More Card-Stealing Malware Found

[HardOCP News]

Just when you thought it might be safe to use your credit card in stores again, this pops up.

The actual bot code is called ChewBacca and was described in detail recently by Kaspersky Lab. As Kaspersky explains, ChewBacca communicates with it's C&C (Command and Control) server over the Tor network, obscuring the IP addresses of parties. According to RSA, this particular botnet has been collecting track 1 and 2 data of payment cards since October 25.

 

[jflail2]

Starting to wonder if I should get one of those "reloadable" Vanilla Visa cards for all in-store and online transactions........

 

[Exavior]

damn it chewy

 

[Megalith]

...so is the security just that bad nowadays, or are hackers that good?

 

[bucketlist]

Just get a free American Express Blue Bird card for free online.
No fees to use or reload, and you can reload at Walmart.

 

[bucketlist]

...so is the security just that bad nowadays, or are hackers that good?

Both.

 

[G1. Killer]

This is why cash is the only option for me

 

[/usr/sbin]

The actual bot code is called ChewBacca and was described in detail recently by Kaspersky Lab. As Kaspersky explains, ChewBacca communicates with it's C&C (Command and Control) server over the Tor network, obscuring the IP addresses of parties. According to RSA, this particular botnet has been collecting track 1 and 2 data of payment cards since October 25.

https://www.youtube.com/watch?v=t0vsNFO2pDg

 

[octoberasian]

Starting to wonder if I should get one of those "reloadable" Vanilla Visa cards for all in-store and online transactions........

My friends have been using reloadable pre-paid cards for years now. I've been using one for about five-ish years. The only downside to some of them are either a) monthly fees or b) fees for each deposit or c) both.

However, it doesn't touch your bank accounts or credit card accounts, so it should be relatively safer than your own debit/credit cards.

 

[bucketlist]

My friends have been using reloadable pre-paid cards for years now. I've been using one for about five-ish years. The only downside to some of them are either a) monthly fees or b) fees for each deposit or c) both.

However, it doesn't touch your bank accounts or credit card accounts, so it should be relatively safer than your own debit/credit cards.

Have you tried Blue Bird?

 

[Exavior]

...so is the security just that bad nowadays, or are hackers that good?

Little of both. Companies don't really care about security, they like to like in the bubble of we are doing good enough and the employees don't care about the security of their work pcs so they will download what they want, plug in their infected phones / tablets via usb to charge them, copy files to / from infected flash drives.... So you have companies not willing to invest what they should in protecting the network as good as possible, they also don't want to piss of employees with too many restrictions so they have lacked security, then you have employees who treat work computers like home devices and don't care about what happens. So that leads to easy targets.

Then on the flip side you have people that are becoming more skilled at coming up with ways to trick you into running a program, opening an email or link... and so they are able to infect you in an easier manor. they also are better at doing more once they get in.

so you have networks not as locked down as well as they could be, stupid people that are likely to infect these networks and people that know how to use both of those factors to their advantage and do what they want.

I also think that the credit card age has helped change things some. Look at the mid to late 90s. most people where on dialup. When you went to a store more people used checks or cash. Growing up I don't recall people having credit cards like they do today. So there wasn't anything that easy to hack into and steal all this information and money. Then over time checks started to become more and more insecure and people started to move towards debit cards instead. this continued till you get to today where most places won't even accept checks anymore (at least at the normal consumer level). This trend also lead to easier targets because now transactions are done electronically instead of a piece of paper being carried to the bank.

 

[travanx]

How does a prepaid card work when unauthorized charges go to it? Is it as easy to get the charges reversed like a normal Amex or Visa?

I was pretty mad when I handed my ID over to buy some wine at Target and the person scanned it before I could say don't scan it. She didn't know the Target systems were hacked. Which is insane to hear from a worker there.

 

[the-one1]

Just get a free American Express Blue Bird card for free online.
No fees to use or reload, and you can reload at Walmart.

But hardly anyone takes an AMEX card. I had one and it was hard to use since many places didn't take it. I might as well be lugging around Rupees

 

[jflail2]

But hardly anyone takes an AMEX card. I had one and it was hard to use since many places didn't take it. I might as well be lugging around Rupees

Yea, that's why I was thinking the Vanilla Visas. We give them to clients as gift cards at work, so I'm somewhat familiar with that particular brand.

 

[Schro]

But hardly anyone takes an AMEX card. I had one and it was hard to use since many places didn't take it. I might as well be lugging around Rupees

I've used an Amex as my daily driver credit card for over 10 years now. I also keep other cards around incase Amex isn't taken, but I average maybe $10-20 per month on my non-Amex cards (which is a rounding error compared to my Amex spend)...

Places that I have had refuse Amex:
- Great Clips
- A couple of mom and pop restaurants
- State Farm
- I don't really remember any others.

 

[Schro]

Of course, I forgot to ask, why would anyone consciously decide to get into the fee fest related to prepaid cards if they're able to qualify for (and responsibly manage) credit cards? Credit cards have significant consumer protection against fraud at the federal law level - these protections do not extend to debit or prepaid cards (though, most companies extend them to stay competitive, they aren't legally obligated). It doesn't really matter if Target or whoever gets owned and your credit card number gets stolen - your credit card company is legally responsible for the fraudulent charges and not you.

 

[Dark Shade]

I've found that the Vanilla Visa doesn't work everywhere either. About 50% success rate at random POS systems. Kind of pisses me off

 

[tazeat]

Why would you use a reloadable? Wouldn't that be a pain in the ass?

Just use a real non-debit Visa... For most non-reward of the quarter categories I like my Chase Sapphire Preferred, fraudulent transactions and they will overnight you a new card and the fraud transactions are gone... 0% fraud liability for credit cards = I don't worry at ALL about fraud.

I never use my debit card except AT my bank to get cash which is very rare (probably been months since I've even taken it out of my safe).

 

[octoberasian]

Have you tried Blue Bird?

Have not heard of it that I can recall, but I'll check it out.

 

[ravx25]

Why would you use a reloadable? Wouldn't that be a pain in the ass?

Just use a real non-debit Visa... For most non-reward of the quarter categories I like my Chase Sapphire Preferred, fraudulent transactions and they will overnight you a new card and the fraud transactions are gone... 0% fraud liability for credit cards = I don't worry at ALL about fraud.

I never use my debit card except AT my bank to get cash which is very rare (probably been months since I've even taken it out of my safe).

There's an annual fee on that card. Who pays for annual fees anymore? Rewards are nice, but I wouldn't pay an annual fee to have them.