[ISN] Dutch Internet blackmailer gets 10 years

[InfoSec News]

http://www.theregister.co.uk/content/55/36485.html

By Jan Libbenga
Posted: 24/03/2004 

A 46-year-old Dutch chip programmer who tried to blackmail dairy giant
Campina using the most up-to-date Internet technologies, has been
jailed for 10 years by a Dutch court on blackmail charges and five
counts of attempted murder.

The blackmailer put agricultural poison in Campina Stracciatella
desserts in a bid to extort €200,000. To conceal his tracks he used a
US anonymizer - a privacy service that allows users to visit web sites
without leaving a trail. In this case, however, it didn’t quite work
out like that.

The man was convinced he was going to commit the perfect crime. He
forced Campina to open a bank account and asked them to deposit €
200,000. Campina was issued with a credit card for the account which
the blackmailer intended to use to withdraw the cash.

But not the original card. To avoid breaking cover, he asked Campina
to buy a credit card reader and extract the information from the
card's magnetic stripe. The output, together with the card's pin code,
was sent to him electronically via steganography - a technology for
encoding information into pictures.

Campina received an envelope containing a floppy with a stego program
and some instructions. The company then had to encode the credit card
data into a picture of a VW Golf in an online advertisement for used
cars. The blackmailer downloaded the picture, decoded the information
it contained, created his own copy of the card, and finally went to
withdraw the cash.

To download the online picture, he used the Anonymizer.com service,
believing the company’s privacy policy would protect him. Not so.  
Dutch police worked closely with the US company and the FBI to track
him down. He was caught red-handed last year when he withdrew the
money from a cash machine using his copy of the credit card.

Which just goes to show that even criminal masterminds can make simple
mistakes. The error, experts say, could have been easily avoided if
the blackmailer had visited an internet café to download the encoded
picture, rather than using his own PC. What's more, he paid for the
Anonymizer service through Paypal, giving his personal email address.