Identity Theft « The GANSEC Security Weblog

As a business,you may be responsible for fraudulent charges,not your bank

By Sven Olensky,on June 9th,2011%

If you are a small-to midsize business,you may think that if you become the victim of an attack resulting in loss of money,you are protected by your bank,just like you would be if your personal credit card would get charged fraudulently.

Well,you may be wrong. You may be on the hook for the entire amount yourself.

DarkReading reports,

A recent ruling by a U.S. District Court of Maine magistrate in favor of a bank being sued by a construction company that had money stolen from its account by hackers highlights how vulnerable small to midsize business owners are to online fraud.
Unlike consumer bank accounts that come with fraud-reversal protection,businesses are left on the hook for fraudulent transfers —a fact that many remain ignorant about,but of which hackers are well-aware,say security experts.
“They don’t get the same kind of protection that an individual consumer gets,but they don’t get much more attention than an individual consumer [from banks],so they are very vulnerable from that standpoint,”says Terry Austin,CEO of Guardian Analytics. “And the criminals figured this out. A lot of the action a couple years ago was in retail banking,and we still see fraud there,but the big,really significant fraud attacks have been against the small-business community. There are hundreds of thousands of dollars,sometimes up to million-dollar attacks on these small businesses.”

This is very disconcerting. So what can you do?

You need to make sure that you are as secure as you can be.

The article continues,

But SMBs must also do their part to secure their machines. Often small-business owners assume that if they’re ever hit by bank-stealing malware,the bank will reverse charges because this is what they are conditioned to believe due to their retail banking experiences. But banks rarely extend the same fraud reversal for business accounts as they do for consumer accounts. So SMBs at the very least need to start with the most basic principles of installing security software,establishing strong passwords,and limiting access to banking credentials across the organizations. Many experts also believe that small businesses should consider buying a dedicated machine solely for online banking.
“One thing I recommend to every small business is to not bank from a computer you use for anything else,period. Just don’t do it,”says Chet Wisiniewski,senior security adviser at Sophos. “Don’t ever search the Web,don’t go to Google,don’t go to Facebook. Because of the Web risk,simply visiting an infected site puts you at risk. Do you really want to take that chance if you can buy the perfect banking netbook for $200? An alternative to that,too,is to use a live CD Linux distribution that’s not writable.”
Additionally,SMBs need to know to ask the right questions when they’re looking for a bank,Austin says.
“These small businesses don’t know how to ask their banks the right questions about their fraud policies,”Austin says,explaining that companies need to ask about what their liability is in the event of an attack,what kind of authentication the bank uses,how the bank monitors activity to look for anomalous behavior,whether the bank utilizes risk-detection technology with behavioral analytics,and what the processes are when fraud is detected.

Good advice.

Android phones open to authentication theft in open wireless networks

By Sven Olensky,on May 18th,2011%

If you have an Android and you connect to an open wireless network hotspot,you are at risk of getting your authentication tokens stolen (i.e.,your login credentials to certain web sites and application may be stolen). Depending on the news site you frequent,the intensity of the reports range from ‘HACKERS STEAL YOUR CREDENTIALS’to ‘NO BIG DEAL’.

Interestingly enough,if you search for ‘android’on Google News,you see less than 2 or 3 articles referring to this issue,whereas if you use Bing News,the first page is pretty much filled with information about this. Wondering who is filtering VS who is emphasizing this problem….

Researchers at Ulm University report that they were able to do so –see the full report here.

[...] found that some Android applications transmit data in the clear,allowing an attacker to eavesdrop any transmitted information. Besides third-party apps,such as Twitter or Facebook,also the Google Calendar app transmitted unencrypted information. Wallach stated that “an eavesdropper can definitely see your calendar transactions and can likely impersonate you to Google Calendar”[...]

What can you do?

Update to Android 2.3.4. Update your phone to the current Android version as soon as possible. However,depending on your phone vendor you may have to wait weeks/months before an update is available for your phone.
Switch off automatic synchronization in the settings menu when connecting with open Wifi networks.
Let your device forget an open network you previously connected to,to prevent automatic reconnection (long press network name and select forget)
The best protection at the moment is to avoid open Wifi networks at all when using affected apps.

Basically,don’t use open,unencrypted wireless networks. If you have a 3G/4G connection,this is a moot point.

Playstation Network Hack –Personal Data Stolen

By Sven Olensky,on April 27th,2011%

Well,after 6 days of downtime Sony finally released some information about the Playstation Network Intrusion:personal data of users may have been stolen.. As Kotaku reports,

Among the possible information stolen:
Name
Address (city,state,zip)
Country
Email address
Birthdate
PlayStation Network/Qriocity password and login and handle/PSN online ID.
“While there is no evidence at this time that credit card data was taken,[they] cannot rule out the possibility.”
”If you have provided your credit card data through PlayStation Network or Qriocity,[...] your credit card number (excluding security code) and expiration date may have been obtained,

What should you do?

change your PSN password immediately (well,once you can log back into the network –it is still down and will be down for another couple of days,according to Sony)
check your credit card for unauthorized charges –you may want to consider cutting it up and getting a new one –call your CC company and tell them you have lost it

Google collecting children’s social security numbers under the guise of an art contest

By Sven Olensky,on February 23rd,2011%

The Huffington Post has an interesting article about Google collecting personally identifiable information about children under the guise of an art contest.

They write,

[...] has been asking parents nationwide to disclose their children’s personal information,including Social Security Numbers,and recruiting schools to help them do it —all under the guise of an art contest. It’s called,“Doodle-4-Google,”a rather catchy,kid-friendly name if I do say so myself. The company is even offering prize money to schools to enlist their help with the promotion. Doesn’t it sound like fun? Don’t you want your kid to enter too?
What could be wrong with filling out a few entry forms?
A national,commercial database of names and addresses of American children,especially one that includes their dates of birth and SSNs,would be worth many millions to marketing firms and retailers.
Of course,data collection is not the reason Google gives for doing this competition. Their FAQ says it’s because “We love to encourage and celebrate the creativity of young people…”etc. If that’s so,then why on earth would the contest’s original Parent Consent Form ask for the child’s city of birth,date of birth and last four digits of the child’s SSN? Along with complete contact info of the parents.
You see what Google knows and many parents don’t know is that a person’s city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number. Then,if you can somehow obtain those last four SSN digits explicitly —voila,you’ve unlocked countless troves of personal information from someone who didn’t even understand that such a disclosure was happening.
This kind of data can be linked with other databases to target advertising. It’s worth many times more than what Google will spend on prizes (each State Finalist gets a T-shirt!).
[...]
So in closing,three simple ideas for you,gentle reader,to take away. (1) City of birth,when coupled with year of birth,can be correlated to social security numbers,so don’t give it out just because a box appears on a form. (2) No public contest should ask for any part of a social security number,especially involving kids. (3) For internet searches,have you tried Yahoo! or Bing lately? You just might find what you’re looking for.

Scary. And yes,what would hold Google back from making this information available to marketers?

How HBGary Federal was compromised –lessons to be learned for everyone

By Sven Olensky,on February 16th,2011%

ARSTechnica has an excellent writeup on what happened to HBGary Federal,the company whose CEO claimed he infiltrated Anonymous,the well-known group that was responsible for the attacks on MasterCard,PayPal and others back in December. Once his claim spread on the Internet,Anonymous broke into his company’s infrastructure,retrieved over 60,000 emails,hacked his web site,his Twitter account and pretty much made an embarrassment out of him on the Internet. Well,out of him,his boss and his company. Furthermore,they were in talks of getting bought for up to $2 million,all of which fell through because he leaned out of the window too far.

ARSTechnica illustrates how HBGary Federal’s infrastructure was compromised by using the most basic methods of intrusion,a combination of exploitation of common vulnerabilities and the realization that the CEO/COO used simple passwords.

Lessons for others:

make sure that your public facing services are not vulnerable. (Shameless self-promotion:we at GANSEC can help you figure out if they are)
do not use simple passwords –I had an article about this last year –please read it here if you need information on this
do not use passwords in more than place –see more information in that same article that I wrote last year
don’t fall for social engineering. Do not send out passwords or any other sensitive information to people without verifying their identity. Call them back on a known number,don’t send passwords in email.
don’t claim you infiltrated one of the most notorious hacker groups out there without having properly secured your stuff. You will regret it.

Are you affected by the Gawker account hack?

By Sven Olensky,on December 16th,2010%

This site enables you to enter your email address to see if your account was part of the database theft that occurred last week.

As you may know,hackers stole over 1.3 million accounts after breaking into the user database that hosts accounts for the Gizmodo,Gawker,Deadspin,Kotaku,Jezebel,IO9,Jalopnik and Lifehacker blogs.

Facebook apps are leaking your identity to advertisers against your wishes

By Sven Olensky,on October 18th,2010%

The Wall Street Journal reports that Facebook has been involved in a breach of protocol. Applications such as Farmville and others leak user IDs to advertisers and spammers for targeted advertising.

From the article:

Many of the most popular applications,or “apps,”on the social-networking site Facebook Inc. have been transmitting identifying information—in effect,providing access to people’s names and,in some cases,their friends’names—to dozens of advertising and Internet tracking companies,a Wall Street Journal investigation has found.
The issue affects tens of millions of Facebook app users,including people who set their profiles to Facebook’s strictest privacy settings. The practice breaks Facebook’s rules,and renews questions about its ability to keep identifiable information about its users’activities secure.
[...]
The most expansive use of Facebook user information uncovered by the Journal involved RapLeaf. The San Francisco company compiles and sells profiles of individuals based in part on their online activities.
The Journal found that some LOLapps applications,as well as the Family Tree application,were transmitting users’Facebook ID numbers to RapLeaf. RapLeaf then linked those ID numbers to dossiers it had previously assembled on those individuals,according to RapLeaf.

What can you do? I recommend deleting and disabling all the Facebook apps you are using,as a cautionary measure.

Facebook crawler collects more than 170 million data sets

By Sven Olensky,on July 28th,2010%

Heise reports:

Hacker Ron Bowes has written a web crawler which he used to systematically graze through [public Facebook profiles]. Bowes claims to have collected more than 170 million sets of data containing the names and URLs of public profiles. The files do not contain any further personal data such as friend lists,but the links in the profiles can easily be used to send out another crawler to collect this information. Bowes has formatted the list and,together with the crawler itself,made it available as a 2.8 GB torrent.

You may want to double check what you choose to have public.

Smartphone Malware on the Rise

By Sven Olensky,on June 22nd,2010%

The fellows at DarkReading published an article about 2 weeks ago that contains some very useful information about the rapid rise of malware on smartphones (Blackberries,Windows Mobile phones,Androids). They state that only in the last 6 months,the amount of malware released on smartphones has more than doubled!

Here is the link to the full article.

Quote:

The number of malware and spyware programs found on smartphones has more than doubled in the past six months —and some types of malware are more prevalent on certain smartphone platforms than others.
[...]
The malware attack vector being used against smartphones isn’t the SMS or email spam that was all the rage in the early days of mobile attacks. Instead,it’s following smartphone user behavior trends and exploiting downloadable applications,experts say. “Users are downloading apps at a huge pace,”Hering says.
And smartphones are actually more “personal”than PCs. They include GPS location,payment information,email,text messages,and records of who a user communicates with. Hering says today’s smartphone malware is all about grabbing personal information and,now,attempting to monetize it. “On the spyware side,you can imagine an app grabbing personal data that you’re unaware of [occurring] and transmitting that to a third-party location”where it can be resold,for example,he says.

Considering how widespread smartphones are,especially Blackberries in corporate environments,this is a huge potential risk for enterprises.

iPhone 4 Order Security Breach Exposes Private Information

By Sven Olensky,on June 15th,2010%

Gizmodo reports in this article that there are some issues with the iPhone 4 pre-order process –no,not the problems regarding outages and such,but that there are serious security issues going on:apparently every once in a while,customers who log in to order an iPhone get redirected to pages containing personal data of other customers. They write:

Apple’s iPhone 4 pre-ordering has been a total disaster,but it gets much worse:An AT&T insider claims that this iPhonecalypse may be related to “a major fraud update that went wrong.”The bug is exposing AT&T users’private information.
So far there have been at least three accounted cases of mistaken identities sent by Gizmodo.com readers. This is how it happens:A customer tries to log into their AT&T account to order a new iPhone 4 upgrade. Despite entering their username and password,the AT&T system would take them to another user account. This gives access to all kinds of private information about the mistaken customer:Addresses,phone calls,and bills,along with the rest of private information,becomes exposed to random strangers.
[...]
At this time (3:34PM EDT),the account system is back online,but the iPhone 4 eligibility page is still down.
AT&T and Apple have not issued any statement about this security problem or the nationwide pre-order disaster.

Another Apple/AT&T security fail. These guys are starting to irritate me.

The GANSEC Security Weblog

Android phones open to authentication theft in open wireless networks

Playstation Network Hack –Personal Data Stolen

Smartphone Malware on the Rise

iPhone 4 Order Security Breach Exposes Private Information

DarkReading

Blog Archive

SANS News

Recent Posts

Post Overview