Feeds

Romanians plead guilty to credit card hack on US Subway shops

$10m PoS pwn

Combat fraud and increase customer satisfaction

Two Romanian nationals who were extradited to the US in May have confessed their involvement in a $10m scam aimed at stealing credit and debit card data from payment terminals at hundreds of Subway restaurants and other merchants across the US, according to the United States Attorney's Office.

Iulian Dolan, 28, of Craiova, Romania, pleaded guilty to conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud. Cezar Butu, 27, of Ploiesti, Romania, pleaded guilty to one count of conspiracy to commit access device fraud. Each agreed to plead guilty in return for lesser sentences as part of a plea-bargaining agreement that will see Dolan jailed for no more than seven years and Butu for no more than 21 months, providing a sentencing judge approves the deal.

The pair were among four Romanian nationals extradited in May after being charged last December with hacking into Subway vulnerable point-of-sale computers between 2009 and 2011. The scheme led to the compromise of more than 146,000 payment cards and more than $10m in losses.

The hack against point-of-sale terminals relied on identifying machines running exploitable remote desktop software applications. The US Dept of Justice said Dolan had hacked into these systems to install keystroke logging applications, which subsequently recorded card data from swiped cards before transferring this information to dump sites. In some cases Dolan had to crack passwords in order to circumvent the remote desktop applications, which in normal use were used to update the software on PoS terminals.

Butu has admitted to attempting to make fraudulent transactions using the stolen credit card data as well as selling the plastic cards data to co-conspirators. The confessions implicate alleged ring-leader Adrian-Tiberiu Opera, a Romanian national extradited to the US and awaiting trial in New Hampshire over his alleged involvement in the scam.

A US DoJ statement on the case can be found here. Subway is not named as the target of the scam by the DoJ in its latest statement but it is named in prior DoJ statements as being one of the victims of the hack – along with around 50 other merchants. ®

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.