Centennial Man: 2009-11-22

Saturday, November 28, 2009

It's not altruism, there's a good bit of (justifiable) paranoia here. What should citizens have a “Right” to and what just makes it easier for the government to identify and control them?

http://thenextweb.com/europe/2009/11/28/turkey-give-70-million-citizens-email-address-search-engine/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+thenextwebeurope+%28The+Next+Web+Europe%29

Turkey wants to give each of its 70 million citizens an email address (and a search engine too.)

By Zee on November 28, 2009

Turkey’s Informational Technology Watchdog today announced its intentions to allocate an e-mail address to each of its 70 million citizens.

The project, called Anaposta, has reportedly already been developed and tested and will allocate a 10GB storage quota to its entire population, with ambitions to build an email network to match its current mobile network.

“Every child will have an email address written on his/her identity card since birth” said Tayfun Acarer, chairman of Turkey’s Information Technologies and Communications Authority Board.

The network would also replace foreign mail networks such as Yahoo, Gmail and Hotmail in Turkey, Acarer was quoted as saying.

… “All major search engines used worldwide are based in foreign countries, which can not meet Turkey’s needs and could bring security problems,” said Tayfun Acarer, chairman of Turkey’s Information Technologies and Communications Authority Board.

Comments on net neutrality irk AT& T

White House official links the issue to censorship in China

By Cecilia Kang Washington Post Staff Writer Wednesday, November 25, 2009

… In an entry published on the Post Tech Blog and in comments at a telecom policy conference last week, McLaughlin compared censorship in China -- where President Obama's recent comments on open Internet values were blocked from Chinese Web sites -- to the need for net neutrality rules so as to prevent corporations from acting as gatekeepers of information and speech.

"If it bothers you that the China government does it, it should bother you when your cable company does it," McLaughlin said at the policy conference. The administration has made net neutrality a cornerstone of its technology agenda.

Maybe MG got it right. If so, how do we use this information to get rich?

http://www.techcrunch.com/2009/11/27/internet-twitter-tiger-woods/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

This Is Why The Internet (And Twitter) Wins

by MG Siegler on November 27, 2009

Undoubtedly by now you’ve heard about Tiger Woods’ car crash. Early reports had him in serious condition (which remember, is better than critical condition) after he apparently hit a fire hydrant and a tree while leaving his home in his SUV. The latest reports say he has been released from the hospital and is “fine.” But I’m not going to speak to any of that because that’s not what we do (you can find out more here).

Instead, as I’m watching this unfold infront of my eyes on the Internet, I’m reminded that this type of story is exactly why the web is destroying newspapers, and should eventually even take down television and the main source of news for most people. I first heard the news via a BNOnews bulletin sent via push notification to my iPhone. I immediately pulled up Twitter and already some 10-15 people had retweeted it and the news was appearing in my stream.

… Information wants to be free, and the web, with services like Twitter, provides the easiest way for that to happen. [Free as in not restrained, not free as in no cost. Bob]

Google was almost as fast on the case, as some 10 minutes after the tweets were flowing, it started showing reports from local Orlando news outlets (where the crash occurred) giving details of the crash. Within 15 minutes, we knew what time the crash occurred at, apparently what happened, and some other important details (like no alcohol being involved).

Not just for math teachers. Take a look at how it returns simple facts...

http://www.makeuseof.com/tag/the-true-power-of-the-wolfram-alpha-knowledge-engine/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Makeuseof+%28MakeUseOf.com%29

The True Power of the Wolfram Alpha Knowledge Engine

Nov. 27th, 2009 By Simon Slangen

… Wolfram Alpha shows us the future of search engines. And we’re now one step closer to a computer taking over the world.

For my Computer Security students

http://www.makeuseof.com/tag/how-to-mask-yourself-online-use-a-fake-ip-address/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Makeuseof+%28MakeUseOf.com%29

How To Mask Yourself Online & Use a Fake IP Address

Nov. 27th, 2009 By Jack Cola

I don't teach Criminal Justice, but Technology is our name.

http://games.slashdot.org/story/09/11/27/2334220/3D-Video-Game-Collaboration-Used-To-Solve-Crimes?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

3D Video Game Collaboration Used To Solve Crimes

Posted by Soulskill on Friday November 27, @08:14PM from the world-of-csi-craft dept.

eldavojohn writes

"Reuters explains how the National Science Foundation's Cyber-Enabled Discovery and Innovation (CDI) program is funding research used to implement real life crimes in a CSI-like game. They will use IC-CRIME's laser scanner technology and the Unity platform (which recently enjoyed the release of a freeware version) to recreate the crime scene as closely as possible. The crime scene will then be hosted for multiple remote crime scene investigators to explore concurrently while discussing what they see, sharing their data and experience as well as learning and asking questions."

Friday, November 27, 2009

This breach continues to grow. Absent mandatory disclosure laws, it's not easy to piece together a clear picture of what happened.

http://www.databreaches.net/?p=8553

Spanish breach causes “largest bank-card security breach in Czech history”

November 26, 2009 by admin Filed under Breach Incidents, Financial Sector, ID Theft, Non-U.S., Of Note

Stephan Delbos reports:

Clients of four major Czech banks could find their accounts blocked at their next visit to the ATM as a result of the largest bank-card security breach in Czech history. [Did they even have credit cards under communism? Bob]

ČSOB, Raiffeisenbank, Česká spořitelna and Volksbank CZ have begun blocking thousands of bank cards for customers who made transactions in Spain in spring and summer this year after it was reported that fraudsters had stolen information necessary to access these accounts, including account numbers and pin codes. Approximately 100,000 accounts in the Czech Republic could be affected by the blockages, according to the Bank Card Association.

“In the spring and summer months this year in Spain, there was a relatively extensive data leakage concerning payment cards, probably from a system processor such as an ATM,” said Roman Kotlán of the Czech Bank Card Association. “There have been reports of the misuse of stolen data to manufacture counterfeits and make payments to merchants in different parts of the world.”

Thursday, November 26, 2009

Looks like this one is a much larger can of worms than I thought.

http://www.databreaches.net/?p=8475

Risky business: Remote Desktop opened the door for Aloha hackers

November 25, 2009 by admin Filed under Breach Incidents, Business Sector, Hack, Of Note, U.S.

When nine restaurants in Louisiana and Mississippi filed lawsuits against Radiant Systems and its Louisiana distributor, they may have represented only the tip of a substantial iceberg of hacks affecting restaurants that used Radiant Systems’ Aloha POS system. It seems that the scope of the problem is first coming to the public’s attention approximately one and a half years after the hacking incidents started. [Yesterday's article mentioned a three year period. Bob]

Breaches in Other Parts of the Country

During a two-month period in late 2008, a Spicy Pickle franchise in Michigan was hacked and 150 customers’ card data were stolen and misused. The franchise closed in June 2009, reportedly unable to recover from the loss of customer confidence after the breach. At around the same time in 2008, Ted’s Cafe Escondido in Oklahoma also reported being hacked. Although both breaches were reported at the time on PogoWasRight.org, the POS system they were using was not reported in the media. Unbeknownst to me at the time, a forum member on FoodService.com commented on both breaches by noting both restaurants used the Aloha system. There was no indication in the forum member’s report, however, as to whether the restaurants had removed any remote access software that was suspected of creating the vulnerability to hacks or whether the restaurants had used commercial grade firewalls.

Hacks Started in Early 2008

Also flying completely under my radar at the time, in December 2008, WKZO News reported this about the Spicy Pickle hack:

Co-owner Terry Henderson says the FBI’s been investigating fraud cases across the country for seven months and they were just the latest victims. [Do the warn anyone? Bob]

“There’s a similar thread to all of it and it keeps leading to one particular software manufacturer,” says Henderson, adding that he’s not at liberty to say which manufacturer that is. [Some kind of gag order? Bob] “It’s a popular software that’s used by thousands of restaurants throughout the country.”

Continuing to work backwards to see what else I had missed, I found that in August 2008, WAFB and the Associated Press had reported that a rash of hacks involving Louisiana restaurants began in March 2008. And although Aloha’s name did not appear in any media reports on affected restaurants, when the Secret Service met with Louisiana restauranteurs in August 2008, they may have specifically mentioned the Aloha system. Another poster on the FoodServices.com forum wrote on August 19, 2008:

I spoke to someone who attended the meeting outlined in the Associated Press article. The meeting was set up by the Lousiana (sic) Restaurant Association and was attended by the Secret Service agent on the case, a US Attorney and a represtative (sic) from Visa. During the meeting it was presented that the 15 breaches occured (sic) were all Aloha POS systems. It was stated that he hackers were able to breach the systems as the Remote support software were all using the same User Name and Password (this is against PCI requirements). The hackers installed a “sniffer” program that would capture credit card data on the Local LAN (ie private network).

So it seems as if suspicions about Aloha were being raised over a year ago but were not specifically mentioned in media coverage.

Radiant’s Response

In August 2008, within days of the Secret Service and Visa representatives meeting with Louisiana restauranteurs, Aloha sent a data security alert to its customers. The alert said, in part:

Radiant Systems has been working with Visa on an emerging issue that could cause POS systems to be compromised. The specific vulnerability is related to Remote Desktop being enabled on BOH servers, POS terminals, and routers, which may allow intruders to gain access to POS systems. Once intruders gain access they could install malware such as packet sniffers to capture card holder data. Remote access to POS systems is critical to supporting sites, but can also provide a method for unauthorized users to obtain access to systems and potentially sensitive credit card data. Configuring and managing access to POS systems is extremely important.

The alert then provided specific steps Aloha clients should take to configure their systems securely including:

Disable Remote Desktop on routers, BOH servers, and POS terminals, if this remote access tool is not used to support the site.
Use Command Center as the single means of remote access for Aloha POS systems to ensure the highest level of site security. Command Center has a number of inherent features that significantly increase your ability to support sites, and also significantly decrease the risks associated with accessing sites.

Alternative measures were described for those who chose to leave remote access tools enabled.

Their alert may well have prevented more restaurants from being hacked, but may be small comfort to the allegedly many restaurants who had already suffered hacks resulting in lost business, fines by Visa and Mastercard, and the cost of forensic audits and IT consultants. Whether the juries will agree with the restaurant-plaintiffs or with Radiant Systems remains to be seen, but it would seem that some jurors are in for a real earful on security. [Anyone need an expert? Bob]

Some interesting “statistics” for those who lose hard drives...

http://www.databreaches.net/?p=8511

Update: BCBS of Tennessee to start sending notifications

November 25, 2009 by admin Filed under Breach Incidents, Healthcare Sector, Theft

John Commins updates us on the Tennessee BlueCross BlueShield breach:

BlueCross BlueShield of Tennessee is readying a Nov. 30 mass mailing to some of its 3.1 million customers in the Volunteer State who may have had their Social Security numbers and other private data compromised after an Oct. 2 hard drive theft at a remote training facility in Chattanooga.

“It’s going to be a progression of mailings, with those who would be most at risk receiving the first mailings, depending upon how many people had a Social Security number compromised,” says BCBST spokeswoman Mary Thompson.

[...]

Meanwhile, local, state, and federal law enforcement officials have been called in to investigate the Oct. 2 theft of three 3.5″ X 10″ hard drives, which were physically removed from server racks on computers inside a data storage closet at a training center located in a strip mall. [Not your typical “grab the laptop and run” – sounds like they knew what they wanted. Bob]

“We were using the information on those drives for training purposes. [Training with live data? Very inefficient. Bob] We were auditing [Wait! We weren't training, we were auditing. Bob] our [customer service representatives] to ensure that they were delivering the correct information and servicing providers correctly and using it for training [Wait! No, yes, were were using it to train after all. Bob] of new CSRs,” Thompson says.

[...]

In the past several weeks, Thompson says BCBST has had as many as 800 people—including employees from a private security company—working at any given time on the arduous task of analyzing more than 300,000 screen shots and about 50,000 hours of audio data to identify potential breaches.

Wednesday, November 25, 2009

The joy spreads. Perhaps companies (their lawyers?) are realizing that “compliant” does not mean “secure.” In any case (no pun intended), suits like these could further swamp the courts.

http://www.databreaches.net/?p=8408

Radiant Systems and Computer World responsible for breach affecting restaurants – lawsuit

November 24, 2009 by admin Filed under Breach Incidents, Hack, ID Theft, Of Note, U.S.

There’s been a lot of coverage of the lawsuits against Heartland Payment Systems, a payment processor fined by both Visa and Mastercard for not being PCI-DSS compliant. Now a class-action lawsuit by seven restaurants claims that dozens of restaurants may have become victims of card fraud because systems provided to the restaurants by Radiant Systems and its Louisiana distributor, Computer World Inc., were not PCI-DSS compliant.

According to a statement provided to DataBreaches.net by Charles Hoff of the Law Offices of Charles Y. Hoff, PC, general counsel for the Georgia Restaurant Association and one of the attorneys acting as a legal advisor to the restaurants in the lawsuit, the plaintiffs “do not have any exact numbers from the Secret Service but have been told that it is believed that dozens of restaurants as well as some hotels were victims of security breaches.”

Seven restaurants in Louisiana and Mississippi are named as plaintiffs in the lawsuit, including a Best Western, Mel’s Diner, Sammy’s Grill, Crawfish Town USA, Jone’s Creek Cafe, Don’s Seafood, and Picante’s Mexican Grill. In a separate, but related lawsuit, On the Half Shell and Boudreaux’s and Thibodeaux’s, sued Radiant Systems and Computer World in April.

Keith Bond, owner of Mel’s Diner in Broussard, Louisiana says that he purchased the “Aloha” system in 2007. In the spring of 2008, one of the restaurant’s servers noticed a problem that the mouse seemed to be moving around out of their control. According to Bond, they called Computer World, who told them to disconnect their internet connection and that they would send someone out the next day. When the service tech examined the system, he reportedly removed and replaced the hard drive, but was “vague” about what was wrong with the system, reassuring them that the problem was now resolved. Less than one month later, the restaurant received letters from Visa and Mastercard that they had been breached, were being fined, and were required to arrange for a forensic audit with an approved auditor. According to Bond, Visa fined them $5,000 and debited the money from their account immediately. Mastercard fined them $100,000 but waived the fine. [Visa fined the restaurant? First time I've heard that. Bob]

Bond says that 669 of his customers were affected by the breach, although he never heard any complaints [“No illegal use of this data has been reported.” Bob] from any of them and only knew of the breach because of Visa and Mastercard contacting him. Other restaurants involved in the lawsuit were reportedly not as lucky. Bond says that Sammy’s Grill had 45,000 customers whose cards were compromised over a three-year period, and that he knows of 19 businesses who had similar breaches while using the Aloha system. He suspects that there are many more restaurants who also experienced breaches of a similar nature.

In a press release from the plaintiffs, Radiant Systems and Computer World Inc., are accused of having directly contributed to the breach by providing products that were not PCI-DSS compliant. [If they were certified compliant, do they automatically win the lawsuit? Bob]

1) Restaurants were sold earlier model POS systems although they were represented to be new models;
2) Computer World used a remote access system that did not have adequate security patches – a violation of PCI-DSS standards;
3) Computer World used the same password for at least 200 operators in violation of PCI standards;
4) The distributor failed to remove prior sensitive customer credit data upon installation of Radiant POS systems, again in violation of PCI standards.

Bond claims that in his case, when Secure Metrics performed the forensic audit, they discovered that the system had previously been installed as Sorano’s Salsa Company’s system. It’s not clear whether any personal or financial data were still accessible, but it was clear that the system was not new. Bond says that pcAnywhere came installed on his system so that Computer World could remotely access the system to service it. But as with every Computer World installation for every Aloha customer, Computer World allegedly used the default password, and all 200 installations used the same password, “computer.” According to Bond, the Secret Service discovered that a Romanian hacker had accessed all of the computers using the system and common password and installed keyloggers to capture the card data.

The plaintiffs also claim that “Radiant and Computer World were warned by Visa in 2007 that their programs were non-compliant, but the restaurants were unaware of these warnings at the time they purchased the Aloha system.”

The plaintiffs are seeking damages to cover all of the expenses they incurred.

Both Radiant Systems and Computer World were contacted for a response to the press release issued yesterday by the plaintiffs. C. York Craig, III, of the law firm representing Computer World, Forman Perry Watkins Krutz & Tardy LLP, sent the following statement:

Computer World, through its New Orleans attorney, Joseph B. Morton, III of Forman Perry Watkins Krutz & Tardy LLP, denied the assertions of the plaintiffs. Morton stated, “We prefer to handle these matters in the proper forum. Computer World is confident that when all of the evidence is examined in a court of law, it will be established that Computer World fulfilled its contractual obligations, appropriately installed/monitored the POS hardware and software, complied with all government requirements and was very responsive to the needs of its clients.”

As of the time of this posting, Radiant Systems did not reply to DataBreaches.net’s inquiry. Bond says that a motion by Radiant Systems to break up the class action lawsuit was dismissed by a judge yesterday, and that the lawsuit has been allowed to go forward as a class-action lawsuit.

Bond informs DataBreaches.net that as a result of the breach, another one of the plaintiffs gave up on using credit cards altogether rather than incur the costs of a forensic audit and fines by Visa and Mastercard. [Good for them! Bob] As for Bond himself, after incurring $19,000 in forensic audit fees, several thousand dollars in fees for an IT consultant to implement the auditor’s recommendations, $20,000 in chargebacks, attorney fees, miscellaneous fees, and $5,000 in fines from Visa, Mel’s Diner has gone back to using dial-up.

When you know (not just suspect, know) someone has hacked your system, shouldn't your review be AT LEAST as through as a “routine” review?

http://www.databreaches.net/?p=8451

Cobra.com hack exposed customer card data for 9,000

November 24, 2009 by admin Filed under Breach Incidents

Almost five months after a security breach was first discovered, lawyers for Cobra Electronics Corporation notified the New Hampshire Attorney General’s Office that its web site at www.cobra.com had been hacked and customer card data might have been accessed.

According to the letter from David E. Teitelbaum of Sidley Austin, Cobra was alerted to a problem on June 14. Subsequent investigation determined that the server had been hacked on June 14. The site was totally offline from June 23 until July 3 while the company addressed the security issues. But according to the notification:

Although the intruder apparently used the Cobra.com site to attempt to download malicious software to customer computers, Cobra did not believe at the time that the intruder had access to any Cobra files containing personally identifiable information, such as cardholder information.

During a routine security review in late September, [Apparently their “Incident Review” did not rise to the level of a “routine” review, even thought they knew they had been hacked.! Really poor management! Bob] however, the company realized that there were unencrypted card numbers in archival files on the server at the time of the intrusion. A subsequent forensic examination concluded that there was no access to the data between June 16 and October 2, but the examiners were unable to determine if there had been any access between June 14 and June 16 because the web host could not provide the relevant hard drives. [What caused them to destroy evidence? Bob] As a result, Cobra decided to notify 9,000 customers whose unencrypted card numbers were on the server at the time of the intrusion or whose unencrypted card numbers were entered after the intruder was shut out but before all data on the server were fully encrypted. The notifications include all customers who made purchases via the web site between November 18, 2007 and September 30, 2009.

Cobra offered affected customers free credit monitoring services and created an FAQ on the breach at http://www.cobra.com/creditcardquestions

Even criminals can learn to be more efficient.

http://www.databreaches.net/?p=8456

The Year Of The Mega Data Breach

November 24, 2009 by admin Filed under Commentaries and Analyses, Of Note

Andy Greenberg reports:

Glance at 2009’s data breach statistics, and you might think the IT world had scored a rare win in the endless struggle against cybercrime.

According to the Identity Theft Resource Center, government agencies and businesses reported 435 breaches as of Nov. 17, on track to show a 50% drop from the number of breaches reported in 2008. That would make 2009 the first year that the number of reported data breaches has dropped since 2005, when the ITRC started counting.

But the decrease in data breaches is deceptive. In fact, the number of personal records that were exposed–data like Social Security numbers, medical records and credit card information tied to an individual–that hackers exposed has skyrocketed to 220 million records so far this year, compared with 35 million in 2008. That represents the largest collection of lost data on record. And the majority of 2009’s data loss stems from a single source: credit card processing firm Heartland Payment Systems.

Tuesday, November 24, 2009

Try and save a few bucks by sewing your own tuxedo... Interesting that several stores recently replaced their credit card machines. Sounds like the crooks traveled around pretending to be from the card processor(?) and replaced the processor's machines with their own.

http://www.databreaches.net/?p=8394

Multi-state debit card fraud linked to Hancock Fabrics – police

November 23, 2009 by admin Filed under Business Sector, ID Theft, Of Note, U.S.

Linda McGlasson reports:

Bank customers in California, Wisconsin and Missouri are reporting fraudulent ATM withdrawals that police say are tied to transactions conducted with the Hancock Fabrics retail chain.

In California, Napa Police Department spokesman Brian McGovern says 60 residents reported their cards being used by thieves….. At about the same time, as many as 70 Wisconsin victims reported suspicious ATM withdrawals from their accounts, according to Wood and Portage county law enforcement, which also ties the thefts to machines in Hancock Fabrics stores…. And in Missouri, at least 10 customers at Hancock Fabrics in the St. Louis area reported their debit card numbers and pin numbers stolen during the week of November 9.

Centennial Man

Saturday, November 28, 2009

Friday, November 27, 2009

Thursday, November 26, 2009

Wednesday, November 25, 2009

Tuesday, November 24, 2009

Search This Blog

Followers

Blog Archive

Links

About Me