Russia is taking the fight to cybercriminals, quietly arresting the alleged mastermind of a major attack on the Royal Bank of Scotland’s Worldpay payment processing systems and also beefing up its controls of top level domain names.
The Russian Federal Security Service has arrested Viktor Pleshchuk, the alleged ring leader of a £6 million attack on RBS, together with other suspects, according to the Financial Times.
A US grand jury indicted Pleshchuk, Sergei Tsurikov, 25, of Tallinn, Estonia; Oleg Covelin, 28, of Chisinau, Moldova; and a person known only as Hacker 3 last November
The indictment alleges that the group used sophisticated hacking techniques to compromise the data encryption that was used by RBS WorldPay to protect customer data on payroll debit cards, which are used by companies to pay employees.
Once the encryption on the card-processing system was compromised, the hacking ring allegedly raised the account limits on compromised accounts, and then provided a network of so-called "cashers" with 44 counterfeit payroll debit cards, the US Department of Justice said.
The counterfeit cards were used to withdraw more than £6 million in just 12 hours from more than 2,100 ATMs in about 280 cities worldwide, including cities in the US, Russia, Ukraine, Estonia, Italy, Hong Kong, Japan and Canada.
The arrests come as the organisation responsible for administering Russia's .ru top-level domain names is tightening its procedures in a bid to cut down on fraud and inappropriate content.
Starting April 1, anyone who registers a .ru domain will need to provide a copy of their passport or, for businesses, legal registration papers. Right now, domains can be set up with no verification - a practice that has allowed scammers to quickly set up .ru domains under bogus names.
The changes will help Russia align its rules with international best practices, said Olga Ermakova, informational projects manager with the Coordination Center for the .ru top-level domain. The .ru administrators care about the 'cleanness' of the domain, she added. "We don't need negative content, and such content is often [created] by unknown users."
Loopholes in the domain name system help spammers, scammers and operators of pornographic websites to avoid detection on the internet by concealing their identity. Criminals often play a cat-and-mouse game with law enforcement and security experts, popping up on different domains as soon as their malicious servers are identified.
Criminals in eastern Europe have used .ru domains for a while, registering domain names under fake identities and using them to send spam or set up command-and-control servers to send instructions to networks of hacked computers.
With the new domain registration requirements, it will be more difficult for criminals to continue with business as usual. At the very least, the requirement that registrants must submit paper documents will make setting up domains a more costly and time-consuming process.
"It's pushing the malicious activity elsewhere," said Rodney Joffe, chief technologist with Neustar, a DNS service provider. "If it's so much of a hassle, they'll say, 'Screw it. I'm going to register another top-level domain.'"
Joffe said it's too early to say how effective the .cn changes have been.
The .ru domain has been a top source of fraud of late, agreed Robert Birkner, chief strategy officer with Hexonet, a domain name service company. But even if it is cleaned up, criminals will have other places to go. Vietnam's .vn domain and Indonesia's .id have also been a problem lately, he said.
Last week, representatives from the US Federal Bureau of Investigation and the UK's Serious Organised Crime Agency (SOCA) lobbied the group responsible for coordinating the internet's domain name system to enforce tighter name recognition policies. Now it is "ridiculously easy" to register a domain name under false details, said Paul Hoare, senior manager and head of e-crime operations with SOCA.