📸 Photo

FREE AMEX!

Max knew exactly where to get the magstripe data Chris wanted. There were thousands of potential sources sitting in plain sight, right on Carder-Planet and Shadowcrew. The carders themselves would be his prey.

Most of them weren't hackers, they were just crooks; they knew a bit about fraud but little about computer security. They certainly wouldn't be much harder to hack than the Pentagon. It was also a morally palatable proposition: He would be stealing credit card numbers that had already been stolen—a criminal was going to use them, so it might as well be Chris Aragon, his criminal.

He started by choosing his weapon, picking out the slick Bifrost Trojan horse program already circulating online and customizing it to evade antivirus detection. To test the results, he used the computer emulation software VMware to run a dozen different virtual Windows boxes on his computer at once, each loaded with a different flavor of security software.

When the malware went undetected on all, he moved to the next step: harvesting a list of carders' ICQ numbers and e-mail addresses from public forum posts, collecting thousands of them into a database. Then, posing as a well-known dumps vendor named Hummer911, he fired off a message to the entire list. The note announced that Hummer911 had acquired more American Express dumps than he could use or sell, so he was giving some away. Click here, Max wrote, to get your free Amex.

When a carder clicked on the link, he found himself looking at a list of fake Amex dumps Max had generated, while invisible code on the Web page exploited a new Internet Explorer vulnerability.

The exploit took advantage of the fact that Internet Explorer can process more than just Web pages. In 1999, Microsoft added support for a new type of file called an HTML Application—a file written in the same markup and scripting languages used by websites but permitted to do things on a user's computer that a website would never be allowed to do, like creating or deleting files at will and executing arbitrary commands. The idea was to let developers already accustomed to programming for the Web use the same skills to craft fully functional desktop applications.