Tag Archives: responsible consumers

Credit card breach at Dells resort imacts thousands of cards

State Journal Staff
Wisconsin State Journal
September 13, 2011
http://host.madison.com/wsj/business/article_6587df18-de00-11e0-96a4-001cc4c03286.html

A Wisconsin company that supplies arcade equipment and vending machines to businesses said hackers broke into its credit-card processing systems at resorts in Tennessee and Wisconsin.

Vacationland Vendors Inc. said Monday up to 40,000 credit and debit cards used in its arcades may have been affected.

Company spokesman Bill Bray said the resorts were Wilderness Waterpark Resort in Wisconsin Dells and the Smokies Resort in Sevierville, Tenn.

The company said it shut down its card-processing systems at both arcades when it discovered the March 22 breach. The company is issuing warnings to patrons who used a credit or debit card at either arcade between Dec. 12, 2008, and May 25, 2011, and is advising those patrons to be on the lookout for unauthorized activity on their bank statements and credit-card bills.

Advertisements

Thieves Found Citigroup Site an Easy Entry

Nelson D. Schwartz and Eric Dash
New York Times
June 13, 2011
http://www.nytimes.com/2011/06/14/technology/14security.html?_r=1&src=recg&pagewanted=all

Think of it as a mansion with a high-tech security system — but the front door wasn’t locked tight.

Using the Citigroup customer Web site as a gateway to bypass traditional safeguards and impersonate actual credit card holders, a team of sophisticated thieves cracked into the bank’s vast reservoir of personal financial data, until they were detected in a routine check in early May.

That allowed them to capture the names, account numbers, e-mail addresses and transaction histories of more than 200,000 Citi customers, security experts said, revealing for the first time details of one of the most brazen bank hacking attacks in recent years.

The case illustrates the threat posed by the rising demand for private financial information from the world of foreign hackers.

In the Citi breach, the data thieves were able to penetrate the bank’s defenses by first logging on to the site reserved for its credit card customers.

Once inside, they leapfrogged between the accounts of different Citi customers by inserting vari-ous account numbers into a string of text located in the browser’s address bar. The hackers’ code systems automatically repeated this exercise tens of thousands of times — allowing them to capture the confidential private data.

The method is seemingly simple, but the fact that the thieves knew to focus on this particular vulnerability marks the Citigroup attack as especially ingenious, security experts said.

One security expert familiar with the investigation wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. “It would have been hard to prepare for this type of vulnerability,” he said. The security expert insisted on anonymity because the inquiry was at an early stage.

The financial damage to Citigroup and its customers is not yet clear. Sean Kevelighan, a bank spokesman, declined to comment on the details of the breach, citing the ongoing criminal investigation. In a statement, he said that Citigroup discovered the breach in early May and the problem was “rectified immediately.” He added that the bank had initiated internal fraud alerts and stepped up its account monitoring.

The expertise behind the attack, according to law enforcement officials and security experts, is a sign of what is likely to be a wave of more and more sophisticated breaches by high-tech thieves hungry for credit card numbers and other confidential information.

That is because demand for the data is on the rise. In 2008, the underground market for the data was flooded with more than 360 million stolen personal records, most of them credit and debit files. That compared with 3.8 million records stolen in 2010, according to a report by Verizon and the Secret Service, which investigates credit card fraud along with other law enforcement agencies like the Federal Bureau of Investigation.

Now, as credit cards that were compromised in the vast 2008 thefts expire, thieves are stepping up efforts to find new accounts.

As a result, prices for basic credit card information could rise to several dollars from their current level of only pennies.

“If you think financially motivated breaches are huge now, just wait another year,” said Bryan Sartin, who conducts forensic investigations for Verizon’s consulting arm.

The kind of information the thieves are able to glean is shared in online forums that are a veritable marketplace for criminals. Networks that three years ago numbered several thousands users have expanded to include tens of thousands of hackers.

“These are online bazaars,” said Pablo Martinez, deputy special agent in charge of the Secret Service’s criminal investigation division. “They are growing exponentially and we have seen the entire process become more professional.”

For example, some hackers specialize in prying out customer names, account numbers and other confidential information, Mr. Martinez said. Brokers then sell that information in the Internet bazaars. Criminals use it to impersonate customers and buy merchandise. Finally, “money mules” wire home the profits through outlets like Western Union or MoneyGram.

“It’s like ‘Mission Impossible’ when they select the teams,” said Mark Rasch, a former prosecutor who is now with CSC, an information technology services firm. “And they don’t know each other, except by hacker handle and reputation.”

In the Citi attack, the hackers did not obtain expiration dates or the three-digit security code on the back of the card, which will make it harder for thieves to use the information to commit fraud.

Not every breach results in a crime. But identity theft has ranked first among complaints to the Federal Trade Commission for 11 consecutive years, with 1.34 million in 2010, twice as many as the next category, which is debt collection.

Many of these attacks have their origins in Eastern Europe, including Russia, Belarus, Ukraine and Romania. In fact, the security expert familiar with the Citi breach said it originated in the region, though he would not specify the country.

In Russia, Xakep.ru, is one of the larger forums for Eastern European hackers today, with nearly 13,300 registered members, according to Cyveillance. HackZone.ru is larger, and has more than 58,000 members. In addition, attacks by Romanian hackers have grown noticeably more advanced recently, according to security experts.

On HackZone, one seller who called himself “zoloto” promised “all cards valid 100%” and that they would be sold only one time.

Underscoring the multinational nature of these rings, American law-enforcement agencies have also been putting more investigators overseas.

“The only way to address a global issue is to address it globally with your partners,” said Gordon M. Snow, assistant director of the F.B.I.’s Cyber Division.

The Secret Service established a presence in Tallinn, Estonia, last month, and has embedded agents with Ukrainian authorities since the beginning of the year. The F.B.I. has embedded agents in the Netherlands, Estonia, Ukraine and Romania, and works closely with its counterparts in Australia, Germany and Britain.

But even officials at these agencies acknowledge that as fast as they move, the hackers’ strategies are evolving at Silicon Valley speed.

“With every takedown, they regroup,” said J. Keith Mularski, a supervisory special agent with the F.B.I.

Thousands of Citi customers at risk after hacker attack

Reuters
msnbc.com
June 9, 2011
http://www.msnbc.msn.com/id/43335996/ns/business-personal_finance?GT1=43001

Citigroup Inc said computer hackers breached the bank’s network and accessed the data of about 200,000 bank card holders in North America, the latest of a string of cyber attacks on high-profile companies.

Citi said the names of customers, account numbers and contact information, including email addresses, were viewed in the breach, which the Financial Times (newspaper operates behind a paywall) said was discovered by the bank in early May.

However, Citi said other information such as birth dates, social security numbers, card expiration dates and card security codes (CVV) were not compromised.

“We are contacting customers whose information was impacted. Citi has implemented enhanced procedures to prevent a recurrence of this type of event,” Sean Kevelighan, a U.S.-based spokesman, said by email.

“For the security of these customers, we are not disclosing further details.”

In the brief email statement, Citi did not say how the breach had occurred.

Another Citi spokesman, James Griffiths in Hong Kong, said the breach had affected 1 percent of North American card customers, which the bank’s annual report says total 21 million.

But like Japanese electronics and entertainment group Sony, which has declared several security breaches of its networks this year, Citi could come under fire for not telling customers sooner.

“It may be the bank’s business, but it’s the consumer’s personal information so consumers deserve to be told about security breaches immediately,” said Dan Simpson, a spokesman for Australia’s Consumer Action Law Centre, an advocacy group.

“It’s hard to see any reason why this sort of breach couldn’t have been disclosed much sooner.”

Growing concern
Citigroup joins a growing list of companies that have suffered cyber attacks.

Data storage firm EMC Ltd this week offered to replace millions of electronic keys after hackers used data from its RSA security division to break into the network of arms supplier and information technology provider Lockheed Martin.

Sony has reported several attacks, including one in which hackers accessed the personal information on 77 million PlayStation Network and Qriocity accounts.

Sony was criticized for a delay in telling account holders that their information had been stolen by hackers.

Google Inc last week revealed a major attack on its Gmail accounts targeting, among others, senior U.S. government officials that it said appeared to originate in China.

Washington has scrambled to assess if security had been compromised by the raid on Google’s Gmail system, reflecting increasing concerns among global policymakers about cyber security.

Citi said it had discovered the unauthorized access at Citi Account Online, an online banking service, through routine monitoring.

“It’s definitely a serious security breach when that amount of data’s been stolen from a bank,” said Sydney-based Ty Miller, chief technology officer of Pure Hacking, a network security company.

Citigroup global enterprise payments head Paul Galant, who previously ran the bank’s credit card unit, said in April that security breaches are a fact of life for financial institutions.

“Security breaches happen, they’re going to continue to happen … the mission of the banking industry is to keep the customer base safe and customers feeling secure about their financial transactions and payments,” he told Reuters in an interview.

DOT Sells Drivers’ Personal Information

Channel 3000
June 3, 2011
http://www.channel3000.com/technology/28115031/detail.html

There are about 4.5 million drivers in Wisconsin, and more than half may not know their personal information is being sold by the state Department of Transportation.

There are laws but almost no oversight to how the Wisconsin DOT uses drivers’ information.

In all, the state makes millions of dollars by selling drivers’ information, WISC-TV reported.

Before a person becomes an official Wisconsin driver and gets his or her license, there’s time to consider two decisions at the Department of Motor Vehicles.

One is whether that person wishes to be recorded as a potential organ donor.

But drivers are also asked to check a box if they wish to have their name and address “withheld from the list the department sells.”

About 2.5 million Wisconsin drivers didn’t check the box to withhold their information. By not doing so, those drivers allow the DOT to sell their information on a monthly basis.

Some may not have noticed the other inquiry.

“It was kind of small (on the form). I didn’t really notice it at first,” said Sierra Scott, a Madison resident.

But it’s not just a person’s name and addresses. The driver record file includes a person’s name, address, date of birth, gender, driver’s license number and driving status.

The entire driver record file containing information on 2.5 million drivers can be purchased for $250.

“We produce a CD containing the record file and then we send that. Those funds are sent to the registration fee trust,” said Taqwanya Smith, director for the DMV’s Bureau of Driver Services.

In 2010, the DOT made $22,250 selling driver record files.

“I think the cost is representative of the amount of effort it takes to produce the records,” Smith said.

Smith, who administers state and federal laws at the Wisconsin Department of Transportation, said that anyone can buy the driver record file, getting access to information for the drivers who haven’t opted out.

“Wisconsin is an open records state, and by that Wisconsin presumes that the public has a right to know about information contained within government records,” Smith said.

Federal law defines who can get the information and how they can use it.

“The (Drivers Privacy Protection Act) authorizes us to disclose to anyone meeting that criteria,” Smith said.

But no state or federal agency tracks who is buying drivers’ information or what they use it for. If people check the right box, they get the information, with no questions asked and no follow up, WISC-TV reported.

To read more click here.

Wis. Auto Title Loan Ban Could Be Lifted

Associated Press
Channel 3000
May 13, 2011
http://www.channel3000.com/news/27881311/detail.html

Auto title loans would again be legal in Wisconsin under a reversal of current law approved by the Legislature’s budget committee.

The change approved Thursday by the Joint Finance Committee would still have to be approved by the full Legislature and Republican Gov. Scott Walker before it would take effect.

A ban on auto title loans was not included in the final version of a bill then-Gov. Jim Doyle signed last year, but he put it in place through the creative use of his veto.

The committee voted without debate to once again allow auto title loans, with restrictions under an 11-5 vote.

Lawmakers find time to tackle economic growth

By Tom Still
Milwaukee Journal Sentinel
May 7, 2011
http://www.jsonline.com/business/121425468.html

A bill that would modernize Wisconsin’s telecommunications laws and open the door for investment in improved broadband and wireless networks was the topic of public hearings last week before Assembly and Senate committees. While some details remain to be worked out, lawmakers appear on their way to embracing a plan that would spur economic growth – particularly in rural areas where e-commerce, telemedicine and distance learning are more concepts than reality.

Traditional phone companies are regulated under rules that stem from an era when telecommunications was defined as two-way, voice-grade, analog wireline service. In short, telecom was a plain black telephone hanging on the wall.

Today, telecom is defined broadly to reflect a tidal wave of change in the age of digital computing and the Internet. The early 21st century meaning of telecom is the transmission and distribution of multiple forms of data – voice, text, video, images, music and more – through a variety of means.

Rethinking regulatory barriers tied to the landline era is part of Wisconsin’s effort to ensure that its telecom systems are world-class and that all regions of Wisconsin, from its major cities to its rural areas, have a chance to compete in the global marketplace.

If the reform package passes, Wisconsin could see job growth across a number of business sectors due to opportunities created by better telecom connections.

To read the entire article, click here.

More parents help kids cheat Facebook age rules

By Patricia Reaney
Reuters
May 9, 2011
http://www.msnbc.msn.com/id/42957561/ns/technology_and_science-tech_and_gadgets

Despite age restrictions on some social media sites, the number of U.S. parents who would allow children 10-12 years old to have a Facebook or MySpace account has doubled in a year, a new survey showed.

Seventeen percent of U.S. parents questioned in the poll said they had no problem with a pre-teen child using a social media site, compared to just eight percent a year ago.

And 11 percent of parents admitted to using social media sites on behalf of a young child or infant, according to the online survey of about 1,000 adults by Liberty Mutual’s Responsibility Project. (Facebook terms state that users must be at least 13.)

“More and more parents are allowing their children to have a Facebook account or to have more online activity at younger and younger ages.” said Janet Taylor.

The clinical instructor of psychiatry at Columbia University at Hospital in New York described the findings as a sign of the times.

“It’s not alarming. I think it means we need to be aware of what is going on and how to best utilize social media,” she added in an interview.

To read more click here.