📸 Photo

KINGPIN

listen in on 911 calls. A third put him in a home owner’s climate control system; he raised the temperature ten degrees and moved on.

A tiny fraction of the systems were more interesting and also familiar from his ongoing intrusion into the Pizza Schmizza: They were restaurant point-of-sale systems. They were money.

Unlike the simple dumb terminals sitting on the counters of liquor stores and neighborhood grocers, restaurant systems had become sophisticated all-in-one solutions that handled everything from order taking to seating arrangements, and they were all based on Microsoft Windows. To support the machines remotely, service vendors were installing them with commercial back doors, including VNC. With his VNC skeleton key, Max could open many of them at will.

So Max, who’d once scanned the entire U.S. military for vulnerable servers, now had his computers trolling the Internet day and night, finding and cracking pizza joints, Italian ristorantes, French bistros, and American-style grills; he harvested magstripe data everywhere he found it.

Under Visa-issued security standards, that shouldn’t have been possible. In 2004 the company outlawed the use of any point-of-sale system that stores magstripe data after a transaction is complete. In an effort to comply with the standards, all the major vendors produced patches that would stop their systems from retaining the swipes. But restaurants weren’t racing to install the upgrade, which in some cases was a paid extra.

Max’s scanning machinery had several moving parts. The first was aimed at finding VNC installations by performing a high-speed “port sweep”—a standard reconnaissance technique that relies on the Internet’s openness and standardization.

From the start, the network’s protocols were designed to let computers juggle a variety of different types of connections simultaneously—today that can include e-mail, Web traffic, file transfers, and hundreds of other more esoteric services. To keep it all separate, a computer initiates new connections with two pieces of information: the IP address of the destination machine, and a virtual “port” on that machine—a number from 0 to