Tracking Cybercrime: August 2012

Wednesday, August 22, 2012

Liberty reserve is the end part 2

Maintenance update
Dear friends, it has come to our attention that some of our customers became concerned with our latest maintenance continuation and erroneous account status change for a group of our clients. Please find below an official explanation of reasons behind both instances:

1. There is a group of blocked accounts which were erroneously blocked by an automated script that was tested in the beginning of August and apparently has failed to perform properly. Script was designed to automatically secure in account in the event of multiple suspicious login attempts. During this maintenance we have identified the problem, addressed it and it is now being solved.

2. Since we were forced to perform extended maintenance, we saw an opportunity to add some of the additional features that were pending to be added to the website. As the web site appears shortly, you will discover Credit Card Funding option (available ONLY to a verified users), along with other minor improvements and enhancements.

We sincerely apologize for any inconvenience this maintenance may have brought to you and would like to assure you that both issues are addressed in a timely manner and currently being worked on around the clock for the quickest and safest resolution. During this final stage of maintenance we are identifying erroneously blocked accounts and updating their statuses to "normal". This is a long and tedious process so your patience is appreciated. While we are doing everything possible to bring the system back faster, these processes make take an additional up to 2-4 days to complete.

Any other explanation of this maintenance that you may come across online in various online forums is inaccurate or simply put - false and misleading.
Posted by Jeniffer at 4:38 PM

Original Link : http://blog.libertyreserve.com/2012/08/maintenance-update_22.html

I want lr back and change my fund in perfect money !!!

Sunday, August 19, 2012

Liberty Reserve is the end?

Maybe you have this problem in your accout

A lot of complaint can be view in hyip website and underground forum
Liberty reserve is the ecurency the most used by cybercriminal

LR block fund in account of big "fish", fund with lot of money since 3-7 days, He blocks randomly account.

Look complaint here

http://www.talkgold.com/forum/r366628-.html
http://www.talkgold.com/forum/r367217-.html
http://forums.digitalpoint.com/showthread.php?t=2538642

and other on all hyip website

Lr has a second prob, you can't received email of them

I have seen the problem will be not resolve before wenesday in a forum

Lr has de problem 1 year, for 24h the website will be down and there is no one explication from the ecurencie-market

https://www.wm-center.com/ one of most popular exhanger website stop accepting lr

Hello. in view of the current difficult situation on the market for liberty, we're experiencing some troubles with processing the orders. We have temporarily suspended the admission liberty for 2-3 days.

They say that on chat
Is the Usa who looks fund for cybercriminal ? LR will be a new paypal ? LR stole money ?

A good rep can be this (find in underground market)

I'm sorry if I might be wrong, but after I completely read all of the threads regarding this, i came to the conclusion that LR might started to .. sacrifice some goats (sorry for the term )
We all know who use LR, what kind of people for what kind of transactions, and I'm not talking about just carding.
Seems that for them to survive, and also keep the Verisign sign on their website and be supported by them ( which is a BIG BIG thing ), they have to .. BEND OVER for some investigations from now and then.
Alot ( and I do mean alot ) of money from dark operations ( ammo, drugs, whores, etc ) beeing moved in LR comes from russia / ukrain, ergo the massive lockage on ru/ua accounts.
It will be over soon, as because of the large amount of people that WILL lose alot of money, the rest of us will go on with our business using LR as always.
It was either this, or the e-gold way, and we all know what happened back then.

We can't belive some super legal legit business men from COSTA RICA (!!!!) woke up one day and said " hey ... lets do a nice money transfer system " without staying out of the radar ..

As you all see, alot of ru exchangers still conduct legit business each day without being blocked.

Lets just hope it will all be over soon

IF you want save your lr, change your ecurrencie
The two more popular I have seen in disussion is Perfec money (but one cybercriminal say they stole money) or bitcoin (very used in tor network)
Since 5 hours im browsing the net to get rid of my lr and all i can see is 40% for LR to PM, %45 for LR to bitcoin and so on

Do not used LR to egopay because egopay is a scam! (they block your account and steal randomly)

http://www.emoneyspace.com/forum/index.php?topic=241833.0

If you exhange your egopay fund to your payza account, payza block your account

(egopay says they are an afiliate of payza but I think is false)

if you type "egopay scam" on google, you can see video of official egopay says they are not a scam (lol this is very strange)

Wednesday, August 15, 2012

BUILD YOUR OWN SKIMMER : Wav to track

A lot of people pay a service in underground forum for decoding track in audio skimmer

kkk is the most famous for this service

His post :

For those who own audio atm skimmers I offer wave-to-track2 decode service.
(Where to buy audio skimmer?)

Payment: 20% of decoded tracks

Decode process:
1. You send me a link to wav/mp3/wma file (upload it to sendspace.com)
2. I tell you amount of tracks inside, we discuss how much time it will take to decode them and amount of tracks I will take as a payment.
3. After decode you get tracks in the following format:
[time] [track]
12-12 432143214321xxxx=130110100000000000123
12-17 543254325xxxx432=150412113414200000142
Part of it will be hidden with "xxx". After I get video for the payment tracks I send you full track list.

Speed of decode process depends on wave quality and amount of interrupts.

Minimal order is 50pcs. You still can send me small parts for decode, we will collect until the whole amount will reach 50pcs.

Contact: ****@jabber.org

PS: Small orders (under 3 tracks, for test purposes or so) I decode for free.

Other service of decrypt is always same price 20% of value of the dump, sometimes 10%

I have do a .rar with a pdf and doc (ru) tutorial and the soft (.exe) for decrypt (you need pyc language)
Download here
pass : trackingcybercrime

You can always use PowerGraph + this table of values

b1 b2 b3 b4 b5 Symbol Value
0 0 0 0 1 -0 (0H) Digit
1 0 0 0 0 -1 (1H) "
0 1 0 0 0 -2 (2H) "
1 1 0 0 1 -3 (3H) "
0 0 1 0 0 -4 (4H) "
1 0 1 0 1 -5 (5H) "
0 1 1 0 1 -6 (6H) "
1 1 1 0 0 -7 (7H) "
0 0 0 1 0 -8 (8H) "
1 0 0 1 1 -9 (9H) "
0 1 0 1 1 -: (AH) Management
1 1 0 1 0 -; (BH) Begin of the sequence
0 0 1 1 1 -<(CH) Management
1 0 1 1 0 -= (DH) Field separator
0 1 1 1 0 -> (EH) Management
1 1 1 1 1 -? (FH) End of the sequence

Monday, August 13, 2012

POS fraud in video

A first time I see it in underworld forum underground
A man take a video who he is using his own POS to do fraud
His name is Sudaka and he come from to Peru (100% 101 they not have chip)

His thread :

Title : I HAVE MY POS need good seller , or work %

I have my own POS, I'm looking for sellers of good material dumps, I'm tired of throwing my money buying and LR, in tinedas and bad sellers, provided I have my own POS, if someone has good stuff and want to sell, or work in% contcatarme in PM, only serious people, look at the picture this morning pass, 12 dumps and could only make 980 usd with one, we can take up to 15K per day,

http://www.sendspace.com/file/np4ba7
NO AUTORIZAR
3 razons, BLOQUED, DECLINED,

Picture of sendspace :

Fraud POS working

Video :

Thursday, August 9, 2012

High quality webinject for banking bot (zeus, spyeye, citadel)

As you know, webinject is used to steal sensitive info that you can't have with a keylogger/formgrabber in trojan. This is used for doing bank transfert, cvv fullz ...

I will show high quality webinject produce by a russian guy call "geforse"

normal webinject just grab info in your botnet and cost like 20-60$ but this webinject grab info in other page (login, pass, other info...), have balance grabber and send info in jabber (for realtime)

You can see all webinject doing by the author, all video can be view in better quality if you change in 480p or 720p

RU	EN
USA - bank inject Пак из 8 инжектов для банков USA: bofa chase citi citizen firstcitizens pnc suntrust wells Отправляют в админку и джаббер данные по аккаунту,сс,dob,ssn,mmn. 101$ = 1 банк 678$ = 8 банков	USA - bank inject Pack of 8 injector for banks USA: bofa chase citi citizen firstcitizens pnc suntrust wells Sent to the admin area and data on jabber account, ss, dob, ssn, mmn. $ 101 = 1 bank $ 678 = 8 banks

RU	EN
facebook.com - 101$ Инжект требует подтверждения своей личности путём ввода данных кредитной карты + dob/ssn.(или + запрашивает данные для восстановления vbv/mcsc) Все данные отправляются в админку и джаббер.	facebook.com - $ 101 Inject your personality to be confirmed by entering credit card data + dob / ssn. (Or + requests data recovery vbv / mcsc) All data is sent to the admin, and jabber.

PayPal.com - 387$

После срабатывания инжекта, холдеру выдаётся "Security Measures" требующая ввести полный номер карты или, если карт нет, банк.акка.
В джаббер отправляется и в админке сохраняется Username,Password,Name,Primary E-mail,Address,Phone Numbers,Balance,Account type,Status,Country,Check date,IP address,User-agent + Все данные карты (номер, exp, cvv) и банк.акка.

PayPal.com - $ 387

After operation inzhekta, holders shall be issued "Security Measures" required to enter the full card number, or if there is no card, bank.akka.
In jabber sent and saved in the admin Username, Password, Name, Primary E-mail, Address, Phone Numbers, Balance, Account type, Status, Country, Check date, IP address, User-agent + All card details (number, exp, cvv) and bank.akka.

RU	EN
Ebay.com - 101$ Инжект выдаёт стандартное окно для регистрации кредитной карты + dob/ssn. Все данные отправляются в админку и джаббер.	Ebay.com - $ 101 Inject the standard window provides for the registration of a credit card + dob / ssn. All data is sent to the admin, and jabber.

RU	EN
anz.com - 88$ Инжект в фоновом режиме шлёт в лог логин, пароль, лимит, балансы счетов	anz.com - $ 88 Inject in the background sends a log login, password, limit, account balances

RU	EN
bankofamerica.com - 101$ Собирает данные сс, вопросов/ответов, баланса при авторизации, которые отправляются в админку и джаббер.	bankofamerica.com - $ 101 Collects data ss, questions / answers for the balance of the authorization to go to the admin, and jabber.

RU	EN
libertyreserve.com - 101$ Собирает данные аккаунта (логин,пароль,пин,мастер кей,баланс) при авторизации и отправляет в админку и джаббер.	libertyreserve.com - $ 101 Collects account information (username, password, PIN, Master Key, Balance) for authorization and sends to the admin, and jabber. .

RU	EN
cahoot.com - 101$ Собирает данные аккаунта при авторизации и отправляет в админку и джаббер.	cahoot.com - $ 101 Collects data when authorizing your account and send to the admin, and jabber.

RU	EN
halifax.co.uk - 101$ Собирает данные аккаунта при авторизации и отправляет в админку и джаббер.	halifax.co.uk - $ 101 Collects data when authorizing your account and send to the admin, and jabber.

Wednesday, August 8, 2012

French key traffic : PASS PTT

I know lot of french carder used a key to open all mailbox

French typical mailbox

Uou need to have a key call "pass ptt" or "passe partout".
All key are only used by postman

A french famous postman

All "pass ptt" are not allowed for sell, all seller in internet are scammer (they take your money and not send anything)
For have this key you have 2 method

#1
you need to buy one in unerdround market (french underground is the best)
I have used this method for buying one (I have received lot of private message)

Hi, I have pass ptt, what you offers?

The price for a pass ptt is 50€ but I have see a vendor sell it for 20$

I have buy one from a people in my city. That I found in underground forum (bordeaux)
I have meet him , they was 2. They have the look of true gangsta in city.

They used "pass ptt" not for carding but for stolen.
They seach cheque for pay electronic item in website "leboncoin", They used modified ID scan for verifying when they buy with stolen cheque.
They stole package too in big mailbox

big french mailbox (they exist a lot bigger in brown)

They have already stole 2 PS game (they said me that)
They show me how stolen and everything all the day (enter private hall, open all mailbox ...)

We have do same this video

#2
The second method is build your own
You cant do yourself, you need a locksmith, you can do one online but not in french website because this is not allowed, they say all "no"
You need a key blanck Silca R041 (not sell in france), you can buy one in other website country.
You need a code (All french ptt)

-A10: 149999
-B10: 269999
-C10: 349999
-D10: 469999     
-E10: 549999
-F10: 669999
-G10: 749999
-H10: 869999

-I10: 169999
-J10: 249999
-K10: 369999     
-L10: 449999
-M10: 569999
-N10: 649999
-O10: 769999
-P10: 849999

-Q10: 159999
-R10: 359999     
-S10: 559999
-T10: 759999
-U10: 959999

-V10: ??9999
-W10: ??9999    
-X10: ??9999 
-Y10: ??9999

-Z10: ??9999

The principal who open all is the T10 75999
you say I want a silca R041 cut with the code 75999 and all is good
T10 open Hall and all mailbox.
F10 open Hall and mailbox of Hall

------------------------------------------------------------------------------------------------------------------------------------------------------------------

Look Pass ptt T10

Look Pass ptt F10

The 2 Pass, they are not the same (difficul to see)

------------------------------------------------------------------------------------------------------------------------------------------------------------------

If you dont have money to buy one you can always used the picking (lot of forum exist)

And if a mailbox or a door dont want be open, this method is the most successfull but not very discrete

Fell free to comment

Tuesday, August 7, 2012

BUILD YOUR OWN SKIMMER : Electronic skimmer Part 2

This article is only for the electronic part (no bezel or cam in other part)

First the electronic is composed

This is an audio skimmer but this is same an electronic skimmer

For build the electronic you need 3 part and 4 others extra part for decoding and charge the battery (not in picture)

Red : This is the magnetic strip card reader, this is the most expensive electronic to buy
The most famous is the msrv007 size :4 x 5 x 15mm
This msrv model is the less expensive and have good size

the famous msrv007

For smallest size, they existe lot of version of magnetic strip card reader like msrv010

You can buy bluetooth version (but size is bigger x2 and more expensive) like msrv008, when you insert your skimmer in ATM you take all data on your computer, if you lose your skimmer you have always your info

Technical info

- All msrv model have interrupted swip technology, when you swip your magnetic card and the swip is interrupted, your data is correctly saved by a powerfull algorithm
For resume : you have better chance to swip successfully more credit card

-All msrv have 3 track reader, it reads all three tracks of the magnetic cards (track 1, 2, 3), for credit card you need only track 2 and 1 (you can generate track 1 with track 2)

- All msrv have an encryption system, All track are crypted, you need to have the software to decrypt data with a password. You can used this method for having worker.

- For the consumption, all msrv can stored up to 32000 cards or run for 16 days (only if you have a 40mA battery)

msrv technical info

Yellow : You need to used a small battery for your msrv, when you buy a msrv package you have always one include

The default battery include in msrv package is the 40mA

Blue : The Magnetic Read Head, This is the part who read the magnetic stripe, this is optionnal but highly recommended for better track

how to connect magnetic read head

The Read head is included in msrv package

The other extra part (all included in msrv package)

USB data cable : The cable required to communicate with the MSRv007 from your PC.