📸 Photo

KINGPIN

DarkMarket turned out to be an unguarded spot. A British carder called JiLsi ran the site, and he’d made the mistake of choosing the same password—“MSR206”—everywhere, including Carders Market, where Max knew everyone’s passwords. Max could just walk in and take over. The Vouched, on the other hand, was a fortress—you couldn’t even connect to the website without a privately issued digital certificate installed in your browser. Fortunately, JiLsi was also a member of that site, and he had moderator privileges there. Max found a copy of the certificate in one of JiLsi’s webmail accounts, protected by the carder’s usual password. From there, it was just a matter of logging in as JiLsi and leveraging his access to get at the database.

On TalkCash and ScandinavianCarding, Max determined that the forum software’s search function was vulnerable to an “SQL injection” attack. It wasn’t a surprising discovery. SQL injection vulnerabilities are the Web’s most persistent weakness.

SQL injection has to do with the behind-the-scenes architecture of most sophisticated websites. When you visit a website with dynamic content—news articles, blog posts, stock quotes, virtual shopping carts—the site’s software is pulling the content in raw form from a back-end database, usually running on a completely different computer than the host to which you’ve connected. The website is a facade—the database server is the important part, and it’s locked down. Ideally, it won’t even be accessible from the Internet.

The website’s software speaks to the database server in a standard syntax called Structured Query Language, or SQL (pronounced “sequel”). The SQL command SELECT, for example, asks the database server for all the information that fits a specified criteria. INSERT puts new information in the database. The rarely used DROP instruction will mass-delete data.

It’s a potentially perilous arrangement, because there are any number of situations where the software has to send a visitor’s input as part of an