Intellectual Property Law

Turkish Police Arrest Alleged ATM Hacker-Kidnapper

By Ryan Singel, Kevin Poulsen, Sarah Lai Stirland, Kim Zetter, and David Kravets

A notorious Turkish ATM hacker Cha0, who has been accused of torturing a police informant, was arrested Friday by Turkish officials -- despite the hacker's claim that not even the FBI could catch him, Turkey's Haber 7 reports.

In August, a fellow hacker-turned-informant who used the online nickname Kier accused Cha0 and his associates of abducting and beating him earlier in the year. Cha0 sent a photo of Kier -- pictured in only his underwear and holding a sign saying, "I'm a rat. ... I am fucked by Cha0" -- to Haber 7.

Kier disappeared a second time after telling reporters via an e-mail that Cha0 was protected by Turkish officials. Cha0 denied any role in the second disappearance.

"I always had a question mark on my mind on where Cha0's men got the resources," Kier wrote the reporters in Turkish. "I found out firsthand when I had a weapon pointed at my head."

ChaO's real name is Cagatay Evyapan, according to the report, and the outlet says it will publish a secret interview with the hacker on Monday.

A well-known figure in the credit card fraud underground, Cha0 markets a high-quality ATM skimmer and PIN pad that fraudsters can covertly affix to certain models of cash machines. The skimmer records the magstripe data on a consumer's debit or credit card as they feed it into an ATM, while the PIN pad overlay stores the user's PIN. The stolen magstripe data can later be encoded onto a blank card and used to make withdrawals from victims' accounts.

Cha0's banner ad on DarkMarket shows a cartoon man wading through a house full of cash. "Is that you?" the text asks. "Yes. If you bought [a] skimmer and PIN pad from Cha0."

In April, Miami Beach police busted a ring of Bulgarian nationals who'd allegedly been planting skimmers on area ATMs for two years. The gang installed pinhole cameras in the ceiling of the ATM to record the PIN numbers. They allegedly used the stolen data to pull more than $160,000 from bank customer accounts in the span of just two weeks last February.

UPDATE 9/15: Haber 7 also has video of the raid, including shots of credit card-related equipment one is not very likely to have lying around one's house.

Photo courtesy Haber 7

See Also:

• Hacker Reportedly Kidnaps and Tortures Informant, Posts Picture as ...

Full post as published by Threat Level on September 12, 2008 (boomark / email).