Centennial Man: 2009-08-16

Saturday, August 22, 2009

Why steal 100 million card numbers? How else is a poor crook to make a living...

http://www.databreaches.net/?p=6812

Stolen credit card data cheap on cyber-black market

August 21, 2009 by admin Filed under Commentaries and Analyses

The black market economy of the cyber-world is always busy, especially in an age of massive data breaches like the ones that occurred at Heartland Payment Systems and Hannaford Brothers.

According to research from Kaspersky Lab posted Aug. 17, U.S. credit cards are not worth as much as you might think. While analyzing malware, Kaspersky Lab virus analyst Dmitry Bestuzhev came across a Website with pricing information for the credit cards swiped by cyber-crooks. The highest prices belonged to German credit cards, which sold for $6 (USD) a piece. U.S. Visa cards sold for $2.

Friday, August 21, 2009

A bit more information on the case and an exam question or two for my Forensics students

http://www.wired.com/threatlevel/2009/08/gonzalez-evidence/

In Gonzalez Hacking Case, a High-Stakes Fight Over a Ukrainian’s Laptop

By Kim Zetter Email Author August 20, 2009 4:21 pm

When Turkish police arrested Maksym “Maksik” Yastremskiy — a Ukrainian wholesaler of stolen identity data — in July 2007, they didn’t just collar one of the most-wanted cybercriminals in the world. They also got a trove of evidence about Yastremskiy’s buyers and suppliers, all locked in an encrypted vault on his laptop computer.

Now federal prosecutors are hoping to introduce a copy of Yastremskiy’s files in its case against accused hacker Albert “Segvec” Gonzalez. Chat logs and other information on the disk allegedly show that Gonzalez was Yastremskiy’s major supplier of credit and debit card numbers.

But Gonzalez’s attorney is fighting to keep the data, and similar information seized from a server in Latvia, far away from the New York court room where Gonzalez is scheduled to stand trial next month on the first of three federal indictments. The argument unfolding over the disks illustrates the challenges and controversies of using electronic evidence gathered in foreign jurisdictions, and sheds more light on the unusual methods used to investigate what authorities have called the largest identity theft case in U.S. history.

… One notable revelation in the government’s own filings (.pdf) is that Yastremskiy’s arrest did not mark the first time the Secret Service gained access to his computer files. On June 14, 2006 the Secret Service worked with local authorities to conduct a “sneak-and-peek” search of Yastremskiy’s laptop while he was traveling through Dubai, in the United Arab Emirates. The agency secretly obtained a copy of the man’s hard drive in the search.

The government says that stealth operation is irrelevant now, because it doesn’t plan on introducing the data from the sneak-and-peek at trial — only the data taken in Turkey at Yastremskiy’s arrest. But defense attorney Rene Palomino, Jr., says the earlier search may have been unlawful, and could have legally tainted the case: The disk image may have been used by U.S. authorities to obtain a provisional arrest warrant for Yastremskiy in California, and it was that warrant that led Turkish authorities to arrest him and seize his laptop.

In a court filing this month, the lawyer is asking (.pdf) for an evidentiary hearing to, among other things, “determine the extent to which the arrests and seizures were causally motivated by the prior sneak-and-peek conducted by the USSS in Dubai.”

Also at issue is the procedure used by Turkish authorities to recover data from the laptop. While U.S. forensics examiners routinely make a bit-for-bit copy of a seized hard drive and leave the original undisturbed, there’s evidence that Turkish police tried to install software on the laptop in order to change the Windows password on the machine. Additionally, access times on some 3,000 files were disturbed. The hard drive broke while in Turkish custody, and was later deemed irreparable by the Secret Service.

… Cronos employee Ivars Tenters imaged the server and gave it to the LVS, who gave it to the Secret Service. About two weeks later, on June 6, U.S. authorities submitted a mutual legal assistance treaty request for the physical server itself, and Tenters disassembled it and passed it to Latvian prosecutors who gave it to U.S. authorities in September.

Palomino points out that the hash value of the Latvian server provided by prosecutors in the New York case is different from the hash value for the same server provided by authorities in the Massachusetts case against Gonzalez. [In other words, something was changed... Bob] He argues that Gonzalez has a right to cross-examine Tenters and the LVS officers about the chain-of-custody of the data and the server.

Palomino says the foreign police were acting as agents of the Secret Service, and thus there should be some Fourth Amendment protection for the searches in Latvia and Turkey, and that foreign authorities should be required to show that they adhered to local legal requirements for searches and seizures as well.

The feds counter (.pdf) that Gonzalez has no Fourth Amendment protection on the server in Latvia, because he’s never acknowledged it belongs to him, [Can the Fed assert it does and still claim he gets no protection? Bob] and the informant gave them the password and permission to search it. Gonzalez also doesn’t have protection for the laptop in Turkey, because it belongs to Yastremskiy, a non-U.S. person.

Just a point for management to consider. The main justification for laptop computers (which are more expensive than desktops of similar capacity) is that they allow employees to take work home. Obviously these computers weren't taken home, so why did you spend the extra (taxpayer) money on laptops?

http://www.databreaches.net/?p=6783

Computers stolen from Cal State L.A.

August 20, 2009 by admin Filed under Breach Incidents, Education Sector, Theft, U.S.

More than a dozen computers have been stolen from California State University, Los Angeles, sparking concerns over possible identity theft.

Officials say on Aug. 1 someone broke a window in the office of the university’s Minority Opportunities in Research program and stole 14 computers, two desktops and 12 laptops.

The computers contain the names, social security numbers and addresses of more than 600 students and faculty members.

Thursday, August 20, 2009

Looks like the media believes the “era of the hacker” has come to an end, all major Identity Theft cases are resolved, and the Feds have demonstrated they can solve any crime – no matter where the perpetrators reside.. I wouldn't bet on it.

You gotta get the publicity while the story's hot. You never know when you might run for office!

http://www.databreaches.net/?p=6776

Gonzalez’s lawyer criticizes federal prosecutors

August 19, 2009 by admin Filed under Breach Incidents, Business Sector, Financial Sector, Hack, Malware

Albert Gonzalez, a suspect in several hacking cases, was close to reaching a comprehensive plea agreement with federal prosecutors in Massachusetts and New York when federal prosecutors in New Jersey indicted him on Monday on a new raft of computer crimes, said Mr. Gonzalez’s lawyer, Rene Palomino Jr.

[...]

Mr. Palomino said the settlement would have ended all active investigations, including New Jersey’s. He charged that New Jersey prosecutors moved up their indictment to short-circuit the settlement talks. “I guess so they could bask in the glory of all the publicity they are getting from this,” he said. [Good guess. Bob]

[...]

Mr. Palomino also shed some light on some mysteries in Monday’s announcement. He said “P.T.,” an unindicted co-conspirator named in the new indictment, was Damon Patrick Toey, one of the 11 people charged last August as part of the data thefts at T.J. Maxx stores, which are owned by TJX. Mr. Toey has pleaded guilty and received a reduced sentence in exchange for cooperation in the government’s case against Mr. Gonzalez.

Mr. Palomino said that he was prepared to argue that Mr. Toey, not Mr. Gonzalez, took the lead in the data thefts in the New Jersey indictment.

He also said that one of the “unnamed Russian conspirators” named in the indictment was Maksym Yastremski, who is currently serving a 30-year sentence in a Turkish prison.

Wednesday, August 19, 2009

Not all Identity Theft is large scale.

http://www.databreaches.net/?p=6738

7-Eleven statement regarding 2007 credit card fraud

August 18, 2009 by admin Filed under Breach Incidents, Business Sector, Hack, Malware, U.S.

7-Eleven, Inc. has learned that federal authorities in New Jersey have indicted individuals for the theft of credit and debit card numbers in a computer hacking scheme targeting multiple retailers in a number of separate incidents over the last several years.

The company became aware in late 2007 that a security breach had occurred. The affected transactions were limited to customers’ use of certain ATMs, owned and operated by a third party, located in 7-Eleven stores over a 12-day period from October 28, 2007, through November 8, 2007. Steps were immediately taken to contain the security breach and prevent any recurrence.

Upon being notified of the breach, the card companies in accordance with their standard fraud response procedures then alerted the issuing financial institutions regarding the security breach. Each financial institution made its own decision about what appropriate actions to take, including the issuance of new cards or putting card numbers on alert for fraud. These remedial measures were taken in late 2007 and early 2008.

7-Eleven would like to thank the federal authorities for their diligence in pursuing the perpetrators of this crime. Because this matter is pending, we are not providing further details.

Is it naive to assume that those with the tools to read email traveling in both directions would limit themselves to incoming mail only?

http://www.pogowasright.org/?p=2935

UK Govt Mail Services operations manager on allegedly illegal mail screening

August 19, 2009 by Dissent Filed under Featured Headlines, Govt, Non-U.S., Surveillance

Which is exactly what the GMS have been doing.

Just a little bit of background information. GMS is the Government Mail Service which are a department within government who protect government employees from terrorist attacks such as mail bombs, razor blades and probably anthrax – but they are only supposed to screen incoming mail to government departments – and therein lies the rub.

According to the Investigatory Powers Tribunal, GMS do not have “RIPA powers” which means if they open outgoing mail from a government agency/department they are actually breaking the law (just the same as Phorm’s WebWise does) as it would be classed as interception.

So imagine the shock for one of our members when he got a reply today from the Crown Prosecution Service which was delayed by an entire week due to being “Screened” [What takes a full week? Bob] by the GMS. Yes you read that correctly – it now seems that GMS are screening outgoing mail from the CPS.

[...]

In order to try and figure out what was going on, I attempted to phone GMS Screening Office only to never have the call answered – so I then phoned the Operations Manager for GMS using the number on their web site. An audio recording of the conversation can be found by clicking on the link below:

Recording of Conversation with GMS Operations Manager (mp3)

Tuesday, August 18, 2009

Even when we start to get answers we find more questions.

http://www.pogowasright.org/?p=2873

Over 130 million stolen: 3 indicted for hacking Heartland, 7-Eleven, Hannaford

August 17, 2009 by Dissent Filed under Breaches, Court, Featured Headlines

An indictment [pdf] was returned today against three individuals who are charged with being responsible for five corporate data breaches, including the single largest reported data breach in U.S. history, announced Acting U.S. Attorney Ralph J. Marra, Jr., along with Assistant Attorney General of the Criminal Division Lanny A. Breuer and United States Secret Service Director Mark Sullivan.

The scheme is believed to constitute the largest hacking and identity theft case ever prosecuted by the U.S. Department of Justice.

The indictment describes a scheme in which more than 130 million credit and debit card numbers together with account information were stolen from Heartland Payment Systems, Inc., based in Princeton, N.J., 7-Eleven, Inc., and Hannaford Brothers Co. In addition, the indictment describes two unidentified corporate victims as being hacked by the coconspirators. [Two more? Should we assume the hacked in but got no data requiring disclosure? I'd think they (whoever they are) would be bragging about that. Bob]

As alleged in the indictment, between October 2006 and May 2008, Albert Gonzalez, 28, of Miami, Fla., acted with two unnamed coconspirators to identify large corporations, often by scanning the list of Fortune 500 companies and exploring corporate websites. Upon identifying a potential victim, Gonzalez and his coconspirators sought to identify vulnerabilities, both by physical observation and by online exploration. For example, according to the Indictment, Gonzalez and an individual identified in the Indictment as “P.T.” would go to the retail locations of their potential victims in an attempt to identify the type of point-of-sale (“checkout”) machines utilized by the victim companies. After reconnaissance of the computer systems was completed, information would be uploaded to servers which served as hacking platforms. These servers, located in New Jersey and around the world, were used by the coconspirators to store information critical to the hacking schemes and to subsequently launch the hacking attacks.

According to the Indictment, the hacking attacks launched against the corporate victims consisted of what is known as a SQL-injection attack, which is an attack that exploits security vulnerabilities in elements of a computer that receives user input. Gonzalez provided some of the malicious software (malware) to his coconspirators, and they added their own as they sought to identify the location of credit and debit card numbers and other valuable data on the corporate victims’ computer systems.

The coconspirators often worked together on a real-time basis, contacting each other by instant messaging as they were improperly accessing the corporate victims’ computer systems, according to the Indictment. Once the target information was discovered, it would be stolen from the corporate victims’ servers and placed onto servers controlled by Gonzalez and the coconspirators. In addition to searching for credit and debit card data on the victims’ computer systems, the Indictment alleges that Gonzalez and the coconspirators installed “sniffers” which conducted real-time interception of credit and debit card data being processed by the corporate victims and subsequently stolen from the corporate victims’ computer servers.

The indictment alleges that Gonzalez and the coconspirators employed numerous techniques to hide their hacking efforts and data breaches. For example, they allegedly accessed the corporate websites only through intermediary, or “proxy,” computers, thereby disguising their own whereabouts. They also tested their malware by using approximately twenty of the leading anti-virus products to determine if any of those products would detect their malware as potentially unwanted. Furthermore, they programmed their malware to actively delete traces of the malware’s presence from the corporate victims’ networks.

Upon stealing the credit and debit card data, Gonzalez and the coconspirators would seek to sell the data to others who would use it to make fraudulent purchases, make unauthorized withdrawals from banks and further identity theft schemes.

… A federal grand jury sitting in Newark, N.J., charged Gonzalez and two individuals identified only as “Hacker 1,” and “Hacker 2,” both in or near Russia, in the two-count Indictment. The first count charges conspiracy to (1) gain unauthorized access to computers, (2) commit fraud in connection with computers, and (3) damage computers. The second count charges conspiracy to commit wire fraud. Each defendant faces a maximum penalty of 5 years in prison on Count One and an additional 30 years on Count Two, for a total of 35 years. In addition, each of the individuals is subject to a maximum fine of $250,000 per Count One, and $1 million per Count Two, or twice the gain resulting from the offense, whichever is greater.

Gonzalez was previously indicted in the Eastern District of New York on May 12, 2008, and the District of Massachusetts on August 5, 2008, for his involvement in different conspiracies relating to data breaches of multiple companies. He was also previously arrested in New Jersey in 2003 for his role in ATM and debit card fraud. Gonzalez is currently detained in the Metropolitan Detention Center in Brooklyn, New York.

… The case is being prosecuted by Assistant U.S. Attorneys Seth Kosto and Erez Liebermann of the U.S. Attorney’s Office Computer Hacking and Intellectual Property Section, [Talk about a cool business card. Does the job come with a cape and secret identity? Bob] part of the Commercial Crimes Unit in Newark, New Jersey, and Senior Counsel Kimberly Kiefer Peretti of the Criminal Division’s Computer Crime & Intellectual Property Section.

Source: U.S. Attorney’s Office, District of New Jersey

(Related) Of course we've seen Mr. Gonzalez before. Is he really that good or are we blaming him for everything just to close the case?

http://www.wired.com/threatlevel/2009/08/tjx-hacker-charged-with-heartland/

TJX Hacker Charged With Heartland, Hannaford Breaches

By Kim Zetter Email Author August 17, 2009 2:34 pm

Impacting the Google and Microsoft “Health Data Sharing” systems. Perhaps they caused the Financial Collapse?

http://www.pogowasright.org/?p=2902

FTC issues Health Breach Notification Rule

August 18, 2009 by Dissent Filed under Breaches, Featured Headlines, Govt

The Federal Trade Commission (“FTC” or “Commission”) is issuing this final rule, as required by the American Recovery and Reinvestment Act of 2009 (the “Recovery Act” or “the Act”). The rule requires vendors of personal health records and related entities to notify consumers when the security of their individually identifiable health information has been breached.

DATES: This rule is effective [insert date 30 days after date of publication in the FEDERAL REGISTER]. Full compliance is required by [insert date 180 days after date of publication in the FEDERAL REGISTER].

The rule can be found on the FTC’s site (pdf, 88 pp.). There will be more coverage of this after everyone has a chance to read through it.

See also the Health Breach Notification form (pdf) and the FTC’s press release.

[From the rule:

A second and related point that many commenters raised was that, to the extent possible, consumers should receive a single notice for a single breach.9 These commenters pointed out that receiving multiple notices for the same breach would confuse consumers and convey an exaggerated sense of risk.1 [...and it would point out how many entities had their data... Bob]

… Finally, many commenters expressed concerns about particular statutory requirements governing breach notification. For example, some commenters stated that entities should be required to provide breach notification for paper, as well as electronic, information;19 others expressed concerns about requiring media notice.20

18 Section 13400(5) of the Recovery Act defines “electronic health record” as an electronic record of health-related information on an individual that is “created, gathered, managed, and consulted by authorized health care clinicians and staff.” In contrast, section 13400(11) defines “personal health record” as an electronic record “on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual.”

(Related?) If this means the FTC will start blogging about Privacy, I'll follow it. More likely, he just gets to explain what a blog is...

http://www.pogowasright.org/?p=2910

FTC hires privacy blogger

August 18, 2009 by Dissent Filed under Govt, Other, U.S.

In yet another sign that the Federal Trade Commission is serious about examining online privacy, Christopher Soghoian said today that he’s accepted a job as technical consultant to the FTC’s Bureau of Consumer Protection, Division of Privacy and Identity Protection. Soghoian, currently with Harvard’s Berkman Center for Internet & Society, is among the most influential researchers today when it comes to online privacy and advertising.

“David Vladeck, the new head of the Bureau of Consumer Protection recently told the New York Times that ‘he would hire technologists to help analyze online marketers’ tracking.’ I guess that means people like me,” Soghoian said on his blog.

Read more on Media Post and on Chris’s blog. This is good news, indeed.

Just call us here at Dial-a-Perp, and we'll provide you with the DNA evidence you need and deserve!

http://www.pogowasright.org/?p=2890

Fighting biological identity theft (updated)

August 17, 2009 by Dissent Filed under Featured Headlines, Other

Fascinating stuff: Elon Ganor is now working in the field of biotechnology with a new Israeli startup, Nucleix, a firm that is devoted to foiling biological identity theft.

Nucleix’s technology is designed to answer a new problem that has arisen where medicine and law meet: biological identity theft. That refers to the ability to build, in laboratory conditions, synthesized DNA based on the real DNA of a person. Other people could use that fabricated DNA to create the appearance of guilt where none exists, for example by disseminating it at crime scenes.

[...]

The startup’s expertise lies in differentiating between artificial DNA and the real genetic code of the actual person. Until now there has been no technology capable of distinguishing between genetic profiles obtained from faked DNA and real biological profiles, it says.

Centennial Man

Saturday, August 22, 2009

Friday, August 21, 2009

Thursday, August 20, 2009

Wednesday, August 19, 2009

Tuesday, August 18, 2009

Search This Blog

Followers

Blog Archive

Links

About Me