The Item for today is "Another Way to Lose Your Identity."

Well, as you'd expect, the bad guys have found another way to launch an attack against us.

PORTLAND, Ore. - Users of the popular social Web site Facebook are being warned that a computer virus is being spread through a well-disguised e-mail masquerading as a video from a friend.

The site boasts over 60 million registered users, including many employees at KATU.

Reporter Dan Tilkin recently registered on the site on the advice of friends and co-workers and received what he thought was a friendly e-mail from a former producer.

A link in the e-mail led him to a Web site that appeared to play a video and prompted him to update his computer's software to see the video.

However, the download was a virus instead.

It's not clear exactly what the virus does, but it should be assumed the purpose is malicious. A computer virus is also commonly referred to as "malware," which is short for "malicious software."

Many viruses scour a computer for personal information including banking and credit card information and then send it out of the country where hackers use it steal funds from the victim.

A virus can also turn a computer into a "zombie" and help to spread the virus to other computers or launch Denial of Service attacks on Web sites without the owner realizing what is taking place.

Computer experts warn users never to download any file with an ".exe" prefix sent from anyone, even if they are a friend, and to carefully monitor what page your browser lands on.

http://www.komonews.com/news/tech/27449439.html

The Big Enchiladas Get Caught!

We've dribbling out cases of spammers and hackers recently arrested. Now we can report on the largest ID theft case in history!



11 are charged with massive ID theft:
41 million credit card numbers allegedly stolen in global theft ring

This is the version in The Boston Globe, August 6, 2008

A ring of people spread across the globe hacked into nine major US companies and stole and sold more than 41 million credit and debit card numbers from 2003 to 2008, costing the companies and individuals hundreds of millions of dollars, federal law enforcement officials said yesterday.

"So far as we know, this is the single largest and most complex identity theft case ever charged in this country," US Attorney General Michael Mukasey said at a news conference at the John Joseph Moakley US Courthouse in Boston.

A grand jury indictment released yesterday charged that Albert "Segvec" Gonzalez of Miami, the alleged ringleader, and his 10 conspirators cruised around with a laptop computer and tapped into accessible wireless networks.

They then hacked into the networks of TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Dave & Buster's, Sports Authority, Forever 21, and DSW. After gaining access to the systems, they installed programs that captured card numbers, passwords, and account information, officials said.

In addition to Gonzalez, two other Miami residents were charged in Boston and eight other alleged conspirators were charged in San Diego. The defendants - one from Estonia, three from Ukraine, two from China, one from Belarus, and one of unknown origin - allegedly concealed the data in encrypted computer servers they controlled in Europe and the United States. They sold some of the numbers, via the Internet, to other criminals, authorities alleged.

The suspected hackers also encoded some of the stolen numbers on the magnetic strips of blank credit or debit cards, which were then used to withdraw tens of thousands of dollars from ATM machines, officials said.

It was not clear how much of the stolen information had been used.

Rene Palomino Jr., a Miami lawyer representing Gonzalez, said his client will be proven innocent. "The government will have an uphill battle to prove their allegations," said Palomino, who declined to comment on the specific allegations.

Lawyers for the other men charged in Boston did not return calls.

Part of the scheme came to the public's attention early last year, when TJX, the Framingham-based retailer that runs T.J. Maxx, Marshalls, and other stores, found that credit and debit card information had been stolen from its computer systems.

In a statement yesterday, TJX officials called on credit card companies to improve security measures to protect consumers.

"The sheer number of retailers attacked by these cyber criminals demonstrates the much broader challenges in protecting sensitive consumer data from this increasing threat," said Sherry Lang, a TJX spokeswoman. "Broader action beyond retailers alone is required to protect consumer data. Banks and the US payment card industry must join retailers and work together."

Lang called for installing proven card security measures that are in use throughout much of the world.

Ted Julian, vice president of strategy and marketing for Application Security Inc. in New York, said the indictments reflect the changing tactics of cyber-criminals. Rather than go after individual consumers, hackers are targeting major retailers, such as wireless networks, to access troves of personal data.

"There are thousands of conduits to customer data. Security isn't working and TJX is the poster child of a big data breach," Julian said. "What is needed is a different approach to secure that data far more directly where it lives."

Officials at BJ's Wholesale Club of Natick, which settled charges in 2005 with the Federal Trade Commission that it failed to take appropriate security measures to protect the sensitive information of thousands of its customers, said they are pleased by the case's progress.

"We instituted significant system upgrades . . . and we are continuously employing measures to help protect data against the ever-increasing sophistication of thieves," the company said in a statement.

At yesterday's news conference, Mukasey said that over the past three years, officials and undercover agents from various federal agencies received help from investigative agencies worldwide.

"The message is simply this: We will track you down wherever you are in the world," Mukasey said. "We will see that you are arrested, and you will go to jail."

Officials said Gonzalez was previously arrested by the Secret Service in 2003 for access device fraud. The Secret Service later discovered that Gonzalez, who was working as a confidential informant for the agency, had become involved in the credit card theft case. He is now in a federal prison in New York awaiting trial on related charges.

Christopher Scott and Damon Patrick Toey of Miami were also charged in Boston. Maksym "Maksik" Yastermskiy, Dzmitry Burak, and Sergey Storchak of Ukraine; Aleksandr "Jonny Hell" Suvorov of Estonia; Hung-Ming Chiu and Zhi Zhi Wang of China; Sergey Pavlovich of Belarus; and a person known only by the online nickname of "Delpiero" were charged in San Diego.

The indictments charge the defendants with crimes related to the sale of the stolen credit card data. Charges included conspiracy to possess unauthorized access devices, possession of unauthorized access devices, trafficking in unauthorized access devices, identity theft, aggravated identity theft, aiding and abetting, trafficking in unauthorized access devices, conspiracy to launder monetary instruments, and trafficking in counterfeit access devices.

The San Diego charges allege that Yastremskiy, Suvorov, Chiu, Wang, Delpiero, Pavolvich, Burak, and Storchak operated an international stolen credit and debit card distribution ring with operations from Ukraine, Belarus, Estonia, China, the Philippines, and Thailand. The indictments allege Yastremskiy earned more than $11 million from his illicit operation.

In May, prosecutors charged Gonzalez, Suvorov, and Yastremskiy with hacking into computer networks run by the Dave & Buster's restaurant chain and stealing credit and debit card numbers from at least 11 locations. They allegedly gained access to the cash register terminals and installed at each restaurant a computer code configured to capture credit and debit card numbers as the restaurants processed them.

At one restaurant, the so-called "packet sniffer" captured data for about 5,000 credit and debit cards, eventually causing losses of at least $600,000 to the financial institutions that issued the credit and debit cards, authorities said.

Richard Walega, a New Bedford city employee who had $6,700 in fraudulent charges appear on his bank card weeks after shopping for Christmas presents at a T.J. Maxx store in Westborough in 2006, said he was "aghast" at the scope of the crimes.

Walega said he hasn't returned to T.J. Maxx and is still awaiting a settlement from the company, which has offered vouchers, cash benefits, credit monitoring, identity theft insurance, and reimbursements to eligible victims.

"It's totally mind-boggling," he said. "I hope this is the end of the trail."

That our security systems have been so porous and weak is the real story here. that corporations still don't have robust defenses against ID theft is the tragedy!

Just RANTING

1.

I have been saying for months that the FTC’s “Red Flag Rule” was never intended to be all encompassing. As many of you know there has been a difference of opinion on this subject with some individuals going as far as using the rule as a scare tactic in order to profit. In my opinion, there is enough to worry about as a business owner in regards to identity theft without having such profiteers lurking about. Finally, the FTC is weighing in on this subject. I have included a recent article that addresses this issue.
http://www.consumeraffairs.com/news04/2008/07/red_flag.html

2.

Now, I am speaking to the companies that are out there offering “compliance training” and charging thousands of dollars and to the insurance agents selling identity theft services and products: Be careful and do what is right for the client.

It is only a matter of time before every adult individual in the United States will be carrying an identity theft policy/service in their portfolio. Be patient and offer the best product - not the most convenient one. The sales will come.

Remember, insurance agents make their real money in residual income. If you are seen as a partner of your client instead of seeing your client as a profit center you will realize a long term residual income and more referrals then you alone can handle. NOW go out there and do what is right.

3.

Lastly, keep in mind, “time will promote or expose”. This is very important to all of the companies coming to the market with a new identity theft product. Bring the public the best product you can and the market will reward you. If it is a product like LifeLock or ID Rehab (now Identity Watchdog) you will find out that time will expose their shortcomings. Keep in mind, indecent exposure is still illegal in most places around the world.

The consumer is not STUPID and good advertisement will not conceal the flaws of your product forever.

Moroccan Held for Alleged Royal ID Theft

Just in case you missed it, I wanted to share this small article with you . Next time someone try's to tell you that identity theft will not happen to them, explain to them it can happen to ANYONE anywhere. Here is a case that the thief used Facebook to commit the crime, something I have been warning of for years.

RABAT, Morocco (AP) — Moroccan authorities arrested a man Wednesday for allegedly stealing the identity of King Mohammed VI's younger brother on the social networking Web site Facebook, the country's official news agency said.
Fouad Mourtada, 26, was detained in Casablanca over "villainous practices" linked to the alleged theft of Prince Moulay Rachid's identity, the MAP agency reported, citing unidentified police officials.
The report did not elaborate, but said members of the royal family have no Web sites or blogs, and that the only official way to obtain information about them was through the MAP agency.
Facebook, one of the world's most popular online hangouts, claims more than 61 million active users.

The archeological deposit of trillions of data rats

Here we go again! The use of Social Security numbers for every random, routine activity has left an archeological deposit of trillions of data rats nests scattered all over the landscape of the United States.

Until a few years ago professors at a major US University reported that they had to fill out a new form every semester with all their info INCLUDING SOCIAL SECURITY NUMBER to obtain an activated key so they could access the multimedia cabinet in their classrooms. Most of these forms were faxed top the office where this was done and were stuck in cabinet somewhere.

The announcement of the data breach below follows the industry standard phrase “We want to assure you that there is no evidence that the computer intruder accessed the files containing Social Security numbers.” Usually the lawyers also add “There is no evidence that any of the information has been used in any identity thefts.”

All we can say is “Yeah, right!”

Here is the latest case study for you to study.

DATE: Dec. 11, 2007

TO WHOM? Iowa State University Faculty and Staff:

WHAT? “A security breach recently was discovered on a server in the Office of
Sponsored Programs Administration. Old files found on that server contained the names and Social Security numbers of approximately 2,900 faculty and staff who submitted proposals through the OSPA GoldSheet process prior to Jan. 1, 2006.

“We want to assure you that there's no evidence that the computer intruder accessed the files containing Social Security numbers. Our technical experts believe the primary motive was to store movies and hacker-related software.”

Two servers at OSPA were breached by the intruder, but only one computer contained files with Social Security numbers. The security breach was reported to Information Technology Services staff on Monday, Nov. 26. The server had already been removed from the campus network. A thorough examination of the server over several days yielded files containing names and SSNs.

Over the past couple of years, Social Security numbers have been removed from all central systems and business processes, except where the SSN is required. This incident points to the urgency to inspect old files and remove Social Security numbers that once were a routine part of university reports. If you need assistance in finding protected information on your computer or would like to know more about securing your computer, please contact …………., ITS security.

We regret any inconvenience or distress this security breach may cause.
We do not think it is likely your information was accessed, but if you are concerned, please see the resources below.

If you have concerns or comments on this security incident, please feel
free to contact either of us.
Michael McCoy @ insurancenow@hotmail.com
Dr. Steffen Schmidt @ steffenschmidt2005@gmail.com

ADDITIONAL RESOURCES:

What should I do if I am concerned about possible identity theft?

1. Place a fraud alert on your credit report. This tells creditors to contact you before opening any new accounts or making changes to current accounts. The Federal Trade Commission offers more information on how to place a fraud alert at http://consumer.gov/idtheft

2. Get a copy of your credit report from the three major credit bureaus
(Equifax, Experian, and TransUnion) and make sure all accounts on that report belong to you. You're entitled to a free annual credit report from the three major credit bureaus. See: https://www.annualcreditreport.com/

26 Years of Non Public Information Shared by U.S.D.A.

Apparently individuals that applied for federal grants through the USDA didn’t read the fine print. It was not explained to them that their names and Social Security numbers (non-public information) were going to be shared with the world.

Below was a statement by the USDA -

“USDA believes that immediately prior to April 13th, the website in question contained private identification information relating to approximately 47,000 individuals who receive USDA funding from the Farm Service Agency and USDA Rural Development. USDA has identified between 105,000 and 150,000 individuals whose private information has been entered into a federal government database at some time during the past 26 years. USDA is in the process of notifying, via registered mail, all 150,000 people whose information was exposed and offering them the opportunity to register for free credit monitoring for one year.”

Once again one of our trusty government agencies gives us an identity theft headline. I guess maybe I should not complain, it does give me job security.