TJX Identity Theft Costs Another 10 million, Protect Yourself from WarDriving

/in , , , , , , , , , , , , , , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Most people are familiar with the TJX data breach, in which 45 million credit card numbers were stolen. TJX recently agreed to pay $9.75 million to 41 states to settle an investigation of the massive data breach. According to some reports, TJX has spent up to $256 million attempting to fix the problem that led to the breach.

It’s been said repeatedly that the criminal hackers responsible for the breach were sitting in a car outside a store when they stumbled across a vulnerable, unprotected wireless network using a laptop, a telescope antenna, and an 802.11 wireless LAN adapter. This process is called “Wardriving.”

WiFi is everywhere. Whether you travel for business or simply need Internet access while out and about, your options are plentiful. You can sign on at airports, hotels, coffee shops, fast food restaurants, and now, airplanes. What are your risk factors when accessing wireless? There are plenty. WiFi wasn’t born to be secure. It was born to be convenient. As more sensitive data has been wirelessly transmitted over the years, the need for security has evolved. Today, with criminal hackers as sophisticated as they ever have been, wireless communications are at an even higher risk.

When setting up a wireless router, there are two different security techniques you can use. WiFi Protected Access is a certification program that was created in response to several serious weaknesses researchers had found in the previous system, Wired Equivalent Privacy. Wired Equivalent Privacy was introduced in 1997 and is the original form of wireless network security. Wireless networks broadcast messages using radio and are thus more susceptible to eavesdropping than wired networks.

It’s one thing to access your own wireless connection from your home or office. It entirely another story when accessing someone else’s unprotected network. Setting up a secure WiFi connection will protect the data on your network, for the most part, but if you’re on someone else’s network, secured or unsecured, your data is at risk. Anyone using an open network risks exposing their data. There are many ways to see who’s connected on a wireless connection, and gain access to their data.

There are a few things you should do to protect yourself while using wireless. Be smart about what kind of data you transmit on a public wireless connection. There’s no need to make critical transactions while sipping that macchiato.

Don’t store critical data on a device used outside the secure network. I have a laptop and an iPhone. If they are hacked, there’s nothing on either device that would compromise me.

Install Hotspot Shield. A free ad supported program, Hotspot Shield protects your entire web surfing session by securing your connection, whether you’re at home or in public, using wired or wireless Internet. Hotspot Shield does this by ensuring that all web transactions are secured through HTTPS. They also offer an iPhone application. There are fee based programs, including Publicvpn.com and HotSpotVPN, which can create a secure “tunnel” between a computer and the site’s server.

Turn off WiFi and blue tooth on your laptop or cell phone when you’re not using them. An unattended device emitting wireless signals is very appealing to a criminal hacker.

Beware of free WiFi connections. Anywhere you see a broadcast for “Free WiFi,” consider it a red flag. It’s likely that free WiFi is meant to act as bait.

Beware of evil twins. These are connections that appear legitimate but are actually traps set to snare anyone who connects.

Keep your antivirus and operating system updated. Make sure your anti-virus is automatically updated and your operating systems critical security patches are up to date.

Invest in Intelius Identity Protect. Because when all else fails you’ll have someone watching your back. Includes a Free Credit Report, SSN monitoring, Credit & Debit Card monitoring, Bank Account monitoring, Email fraud alerts, Public Records Monitoring, Customizable “Watch List”, $25,000 in ID theft insurance, Junk Mail OptOut and Credit Card Offer OptOut.

Robert Siciliano identity theft speaker discussing criminal wireless hack

Insider Identity Theft Poses Major Threats

/in , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

A Boston woman has been indicted for allegedly stealing at least 34 identities, which she was able to access from her workplace, a medical cost-management firm.

“This was an extensive scheme in which the defendant used her access to the victims’ personal identifying information as a means to steal their identities, obtain credit cards in their names without their knowledge, and then use those credit cards to make purchases for her own personal gain,” said the local District Attorney. “The defendant had access to a large database of health care professionals that contained their personal information.”

State police learned of the fraud when a physician discovered that a credit card had been set up in her name and sent to a P.O. Box in Lowell, Massachusetts. Further investigation by postal inspectors revealed that other cards had also been sent to this P.O. Box. If convicted, she could face up to 75 years in state prison for 15 counts of grand larceny, 100 years for 20 counts of credit card fraud, 55 years for 22 counts of identity theft, and 20 years in for being a “common and notorious thief.”

As much as 70% of all identity theft is committed by someone with inside access to organizations such as corporations, banks or government agencies, or simply someone who has an existing relationship with the victim. People with access to sensitive personal data are most likely to commit identity theft. For many, it’s just too easy not to.

An identity thief begins by acquiring a target’s personal identifying information: name, Social Security number, birth date and address, in that order. If the thief has regular access to a database, he can simply copy and paste the information into an online credit application, or hand write the information on a paper credit card application.

Many credit applications request current and previous addresses. So the thief fills out the victim’s current address as “previous” and plugs in a new address, usually a P.O. Box or the thief’s own address, where the new credit card will be sent. I’m amazed that a lender or credit card company can be careless enough to send a new credit card to a relatively anonymous P.O. Box. The lender just checks the victim’s credit and, since everything matches, no red flags pop up. The card is issued and the fun begins.

Once the thief receives the new card, he or she activates it from a throwaway cell phone. The next step is to either use the card to withdraw as much cash as possible from an ATM, or max it out with charges and then resell the stolen goods through classified ads or online auctions. If the thief is suffering from a drug addiction, it can be impossible to stop this cycle, because stealing identities goes hand in hand with addictive behavior. It’s like gambling. Thieves get a high or a rush when they feel they’re beating the system.

In the case of the Boston woman mentioned above, most people’s first response would be a determination that her employer should have done more to protect the data. There are numerous technologies that monitor, manage, control and restrict who has access to sensitive information. Today, these technologies are being deployed more often than ever before, due to various regulatory issues. However, regardless of what technologies are deployed, all you need to open a file cabinet is a key, if the cabinet is even locked in the first place. So how do you protect yourself when someone has full access to all your information?

1. Get a credit freeze. Go online now and search “credit freeze” or “security freeze” and go to consumersunion.org and follow the steps for the state you live in. This is an absolutely necessary tool to secure your credit. In most cases it prevents new accounts from being opened in your name.
2. Invest in Intelius Identity Protect. While not all forms of identity theft can be prevented, you can effectively manage your personal identifying information by knowing what’s buzzing out there in regards to YOU.

Includes;
Personal Identity Profile – Find out if you’re at risk for identity theft with a detailed report of your identity information, including a current credit report, address history, aliases, and more.

24/7 Identity Monitoring and Alerts – Prevent identity theft with automatic monitoring that scans billions of public records daily and alerts you to suspicious activity.

Identity Recovery Assistance – Let professionals help you recover your identity if you ever become a victim of identity theft.

Robert Siciliano Identity Theft Speaker discussing identity theft

Identity Theft Ring Pickpockets Caught by Feds

/in , , , , , , , , , , /by

Identity Theft Expert Robert Siciliano

If there were a “criminal hall of fame,” with an award bestowed on the “coolest” criminal, it would have to be a pickpocket. Pickpockets are sneaky, devilish creatures who function exactly one degree below the radar.

Pickpockets whisper through society, undetected and undeterred. They are subtle and brazen at the same time. They are  like a bed bugs, crawling on you and injecting a numbing venom that prevents you from detecting their bite until it’s much to late. They aren’t violent like a drug crazed mugger or confrontational like a stick up robber. They have much more gumption than any criminal hacker because they don’t hide under the anonymity of the Internet.

One second is all a pickpocket needs. A brief diversion, a quick move, and before you can take a breath, your wallet is gone.

Pickpocketing is one of the oldest criminal professions, and is still very prevalent in Europe. Their target? Clueless Americans. Americans just aren’t as aware of pickpockets, since it isn’t as prevalent here.

One victim’s story: “My wife and I were at a Paris Metro station where the loudspeakers were blaring, ‘WARNING. THERE ARE PICKPOCKETS PRESENT AT THIS STATION.’ We got on the crowded subway. A woman stayed half on and half off, blocking the door. At the same time, another woman was bumping against me, indicating that she needed to get off. She got past me and she and her friend exited the train, allowing the door to close. As she did, I realized that my cash (about $120) was gone from my pocket. As we pulled away, I watched the two women at the station, smiling and waving at me.”

Pickpockets’ greatest advantage is the fact that most people don’t believe it can happen to them. Including me.

Years ago, I met this cat named Gene Turner at a convention. A great guy who has the skills of a real pickpocket, but uses his abilities to inform, educate and entertain people. I told him to get Pickpocket.com, which he did. I should get a slice of that action! Real nice guy, very personable. He introduced himself to me by – without me knowing – taking my watch off my left wrist. Then asked me what time it was. I looked at my left wrist, no watch. He pointed to my right arm, where he re-fastened it. Freaked me out.

Gene says, “Personally, I get ‘caught’ maybe once out of a thousand times when I’m lifting a watch. And usually it’s either a really difficult watch or I’m taking it from the same person for the third or fourth time. I have always said a good pickpocket could pick me clean and I would never feel it. Even the best multi-tasker can be distracted, and it only takes a split second of distraction to become a victim. I have lifted watches from and put watches on many magicians, security people and yes, even other pickpockets, without their knowledge.”

Wired reports that pickpockets have upped the ante: “Feds Swoop In on Nationwide Pickpocket, I.D. Theft Ring.” The suspects, using a novel and high-tech strategy, allegedly stole the identities and bank account information from victims nationwide through pickpocketing and other means. The ring allegedly traveled around the country to crowded events, targeting sports fans in particular. Often, they worked in teams, in which one person distracts the victim and the other lifts the victim’s wallet.

How to protect yourself:

1. Be wary of someone yelling, “There’s a pickpocket in the crowd.”

Gene says, “I use this ploy a lot in my show. When people find out that I can pick pockets, the men check for their wallets and the women will check for their jewelry in the order of value – most expensive first. Their actions clue me as to exactly where the wallets and valuable jewelry are located.”

A man in a business suit has four pants pockets and six to eight pockets in the jacket. His wallet, cash and credit cards could be in any one of ten or more pockets. Pickpockets don’t usually have time to search all ten, but if they see you check your pocket when you read the sign, they now know the exact location. If you think there are pickpockets around or you see a sign, don’t be obvious about checking for your wallet or valuables.

2. Don’t display money or valuables in public.

Flashing your money will get you more attention than you want. Pickpockets will notice where you stash the cash and one bump later, you’ll be left with an empty pocket.

3. Be aware of your surroundings.

Especially in crowded places, bumps, commotions, and aggressive people are the typical distractions pickpockets use. Sometimes a person will fall down, drop something or appear to be ill, and we rush in to help. That’s great and I recommend it, but it may be a diversion. If you’re helping a stranger, make sure someone you trust is watching your valuables. Sidewalks, malls, bus terminals, airports, train stations, in any type of crowd it is extremely important to be aware of your surroundings. Pickpockets are counting on you paying attention to everything except for your wallet or purse.

4. Don’t carry valuables in a backpack or fanny pack.

Anyone can reach into a backpack without you seeing or feeling. Fanny packs, if worn, should only be worn in front. Keep in mind that that won’t prevent a thief from undoing it or slashing the belt and getting away with it. If you do wear a fanny pack, make sure the buckle is near the pouch in front, so a pickpocket would have a more difficult time getting to the latch without your knowledge. It is not uncommon for a pickpocket to use a razor blade to slice through a bag and reach in.

5. Thin out your wallet.

Ultimately, they may still get your wallet. And when they do, you need to be prepared to respond to the fallout. The best protection is to not carry anything of value. There is no need to carry documents containing Social Security numbers, passwords, account numbers, birth certificates or anything that could lead to new account fraud. I carry a drivers license, credit card and a Costco card. Think of it this way: if your wallet were lost or stolen, would you feel like throwing up? If so, you have too much stuff in there.

6. Make copies.

For those of you that have to carry lots of stuff for various reasons, please make a photocopy, front and back, of every document in your wallet. Keep those photocopies in a secure place. If your wallet goes missing, you will have everything you need to close the existing cards and get new ones. Plus, it doesn’t hurt as much when you can see a copy of the missing cards.

7. Use anti-check washing pens.

Wallets often contain checkbooks. Check fraud is a billion dollar problem. Check washing occurs when criminals use nail polish remover to scrub out the payee and dollar amount, and rewrite checks to themselves for increased  amounts. With a uni-ball anti-check washing gel pen, you can prevent your checks from being washed.

8. Protect your identity
Invest in intelius identity theft protection and prevention services. Even if your wallet is squeaky clean, your data may be found in your banks dumpster or be hacked. Which is why you also must protect your computer by having the latest McAfee anti-virus and spyware protection.

Robert Siciliano Identity Theft Speaker discussing identity theft ring busted

mCrime; Hacking Mobile Phones for Identity Theft

/in , , , , , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

History indicates that we are at the forefront of an era in which criminal hackers develop tools and techniques to steal your money using your own cell phone.

Fifteen years ago, cell phones were so bulky and cumbersome, they had to be carried in bags or briefcases. Then they became chunky, heavy bricks. Calls dropped every other minute. Clearly, cell phones have evolved since then. Today’s cell phone is a lot more than a phone. It’s a computer, one that rivals many desktops and laptops being manufactured today. A cell phone can pretty much do everything a PC can do, including online shopping, banking, and merchant credit card processing.

The personal computer started out slow and stodgy, and was mainly used for things like word processing and solitaire. Today, PCs are fast, multimedia machines, capable of performing amazing tasks.

There are consequences to the rapid evolution of these technologies.

A decade ago, during the slow, dial up era, hackers (and, in the beginning, phreakers) hacked for fun and fame. Many wreaked havoc, causing problems that crippled major networks. And they did it without today’s sophisticated technology.

Meanwhile, the dot-com boom and bust occurred. Then, as e-commerce picked up speed, high speed and broadband connections made it easier to shop and bank online, quickly and efficiently. Around 2003, social networking was born, in the form of online dating services and Friendster. PCs became integral to our fiscal and social lives. We funneled all our personal and financial information onto our computers, and spent more and more of our time on the Internet. And the speed of technology began to drastically outpace the speed of security. Seeing an opportunity, hackers began hacking for profit, rather than fun and fame.

Now, iPhones and other smart phones have become revolutionary computers themselves. For the next generation, the phone is replacing the PC. AT&T recently announced that they’ll be upping the speed of the latest version of their 3G network, doubling download speeds. It has been reported that the next iPhone will have 32 gigabytes. That’s more hard drive than my three year old laptop.

So naturally, criminal hackers are considering the possibilities offered by cell phones today, just as they were looking at computers five years ago.

Two things have changed the game: the speed and advancement of technology and spyware. Spyware was created as a legitimate technology for PCs. Spyware tracks and records social network activities, online searches, chats, instant messages, emails sent and received, websites visited, keystrokes typed and programs launched. It can be the equivalent of digital surveillance, revealing every stroke of the user’s mouse and keyboard. Parents can use spyware to monitor their young children’s surfing habits and employers can make sure their employees are working, as opposed to surfing for porn all day.

Criminal hackers created a cocktail of viruses and spyware, which allows for the infection and duplication of a virus that gives the criminal total, remote access to the user’s data. This same technology is being introduced to cell phones as “snoopware.” Legitimate uses for snoopware on phones do exist: silently recording caller information, seeing GPS positions, monitoring kids’ and employees’ mobile web and text messaging activities. Criminal hackers have taken the snoopware and spyware technology even further. Major technology companies agree that almost any cell phone can be hacked into and remotely controlled. Malicious software can be sent to the intended victim disguised as a picture or audio clip, and when the victim clicks on it, malware is installed.

One virus, called “Red Browser,” was created specifically to infect mobile phones using Java. It can be installed directly on a phone, should physical access be obtained, or this malicious software can be disguised as a harmless download. Bluetooth infared is also a point of vulnerability. Once installed, the Red Browser virus allows the hacker to remotely control the phone and its features, such as the camera and microphone.

While this may sound improbable, I’ve consulted and appeared on television (Tyra Banks and Fox) with an entire family that seems to have been victimized by every aspect of snoopware. The Kuykendalls, of Tacoma, Washington, found that several of their phones had been hijacked in order to spy on them. They say the hacker was able to turn a compromised phone on and off, use the phone’s camera to take pictures, and use the speakerphone as a bug. Ever since the program featuring the Kuykendalls’ story aired and continues to repeat, I’ve received dozens of emails from people around the world who have experienced the same thing. Many of these people seem totally overwhelmed by what has happened to them, and some are beginning to suffer financial losses.

If history is any indication of the future, mobile phones, just like computers, will soon be regularly hacked for financial gain. Prepare for mCrime in the form of credit card fraud, identity theft and data breaches.

Some Internet security software providers are beginning to offer software specifically for mobile phones. In the meantime, identity theft protection services are one line of defense against the latest cybercrime techniques.

Robert Siciliano, identity theft speaker, discusses hacked cell phones.

ATM Skimmer Defeated By Customer

/in , , , , , , , , , , , , /by

Identity Theft Expert Robert Siciliano

Its not often that I get to report on the victim becoming the victor. It’s nice to see the good guys win one.

I met a charismatic gent on FOX and Friends named Sean Seibel. Sean has a unique job title at Microsoft: User Experience Evangelist. Sean’s job is to be on top of what’s new and what’s next in technology, in the next 5-7 years. He’s a futurist. He and I spoke in the green room of the show before we appeared together on a segment regarding ATM skimming.

ATM skimming often results in forms of identity theft, credit card fraud or bank fraud.

To be a User Experience Evangelist requires a certain vision, insight and the ability to go beyond what’s current or obvious. Sean proved his ability to see “more” by trumping a gang of identity thieves who set out to steal millions from ATMs but “only” got away with $500,000.

Sean stopped at an ATM to get some cash to pay his barber. When he inserted his ATM card in the machine, he noticed a bit of resistance. Most people wouldn’t think twice about this. But Sean doesn’t think like most people. Then the screen said the machine was unable to read his card so he tried again. The second time, the machine gave him an error message. Before he tried again, he thought about a report he had heard about devices that fraudsters attach to the outside of card readers on ATM machines and wondered if that was the source of his problem.

He says, “I’m looking at the thing and thinking, this can’t be. No way. There are all these stories and myths about it, but I actually found one in the wild.”

Sean was face to face with an ATM skimmer, one that he had just swiped his card through. His heart started pounding. Adrenalin was rushing through his body. He was concerned, not just that he might be scammed, but that criminals might be very close by, maybe even behind him or watching him. However, that did not deter him.

Sean says, “I tried to pull on the green plastic surrounding the card slot and found that it peeled right off.” This plastic ATM skimmer had an SD card built into it to store all the stolen data. Sean went into the bank and notified the branch manager, who had never seen an ATM skimmer and didn’t know what to do. She took the skimmer and thanked Sean.

Then Sean remembered, from numerous reports about ATM skimming, that there are usually 2 parts to the ATM skimmer. One is the skimming device itself, the second is a micro-camera placed somewhere on the machine, where it 1arecords the user’s PIN. The camera is often installed in a false brochure holder that taped to the ATM. In this case, it was behind a small mirror that alerts the ATM user to beware of “shoulder surfers.”

Sean went back to the still operational ATM, where people were waiting in line for their cash, and noticed a tiny video camera behind an extra mirror attached to the machine, positioned right over the key pad where it could record user’s PINs. Not being a bank employee and not wanting to alarm any of the people iwaiting, he actually got in line, waited his turn (knowing that the skimmer was gone and nobody was in danger) and pulled the camera off the ATM.

He brought the camera to the bank manager, who replied by saying, “Maybe we should shut 2b*that machine down, huh?” Sean said, “I think that’s a good idea.” The bank manager contacted bank security, shut down the machine and alerted other area banks. The identity thieves netted $500,000 from their scam, rather than the millions they might have stolen had Sean Seibel not foiled their operation.

Bank branch manager…ZERO
Identity Thieves……….$500,000
Sean Seibel foiling their operation and becoming a hero to many….Priceless.

Some great tips from Marite Ferrero, of CardSwitch Technology:

  • Skimming has been and will continue to be the most common type of ATM-related fraud.
  • Criminals attach skimming devices over card slots on ATMs to steal data as the machine reads the card’s magnetic strip.
  • Hidden cameras record victims typing in their PIN codes.
  • More sophisticated criminals use wireless keypad overlays, which transmit PINs to a nearby laptop, instead 3bof cameras.
  • The U.S. Secret Service estimates that annual losses from ATM skimming total about $1 billion each year, or $350,000 a day.
  • Bank ATMs are more vulnerable than standalone ATMs.
  • Standalone ATMs in grocery stores or on the street use technology that encrypts the PIN pad, making them more difficult for criminals to hack.
  • Standalone ATMs are often positioned near the watchful eye of cashiers or store owners, so it’s harder to install skimmers without being caught.
  • Bank ATMs are also more highly trafficked, which means a bigger potential payoff for the criminals.

Also, invest in identity theft protection and make to update your PC’s McAfee internet security software.

Identity theft expert Robert Siciliano discusses ATM skimming.

Data Breaches; LexisNexis – FAA Hacked, Botnets Grow, Hackers Hold Data Ransom

/in , , , , , , , , , , , , , , /by

Identity Theft Expert

What a week. Just when it starts to get boring, criminal hackers put on a spectacular show.

Criminal hackers continue to step up to the plate. Security professionals are fighting, and sometimes losing, the battle. Here’s one week’s worth of hacks:

Lexis Nexis, which owns ChoicePoint, an information broker I recently blogged about that was hacked in 2005, was just hacked again this week. On Friday, LexisNexis Group notified more than 32,000 people that their information may have been stolen and used in a credit card scam that involved stealing names, birth dates and Social Security numbers to set up fake credit card accounts. The cybercriminals broke into USPS mailboxes of businesses that contained LexisNexis database information, according to a breach notification letter sent by LexisNexis to its customers. The U.S. Postal Inspection Service is investigating the matter. (Check your credit reports and examine        your credit card statements carefully!)

CNET reports that hackers broke into FAA air traffic control systems, too. The hackers compromised an FAA public-facing computer and used it to gain access to personally identifiable information, such as Social Security numbers, for 48,000 current and former FAA employees. In a House Oversight and Government Reform Subcommittee testimony, it was stated, “FAA computer systems were hacked and, as the FAA increases its dependence on modern IP-based networks, the risk of the intentional disruption of commercial air traffic has increased.”

Computerworld reports that a hacker has threatened to expose health data and is demanding $10 million. Good for him, bad for the Virginia Department of Health Professions. The alleged ransom note posted on the Virginia DHP Prescription Monitoring Program site claimed that the hacker had backed up and encrypted  more than 8 million patient records and 35 million prescriptions and then deleted the original data. “Unfortunately for Virginia, their backups seem to have gone missing, too. Uh oh,” posted the hacker. Holding data hostage is nothing new, but it is      becoming increasingly common.

The Register reports that bot-herders have taken control of 12 million new IP addresses in the first quarter of 2009, a 50% increase since the last quarter of 2008, according to an Internet security report from McAfee. The infamous Conficker superworm has occupied all the headlines, and makes a big contribution to the overall figure of compromised Windows PCs, but other strains of malware collectively make a big contribution to this number. McAfee’s Threat Report notes that the US is home to 18% of botnet-infected computers.

While you can’t do much about others being irresponsible with your data, you can protect your identity, to a degree. Consider investing in identity theft protection and always keep your Internet security software updated.

Robert Siciliano, identity theft speaker, discusses Ransomware.

E-banking just got less secure

/in , , , , , , , , , , , /by

Robert Siciliano Identity Theft Speaker

There is no end to the ingenuity of the criminal hacker. They’ve figured out how to hack debit card PINS. Debit cards are linked directly to our checking accounts, which makes them tasty treats for criminal hackers.

At an ATM or cash register, most debit card users are blissfully unaware of what occurs when they swipe their cards and enter their pin numbers. A magical mystery takes place and we get to walk away with our new purchase, simply by swiping a card and tapping a few keys. The money magically disappears from our account and we celebrate by eating the Twinkie we just bought.

Whether you’re swiping your debit card at an ATM or in a store or restaurant, the process is similar. The user swipes his or her card and types in the pin number. The data is verified by a 3rd party payment processor or, in some cases, by a bank, over telephone lines or the Internet. Once the information has been validated and the payment processor confirms that the required funds exist, the money is moved from the user’s account to the merchant’s account, or is dispensed in cash.

The convenience of debit cards has led to global popularity that vastly exceeds that of handwritten checks, all the way into 3rd world countries.

We’ve known for some time that low-tech skimming at ATMs and gas pumps has been a point of compromise. Now, Wired reports that the transaction itself puts your PIN number at risk. Academics discovered this flaw years ago, but didn’t think it would be possible to execute in the field. Criminal hackers, however, have come up with the holy grail of hacks, stealing large amounts of encrypted and unencrypted debit card and pin numbers. And they have figured a way to crack the encryption codes.

The first signs of PIN tampering were recognized when investigators studied the processes of the 11 criminals who were caught after the TJX data breach. That breach involved 45 million credit and debit cards. The crime ring needed PIN codes to turn that data into cash. An investigation into this breach reported that the hacks resulted in “more targeted, cutting-edge, complex, and clever cyber crime attacks than seen in previous years.”

This revelation has some saying that the only cure for this type of hack is a complete overhaul to the payment processing system.

The compromise occurs in a device called a hardware security module (HSM), which sits on bank networks. PIN numbers pass through this device on their way to the card issuer. The module is tamper-resistant and provides a secure environment for encryption and decryption for PINs and card numbers. Criminal hackers are accessing HSMs and tricking them into providing the decrypting data. They are installing malware called “memory scrapers,” which capture the unencrypted data and use the hacked system to store it.

The PCI Security Standards Council, a self regulating body that oversees much of what occurs regarding payment card transaction, said they would begin testing HSMs. Bob Russo, general manager of the global standards body, said that the council’s testing of the devices would “focus specifically on security properties that are critical to the payment system.”

I don’t own a debit card and never have and never will. Simply put, if my debit card were hacked, that money would be coming directly from my bank account. A compromised ATM or point of sale transaction often fails to exhibit evidence of hacking. This means that I’d have to go through the arduous process of convincing my bank that it wasn’t me who withdrew thousands of dollars from my account. Whereas if a credit card is compromised, the zero-liability guarantee kicks in and I’m cured much more quickly.

Your ultimate responsibility here is to check your statements very closely and look for unauthorized activity. Read your statements online biweekly as opposed to relying solely on your monthly paper statement, and refute unauthorized charges immediately. Consider using a credit card instead of a debit card.

While this type of fraud is generally out of your control it’s still imperative you invest in internet security software such as McAfee and consider identity theft protection.

Identity Theft Expert discussing flawed card transactions

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Conficker flexes muscles, phones home

/in , , , , , , , , , , , /by

Identity Theft Expert Robert Siciliano

The internets number one virus Conficker, called home and sent its next set of updates to its global botnet.

Conficker’s botnet, which includes anywhere from 3 to 15 million PCs, has a peer to peer (P2P) feature that allows each PC on the network to talk to one another. Each PC has the ability to become the command server. This characteristic allows Conficker to fluidly update each PC on the network.

The latest variant shows that Conficker is updating via P2P, as opposed to pinging a website for its updates. This makes Conficker “self reliant.”

A botnet is a robot network of zombie computers under the control of a single leader. The concept behind a botnet is strength in numbers. Botnets can attack websites, send spam, and log data, which can lead to data breaches, credit card fraud and identity theft, and ultimately clog a network until it shuts down.

CNET reports that researchers have observed Conficker making its first update, which they believe to be a keystroke logger, a form of spyware designed to log usernames and passwords. This new update also tells the zombies to seek other PCs that have not been patched with Microsoft’s update. The worm also pings websites including MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com in order to determine whether that PC has Internet access.

The Register reports that Conficker is now pinging what’s known as a Waledac domain, which contacts a new server if the current one is blacklisted by ISPs for spamming. This allows the virus to download more updates.

In 2007 and 2008, the Storm Worm was thought to have infected over 50 million PCs. Waledac is using the same technology as the Storm Worm,which means two things. First, this may get ugly fast. And second, whoever is controlling Waledac must be the same criminal hackers that built Storm Worm.

All this means that Conficker is about as dangerous as a virus can be, with the best of the best technologies, both old and new. While the virus has yet to strike, it is definitely gearing up.

 

Identity theft speaker Robert Siciliano discusses criminals using viruses to hack credit cards.

To protect yourself, be sure you have updated Internet security software, and consider an identity theft protection service.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information

Credit card fraud is Americans number one concern

/in , , , , , , , , , , , /by

Identity theft Expert Robert Siciliano

A recent study conducted by the Unisys Corporation shows that identity theft as it pertains to credit card fraud is Americans’ number one concern.

When people ask me, “How do I protect myself from credit card fraud?” I tell them, “Cancel the card, or never use it.” Because that’s the only way.

Personal security (as it pertains to violence) and national security have always been a concern. However, this new study shows that people are more concerned with fraud, and the risk of having their savings depleted by scammers. Not so hard to believe, what with the number of data breaches, and the Madoffs of the world fleecing their unsuspecting investors.

75% of Americans feel that the recession has increased their chances of being victimized by criminal hackers and thieves. Most are also concerned their “private” information on a corporate or bank network may be compromised.

FBI’s Internet Crime Complaint Center’s 2008 Annual Report determined that online fraud increased by 33.1% last year. Dollar losses resulting from online fraud increased to $265 million.

Overall, these concerns are valid, due to flaws in the system of issuing credit that facilitate new account fraud. Furthermore, account takeover requires nothing more than access to credit card numbers, which are available in hacked databases or susceptible every time you hand your card over to a gas station attendant.

Viruses in spam or phishing emails continue to plague consumers and as scammers get more sophisticated, the chances of getting hooked increase.

Banks and business will continue to feel the pressure as criminals target their clients’ data.

Credit card skimming at ATMs and gas pumps makes it impossible to protect yourself when you could essentially be handing your digits over to a criminal.

Skimming is one of the financial industry’s fastest-growing crimes, according to the U.S. Secret Service. The worldwide ATM Industry Association reports over $1 billion in annual global losses from credit card fraud and electronic crime associated with ATMs.

Marite Ferrero, a blogger with Finextra, adds, “In Europe, the points of compromise are everywhere: ATM, gas pumps, parking, DVD rentals, movie tickets, food kiosks, tolls, buying metro tickets, and the list goes on… Because of chip and pin implementation, the proliferation of stand-alone terminals that accept chip and pin has provided a profitable playground for fraudsters.”

While the card holder is generally only responsible for the first $50.00 in losses, which is often waived by a “zero liability policy,” card holders who don’t pay attention to their statements often let these charges pass and eat them.

There are many technologies available to secure credit cards, such as “smart cards” and “chip and pin.” However, due to the nature of a credit card transaction, once the data leaves the card, it’s up for grabs. Whatever card security their may have been is now gone.

Check your credit and banking statements carefully. Scrutinize every charge and refute any unauthorized charges within 30-60 days. Call your bank or credit card company immediately if you see any fraudulent activity.

Invest in identity theft protection. Credit freezes or fraud alerts help prevent new account fraud. Protect your PC with McAfee, or other Internet security software.

Robert Siciliano, identity theft speaker, discusses credit card fraud.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

WWW. Weird Wild Web Goes Nutty

/in , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Every day new reports of another flaw and another breach. Today we learn attacks rise 33 percent. I’m not surprised.

Credit card details of 19,000 Brits have been found on a cached Google page, where they had been accidentally published by fraudsters. Silly criminal hackers need to tighten up their data security controls and not publish sensitive data like that!

Reuters reports – Fraud on the Internet reported to U.S. authorities increased by 33 percent last year, rising for the first time in three years, and is surging this year as the recession deepens, federal authorities said.

Internet fraud losses reported in the United States reached a record high $264.6 million in 2008, according to a report released on Monday from the Internet Fraud Complaint Center, run by the FBI and the National White Collar Crime Center.

CNBC reports Online scams originating from across the globe—mostly from the United States, Canada, Britain, Nigeria and China—are gathering steam this year with a nearly 50 percent increase in complaints reported to U.S. authorities in March alone.

About 74 percent of the scams were through e-mail messages last year, especially spam, while about 29 percent used websites. But criminals were increasingly tapping new technologies such as social networking sites and instant messenger services.

The report highlights one new ‘significant’ identity-theft scam involving e-mail messages that give the appearance of originating from the FBI but seek bank account information to help in investigations of money being transferred to Nigeria.

Recipients of the e-mails are told they could be richly rewarded by cooperating. Duh.

Criminal hackers are going hog wild.

Invest in identity theft protection and secure your PC with anti-virus protection such as McAfee

Meanwhile two scumbag criminal hackers are arrested while spying on children between the ages of 14 and 17 using the child’s personal Web cam. The degenerates worked together to extort money from teenagers in exchange for stolen images.

They allegedly gained access to computers using a variety of e-mail addresses and screen names.

Conficker is spawning new hacks such as Scareware as Scammers are taking advantage of the huge interest in the impending “activation” of the Conficker superworm by poisoning search engine results.

Washington Post reports experts have discovered a security hole in the computer code that powers the Conficker worm, an aggressive contagion that has spread to more than 12 million Microsoft Windows systems worldwide.

Stay tuned…

Robert Siciliano Identity Theft Speaker discusses credit card scams here

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.