Always strive to learn something useful. --Sophocles

Last month, Amazon lost control of 256 IP addresses for three hours due to BGP security flaws. This enabled cybercrooks to take over credentialing authentication and steal $234,000 in cryptocurrency from an exchange called Celer Bridge. 32 accounts were victimized.

https://arstechnica.com/information-technology/2022/09/how-3-hours-of-inaction-from-amazon-cost-cryptocurrency-holders-235000/


In the UK, three men were arrested after a community resident reported suspicious activity. Found in their car was a fake police uniform, an imitation firearm, a real taser and baseball bat. Their intent: "...pay a surprise visit to a 19-year-old hacker known by the handles “Discoli,” “Disco Dog,” and “Chinese.” In December 2020, Discoli took credit for hacking and leaking the user database for OGUsers, a forum overrun with people looking to buy, sell and trade access to compromised social media accounts."

Discoli happened to be not at home, and the thugs were so obvious about not being police that they fled and got the real police notified.

Impersonating police and that fake firearm is really going to ratchet up the sentencing.

https://krebsonsecurity.com/2022/09/botched-crypto-mugging-lands-three-u-k-men-in-jail/


"A Florida teenager who served as a lackey for a cybercriminal group that specializes in cryptocurrency thefts was beaten and kidnapped last week by a rival cybercrime gang. The teen’s captives held guns to his head while forcing him to record a video message pleading with his crew to fork over a $200,000 ransom in exchange for his life. The youth is now reportedly cooperating with U.S. federal investigators, who are responding to an alarming number of reports of physical violence tied to certain online crime communities."

Kidnapped, beaten, and forced to record a video begging for $200,000 with two pistols pressed against his head. Florida.

https://krebsonsecurity.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/

What I really hate is the inconvenience for you and me. We have to worry - 'Hey, I ate at that place six months ago!' We have to compulsively check out accounts, we have to decide whether or not to do the credit monitoring (major PITB, especially if your credit history is damaged with incorrect information like mine), we have to go through the hassle of getting our cards cancelled and not being usable until replacements arrive.

The banks really don't care as long as the cash flows. THREE MILLION CREDIT CARDS. One of the security companies brought in to investigate and mitigate the situation said "I never thought in 2005 (or maybe he said 2015) that in 2020 I'd still be seeing magnetic stripe compromises."

But hey - we're the USA! WE'RE NUMBER ONE! In stolen credit cards.

There was nothing preventing these machines from being replaced when we had a booming economy, except MasterCard and Visa didn't push for it. Because? The gasoline retail industry didn't want to have to pay to upgrade all of those gas pumps.

THREE MILLION CREDIT CARDS.

I don't bother to post about a lot of credit card thefts because it just happens so damn often. It's only when there's several million cards or someone outrageously famous that gets clobbered. And now MC/V won't push for replacement terminals - or just fund it themselves - because the economy is going to be in the toilet for several more years to come and merchants won't be able to afford it. Which means there will be more of these thefts in the next 5-10 years.


I've had my banking information compromised precisely ONCE. And it wasn't by one of these credit card thefts. It was 10-11 years ago, I was in Phoenix for a couple of days before going to Las Vegas for a convention, I was checking my bank balance and found a charge for a gas station in one of the Carolinas for $85. I hadn't been there in something like 5 years, it was definitely hinky. Called the bank, they confirmed it was fraud and turned off my debit card.

But it wasn't a card or card processor that got hacked. It was a check processing facility that somehow got ahold of my account information. I have no idea how that happened.

My wife and I have had numerous card replacements, but have never had a dime misplaced. Several friends have been victimized, one lost money from the Target hack before it became public!

It's just so bloody frustrating. It could have been put to an end years ago, but Visa and Mastercard didn't do it. And it's just going to go on and on and on.


Oh, speaking of data breaches: you heard Barnes and Noble got clobbered, didn't you? Someone got in and made off with a bunch of info. "But no customer credit card information was stolen." Yeah, we'll see if that statement rings true in another month or so.


Sorry, I'm just in a bit of a pissy mood. Multiple government administrations have not made the industry fix things. The industry hasn't fixed things. So nothing gets fixed. And it will continue this way while the rest of the world looks on in wonder at yet another weird thing that Americans do.

And Disney+ is not yet a week old.

In many cases, the account compromises happened because people frequently re-use passwords, so all the criminals needed to do was to take one of the well-known password dumps and test it against Disney+ until it hit, then change the password and lock the true owner out of the system.

But there are documented cases of people using unique passwords who are getting their accounts taken away by these thieves.

So the question is: has Disney's system already been hacked? There's also the possibility that a number of people have their computers infected with malware such as keyloggers and their accounts were compromised through that vector.

Here's a simple rule to follow: any web site or service that has your credit card or banking information SHOULD HAVE A UNIQUE AND STRONG PASSWORD. Re-using passwords is fine - I do it all the time - for sites that have zero monetary value. But if my banking information is tied to a site, it has a strong and unique password associated to it.

https://www.zdnet.com/article/thousands-of-hacked-disney-accounts-are-already-for-sale-on-hacking-forums/

It is indeed a doozy, perhaps the largest data privacy leak in history. Equifax has been collecting information on people for decades, and they do it without our express permission. But at the same time, they are used for credit scores and to generate bank decisions for our getting loans and such. Yet I never signed a contract with Equifax allowing them to collect information on me.

And they have, through zero fault of my own, personally screwed me over.

A couple of years ago my wife and I decided to shop car insurance. Our current insurer was doing some corporate shenanigans that we didn't care for, and it should have been possible to shave some bucks off our premiums, and it never hurts to shop. I called the car club AAA, we ran through my information, and they told me that they couldn't take me because I had three accidents on my record. I'm accident-free. Equifax had taken three accidents OF MY FATHER, whose name is Andrew Donald, and put them on my record, where my name is Donald Wayne. We lived at the same address some years back, but I was living in New Mexico at the time of the accidents and have never owned a Buick. As it happens, we were born in the same month, but not on the day and clearly not in the same year. No two digits in our birth date or year are the same. There's no reason to conflate us and put the accidents on to my record, except for pure sloppy processes.

So I have a pretty poor opinion of these credit bureaus.

What happened to Equifax is pretty simple. They built their data framework on an open source software package called Apache Struts. Like virtually all software packages, bugs are found and patches are issued. A particularly big problem with Struts was first patched in March, but the intruders were in Equifax's system from mid-March through July - approx 2.5 months. Thus it is perfectly reasonable for Equifax to blame open source software for its breach. [sarcasm off] Struts is a framework for Java programs to run either on servers or web browsers, and after updating the framework you have to recompile literally hundreds of programs, and doing that would be a tremendous PITA, but it MUST be done, otherwise shit like this happens. Apparently some management at Equifax didn't like to pay overtime, and now they have to cope with a tremendous amount of shit.

In some late-breaking news from this afternoon, Equifax's Chief Information Officer and Chief Security Officer are both "retiring", proving that for once, shit started at the top. In "there is occasionally some justice, or perhaps there will be" news, the Federal Trade Commission is investigating the breech. It will be interesting to find out what they learn, assuming they ever issue a report. I wonder if Congress will hold public hearings. The breech is being compared by some news agencies to Enron. According to the Reuter's story, "Shares of Equifax fell 2.4 percent on Thursday and trading volume hit a record high. The shares have lost 32 percent since the company disclosed the hack on Sept. 7.

Senate Democratic leader Chuck Schumer compared Equifax to Enron, the U.S. energy company that filed for bankruptcy in 2001 after revelations of a widespread accounting fraud."

But you see, this is not just a problem for people in the USA. Equifax holds information for people in Canada and Mexico. And Argentine, and possibly other Latin American countries. And the BBC is reporting that 400,000 UKians have information that was compromised in the theft, but their information exposure was minimal and should not lead to identity theft. Well, we'll see about that! In Argentine, apparently Equifax's software used the highly-[in]secure account/password combination of admin/admin.

This is one of my favorite stories, and it may be behind a paywall since it's from the Wall Street Journal. Here's the Slashdot summary:

Equifax was lobbying lawmakers and federal agencies to ease up on regulation of credit-reporting companies in the months before its massive data breach. Equifax spent at least $500,000 on lobbying Congress and federal regulators in the first half of 2017, according to its congressional lobbying-disclosure reports. Among the issues on which it lobbied was limiting the legal liability of credit-reporting companies. That issue is the subject of a bill that a panel of the House Financial Services Committee, which oversees the industry, discussed the same day Equifax disclosed the cyberattack that exposed personal financial data of as many as 143 million Americans. Equifax has also lobbied Congress and regulatory agencies on issues around "data security and breach notification" and "cybersecurity threat information sharing," according to its lobbying disclosures. The amount Equifax spent in the first half of this year appears to be in line with previous spending. In 2016 and 2015, the company's reports show it spent $1.1 million and $1.02 million, respectively, on lobbying activities. While the company had broadly similar lobbying issues in those years, the liability matter was new in 2017.

The title of the story is "Equifax Lobbied for Easier Regulation Before Data Breach", it's by Michael Rapoport and AnnaMaria Andriotis. f you do a little searching, you might be able to find a copy.

Now, the breech itself is extremely bad. If you were compromised, and there's a very good chance that you were, then the information that was stolen includes: your full name, social security number, previous addresses, list of jobs, all sorts of amazing things. Information about you that never changes. Information about you that you use to apply for credit cards, loans, mortgages, JOBS. The best thing you can do is to approach all four credit bureaus and put a FREEZE, not monitor, but FREEZE your credit. That means that no credit can be taken out in your name without postal correspondence going back and forth with your house. No credit reports can be pulled. It's about the best that you can do. Brian Krebs has an excellent post that he has to pull out a few times every year to discuss this. Definitely worth a read. Me? I'm unemployed. Banks would have to be idiots to issue credit under my information, still, I plan on freezing my accounts.

But that's not the worst.

For reasons unknown, Equifax had credit card transaction information, 200,000 transactions worth dating back to last November, sitting on their servers, apparently unencrypted. Massive violation of PCI compliance rules.

And who knows, there may be more yet to come.

I won't bother providing links to the stories about your surrendering your right to sue if you signed up for their monitoring service, that's been rescinded. There were at least two class-action law suits in development, along with a couple of States Attorneys General beginning investigation.

One more thing to mention: an op ed piece by Bruce Schneier, a very well-known and respected expert on encryption and privacy. He has some facts wrong, I think he wasn't as well-versed on the scope of the breech as perhaps he should have been when he wrote it. But at the beginning of the piece he talks about how the public are not customers of Equifax, we are what is being sold, and we have no say in the matter. And there are THOUSANDS of data brokers out there that we can't come close to naming all of them.

Equifax's feet will be in the fire for some time, I imagine.

Needless to say, it hasn't stopped while I haven't written about it.

The latest victims, and I mean corporations, are Arby's fast food (I hesitate to call them a restaurant) and Holiday Inn hotels. Arby's says the malware that stole credit cards was limited to their corporate stores, over a thousand locations of their 3,300 locations in the United States. Of course it's entirely possible that some of their franchisees have been compromised, especially if there are big corps with many locations that use a third-party credit card processing solution.

And it is a BIG breach. The president and CEO of the National Association of Federal Credit Unions is saying the number of cards is in the "hundreds of thousands". So that malware, since remediated, has been sitting there for a while. Arby's did not previously announce the hack at the request of the FBI while they were still investigating it.

Someone posted a comment/question asking if a specific location was compromised, I posted this reply:
Call them and ask them if they're a corporate store or a franchisee. If the former, then probably yes. I'm going to be doing that Monday with my semi-local store. Regardless, watch your bank account online for probe charges: a charge for $1-4 from cities and businesses that you don't do business in/with.

A friend of mine was hit by the Wendy's hack. He's on the road a lot and I told him about the probe charges. Sure enough, they appeared on his credit card. Fortunately when the serious charge appeared, he was in a town that had an office for his credit card and he was able to get a replacement sent there.

https://krebsonsecurity.com/2017/02/fast-food-chain-arbys-acknowledges-breach/


The Holiday Inn hack was very specific, it targeted just a few hotel restaurants and bars in high-profile and high-dollar areas in San Francisco, San Jose, Chicago, etc. The malware was present from August to December 2016. It was not found on the hotel's front desk systems.

https://krebsonsecurity.com/2017/02/intercontinental-confirms-breach-at-12-hotels/

Back in June, many news sources reported that OPM got hacked and basically if you applied for a job with the Federal government in the last 20 years, your information was compromised.  Didn't matter if you were a park ranger or an office admin or what, you were compromised.  A more recent revelation is that fingerprint scans were also compromised.  Bruce Schneier has a recent post about this and the risk of trusting centralized, networked, databases with our information.

Now for a slight diversion.

Salon had a recent article about how a certain KGB agent was amazing at correctly identifying CIA agents in foreign countries.  He applied basic common sense and deduced certain patterns: CIA agents when they were undercover at an embassy always had offices in the secure part of the embassy, always took over the apartment that their predecessor had, did not attend certain functions, when they had meetings out of town they were almost always at night during certain hours.  But the most important tell of all is that their biographies had gaps.  A non-spy in the State Department had a complete and easily verified biography.  Spies did not, theirs had gaps.

Back to the OPM hack.

Two days ago, several news sources reported that the CIA was pulling their agents out of China.  The OPM hack compromised the full information of over 20,000,000 Federal employees, including CIA agents.  China is believed responsible for this hack, so they have all this information.  And basically the CIA knows that China now knows all its agents and has the fingerprints for most of them.

If you know who works for the State Department, and you know "Bob" came in to the country allegedly working for State yet he is not on the list of known State employees, he's probably a spy.  So the CIA pulled them before they could get caught or in trouble.

If China really wanted to screw with us, they'd shop that list around and sell it to Russia, North Korea, etc.


In other glorious news, Experian was hacked again.  This time a specific server or dataset was compromised, and it belonged to the cell phone carrier T-Mobile.  If you applied for a T-Mobile line from September '13 to September '16, the following info was compromised: "Social Security numbers, dates of birth and home addresses."  But that's only for 15,000,000 people, so no worries.

It is important to remember that it was not T-Mobile that was hacked, it wsa the credit reporting agency/data aggregator Experian that was hacked.  When you applied for cell service, you fill out an application and it's run through Experian to determine if your credit is sufficient to pay for a contract.  Common sense would say that after the credit is approved or denied, a summary should be passed on to T-Mobile, a notation made on the person's credit report, and the application should be purged.  But apparently that wasn't good enough for Experian and they decided that they needed to keep the actual application.

Oh, well.

October 1 is the deadline for merchants to be switched over to the new readers in the USA, otherwise they can be liable for any theft that takes place. But what is utterly ridiculous is that THEY DID A HALF-ASSED IMPLEMENTATION OVER HERE. No, correct that, quarter-assed. They would have to improve their implementation to be half-assed. THEY DO NOT REQUIRE A PIN! So if someone lifts your wallet and you have an EMV card, they can spend their way to heaven until you cancel the card.

I am curious how European cards, which have PINs, will work over here. Likewise, I wonder how our PINless EMV cards would work in Europe.

For $10-$27 a card, you can get a new (stolen) credit card for a loved one!

The breech seems to have been between November 18 and 28, but it is unclear if it might have started earlier or possibly still be on-going. Bebe decided they didn't want to talk to Krebs, so apparently they're still in denial. Evidence suggests that this was another card reader compromise and that their online store was not breeched.

One thing that I don't know since I don't know anyone who shops there is how valuable the cards are. If Bebe is a high-end store, the cards could be worth a lot. Also, the cards are up for sale in a hitherto not known carder forum, so the stolen card retailers have another store that you can buy from.

http://krebsonsecurity.com/2014/12/banks-credit-card-breach-at-bebe-stores/


UPDATE: Bebe confirmed the breech.

"Bebe stores said its investigation indicates that the breach impacted payment cards swiped in its U.S., Puerto Rico and U.S. Virgin Islands stores between Nov. 8, 2014 and Nov. 26, 2014. The data may have included cardholder name, account number, expiration date, and verification code." They claim the breech has been stopped.

So at least they caught it before Black Friday, that greatly reduces the number of compromised cards.

http://krebsonsecurity.com/2014/12/bebe-stores-confirms-credit-card-breach/

A bank in New England got took for $120,000 in fraudulent C&P charges emanating from Brazil. The issue? The bank haven't issued any C&P cards yet.

One part of C&P is a built-in counter that is part of the transaction data stream. If your bank receives a second transaction with the same counter number, you know it's fraudulent. But since it's not implemented, it's largely ignored. Apparently some criminals in Brazil bought a bunch of Home Depot stolen cards, got ahold of a credit card terminal, and manipulated the data stream to cram the cards through. The bank recovered about $80k of the stolen money and is trying to get the rest back. Meanwhile, Mastercard is saying that they're responsible for the remainder.

After the Home Depot theft, the bank decided not to re-issue potentially compromised cards as they represented a fairly large portion of their customer base. I would guess that they're reconsidering that right now.

There's no doubt that C&P will greatly reduce fraud, but it's not easy to implement, so chances are that we'll see as much and maybe more as it begins to be rolled out next year. In the case of this New England bank, an upstream provider authorized the charges when the bank's systems were offline and couldn't directly authenticate the transactions.

http://krebsonsecurity.com/2014/10/replay-attacks-spoof-chip-card-charges/


ETA: Bruce Schneier wrote about C&P attacks a while back, it's called a Pre-Play Attack.
https://www.schneier.com/blog/archives/2014/05/preplay_attack_.html

This is very limited, the theft specifically struck three states (NY, NJ, PA) and only about eleven stores. Very little information is available, though it appears to be a cash register malware attack. I'm thinking that maybe it was detected early before the fraudsters could roll out a larger scale breech. Still, I'm sure this will force a chain-wide audit, which consists of some 1,800 stores across the USA.

No mention as to how many cards were compromised or how long the breech lasted.

http://krebsonsecurity.com/2014/10/banks-credit-card-breach-at-staples-stores/