Feeds

‘Bill Gates’ hacker escapes jail

Psychiatric and community service order for teen cracker Curador

  • alert
  • submit to reddit

SANS - Survey on application security programs

A Welsh cracker whose "campaign" to expose the insecurity of ecommerce sites led to an FBI investigation has escaped jail.

19 year-old Raphael Gray was sentenced to a psychiatric and community service rehabilitation order of three years, in a hearing before Judge Gareth Davies at Swansea Crown Court today.

Gray (whose handle is "Curador", or custodian in Welsh) obtained the credit card details of thousands of people from sites with flakey security and published those details on two sites, paid for with stolen credit card details.

Neil Barrett, technical director of Information Risk Management, and expert witness for the prosecution in the case, described Gray's offences as "very serious" because many people could have had their credit card details exploited.

That said, Gray himself did not commit widespread fraud, said Barrett, who added that no "collateral damage" was inflicted by the cracker to the sites he targeted.

Credulous news outlets continue to report that Gray published the credit card details and phone number of Bill Gates on his sites ecrackers.com and freecreditcards.com, and sent a consignment of Viagra to the Microsoft boss. In fact the details published were an obvious fake, as you can see on an archive of his site (minus credit card details) here.

Nonetheless the self-styled "saint of ecommerce" caused huge inconvenience to the American, British and Canadian dotcoms he targeted. His activities brought him to the attention of the FBI and, amid fears details of 26,000 credit cards had been compromised, his house in the sleepy hamlet of Clynderwen in west Wales was raided in March last year.

Gray pleaded guilty to theft and hacking offences which fall under the Computer Misuse Act when the case came to trial four months ago. He admitted two charges of obtaining services by deception and offences under the Theft Act in setting up the two Internet sites on which credit card information was published.

He also pleaded guilty to six charges of intentionally accessing sites containing credit card details, but without using this information for financial gain.

Prior to pleading guilty, Gray had argued in his defence the he hadn't hacked into the Web sites. His defence was that because there was no way for him to establish that his access was authorised, it couldn't be unauthorised. Because of his guilty plea these arguments, which have a wider significance beyond Gray's case and could have opened up a line of defence for hackers, were not tested in court.

"It was a shame that the interesting arguments about authorised versus unauthorised access on Web sites were not fully exposed in the case," said Barrett. ®

Related Stories:
Cracker in 'credit card Viagra sting on Gates'
Welsh hacker pleads guilty to deception and theft
FBI tracks Bill Gates credit card hackers to Welsh village
Hacking credit cards is preposterously easy
Identity Thefts from the Rich and Famous

External links:
Curador's web site (minus real credit card details) - as mirrored by Attrition

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.