Drinkman and Smilianets Sentenced: The End to Our Longest Databreach Saga?

On Thursday, February 15, 2018, we may have finally reached the end of the Albert Gonzalez Databreach Saga.  Vladimir Drinkman, age 37, was sentenced to 144 months in prison, after pleading guilty before U.S. District Judge Jerome Simandle in New Jersey.  His colleague, Dmitriy Smilianets, age 34, had also pleased guilty and was sentenced to 51 months and 21 days in prison (which is basically "time served", so he'll walk immediately).  The pair were actually arrested in the Netherlands on June 28, 2012, and the guilty pleas had happened in September 2015th after they were extradited to New Jersey.

Those who follow data breaches will certainly be familiar with Albert Gonzalez, but may not realize how far back his criminal career goes.

On July 24, 2003, the NYPD arrested Gonzalez in front of a Chase Bank ATM at 2219 Broadway found Gonzalez in possession of 15 counterfeit Chase ATM cards and $3,000 in cash. (See case 1:09-cr-00626-JBS).  After that arrest, Gonzalez was taken under the wing of a pair of Secret Service agents, David Esposito and Steve Ward.  Gonzalez describes some of the activities he engaged in during his time as a CI in his 53 page appeal that he files March 24, 2011 from his prison cell in Milan, Michigan.

At one point, he claims that he explained to Agent Ward that he owed a Russian criminal $5,000 and he couldn't afford to pay it.  According to his appeal, he claims Ward told him to "Go do your thing, just don't get caught" and that Agent Ward later asked him if he had "handled it." Because of this, Gonzalez (who again, according to his own sentencing memo, likely has Asperger's) claims he believed that he had permission to hack, as long as he didn't get caught.

Over Christmas 2007, Gonzalez and his crew hacked Heartland Payments Systems and stole around 130 million credit and debit cards.  He was also charged with hacking 7-Eleven (August 2007), Hannaford Brothers (November 2007) where he stole 4.2 million credit and debit cards. Two additional data breaches against "Company A" and "Company B" were also listed as victims.  In Gonzalez's indictment, it refers to "HACKER 1 who resided in or near Russia" and "HACKER 2 who resided in or near Russia."  Another co-conspirator "PT" was later identified as Patrick Toey, a resident of Virginia Beach, VA.  (Patrick Toey's sentencing memorandum is a fascinating document that describes his first "Cash out trip" working for Albert Gonzalez in 2003. Toey describes being a high school drop out who smoked marijuana and drank heavily who was "put on a bus to New York" by his mother to do the cash out run because she needed rent money.  Toey later moved in with Gonzalez in Miami, where he describes hacking Forever 21 "for Gonzalez" among other hacks.

Gonzalez's extracurricular activities caught up with him when Maksym Yastremskiy (AKA Maksik) was arrested in Turkey.  Another point of Gonzalez's appeal was to say that Maksik was tortured by Turkish police, and that without said torture, he never would have confessed, which would have meant that Gonzalez (then acting online as "Segvec") would never have been identified or arrested.  Gonzalez claims that he suffered from an inadequate defense, because his lawyer should have objected to the evidence "obtained under torture."  These charges against Gonzalez were tried in the Eastern District of New York (2:08-cr-00160-SJF-AKT) and proved that Gonzalez was part of the Dave & Buster's data breach

On December 15, 2009, Gonzalez tried to shrug off some of his federal charges by filing a sentencing memo claiming that he lacked the "capacity to knowingly evaluate the wrongfulness of his actions" and asserting that his criminal behavior "was consistent with description of the Asperger's discorder" and that he exhibited characteristics of "Internet addiction."  Two weeks later, after fighting that the court could not conduct their own psychological exam, Gonzalez signed a guilty plea, agreeing that the prosecutor would try to limit his sentence to 17 years. He is currently imprisoned in Yazoo, Mississippi (FBOP # 25702-050) scheduled to be released October 29, 2025.

Eventually "HACKER 1" and "HACKER 2" were indicted themselves in April 2012, with an arrest warrant issued in July 2012, but due to criminals still at large, the indictment was not unsealed until December 18, 2013. HACKER 1 was Drinkman.  HACKER 2 was Alexandr Kalinin, who was also indicted with Drinkman and Smilianets.

Shortly after the Target Data Breach, I created a presentation called "Target Data Breach: Lessons Learned" which drew heavily on the history of Drinkman and Smilianets. Some of their documented data breaches included:

Victim	Date	Damages
NASDAQ	May 2007	loss of control
7-ELEVEN	August 2007
Carrefour	October 2007	2 million cards
JCPenney	October 2007
Hannaford	November 2007	4.2 million cards
Wet Seal	January 2008
Commidea	November 2008	30 million cards
Dexia Bank Belgium	Feb'08-Feb'09
Jet Blue	Jan'08 to Feb '11
Dow Jones	2009
EuroNet	Jul '10 to Oct '11	2 million cards
Visa Jordan	Feb-Mar '11	800,000 cards
Global Payments Systems	Jan '11 to Mar '12
Diners Club Singapore	Jun '11
Ingenicard	Mar '12 to Dec '12

During the time of these attacks, Dimitry Smilianets was also leading the video game world.  His team, The Moscow 5, were the "Intel Extreme Masters" champions in the first League of Legends championship, also placing in the CounterStrike category.   Smilianets turned out not to be the hacker, but rather specialized in selling the credit cards that the other team members stole.  Steal a few hundred million credit cards and you can buy a nice gaming rig!

Smilianets with his World Champion League of Legends team in 2012

 How did these databreaches work?

Lockheed Martin's famous paper "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains" laid out the phases of an attack like this:

But my friend Daniel Clemens had explained these same phases to me when he was teaching me the basics of Penetration Testing years before when he was first starting Packet Ninjas!

1. External Recon - Gonzalez and his crew scan for Internet-facing SQL servers
2. Attack (Dan calls this "Establishing a Foothold") - using common SQL configuration weaknesses, they caused a set of additional tools to be downloaded from the Internet
3. Internal Recon - these tools included a Password Dumper, Password Cracker, Port Scanner,  and tools for bulk exporting data
4. Expand (Dan calls this "Creating a Stronghold")  - usually this consisted with monitoring the network until they found a Domain Admin userid and password.  (for example, in the Heartland Payments attack, the VERITAS userid was found to have the password "BACKUP" which unlocked every server on the network!
5. Dominate - Gonzalez' crew would then schedule an SQL script to run a nightly dump their card data
6. Exfiltrate - data sent to remote servers via an outbound FTP.

In Rolling Stone, Gonzalez claims he compromised more than 250 networks

In the Rolling Stone article, "Sex, Drugs, and the Biggest Cybercrime of All Time" , Steven Watt, who was charged in Massachusetts for providing attack tools to Gonzalez in October 2008.  Watt's tools were used in breaches, including BJ's Wholesale Club, Boston Market, Barnes & Noble, Sports Authority, Forever 21, DSW, and OfficeMax.  As part of his sentencing, Watt was ordered to repay $171.5 Million dollars.

Almost all of those databreaches followed the same model ... scan, SQL Inject, download tools, plant a foothold, convert it to a stronghold by becoming a domain admin, dominate the network, and exfiltrate the data. 

How did the TARGET Data breach happen, by the way?  Target is still listed as being "Unsolved" ...   but let's review.  An SQL injection led to downloaded tools, (including NetCat, PSExec, QuarksPWDump, ElcomSoft's Proactive Password Auditor, SomarSoft's DumpSec, Angry IP Scanner (for finding database servers), and Microsoft's OSQL and BCP (Bulk Copy)), a Domain Admin password was found (in Target's case, a BMC server monitoring tool running the default password), the POS Malware was installed, and data exfiltration begun. 

Sound familiar???

Justice?

With most of Gonzalez's crew in prison by 2010, the data breaches kept right on coming, thanks to Drinkman and Smilianets. 

Drinkman, the hacker, was sentenced to 144 months in prison.
Smilianets, the card broker, was sentenced to 51 months and 21 days, which was basically "time served" -- he was extradited to the US on September 7, 2012, so he'll basically walk.

Will Smilianets return to video gaming? to money laundering? or perhaps choose to go straight?

Meanwhile, Alexandr Kalinin, of St. Petersburg, Russia; Mikhail Rytikov, of Odessa, Ukraine; and Roman Kotov, of Moscow, Russia, are all still at large.  Have they learned from the fate of their co-conspirators? or are they in all likelihood, scanning networks for SQL servers, injecting them, dropping tools, planting footholds, creating strongholds, and exfiltrating credit card data from American companies every day?

Kalinin (AKA Grig, AKA "g", AKA "tempo") is wanted for hacking NASDAQ and planting malware that ran on the NASDAQ networks from 2008 to 2010.  (See the indictment in the Southern District of New York, filed 24JUL2013 ==> 1:13-cr-00548-ALC )

Mykhailo Sergiyovych Rytikov is wanted in the Western District of Pennsylvania for his role in a major Zeus malware case.  Rytikov leased servers to other malware operators.  Rytikov is also indicted in the Eastern District of Virginia along with Andriy DERKACH for running a "Dumps Checking Service" that processed at least 1.8 million credit cards in the first half of 2009 and that directly led to more than $12M in fraud.  ( 1:12-cr-00522-AJT filed 08AUG2013.)  Rytikov did have a New York attorney presenting a defense in the case -- Arkady Bukh argues that while Rytikov is definitely involved in web-hosting, he isn't responsible for what happens on the websites he hosts.

Roman Kotov, and Rytikov and Kalinin, are still wanted in New Jersey as part of the case 1:09-cr-00626-JBS (Chief Judge Jerome B. Simandle ). This is the same case Drinkman and Smilianets were just sentenced under.

"Unlimited" ATM attack in Japan against South Africa's Standard Bank

We've written about Unlimited ATM attacks in this blog many times in the past, from 2008 until just a few months ago, but this newest attack is the first to feature Japanese ATM machines, to my knowledge.  In the early morning hours of 15MAY2016, at least 100 criminals visited at least 1,400 ATM machines and used a set of counterfeit ATM cards, cloned to correspond with accounts at Standard Bank in South Africa, to do the maximum 100,000 Yen withdraw ($913USD or £629) . . . about 14,000 times!

Standard Bank has confirmed the robbery to South African media that the event occurred, and has estimated the damage to the bank at around R200m (200 million South African Rand, or about $12.7M USD or about 1.4 billion Japanese Yen).  But is it truly an "Unlimited" attack?

The story was first reported in the 22MAY2016 Mainichi Daily News as "1.4 billion yen stolen from 1,400 convenience store ATMs across Japan".  The ATM machines are located in 7-Eleven convenience stores throughout Tokyo and 16 prefectures around the country.  The ATM machines in 7-Eleven stores in Japan are part of the bank network associated with Seven Bank.  Seven Bank's website invites international visitors to Japan to use their ATMs at 7-Eleven stores "Day or Night" which may be part of the appeal to these criminals.

www.sevenbank.co.jp/intlcard/index2.html

Several unique things happened in this account.  In previous "Unlimited" attacks, a very small number of accounts have had a related debit card "cloned" by making an exact copy of the magnetic stripe of the card.  In the past, an intruder onto the bank's network has been able to adjust the daily withdrawal limits of the cards, and reverse transactions, so that the same account could be used to perform hundreds or thousands of withdrawals.  The attacks are referred to as "Unlimited" attacks because a single account with a very small balance could be used to front millions of dollars worth of transactions, because each transaction is immediately reversed by the intruders who monitor the carefully orchestrated attack.  In the case of the most famous Unlimited attack, "The $9 Million World-Wide Bank Robbery", forty-four accounts were used to withdraw funds from 2,100 ATM machines in at least 280 cities around the world in a single evening.

In this case, it is not clear if this is what happened, primarily because the published reports say that at least 1,600 Standard Bank customers' accounts were used to perform the transactions. If this is true, with an estimate of 100 criminals involved in the "cash-out" portion of this robbery, that means on the average each criminal had access to 16 accounts that were unique to that criminal.  Also, with 1600 accounts in play, that means the average account holder's account would only have faced $7900 USD in charges.  This, however, contradicts the description of events that the BBC quotes, when it says that Standard Bank reported that "a small number" of fake cards were used in the event.  (The BBC article also places Standard Banks' estimated lossed at $19.25m, which, if you do the math, shows they chose the higher of the two contradictory values being reported in South Africa of either R200m or R300m.  R200m matches all of other figures being thrown about, while R300m is 50% higher.)

In my humble opinion, I believe that a journalist not versed in this type of cybercrime heard that 1600 counterfeit cards were used and assumed that they must belong to 1600 customers.  The key difference, and the most important with regards to Standard Bank, is that in a true "Unlimited" attack, the criminals would need to be controlling ATM accounts and logs INSIDE the Standard Bank network with administrator-level privileges. 

The Japan Times say "Japanese police have put suspects belonging to a Malaysian group on an international wanted list" relating to this event.  In reports from 2014, Japanese officials say that Chinese students are often used as money mules in Japan for withdrawing cash on behalf of organized cyber criminals, in much the same way that Russian money mules are used to withdraw cash from American banks.