Always strive to learn something useful. --Sophocles

Back in June, many news sources reported that OPM got hacked and basically if you applied for a job with the Federal government in the last 20 years, your information was compromised.  Didn't matter if you were a park ranger or an office admin or what, you were compromised.  A more recent revelation is that fingerprint scans were also compromised.  Bruce Schneier has a recent post about this and the risk of trusting centralized, networked, databases with our information.

Now for a slight diversion.

Salon had a recent article about how a certain KGB agent was amazing at correctly identifying CIA agents in foreign countries.  He applied basic common sense and deduced certain patterns: CIA agents when they were undercover at an embassy always had offices in the secure part of the embassy, always took over the apartment that their predecessor had, did not attend certain functions, when they had meetings out of town they were almost always at night during certain hours.  But the most important tell of all is that their biographies had gaps.  A non-spy in the State Department had a complete and easily verified biography.  Spies did not, theirs had gaps.

Back to the OPM hack.

Two days ago, several news sources reported that the CIA was pulling their agents out of China.  The OPM hack compromised the full information of over 20,000,000 Federal employees, including CIA agents.  China is believed responsible for this hack, so they have all this information.  And basically the CIA knows that China now knows all its agents and has the fingerprints for most of them.

If you know who works for the State Department, and you know "Bob" came in to the country allegedly working for State yet he is not on the list of known State employees, he's probably a spy.  So the CIA pulled them before they could get caught or in trouble.

If China really wanted to screw with us, they'd shop that list around and sell it to Russia, North Korea, etc.


In other glorious news, Experian was hacked again.  This time a specific server or dataset was compromised, and it belonged to the cell phone carrier T-Mobile.  If you applied for a T-Mobile line from September '13 to September '16, the following info was compromised: "Social Security numbers, dates of birth and home addresses."  But that's only for 15,000,000 people, so no worries.

It is important to remember that it was not T-Mobile that was hacked, it wsa the credit reporting agency/data aggregator Experian that was hacked.  When you applied for cell service, you fill out an application and it's run through Experian to determine if your credit is sufficient to pay for a contract.  Common sense would say that after the credit is approved or denied, a summary should be passed on to T-Mobile, a notation made on the person's credit report, and the application should be purged.  But apparently that wasn't good enough for Experian and they decided that they needed to keep the actual application.

Oh, well.

He arranged to buy access to an information agency that bought court records, posing as a private investigator out of Singapore. He had direct access to 200 million records that would allow fraudsters to create perfect identity/credit theft records. The data service he was buying them through was later acquired by Experian and he still siphoned data out of the system for almost a year after that acquisition.

He was arrested when US Secret Service lured him to Guam, posing as an info broker who wanted to buy lots of ID information. In court he plead guilty to what he did, so he's going to American prison for a while.

http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/

There are forums on the internet called Carder sites where people post 'I have 3,000 clean American cards for sale' and such information is bought and sold. Such sites come and go, within the last few weeks a big one was taken down. They also move drugs and identity theft information. Some of the information is gained through card skimmers installed on point of sale terminals, such as what happened to Barns & Noble and to Nordstroms, but also at gas pumps and ATMs. Some is obtained through server compromises, such as happened to TJ Maxx a few years ago where criminals roamed their network with impunity and undetected for months, sniffing credit card information by the bucketful.

Then there's the criminals that get it directly from Experian and Lexis/Nexis.

There are three major credit bureaus in the U.S., Experian is one of them. Through a third-party vendor connected to their data, criminals paid for an account with Experian, posing as U.S. private investigators, while they were based in Vietnam and they paid for the account with wire transfers from Singapore. No red flags there, nosiree!

The criminals had an Experian account for a year. So clearly Experian was doing zero due diligence to make sure their systems were only being accessed by the people who should be accessing them. As long as the checks came in, they didn't care. The criminals had everything on people that would allow them to do a full impersonation: name, address, social security number, mother's maiden name, job info, bank account info including routing numbers, etc. The indictment of the head of the operation alleges that they bought and sold information on half a million people. Secret Service lured him out of Vietnam to Guam where he was arrested and moved to New Hampshire where he's facing 15 criminal counts that could amount to basically a life sentence if he's convicted on all counts.

The ultimate irony is that Experian claims that they are data breach experts and sell credit monitoring services to watch to see if your information is compromised.

http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/


Last month Krebs broke a story of how LexisNexis, Dunn & Bradstreet, and a service called Kroll were compromised by identity theft criminals. LexisNexis is an invaluable tool for attorneys, but also for crooks. It's also a pay-for service, but apparently free accounts are given to law students all over the country, and one such inactive account was compromised to gain access to the service for criminals. Again, all the information that you'd need to impersonate someone or get credit issued in their name was available through their service.

The way this compromise was discovered is kind of interesting. The information was found on a criminal web site called SSNDOB which sold the info, their site got hacked and plundered by other hackers, and their database was posted publicly, the records had a field that showed where it came from, with codes such as DNB, LX, etc. Quickly a botnet was discovered and everything was unraveled.

http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/

Certegy provides check processing services to a HUGE number of retail operations throughout the United States, possibly credit card processing internationally. Wal Mart? Best Buy? Certegy customers.

They weren't hacked, they were robbed. A database administrator, which is what I do for a living, stole banking and credit card information from 2.3 million accounts, and SOLD THEM TO MARKETERS. It has since been found that a large number of people are experience a variety of problems ranging from identity theft to having their accounts plundered. Class action law suits are being formed even as we speak.

http://www.networkworld.com/news/2007/070307-fidelity-national-records.html

I'm not personally concerned because of my current checking account, one has never been used at Best Buy or Walmart, one was opened in April which is after the data theft, and the other is being closed. But PLEASE order copies of your credit ratings and keep a VERY close eye on your bank statements! The article says that Certegy is "implementing a fraud watch associated with the stolen records, has also notified credit-reporting agencies TransUnion, Equifax and Experian of the incident, in addition to notifying Visa and MasterCard.", but based on feedback to the article, people are having to get the credit monitoring in place themselves and lots of banks, including Wells Fargo IIRC, do not know this is going on.

Here's one reply to the article, there's something like 45 of them:
"I decdided to call them to see if I was included in their database, and if so how I could remove myself. The person I talked to said that she needed by Driver's license number, my routing number, and my account number to even tell if I was in the Database. But she added that if I had ever written a check or used my debit card at Wal Mart, Bestbuy or 374,998 other businesses in the US, then I was definately in their database. I asked how to remove myself from the database, and she replied stop writing checks or using my debit card. I then asked that since I was probably already in their database, how can I get the information removed? She said I cannot, it is Certegy property.


I'll be talking about preventing something like this from a technical side on my other blog.