Poxxie's site, which is well known to security experts, was run until recently from a server in India, where U.S. law enforcement carries little weight with local authorities when it comes to computer crime. The site was recently moved or shut down, a common security practice among hackers.
Poxxie has been in business long enough to see the price for a stolen credit card plummet because of over-supply and more sophisticated safety precautions by banks. Why charge $3.50 for a stolen card number with the purchasing power to buy a car? The card could be canceled at any time after purchase, he said, and there are inherent risks in using it.
Crime Wave
"In this whole carding scene, nothing is guaranteed," Poxxie said via ICQ, the online messaging network that is a common platform for doing business in the cyberunderground.
Poxxie's business is a boutique firm in an industrial-scale crime wave. Although the targets of cybercrime are still concentrated in the U.S. and Europe, the perpetrators are global. Some are independent operators who make a few thousand dollars a month, often supplementing their income with a day job. Others are members of large criminal organizations.
Hex Nightmare falls somewhere in between. When you conduct business with the 20-something cyberthief, the first -- and only -- thing you see is an avatar on ICQ: an anime version of a girl in hip huggers and a tank top. A person who has tracked her over several years said Hex Nightmare has managed to gain an impressive pedigree in the cyberunderground, learning quickly and moving in some of the most trusted circles of top cyberthieves.
Take-Home Pay
Her take-home from cybertheft, which concentrates mostly on stealing credit-card numbers and online banking credentials, compares with the pay of some lower-level corporate executives, she said via ICQ -- keeping her true identity secret. "I can possibly make an extra $8k a month on top of my regular income," she said.
To the young hacker, cybertheft is like a second job, one she juggles, she said, with going out to clubs on weekend nights and waitressing during the week. Her legitimate job is also a way to launder illicit income, she said. Hex Nightmare said she didn't want the debt of a university education and instead spent two years on the forums learning her trade. The hacker faces none of violence associated with other organized crime and otherwise leads a relatively normal life.
"They have no idea what I do," she said of friends and acquaintances. The details of the cyberthief's personal life -- including her real gender and age -- couldn't be verified but her business model and activities were corroborated by a security professional and fit the profile typical of young hackers, according to Eric Strom, an FBI special agent who heads an elite cyber team based in Pittsburgh.
Like Universities
"These are marketplaces, but they are also like universities," Strom said. "You have newbies on there, you have seasoned guys. It's a meeting place, it's a social networking place, everything wrapped into one."