Data Breaches; LexisNexis – FAA Hacked, Botnets Grow, Hackers Hold Data Ransom

/in , , , , , , , , , , , , , , /by

Identity Theft Expert

What a week. Just when it starts to get boring, criminal hackers put on a spectacular show.

Criminal hackers continue to step up to the plate. Security professionals are fighting, and sometimes losing, the battle. Here’s one week’s worth of hacks:

Lexis Nexis, which owns ChoicePoint, an information broker I recently blogged about that was hacked in 2005, was just hacked again this week. On Friday, LexisNexis Group notified more than 32,000 people that their information may have been stolen and used in a credit card scam that involved stealing names, birth dates and Social Security numbers to set up fake credit card accounts. The cybercriminals broke into USPS mailboxes of businesses that contained LexisNexis database information, according to a breach notification letter sent by LexisNexis to its customers. The U.S. Postal Inspection Service is investigating the matter. (Check your credit reports and examine        your credit card statements carefully!)

CNET reports that hackers broke into FAA air traffic control systems, too. The hackers compromised an FAA public-facing computer and used it to gain access to personally identifiable information, such as Social Security numbers, for 48,000 current and former FAA employees. In a House Oversight and Government Reform Subcommittee testimony, it was stated, “FAA computer systems were hacked and, as the FAA increases its dependence on modern IP-based networks, the risk of the intentional disruption of commercial air traffic has increased.”

Computerworld reports that a hacker has threatened to expose health data and is demanding $10 million. Good for him, bad for the Virginia Department of Health Professions. The alleged ransom note posted on the Virginia DHP Prescription Monitoring Program site claimed that the hacker had backed up and encrypted  more than 8 million patient records and 35 million prescriptions and then deleted the original data. “Unfortunately for Virginia, their backups seem to have gone missing, too. Uh oh,” posted the hacker. Holding data hostage is nothing new, but it is      becoming increasingly common.

The Register reports that bot-herders have taken control of 12 million new IP addresses in the first quarter of 2009, a 50% increase since the last quarter of 2008, according to an Internet security report from McAfee. The infamous Conficker superworm has occupied all the headlines, and makes a big contribution to the overall figure of compromised Windows PCs, but other strains of malware collectively make a big contribution to this number. McAfee’s Threat Report notes that the US is home to 18% of botnet-infected computers.

While you can’t do much about others being irresponsible with your data, you can protect your identity, to a degree. Consider investing in identity theft protection and always keep your Internet security software updated.

Robert Siciliano, identity theft speaker, discusses Ransomware.

Privacy Is Dead, Identity Theft Prospers

/in , , , , , , , , , , , , , , /by

My information is in lots and lots of different places. I sacrifice a lot of privacy because of the nature of my business. If I wasnt so dependant on eyeballs I’d live much differently. However to participate in society on any level, privacy becomes a dead issue. Accept it. Or live in the jungle in Africa.

A CEO of a major software company declares, “You have zero privacy, get over it.” In response, the FTC states, “Millions of American consumers tell us that privacy is a grave concern to them when they are thinking about shopping online.”

Do you agree? Is privacy dead? Do you share your “status” on Facebook? Twitter? Do you have a MySpace page? A blog? Do you post your family photos on any of the above, or on Flicker?

The statement, “You have zero privacy, get over it,” was made by Scott McNealy, former chief executive officer of Sun Microsystems, in 1999. That was 10 years ago. Before the phrase “social networking” or the word “blog” entered our lexicon.

Here we are in 2009, when that statement is 100 times more true than it was 10 years ago. When you ask people if they are concerned about online privacy, they respond with a big, loud, angry “YES!” Then they hypocritically use their Facebook pages to inform the world that they are about to go on vacation. Which means that the lights are off and nobody’s home.

It isn’t just web users voluntarily giving up their privacy, it’s also corporations and government agencies gathering data as a form of intelligence. This data might be used to sell you something or it could be used to protect us in the form of Homeland Security.

Our personal information can be bought and sold. “Information brokers” sell our data to anyone with a credit card. One of the largest publicly traded information brokers in the world is a company called ChoicePoint. Last time I checked, they had 19 billion records on file. And one of their biggest customers is the US government.

So even if you don’t update your Facebook status to tell the world you just made a tuna sandwich, chances are, your phone number, your most recent address, or even your anonymous chat handle can be found on Zabasearch.com or iSearch.com. If you’ve ever committed a felony, your data may be on CriminalSearches.com Heck, just Google yourself.

At least head to Facebook and lock down your privacy settings. You get to them from the Settings –> Privacy Settings menu.

If you are reading this, you are participating in society. The price you pay is sacraficing your personal identifying information in order to get an Internet connection, credit, a car, medical attention, to go to school or buy a pair of shoes. While many citizens scream against Big Brother and corporate America abusing their trust, many will also give up all their privacy for ten% off a new pair of shoes.

All this makes it very easy for criminal hackers to commit identity theft. They use this available data to become you. Since your data is already out there, you’d better invest in identity theft protection and make sure your PC is up to date with Internet security software.

For more information, I recommend You Have Zero Privacy – Enjoy It! by Mike Spinny, and Cyberwar’s First Casualty: Your Privacy by Preston Gralla and Why give up Privacy? by Bob Sullivan

Robert Siciliano, identity theft expert, discusses background checks.