payments as wedding dress and pet supply stores.
The globetrotting conspiracy hacked servers in Egypt, the Czech Republic, South Africa and Brazil, among other countries, in one instance exploiting the notorious Heartbleed bug. The unnamed team-mate then installed malware on the servers, providing the group with “persistent access” to the victim companies’ networks, allowing them to steal data as they wanted it, sometimes over months.
Then, with personal information harvested from those networks – and with access to the emails of “top managers” at financial institutions – the group began emailing people it believed could be fooled into investing in stocks the organization would artificially inflate. It also began targeting companies to “pump and dump”.
The group convinced some private companies to offer their shares publicly. To avoid arousing suspicion, Shalon would engage in “reverse mergers” with internationally traded shell corporations he controlled and operated. Then the group would carefully shore up the prices of the stocks by buying them on successive days. Shalon and his group would send phony “tips” on the rising share price via email spam sent to millions of people, and cash out when the price was high enough, causing the stocks of the companies they had tricked into going public to crater.
The group earned millions of dollars this way.
They also marketed their illegal online casinos with the same multimillion-account email spam lists. “Through the casino companies, Shalon, Orenstein and their co-conspirators generated hundreds of millions of dollars in unlawful income, at a minimum,” wrote Bharara in the indictment, “earning up to millions of dollars of profits each month.” Shalon and his partners also orchestrated attacks against fellow online casinos, stealing customer information executives emails and even crippling competitors with distributed denial of service (DDoS) attacks.
According to the US Department of Justice, the hack is now connected to the shutdown of bitcoin exchange Coin.mx in July – just one of multiple money-laundering businesses run by the organization.
Andy Yen, formerly of Swiss research center Cern and now of encrypted email company ProtonMail, said his own company had experienced an especially strong DDoS attack and that it was important not to keep hackers out of the network, but to safeguard the networks from within.
“Historically, companies have put their security focus on reinforcing the ‘wall’ which keep attackers out, but with attackers growing more and more sophisticated, it is no longer a question of if you will be breached, but when you will be breached,” Yen said. “This is why we need increasing adoption of the end-to-end encryption paradigm, where data is encrypted and secured client side. This ensures that even in the event of a breach of a central server, sensitive client data can be kept safe.”
Michael Kaiser, head of the National Cyber Security Alliance, said he expected crimes like this to become more common.
“I don’t think this is an anomaly at all,” Kaiser said. “I think the cybercrime ecosystem is highly sophisticated. It’s also specialized. There are some folks who are good at gathering the data, others are good at monetizing it. This is not just about stealing some credit cards and cloning them and using them a few times before they get canceled. This had many technical aspects. It involved casinos and stock trading.”
This article was written by Sam Thielman, for theguardian.com on Tuesday 10th November 2015 21.56 Europe/Londonguardian.co.uk © Guardian News and Media Limited 2010