Identity Theft Expert; Organized Webmobs Focused on Cyber Crime

/in , , , , , , , , , , , , /by

Identity Theft Expert Robert Siciliano

New reports confirm what we have been seeing in the news; organized criminals have upped the ante. Global web mobs are tearing up financial institutions’ networks.

We’ve known for some time that the long-haired, lowly, pot-smoking, havoc-reeking hacker, sitting alone in his mom’s basement, hacking for fun and fame is no more. He cut his hair and has now graduated into a full time professional criminal hacker, hacking for government secrets and financial gain.

His contacts are global, many from Russia and Eastern Europe, and they include brilliant teens, 20-somethings, all the way up to clinical psychologists who are organized, international cyber criminals.

We are in the middle of a cold cyber crime war.

Their sole motivation is money and information and they either find their way inside networks due to flaws in the applications, or they work on their victims psychologically and trick them into entering usernames and passwords, or clicking links.

According to a new Verizon report, a staggering 285 million records were compromised in 2008, which exceeds total losses for 2004-2007 combined. As many as 93% of the breaches were targeted hacks occurring at financial institutions.

Hackers made $10 million by hacking RBS Worldpay’s system, then loading up blank dummy cards and gift cards, and sending mules to use them at ATMs. The entire scheme took less than one day to pull off.

Many of these hacks occur due to flaws in the design of web applications. The criminals send out “sniffers,” which seek out those flaws. Once they are found, the attack begins. Malware is generally implanted on the network to extract usernames and passwords. Once the criminals have full access, they use the breached system as their own, storing the stolen data and eventually turning it into cash.

Meanwhile, criminal hackers have created approximately 1.6 million security threats, according to Symantec’s Internet Security Threat Report. 90% of these attacks were designed to steal personal information including names, addresses and credit card details. Almost every single American has had their data compromised in some way.

Unsuspecting computer users who do not update their PC’s basic security, including Windows updates, critical security patches or anti-virus definitions often become infected as part of a botnet. Botnets are used to execute many of the attacks on unprotected networks.

The same study shows computer users were hit by 349 billion spam and phishing messages. Many were tricked into giving up personal information. It is common sense not to plug data into an email that appears to be from your bank, asking to update your account. Attacks directed towards mobile phones are also rising. “Phexting” is when a text message phishes for personal data. Just hit delete.

Much of the data stolen is out of your hands. So invest in identity theft protection, and keep your McAfee Internet security software updated.

Robert Siciliano, identity theft speaker, discusses criminal hackers who got caught.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Week of FUD; Hackers breach electric grid, Conficker sells out, Obama has a plan

/in , , , , , , /by

Robert Siciliano Identity Theft Expert

They say adversity university and the school of hard knocks makes your stronger, faster and streetsmart.  And if it doesn’t kill you it makes you stronger. Lately, I’ve been killing my readers with lots of deadly data so I bet your security muscles are getting huge!

The security community has bombarded the media with fascinating claims of gloom and doom. (I’m guilty of it, too.) The hype hasn’t entirely met the hyperbole. There have been no major catastrophic issues. The power hasn’t gone out, and data breaches haven’t occurred in the 3-15 million PCs that have been compromised by Conficker.

But that doesn’t change the fact that there are still real problems that need solving. The security community and the media are getting better at discovering these new hacks, reporting on them and taking decisive action to fix them before they get worse.

For good reason, President Obama ordered a cyber-security review earlier this year. And he announced plans to appoint a top cyber-security czar, who will coordinate government efforts to protect the country’s networks. This is a response to years of inaction, culminating in millions and millions of breached records by cyber criminals toying with our critical infrastructures and corporate networks.

The Register points out, “According to the Wall Street Journal – which cites unnamed national security officials – electro-spooks hailing from China, Russia, and ‘other countries’ are trying to navigate and control the power grid as well as other US infrastructure like water and sewage.” That could get messy. Let’s make sure the Cyber Security Czar gives the sewage situation his undivided attention. CNET reportsthat the Pentagon has spent over $100 million on its networks in the past 6 months in response to attacks on the government’s computers. This is part reactionary and part proactive.

Wired reports that Conficker is now a lame spambot, selling fake Internet security software in the form ofscareware. I’m going to shut up about Conficker, for the most part, unless this thing does something that impresses me.

Bob Sullivan points out today in “Why all the cyber-scares?” (as I did earlier this week) that, “Security experts use the term ‘spreading FUD’ – fear, uncertainty, and doubt – to criticize the sales tactics of firms that use hyperbole to scare customers into overpaying for security products. The Conficker incident appears to a be a classic example of FUD.”

I’m all done with this week and I’m going to paint eggs.

For an Easter treat, identity theft speaker Robert Siciliano provides you with a hilarious rare glimpse of someone he loves walking for the first time. (I am human, you know.)

And a big THANK YOU to uni-ball because I cant do what I do without them. I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Conficker flexes muscles, phones home

/in , , , , , , , , , , , /by

Identity Theft Expert Robert Siciliano

The internets number one virus Conficker, called home and sent its next set of updates to its global botnet.

Conficker’s botnet, which includes anywhere from 3 to 15 million PCs, has a peer to peer (P2P) feature that allows each PC on the network to talk to one another. Each PC has the ability to become the command server. This characteristic allows Conficker to fluidly update each PC on the network.

The latest variant shows that Conficker is updating via P2P, as opposed to pinging a website for its updates. This makes Conficker “self reliant.”

A botnet is a robot network of zombie computers under the control of a single leader. The concept behind a botnet is strength in numbers. Botnets can attack websites, send spam, and log data, which can lead to data breaches, credit card fraud and identity theft, and ultimately clog a network until it shuts down.

CNET reports that researchers have observed Conficker making its first update, which they believe to be a keystroke logger, a form of spyware designed to log usernames and passwords. This new update also tells the zombies to seek other PCs that have not been patched with Microsoft’s update. The worm also pings websites including MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com in order to determine whether that PC has Internet access.

The Register reports that Conficker is now pinging what’s known as a Waledac domain, which contacts a new server if the current one is blacklisted by ISPs for spamming. This allows the virus to download more updates.

In 2007 and 2008, the Storm Worm was thought to have infected over 50 million PCs. Waledac is using the same technology as the Storm Worm,which means two things. First, this may get ugly fast. And second, whoever is controlling Waledac must be the same criminal hackers that built Storm Worm.

All this means that Conficker is about as dangerous as a virus can be, with the best of the best technologies, both old and new. While the virus has yet to strike, it is definitely gearing up.

 

Identity theft speaker Robert Siciliano discusses criminals using viruses to hack credit cards.

To protect yourself, be sure you have updated Internet security software, and consider an identity theft protection service.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information

Confickers copycat evil twin

/in , , , , , , , , /by

Identity Theft Expert Robert Siciliano

Both Microsoft Certified Professional and Computerworld report on a variation of Conficker known as “Neeris.” Neeris is a 4 year old virus that has resurfaced and is now behaving like a Conficker wannabe. It is believed that the criminal hackers who created Conficker and Neeris are either the same person or are working together, double teaming the computer security community.

Neeris began showing up on March 31st into April 1st which, as we know, was supposed to be the launch date for the next set of Conficker updates.

Conficker and Neeris both include auto-run and remote call features that allow it to slither into external storage, including cameras, USB drives, external hard drives and other memory-based devices. Furthermore, it is feared that the “call home” feature will eventually enable either virus to update their abilities to wreak havoc and compromise data.

What’s troubling is that Microsoft created a critical security update specifically for Conficker, labeled the MS08-067 patch. Now, Microsoft Certified Professional states that Neeris is able to “poke holes in” this patch, indicating that the patch is no match for Neeris.

However, as stated in Computerworld, “Due to the similarities to Conficker, most of the mitigations that were mentioned also apply here. Make sure to install MS08-067 if you haven’t done so yet, and be careful to use only autoplay options you’re familiar with, or consider disabling the Autorun altogether.”

Regardless, update critical security patches and run the latest McAfee anti-virus definitions.

Robert Siciliano Identity Theft Speaker discussing viruses slithering into memory based devices here

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Credit card fraud is Americans number one concern

/in , , , , , , , , , , , /by

Identity theft Expert Robert Siciliano

A recent study conducted by the Unisys Corporation shows that identity theft as it pertains to credit card fraud is Americans’ number one concern.

When people ask me, “How do I protect myself from credit card fraud?” I tell them, “Cancel the card, or never use it.” Because that’s the only way.

Personal security (as it pertains to violence) and national security have always been a concern. However, this new study shows that people are more concerned with fraud, and the risk of having their savings depleted by scammers. Not so hard to believe, what with the number of data breaches, and the Madoffs of the world fleecing their unsuspecting investors.

75% of Americans feel that the recession has increased their chances of being victimized by criminal hackers and thieves. Most are also concerned their “private” information on a corporate or bank network may be compromised.

FBI’s Internet Crime Complaint Center’s 2008 Annual Report determined that online fraud increased by 33.1% last year. Dollar losses resulting from online fraud increased to $265 million.

Overall, these concerns are valid, due to flaws in the system of issuing credit that facilitate new account fraud. Furthermore, account takeover requires nothing more than access to credit card numbers, which are available in hacked databases or susceptible every time you hand your card over to a gas station attendant.

Viruses in spam or phishing emails continue to plague consumers and as scammers get more sophisticated, the chances of getting hooked increase.

Banks and business will continue to feel the pressure as criminals target their clients’ data.

Credit card skimming at ATMs and gas pumps makes it impossible to protect yourself when you could essentially be handing your digits over to a criminal.

Skimming is one of the financial industry’s fastest-growing crimes, according to the U.S. Secret Service. The worldwide ATM Industry Association reports over $1 billion in annual global losses from credit card fraud and electronic crime associated with ATMs.

Marite Ferrero, a blogger with Finextra, adds, “In Europe, the points of compromise are everywhere: ATM, gas pumps, parking, DVD rentals, movie tickets, food kiosks, tolls, buying metro tickets, and the list goes on… Because of chip and pin implementation, the proliferation of stand-alone terminals that accept chip and pin has provided a profitable playground for fraudsters.”

While the card holder is generally only responsible for the first $50.00 in losses, which is often waived by a “zero liability policy,” card holders who don’t pay attention to their statements often let these charges pass and eat them.

There are many technologies available to secure credit cards, such as “smart cards” and “chip and pin.” However, due to the nature of a credit card transaction, once the data leaves the card, it’s up for grabs. Whatever card security their may have been is now gone.

Check your credit and banking statements carefully. Scrutinize every charge and refute any unauthorized charges within 30-60 days. Call your bank or credit card company immediately if you see any fraudulent activity.

Invest in identity theft protection. Credit freezes or fraud alerts help prevent new account fraud. Protect your PC with McAfee, or other Internet security software.

Robert Siciliano, identity theft speaker, discusses credit card fraud.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Identity Theft Speaker; Confickers Threat Hasn’t Waned www.IDTheftSecurity.com

/in , , , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

We are not out of the woods with this one.

Conficker’s rise and fall and the passing activity of the worm on April 1st has allowed researchers and anti-virus companies to better understand the virus and its impact. While April Fools was supposed to be the day of reckoning for Conficker, it wasn’t and still isn’t a joke.

Viruses often come with a trigger date, as pointed out by CNET. And while many fail to meet the media hype, they still can and often do cause millions or billions in damage.

The media does what it does and reports on the news. While they or even I may not always get the facts straight, the impetus is still there.

In a “Conficker Postmortem,” CNET examines the media frenzy and points to a humorous spoof that Wired ran, a fake live blog from the “Conficker Worm War Room.” CNET also points out that, “The New York Times called it an ‘unthinkable disaster’ in the making. CBS’s 60Minutes said the worm could ‘disrupt the entire internet,’ and The Guardian warned that it might be a ‘deadly threat’.”

The positive result of this media hype is that it brings attention to an ongoing problem for an audience that never considered themselves vulnerable to these issues. In my world, even Facebook friends and Twitter followers who had never reacted to previous posts on a plethoraof IT and personal security issues are finally starting to ask the right questions.

“Your mom’s virus,” as we knew it, has become a part of popular culture. In a sense, this is a good thing, because it’s now water cooler talk with the same level of buzz as Britney Spears going nutty. We in the security community couldn’t ask for more and better attention, that may potentially enlist an army of security moms. Thank you, Conficker!

Still, Conficker is the most sophisticated virus to date and is still waiting to strike, which can very well lead to major data breaches and identity theft. As the virus continues to call home for the yet to be delivered update, researchers have determined an estimated 3.5 to 4 million PCs are infected on the Conficker botnet, which is the most powerful and dangerous aspect of Conficker.

Overall totals of infected computers may still be between 10 and 15 million. Many of those have a dormant virus that has the capability to wreak havoc, or that may have already been rendered impotent by anti-virus providers and IT administrators who have taken advantage of numerous solutions by McAfee and others.

What the public needs to understand is this infection is anything but over. The virus phones home every day looking for its next set of updates, which could still have catastrophic results if the virus ever reaches its full potential.

The risk here is that a virus of this kind has technology that can disable anti-virus software and that prevents access to numerous websites which provide automatic security updates, including Windows.

Today, Brian Krebs from the Washington Post points out the similarity’s to Y2K potential bug, just as I did last week. “In one sense, the response to Conficker could be compared to that of Y2K: A great deal of smart people threw a whole lot of resources and energy at a fairly complex problem and managed to turn a potentially very ugly situation into a relative non-event.”

The attention that Conficker brought upon itself has rallied security professionals to be on their highest guard, which is exactly where they should be.

See Robert Siciliano, identity theft speaker, discussing hacking for dollars.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out Uniball.com for more information.

Identity Theft Expert; Conficker Virus Countdown

/in , , , , , , , , , , /by

Robert Siciliano Identity Theft Speaker

News of Conficker out of control then under control is everywhere.

60 minutes reports on everything we have discussed in these posts. Main stream media has recognized the Internet has a cancerous virus and is infected. Criminal hackers are creating viruses infecting webpages in record numbers all in the name of money.

Security professionals are losing sleep as they race against the bad guys in anticipation of the next big breach.

Conficker is big news as its infecting mainly corporate networks at an astonishing estimated 10-12 million PCs and this sleeper cell is set to get its next set of updates April 1st.

Like Al Queda operatives living amongst us, cyber terrorists waiting for their next communiqué from a remote cave, Conficker waits to strike.

Nobody knows what’s going to happen April Fools, but security professional have a plan. Do you?

By all accounts Conficker has the potential capacity to steal data or launch a massive denial of service attack which encompasses massive amounts of data, flooding the Net, bogging down mainframe servers that distribute data to our inboxes.

60 Minutes used the example of what I did on CNN describing a Facebook hack and used a Morley Safer Facebook account that may be hacked with Conficker and begins to send messages to Morleys friends. Then Leslie Stahl who is a Morely “friend” receives an email looking like it’s from Morelys Facebook account to click a video. That video has a destructive payload that infects Leslies machine and the virus replicates itself to Leslies contacts.

Now Morelys PC has a virus that records all his keystrokes and Leslie is just as vulnerable. Bank accounts are cracked, credit card log-ins are stolen, the contents of their My Documents folders are copied and sent to Turkey and identities are stolen. People who don’t have any identity theft protection face years of dealing with creditors who accuse them of being bad debtors.

Malware is showing up on thousands of websites compromised in numerous ways and infecting computer users whose defenses are down.

Most attacks can be prevented with updated anti virus like McAfee or others. But with an estimated 15,000 new infections daily it’s difficult for the every day user to protect themselves unless they are automatically downloading virus definitions. And that may not be enough.

Criminal hackers come in all shapes and colors from every corner of the world. Russian hackers are often depicted as the best of the worst. These cyber criminals are often put on a pedestal in their communities as they brag about their accomplishments, hacking wealthy hacker Americans and stealing 10s of thousands of dollars monthly and spending that money in their remote villages.

Russian authorities generally don’t prosecute and may even employ criminals to steal from greedy Americans. As long as hate and money are motivators, foreign governments will groom and incite talented 14 year olds into a life of crime.

This story is far from over.

Robert Siciliano Identity Theft Speaker discusses online banking security here

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information

Identity Theft Speaker; April Fools Day is conficker worm day

/in , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Criminal hackers have created a virus that has slipped into millions of PCs and is set to strike on April Fools day. This is no joke.

So far this year it is estimated that somewhere between 3 and 12 million computers have been compromised by the “Conficker” worm, also known as “Downup,” “Downadup” and “Kido,” possibly considered the largest known global botnet.

Microsoft and others are in a 24/7/365 battle with the makers of Conficker to see who ends up at the finish line first.

None of the PCs infected with Conficker are displaying any of the characteristics generally exhibited by the recent spate of viruses, offering a remote control component and often used to host spoofed websites and other malicious fraud related activities. At least not yet.

If Conficker reaches its full potential, it will result in data breaches, credit card fraud and numerous forms of identity theft.

It has been widely believed that Conficker is waiting for its next set of updates on April 1st, to unleash the endgame its writers had in mind.

The sense among security professionals is that Conficker will unleash an uncontrollable fury not yet seen or experienced by the security community.

Conficker duplicates like viruses of old and infects PCs that are unpatched and outdated. The virus scans the Internet, seeking and infecting unpatched computers. Conficker was built with encryption pirated from an MIT researcher and has the ability to circumvent anti-virus programs.

This level of technology has the ability to slip into external hard drives, thumb drives and any memory based peripheral. When that same peripheral is plugged into another PC, that PC is also infected.

Many PCs in Asia have rogue versions of Windows, and are largely unpatched due to Microsoft not allowing updates.

Update your Microsoft Windows ASAP. Make sure you have up to date Internet security software, such as McAfee. Stay away from rogue websites and be careful what you click.

As stated in a previous post, Microsoft offered a global bounty for the arrest and prosecution of whoever created and released the Conficker virus.

Even with the security community vigorously trying to defend PCs globally, in early March, millions of Conficker-infected PCs were upgraded into a peer to peer network, which makes the botnet even more dangerous by giving each infected PC commanding authority over others. This means that every PC has the capability of running every other PC on the botnet.

The anticipation among researchers leading up to April 1st is much like that which was felt prior to midnight on December 31st, 1999. The Y2K ”bug” was considered a ticking time bomb for all major computer applications.

Much has been done to avert a Conficker disaster, but nobody knows for sure what will happen. April 1st is a day of foolery, but this year it may also be a major breakthrough for hackers, good or bad, to see who is top dog.

See Robert Siciliano, identity theft speaker, discussing viruses in peripherals here.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Credit Card Hackers Target Small Business

/in , , , , , , , , , , , /by

Robert Siciliano Identity Theft Speaker

Up until now, identity thieves have been hunting elephants. But that may soon change.

According to this study, small to medium size businesses (SMB’s) are the criminal hackers next target. This should come as no surprise, as large enterprise networks have gradually become better at defending themselves.

Over the past few years, criminal hackers have acted like hornets, attacking and swarming unassuming enterprise networks. Big business has responded by allocated billions of dollars in funding for technology and talent to thwart their sting.

In 2009, enterprise defense is the best it has ever been. It’s still lax, but now the path of least resistance has become SMB’s. Your mom and pop shops simply don’t have the resources, including deep pockets, to keep up.

Studies by the International Council for Small Business show that one fifth of small businesses aren’t even equipped with basic defenses, such as McAfee security software. Furthermore, as many as 60% don’t even have wireless encryption activated. What is most disturbing, but not surprising to this security analyst, is two thirds don’t have any type of security plan in place.

According to poll responses, these same SMB’s overwhelmingly believe that they aren’t targets, that only big businesses need to worry. However, this same study shows that 85% of fraud related to criminal hacks occurs within this exact group.

The National Retail Federation stated that Level 3 businesses are only 60% compliant and Level 4’s are even less secure.

PCI Compliance, a Visa based organization that regulates merchants in order to prevent credit card fraud, recognizes retailers at different levels. Level 1 retailers process 6,000,000 Visa transactions per year, Level 2 retailers process 1,000,000 to 6,000,000, Level 3 retailers process 20,000 to 1,000,000, and Level 4 retailers process fewer than 20,000.

Many security issues stem from the SMB’s lack of resources, coupled with their shift to online transactions and the handling and storage of their own data.

Some say that the responsibility of handling these transactions should be shifted back to the banks.

One additional recommendation for these Level 3 and 4s is to adopt a strategy in which the merchant never handles the credit data at all. The merchant would have an online shopping cart, but the credit card transaction would be diverted to the bank server, without ever being touched by the merchant.

I’m one of those Level 4 merchants and this is the strategy that I use. All orders are taken online and nobody aside from the bank handles client credit card data. PCI compliance is a breeze – no hiccups.

While this is practical for some SMB’s, it doesn’t work for others, so those retailers need to get their act together immediately, because criminal hackers are watching.

See identity theft speaker Robert Siciliano discuss data breaches here.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Identity Theft Prevention is a People Problem

/in , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Every week we learn of a new hack, another breach, credit cards stolen and another identity theft victim.

Many have blamed the bad guy or criminal hackers for all the problems we have in the security world. And while the bad guy is certainly a problem, they are a small part.

The people responsible for their own physical or computer security or the security of others are often the guilty.

You wonder why your credit card company sent you a new card? Because some baboon didn’t do his job and your were compromised.

Chances are we could look at 7 out of 10 data breaches and point to someone who didn’t properly flip a switch or lock a door.

Recent studies polling companies with 1000 or more employees when asked to define the most important measures for protecting confidential data, nearly half of all respondents said, “communicating and training users on confidential data security policies.”

And when asked to rate their organizations performance with regard to, “communicating and training users on confidential data security policies,” more than one-fourth of security professionals gave their organization a rating of either “fair” or “poor.”

North Americans ranked 24% as being “poor” while Europeans ranked 38%. I suspect the North Americans are just lying and are just as lax. I read the papers and see the data. Pleeeeze. I have my eye on you Focker.

Security is not entirely an IT problem. There are many “to-dos”, policies in place regarding physical security that must be observed. And if followed properly, would reduce many of the breaches we see.

One plain and simple example is dumpster diving. How prevalent are shredders? I’ve gone though 4. Besides the copy machine or your desk/laptop, a shredder should be the most used home/office appliance.

Here is an infuriating video of a dumpster diver here, also a security professional who spent 3 minutes in the dumpster of a local bank. He found a laptop, wire transfers and Social Security Numbers. That’s not an IT problem. That’s a stupid-lazy-people problem.

How is anyone supposed to feel secure and protect their identity when others are responsible for our security? The fact remains we are an open sore and idiots keep pouring salt in the wounds.

Robert Siciliano Identity Theft Speaker discussing Idiots who didn’t secure a wireless connection and exposed 45 million credit cards Here

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.