Subscribe
Printer Friendly
Share this PageTechnology
The BBC is reporting that 25 million Britains were exposed to the threat of identity theft when the HM Revenue & Customs (similar to the IRS in the U.S.) lost a CD containing personal data.
Ouch!
This has to be one of the worst data breaches ever, since the CD was not encrypted (just password protected) and the data included:
- Name
- Address
- Date of birth
- Bank account details
- National insurance number
In case you're not familiar with that last item, it's similar to the Social Security Number here in the U.S. What else could a potential thief want?
The CD with the data was sent to another HMRC location by a lower level employee via regular mail instead of using an encrypted network connection or some other secure method. The CD never showed up at the other office and officials are now trying to determine if it was stolen or just lost.
"The data lost - bank account numbers, names and addresses - represents a gold mine for the thieves and is much more valuable to them than credit card numbers or taxpayer id numbers," said Gartner analyst Avivah Litan.
"In fact, in the black market, bank account numbers sell for the highest price, or between $30 and $400 (£15 to £200), which is significantly more than the fifty cents to five dollars that criminals pay for credit cards."
This disaster has already forced the resignation of HMRC's chairman - Paul Gray. I'm guessing the employee involved was also "sacked," as the Brits like to put it. Let's hope so.
More coverage on the BBC site - Q&A: Child Benefit Records Lost | Analysis: How Worried Should You Be?
Who would have thought that a big company like SuperValu would be susceptible to an e-mail scam and almost lose $10 million?! Well, it happened just a few months ago. In February they received e-mails supposedly from American Greetings Corp. and Frito-Lay indicating new bank accounts had been set up and payments should be wired to these new accounts.
Has anyone at SuperValu ever read about "phishing' or other email scams? I guess not...
Without making any inquiries with the two companies about the change in accounts, SuperValu just started sending payments to the accounts indicated in the e-mail. After a week, nine payments and $6.5 million later, it was discovered that the new account with American Greetings was fraudulent. Meanwhile, another $3.6 million was being sent to the fraudulent Frito-Lay account. Luckily, for SuperValu, the FBI was able to get right on it and recover the money before it disappeared.
“SuperValu was the target of attempted financial fraud,” company spokeswoman Haley Meyer wrote in a prepared statement. “We were able to quickly discover and report this to the FBI. As a result of the quick work of the Boise FBI Office and the U.S. Attorney, any funds lost are minimal.”
Fortunate as it may seem, it’s not quite time to break out the bubbly. American Greetings and Frito-Lay are demanding that they get paid – and rightly so. But the matter has been turned over to a judge to decide how the money is going to be allocated. It’s a shame that such fairy-tale endings don’t happen for most individuals who fall victim to e-mail scams. Here's the link the the whole tale from the Idaho Statesman.
Who would have thought that befriending a frog could be dangerous? Well, it is, if that frog has access to things like your e-mail address, birth date, home address, work info or school info. You may say to yourself that you would never be so foolish, but what kind of info do you post on social network pages?
The security company Sophos did a study and to find out what kind of information people are sharing and how easy it is to get hold of it. So, they created “Freddi Staur” - a fake Facebook user - then sent out 200 friend invites.
“Of the 200 people contacted, 87 responded and agreed to be friends … 82% of them gave "Freddi" an open view of their profiles … 72% divulged at least one of their e-mail addresses, 84% gave up their date of birth, and 87% offered details about where they went to school and where they work.”
Having personal information on your profile isn’t the problem. The problem is who has access to the info because it could be used to steal your identity. While it may be cool to have lots of friends - even if it's just a frog - you need to stop and think what kind of information you are giving them and how safe you really are.
Read all the study details on the Sophos web site.
Update:
If one study isn't convincing enough, here is another. The BBC show Watchdog did a very similar study to Sophos study. They created a false identity and befriended people on facebook. Then they took their study one step further. They actually opened bank accounts and credit cards using the information of an individual that was provided on their profile! Social networks are not as safe as we would like to think. Read all the study details on the BBC web site.
Need another reason to be cautious of social networks? Here's one, facebook employees can track what profiles you are looking at. Yep, not only can the look at anyone's profile they can track the profiles that people look at. While it may weird you out, it also helps keep people safe. Check out the story and decide for yourself.
Netcraft, a provider of internet security services and research, is reporting that a recent batch of phishing web sites targeting Chase Bank and eBay were hosted by state-owned Chinese Construction Bank. This apparently is the first time a bank's servers have been used to attack another bank.
The phishing emails were sent out in mid-March offering $20 for users to fill out a survey. As part of the survey, users were asked for their account username and password, credit card number, PIN, and security number as well as their SSN and mother's maiden name. The phishing pages were hosted on an IP address assigned to China Construction Bank, Shanghai Branch.
It's unclear if the attack was generated by the bank itself, by one of its employees, or by someone who had compromised the bank's servers.
Fidelity Investments lost a laptop that had sensitive employee information for 196,000 current and former HP employees. The employes were told this week that they are at risk for identity theft and that they should take steps to protect themselves.
Here's part of the email that went out to HP employees:
"This is to let you know that Fidelity Investments, record-keeper for the HP retirement plans, recently had a laptop computer stolen that contained personal information about you, including your name, address, social security number and compensation."
A web site has been set up that "includes some immediate steps that you can take to protect yourself, as well as information about how to enroll for a 12-month period of credit monitoring at no cost to you and a Fidelity call center number in case you have additional questions."
This is just the latest in string of laptop losses that have affected employees at Sun, Cisco and IBM. It's unclear if the laptops are being targeted because of the information they contain, or if it's just random theft. My guess would be random theft.
When I worked in the corporate world, laptops disappeared on a regular basis. Thieves are able to dress like the typical corporate type (tan slacks, blue dress shirt, just the right amount of hair mousse) and sneak into one of our offices. From there they'd look for an unattended laptop, pick it up, and carry it out the door as if they were rushing off to attend the next staff meeting.
Anyway...
Fidelity has good news for those affected. It appears the data was encrypted and the encryption key has expired on the machine - making the data more difficult to extract.
Here's Fidelity's take on the situation:
"At this time, we are unaware of any misuse of the information contained in the software on the laptop," said Fidelity spokeswoman Anne Crowley. "The application was running on a temporary license from a third-party software vendor. The license has expired. Since the expiration of the license, the scrambled data would be difficult to interpret and generally unusable.
We have taken steps to implement extra security processes requiring additional authentication for access to those HP accounts as well as other measures to prevent unauthorized use. We have also employed additional security controls above and beyond our already significant monitoring activity to identify if there is any unusual activity in these accounts. Further, we have reviewed activity in the HP accounts and have found no indication of unusual or suspicious activity."
The bottom line is that no matter how careful you are, someone else's blunder can expose you to identity theft. The only way to avoid it is to withdraw from modern society. I'd personally rather have the 401k money.
Remember that scene in National Treasure where Nicolas Cage pulls a thumb print off Diane Kruger's champagne glass and uses it to get into the super-secret room housing the Declaration of Independence? If not, rent it tonight and take a look.
So, is that really possible or is it just one of those movie-inspired myths? Unfortunately for security vendors, it's pretty close to the truth.
A study at Clarkson University revealed that fingerprint scanners were fooled 90% of the time by fake fingerprints created from gelatin, dental plaster, or even Play-Doh! Another option is for a thief to just cut one of your fingers off and use it on the scanner.
So should you care about this high-tech biometrics stuff? What does this have to do with your life? Well, the Albertsons grocery store chain has recently implemented a biometric finger scan for payment and identification in some stores and both Wal-Mart and Costco are supposedly discussing doing the same thing.
Before there's wide-spread adoption, hopefully these security questions will be resolved. One company trying to do that is Luminetx. They recently patented their vein scanner (designed initially for medical purposes) for use in biometric scans. Evidently your vein layout is extremely unique and can't be faked or bypassed (so far).
Whether it's your finger, eyeball, or arm, get ready for high-tech features at your local grocery or big box store. They're coming.
I've seen a number of stories, most recently in yesterday's Times Online, that describe surprise and fear over what Google knows about its users.
This is silly, in my opinion.
Sergey Brin and Larry Page - Founders of Google
The Times Online headline is "Big Google is Watching You" and the article states:
"Google has an extraordinary amount of information about its users. It logs all the searches made on it and stores this information indefinitely. Because every computer has a unique IP (internet protocol) address, every visit to every website can be traced back to the computer making it — a fact which is well known in geek circles but remarkably under-publicised outside them."
and
"Users of Google’s Gmail service, who are already having their e-mails scanned to place targeted ads, have given the company their identity, a full record of all their searches and copies of all their e-mails, stored indefinitely. Users of Google’s Toolbar are inadvertently giving the company a list of not just all their searches but also of every single website they visit. And, as the lawsuit makes clear, all this information is potentially vulnerable to subpoena."
Maybe I'm one of those geeks that realizes that this happens on virtually EVERY web site you visit.
What's a Log File and What Does it Look Like?
When you visit a web site, most will keep a log of what information is requested along with the IP address of who requested it. What does the log file look like? Here's a real sample from the Fight Identity Theft site:
192.168.1.100 - - [29/Sep/2005:09:56:28 -0400] "GET /how-to-report-scams.html HTTP/1.1" 200 22806 " http://search.yahoo.com/search?p=how+to+report+a+scam" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
So here's what this glob of code shows...
- First is the person's IP address (I changed it to protect the visitor's privacy)
- The date and time of the request
- What was requested (in this case, our "How to Report Scams" page)
- The referring web site (in this case, the person did a Yahoo search for "how to report a scam")
- The type of browser being used (Microsoft Internet Explorer 6)
- And the operating system (Windows NT 5.0 = Windows 2000)
This is how web sites work. They collect data and log the data for later analysis (e.g. "How many people visit my homepage?" "What did a person search for to find my web site?", etc.)
What Information Are You Sharing and Can You Hide It?
So what information are you sharing as you browse the web? ShowIpAddress.com is one of many sites that will show you what a log file can capture about you. The only personally identifiable piece of information is your IP address. That number is assigned to you by your Internet Service Provider (ISP). One way or another that number can be traced back to you as an individual, even if you are surfing during work at a Fortune 500 company or other large organization.
Does that make you scared, angry, or just plain nervous? Maybe it should, maybe it shouldn't. In either case, you can browse anonymously if you choose.
There are many products and services that allow you to web surf anonymously. Most will route your requests through their servers, thus hiding your IP address. Anonymizer.com has been around for a long time and they provide a service where you can use their site to browse anonymously for free.
But, back to Google...
Are they evil because they log this information? Powerful, yes, because so many people use their services, but I wouldn't say evil.
When I choose to sign up for a service like Gmail, I know that they will be reading my email content so they can serve up related ads. That's how they make money. That's how I can have a 2.5 gigs of free storage for my messages. Yahoo has a similar policy. Same with MSN Hotmail.
When I choose to use Google search I have to know that they log what I'm searching for and analyze it to spot user patterns. The same thing happens at Yahoo and MSN.
I have to realize that sites, like Google, store this information and will use it to improve their product and to make money. I also have to realize that it could be handed over to the government.
This is all part of the trade-off we make every day between security/privacy and convenience. If you are extremely concerned with privacy you probably shouldn't be using the internet and you certainly shouldn't sign up for a service that clearly states it will read and store your email messages. If you're concerned that your search history or email messages could be revealed at a later date you should consider using a product that protects your anonymity, like Anonymizer.
Here's the bottom line...
When information is aggregated, abuses, information leaks, subpoenas, and profiteering can occur. When it does occur it should be exposed and fought. I just don't see where Google has done anything evil or different than any other web site on the internet.
Feel differently? Then please append a comment to this story.
If you're a victim of identity theft, you will likely need to contact banks, credit card companies, and department stores. Most companies have what's called an Interactive Voice Response (IVR) in place to "help" you.
These systems can be very frustrating, especially when you're stressed out and just need to talk to a fellow human being to work out your problems. That's where the IVR Cheat Sheet comes in handy.
Paul English, Boston resident and CTO of travel search engine company Kayak.com, decided to take matters into his own hands and create a cheat sheet for major institutions in the U.S. and the U.K.
Here are some examples of what you'll find:
- Trans Union - 800-916-8800. No cheat is necessary. Just press 2 and you're connected directly to a real person.
- Bank of America - 800-900-9000 and press 0.
- MasterCard - 800-MC-ASSIST and then press 000 on each menu.
- PayPal - 402-935-7733 and then say "agent."
- eBay - 800-322-9266 and then press 0,0.
Isn't this fun! The list contains over 259 companies as well as a how-to guide for companies that aren't listed.
Here's the link: The IVR Cheat Sheet
Peer-to-Peer (P2P) file sharing networks exist so people can download free mp3 files, DVDs, movies, etc. They work by having each member of the network share some personal files while downloading files from other people's computers. Share and share alike, right?
This has understandably driven the RIAA (Recording Industry Association of America) as well as the people in Hollywood crazy. So crazy that they are suing people they catch sharing copyrighted materials. We're not going to go into the ethics either way on this argument. Maybe some other time...
The problem is that people are not only sharing their ripped CDs and DVDs, they're also sharing (accidently, I'm guessing) sensitive files on their hard drive like tax returns, bank statements and cancelled checks.
A blogger recently decided to do a few searches on Gnutella, a major P2P network, for sensitive documents. It took him only 10 minutes to find a handful.
Take a look at what he dug up... (maybe it's your tax return)
What is the lesson you should learn?
- Avoid P2P networks PERIOD! The software that enables the network is often full of spyware and the files you download can be infected with viruses and other malware. Not good.
- Keep control of other users on your computer, especially if they are teenagers. If they install file-sharing software on your computer it may be your tax return (along with your SSN, DOB, address, etc.) showing up all over the internet.
- If you do decide to use file sharing software, make sure you've clearly designated a single folder to share and make sure you don't accidently drop your scanned bank statements in the folder.
Think your check is safe after you fill it out? Think again...
Your writing can be removed using a procedure called "check washing." A solvent is used - usually rubbing alcohol or nail polish remover - to fade out or completely remove what you've put on your check.
Here's a before and after picture:
The check is now ready for a new amount (I'm guessing larger than $10) and a new recipient.
An even better trick for the forger is to cover your signature so it remains in place while everything else is removed.
So how can you avoid becoming a victim of this trick?
Use the right pen.
Based on the excellent testing of Sean Kane, he found that gel pens worked best at resisting these check washing procedures.
See the whole experiment and complete results on Sean's site.
Special Offers
Connect With Us
We invite you to become a fan of Fight Identity Theft or just join in the discussion.
Subscribe to Breaking News
Subscribe to Fight Identity Theft and receive top stories and breaking news via email.
Recent Blog Entries
Blog Archives
- November, 2009 (4)
- October, 2009 (6)
- September, 2009 (2)
- August, 2009 (3)
- April, 2009 (2)
- February, 2009 (3)
- January, 2009 (8)
- December, 2008 (8)
- March, 2008 (1)
- January, 2008 (1)
- December, 2007 (3)
- November, 2007 (2)
- October, 2007 (3)
- May, 2006 (1)
- March, 2006 (4)
- February, 2006 (4)
- January, 2006 (10)
- December, 2005 (7)
- July, 2005 (3)
- June, 2005 (4)
- May, 2005 (5)
- March, 2005 (1)
- Credit (12)
- Fraud (36)
- Government (20)
- Identity Theft (37)
- Junk Mail (5)
- Phishing (12)
- Privacy (19)
- Scam (30)
- Technology (50)
- Telemarketing (2)
- Viruses (11)
- Visitor Stories (1)
- Worms (11)
