Showing posts with label identity theft. Show all posts
Showing posts with label identity theft. Show all posts

Tuesday, August 26, 2014

Ad by cosstminn | Close This Ad Technology Russian Hackers Amass Over a Billion Internet Passwords

By NICOLE PERLROTH and DAVID GELLESAUG. 5, 2014

A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say.

The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites. Hold Security has a history of uncovering significant hacks, including the theft last year of tens of millions of records from Adobe Systems.

Hold Security would not name the victims, citing nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable. At the request of The New York Times, a security expert not affiliated with Hold Security analyzed the database of stolen credentials and confirmed it was authentic. Another computer crime expert who had reviewed the data, but was not allowed to discuss it publicly, said some big companies were aware that their records were among the stolen information.

Alex Holden of Hold Security said most of the targeted websites were still vulnerable. Credit Darren Hauck for The New York Times

Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites,” said Alex Holden, the founder and chief information security officer of Hold Security. “And most of these sites are still vulnerable.”

Mr. Holden, who is paid to consult on the security of corporate websites, decided to make details of the attack public this week to coincide with discussions at an industry conference and to let the many small sites he will not be able to contact know that they should look into the problem.

There is worry among some in the security community that keeping personal information out of the hands of thieves is increasingly a losing battle. In December, 40 million credit card numbers and 70 million addresses, phone numbers and additional pieces of personal information were stolen from the retail giant Target by hackers in Eastern Europe.

And in October, federal prosecutors said an identity theft service in Vietnam managed to obtain as many as 200 million personal records, including Social Security numbers, credit card data and bank account information from Court Ventures, a company now owned by the data brokerage firm Experian.

But the discovery by Hold Security dwarfs those incidents, and the size of the latest discovery has prompted security experts to call for improved identity protection on the web.

“Companies that rely on user names and passwords have to develop a sense of urgency about changing this,” said Avivah Litan, a security analyst at the research firm Gartner. “Until they do, criminals will just keep stockpiling people’s credentials.”

Websites inside Russia had been hacked, too, and Mr. Holden said he saw no connection between the hackers and the Russian government. He said he planned to alert law enforcement after making the research public, though the Russian government has not historically pursued accused hackers.

So far, the criminals have not sold many of the records online. Instead, they appear to be using the stolen information to send spam on social networks like Twitter at the behest of other groups, collecting fees for their work.

But selling more of the records on the black market would be lucrative.

While a credit card can be easily canceled, personal credentials like an email address, Social Security number or password can be used for identity theft. Because people tend to use the same passwords for different sites, criminals test stolen credentials on websites where valuable information can be gleaned, like those of banks and brokerage firms.

Like other computer security consulting firms, Hold Security has contacts in the criminal hacking community and has been monitoring and even communicating with this particular group for some time. Continue reading the main story How to Keep Data Out of Hackers’ Hands

For people worried about identity theft and privacy, the discovery by Hold Security of a giant database of stolen data is highly personal. But there are steps everyone can take to minimize the hackers’ impact.

The hacking ring is based in a small city in south central Russia, the region flanked by Kazakhstan and Mongolia. The group includes fewer than a dozen men in their 20s who know one another personally — not just virtually. Their computer servers are thought to be in Russia.

“There is a division of labor within the gang,” Mr. Holden said. “Some are writing the programming, some are stealing the data. It’s like you would imagine a small company; everyone is trying to make a living.”

They began as amateur spammers in 2011, buying stolen databases of personal information on the black market. But in April, the group accelerated its activity. Mr. Holden surmised they partnered with another entity, whom he has not identified, that may have shared hacking techniques and tools.

Since then, the Russian hackers have been able to capture credentials on a mass scale using botnets — networks of zombie computers that have been infected with a computer virus — to do their bidding. Any time an infected user visits a website, criminals command the botnet to test that website to see if it is vulnerable to a well-known hacking technique known as an SQL injection, in which a hacker enters commands that cause a database to produce its contents. If the website proves vulnerable, criminals flag the site and return later to extract the full contents of the database.

“They audited the Internet,” Mr. Holden said. It was not clear, however, how computers were infected with the botnet in the first place.

By July, criminals were able to collect 4.5 billion records — each a user name and password — though many overlapped. After sorting through the data, Hold Security found that 1.2 billion of those records were unique. Because people tend to use multiple emails, they filtered further and found that the criminals’ database included about 542 million unique email addresses.

“Most of these sites are still vulnerable,” said Mr. Holden, emphasizing that the hackers continue to exploit the vulnerability and collect data.

Mr. Holden said his team had begun alerting victimized companies to the breaches, but had been unable to reach every website. He said his firm was also trying to come up with an online tool that would allow individuals to securely test for their information in the database.

The disclosure comes as hackers and security companies gathered in Las Vegas for the annual Black Hat security conference this week. The event, which began as a small hacker convention in 1997, now attracts thousands of security vendors peddling the latest and greatest in security technologies. At the conference, security firms often release research — to land new business, discuss with colleagues or simply for bragging rights.

Yet for all the new security mousetraps, data security breaches have only gotten larger, more frequent and more costly. The average total cost of a data breach to a company increased 15 percent this year from last year, to $3.5 million per breach, from $3.1 million, according to a joint study last May, published by the Ponemon Institute, an independent research group, and IBM.

Last February, Mr. Holden also uncovered a database of 360 million records for sale, which were collected from multiple companies.

“The ability to attack is certainly outpacing the ability to defend,” said Lillian Ablon, a security researcher at the RAND Corporation. “We’re constantly playing this cat and mouse game, but ultimately companies just patch and pray.” Nicole Perlroth reported from San Francisco and David Gelles from New York City.

Friday, December 06, 2013

10 Ways to Protect Yourself Against Identity Theft

Protecting yourself against identity theft is always easier than having to clear your name and credit record after the fact. It can take a lot of your time and even some of your own money to clear your name if you are a victim. So, here are 10 things you can do to help protect yourself from becoming one of the 9.9 million victims of identity theft.

#1. Guard your social security number, PINs, passwords and account numbers. Are you walking around with your social security card in your wallet, on your checks and maybe even on your driver’s license? Do you have all your passwords and account numbers written out and shoved in your wallet or purse? If you do, you could make it really easy for a thief to open accounts in your name. Only give out your social security number when absolutely necessary, generally for tax purposes or when applying for credit. For job applications, driver’s license and school identification, your social security number is not usually required. When asked for your Social Security Number for things like driver’s licenses or student IDs, first ask if it is possible to not have it printed on these items. If that isn’t possible then find out how your information will be used and what measures will be taken to protect it..

#2. Monitor bank statements and credit card statements. Make sure you’re looking at your bank and credit card statements regularly, checking for any suspicious activity, such as withdrawals or purchases you didn’t make. If you don’t receive paper statements, make sure you are using online banking to check your statements often. The more frequently you are checking your accounts, the quicker you would catch the theft and contain the possible damage. .

#3. Shred documents. You should shred anything that has personal information on it, like past account statements and any of those pre-approved credit card offers that don’t interest you. You might also consider calling 1-888-5-OptOut or visiting www.optoutprescreen.com to be removed from any future mailing lists for those types of offers. Just know that there might be some good offers out there that you might miss out on. .

Click on the thumbnail to view full-size. Secure Site Example #4. Make sure websites are secure. Whether you’re shopping, banking or paying bills, you need to make sure that the information you share online is secure and won’t be shared with anyone else. Anytime you are about to share personal information, such as your Social Security number, credit card information or bank account number, make sure the site is secure by looking for two things: a yellow lock in the lower right-hand corner of your browser and the “s” on the end of http: in the URL line of your browser. If you don’t see these, find someplace else to shop. .

#5. Be cautious when sharing computers. If you share a computer with a roommate, or use a computer at a library or computer lab, make sure you clear all cookies when you are finished using the computer and always make sure you log out and delete your log in from the computer’s memory. .

#6. Guard your laptop, cell phone, PDA and other technology against theft. Laptops, cell phones and PDAs are hot targets for thieves, so make sure you keep close watch on these items and use strong passwords with a combination of upper and lower case letters, numbers and symbols to protect your data. #7. Keep copies of cards and documents. It’s a good idea to keep a copy of all your identification and credit cards, as well as other important documents, in case they are stolen. This is especially helpful if one or more of your credit cards goes missing because you’ll have the 1-800 numbers and account numbers so you’ll easily be able to call the credit card company and cancel your card. .

#8. Treat mail with care. Always deposit any outgoing mail containing personally identifying information in a post office collection box or at the post office, rather than in an unsecured mailbox. And make sure you get your mail every day. You might consider contacting your bank, credit card provider and other companies that send you bills to switch to paperless billing. If you're planning to be away from home and have no one that can pick up your mail for you, contact the U.S. Postal Service to request a vacation hold. The USPS will hold your mail at your local post office until you can pick it up or can begin receiving it again. .

#9. Avoid phishing scams. Never give out your personal information on the phone, through the mail or via the Internet unless you are sure you know who you're dealing with. Identity thieves may pose as representatives of banks, Internet service providers (ISPs), or government agencies to get you to reveal your Social Security number, account numbers and other identifying information. .

#10. Be cautious when using the ATM. If you’re using a walk-up ATM, a gas pump, a grocery store card swipe machine or any other public debit or credit machine, make sure to keep an eye on the people around you to ensure they’re not “shoulder surfing,” or watching you as you enter in your PIN. Also make sure you take any receipts with you when you are finished with your transaction. Be on the lookout for any unusual equipment on the ATM to ensure a skimming device has not been attached. Another good tip is to cover the keyboard while entering your PIN so that it cannot be recorded by a hidden camera or seen by someone close by.

Monday, October 08, 2012

Skimmers May Use Smartphones To Steal Credit Card Information

) – The increasingly popular radio frequency identification (RFID) credit cards that allow consumers to pay by tapping may be making it easier for crooks to steal valuable information with their smartphones. By tapping machines equipped with radio frequency readers, people can conveniently pay with RFID credit and debit cards without having to enter PIN numbers. According to the owner of Identity Stronghold, Walt Augustinowicz, credit card skimmers made up of about $100 worth of parts easily obtained online can steal enough information to clone credit cards. Similarly, tech-savvy scammers can also use their smartphones to steal information with just a simple tap. As Augustinowicz demonstrated, a hacker can develop a smartphone app or game that looks harmless, but when it gets close enough to an RFID card, the app launches and scans the card’s information and sends the details off to the hacker’s email address. Augustinowicz said that if hackers are talented enough, they can develop RFID information-stealing apps and games that many may mistake as something benign and download them. “Hundreds of people start downloading it, and they just sit back and watch their email box fill up with credit card numbers they can use,” he said. Not all smartphones are at risk for these virus-like apps and games, though. Only phones with near field communication like Google Wallet Android technology that allows for pay by tapping have the safety dangers. pay by tapping have the safety dangers. However, as pay-by-tapping technology becomes more widely used, security expert, Eddie Schwartz, said RFID software will become an industry standard. “It’s a good thing that people are pointing out these vulnerabilities. It forced us as an industry to be more vigilant and to take the necessary steps to protect our assets,” he said. To protect your information, Augustinowicz recommends buying a protective case or wrapping cards in tin foil to block RFID signals.

The Dangers of Using Wi-Fi on Smart Phones

The Dangers of Using Wi-Fi on Smart Phones by Phillip Richards The next time you use your smart phone’s Wi-Fi to access the internet be careful that you are not also exposing yourself to hackers who can actually access information on your phone and login passwords as well. There is a growing threat with the broad use of internet hotspots for hackers to steal information that they gather with fake Wi-Fi gateways. And once these crooks get you to use their Wi-Fi connection they can decrypt the information on your phone and then sell it to 3rd parties or use it themselves to steal your identity. It has been estimated that there are over 100 million smart phone users in the United States alone. And this number continues to grow as smart phones overtake the use of feature phones and the ordinary cell phones that once dominated the market. One of the most useful features of these phones is the ability to access the internet via Wi-Fi. But since this wireless connection to the internet requires no identification, all mobile browsers see is a name of a Wi-Fi hotspot. And even with the best identity theft protection with services like Lifelock and Trusted ID, you are still at risk of identity theft if you access public Wi-Fi hotspots with your smart phone. To make the problem even worse, many smart phones will connect to an available hotspot automatically without the cell phone user doing anything about it. So even if your smart phone is just powered on and just sitting there a crook with the right software and hardware can hack into your personal life when your phone connects to the Wi-Fi connection he has setup. Companies are working on making Wi-Fi more secure, but it is increasingly difficult with more public places making free internet access available. All a hacker has to do is visit a high-traffic public coffee shop or park and setup his own fake Wi-Fi gateway. Then, while a user is surfing the internet and entering usernames and passwords, this information is automatically being picked up with the hacker’s software. Identity thieves are using the information picked up from fake Wi-Fi hotspots to access email accounts, bank accounts, and Facebook accounts and all of this information can be used to steal an identity while the hacker remains completely anonymous. So what can smart phone users do to prevent this? First of all, instead of using a public Wi-Fi hotspot you should just use your phones service provider to access personal accounts. So if you want to check your email, login to Facebook, or check your bank account, just use your phone’s 3g or 4g service. You can still use public Wi-Fi hotspots but only use it for generic internet surfing. Any internet usage that will not give away any personal data should be fine. However, if you know the internet connect is secure you should be ok to use it on your smart phone. If your cell phone has the ability to automatically connect to hotspots whenever they become available you should turn this feature off. Or you can just turn the Wi-Fi off until you know you are going to use it. Having it on just drains your battery anyway, so you really have no reason to leave it on.

Tuesday, February 22, 2011

Here's a great free resource

Hi Everyone ,
Here's another great place that will help you out greatly .Learn from how stuff works

Identity Theft

Thursday, January 27, 2011

It's Tax Time Again

Hi Everyone,
I hope all of you are keeping safe out there. When money is being exchanged the crooks are extra busy and at tax time with so much money and information floating around it pays to be safe. Here's an interesting twist i just heard about.

Extortion Virus Fools Victims Into Thinking They Must Buy Anti-Virus Software


Friday, July 02, 2010

What's Old Is New Again

Hi Everyone,
By now you've all heard about the gang of Soviet spies we had here in the states. One of the suspect went old school dumpster diving and graveyard hunting to create a new identity. It was discovered by the deceased's brother.

Soviet Spies

Thursday, June 10, 2010

Health Care Law Scams

State insurance commissioners and attorney generals are warning consumers about a new wave of scams that are exploiting uncertanties about the new health care laws. Scam artits may call, email or show up at your door saying that under the new law you must have health insurance or got to jail.

This is not true. Never signup for an insurance policy without calling you state insurance department to findout if the policy is legitimate and the seller is liscensed. Never give out your credit card number or social security number to anyone you don't know.

Thursday, April 22, 2010

Special Alert

Hi Everyone,
It's the time of year where everyone is starting to get outside and travel a lot more which canleave you open to this scam which has been reportedly spreading quickly .

ATM Users Warned About Credit Card Skimmers
April 22, 2010 02:04 PM
(Washington Post) — Cases of a hard-to-detect form of credit card fraud are showing up more frequently in the Washington region, police say, including a recent case in Rockville, where a skimming device that reads encrypted credit card data was found in a Wachovia bank branch ATM. A credit card skimmer is a device that uses a card scanner and camera to capture credit card information. The skimmer is placed over the card slot reader and reads the magnetic swipe, while a hidden miniature camera in the device works in tandem to record the personal identification number

More on Credit Card Scimmers

Thursday, March 18, 2010

Please Don't Lose Your Mind

Hi Again,
In today's world of everyone trying to get in on the social craze some of us go overboard and overshare . This can leave us open to a wide variety of crime including credit card fraud and identity theft among others. To see what I mean check out

Please Rob Me

Wednesday, March 03, 2010

Microsoft Scores One For The Little Guy

Hi Everyone,

In the never ending battle against hackers it seems Microsoft is taking an aggresive approach to hinder the attacks leading to credit card fraud and identity theft this includes spam an malware

Stop Identity Theft

Tuesday, February 16, 2010

A Never Ending Battle

Identity theft and credit card fraud is constantly growing but hackers are being caught. here's a who's who of been causing all the chaos.

Convicted: Nine Notorious Hackers of Our Time

Tuesday, August 04, 2009

Man Spends 35 Years Trying To Clear His name

Hi Everyone,
I've been saying for years that becoming a victim of identity theft is like falling into a black hole. Many think it's just all hype but here is a real life example.

Read 35 yr.Identity Theft Story here

Monday, January 26, 2009

Major Data Breach Puts Millions At Risk

If the market meltdown, housing and bank crises weren't enough, U.S. consumers can now add the potential of massive credit and debit card fraud to the list financial concerns. A major processor of credit card transactions just disclosed its system had been hacked, putting millions of consumers at risk.

--------------------------------------------------------------------------------

The cyber-thieves went straight to the heart of one of the biggest and most respected credit and debit card processing companies in the country, Heartland Payment Systems of Princeton, N.J.

"It could be the largest breach ever," said cyber law attorney Andrew DeVore. "It would dwarf the largest prior breach."

Sources tell CBS News that hackers cracked Heartland's computers as far back as May of last year. But it wasn't until last week, after being alerted to suspicious activity by Visa and MasterCard, that the company uncovered malicious software in its system.

Heartland, which acts as a middle man between retailers and banks, processes 100 million transactions per month at an estimated 200,000 merchants nationwide - mainly gas stations, bars and restaurants.

The company says about it has alerted about 150,000 of them, but CBS News found several that didn't learn about the breach until we told them.

"I'm disappointed from that point of view that they wouldn't be up front and proactive. Because customers trust us to protect their records and they are the keeper of the record,'' said bar owner Peter O'Connell.

I think the release of information was a bit manipulative in the timing.

Security analyst Avivah Litan of Gartner GroupNow there are concerns the public company has downplayed the danger to untold millions of consumers.

"I think the release of information was a bit manipulative in the timing," said security analyst Avivah Litan of Gartner Group. "It was released on inauguration day, but the incident was known about for days before that."

The president of Heartland originally agreed to an interview with CBS News before canceling. We wanted to ask why the company's inauguration day in which it didn't even mention that millions of credit card numbers and expiration dates - the only information needed for fraud - were stolen.

Only today did Heartland say it doesn't know how many card numbers were compromised. It's only advice was for consumers to check their own statements to make sure they're not the latest victims of financial fraud.

Thursday, November 20, 2008

Happy Holidays

Well the year is almost coming to a close and the holiday season is upon us. During this time it pay st obe extra vigilant while using your personal info. CBS News has had and excellent expose on Identity Theft in it's many forms if you missed it there links are a must see.

Your Id being sold online
Stolen Pictures
Medical Id Theft

Tuesday, October 16, 2007

Beware Of The Frog!!??

Hello again,
This is hot news for you or anyone you know is online this is a must read before you login again!!


Beware of the frog11