Feeds

Romanians plead guilty to credit card hack on US Subway shops

$10m PoS pwn

Reducing security risks from open source software

Two Romanian nationals who were extradited to the US in May have confessed their involvement in a $10m scam aimed at stealing credit and debit card data from payment terminals at hundreds of Subway restaurants and other merchants across the US, according to the United States Attorney's Office.

Iulian Dolan, 28, of Craiova, Romania, pleaded guilty to conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud. Cezar Butu, 27, of Ploiesti, Romania, pleaded guilty to one count of conspiracy to commit access device fraud. Each agreed to plead guilty in return for lesser sentences as part of a plea-bargaining agreement that will see Dolan jailed for no more than seven years and Butu for no more than 21 months, providing a sentencing judge approves the deal.

The pair were among four Romanian nationals extradited in May after being charged last December with hacking into Subway vulnerable point-of-sale computers between 2009 and 2011. The scheme led to the compromise of more than 146,000 payment cards and more than $10m in losses.

The hack against point-of-sale terminals relied on identifying machines running exploitable remote desktop software applications. The US Dept of Justice said Dolan had hacked into these systems to install keystroke logging applications, which subsequently recorded card data from swiped cards before transferring this information to dump sites. In some cases Dolan had to crack passwords in order to circumvent the remote desktop applications, which in normal use were used to update the software on PoS terminals.

Butu has admitted to attempting to make fraudulent transactions using the stolen credit card data as well as selling the plastic cards data to co-conspirators. The confessions implicate alleged ring-leader Adrian-Tiberiu Opera, a Romanian national extradited to the US and awaiting trial in New Hampshire over his alleged involvement in the scam.

A US DoJ statement on the case can be found here. Subway is not named as the target of the scam by the DoJ in its latest statement but it is named in prior DoJ statements as being one of the victims of the hack – along with around 50 other merchants. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.