Archive for category: Hack

You are here: / Hack

Macy’s and Bloomingdale’s just announced a data breach that’s exposed sensitive customer info

Here’s what you need to know about the Macy’s and Bloomingdale’s breach
  • Macy’s and Bloomingdale’s (both owned by parent company Macy’s, Inc.) recently sent letters to some of their online customers confirming the retailer had discovered a cybersecurity threat to its systems on June 11, 2018.
  • According to the letters, “an unauthorized third party, from April 26, 2018, through June 12, 2018, used valid customer usernames and passwords to log in to customer online profiles.”
  • Hackers were able to access users’ first and last names, addresses, phone numbers, email addresses, birth dates, and debit and credit card numbers with expiration dates, Macy’s said.
  • See this article for more information.
How to protect your info after this breach
To support you during this time, we’ve put together some guidelines to help you protect yourself:
  • Change your Macys.com or Bloomingdales.com password(s).
  • Monitor your credit/debit card accounts for any suspicious activity.
  • Update any debit/credit cards you’ve used on Macys.com or Bloomingdales.com.
  • Check your credit report regularly to keep an eye on any unauthorized activity.

Important Message Regarding MyFitnessPal Account Security

NOTICE OF DATA BREACH
To the MyFitnessPal Community:

We are writing to notify you about an issue that may involve your MyFitnessPal account information. We understand that you value your privacy and we take the protection of your information seriously.

What Happened?

On March 25, 2018, we became aware that during February of this year an unauthorized party acquired data associated with MyFitnessPal user accounts.

What Information Was Involved?

The affected information included usernames, email addresses, and hashed passwords – the majority with the hashing function called bcrypt used to secure passwords.

What We Are Doing

Once we became aware, we quickly took steps to determine the nature and scope of the issue. We are working with leading data security firms to assist in our investigation. We have also notified and are coordinating with law enforcement authorities.

We are taking steps to protect our community, including the following:

  • We are notifying MyFitnessPal users to provide information on how they can protect their data.
  • We will be requiring MyFitnessPal users to change their passwords and urge users to do so immediately.
  • We continue to monitor for suspicious activity and to coordinate with law enforcement authorities.
  • We continue to make enhancements to our systems to detect and prevent unauthorized access to user information.

What You Can Do

We take our obligation to safeguard your personal data very seriously and are alerting you about this issue so you can take steps to help protect your information. We recommend you:

  • Change your password for any other account on which you used the same or similar information used for your MyFitnessPal account.
  • Review your accounts for suspicious activity.
  • Be cautious of any unsolicited communications that ask for your personal data or refer you to a web page asking for personal data.
  • Avoid clicking on links or downloading attachments from suspicious emails.

For More Information

For more information, please go to https://content.myfitnesspal.com/security-information/FAQ.html.

Sincerely,

Paul Fipps
Chief Digital Officer

2018 Security Concerns to Look Out For

2017 was a tough year for cyber security companies and professional as phishing attacks, ransomware and state-sponsored attacks took front stage.  So what should we expect for 2018?  I say bigger breaches and new types of attacks if the current trend continues.  With that being said, her are a few of my ideas on the types of attacks that will cover our headlines in 2018:

 

  1. State-sponsored Attacks will Increase – The regular actors such as North Korea, China, Russia and Iran will continue with their cyber-attacks to extort, steal and disrupt information systems. I also see new actors including our so called allies jumping into the pot to obtain economic and technological advantages.

 

  1. Internet of Things (IoT) attacks will increase – As more Internet connected devices enter the market from what I have been able to ascertain from this year’s CES, I could not help but think about how minimal security controls are implemented to defend against cyber-attacks.

 

  1. Ransomware Attacks will Increase – The increase of ransomware attacks are no surprise to me since their presence have increased from 2016 to 2017 exponentially and I see no change in 2018. What I am most concerned with in the idea many of the new attacks will be targeted.  For example, there are concerns, hackers will focus their efforts towards the health-care sector and target devices such as pacemakers.  So instead of paying to get you information back, a person will have to pay to keep their life.

 

These are just a few of the concerns I predict will have security practitioners up at night, the good news, our awareness of this threats have increased and security tools are being implemented to assist in defending our information systems and data.  What do you think?

SecurityOrb.com’s Top 3 Security Hacks of 2017

In recent years security breaches have been a big topic as it has impacted many of our lives and 2017 is not different.  securityorb.com/ recently reviewed some of the most notable hacks of 2017 and compiled a list of the top 3 security breaches. 

 

  1. Equifax – In July of 2017, Equifax one of the largest credit bureaus was hacked as the personal information of 145 million people were taken by cybercriminals. It was considered among the worst breaches of all time because of the amount of sensitive information exposed, including Social Security numbers, addresses and the maiden names of your mother.

 

  1. Leaked NSA Hacking Tools – In April of 2017, a hacking group called the Shadow Brokers leaked a bunch of hacking tools that belonged to the National Security Agency aimed at exploiting Windows-based systems. One to the tools leaked by the Shadow Brokers was used in the year’s biggest global cyberattack known as the WannaCry exploit.

 

  1. WannaCry – In May of 2017 the ransomware known as “WannaCry” targeted more than 150 countries and many of the businesses within those countries that were running outdated Windows software. The hackers behind WannaCry demanded money to unlock the files and more than 300,000 machines were effected across several industries, including health care, universities and car companies.

 

Let us know what you think of the list, what else should have been on the list in your opinion?

Suspicious Activities on Hotels.com User Accounts

I recently received an email from Hotels.com stating an unauthorized user may have accessed user’s accounts and are urging customers to change their password.  Read the actual email below.

“We are writing to make you aware of recent activity involving Hotels.com accounts that leads us to believe that some of your personal information, including your reward nights, may have been accessed by an unauthorized user. However, rest assured that your full credit card information was not compromised on our website.

On May 22-29, 2017, we detected unusual user activity with a number of accounts, including yours, which we believe resulted from an unauthorized user accessing the accounts using customers’ usernames and passwords. The accessed data could have included your name, address, e-mail address, hotel booking history, reward nights, and the last four digits of your stored credit card—but only if a user selected the option to save credit card numbers.

If we’re able to verify that free nights were recently removed from your account without your authorization, we will quickly restore those nights.

We are taking steps to ensure the continued security of your data, including resetting all compromised passwords. When you attempt to log in to your account, you will receive a message that will provide you with instructions on how to change your password.

The following are tips on how better to protect your account:

  • To reset your password, click the “forgot your password” link and follow the instructions on the screen.
  • Because an unauthorized user accessed your account using your username and password, we recommend that you create an entirely different password and one that is not shared with any other online service. Strong passwords are at least eight characters long, and contain upper and lowercase letters, plus numbers and symbols.
  • Verify your account details are correct by validating your e-mail address, and other account information. If you notice anything unusual with your account details, please contact us.

The security of our customers’ account information is of the utmost importance to us, and we apologize for any inconvenience this issue may cause you.  If you have questions, please feel free to contact Hotels.com at 800-246-8357. Please note that our Customer Service agents will not be able to assist you with changing your password—only you can change your password online.

Sincerely,
Hotels.com Customer Support”

Kmart Stores Battling Malware-Based Security Breach of its Store Credit Card Processing Systems. Again…

An article by Brian Krebs from KrebsonSecurity.com:

For the second time in less than three years, Kmart Stores is battling a malware-based security breach of its store credit card processing systems.

Last week I began hearing from smaller banks and credit unions who said they strongly suspected another card breach at Kmart. Some of those institutions received alerts from the credit card companies about batches of stolen cards that all had one thing in common: They were all used at Kmart locations.

Asked to respond to rumors about a card breach, Kmart’s parent company Sears Holdings said some of its payment systems were infected with malicious software:

“We recently became aware that Sears Holdings was a victim of a security incident involving unauthorized credit card activity following certain customer purchases at some of our Kmart stores. We immediately launched a thorough investigation and engaged leading third party forensic experts to review our systems and secure the affected part of our network.”

“Our Kmart store payment data systems were infected with a form of malicious code that was undetectable by current anti-virus systems and application controls. Once aware of the new malicious code, we quickly removed it and contained the event. We are confident that our customers can safely use their credit and debit cards in our retail stores.”

Based on the forensic investigation, NO PERSONAL identifying information (including names, addresses, social security numbers, and email addresses) was obtained by those criminally responsible. However, we believe certain credit card numbers have been compromised. Nevertheless, in light of our EMV compliant point of sale systems, which rolled out last year, we believe the exposure to cardholder data that can be used to create counterfeit cards is limited. There is also no evidence that kmart.com or Sears customers were impacted.”

Sears spokesman Chris Brathwaite said the company is not commenting on how many of Kmart’s 735 locations nationwide may have been impacted or how long the breach is believed to have persisted, saying the investigation is ongoing.

Read the rest here.

 

American vigilante hacker sends Russia a warning

By Jose Pagliery at cnn.com

An American vigilante hacker — who calls himself “The Jester” — has defaced the website of the Russian Ministry of Foreign Affairs in retaliation for attacks on American targets.

On Friday night, the Jester gained access to the Russian government ministry’s website. And he left a message: Stop attacking Americans.

“Comrades! We interrupt regular scheduled Russian Foreign Affairs Website programming to bring you the following important message,” he wrote. “Knock it off. You may be able to push around nations around you, but this is America. Nobody is impressed.”

MID.ru is the official website of the Russian agency that is in charge of maintaining that country’s international diplomacy — equivalent to the U.S. Department of State.

His hacking of the website included this gag: Visitors are subjected to the ear-piercing sound of an American civil alert message — that shrieking dial tone that accompanies emergency weather broadcasts.

Read more here.

 

NSA Cyber Hacking Tools Hacked and Released to the Public

Last week on my radio show, I discussed how some of the most powerful hacking tools created by the NSA’s elite hacking group known as the “Equation Group” have been released in the public by a hacking group calling themselves “The Shadow Brokers”.

Many experts in the InfoSec arena including the security firm Kaspersky stated, “The files posted by The Shadow Brokers and tools used by the Equation group, “share specific and rare characteristics”, so the probability of falsification is “highly unlikely.”

The tools that were release are much more sophisticated than many of the open source and freely available hacking tools that are available on the internet.  These tools can easily circumvent the security of many of the major government and corporate networks both in the US and abroad.  These tools can also be used to take over firewalls that are used in the largest and most critical environments around the world.

The Shadow Brokers are asking for 1 Million in Bitcoins (around $568 Million Dollars) in an auction to release more hacking tools in the public.

How can this happen you ask?

The main suspect is Russia, and it’s not clear if the hackers broke into the secure NSA computer network or, more likely, an NSA employee left the hacking tools on an unsecured intermediate server during a hacking operation.

In a tweet about the event, Edward Snowden, former NSA employee and whistle blower stated, “NSA’s hackers are told not to leave their hack tools (‘binaries’) on the server after an op,” but later stated, “But people get lazy.”

If Russia is indeed responsible as many security researchers believe, it seems they have taken their cyber-attacks to a new level with the recent occurrence pertaining to the hacked emails and stolen documents from the Democratic Party.

How should the US respond?

Cheating website subscribers included WH, Congress workers

By JACK GILLUM and TED BRIDIS
Published: Aug 20, 2015

WASHINGTON (AP) – Hundreds of U.S. government employees – including some with sensitive jobs in the White House, Congress and law enforcement agencies – used Internet connections in their federal offices to access and pay membership fees to the cheating website Ashley Madison, The Associated Press has learned.

The AP traced many of the accounts exposed by hackers back to federal workers. They included at least two assistant U.S. attorneys; an information technology administrator in the Executive Office of the President; a division chief, an investigator and a trial attorney in the Justice Department; a government hacker at the Homeland Security Department and another DHS employee who indicated he worked on a U.S. counterterrorism response team.

Few actually paid for their services with their government email accounts. But AP traced their government Internet connections – logged by the website over five years – and reviewed their credit-card transactions to identify them. They included workers at more than two dozen Obama administration agencies, including the departments of State, Defense, Justice, Energy, Treasury, Transportation and Homeland Security. Others came from House or Senate computer networks.

The AP is not naming the government subscribers it found because they are not elected officials or accused of a crime.

Hackers this week released detailed records on millions of people registered with the website one month after the break-in at Ashley Madison’s parent company, Toronto-based Avid Life Media Inc. The website – whose slogan is, “Life is short. Have an affair” – is marketed to facilitate extramarital affairs.

Many federal customers appeared to use non-government email addresses with handles such as “sexlessmarriage,” ”soontobesingle” or “latinlovers.” Some Justice Department employees appeared to use pre-paid credit cards to help preserve their anonymity but connected to the service from their office computers.

“I was doing some things I shouldn’t have been doing,” a Justice Department investigator told the AP. Asked about the threat of blackmail, the investigator said if prompted he would reveal his actions to his family and employer to prevent it. “I’ve worked too hard all my life to be a victim of blackmail. That wouldn’t happen,” he said. He spoke on condition of anonymity because he was deeply embarrassed and not authorized by the government to speak to reporters using his name.

The AP’s analysis also found hundreds of transactions associated with Department of Defense networks, either at the Pentagon or from armed services connections elsewhere.

Defense Secretary Ash Carter confirmed the Pentagon was looking into the list of people who used military email addresses. Adultery can be a criminal offense under the Uniform Code of Military Justice.

“I’m aware it,” Carter said. “Of course it’s an issue because conduct is very important. And we expect good conduct on the part of our people. … The services are looking into it and as well they should be. Absolutely.”

The AP’s review was the first to reveal that federal workers used their office systems to access the site, based on their Internet Protocol addresses associated with credit card transactions. It focused on searching for government employees in especially sensitive positions who could perhaps become blackmail targets. The government hacker at the Homeland Security Department, who did not respond to phone or email messages, included photographs of his wife and infant son on his Facebook page.

One assistant U.S. attorney declined through a spokesman to speak to the AP, and another did not return phone or email messages.

A White House spokesman said Thursday he could not immediately comment on the matter. The IT administrator in the White House did not return email messages.

Federal policies vary for employees by agency as to whether they would be permitted during work hours to use websites like Ashley Madison, which could fall under the same category as dating websites. But it raises questions about what personal business is acceptable – and what websites are OK to visit – for government workers on taxpayer time, especially employees who could face blackmail.

The Homeland Security Department rules for use of work computers say the devices should be used for only for official purposes, though “limited personal use is authorized as long as this use does not interfere with official duties or cause degradation of network services.” Employees are barred from using government computers to access “inappropriate sites” including those that are “obscene, hateful, harmful, malicious, hostile, threatening, abusive, vulgar, defamatory, profane, or racially, sexually, or ethnically objectionable.”

The hackers who took credit for the break-in had accused the website’s owners of deceit and incompetence, and said the company refused to bow to their demands to close the site. Avid Life released a statement calling the hackers criminals. It added that law enforcement in both the U.S. and Canada is investigating and declined comment beyond its statement Tuesday that it was investigating the hackers’ claims.

___

Associated Press writers Alicia Caldwell and Lolita C. Baldor in Washington and Raphael Satter in London contributed to this report.

___

Follow Jack Gillum on Twitter at https://twitter.com/jackgillum and Ted Bridis at https://twitter.com/tbridis