Inside the Carding Underworld

Carder.cc is a German online forum dedicated to helping criminals in trading stolen credit card and login details obtained via their carding or phishing activities. Because such forums are a source of income for their administrators (who are also involved in this black market), the best-known forums are forever engaged in underground infighting to stay atop the heap. If a competitor can demonstrate that another forum is insecure, the former can win market share.

This is the likely cause that some individuals hacked the carder.cc forum and posted on a public file-sharing network the results–including information about thousands of forum members and, in many cases, their passwords.

Perhaps the most interesting exposed file is a RAR that contains a dump of the forum and a tool allowing the curious to reconstitute site for browsing with administrator rights.

First of all, we find data about the four administrators, their emails, and when they joined the group:

Following the link, we see the IP for each member (a real or fake IP, depending on the use of an anonymizer) and the function title (KRON0S is the “God of Carders”; Zagerus is “Techadmin”).

Besides the four administrators, by browsing the member list we find:

• 4121 simple members
• 5 global moderators
• 258 second-level members
• 7 third-level members
• 4 moderators
• 17 verified vendors
• 497 banned members

Age, nationality, and other personal data are sometimes mentioned. Websites, ICQ, AOL Messenger, Yahoo Messenger, and MSN contacts are also noted. No doubt these data will interest law enforcement agencies in their inquiries.

Most of the offers available in the various forum areas are linked to standard carding and botnet businesses. However, some of them were less common: I noted a Secondlife account with 65000 Lidendollars (about US$60), some $50 iTunes gift cards ($20 each), and a forged papers factory (about $1,000 for each falsified document).

Visiting this forum shows the identity theft market is plenty healthy. The number of free payment accounts that include the full identity of each victim–offered here to attract customer interest–gives us the proof. I made a search for French victims. The next screenshot gives only a brief outline.