Centennial Man: 2009-07-19

Saturday, July 25, 2009

Another example of delayed use of stolen data. As long as the cards remain valid, the crooks can plan and execute their scheme for converting that information into cash.

http://www.databreaches.net/?p=6393

First National Bank closes debit accounts

July 24, 2009 by admin Filed under Breach Incidents, Financial Sector, Hack, ID Theft, Malware, U.S.

Another delayed effect of the Heartland breach….

More than two thousand debit card customers of First National Bank of Howell have had their accounts closed down after learning of a security breach. [Almost certain that they learned about this months ago. They chose to delay replacing cards in hopes that they could avoid the expense – leaving their customers at risk too. Will they repair any damage does to credit scores? Bob] Bank officials tell WHMI that after learning of an information breach at Heartland Payment Systems, a national credit and debit card processing company, they began to closely monitor their customer’s accounts and quickly found a pattern of suspicious activity. Randy Greene is the First National’s Vice President in charge of retail banking. He says that on Thursday they deactivated 2,300 of their customers debit cards as a precaution. He adds that any fraudulent activity will be completely covered and they are notifying all of their customers and arranging for new cards to be sent. A mass letter is also being sent out explaining the situation. Greene stresses that none of their customers personal identification data such as Social Security numbers or pin codes are believed to have been compromised.

Source: WHMI

Thanks to the good folks at ITRC for sending me this link.

Technical sophistication isn't enough and you can't spend all of your security budget on prevention. Some resources must be allocated to detecting a breach.

http://www.databreaches.net/?p=6397

Network Solutions hacked

July 24, 2009 by admin Filed under Breach Incidents, Business Sector, Hack, Of Note, U.S.

Hackers have broken into Web servers owned by domain registrar and hosting provider Network Solutions, planting rogue code that resulted in the compromise of more than 573,000 debit and credit card accounts over the past three months, Security Fix has learned.

Herndon, Va. based Network Solutions discovered in early June that attackers had hacked into Web servers the company uses to provide e-commerce services - a package that includes everything from Web hosting to payment processing — to at least 4,343 customers, mostly mom-and-pop online stores. The malicious code left behind by the attackers allowed them to intercept personal and financial information for customers who purchased from those stores, Network Solutions spokeswoman Susan Wade said.

Wade said the company is working with federal law enforcement and a commercial data breach forensics team to determine the cause and source of the break-in. The payment data stolen was captured from transactions made between March 12, 2009 and June 8, 2009.

Friday, July 24, 2009

If you don't know what happened, how do you know you've identified all the victims?

http://www.databreaches.net/?p=6385

Big credit card breach in Japan

July 24, 2009 by admin Filed under Business Sector, ID Theft, Non-U.S., Of Note

Alico Japan said Thursday that credit card data on possibly tens of thousands of its insurance policyholders had apparently leaked, resulting in massive fraudulent transactions.

It said that up to 110,000 policyholders could be affected.

Names of policyholders, their credit card numbers and the expiry dates of the cards were used to make fraudulent purchases via the Internet.

By Thursday, the life insurer said it had received inquiries from more than 1,000 policyholders who complained they had been billed by credit card companies for purchases they hadn’t made.

The parent company of Alico Japan is the U.S.-based American Life Insurance Co. Alico Japan also falls under the umbrella of the giant American International Group Inc. (AIG).

The apparent scope of the fraud makes it one of the largest of its kind in Japan in recent years.

Alico Japan said it was first alerted to the problem on July 14 by a credit card company with which it has business dealings. The credit card company said the leak had apparently occurred at Alico Japan.

Read more on Asahi.com. The company does not yet know how the breach occurred.

[From the article:

… Their policy contract numbers end with the numerals 2 or 3. [So only 2 out of 10 policies are impacted – or the crooks haven't needed to open the other files yet. Bob]

Trends?

http://www.atthebreach.com/blog/2009-verizon-business-risk-team-findings/

2009 Verizon Business Risk Team Findings

Key Findings of the 2009 Verizon Business Risk Team Cybercrime Report

This year’s key findings both support last year’s conclusions and provide new insights. These include:

* Most data breaches investigated were caused by external sources. Seventy-four percent of breaches resulted from external sources, while 32 percent were linked to business partners. Only 20 percent were caused by insiders, a finding that may be contrary to certain widely held beliefs.

* Most breaches resulted from a combination of events rather than a single action. Sixty-four percent of breaches were attributed to hackers who used a combination of methods. In most successful breaches, the attacker exploited some mistake committed by the victim, hacked into the network, and installed malware on a system to collect data.

* In 69 percent of cases, the breach was discovered by third parties. The ability to detect a data breach when it occurs remains a huge stumbling block for most organizations. Whether the deficiency lies in technology or process, the result is the same. During the last five years, relatively few victims have discovered their own breaches.

* Nearly all records compromised in 2008 were from online assets. Despite widespread concern over desktops, mobile devices, portable media and the like, 99 percent of all breached records were compromised from servers and applications. [A bit misleading, since the greatest volume of data is on servers and in applications. One server breach could yield 1000 times the data on a stolen laptop. Bob]

* Roughly 20 percent of 2008 cases involved more than one breach. Multiple distinct entities or locations were individually compromised as part of a single case, and remarkably, half of the breaches consisted of interrelated incidents often caused by the same individuals.

* Being PCI-compliant is critically important. A staggering 81 percent of affected organizations subject to the Payment Card Industry Data Security Standard (PCI-DSS) had been found non-compliant prior to being breached.

If nothing else, the graphic showing relative length of the privacy policies examined is amusing.

http://www.pogowasright.org/?p=2132

15 Top Privacy Policies, Analyzed

July 23, 2009 by Dissent Filed under Internet

We all know no one reads privacy policies. What do the top websites really include in them? In its mission to get anonymous public data, The Common Data Project a New York City-based non-profit, is on a mission to eliminate the barriers that privacy policies pose.

In a new report, they analyzed ten of the most popular Web properties on the Internet, and several more emerging ones. Here’s how what they put in their policies affects your privacy, and how other enterprises can imitate their best practices.

Thursday, July 23, 2009

Perhaps not the best target for identity theft?

http://www.pogowasright.org/?p=2113

Jackson death certificate improperly accessed

July 23, 2009 by Dissent Filed under Breaches, U.S.

Los Angeles County coroner’s officials said Wednesday that they have discovered security breaches involving the investigation into Michael Jackson’s death, including hundreds of improper views of the pop star’s death certificate and the discovery of weaknesses in two other computer systems in which more sensitive records are stored.

At least half a dozen staff members inappropriately accessed Jackson’s death certificate, officials said. Within two weeks of his death June 25, the certificate had been viewed more than 300 times. The document was not released publicly until July 7.

Wednesday, July 22, 2009

How much should a security breach cost an organization?

http://www.databreaches.net/?p=6353

HSBC fined for personal data loss

July 22, 2009 by admin Filed under Breach Incidents, Lost or Missing, Non-U.S., Of Note

Three HSBC firms have been fined more than £3m for failing to adequately protect customers’ confidential details from being lost or stolen.

The Financial Services Authority (FSA) said customer data had been lost in the post on two occasions.

The firms concerned are HSBC Life UK, HSBC Actuaries and Consultants, and HSBC Insurance Brokers.
[...]

The FSA identified two instances where unencrypted data had been lost in the post.

In April 2007, HSBC Actuaries lost a floppy disk containing the personal information of 1,917 pension scheme members, including addresses, dates of birth and national insurance numbers.

And in February 2008, HSBC Life lost a CD containing the details of 180,000 policyholders.

“All three firms failed their customers by being careless with personal details which could have ended up in the hands of criminals,” said Margaret Cole, director of enforcement at the FSA.

Read more on BBC. Related - FSA Press Release

See how common “not knowing” is? Here's an idea. If you can't prove your laptop was “PII Free” then you must assume it contained data on every customer. (It'll never fly, but it would open some eyes.)

http://www.databreaches.net/?p=6349

Stolen laptop “may have” held customer data

July 21, 2009 by admin Filed under Breach Incidents, Business Sector, Theft

On July 8, a laptop that may have contained some customer information such as names and credit card numbers was stolen from an employee of Henry Schein, Inc. Although the laptop was password protected, the data were not encrypted.

By letter dated July 16 to the New Hampshire Attorney General’s Office, Kristen J. Mathews of Proskauer Rose indicated that the HSI, which distributes medical, dental, and veterinary supplies, was not even sure any customer data were on the laptop, writing “At this time HSI has no reason to believe that any personal information (if any was actually contained on the laptop) has been or will be accessed or misused. ”

So how do you notify customers when you’re not even sure any customer data were on a stolen device? Is this a “if there were data, then it would have to be _________’s data” thing?

Whenever I read such reports, I always wonder why there was no backup that could tell them definitively whether there were PII on a stolen device and if so, whose. I also wonder why any customer data would be on the device since it seems logical (to me, anyway) that the employee wasn’t working with the data or at the very least, hadn’t worked with it for long enough time that s/he could not longer remember or be sure what was on the laptop. So far, I haven’t come up with any good answers, but maybe there is a scenario that I haven’t considered. [Rampant stupidity? Bob]

(Related) If you don't have expertise in a niche area, ask the Internet. The first Comment provides a (free) answer. See how easy “knowing” can be?

http://tech.slashdot.org/story/09/07/21/218206/Best-Tools-For-Network-Inventory-Management?from=rss

Best Tools For Network Inventory Management?

Posted by kdawson on Tuesday July 21, @05:51PM from the IPs-and-users-and-boxes-oh-my dept. networking

jra writes

"Once every month or so, people ask here about backups, network management, and so on, but one topic I don't see come up too often is network inventory management — machines, serial numbers, license keys, user assignments, IP addresses, and the like. This level of tracking is starting to get out of hand in my facility as we approach 100 workstations and 40 servers, and I'm looking for something to automate it.

Hope for the “Privacy/Security Challenged?” (It is possible some of my students are already sending me their research papers using this tool...

http://it.slashdot.org/story/09/07/21/1522255/Vanish-Makes-Sensitive-Data-Self-Destruct?from=rss

'Vanish' Makes Sensitive Data Self-Destruct

Posted by Soulskill on Tuesday July 21, @12:14PM from the also-doesn't-appear-to-be-a-fire-hazard dept. security encryption

Hugh Pickens writes

"The NY Times reports on new software called 'Vanish,' developed by computer scientists at the University of Washington, which makes sensitive electronic messages 'self destruct' after a certain period of time. The researchers say they have struck upon a unique approach that relies on 'shattering' an encryption key that is held by neither party in an e-mail exchange, but is widely scattered across a peer-to-peer file sharing system. 'Our goal was really to come up with a system where, through a property of nature, the message, or the data, disappears,' says Amit Levy, who helped create Vanish. It has been released as a free, open-source tool that works with Firefox. To use Vanish, both the sender and the recipient must have installed the tool. The sender then highlights any sensitive text entered into the browser and presses the 'Vanish' button. The tool encrypts the information with a key unknown even to the sender. That text can be read, for a limited time only, when the recipient highlights the text and presses the 'Vanish' button to unscramble it. After eight hours, the message will be impossible to unscramble and will remain gibberish forever. Tadayoshi Kohno says Vanish makes it possible to control the 'lifetime' of any type of data stored in the cloud, including information on Facebook, Google documents or blogs."

Interesting approach. If the same information is available for the other state laws, we have the basis for a quick (and useful?) article.

http://www.databreaches.net/?p=6335

FAQ on Nevada’s Security of Personal Information Law (NRS 603A)

July 21, 2009 by admin Filed under Breach Laws, Legislation, State/Local

InfoSecCompliance (”ISC”) was recently asked by a prospective client to provide a summary of Nevada’s Security of Personal Information law (NRS 603A) and a recent amendment to the Security Law that incorporated the Payment Card Industry Data Security Standard (”PCI”). ISC decided to try something new and create a Frequently Asked Questions document around the PCI requirements contained in the Security Law. For better or worse (after sinking in 15 - 20 hours) ISC ended up doing FAQs for the entire Nevada Security Law. This turned out to be a much bigger work than originally anticipated, so ISC is going to do a five-part blog post series breaking down the Nevada Security Law into (hopefully) digestible parts.

This FAQ is broken down into six sections that will be posted over five posts over the next week or so. The postings will be broken down as follows:

Post One: The Basics of Nevada’s Security Law and Destruction of Records

Post Two: Security Breach Notice

Post Three: Required Security Measures

Post Four: Encryption and PCI Compliance

Post Five: Remedies, Penalties and Enforcement

Check the site for updates when the posts become available. Post One is available now.

(Related)

http://www.databreaches.net/?p=6358

Nevada’s Security of Personal Information Law Post Two: The Breach Notice Requirements

July 22, 2009 by admin Filed under Breach Laws, State/Local

From the FAQ provided by InfoSecCompliance:

What triggers the security breach notice obligations under the Security Law?

In order for the breach notice requirements to be triggered under the Security Law two general events must occur (with some sub-requirements discussed further below). First, there must have been a “breach of the security of the system data” discovered by a data collector or notified to a data collector. Second, “personal information” must have actually been acquired by an unauthorized person, or was “reasonably believed to have been acquired” by an unauthorized person.

Tuesday, July 21, 2009

“Interesting,” Anonymous

http://www.pogowasright.org/?p=2021

Judge OKs anon comments, some bloggers don’t

July 20, 2009 by Dissent Filed under Court, Internet, U.S.

There are a couple of interesting new posts around the blogosphere concerning anonymous online commenters. The first, over at Volokh, discusses a recent case out of Tennessee, State v. Cobbins, where a judge denied defendants’ motion to require a media outlet to disable a portion of its Web site enabling Web users to post comments (mostly anonymous) about the pending case. Defendants argued that the site comments could prejudice jurors. The judge denied the motion for a variety of reasons, noting the importance of the First Amendment rights at stake:

The right to speak anonymously extends to speech via the Internet. Internet anonymity facilitates the rich, diverse, and far ranging exchange of ideas. The “ability to speak one’s mind” on the Internet “without the burden of the other party knowing all the facts about one’s identity can foster open communication and robust debate.” People who have committed no wrongdoing should be free to participate in online forums without fear that their identity will be exposed under the authority of the court.

Read more on Legal Blog Watch. The blog entry goes on to discuss the recent trend on some legal blogs to require commenters to provide their real name and email address. [Perhaps we need an “Anonymous Lawyer” blog? Bob]

Too good to be true? Probably.

http://www.techradar.com/news/internet/google-promises-the-end-of-viruses--617790

Google promises 'the end of viruses'

Engineering director claims Chrome OS will finally defeat malware

By Adam Hartley Monday at 11:30 BST

Google's Engineering Director has promised that its forthcoming Chrome OS will see 'the end of malware'.

Google is promising what the latest issue of New Scientist magazine refers to as "a carefree antivirus nirvana" with its forthcoming Google Chrome OS.

… Via New Scientist

Of course, this was before the iPhone (June 2007)

http://www.bespacific.com/mt/archives/021863.html

July 20, 2009

NYT Posts Unreleased Government Report on Dangers of Using Cell Phones While Driving

"The following body of research, conducted by the Department of Transportation and completed in 2003, has not been made public until now. The documents pertain to the safety of using wireless communication devices while driving. The New York Times obtained the research from the Center for Auto Safety and Public Citizen, two consumer advocacy groups that earlier this year acquired more than 250 pages of undisclosed material through a Freedom of Information Act lawsuit." See also Related Article.

Status Summary: Using Wireless Communications Devices While Driving, Original Date May 21, 2002 - Last updated: July 2003 [266 pages]

[From the report:

The experimental data indicates that, with the exception of the consequences of manipulating a

wireless communications device, there are negligible differences in safety relevant behavior and

performance between using hand-held and hands-free communications devices while driving from

the standpoint of cognitive distraction.

This all started with the evil conspiracy to eliminate the buggy whip industry. No doubt Congress will take action to “Keep American in the Forefront of 19^th Century Technology!”

http://www.bespacific.com/mt/archives/021859.html

July 20, 2009

Will There Be a Fight To Save American Manufacturing?

New York Times: "The United States ranks behind every industrial nation except France in the percentage of overall economic activity devoted to manufacturing — 13.9 percent, the World Bank reports, down a percentage point or so in a decade. The 19-month-old recession has contributed to this decline. Industrial production has fallen 17.3 percent, the sharpest drop during a recession since the 1930s... Manufacturing has long been viewed as an essential pillar of a powerful economy. It generates millions of well-paid jobs for those with only a high school education, a huge segment of the population. No other sector contributes more to the nation’s overall productivity, economists say. [Didn't they say that about farming? Bob] And as manufacturing weakens, the country becomes ever more dependent on imports of merchandise, computers, machinery and the like — running up a trade deficit that in time could undermine the dollar and the nation’s capacity to sustain so many imports."

Related postings on financial system

Once again I will be able to argue with the Antitrust lawyers that it is simpler to wait a full “Internet century” (about 10 years) for the “next big thing” to supersede Google, or for Google to follow Microsoft's example and shoot itself in the foot once too often.

http://www.wired.com/techbiz/it/magazine/17-08/mf_googlopoly

Why Is Obama's Top Antitrust Cop Gunning for Google?

By Fred Vogelstein

"I think you are going to see a repeat of Microsoft."

Christine Varney's blunt assessment sent a buzz through the audience at the National Press Club in Washington, DC. Varney, a partner at Hogan & Hartson and one of the country's foremost experts in online law, was speaking at the ninth annual conference of the American Antitrust Institute, a gathering of top monopoly attorneys and economists.

… The technology industry, she said, was coming under the sway of a dominant behemoth, one that had the potential to stifle innovation and squash its competitors. The last time the government saw a threat like this—Microsoft in the 1990s—it launched an aggressive antitrust case. But by the time of this conference, mid-June 2008, a new offender had emerged. "For me, Microsoft is so last century," Varney said. "They are not the problem. I think we are going to continually see a problem, potentially, with Google."

… She acknowledged that her remarks might ruffle some feathers at Google headquarters in Mountain View, California. "If any of my colleagues or friends from Google are here," she said, "I invite you to jump up and scream and yell at me."

Nobody took her up on that offer. But it is safe to assume that plenty of Googlers were jumping and screaming six months later when President Obama appointed Varney head of the Justice Department's antitrust division, making her the government's most powerful antimonopoly prosecutor.

… "Part of what you have to do when you're going to try to bring a [Sherman Antitrust] Section Two case is you have to create the political climate," she said. [Because neither the B-school nor Google's customers believe you have a case. Bob]

… In and of itself, Google's size is not a legal problem.

… Because its search and advertising algorithms are secret, there is no way for competitors or partners to know whether Google tweaks results to direct traffic to its own properties over theirs.

… And even if Google is behaving honorably now, it is creating a system full of temptations should the company ever come under financial pressure.

… Some antitrust experts argue that the natural business cycle will take care of this problem without government intervention, but Varney's three top economists have all said that they favor a hands-on approach. [What did they say when the Republicans were in charge? Bob]

This is an interesting business model. Would it work for other professions?

http://www.killerstartups.com/Web20/pubmeddy-com-science-articles-resources

PubMeddy.com - Science Articles & Resources

http://pubmeddy.com/

Hundreds of articles are published in various fields of medical research ranging from obesity, stem cell, various human syndromes and so forth on a daily basis. The information is usually stored in various publicly available databases. Pubmeddy.com takes that information and automatically makes webpages that users can access to read the articles or research papers of their choice.

This means that now instead of conducting a search that goes “stem cell papers” or “obesity” users can resort to this site and find the latest articles that are published by the scientific community. The site is updated by the hour, which means if you are interested in various fields of biomedical research, you can just check out the website and see what is new at a glance. Websites such as this one (solely devoted to biomedical research) are not that commonplace, and as such it can gather a considerable following.

This is brilliant. Now I can point my students to tools they can try before downloading and installing (i.e. immediate feedback.)

http://www.killerstartups.com/Web20/click2try-com-try-open-source-software-at-no-cost

Click2Try.com - Try Open Source Software At No Cost

http://www.click2try.com/

Quite a well-focused community site, Click2Try will allow you to put open source software to the task without having to incur into downloads of any kind, and without having to worry about setting anything up. Basically, through the site you can gain access to software applications that are pre-configured and already functional, and that are installed on a virtual machine that is also private, and accessible from your desktop.

The advantages of such an approach are obvious: you eliminate long downloads and time-demanding installation procedures, whereas you also dispense with upgrades and integration issues of every kind. In short, a system like this one ensures that you will do without each and every software headache one knows that has to be faced when putting a new application into motion.

There are both standard and premium subscription plans, and there are also different evaluation packages so that if you want to see whether such an approach is what you need in order to have a less-stressful time with your computer this might be where it’s at.

Expect many pointers to presentations and videos...

http://en.oreilly.com/oscon2009

OSCON 2009

[I'm interested in:

Introduction to Forensics

http://en.oreilly.com/oscon2009/public/schedule/detail/8194

Cloud Computing - Why IT Matters

http://en.oreilly.com/oscon2009/public/schedule/detail/9210

Enabling Academic Research – Open Tools and Services on Microsoft Platforms

http://en.oreilly.com/oscon2009/public/schedule/detail/10209

Centennial Man

Saturday, July 25, 2009

Friday, July 24, 2009

Thursday, July 23, 2009

Wednesday, July 22, 2009

Tuesday, July 21, 2009

Search This Blog

Followers

Blog Archive

Links

About Me