DarkMarket_ Cyberthieves, Cybercops and You - Misha Glenny [93]
He was unaware that one year earlier, in the late spring of 2007, Cha0 had fallen out with Dron, the Canadian skimmer specialist whom the Secret Service and Detective Spencer Frizzell of the Calgary Police were preparing to arrest. Cha0 claimed that Dron was ‘a difficult character’ who irritated his customers and had therefore sullied the good reputation of DarkMarket. The many positive messages about Dron’s service suggested that Cha0’s motivation may have been different – certainly other carders on the board maintained that Cha0 had deliberately targeted Dron for his own reasons.
About a month before the young Canadian skimming expert and salesman was picked up by Detective Frizzell, Cha0, using his position as administrator, announced that Dron would be excluded from DarkMarket and would not be allowed back. Cha0 could now activate his plan to dominate the skimming market and move into action.
DarkMarket had provided a vital platform for Dron’s wares – a large number of his devices were sold to carders who had spotted his paid adverts on the board. DarkMarket was also used as the primary advertising vehicle for CrimeEnforcers.com, through which Cha0 was selling his own skimmers. Cha0 also offered packaged solutions to wannabe cyber criminals, including training, manuals and all the equipment needed for a start-up operation.
But once he had removed Dron from the equation, he changed his business model: interested parties were no longer at liberty to purchase his skimmers; they had to hire them instead. Cha0 would send them out, but with a little added modification.
After Dron’s expulsion, Cha0 was in a position to jack up the unit price of the skimmers – from now on they would cost $7,000 to hire, up from $5,000 to buy. For this, clients would receive a PIN pad along with the skimmer. They would install the skimmer on the mouth of an ATM and lay the PIN pad over the existing one. When bank customers inserted their cards and typed in their PINs, these were both recorded on the fake pad and the skimmer. The two fraudulent devices would then be detached and Cha0’s client would download the information onto a computer using a USB lead.
With Dron’s skimmers, the client would then be able to use that information to obtain funds fraudulently. But with Cha0’s skimmers, the data downloaded onto the computer was encrypted. The only person who possessed the key to decrypt this information was … Cha0. So the youthful criminal who had so painstakingly placed the skimmer and PIN pad onto the ATM could not simply go out and clone credit cards himself – he would have to send the information back to Istanbul. Cha0 would then organise the cash-out. Once he had the money, he would then send a cut to the client who had actually done the hard work. He was effectively renting out his skimmers – a much more profitable strategy than Dron’s outright selling.
This was a daring business model within the world of cyber criminality. If it succeeded, Cha0 stood to make untold sums, creaming off a huge percentage of illegal skimmer transactions around the world. All he had to do was maintain his supply of skimmers and ship them forward, without being detected. Not beyond the wit of man. Obviously there might come a time when a competitor might seek to undercut his strategy, or indeed return to the old-style simple sale of skimmers. But until then, by controlling the most influential board in the English-speaking world, Cha0 could enjoy the high life. And enjoy it he did.
By 2008 Istanbul was well on the way to becoming the city with the highest growth rate in the world. The population had been rising almost uncontrollably for fifteen years and it was now home to about fifteen million people, an estimated two million of whom were unregistered migrants, not just foreigners, but Turks and Kurds from Anatolia who were streaming