Always strive to learn something useful. --Sophocles

In October, the gene testing company got hacked. The information on 7,000,000 customers was compromised. From the article, the information compromised includes: "photos, full names, geographical location, information related to ancestry trees, and even names of related family members. The company said that no genetic material or DNA records were exposed. Days after that attack, the hackers put up profiles of hundreds of thousands of Ashkenazi Jews and Chinese people for sale on the internet."

Of course, law suits started popping up immediately. Back to the article: "multiple class action claims” have already been against the company in both federal and state court in California and state court in Illinois, as well as in Canadian courts." No surprise there.

Here's the surprise.

23 sent out an update to its terms of service to all customers. Okay, that's not new, companies do it all the time and usually we ignore them. These were a bit different. Just a wee bit.

First off, unless you notified them in writing within 30 days, you automatically agreed to them.

Second, by agreeing to them, you relinquished your right to participate in class action claims.

GEE, ISN'T THAT SPECIAL?! Company gets hacked, then screws over their customers to try to prevent them from suing the company. Pretty clever. One law professor said that the change in the user agreement would not be enough to prevent claims, but the article did not go into any detail of the reasoning behind the statement. Perhaps some ex post facto going on there?

Myself, while I have had genetic testing performed, it was purely in a medical context and theoretically my genes have never been shared with companies like this. They are far too liberal with sharing their information and with letting law enforcement stroll through their data.

https://www.engadget.com/23andme-frantically-changed-its-terms-of-service-to-prevent-hacked-customers-from-suing-152434306.html

Live in Texas? Have a driver's license? Think the information is held securely?

BWAHAHAHAHA!

A contractor for the state motor vehicle department, Vertafore, said "the data was exposed between March and August and affected licenses issued before February 2019.

Exposed data included driver’s license numbers, addresses, dates of birth and vehicle registration history, according to the company. The group said that no Social Security numbers or financial account information were compromised.

The breach happened after three files were accessed by an unauthorized user after the files were “inadvertently stored in an unsecured external storage service,” Vertafore said in its statement."

"An unsecured external storage device" means they probably put it in an Amazon Cloud or something similar and didn't secure it properly. Because security is hard!

THEN DON'T PUT IT SOMEWHERE THAT YOU DON'T KNOW HOW TO EFFING SECURE PROPERLY!

Oh, but they're going to pay for data monitoring and "identity restoration services", whatever the heck that is. Thoughts and prayers, people, thoughts and prayers.

https://thehill.com/policy/cybersecurity/525923-data-breach-of-software-vendor-exposes-almost-28-million-texas-drivers

https://news.slashdot.org/story/20/11/15/0638241/data-breach-exposes-27-million-texas-drivers-license-records


This next one is a doozy, and definitely involves a misconfigured Amazon storage bucket. Now, Amazon is not to blame: they're selling you a service, YOU are responsible for securing it. It's like people not changing the combination on their brief case or luggage.

Anyway, there's this company that works with major, MAJOR, online hotel/travel reservation systems, like Expedia. Specifically Expedia and others. And 10 MILLION FILES were exposed. Not records of people or reservations. FILES. As in collections of records. So we don't know how many people are affected. August 2020 - by itself! - contained 180,000 records. During the COVID slower travel period!

The company in question, Prestige, is in a whole heap o' trouble, because credit card data was leaked, but also because they fall under the European GDPR regulations. It's quite possible that they're going to be fined out of existence. And because they did not secure their credit card information, they could be stripped of their ability to process credit cards, which would nullify their cashflow. Once they were notified about this exposure, they contacted Amazon and the naked storage bucket was immediately secured.

Here's what was exposed: "The records contain a raft of information, Website Planet said, including full names, email addresses, national ID numbers and phone numbers of hotel guests; card numbers, cardholder names, CVVs and expiration dates; and reservation details, such as the total cost of hotel reservations, reservation number, dates of a stay, special requests made by guests, number of people, guest names and more.

The exposure affects a wide number of platforms, with data related to reservations made through Amadeus, Booking.com, Expedia, Hotels.com, Hotelbeds, Omnibees, Sabre and more."

Have you made an online booking since 2013? Your data may have been in there. I know I'm a likely unwilling participant.

Here's some ways that the information could be used against us: "Hotel guests affected could be the targets of a wide range of attacks, from identity theft and phishing to someone hijacking their vacations, researchers said. For instance, they pointed out that cybercriminals could use details of hotel stays to create convincing scams and target wealthy individuals who have stayed at expensive hotels. And if any hotel stays revealed embarrassing or compromising info about a person’s life, it could be used to blackmail and extort them."

https://threatpost.com/millions-hotel-guests-worldwide-data-leak/161044/

https://it.slashdot.org/story/20/11/15/0422207/credit-card-numbers-for-millions-of-hotel-guests-exposed-by-misconfigured-cloud-database

Mainly in California and Arizona. Dickey's is a franchised operation, and as franchisees can choose their point of sale operation, it is most likely that a downstream credit card operator was compromised.

From the article, one of the consultants brought in said "The financial institutions we’ve been working with have already seen a significant amount of fraud related to these cards,” and "data indicated some 156 Dickey’s locations across 30 states likely had payment systems compromised by card-stealing malware, with the highest exposure in California and Arizona. Gemini puts the exposure window between July 2019 and August 2020.

Apparently with the emphasis in hardening systems against ransomware, people have been neglecting converting over to chip payment and the swiping of cards is notorious for being vulnerable to card theft.

https://krebsonsecurity.com/2020/10/breach-at-dickeys-bbq-smokes-3m-cards/

This is interesting. Their stores didn't get breached, but their peripheral services did: gas pumps, restaurants, drive-up coffee shops.

35 states, 5.3 million credit cards. The breach was announced on the 14th and the investigation is in early phrases, but the store is confident that the check-out lanes and pharmacy terminals were not compromised.

This is what pisses me off about cavalier attitudes when I'm told "just swipe your card". I DON'T WANT TO SWIPE MY CARD! THAT'S WHERE MY CARD INFO GETS STOLEN! I'm just about ready to tell businesses that if I can't use the chip reader, I'm not buying anything and turning around and walking.

https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-of-5m-stolen-credit-debit-cards/

I don't post about these anymore because it's so flamin' common and so little is being done to prevent it. Company is breached, credit monitoring is offered, most banks cover their customer losses, wait until the next company is breached.

I only post this because I've eaten there a few times and really like the place. I had my 50th birthday party there in Phoenix with family and friends, we had a really good time.

Anyway, it was a point of sale breach between May 23, 2018 and March 18, 2019 and according to a company press release, the hack was found in "67 Buca di Beppo locations in the United States; a handful out of the total 31 Earl of Sandwich locations; and Planet Hollywood locations in Las Vegas, New York City and Orlando. Also impacted were Tequila Taqueria in Las Vegas; Chicken Guy! in Disney Springs, Fla.; and Mixology in Los Angeles."

https://krebsonsecurity.com/2019/03/a-month-after-2-million-customer-cards-sold-online-buca-di-beppo-parent-admits-breach/

I'm not going to bother linking to an article about the CEO "retiring" with a $90,000,000 plan, it's just not worth it.

Bloomberg has a good breakdown of the structure of the hack. Basically after the Struts exploit became known and some (essentially) script kiddies gained a toehold in to Equifax's network, they handed their penetration off to a skilled team of pros. The pros then did quite a serious number, including installing custom backdoors that ignored the Struts problem and bypassed the firewalls, they then started breaking apart databases. They had so much information that they had to prioritize which databases were more valuable, then they had to break them down in to smaller chunks for exfiltration to avoid tripping monitoring software that watches for just this sort of thing.

Definite experts.

Which points to possibly nation state actors. A lot of people want to point to the Chinese because one of the tools is called China Chopper because it has a Chinese language interface, but it's used by hackers around the world, so that's hardly conclusive. But the thing that really points to nation actors: none of the information on the 143 million people that was stolen, including credit cards, has surfaced on any underground forums that sell stolen information.

Personally, my money for the country most likely to be responsible is Russia or North Korea. We know that Russia has the talent for something like this, and after the DPRK tore apart Sony for The Interview, and the fact that their cyber people were trained by the Chinese, they also have the skill.

Equifax suspected someone was in their system. Their contractor, Mandiant, sent a team over. For whatever reason, Equifax thinks that Mandiant didn't send over their best people. Squabbling ensued for an extended period of time, during which apparently nothing was done to stop the hackers or their theft. This amounts to criminal stupidity as far as I'm concerned. Disagree all you want, but GET THE EFFING JOB DONE and resolve the fight later! JOB ONE IS TO STOP THE BAD GUYS!

The original Bloomberg article:
https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros

The Slashdot article that lead me to the Bloomberg article, complete with some interesting comments:
https://news.slashdot.org/story/17/09/30/207200/squabble-with-contractor-delayed-equifaxs-response-to-data-breach

Apparently. In March they brought in the company that is investigating the May-July breech. These seem to be the same intruders.

From Slashdot:
Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed (bloomberg.com)
Posted by BeauHD on Monday September 18, 2017 @05:20PM from the earlier-than-expected dept.
Bloomberg is reporting that Equifax, the credit reporting company that recently reported a cybersecurity incident impacting roughly 143 million U.S. consumers, learned about a breach of its computer systems in March -- almost five months before the date it has publicly disclosed. The company said the March breach was unrelated to the recent hack involving millions of U.S. consumers, but one of the people familiar with the situation said the breaches involve the same intruders. From the report:

Equifax hired the security firm Mandiant on both occasions and may have believed it had the initial breach under control, only to have to bring the investigators back when it detected suspicious activity again on July 29, two of the people said. Equifax's hiring of Mandiant the first time was unrelated to the July 29 incident, the company spokesperson said. The revelation of a March breach will complicate the company's efforts to explain a series of unusual stock sales by Equifax executives. If it's shown that those executives did so with the knowledge that either or both breaches could damage the company, they could be vulnerable to charges of insider trading. The U.S. Justice Department has opened a criminal investigation into the stock sales, according to people familiar with the probe.

In early March, they said, Equifax began notifying a small number of outsiders and banking customers that it had suffered a breach and was bringing in a security firm to help investigate. The company's outside counsel, Atlanta-based law firm King & Spalding, first engaged Mandiant at about that time. While it's not clear how long the Mandiant and Equifax security teams conducted that probe, one person said there are indications it began to wrap up in May. Equifax has yet to disclose that March breach to the public.

https://it.slashdot.org/story/17/09/18/230234/equifax-suffered-a-hack-almost-five-months-earlier-than-the-date-it-disclosed

The Bloomberg original story has auto-start videos.
https://www.bloomberg.com/news/articles/2017-09-18/equifax-is-said-to-suffer-a-hack-earlier-than-the-date-disclosed

It is indeed a doozy, perhaps the largest data privacy leak in history. Equifax has been collecting information on people for decades, and they do it without our express permission. But at the same time, they are used for credit scores and to generate bank decisions for our getting loans and such. Yet I never signed a contract with Equifax allowing them to collect information on me.

And they have, through zero fault of my own, personally screwed me over.

A couple of years ago my wife and I decided to shop car insurance. Our current insurer was doing some corporate shenanigans that we didn't care for, and it should have been possible to shave some bucks off our premiums, and it never hurts to shop. I called the car club AAA, we ran through my information, and they told me that they couldn't take me because I had three accidents on my record. I'm accident-free. Equifax had taken three accidents OF MY FATHER, whose name is Andrew Donald, and put them on my record, where my name is Donald Wayne. We lived at the same address some years back, but I was living in New Mexico at the time of the accidents and have never owned a Buick. As it happens, we were born in the same month, but not on the day and clearly not in the same year. No two digits in our birth date or year are the same. There's no reason to conflate us and put the accidents on to my record, except for pure sloppy processes.

So I have a pretty poor opinion of these credit bureaus.

What happened to Equifax is pretty simple. They built their data framework on an open source software package called Apache Struts. Like virtually all software packages, bugs are found and patches are issued. A particularly big problem with Struts was first patched in March, but the intruders were in Equifax's system from mid-March through July - approx 2.5 months. Thus it is perfectly reasonable for Equifax to blame open source software for its breach. [sarcasm off] Struts is a framework for Java programs to run either on servers or web browsers, and after updating the framework you have to recompile literally hundreds of programs, and doing that would be a tremendous PITA, but it MUST be done, otherwise shit like this happens. Apparently some management at Equifax didn't like to pay overtime, and now they have to cope with a tremendous amount of shit.

In some late-breaking news from this afternoon, Equifax's Chief Information Officer and Chief Security Officer are both "retiring", proving that for once, shit started at the top. In "there is occasionally some justice, or perhaps there will be" news, the Federal Trade Commission is investigating the breech. It will be interesting to find out what they learn, assuming they ever issue a report. I wonder if Congress will hold public hearings. The breech is being compared by some news agencies to Enron. According to the Reuter's story, "Shares of Equifax fell 2.4 percent on Thursday and trading volume hit a record high. The shares have lost 32 percent since the company disclosed the hack on Sept. 7.

Senate Democratic leader Chuck Schumer compared Equifax to Enron, the U.S. energy company that filed for bankruptcy in 2001 after revelations of a widespread accounting fraud."

But you see, this is not just a problem for people in the USA. Equifax holds information for people in Canada and Mexico. And Argentine, and possibly other Latin American countries. And the BBC is reporting that 400,000 UKians have information that was compromised in the theft, but their information exposure was minimal and should not lead to identity theft. Well, we'll see about that! In Argentine, apparently Equifax's software used the highly-[in]secure account/password combination of admin/admin.

This is one of my favorite stories, and it may be behind a paywall since it's from the Wall Street Journal. Here's the Slashdot summary:

Equifax was lobbying lawmakers and federal agencies to ease up on regulation of credit-reporting companies in the months before its massive data breach. Equifax spent at least $500,000 on lobbying Congress and federal regulators in the first half of 2017, according to its congressional lobbying-disclosure reports. Among the issues on which it lobbied was limiting the legal liability of credit-reporting companies. That issue is the subject of a bill that a panel of the House Financial Services Committee, which oversees the industry, discussed the same day Equifax disclosed the cyberattack that exposed personal financial data of as many as 143 million Americans. Equifax has also lobbied Congress and regulatory agencies on issues around "data security and breach notification" and "cybersecurity threat information sharing," according to its lobbying disclosures. The amount Equifax spent in the first half of this year appears to be in line with previous spending. In 2016 and 2015, the company's reports show it spent $1.1 million and $1.02 million, respectively, on lobbying activities. While the company had broadly similar lobbying issues in those years, the liability matter was new in 2017.

The title of the story is "Equifax Lobbied for Easier Regulation Before Data Breach", it's by Michael Rapoport and AnnaMaria Andriotis. f you do a little searching, you might be able to find a copy.

Now, the breech itself is extremely bad. If you were compromised, and there's a very good chance that you were, then the information that was stolen includes: your full name, social security number, previous addresses, list of jobs, all sorts of amazing things. Information about you that never changes. Information about you that you use to apply for credit cards, loans, mortgages, JOBS. The best thing you can do is to approach all four credit bureaus and put a FREEZE, not monitor, but FREEZE your credit. That means that no credit can be taken out in your name without postal correspondence going back and forth with your house. No credit reports can be pulled. It's about the best that you can do. Brian Krebs has an excellent post that he has to pull out a few times every year to discuss this. Definitely worth a read. Me? I'm unemployed. Banks would have to be idiots to issue credit under my information, still, I plan on freezing my accounts.

But that's not the worst.

For reasons unknown, Equifax had credit card transaction information, 200,000 transactions worth dating back to last November, sitting on their servers, apparently unencrypted. Massive violation of PCI compliance rules.

And who knows, there may be more yet to come.

I won't bother providing links to the stories about your surrendering your right to sue if you signed up for their monitoring service, that's been rescinded. There were at least two class-action law suits in development, along with a couple of States Attorneys General beginning investigation.

One more thing to mention: an op ed piece by Bruce Schneier, a very well-known and respected expert on encryption and privacy. He has some facts wrong, I think he wasn't as well-versed on the scope of the breech as perhaps he should have been when he wrote it. But at the beginning of the piece he talks about how the public are not customers of Equifax, we are what is being sold, and we have no say in the matter. And there are THOUSANDS of data brokers out there that we can't come close to naming all of them.

Equifax's feet will be in the fire for some time, I imagine.

Anyone who doesn't expect Trump facilities to NOT get hit more in coming years raise your hand. Bueller? Anyone? It's been documented that Trump's facilities have lousy IT practices and terrible WiFi security, but hotels are particularly problematic. American hotels seem to be stuck with using card swiping technology rather than ECV chip readers, which greatly increase security through strong encryption. Until they upgrade, we'll be seeing hotel breeches regularly.

https://krebsonsecurity.com/2017/07/trump-hotels-hit-by-3rd-card-breach-in-2-years/

Back in March, Brian Krebs posted an article titled Why I Always Tug On The ATM. It boils down to there being a limited number of ways that your credit card information can be stolen:

1. Financial institution is hacked
2. Malware is implanted on a merchant's network, possibly on point of sale (POS) card scanners
3. Hardware is covertly installed on or in POS card scanners

You can't do anything about #1. The first time my banking information was compromised was about seven years ago. I was at my parent's house in Phoenix, heading to Las Vegas to a convention when I saw a charge on my checking account for $80ish at a truck stop in North Carolina, a state where I hadn't been in five years. Turns out that a check processing company in Albuquerque had been hacked and they managed to create a bank card from that info. That hack never hit the news.

#2 is the classic Target hack, though that was an extreme example where the criminals managed complete subversion of their cash register system. They could have done what North Korea did to Sony over the release of The Interview. Arby's, Wendy's, CiCi's, you name it. And you can't do anything about this, either.

#3 is something that you can attempt a bit of defense with.

Skimming comes in two flavors, an overlay or an insert. The overlays are easy. The criminals somehow manufacture a flimsy plastic module containing electronics, generally a card reader for capturing card information, a camera for capturing PINs, and a Bluetooth radio for transmitting the info. The whole thing can be quickly slipped over a card reader at a cashier station. It's a two or three man job: distract the cashier, obscure the overhead security camera, slip the shell over the reader. The shell is precisely made for specific models of card readers and will only fit on those models. There are a few 'tells' that help identify an overlay. The colors will be slightly off. It will feel like thin plastic. The graphics won't look quite right. The dimensions will be slightly off. If you pay attention to the card terminals that you use, you might notice these.

But the best way to notice is to tug. Give the terminal a squeeze and a pull. It should feel solid and it should be solidly anchored to the pedestal that it's secured to.

Gas stations are a slightly different problem. These will sometimes have overlays, so a visual inspection and a tug test is good, but they also may have internal skimmers. These are tiny circuit boards that are actually slipped in to the card slot that read the inserted card and store the info. They don't collect as much information as an overlay, but it's still enough to cause you problems with card theft, and it's not easy to spot these.

Gas stations have taken some defensive measures. You'll notice there are security tape seals where the panels open on the pumps to show they haven't been tampered with, but let's face it, it wouldn't be hard to make fakes of those. But they've also improved the design of the pump faces to try and make it harder for skimmers to be installed, ATM makers have also tried defensive design with varying success.

Brian Krebs' suggestion is that the best defense is to never use a debit card at a terminal that you don't have absolute confidence in, only use a credit card. The reason for this is that credit cards have legal limits for fraud protection, debit cards do not. Your bank may limit your liability if your debit card is compromised, but they are not REQUIRED to by law. So you can trust your bank if you like, but you need to know that they don't have to back you.

Another way to defend yourself, if you have a fairly recent smartphone with Near Field Communications (NFC) and your merchant supports it, is to use Apple Pay or Google Pay. Microsoft tried to set up a wallet system, but it never gained traction and has been relegated to the dustbin of history. BE WARNED: these payment systems take a little getting used to! I set up Apple Pay last week: I've used it four times, I've been successful ONCE. I know how I failed the first time, and I suspect how I failed the other two times, so I think I have it figured out, but still, be prepared for a learning curve.

Apple has an exhaustive explanation of how their system works, and it is really elegant. From what I understand, even if the POS terminal has malware installed, if you use Apple Pay the criminals will get nothing usable. The information is not just encrypted, it's done with a one-way encryption that cannot be reversed after it's transmitted, so no card information can be recovered by an intercepting criminal. The merchant identifier and transaction amount is appended, the packet is sent to your financial org, which authorizes it, and the bill is paid. Your information is never exposed.

I'm sure Google's system works in a similar fashion, but the info that I easily found didn't go in to nearly as much detail as what I found with a casual search for Apple's system.

And I have to tell you, the Apple method for registering a card was amazingly cool: take a picture of your credit card. I was sitting in my partially demolished computer area, in somewhat poor lighting, and it said to take a picture of your card. So I pulled out my personal debit card, and it read it perfectly. Done. Pulled out the debit card in my name for my wife's checking account. For some reason, within about a month of receiving it the gold paint on the letters is completely gone. There was no strong side lighting to provide contrast for the lettering, yet my iPhone 6S had no trouble reading the card! I was VERY impressed. The third card that I registered was my credit card, and that one also registered fine, except it got the expiration date wrong, and that was easy to correct.

You can also manually enter the card information.

You can also use Apple Wallet for concert tickets! I used them for Jethro Tull, which was convenient because I forgot to take the printouts. It looked to me like 75% of the people in line were using smart phones for their tickets.

iPhone 6 series and later, which includes the SE, have NFC. Apple Wallet can be configured to use a fingerprint to authorize rather than the phone's password, regardless of whether you use a password to unlock the phone. Androids that run version 4.4 of the OS or later should have NFC. I saw that sometimes Android updates can cause headaches for Wallet users.

Anyway, that's enough blathering. The best defense, of course, is to always pay in cash. But that brings up two problems: carrying large sums of cash, and do you get the cash from the bank, which may involve lots of inconvenience, or do you trust the ATM to not have been compromised?

It seems to be never-ending.

https://krebsonsecurity.com/2017/03/why-i-always-tug-on-the-atm/