Part 1
According to FinCEN, between between January 1 and June 30, 2009, depository institution (banking) suspicious activity reports characterized as computer intrusion increased 75 percent, compared to the corresponding six-month reporting period in 2008. These reports are filed by individual banks across the country and I'm currently grappling with the multiple categories in an attempt to determine exactly how large this banking trojan corporate account takeover risk may be.
Tell you what – 75 percent growth year to year is not small. If one Zeus banking trojan-hijacked account equals the $100,000 average loss that experts tell me, that money is easily the payroll of 20 people – employees, vendors, and owners – who won't be paying their mortgages or rent on time. I can't speculate on where the growth comes from yet because so much of it is mislabled and tagged into multiple categories.
The importance of clarifying this threat is simple: All experts are unanimous in the fact that businesses are at greater risk of a show-stopping corporate account hijacking event – consumers have separate rights which protect account takeover losses for a much longer time period. Yet businesses often don't know what lurks online or how they can get phished with a simple email, and often they handle a half million dollars or more with no issue.
Strategic value of small businesses
According to the SBA advocacy site, over 99 percent of the private payroll in the US comes from small and midsize businesses. Without small business steadily providing the fifteen year trend of 64 percent of all net new jobs stateside, the logic is simple: our economy can't continue to grow. No new jobs mean slow economic growth.
And somehow we can't seem to measure all of this quantitatively. The overuse by banking employees of the FinCEN SAR category of ‘Other' mocks any efforts at transparency. I may not be able to access more granular data directly due to the Banking Secrecy Act. My calls and emails are still being automatically handled by FinCEN at the time of this article.
Banking trojans have the potential to become the largest historically destructive threat to our nation's economy short of the Civil War. Business account hijacking has the ability to completely destroy what typically takes strong business teams years of nurturing. All from thousands of miles away or from right across the street.
To the start-ups – willing to take on the gut check of starting a business – it's even worse. The theft of someone's total commitment and investment in their future, their employee's futures – different than merely victimizing a single household more and more this crime victimizes entire communities. Adding longer term impact: the money that's taken is not spent stateside, so our small restaurants, coffee shops, gas stations and others don't even get that money back into circulation.
Banking trojans are a weapon of mass destruction loosed in the heart of the American Dream.
Sunday, August 8, 2010
The soul-destroying consequence of losing a business payroll account
Part 2
There's no Hurricane Katrina fund, no 9/11 trust for business banking victims. Instead of the sudden shocking yet galvanizing crash of a jet into a building, this malware-based attack comes as a slow, stealthy shadow creeping into the already bleak landscape of the jobless.
If a business owner lost their funds overnight, I imagine it might go something like:
■Day one: Shock. Could this really be happening?
■Day two: Fight the bank. And lose. Again, is this really happening?
■Day three: Find a new job so your family can sustain itself. And good luck with that task if you were part of the IT team who missed the malware which stole the banking funds!
Brian Krebs has interviewed many victims whose stories are similar:
“Since the incident, [Michelle Marsico] has had to take out a $395,000 loan at 12 percent to cover the loss (she managed to get $70,000 in wires reversed).
“I'm working for nothing right now, and can't afford to pay myself,” Marisco / [Marsico] said in a phone interview.
Without small business providing new job growth it's arguably a nuclear winter for our economy.
This must stop
1.Business owners are completely in the dark about this threat.
2.The critical priority must become identifying the threat of cybercrimes that soul-kill our communities: FinCEN and other aggregators of financial crime reporting need to step it up and show the data more transparently.
3.There are no laws which require protection for payroll accounts and the ABA, after saying how safe online banking has been for years now doesn't seem to want to budge from their position of the business' sole responsibility for compromise.
A recent interview was held with American Banking Association Vice President and Senior Advisor of Risk Management Policy Doug Johnson who, after agreeing that the threat of corporate account takeover was “very large”, pushes responsibility right back at the business, not with the banking community for prevention and risk.
““Banks have a tremendous responsibility to protect their small businesses and municipal customers just as they have that responsibility to protect their retail customers.
But the retail customer protections of Reg E would essentially absolve the small businesses of any responsibility or liability for not properly protecting themselves, and you can certainly appreciate that in a community bank market it is very difficult for a financial institution, through no fault of its own, to really make a corporate customer whole for a loss which could be upwards toward a half of million dollars.
“And there would be less incentive on the part of the corporate customer to protect themselves if they knew that they were going to be made whole in that fashion, even if they didn't protect themselves.”
Five years ago, Doug Johnson was saying something very different:
“"Online banking is safe and getting safer," says Doug Johnson, senior policy analyst at the American Bankers Association.” (USA Today, 2005)
2009 APWG Thought Leader Dr. Laura Mather states that dual control for small business accounts is a good practice for businesses to follow since it raises the bar for criminals, however she feels that it is unlikely that all businesses will implement dual controls and worse, that the tactic has a limited shelf life against faster cybercriminals.
““Banks should be educating their business customers to use this technique,” Dr. Mather adds, “and possibly implement measures that enforce the requirements for dual control. The next obvious step for cybercriminals will be multiple infections within a business such that the criminal has access to both of the dual control accounts.”
“As for the ABA party line – I think with the litigation that is moving forward there will soon be legislation around the SMB accounts. Of course, when that happens, all banking organizations will likely have to change their stance on these issues.”
Her words are prophetic: I found a story about the banking trojan compromise of the ABA-recommended dual control method right in our own SoCal backyard which Brian Krebs wrote about a few weeks ago:
http://krebsonsecurity.com/2010/06/e-banking-bandits-stole-465000-from-calif-escrow-firm/
““Owner Michelle Marisco said her financial institution at the time — Professional Business Bank of Pasadena, Calif. – normally notified her by email each time a new wire was sent out of the company's escrow account. But the attackers apparently disabled that feature before initiating the fraudulent wires.”
“The thieves also defeated another anti-fraud measure: A requirement that two employees sign off on any wire requests. Marisco said that a few days before the theft, she opened an email informing her that a UPS package she had been sent was lost, and urging her to open the attached invoice. Nothing happened when she opened the attached file, so she forwarded it on to her assistant who also tried to view it. The invoice was in fact a trojan horse program that let the thieves break in and set up shop and plant a password-stealing virus on both Marisco's computer and the PC belonging to her assistant, the second person needed to approve transfers.”
Steps you can take:
In keeping with how to protect yourselves and your business here are the top things to do today to harden your business target:
1.Update your endpoint malware protection and ensure you have an antispam solution which will block phishing attacks which use spam tactics to reach their victims.
2.Plan and complete a US-CERT risk assessment,
3.Plan to audit your business accounts DAILY from a secure computer. Don't rely too heavily on email alerts – the latest malware disables them.
4.Raise awareness in your own back yard. Start the discussion.
One final step would be to sit down and have a formal review with your bank of the responsibilities involved with an account hijacking and quite frankly, if you don't like what you hear, vote with your feet and consider changing your approach to online banking or changing your bank.
We're still on the search for definative bank account hijacking statistics. Once we get them, you'll be the first to know.
There's no Hurricane Katrina fund, no 9/11 trust for business banking victims. Instead of the sudden shocking yet galvanizing crash of a jet into a building, this malware-based attack comes as a slow, stealthy shadow creeping into the already bleak landscape of the jobless.
If a business owner lost their funds overnight, I imagine it might go something like:
■Day one: Shock. Could this really be happening?
■Day two: Fight the bank. And lose. Again, is this really happening?
■Day three: Find a new job so your family can sustain itself. And good luck with that task if you were part of the IT team who missed the malware which stole the banking funds!
Brian Krebs has interviewed many victims whose stories are similar:
“Since the incident, [Michelle Marsico] has had to take out a $395,000 loan at 12 percent to cover the loss (she managed to get $70,000 in wires reversed).
“I'm working for nothing right now, and can't afford to pay myself,” Marisco / [Marsico] said in a phone interview.
Without small business providing new job growth it's arguably a nuclear winter for our economy.
This must stop
1.Business owners are completely in the dark about this threat.
2.The critical priority must become identifying the threat of cybercrimes that soul-kill our communities: FinCEN and other aggregators of financial crime reporting need to step it up and show the data more transparently.
3.There are no laws which require protection for payroll accounts and the ABA, after saying how safe online banking has been for years now doesn't seem to want to budge from their position of the business' sole responsibility for compromise.
A recent interview was held with American Banking Association Vice President and Senior Advisor of Risk Management Policy Doug Johnson who, after agreeing that the threat of corporate account takeover was “very large”, pushes responsibility right back at the business, not with the banking community for prevention and risk.
““Banks have a tremendous responsibility to protect their small businesses and municipal customers just as they have that responsibility to protect their retail customers.
But the retail customer protections of Reg E would essentially absolve the small businesses of any responsibility or liability for not properly protecting themselves, and you can certainly appreciate that in a community bank market it is very difficult for a financial institution, through no fault of its own, to really make a corporate customer whole for a loss which could be upwards toward a half of million dollars.
“And there would be less incentive on the part of the corporate customer to protect themselves if they knew that they were going to be made whole in that fashion, even if they didn't protect themselves.”
Five years ago, Doug Johnson was saying something very different:
“"Online banking is safe and getting safer," says Doug Johnson, senior policy analyst at the American Bankers Association.” (USA Today, 2005)
2009 APWG Thought Leader Dr. Laura Mather states that dual control for small business accounts is a good practice for businesses to follow since it raises the bar for criminals, however she feels that it is unlikely that all businesses will implement dual controls and worse, that the tactic has a limited shelf life against faster cybercriminals.
““Banks should be educating their business customers to use this technique,” Dr. Mather adds, “and possibly implement measures that enforce the requirements for dual control. The next obvious step for cybercriminals will be multiple infections within a business such that the criminal has access to both of the dual control accounts.”
“As for the ABA party line – I think with the litigation that is moving forward there will soon be legislation around the SMB accounts. Of course, when that happens, all banking organizations will likely have to change their stance on these issues.”
Her words are prophetic: I found a story about the banking trojan compromise of the ABA-recommended dual control method right in our own SoCal backyard which Brian Krebs wrote about a few weeks ago:
http://krebsonsecurity.com/2010/06/e-banking-bandits-stole-465000-from-calif-escrow-firm/
““Owner Michelle Marisco said her financial institution at the time — Professional Business Bank of Pasadena, Calif. – normally notified her by email each time a new wire was sent out of the company's escrow account. But the attackers apparently disabled that feature before initiating the fraudulent wires.”
“The thieves also defeated another anti-fraud measure: A requirement that two employees sign off on any wire requests. Marisco said that a few days before the theft, she opened an email informing her that a UPS package she had been sent was lost, and urging her to open the attached invoice. Nothing happened when she opened the attached file, so she forwarded it on to her assistant who also tried to view it. The invoice was in fact a trojan horse program that let the thieves break in and set up shop and plant a password-stealing virus on both Marisco's computer and the PC belonging to her assistant, the second person needed to approve transfers.”
Steps you can take:
In keeping with how to protect yourselves and your business here are the top things to do today to harden your business target:
1.Update your endpoint malware protection and ensure you have an antispam solution which will block phishing attacks which use spam tactics to reach their victims.
2.Plan and complete a US-CERT risk assessment,
3.Plan to audit your business accounts DAILY from a secure computer. Don't rely too heavily on email alerts – the latest malware disables them.
4.Raise awareness in your own back yard. Start the discussion.
One final step would be to sit down and have a formal review with your bank of the responsibilities involved with an account hijacking and quite frankly, if you don't like what you hear, vote with your feet and consider changing your approach to online banking or changing your bank.
We're still on the search for definative bank account hijacking statistics. Once we get them, you'll be the first to know.
Once more unto the (data) breach
While going through some FAA manuals, I was reminded of a particular term that is highly applicable in the world of cybercrime. It is referred to as the “chain of events” or the “error chain.” These terms simply mean that multiple factors, rather than a single one, lead to an accident. The same can be said for security incidents, such as data leakage. Take, for instance, some of the largest data breaches to date – such as the those experienced by TJX Companies or Heartland Payment Systems (which I've written about in the past here and here).
When the chain of events is unraveled, interesting details begin to unfold – one after another. These are obviously valuable lessons so that the majority of companies can take steps to protect themselves from these severe incidents in the future. But there will always be another way to “get to the goods.”
What are “the goods”? They are, primarily, the unencrypted customer information that resides deep within the core of organizations. In August 2008, I read a Yankee Group analyst research paper by Phil Hochmuth entitled, “Anywhere Data is Powerful, Data Everywhere is Dangerous.” In this paper, Phil discusses the challenge of data security and an increasingly untethered workforce. While that particular paper's focus covered the mobile workforce, it also conveys the key point applicable to all businesses: Customer data is essential to running a business and supporting our customers, but it can also be considered a dangerous liability that must be well-protected.
Three proposed solutions to securing customer data.
■End-to-end encryption (E3). In this context it is from where data is captured, through all intermediaries to the final credit issuer or debit gateway endpoint (http://www.e3secure.com/pdf/E3Security_Model.pdf);
■Mandatory encryption of personally identifiable information (PII) at rest and in motion (this brings up painful key management issues);
■Heartland is requesting the Accredited Standards Committee X9 (ASC X9) develop a standard to protect cardholder data.
Data breach consequences. There are a slew of consequences that can impact companies after a breach occurs. Some of them bandied about by industry experts are noted below:
Financially catastrophic:
■According to the Ponemon Institute's 2009 Annual Study “U.S. Cost of a Data Breach,” the average cost of a data breach (per record) is $204;
■Loss of sales;
■Investigation and notification costs;
■Fines and litigation;
■Cost of credit monitoring service;
■Interruption of operations;
■Last, but definitely not least, brand erosion (reputation, customer trust).
Regulatory compliance mandates that may impact breached organizations. Of course, many organizations began really paying attention to protecting data as a result not only of some of the consequences noted above, but also because of various industry and government compliance mandates. A sampling includes:
■Health Insurance Portability and Accounting Act (HIPAA);
■Sarbanes-Oxley (SARBOX);
■Graham-Leach-Bliley Act (GLBA);
■Payment Card Industry Data Security Standard (PCI DSS);
■Federal Information Security Management Act (FISMA).
These are but a few points that are relevant to data breaches of all sizes – not only those that potentially revealed more than 100 million customer records in one incident. Keep in mind that at the time of the breaches, the companies I mentioned were PCI compliant. This should reinforce the point that we still have a long way to go to secure our data and reduce the severity of data breaches.
Data security risk is as unlimited as human intelligence, ingenuity and ignorance.
When the chain of events is unraveled, interesting details begin to unfold – one after another. These are obviously valuable lessons so that the majority of companies can take steps to protect themselves from these severe incidents in the future. But there will always be another way to “get to the goods.”
What are “the goods”? They are, primarily, the unencrypted customer information that resides deep within the core of organizations. In August 2008, I read a Yankee Group analyst research paper by Phil Hochmuth entitled, “Anywhere Data is Powerful, Data Everywhere is Dangerous.” In this paper, Phil discusses the challenge of data security and an increasingly untethered workforce. While that particular paper's focus covered the mobile workforce, it also conveys the key point applicable to all businesses: Customer data is essential to running a business and supporting our customers, but it can also be considered a dangerous liability that must be well-protected.
Three proposed solutions to securing customer data.
■End-to-end encryption (E3). In this context it is from where data is captured, through all intermediaries to the final credit issuer or debit gateway endpoint (http://www.e3secure.com/pdf/E3Security_Model.pdf);
■Mandatory encryption of personally identifiable information (PII) at rest and in motion (this brings up painful key management issues);
■Heartland is requesting the Accredited Standards Committee X9 (ASC X9) develop a standard to protect cardholder data.
Data breach consequences. There are a slew of consequences that can impact companies after a breach occurs. Some of them bandied about by industry experts are noted below:
Financially catastrophic:
■According to the Ponemon Institute's 2009 Annual Study “U.S. Cost of a Data Breach,” the average cost of a data breach (per record) is $204;
■Loss of sales;
■Investigation and notification costs;
■Fines and litigation;
■Cost of credit monitoring service;
■Interruption of operations;
■Last, but definitely not least, brand erosion (reputation, customer trust).
Regulatory compliance mandates that may impact breached organizations. Of course, many organizations began really paying attention to protecting data as a result not only of some of the consequences noted above, but also because of various industry and government compliance mandates. A sampling includes:
■Health Insurance Portability and Accounting Act (HIPAA);
■Sarbanes-Oxley (SARBOX);
■Graham-Leach-Bliley Act (GLBA);
■Payment Card Industry Data Security Standard (PCI DSS);
■Federal Information Security Management Act (FISMA).
These are but a few points that are relevant to data breaches of all sizes – not only those that potentially revealed more than 100 million customer records in one incident. Keep in mind that at the time of the breaches, the companies I mentioned were PCI compliant. This should reinforce the point that we still have a long way to go to secure our data and reduce the severity of data breaches.
Data security risk is as unlimited as human intelligence, ingenuity and ignorance.
Rampant hotel data theft
For the past several years, hotels have been hit hard by data thieves. Experts say that despite an increased awareness within the hospitality industry, data theft is still prevalent.
In the most recent incident, disclosed in late June, remote attackers installed a malicious program into the card processing system of Englewood, Colo.-based hotel chain Destination Hotels & Resorts. Guests at 21 Destination properties may have been subjected to credit card theft.
Cybercriminals last year targeted hotels more than any other industry for credit card theft, according to a recent report by data security company Trustwave. Hotels are being targeted because they have large amounts of credit card data and frequently neglect to implement the most basic security precautions, such as changing default passwords or ensuring programs are up to date, said Nicholas Percoco, senior vice president of Trustwave's SpiderLabs.
As a result, attackers commonly gain entry into a hotel's network by exploiting default passwords on point-of-sale (POS) applications, added Dave Ostertag, manager of investigative response at Verizon Business. From there, customized malware is loaded onto the hotel's transaction server that steals credit card information as a transaction occurs.
In March, the Westin Bonaventure Hotel & Suites in Los Angeles disclosed a possible data breach of its POS systems dating back to 2009. Also, between November 2008 and May 2009, the computer systems of some Radisson hotels in the United States and Canada were illegally accessed. And the computer systems of Wyndham Hotels & Resorts were accessed on two separate occasions by cybercriminals who stole customers' card numbers, expiration dates and other data.
Part of the problem is that many hotels are not compliant with the Payment Card Industry (PCI) Data Security Standards (DSS), said Gary Palgon, vice president of product management at encryption firm nuBridges. While retailers have faced increasing pressure over the past few years to get into compliance with the mandate, few from the hotel industry have been paying attention.
However, some members of the hospitality industry are working to deal with this problem, experts said. The Hotel Technology Next Generation (HTNG), a nonprofit hotel trade association, recently issued a security standard which defines how card data should securely flow between a hotel's various systems. Additionally, large, brand-name organizations are beginning to take data security seriously, experts said. But many others are lagging.
“We are still seeing cases on a weekly basis of hotels getting breached,” Percoco said.
In the most recent incident, disclosed in late June, remote attackers installed a malicious program into the card processing system of Englewood, Colo.-based hotel chain Destination Hotels & Resorts. Guests at 21 Destination properties may have been subjected to credit card theft.
Cybercriminals last year targeted hotels more than any other industry for credit card theft, according to a recent report by data security company Trustwave. Hotels are being targeted because they have large amounts of credit card data and frequently neglect to implement the most basic security precautions, such as changing default passwords or ensuring programs are up to date, said Nicholas Percoco, senior vice president of Trustwave's SpiderLabs.
As a result, attackers commonly gain entry into a hotel's network by exploiting default passwords on point-of-sale (POS) applications, added Dave Ostertag, manager of investigative response at Verizon Business. From there, customized malware is loaded onto the hotel's transaction server that steals credit card information as a transaction occurs.
In March, the Westin Bonaventure Hotel & Suites in Los Angeles disclosed a possible data breach of its POS systems dating back to 2009. Also, between November 2008 and May 2009, the computer systems of some Radisson hotels in the United States and Canada were illegally accessed. And the computer systems of Wyndham Hotels & Resorts were accessed on two separate occasions by cybercriminals who stole customers' card numbers, expiration dates and other data.
Part of the problem is that many hotels are not compliant with the Payment Card Industry (PCI) Data Security Standards (DSS), said Gary Palgon, vice president of product management at encryption firm nuBridges. While retailers have faced increasing pressure over the past few years to get into compliance with the mandate, few from the hotel industry have been paying attention.
However, some members of the hospitality industry are working to deal with this problem, experts said. The Hotel Technology Next Generation (HTNG), a nonprofit hotel trade association, recently issued a security standard which defines how card data should securely flow between a hotel's various systems. Additionally, large, brand-name organizations are beginning to take data security seriously, experts said. But many others are lagging.
“We are still seeing cases on a weekly basis of hotels getting breached,” Percoco said.
Microsoft readies record 14 fixes, eight critical
Microsoft on Thursday announced that next week it plans to deliver a record 14 patches to resolve 34 vulnerabilities across its product line.
The 34 flaws expected to be fixed, which ties a record with the number of holes plugged in June's update, reside in Windows, Office, Internet Explorer, SQL Server and Silverlight, according to the advance notification. Eight of the 14 bulletins earned a "critical" rating, while the others are designated as "important."
Of the critical bulletins, seven impact Windows. Joshua Abraham, a security researcher at Rapid7, which provides vulnerability management and penetration testing services, said he'd expect a few working exploits to come out of the security update, launching attacks such as drive-by downloads.
Abraham added that administrators should not necessarily be concerned by the high number of vulnerabilities receiving updates. He said this is not uncommon following security conferences such as Black Hat and DEFCON.
"In the past, there has been a rather high volume around the summer months," Abraham told SCMagazineUS.com on Thursday. "It's something we've seen before. It doesn't really shock me."
August's update appears to match a recent trend in which a light month of bulletins precedes a busier month.
Administrators should review Microsoft's advisories and use its exploit grades to determine which patches deserve priority, Abraham said.
The 34 flaws expected to be fixed, which ties a record with the number of holes plugged in June's update, reside in Windows, Office, Internet Explorer, SQL Server and Silverlight, according to the advance notification. Eight of the 14 bulletins earned a "critical" rating, while the others are designated as "important."
Of the critical bulletins, seven impact Windows. Joshua Abraham, a security researcher at Rapid7, which provides vulnerability management and penetration testing services, said he'd expect a few working exploits to come out of the security update, launching attacks such as drive-by downloads.
Abraham added that administrators should not necessarily be concerned by the high number of vulnerabilities receiving updates. He said this is not uncommon following security conferences such as Black Hat and DEFCON.
"In the past, there has been a rather high volume around the summer months," Abraham told SCMagazineUS.com on Thursday. "It's something we've seen before. It doesn't really shock me."
August's update appears to match a recent trend in which a light month of bulletins precedes a busier month.
Administrators should review Microsoft's advisories and use its exploit grades to determine which patches deserve priority, Abraham said.
Rockefeller, Pryor introduce federal data security law
Two senators on Thursday introduced a national data breach notification bill that also would force businesses to create measures to protect sensitive information under their control, according to a news report.
The legislation, introduced Thursday by Sens. Mark Pryor, D-Ark., and John Rockefeller, D-W.Va., would require organizations to alert victims of a breach within 60 days and provide them with two years of credit monitoring services, according to the National Journal's Tech Daily Dose blog.
In addition, businesses and nonprofits would have to implement policies and procedures to protect their data, the blog post said.
Representatives for Pryor and Rockefeller did not immediately respond to requests for comment by SCMagazineUS.com.
Last month, Sens. Tom Carper, D-Del., and Bob Bennett, R-Utah, reintroduced a similar bill
"The Data Security Act of 2010 would require entities such as financial establishments, retailers, and federal agencies to safeguard sensitive information, investigate security breaches, and notify consumers when there is a substantial risk of identity theft or account fraud," said a news release. "These new requirements would apply to retailers who take credit card information, data brokers who compile private information and government agencies that possess nonpublic personal information."
A national data breach notification law has been in the works for a number of years. Several versions have made the rounds, but nothing ever has cleared both chambers.
This mainly has been due to other Congressional priorities and, more specific to the bills, disagreement over what constitutes a suitable threshold to report a breach. The lack of a federal measure has given way to a hodgepodge of state laws, 46 to be exact.
The legislation, introduced Thursday by Sens. Mark Pryor, D-Ark., and John Rockefeller, D-W.Va., would require organizations to alert victims of a breach within 60 days and provide them with two years of credit monitoring services, according to the National Journal's Tech Daily Dose blog.
In addition, businesses and nonprofits would have to implement policies and procedures to protect their data, the blog post said.
Representatives for Pryor and Rockefeller did not immediately respond to requests for comment by SCMagazineUS.com.
Last month, Sens. Tom Carper, D-Del., and Bob Bennett, R-Utah, reintroduced a similar bill
"The Data Security Act of 2010 would require entities such as financial establishments, retailers, and federal agencies to safeguard sensitive information, investigate security breaches, and notify consumers when there is a substantial risk of identity theft or account fraud," said a news release. "These new requirements would apply to retailers who take credit card information, data brokers who compile private information and government agencies that possess nonpublic personal information."
A national data breach notification law has been in the works for a number of years. Several versions have made the rounds, but nothing ever has cleared both chambers.
This mainly has been due to other Congressional priorities and, more specific to the bills, disagreement over what constitutes a suitable threshold to report a breach. The lack of a federal measure has given way to a hodgepodge of state laws, 46 to be exact.
Sunday, August 1, 2010
Hack attack hits ATM jackpots
LAS VEGAS — Computer security researcher Barnaby Jack jokes that he has resorted to hiding cash under his bed since figuring out how to crack automated teller machines remotely using the Internet.
The New Zealand native on Saturday demonstrated his "ATM jackpotting" discovery for an overflow crowd of hackers during a presentation at the infamous DefCon gathering in Las Vegas.
"You don't have to go to the ATM at all," Jack told AFP after briefing fellow software savants. "You can do it from the comfort of your own bedroom."
Jack proved his findings using two kinds of ATMs typically found in corner stores, bars or other "stand-alone" venues in the United States but said the flaw likely exists in machines at banks.
Banks use "remote management" software to monitor and control their ATMs, and Jack used a weakness in that kind of code to take control of machines by way of the Internet.
He found a way to bypass having to submit passwords and serial numbers to access ATMs remotely. Once in the machines, he could command them to spit out cash or transfer funds.
He could also capture account data from magnetic strips on credit or bank cards as well as passwords punched in by ATM users.
"When you think about ATM security you generally think about the hardware side; is it bolted down and are the cameras in position," Jack said.
"This is the first time anyone has taken the approach of trying to attack the underlying software. It is time to find software defenses rather than hardware defenses."
Jack did his research on ATMs he bought on the Internet. He also found master keys for stand-alone machines available for purchase online, meaning hackers could walk up and tinker with ATM software, he added.
"We shouldn't dwell on the walk-up attack, because no physical access is required," Jack said. "They have a flaw that lets me bypass all authentication on the device on the Internet, and I am the ATM at that stage."
He didn't reveal specifics of the attack to hackers even though the ATM makers were told of the flaw and have bolstered machine defenses.
"I might get my butt in hot water if I released the code," said the IO Active software security researcher who did the ATM hack 'as a hobby.'
"I was careful not to release the keys to the kingdom."
Jack said he doesn't know if criminals have exploited the software flaw "in the wild" but that it is tough to be certain.
"It is not an easy attack to replicate but I am not naive enough to think I am the only one who can do it," Jack said, admitting he has grown wary of ATMs. "I just keep my cash under the bed now, mate."
The New Zealand native on Saturday demonstrated his "ATM jackpotting" discovery for an overflow crowd of hackers during a presentation at the infamous DefCon gathering in Las Vegas.
"You don't have to go to the ATM at all," Jack told AFP after briefing fellow software savants. "You can do it from the comfort of your own bedroom."
Jack proved his findings using two kinds of ATMs typically found in corner stores, bars or other "stand-alone" venues in the United States but said the flaw likely exists in machines at banks.
Banks use "remote management" software to monitor and control their ATMs, and Jack used a weakness in that kind of code to take control of machines by way of the Internet.
He found a way to bypass having to submit passwords and serial numbers to access ATMs remotely. Once in the machines, he could command them to spit out cash or transfer funds.
He could also capture account data from magnetic strips on credit or bank cards as well as passwords punched in by ATM users.
"When you think about ATM security you generally think about the hardware side; is it bolted down and are the cameras in position," Jack said.
"This is the first time anyone has taken the approach of trying to attack the underlying software. It is time to find software defenses rather than hardware defenses."
Jack did his research on ATMs he bought on the Internet. He also found master keys for stand-alone machines available for purchase online, meaning hackers could walk up and tinker with ATM software, he added.
"We shouldn't dwell on the walk-up attack, because no physical access is required," Jack said. "They have a flaw that lets me bypass all authentication on the device on the Internet, and I am the ATM at that stage."
He didn't reveal specifics of the attack to hackers even though the ATM makers were told of the flaw and have bolstered machine defenses.
"I might get my butt in hot water if I released the code," said the IO Active software security researcher who did the ATM hack 'as a hobby.'
"I was careful not to release the keys to the kingdom."
Jack said he doesn't know if criminals have exploited the software flaw "in the wild" but that it is tough to be certain.
"It is not an easy attack to replicate but I am not naive enough to think I am the only one who can do it," Jack said, admitting he has grown wary of ATMs. "I just keep my cash under the bed now, mate."
Subscribe to:
Posts (Atom)
Posts
