Kingpin: How One Hacker Took Over the Billion Dollar Cyber Crime Underground by Kevin Poulsen Page A

$30. Hacked eBay accounts were worth $20. Ambitious buyers could spend $100 for a “change of billing,” or COB, a stolen credit card account where the billing address could be changed to a mail drop under the buyer’s control. Other vendors sold counterfeit checks or money orders, or rented drop addresses in the United States where merchandise ordered on American credit cards could be delivered without raising alarms and then reshipped to the scammer.
    Physical products like blank plastic “magstripe” (magnetic stripe) cards were in the offering, as well as “novelty” IDs, complete with holograms, which sold for anywhere from $75 to $150, depending on the quality. One could purchase a package of ten identification cards with the same photo but different names for $500.
    CarderPlanet’s registration was open to anyone, but to sell on the site, vendors first had to submit their products or services to an approved reviewer for inspection. New vendors would sometimes be required to escrow their transactions through Script or to post a bond with the site’s emergency fund, used to pay out buyers in case an approved vendor went out of business with unfilled orders in his queue. Vendors were expected to keep the board apprised of any vacation plans, safeguard buyers’ information from hacker attacks, and respond promptly to customer complaints. “Rippers,” vendors who failed to deliver on a sale, were subject to banishment, as was any vendor who accumulated five customer complaints.
    CarderPlanet was soon imitated by a second site, this one aimed at the English-speaking world: Shadowcrew. In September 2002, after witnessing the stunning success of CarderPlanet’s regimented hierarchy, a carder named “Kidd” brought over the heaviest hitters from Counterfeit Library to do business the Russian way. News of the site spread through IRC chat rooms and prison yards alike, and by April 2003, Shadowcrew had four thousand registered users.
    With the motto “For Those Who Like to Play in the Shadows,” Shadowcrew was at once a study-at-home college and an online supermarket for nearly anything illegal. Its tutorials offered lessons on how to use a stolen credit card number, forge a driver’s license, defeat a burglar alarm, or silence a gun. It boasted a wiki that tracked which state driver’s licenses were forgeable. And its approved vendors around the world could provide a dizzying array of illicit products and services: credit reports, hacked online bank accounts, and names, birth dates, and Social Security numbers of potential identity theft targets.
    As on CarderPlanet, each product had its own specialists, and every vendor had to be reviewed by a trusted site member before they were allowed to sell. Disputes were handled judiciously, with administrators and moderators working overtime to expose and ban rippers selling bunk products.
    The trading wandered beyond data into tangible items like ATM skimmers, prescription drugs, and cocaine, and into services like distributed denial-of-service (DDoS) attacks—take down any website for $200—and malware customization to evade antivirus products. One well-reviewed vendor offered a test-taking service that promised to get customers technical certifications within days. A vendor called UBuyWeRush sprang up to flood the underground with magnetic stripe writers, as well as must-haves like safety paper and magnetic ink cartridges for counterfeiting checks.
    Child porn was forbidden, and one vendor who asked to be reviewed for exotic animal sales was laughed off the board. But nearly anything else was fair game on Shadowcrew.
    By this time, CarderPlanet had launched subforums for criminals from Asia, Europe, and the States, but it was Shadowcrew that forged a true international marketplace: a cross between the Chicago Mercantile Exchange and
Star Wars
’s Mos Eisley cantina, where criminals of varying disciplines could meet up and collaborate on heists. An identity thief in