Centennial Man: 2009-01-18

Saturday, January 24, 2009

I too suspect Vladimir Putin

http://www.databreaches.net/?p=936

Suspect identified in Heartland Payment Systems breach

Posted January 23rd, 2009 by admin

Evan Schuman at Storefront Backtalk is reporting that the Secret Service has identified an overseas suspect in the Heartland Payment Systems breach.

Evan also has some other updated info on the breach:

The processor first learned of the breach (when alerted by Visa and Mastercard) in late October/early November, said Heartland spokesman Jason Maloni. Previously, the only comment had been that it had been alerted in late Fall, which could have been as late as Dec. 20.

Maloni also revealed that when the sniffer software had been discovered by Heartland, the application had already been deactivated, presumably by the cyber thieves who had planted it. “It was inactive when we found it,” Maloni said.

Maloni said he didn’t more about the application’s inactive status, such as whether it had been fully terminated or whether it could have been merely dormant, programmed to awaken at some future point. If the Trojan had been deactivated, that could mean that the thieves learned they were being hunted and shut off many such applications to try and make it more difficult for investigators to discover their location.

Friday, January 23, 2009

Maybe someone will start a website just for this breach. Meanwhile, this helps...

http://www.pogowasright.org/article.php?story=20090122091603601

An F.A.Q. on the Heartland Payment Systems breach

Thursday, January 22 2009 @ 09:16 AM EST Contributed by: PrivacyNews

Because Heartland Payment Systems has not really answered the questions of interest to consumers and bloggers like me, I thought -- out of "an abundance of caution" -- that I would compile what we know and create an F.A.Q. on the breach.

1. I never heard of Heartland Payment Systems. Who are they, and how do I know if they have my data?

When you use your credit card or debit card , you provide your card details. Merchants and restaurants all use payment processing companies to handle the card transactions. Heartland is one of the biggest card payment processors in the U.S. It handles transactions for Visa, MasterCard, American Express, Diners Club, Discover, and JCB.

You would have no way of knowing whether they have your data unless you had a list of every one of their 175,000 or so clients and had used your card with one of those clients during the period when their system had been breached.

You can find more information on Heartland on their web site. What you will not find on their home page is any reference to the breach or any link to information about the breach.

2. What happened?

Heartland Payment Systems' security failed to detect that a keylogger had gotten past their firewall. A keylogger records every keystroke you type, like usernames and passwords. According to HPS president Robert Baldwin, the keylogger then propagated a sniffer that started capturing transaction data in real-time. Transaction data includes your name, and credit or debit card number and expiration date.

3. When did the breach occur?

HPS is still scratching its head over that one, but there are published reports that Visa and MasterCard informed credit unions that fraudulent charges were being posted from May 16 - August 19th, suggesting that the breach predates May 2008. HPS either hasn't figured out or hasn't revealed exactly when the breach began and when it ended.

4. How did HPS find out about the breach?

HPS reports that Visa and MasterCard contacted them about suspicious activity. HPS couldn't find anything wrong, and brought in a forensics team, who just last week, reportedly discovered "evidence" of the breach.

5. When did HPS find out about the breach?

HPS has not said precisely when they were first contacted, but some reports indicate that they were notified by Visa and MasterCard in the fall of 2008.

6. What kinds of data were stolen?

Credit card numbers, expiration dates, debit card numbers, and customers' names. In its press release, HPS said that no Social Security numbers, unencrypted personal identification numbers (PIN), addresses, or telephone numbers were involved. The breach affected one of HPS's networks, but not all of them.

7. How many people had their data stolen? I heard it was 100 million accounts.

HPS president Baldwin says that they don't know that yet. As of Jan. 20, they hadn't figured out what data the sniffer actually grabbed, whether the data were sent to an external site, or what data was actually accessed.

The 100 million figure is a distortion of a statement Baldwin made in an interview where he mentioned that HPS processes 100 million transactions per month. First, 100 million transactions per month do not represent 100 million accounts or unique individuals because some people make numerous purchases on their card each month. Second, this breach seemingly went on for well over a month. So how many unique card numbers does HPS process in an 8-month period? We don't know.

8. Is there any indication of fraudulent use of card numbers resulting from this breach?

Yes, indeedy. Although the number of publicly reported cases is relatively small (less than 200 as of Jan. 22), we expect the numbers to rise.

9. Is the breach still ongoing?

HPS says that it has contained the problem.

10. Some reports said that HPS was PCI-compliant but the breach happened anyway. What's that about?

It means that they followed industry standards for security. But industry standards are the floor protections that need to be in place, and do not protect against all breaches. Think "necessary but not sufficient."

11. What should I do?

You can do what I did: make up a dartboard and put HPS in the center and throw darts at it.

Other than that, either wait for your bank, credit union or card issuer to notify you. If you don't want to wait, call them to see if your account was known to be affected. And if you haven't been checking your card and bank statements all along, go back and check them starting in April of 2008.

If you're really nervous, cancel all your cards and have them reissued with new numbers.

12. What is HPS offering or doing to help us if our cards were used for fraud?

Absolutely nothing. They say it would be "inappropriate" to do anything because this cannot lead to ID theft because there were no addresses or PINs or SSN. They did not respond to an inquiry as to whether they would reconsider offering free credit monitoring in light of reports that the breach resulted in fraud.

13. Where can I find out more about the breach and any updates?

HPS set up what has so far been a totally uninformative and useless web site at www.2008breach.com. Your best bet is to read news sites or sites like www.databreaches.net where you will find links to news articles and other updates based on our own queries.

New software installed, data going out and no one notices?

http://www.databreaches.net/?p=915

Six month exposure window on Heartland breach?

Posted January 22nd, 2009 by admin

According to a CBS news report, Platte Valley Bank issued the following release today:

The VISA Fraud Control & Investigations has been notified of a confirmed network intrusion that has put VISA account numbers at risk. Platte Valley Bank received a VISA Alert Wednesday, January 21, 2009. As of Thursday morning, January 22nd, 388 of Platte Valley Bank’s Debit Card customers have been affected. The entity type was classified as a “Brick & Mortar 3rd Party Processor”. No word yet on any Credit Cards being affected, but possibly could be, as this is related to the Heartland Payment Systems Breach announced yesterday, January 21, 2009.

The reported incident involves confirmed unauthorized access to a U.S. 3RD party processor’s authorization system of signature-based and PIN-based transaction information, that included cardholder name, expiration date, account numbers and some encrypted PIN blocks. Exposure Window was May 15, 2008 through November 13, 2008.

[...]

The release raises additional questions, including:

How did the window of exposure end on November 13 if Heartland didn’t find any evidence of a breach until last week (and seemingly wouldn’t be able to stop the bleeding until they found out where the problem was)?

Maybe some kind reader with a security background can explain that.

In other Heartland news, Forcht Bank updated the alert on their site and confirmed that their debit card breach was part of the Heartland breach.

“It is better to look secure than to be secure.”

http://www.databreaches.net/?p=911

Heartland breach raises questions about PCI standard’s effectiveness

Posted January 22nd, 2009 by admin

Ellen Messmer reports:

[...]

It’s not yet known if the Heartland data breach will count as the largest card heist ever. But some analysts say what is clear is that payment-card processors are under increasing attack, and that the Payment Card Industry (PCI) data security standard that Visa and MasterCard require isn’t sufficient to ensure cardholder data is safeguarded.

“Billions is being spent on PCI compliance, but it isn’t really working,” says Gartner analyst Avivah Litan. “PCI’s dirty little secret is that it doesn’t mandate encryption inside a private network because then all the processors would have to encrypt.”

Encryption of data would make it much harder for attackers to benefit from the kind of network break-in that Heartland suffered. But Litan notes the complex interconnections among payment-card processers, merchants and banks would make point-to-point encryption extremely unwieldy. End-to-end application-level encryption might be more feasible where card data is originated.

The irony, Litan says, is that some retailers today do encrypt using VPNs to send cardholder data to a payment processor like Heartland, but processors decrypt it to transmit it onward.

Thursday, January 22, 2009

There are a lot of stories on the HPS breach. A small sampling follows.

Perhaps another wave of panic in the financial industry?

http://www.databreaches.net/?p=832

Two credit unions report debit card misuse linked to Heartland breach

Posted January 21st, 2009 by admin

Yesterday, we reported that Piedmont Credit Union in North Carolina had reported that 15 of its members were reporting fraudulent use of their Visa-issued debit cards, mostly at gas stations in Florida. We also reported that Oregon Territory Federal Credit Union members were reporting misuse of their debit cards. At the time of the initial reports, neither credit union was able to identify the source of the breach.

Now Piedmont has issued a statement on its site linking their breach to the Heartland breach. Although the statement does not name Heartland, a spokesperson confirmed to me that it was Heartland being referred to in their announcement.

A spokesperson for Oregon Territory also informs me that they have determined that their breach and fraud reports were also due to the Heartland breach.

In a third credit union breach, a spokesperson for Franciscan Skemp Credit Union informs me that they are as yet unable to determine if the Heartland breach was responsible for their reports, but that approximately 60 members have reported debit card fraud starting at the beginning of December. In their case, most of the fraudulent activity occurred at California retail merchants and gas stations.

Heartland’s initial press release did not indicate that it was arranging for any credit monitor or ID theft restoration services for those affected, and they have not yet responded to an inquiry as to whether they will arrange for such services in light of reports that there has been fraudulent use linked to the breach.

[small update: PCU's newest statement on their site names Heartland as the source of their breach.]

Replacing cards, even with no direct evidence of fraud, suggests they are taking this very seriously.

http://www.databreaches.net/?p=206

Maine banks checking for impact from data theft (Heartland Payment Systems follow-up)

Posted January 21st, 2009 by admin

Tux Turkel reports:

Maine banks and credit unions were scrambling this morning to assess the scope of a nationwide data breach involving credit and debit cards.

[...]

It was not immediately clear whether Maine customers had been victims of fraud related to the Heartland breach, but some banks were making plans to reissue cards, just to be safe.

Kennebunk Savings Bank has 7,000 MasterCard accounts that potentially could have been compromised. The bank decided this morning that it will send new cards to customers, although it hadn’t gotten any reports of misused cards.

Other banks were waiting for more information, to assess whether their customers were at risk. Bangor Savings Bank, which has 70,000 Visa cardholders, said its internal fraud-detection software had so far not detected any problems. For now, the bank isn’t planning to reissue new cards for all customers.

[...]

Wednesday, January 21, 2009

We have a new BIGGEST! One of my students reported that her Credit Union will replace her credit card but the CU provided little information as to why.

http://it.slashdot.org/article.pl?sid=09%2F01%2F20%2F1930252&from=rss

Largest Data Breach Disclosed During Inauguration

Posted by kdawson on Tuesday January 20, @02:44PM from the debit-cards-at-risk dept. Security The Almighty Buck

rmogull writes

"Brian Krebs over at the Washington Post just published a story that Heartland Payment Systems disclosed what may be the largest data breach in history. Today. During the inauguration. Heartland processes over 100 million transactions a month, mostly from small to medium-sized businesses, and doesn't know how many cards were compromised. The breach was discovered after tracing fraud in the system back to Heartland, and involved malicious software snooping their internal network. I've written some additional analysis on this and similar breaches. It's interesting that the biggest breaches now involve attacks installing malicious software to sniff data — including TJX, Hannaford, Cardsystems, and now Heartland Payment Systems."

One bit of good news out of this massive breach is that, according to Heartland's CFO, "The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address." [Are they saying the hackers didn't get your home address? Why would that make much difference? Bob] Heartland just put up a press release on the breach.

[From the article:

… Robert Baldwin, Heartland's president and chief financial officer, said the company … began receiving fraudulent activity reports late last year from MasterCard and Visa

… Heartland called U.S. Secret Service and hired two breach forensics teams to investigate. [But apparently not until last week! Bob] But Baldwin said it wasn't until last week that investigators uncovered the source of the breach: A piece of malicious software planted on the company's payment processing network that recorded payment card data as it was being sent for processing to Heartland by thousands of the company's retail clients.

Baldwin said Heartland does not know how long the malicious software was in place, how it got there or how many accounts may have been compromised.

… The data stolen includes the digital information encoded onto the magnetic stripe built into the backs of credit and debit cards. Armed with this data, thieves can fashion counterfeit credit cards by imprinting the same stolen information onto fabricated cards.

… Baldwin said it was not appropriate for Heartland to offer affected consumers credit protection or other identity theft protection services. [Certainly not affordable. Bob]

… Avivah Litan, a fraud analyst with Gartner Inc., questioned the timing of Heartland's disclosure -- a day in which many Americans and news outlets are glued to coverage of Barack Obama's inauguration as the nation's 44th president.

"This looks like the biggest breach ever disclosed, and they're doing it on inauguration day?" Litan said. "I can't believe they waited until today to disclose. That seems very deceptive."

http://www.digitaltransactions.net/newsstory.cfm?newsid=2063

PCI’s Shield Suffers Another Blow As Heartland Reports a Hack

… This latest breach happened despite the fact that a qualified Payment Card Industry data-security standard, or PCI, assessor found Heartland in compliance with the card networks’ security standards last April, according to Baldwin.

… After bringing in outside investigators and immediately reporting the breach to the U.S. Secret Service and U.S. Justice Department upon confirming it last week, [Why not last year, when Visa told them about it? Bob] Heartland in a news release today described the incident as the possible work of “a widespread global cyber fraud operation.”

… Visa Inc. and MasterCard Inc. first alerted Heartland of suspicious transactions late in the fall, according to Baldwin.

… Asked when the malware was planted, Baldwin says, “we have some strong suspicions, but at this point it’s still speculative. [Translation: We don't know. Bob]

… The breach could be large, according to Avivah Litan, a technology and security analyst at Stamford, Conn.-based Gartner Inc. “Very credible sources tell me this could be at least as big as TJX,” she says, refusing to identify the sources.

http://www.networkworld.com/community/node/37510

Banks warn customers as debit-card processor acknowledges breach ... "Larger than TJX?"

By Paul McNamara on Tue, 01/20/09 - 10:03am.

… "We really don't have too many more details, but have noticed that credit unions in at least five states from Florida to Oregon have placed 'alerts' on their Web sites about a 'possible breach,' " says Kelly Todd, who helps maintain the Open Security Foundation's DataLossDB.

… According to this story from the TimesTribune.com in Kentucky, Forcht Bank is among those taking steps to protect its customers.

… This story over the weekend in the Kennebec Journal tells of 1,500 customers of the Kennebec Savings Bank in Augusta, Maine being notified that their card information had been compromised. The bank was replacing cards only upon request.

Here police in Salem, Oregon report a rash of actually compromised debit-card accounts held by the Oregon Territory Federal Credit Union.

A flashing "Debit Card Alert" message on the homepage of Franciscan Skemp Credit Union in Wisconsin leads to this detailed warning (.pdf).

… While there are indications that the malicious software had compromised Heartland's network as long ago as mid-May (Baldwin would not confirm that), he said it was "just last week" that forensic examinations definitively pinpointed Heartland as the source of the breach.

Trivial in comparison?

http://www.databreaches.net/?p=773

VOIP hacked to the tune of $120k

Posted January 20th, 2009 by admin

Slightly o/t, but for the second time in one month, we’re seeing reports of phone system hacks leaving businesses with huge bills.

[From article one:

A Canadian computer security firm got worse than a lump of coal in its stocking this year -- it got a $50,000 phone bill after someone hi-jacked its phone system and made hundreds of calls to Bulgaria over two weeks.

[From article two:

A small business has a $120,000 phone bill after criminals hacked into its internet phone system and used it to make 11,000 international calls in just 46 hours.

More detail on an old story.

http://it.slashdot.org/article.pl?sid=09%2F01%2F20%2F2258217&from=rss

Details Emerge On the 2006 Hacking of Congress

Posted by kdawson on Wednesday January 21, @08:08AM from the by-party-or-parties-unknown dept.

The National Journal just published an article with details about the hacking of Congress in 2006, possibly by agents in China, though the attack's origin is uncertain. The article notes the difficult work of the House Information Systems Security Office, which must set security policies and then try to enforce them on a population of the equivalent of C-level executives. The few members who have called attention to the issue of Congressional cyber-security have been advised to shut up about it, by whom the reporter did not discover.

"Armed with this information about how the virus worked, the security officers scanned the House network again. This time, they found more machines that seemed to match the profile — they, too, were infected. Investigators found at least one infected computer in a member's district office, indicating that the virus had traveled through the House network and may have breached machines far away from Washington. Eventually, the security office determined that eight members' offices were affected; in most of the offices, the virus had invaded only one machine, but in some offices, it hit multiple computers. It also struck seven committee offices, including Commerce; Transportation and Infrastructure; Homeland Security; and Ways and Means; plus the Commission on China, which monitors human rights and laws in China."

Oh yeah, this happened too...

http://www.bespacific.com/mt/archives/020355.html

January 20, 2009

Text and Video of President Obama's Inaugural Address

CNN: "Barack Obama was sworn in as the 44th president of the United States and the nation's first African-American president Tuesday. This is a transcript of his prepared speech." The video link is here.

Tuesday, January 20, 2009

Another biggie? No mention of the retailer's name, but 8500 customers from one bank suggests this could be huge!

http://www.databreaches.net/?p=748

KY: Hackers break into STAR and ATM Network

Posted January 19th, 2009 by admin

Forcht Bank disabled 8,500 customer debit cards this week after learning they could have potentially been hacked into by persons creating duplicate cards.

Eddie Woodruff, chief operations officer for the bank, confirmed that 8,500 of the bank’s roughly 22,000 total debit cards had been deactivated, but the move was primarily a precaution.

“Right now, none of our customers have reported any fraudulent activity on the cards,” Woodruff said. “We’re just trying to take every precaution.”

The cards were comprised when a retail merchant’s computer system was hacked, Woodruff said. The breach affected customers of multiple banks whose cards are processed by the STAR Debit and ATM Network.

[...]

Woodruff said other banks were affected by the problem, but First Data Corporation, which operates the STAR Debit and ATM Network, would not comment on how many were affected.

The STAR system is used by 2 million ATM and retail locations across the country, according to its Web site.

Centennial Man

Saturday, January 24, 2009

Friday, January 23, 2009

Thursday, January 22, 2009

Wednesday, January 21, 2009

Tuesday, January 20, 2009

Search This Blog

Followers

Blog Archive

Links

About Me