UBER - Not only did they have a data breach , they also paid ransom to keep it a secret

The $100K Question would be - Did the hackers really delete the data?

Instead of disclosing the breach, the company paid $100,000 in ransom to the two hackers who had access to the data in exchange for keeping the incident secret and deleting the information instead of disclosing the breach, the company paid $100,000 in ransom to the two hackers who had access to the data in exchange for keeping the incident secret and deleting the information


For More:
https://thehackernews.com/2017/11/uber-hack-data-breach.html

Did you know that Equifax might have your salary info and selling it for $20

Every payroll period, Facebook, Amazon, Microsoft, and Oracle also provide an electronic feed of their employees’ hourly work and wage information to Equifax. So do Wal-Mart, Twitter, AT&T, Harvard Law School, and the Commonwealth of Pennsylvania. Even Edward Snowden’s former employer, the sometimes secretive N.S.A. contractor Booz Allen Hamilton, sends salary and other personal data about its employees to Equifax Workplace Solutions.

If his new prospective employer is among the 70,000 approved entities in Equifax’s verifier network with a “permissible purpose,” that company can purchase his employment and income information for about $20.

That individual has no control over who picks up the phone, whether the right information is actually given out, or if his or her privacy will be respected.”

In May 2017, Equifax informed some of its customers that unauthorized access to their employee tax records continued, undetected, for nearly a year, between April 17, 2016, and March 29, 2017. These Equifax security lapses occurred in another of TALX’s databases, the Tax Form Management platform, after “crooks were able to reset the 4-digit PIN given to customer employees as a password and then steal W-2 tax data after successfully answering personal questions about those employees,”

For More:
https://www.fastcompany.com/40485634/equifax-salary-data-and-the-work-number-database

Threatened with legal action - For trying to expose the vulnerability.

I guess the researcher should create an exploit and sell it in the black market.

Remember:

1. Any system that claims to be secure but does not allow to be inspected is WORSE than a insecure system.
2. In security what you don't know CAN HURT YOU.

From the article:

While the vendors' descriptions made large claims about how secure their cameras were, Gnesa found undocumented backdoors and remotely exploitable vulnerabilities

He would have presented all of this information at next week's conference until he was threatened with legal action from an unnamed vendor of one of the cameras.

Garcia and a number of other researchers discovered that millions of vehicles were vulnerable to remote hacking and effective immobilisation.
When they presented their research to Volkswagen in 2013, they were promptly smacked with an injunction in the UK high court and their work was suppressed until recently.

For more information:
http://www.scmagazineuk.com/security-expert-cancels-talk-on-back-of-legal-threat/article/444136/

Security Researcher detects vulnerability - And Starbucks considers it FRAUD?

But, it also claims that it fixed this issue after being informed by this researcher.

From the Article:

Egor Homakov of the Sakurity security consultancy found a weakness known as a race condition in the section of the Starbucks website responsible for checking balances and transferring money to gift cards. To test if an exploit would work in the real world, the researcher bought three $5 cards. After a fair amount of experimentation, he managed to transfer the $5 balance from card A to card B, not just once as one would expect, but twice. As a result, Homakov now had a total balance of $20, a net—and fraudulent—gain of $5.

The researcher went on to visit a downtown San Francisco Starbucks location to make sure his attack would actually work. He used the two cards to make a $16.70 cent purchase. He went on to deposit an additional $10 from his credit card "to make sure the US justice system will not put us in jail over $1.70," he explained in a blog post.

"It was just completely uncalled for claiming that I committed fraud," Homakov said of the latter call. "It made me angry."

More here

http://arstechnica.co.uk/security/2015/05/researcher-who-exploits-bug-in-starbucks-gift-cards-gets-rebuke-not-love/

A chain is only as strong as its weakest link, - You (Example :- JP Morgan) will get hacked even if you spend $250 Million every year

There are two thinks I always remember

1. A chain is only as strong as its weakest link (So, know what you want to protect and then find the the right method (simple is always best) to protect it)
2. Security is Part philosophy (Sometimes what you think and believe may not be the best method of protection so, listen well and adapt quickly)

From the Article

Big corporations like JPMorgan spend millions — $250 million in the bank’s case — on computer security every year to guard against increasingly sophisticated attacks like the one on Sony Pictures. But the weak spot at JPMorgan appears to have been a very basic one.

JPMorgan’s security team had apparently neglected to upgrade one of its network servers with the dual password scheme (2 Factor) , the people briefed on the matter said. That left the bank vulnerable to intrusion.

Follow this link for additional details:

http://dealbook.nytimes.com/2014/12/22/entry-point-of-jpmorgan-data-breach-is-identified/?_r=0

Two 9th grade kids hack ATM - What is strange about it - They used the operator's Manual

Apparently, even the password was not changed from the default one.

(From the article)

Matthew Hewlett and Caleb Turon, both Grade 9 students, found an old ATM operators manual online that showed how to get into the machine's operator mode. 

Hewlett and Turon were even more shocked when their first random guess at the six-digit password worked. They used a common default password.

The link below has more information:-

http://www.winnipegsun.com/2014/06/08/code-crackers--charleswood-teens-hack-into-grant-avenue-atm

Strange and very bad - Adobe Shockwave provides its own version of the Flash runtime that is more than 15 months behind on security updates (according to Krebs}

According to the article:-

Dormann said, the current version of Shockwave for both Windows and Mac systems lacks any of the Flash security fixes released since January 2013. By my count, Adobe has issued nearly 20 separate security updates for Flash since then, including fixes for several dangerous zero-day vulnerabilities.

Dormann said it may actually be easier for attackers to exploit Flash vulnerabilities via Shockwave than it is to exploit them directly against the standalone Flash plugin itself. That’s because Shockwave has several modules that don’t opt in to trivial exploit mitigation techniques built into Microsoft Windows, such as SafeSEH.

The link below has more information:-

http://krebsonsecurity.com/2014/05/why-you-should-ditch-adobe-shockwave/

Antiviirus is dead - says Symantec (why?)

Everyone knew that but the the true reason for this statement lies in the 2nd sentence.

“We don't think of anti-virus as a money maker in any way," Brian Dye told the Wall Street Journal.

What this means is that "we have been selling CRAP for a long time and customers have started to realized it. Moreover, with all the malware and cyber threats, we cam make better money by selling different CRAP"

The link below has more information:-

http://www.pcr-online.biz/news/read/anti-virus-is-dead-says-symantec-reveals-new-partner-programme/033901

eBay ProStore vulnerability related to credit card took more than a month to fix.

Is that the fastest turn around time?

Particularly when this flaw is detected by an outsider.

According to the article:- 

Mark Litchfield, an infosec pro at Securatary, told us he discovered a flaw in eBay-owned ProStores that not only opened the door to store account hijackers, but also leaked "full access to all their customers PII [Personally identifiable information] as well as their full credit information in clear text."

"Like the gostorego vulnerability (also eBay), we could shop for free by giving ourselves store credit or gift cards or created our own orders for free," Litchfield told The Reg.

Securatary said it had reported the problem to eBay on 11 February but it was only fixed on 20 March. 

The link below has more information:-

http://www.theregister.co.uk/2014/04/01/ebay_stores_vuln/

T-Mobile - Free International Roaming (120+ Countries) - Experience from one consumer

According to him , it was not all bad , considering the fact that it was free.

If I read it correctly, incoming was free, Outgoing was expensive. Hey, still if you can receive calls/ messages  for free , why not?


The links below has more information:-

http://www.cio.com/article/750324/On_the_Road_with_T_mobile_39_s_Free_International_Roaming

Interesting question - How Do the FBI and Secret Service Know Your Network has Been Breached Before You Do?

We think we know the answer but, some details in this article could surprise you

According to the article:- 

In the course of all of this monitoring, Henry says, law enforcement often finds itself in the odd position of having to show companies evidence they have been victimized. And they aren't always thanked for their efforts. Sometimes, Henry says, companies say "'Please just go away.'" He adds,  "It happens all the time."

How frequently do the Secret Service and FBI come calling? "About 40% to 50% of our customer base have regular conversations with the FBI and other agencies that have warned that they have been breached," says Simon Crosby

In the course of that investigation it was discovered a laptop had malware on it that eluded anti-virus tools and the malware had been in contact with a botnet command-and-control server on the Internet. A "The FBI happened to be monitoring the C&C center" for that botnet, Stahl says.

One of the main questions then becomes, are the companies victimized ready to investigate it? Unfortunately, often they are not, say security experts at Solutionary, 

Solutionary last year was hired by a bank to conduct a forensics examination after the FBI showed up with evidence of a major breach that turned out to have been caused by SQL Injection attacks on the bank's website and had been going on for months. One difficulty, says Kraus, is the bank's logging system was weak and only stored log data for 2 and 1/2 months. Solutionary believes incident response capabilities remain tepid at best in companies today.

This raises the all-important question of how well companies defend their networks and whether their logging capabilities are sufficient to give them a clue about anything after a breach.

The links below has more information:-

http://www.networkworld.com/news/2014/032614-fbi-secret-service-breach-280126.html?source=NWWNLE_nlt_daily_am_2014-03-27

"TECHTOPUS" - Affected the salaries Million+ Silicon valley tech workers.

In simple terms "Silicon valley Wage Cartel"

It is an illegal agreement between seven tech giants, including Apple, Google, and Intel, to suppress wages for tens of thousands of tech employees.

Welcome to " Power Capitalism" where , Powerful people can easily exploit and still claim that the results are driven by the "Market".  This is easy when you are both the supplier and the consumer and unfortunately we are the commodities whose prices are fixed by a few.

UNION is an outdated "Socialist" word when it comes to employees.

CARTEL is the same but it applies to Bosses who own the business. 

DISCLAIMER:

"I am not GOD so, I admit that I could be wrong anywhere between 0 - 100%"

According to the article:- 

The combined workforce of the companies involved totals well over a million employees.

Although the Department ultimately decided to focus its attention on just Adobe, Apple, Google, Intel, Intuit, Lucasfilm and Pixar, the emails and memos clearly name dozens more companies which, at least as far as Google and Apple executives were concerned, formed part of their wage-fixing cartel.

The links below has more information:

http://pando.com/2014/03/22/revealed-apple-and-googles-wage-fixing-cartel-involved-dozens-more-companies-over-one-million-employees/

NSA Fires back - They ( Google, Microsoft and others )knew the government was collecting their user data

I guess this story is not going to end and the claims and denials will continue with carefully worded statements

According to the article:- 

" Data collection under PRISM, he said, was a "compulsory legal process, that any recipient company would receive."

"If you have to go back to court every time you look at the information in your custody, you can imagine that would be quite burdensome," testified Brad Wiegmann, deputy assistant attorney general. 

Google CEO Larry Page echoed those statements, and added, "[W]e had never heard of the broad type of order that Verizon received -- an order that appears to have required them to hand over millions of users' call records."

The links below has more information:

http://news.cnet.com/8301-13578_3-57620600-38/nsa-top-lawyer-says-tech-giants-knew-about-data-collection

What is "Mobile Context", It has something to do with $44 Billion market and MasterCard's geolocation payment security.

Oh, by the way, if you lose credit card and phone in the same country then, the geolocation protection will work against you.

MasterCard says, mobile geolocation can deliver payment security - Really or is there an ulterior motive?

The author of this article has a few good points

SNIPPETS from the Article:-

Mobile geolocation data will tell MasterCard that your phone is in the same country (not city) where someone is trying to use your card to make a purchase. If your MasterCard were stolen at Giza and then used to buy a high-res TV in Cairo, MasterCard's new geolocation effort would take a look and decide everything must be fine, because your phone is in Egypt.

"All we care about is whether the consumer has changed the country where they are visiting," said James Davlouros, MasterCard's vice president of global strategic alliances.

Even if MasterCard were narrowing your phone's location down to a city, a neighborhood or a specific street, this isn't a foolproof approach. Say that you keep both your MasterCard and your phone in a purse or a backpack and then that purse or backpack is stolen. There go your credit card and your phone, always together in the shops the thief visits

(The real reason? - Mobile Context)

In the future, they could implement targeted offers, which will be made more relevant by knowing the location of a mobile device, for example in close proximity to a retail store. A research report for Syniverse from economists at SEEC uncovered a market valued of as much as $44 billion for operators providing services to brands based on opted-in mobile subscribers' information, behavior and location -- known as mobile context."

The links below has more information:

http://www.cio.com/article/749539/Is_MasterCard_s_Fraud_Program_Just_Another_Data_Grab_?page=1&taxonomyId=3061

200 Million consumer records NOT STOLEN but legally BOUGHT from - Experion owned "Court Ventures".

So, he was not only buying user data, he also managed to trick EXPERION (Guardian of our Credit History) to provide direct access just by sitting at home in Vietnam.

Again - If organizations don't have a incentive to protect our data or penalties for exposure then they will not make an sincere attempt to protect our data.

Here, we should not be stupid to have a single regulation that penalizes all companies equally. Organization like Experion should be held responsible at a higher level as they are in a way custodians of our credit history.

SNIPPET:

The smart guy Hieu Minh Ngo, a 24-year-old Vietnamese national, pleaded guilty to running an identity theft service OUT OF HIS HOME in Vietnam.

But according to prosecutors, Ngo had already struck deals with one of the world’s biggest data brokers: Experian. Court records just released last week show that Ngo tricked an Experian subsidiary into giving him direct access to personal and financial data on more than 200 million Americans. 

The links below has more details:

http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/

Zero Day exploit Business - Aptly called “the modern-day merchants of death” selling “the bullets of cyberwar.”

This article is 2 years old so, we can imagine what it would be today

Here is a rough price list

ADOBE READER                                     $5,000-$30,000

MAC OSX                                                $20,000-$50.000

ANDROID                                                $30,000-$60.000

FLASH OR JAVA BROWSER PLUG-INS $40,000-$100,000

MICROSOFT WORD                                 $50,000-$100,000

WINDOWS $60,000-$120,000

FIREFOX OR SAFARI $60,000-$150.000

CHROME OR INTERNET EXPLORER        $80.000-$200,000

iOS         $100,000-$250,000

The links below has more details:

http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/

Is it "whole food" or "hole food" (I mean, with a lot of holes about their scientific explanantion)

Still, there’s a lot in your average Whole Foods that’s resolutely pseudoscientific. The homeopathy section has plenty of Latin words and mathematical terms, but many of its remedies are so diluted that, statistically speaking, they may not contain a single molecule of the substance they purport to deliver.

Nearby are eight full shelves of probiotics—live bacteria intended to improve general health. I invited a biologist friend who studies human gut bacteria to come take a look with me. She read the healing claims printed on a handful of bottles and frowned. “This is bullshit,” she said

 a significant portion of what Whole Foods sells is based on simple pseudoscience. And sometimes that can spill over into outright anti-science 

The link below has more details:

http://www.thedailybeast.com/articles/2014/02/23/whole-foods-america-s-temple-of-pseudoscience.html

We are all aware of Patent trolls, how about, Patent delay for 45 years.

Gilbert P. Hyatt, the dogged inventor isn't some gadfly in a garden shed. He's probably made more than $150 million from a deal with Royal Philips, the Dutch electronics maker, to license 23 of his patents, including the 1990 one. Intel Corp. co-founder Robert Noyce invested in Hyatt's first company in the 1960s, according to Hyatt.

He has taken the patent office to court more than 10 times to force the agency to reconsider rejections of some of his applications. He even won a case at the Supreme Court in 2012 over what type of evidence can be presented in district court.

To me , the following sensible line

"I respect Gilbert Hyatt's work — the process of engineering is difficult," Bassett said in a telephone interview. "But innovations are more than ideas. The broader context matters. If Gilbert Hyatt had never existed, I believe the microprocessor would have developed in the same way that it did."

The link below has more details:

http://www.chicagotribune.com/news/sns-wp-blm-news-bc-inventor01-20140301,0,255272.story

Are you aware of this Billion dollar Hacker Club?

                 

One of the group’s former members had just sold their company (WhatsApp) for $19 billion.

Napster co-founder Shawn Fanning (“napster”) is known to have been a member

Many other former members of this elite hacking crew have become leaders in the Internet security and related industries, founding or working in senior roles at companies such as Cloudmark, Duo Security, Hotmail, Google, Yammer, Veracode, CloudVolumes, Symantec, SecurityFocus, Immunet, and Sourcefire.

The link below has more details:

http://techcrunch.com/2014/03/02/w00w00/

Exxon CEO - Is he an hypocrite?

A key and critical function of Mr. Tillerson’s day job is to do all he can to protect and nurture the process of hydraulic fracturing—aka ‘fracking’—so that his company can continue to rack in billions via the production and sale of natural gas.

(So far so good I thought then, the following lines totally confused me)

Tillerson—ExxonMobil CEO and proud proponent of fracking as a key to both America’s and his company’s great energy future—has joined a lawsuit seeking to shut down a fracking project near Mr. and Mrs. Tillerson’s Texas ranch.


http://www.forbes.com/sites/rickungar/2014/02/22/exxon-ceo-profits-huge-as-americas-largest-natural-gas-producer-but-frack-it-in-his-own-backyard-and-he-sues/