I just finished watching Yahoo's Cybergeddon. It is about 1 1/2 hours long and follows Chloe Jocelyn, a hacker turned FBI agent, who is trying to stop a cyber terrorist bent on revenge. It is very entertaining and mentions some real life tools and virus's. While of course it is fiction and a lot of the dramatization seem to be right of of the 1995 movie "Hackers", it is very entertaining and, believe it or not semi-plausible.
Check it out: Cybergeddon
I talk and write about it often. It was the subject of my final project during my Masters studies. I even spoke about the topic at the RSA Conference in 2012. For years one of my many hobbies has been to acquire storage media devices that people have disposed of and review them to find out what they left behind. I find devices at yard sales, laying on the ground, auctions, storage units that have been sold at auction, and pretty much anywhere you can think of. They are not always the old 256mb worthless drives either, recently I found a very nice 16gb SanDisk for 50 cents at a yard sale. Below is a very small sampling of my collection.
Posted below is my abbreviated presentation from the 2012 RSA Security Conference in San Francisco. I hate watching myself on video and no, despite my swaying back and forth, it was not film on a ship in rough seas.
Garage Sale Forensics: Data Discovery Through Discarded Devices
"A review of how data storage devices can be discovered and the data left
on those devices used for unauthorized purposes. Individuals and
organizations may dispose of a device without completely purging all
data that resides or resided on it. This presentation will show where
devices can be located, how data can be recovered, and how the
organization or individual can protect themselves from loss."
While at the RSA Conference in San Francisco last week I had the need to drop into the Apple Store. I was looking for a stand for my iPad that I could use to view the script of my presentation while on stage. With the help of an Apple Genius I as able to find exactly what I was looking for. Then, to my surprise she whipped out her POS device, Point of Sale device that is, and advised me that if I was done shopping, that she could complete my purchase. On her modified iPod she swiped my credit card and emailed me a receipt. Purchase complete no fuss no hassle.
We put a lot of trust in retailers when we hand over our credit card to them to complete a transaction. In many cases we are standing at a checkout counter, we usually swipe our card ourselves or hand it to the checker to swipe for us, but most of the time that card never leaves our hand, or at worse it never leaves our sight. The major exception to this is restaurants. At most restaurants we order, we eat, we get a check, and we hand over our card. Then our card disappears for a few minutes or on some cases more than a few minutes. What is going on back there? Where is my card? Is it being skimmed, are the numbers being transfered or copied, did it get handed to another customer by mistake? There are so many things that could be going on when that card is out of our sight that we have no control over.
If Apple can create a POS system that uses a presumably secure wifi connection and a presumably secure iPod device to complete a credit card transaction why can't Applebee's, and Denny's, and every other restaurant out there. This technology is available, it may cost a little more then their current POS devices, but it could save them:
Time; the wait staff could use one of the devices to deliver the check and take immediate payment, then have the receipt emailed or printed back at the register. The customer, who often is ready to leave can do so without waiting even longer for the ticket and their card to return.
Security; the customers card never leaves their site and there is no question as to whether or not the card is tampered with or copied. The wifi and devices would be compliant with laws and regulations that regulate such transactions, not only in transit but also in rest.
Cost; the establishment simply needs to purchase and design the system for a handful of devices. The wait staff could share multiple devices between them. After all, in most cases they only have one or two current POS devices to complete these transaction now.
Reputation; when a theft does occur or even a suspected theft, that customer is going to complain. But often that customer is complaining loudest to other customers. They will tell everyone about the theft and how they think that it must have been that waiter that stole his card. If the card does not leave the customers sight the opportunity of skimming or theft would be low.
Satisfaction; the customer will be very pleased that their credit card does not leave their sight, that they don't have to worry about losing a receipt because it has been emailed, and they don't have to wait for the lengthy payment process at the end of their meal.
Good job to Apple on this one. Another great device even if it is just a POS device.
According to a study at Carnegie Mellon Cylab many children are becoming the victims of identity theft. Children are often easy targets for thieves because the theft can go unnoticed for many years. Often it is not until the child reaches adulthood and they apply for their first credit card or car loan is it discovered that their credit has been ruined. This is a huge problem and the credit reporting agencies do not help the issue, in fact, in my opinion, they aid the thieves.
If I wanted to see my credit report and determine if there are any fraudulent charges I simply need to visit https://www.annualcreditreport.com and I can have access to each of the three reports at no charge, once per year. But try to access your child's credit report, go ahead, try it... I can wait.
You will find, like I did that you cannot access the report online. They claim that they "do not knowingly maintain credit files on minor children". If this is the case, why are there credit cards issued to minor children and why is this information not being verified? Oh, I missed the 'knowingly" part... really? Is a killer less a killer because they did not "knowing" put bullets in the gun before they fired it?
So what now, assuming you are not lazy, and want to ensure that your kids are able to receive credit someday, you need to take proactive action and take that action sooner rather then later. In order to get the credit reports you must request them in writing from each of the three agencies. In order to do this you must:
All too often people simply dispose of their computers, disk drives, portable devices, thumb drives, etc. when they are done using them. By doing this, often they expose themselves to identity theft. Anyone can simply take that drive, connect to to a computer system, and read your information.
But you formatted it so your data was all erased, right? Wrong! The fact is, formatting a drive does nothing more then tell the allocation table on the drive (which is like the drives table of contents) that the data is available to be written over. That does not mean the data is gone, in fact the data is not gone.
In order to completely erase all data on your drive before you dispose of it s to wipe the drive with a tool that uses at least a three pass Department of Defense compliant wiping process. This process actually deletes all data on the drive, then writes useless data to every sector on the drive, then erases the drive again. The software will repeat this process at least three times eliminating the possibility of anyone recovering your data. There is a great free tool called Disk Wipe for this. I encourage you to use it, or a sledge hammer.
According to the Federal Trade Commission, Identity Theft is number one in consumer complaints for 2010. There were 250,854 complaints about Identity Theft, of the 1.9 million total complaints, making it 19% of all reports. This is the 11th year in a row where ID theft has been at the top of the list according to CNNMoney.com.
Also according to the CNNMoney.com report fraudulent government documents were the top source of the ID theft complaints. For those of you that don't know, that is someone stealing and using your Social Security Number or other government issued document. At the 2011 RSA Security conference I listened to Kimberly Peretti a former senior litigator for the Department of Justice speak. She was the lead prosecutor in the Albert Gonzolez case speak. She confirmed that SSN's are still the number one target of ID thieves.
Here is a good writeup about a scam going around. It is written by Rik Ferguson over at Trend Micro.
http://countermeasures.trendmicro.eu/an-unwanted-favour-from-india/
David Kernell, son of Democratic Representative from Tennessee Mike Kernell, was convicted by jury of “Hacking” Sarah Palin’s Yahoo account. The 22 year old Kernell was convicted of unauthorized access to a computer and obstruction of justice.
Kernell used information that Palin herself made available to the public to guess her challenge questions that ultimately lead to his ability to gain access to her Yahoo account. Once he gained access to her account he changed her password and posted screen shots of emails on the internet.
On her Facebook page, Sarah Palin released the following statement (in part):
Network World is reporting the Blippy.com is going to hire a Chief Security Officer (CSO) in light of their recent data loss...
I am at a loss for words... dumb, dumb, dumb.
Source: Network World
I first introduced you to Blippy.com in my post on March 16, 2010 titled "Blippy.com, a Whole New Level of Stupid". It has just been discovered that using a simple Google search you can see actual credit card numbers of Blippy users. This Google search is very similar to the method that I showed you in my first post.
You can see an example of the Google results in the screen shots below. At the time of this post the Google search is broken but there are plenty of examples on the internet. The breach was acknowledged by Blippy management and they state that it was an over site during some beta testing that they were preforming.
Blippy.com, a Whole Whole New Level of Stupid!
Affinity Health Plan has released a statement concerning a data loss of as many as 409,000 customers.
In the press release they state that a copier that they had been leased was discovered to have contained personal information of its clientele. The lost data may include Social Security numbers, dates of birth, and medical records.
Abbe Abboa-Offei, the senior vice president of Customer and Community Connections stated, “Like many organizations across the country, we were not aware copy machines contained hard drives that need to be wiped.” (eh, fail!)
Affinity Health Plan was one of the companies that was in the CBS news video that I posted yesterday. If you have not seen that video, you should! (Click here)
Press Release.
.
Below is a CBS News video that shows the extreme security risk of data stored on copy machines. I am simply amazed that organizations and enterprise would allow data to simply walk out their doors as shown in the video below.
We don't need hackers and crackers to break into networks and steal data. For a few hundred dollars anyone can purchase it legitimately.
It is very simple and only takes a small amount of effort to remove a hard disk and wipe it making data unrecoverable.
A new malware has been discovered and is “in the wild”, meaning that some antivirus / antimalware vendors are not detecting it.
This is a new twist on ransom ware or as I like to refer to it as extortion ware. The notice received after visiting an infected site is a “Copyright Violation Alert.”
These fake copyright violation notices advise that they have determined you have illegally downloaded files onto your computer and that you must pay their pre-defined amount of $400 or you will be sued. Part of the process of paying the ransom is to enter your credit card information. However it has been confirmed that there is no payment processing associated to the action and the hacker is likely just capturing your credit card data to be used later.
You can see sample screen shot of the popup at the below link.
Source: F-Secure
A 16 year old boy is suing his mother alleging that she accessed his Facebook and email accounts, made “slanderous” comments about him on his Facebook page, and changed the account passwords.
According to Denise New, the boy’s mother, he left his accounts logged in on her computer and because of this she was able to access his accounts, change the passwords, and leave some comments.
New says that she was upset about posts that he had made on his Facebook account and felt that she was within her rights as a mother to monitor his behavior.
New did not deny the allegations and in fact made statements that seemed to confirm them. New will get her next day in court on May 12 where she will answer the criminal charge of harassment.
Source: KATV.com
Source: PC World
Have you ever considered what you would really lose if you were to lose or have stolen your USB thumb drive. Whether it is dangling from your neck or attached to your key chain you should consider the reality that you may misplace, lose, or have that device stolen from you.
In 2008 I traveled to the Palo Alto California to take part in a review of a security product that was in Beta. After the two day review was completed I made the trek home and returned to life as normal. I soon realized that I was missing my USB thumb drive that I use when traveling. This drive contained my password management program, all of my logins, personal and financial data. It also included VPN information, network and systems information. I called the hotel and to my surprise they had actually found my drive and would ship it back to me.
I was quite relieved by this good news. Now I was not going to have to dig through my bowl of swag drives and build a new travel thumb drive. You may be surprised to know that I was not concerned in the least about the data on the device because I used whole disk encryption to secure the device thus making any data stored on the device completely unreadable to anyone who was to find it.
When you utilize disk encryption any data stored on the device, or in the encrypted areas of the device, will be completely unreadable by anyone who does not have the corresponding password, passphrase, or key that is required to decrypt.
There are many paid applications and a few completely free applications that anyone can use to encrypt data or entire disks or devices. TrueCrypt is one of the freebies. Utilizing a utility like this to secure your device is not only a great idea but could save you a lot of time and money if, or when, you lose your device.
I recently ran across an excellent write up on the recommended steps to take for anyone who is duped into answering a Phishing Scam.
Full credit goes to Dan Keen of eHow.com
According to Wired, Albert Gonzalez the hacker convicted breaching the networks and stealing data from T.J. Maxx, Office Max, Dave and Busters and a handful of other companies, was today sentenced to 20 years in prison and a $25,000 fine. I reported earlier this week that he could have gotten as much as 25 years.
You can read Wired full story at the link below.
Wired.com
What would you think if I told you that there is a website that allows you to search anyone and find personal details about them? What if I told you that all I need to know is your name and the city you live in and I may be able to find your; address, phone number, cell phone number, spouses name, age, gender, race, marital status, education, hobbies, type of home, zodiac sign, whether or not you own your home, how long you have lived in your home, number of people living in your home, whether or not you have children, a photo of your home (yes a photo of your home!), and... Need I continue, or do I have your attention?
The website is spokeo.com who coins themselves as “Not your grandma’s phonebook”. This very easy to use search engine will locate just about anyone and allow you to learn a lot of information about them. Of course, it is not 100% accurate, but it is not too far off either!
Where do they get this information? I am sure a lot of it is dredged up from the internet and public record. I would imagine some of it is found on your social networking websites. But what about the data that is not common record or dredged up around the internet.
Let me use as an example my 90 year old grandmother who has never touched a computer. Why is her information there? Or my sister-in-law who told me about this site (I can see Mickey Mouse in your back yard). I know that she does not put her data on the internet.
Any conspiracy theorists want to tackle the US Census data?
To spokeo’s credit they do offer a way to remove yourself from their records and it is quite easy and effective. Below are the simple steps to remove yourself and your family members. Be warned, you can only make requests to remove two listings. I am not sure what the delay is before you can remove more.
Albert Gonzalez, the convicted ring leader of the group of hackers that stole nearly 130 million credit card numbers from T.J. Maxx and other businesses, may be looking at 25 years in federal prison for his deeds.
If imposed, this sentence would be the longest ever for an identity theft case. Some interesting facts about this case are;
