ADVERTISEMENTS

I noted yesterday that Canadian papers had reported that Israeli hacker Ehud Tenenbaum (aka "The Analyzer") had been released on bail in Canada. I've now learned that Tenenbaum wasn't released at all but is being held in Canadian custody on a U.S. warrant.

According to Canadian Crown prosecutor Jane McClellan, a provisional warrant from the U.S. was executed against Tenenbaum last Thursday within hours after a Canadian court in Calgary granted him release on $30,000 bail. The provisional warrant is likely the first step in extradition proceedings, and McClellan said it's unclear at the moment whether Canada will proceed with its case against Tenenbaum if the U.S. seeks extradition.

"There are a lot of factors to consider," she told Threat Level. "Right now he's charged in both countries."

McClellan provided more details about the crime that Tenenbaum is charged with committing, some of which have not previously been reported.

Tenenbaum is accused of hacking into computers belonging to Direct Cash Management in Calgary, which sells pre-paid debit and credit cards through various merchants, and increasing the cash limits on those cards. Then he and others allegedly withdrew CDN $1.8 million on the cards through ATMs.

According to McClellan, this is how it worked.

A number of people purchased 37 pre-paid debit cards with small cash limits on them -- usually $15. Then tracking data encoded in the magnetic stripe on the back of the card was allegedly passed to Tenenbaum. That tracking data contained the account number and the customer PIN that allows the cardholder to withdraw cash from the account. Tenenbaum, alone or with the help of others, then allegedly hacked into Direct Cash's server using a SQL injection attack and deleted the limits on some cards and increased the limit on other cards to a combined total of more than CDN $3.5 million. The amount on one card account alone was increased to more than CDN $1 million.

The card track data was then given or sold to others around the world who encoded blank cards with the data and used it to withdraw cash on the accounts. Within days CDN $1.8 million had been stolen.

"Its astonishing how quickly they can get the money out," McClellan said. "These withdrawals happened over a period of about three or four days."

Direct Cash discovered the problem when it conducted a weekly audit and noticed that $1.4 million was missing. A subsequent forensic audit of its system revealed that someone had used a SQL injection attack to hack the company's server.

McClellan says that Tenenbaum and people associated with him were caught on ATM video cameras withdrawing some of the cash soon after the cash limits on the cards were changed.

Tenenbaum was arrested with three other Canadians, 30-year-old Priscilla Mastrangelo, whom Tenenbaum has identified as his fiancee; 28-year-old Ralph Jean-Francois; and 33-year-old Sypros Xenoulis, said to be Tenenbaum's partner in a computer security business.

Mastrangelo is accused of withdrawing $32,082 in the scam, while Jean-Francois and Xenoulis took considerably less -- $6,585 and $1,001.

McClellan wouldn't disclose which DoJ district office is seeking Tenenbaum. The provisional warrant was filed under seal and doesn't yet appear in the federal court system where such filings can usually be found. The U.S. Justice Department said it would get back to me about the matter.

See also:

• "The Analyzer" Released on Bail; Mom Says FBI Out to Get Her Son
• Israeli Hacker Known as "The Analyzer" Suspected of Hacking Again
• Video: Solar Sunrise, the Best FBI-Produced Hacker Flick Ever
• Kevin Mitnick Tells All in Upcoming Book -- Promises No Whining
• Feds Charge 11 in Breaches at TJ Maxx
• E-Gold Gets Tough on Crime
• I Was a Cybercrook for the FBI
• Confessions of a Cybermule
• Secret Service Operative Moonlights as Identity Thief

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.