CHARLOTTE, N.C. - Credit card hacking is a growing crime and a man convicted of it said he opened 5,000 accounts and spent hundreds of thousands of dollars in other people’s names.
Eyewitness News anchor Blaine Tolison explains how and where it happens and what people can do about it.
Lillian Sullivan's credit is still frozen three weeks after she received an Amazon Chase card with a $9,000 limit in the mail, something she never applied for.
"My heart just kind of dropped," Sullivan said.
Until then, she knew nothing about a hidden world where hackers steal information at will.
"You don't know who has it, you know, or what they're actually going to do with it," Sullivan said.
Will Jones knows that world all too well.
"Everybody calls me ‘Credit Card Will,’" Jones said.
He's serving six years for crimes that include identity theft.
"We can open credit cards in your name,” Jones said. “We can get loans in your name. We can get houses in your name."
At one point, Jones had 5,000 open credit accounts.
He had rented a hotel room and set up seven laptops, Wi-Fi and a smart TV that he used to access what's known as the Dark Web controlled by hackers.
Jones said identities are sold as cheap as $1.54.
In fact, he spent $1,000 of his own money allowing him to spend $750,000 of other people's money.
"You can purchase them, you can purchase full information, identities," Jones said.
Hackers like Jones can steal information from people who log their devices into a public Wi-Fi network anywhere.
Hackers can also intercept information by simply breaking through poor network security.
Experts said there are many ways to protect yourself.
Subscribe to a virtual private network or VPN, which encrypts your information, and avoid open, public networks.
"You don't it's going to happen to you, until it does happen to you," Sullivan said.
Sullivan will likely never know who stole her information, and now she is dealing with a credit-monitoring nightmare trying to make sure it doesn't happen again.
"It's horrible,” she said. “It's a horrible situation."
Experts say coffee shops and other public places can be especially dangerous because hackers are known to set up rogue Wi-Fi that looks like the real thing.
Issues with Public Wifi
Any device that lies between a user and a network server can execute “man in-the-middle attacks”, which tricks all connected to devices to use the attacking device as a router, and allows for the interception and modification of data exchanged between the user and the destination. Attackers can spoof certificates or attempt to strip out SSL protections to intercept login credentials, and can inject arbitrary code into displayed websites. During a MITM attack, users are at risk of data interception and may also be exposed to a malware infection via malicious website code injections.
Poor security posture of networks in general
You can’t control the wireless network/router at a hotel or other public location, we find thousands of networks every day with various routers and peripheral devices (printers/phones) with no authentication in use, leaving them wide open to compromise.
The Mirai botnet takes advantage of exposed routers and IoT devices that are using default credentials.
Evil Twin: An evil twin is a rogue WiFi access point that appears to be legitimate but actually has been set up by a hacker to fool wireless users into connecting a laptop or mobile phone to a tainted hotspot. Once the victim connects to the evil twin, the hacker can listen to all Internet traffic, perform MITM attacks, or even ask for credit card information posing as a standard pay-for-access WiFi squeeze page. These devices will listen for broadcasting SSID's sent by nearby devices, and then impersonate the SSID to trick the device into automatically connecting. For example, if a user regularly connects to WiFi at 'JoesCoffee', an Evil Twin attack will detect requests from the user's device and then pretend to be 'JoesCoffee' to gain an automatic connection.
Pay careful attention to the network names (aka SSID), disable automatic connections to known WiFi networks on mobile devices and laptops, and never connect to an open networks without the use of a VPN service.
What can you do to protect yourself:
Use of a VPN Service - There are thousands of virtual private network (VPN) subscription services available, both free and paid. A VPN encrypt all traffic as it traverses the local network, and significantly decreases the chances of a successful MITM attack. Setting up a VPN is not difficult, all providers offer step by step tutorials for use. You can always ask a friend whos 'good at computers' to help, most techies are happy to help others with privacy concerns.
Avoid the use of open networks that do not make use of any encryption or authentication.
Attackers will attempt to remove 'https' protections while conducting MITM attacks. Always ensure websites are accessed via “https://” instead of “http://”, many browsers will give you warning when your data isn’t encrypted or if the encryption certificate is suspicious.
Use a “throw away” email and unique password to register for WiFi networks or any sites that aren’t critical to your day to day. In the event that the service provider is breached, those emails and password combinations are leveraged by attackers to conduct password reuse attacks, and to phish for further data.
Where available, leverage dual factor authentication on all sensitive websites (MS is typically free)
© 2018 Cox Media Group.