📸 Photo

KINGPIN

offshore repository where they could park the cash without it being recalled by the victim bank. So far, he’d failed.

So when, in September, Max got his hands on a deadly new Internet Explorer zero day, he shared the news not with Chris but with a different partner, one who had more knowledge of international finance, the Carders Market admin called NightFox.

The security hole was a monster: another buffer overflow, this time in the Internet Explorer code designed to let websites draw vector graphics on a visitor’s screen. Sadly for Max, Eastern European hackers had found the bug first, and they’d been using it. A computer security company had already found the Russian exploit code infecting visitors to an Internet porn site and sent it to Microsoft. The Department of Homeland Security had issued a blunt warning to Internet Explorer users: “Do not follow unsolicited links.”

The word was out, but there was no patch. Every Internet Explorer user was vulnerable. Max got his copy of the Russian exploit in the early morning hours of September 26 and informed NightFox enthusiastically.

“Assume we get a free pass today to own whatever company we want,” Max wrote over Carders Market’s messaging system. “There you go. No limits. Visa.com. Mastercard.com. egold.com. Whatever you can get the employee e-mails for. Google. Microsoft. Doesn’t matter. It's all equally ownable right now.”

Microsoft pushed out a patch later that day, but Max knew that even the most secure company would take days or weeks to test and install the update. The Russian exploit was already detected by antivirus software, so he modified it to change its signature, running it through his antivirus lab to verify that it was now undetectable.

The only thing left was the social engineering: Max had to trick his targets into visiting a website loaded with the exploit code. Max decided on the domain name Financialedgenews.com, and set up hosting at ValueWeb.

NightFox came back with the target list: CitiMortage, GMAC, Experian’s Lowermybills.com, Bank of America, Western Union Money-