Reuters: Hacked Retailer Customer Data Related to Outdated Magnetic Stripes, Retailers Look to Chip and PIN

(Reuters) – A top retail trade group executive on Sunday called for tougher security standards that could mean more spending for the industry, its banks and business partners after a series of data breaches at major merchants.

Stores and card processing companies have reported a steady stream of security breaches for years without a major backlash from consumers, such as those disclosed by TJX Cos in 2007 and by Heartland Payment Systems Inc in 2009.

But the latest thefts – including attacks on Target Corp and Neiman Marcus – have involved a broad set of merchants and could mark a watershed moment for security standards as calls grow for changes in the protection of consumer information.

One sign of the change is a new enthusiasm for payment cards that store customer information on computer chips and require users to type in personal identification numbers.

Mallory Duncan, general counsel of the National Retail Federation that represents Target, Wal-Mart and other big stores, said in an interview on Sunday that the trade group encouraged its members to upgrade to the higher-security cards even though they cost more than old systems that store data on magnetic stripes.

The breaches are “unfortunate but we’re not entirely surprised,” Duncan said at his organization’s annual convention now being held in New York.

“The technology that exists in cards out there is 20th-century technology and we’ve got 21st-century hackers,” he said.

Duncan said the trade group had only made its backing for the higher-security cards public since the Target breach. Banks have quietly begun to offer the cards but mainly for customers to use while traveling. Big U.S. card networks led by Visa Inc will not require the higher security until next year at the earliest.

It is not clear the new “Chip-and-PIN” cards would have prevented the breaches at Target and elsewhere. At the very least they make stolen data harder to re-use, a reason the technology has caught on widely in Europe and Asia.

Investigators believe that hackers used malware that captured data on customers from the magnetic stripes on their payment cards. Since Target’s disclosure the more upscale store chain Neiman Marcus has said it also suffered an attack, and sources have told Reuters that at least three other well-known U.S. retailers have been breached but not come forward.

http://www.reuters.com/article/2014/01/13/us-target-databreach-retailers-security-idUSBREA0C09O20140113

How Did Target Miss Up to 70 Million More Hacking Victims?

“I know that it is frustrating for our guests to learn that this information was taken, and we are truly sorry they are having to endure this,” Gregg Steinhafel, Target’s chairman, president and chief executive, said in a statement. “I also want our guests to know that understanding and sharing the facts related to this incident is important to me and the entire Target team.”

Friday’s announcement is the result of an ongoing investigation into the security breach, Target said. The company is working with the Secret Service and the Department of Justice to determine who was behind the attack. Spokesmen at the Secret Service and the Justice Department declined to comment on the investigation.

Target’s problems reflect a crisis in how customer data is protected, analysts said.

“It’s a little frightening. These bad guys are getting into some of the most secure retailers’ networks, and I’m sure it’s not going to stop at Target,” Litan said. “We need a fundamentally different paradigm here for how we manage security.”

But, with few details emerging about how the crime against Target was committed, it’s hard to say what solutions could have prevented this particular breach.

Shoppers whose personal and financial data was stolen — the exact number is unclear — are at higher risk of falling victim to scams or having their information misused. Target said the two types of data are not linked within its system.

But consumer advocates point to the fact that Target is an industry leader at data mining, the practice of analyzing customers’ information to find out more about their preferences and shopping habits.

“That makes this breach all the more frightening,” said Paul Stephens, director of policy and advocacy at Privacy Rights Clearinghouse, an advocacy group. The volume of information Target has on its customers raised the stakes, he said.

Experts said that with names and mailing addresses, thieves can use the credit cards for online purchases that require that information. On top of that, they can try to trick people into providing even more sensitive information, such as Social Security numbers, or hack into their computers.

The company said it doesn’t know how many customers have found fraudulent charges on their credit or debit cards, but individual stories and lawsuits are beginning to crop up across the country.

A California shopper filed a lawsuit against Target last month and hopes to include other shoppers in a class-action case. Last week, a credit union in Alabama also took action against Target, seeking compensation for costs that would arise from issuing customers new cards, as well as any fraudulent charges

http://www.washingtonpost.com/business/economy/target-says-70-million-customers-were-hit-by-dec-data-breach-more-than-first-reported/2014/01/10/0ada1026-79fe-11e3-8963-b4b654bcc9b2_story.html

Neiman Marcus Not Very Forthcoming Regarding Hacked Customer Financial Data

Neiman Marcus confirmed Saturday that its customers are at risk after hackers breached the Dallas company’s servers and accessed the payment information of those who visited its stores.

The firm has offered few concrete details about the scope of the attack, such as what data were taken or how many customers may be at risk. Nor did it say whether data from any of the other retailers it operates — including Bergdorf Goodman, Horchow, Cusp and Last Call — were affected. In a statement, Neiman Marcus said it was informed of the breach in mid-December by its credit card processor and subsequently informed law enforcement officials, including the Secret Service. The company is taking steps to contain the breach and has “taken significant steps to further enhance information security,” the statement said.

Neiman Marcus spokeswoman Ginger Reeder declined to provide further information on the attack. A spokesman for the Secret Service also declined to comment.

The company apologized to its customers for the breach through messages on its Twitter feed and said that it is working to notify those whose cards were used fraudulently after visits to Neiman Marcus stores.

http://www.washingtonpost.com/business/technology/neiman-marcus-confirms-data-breach-offers-few-details/2014/01/11/56c6dc7e-7ae1-11e3-af7f-13bf0e9965f6_story.html?tid=hpModule_88854bf0-8691-11e2-9d71-f0feafdd1394

FBI Threatened Lavabi to Turn Over SSL Keys to ALL User Email Accounts

Lavabit owner Ladar Levison told RT that he had no choice but to close his email service because the FBI, in pursuit of NSA whistleblower Edward Snowden, forced him into an ethical dilemma by demanding he hand over customers’ personal data.

RT: The FBI demanded you hand over encryption  codes to collect data from a specific account that is not named  in the documents. What was your initial response

Ladar Levison: That’s actually not correct. What they  demanded were the SSL keys that were protecting all the data  coming in and out of my network for all of my users, and that’s  what I had an issue with. I’ve said before that I took the stance  that I did not to try and protect a single person but because I  was concerned about the invasion and the sacrificing of  everyone’s privacy rights that were accessing my system. 

RT: We were led to believe that you had been  threatened to be charged with criminal content if you did not  comply. Do you feel those threats would have eventually become  reality if you didn’t follow suit? 

LL: Oh, I know they would. In fact they went on to  charge me $5,000 a day for every day that I didn’t turn over  those keys, which is why I was eventually forced to hand them  over. Given the difficult choice of remaining silent about what I  thought was a grave injustice or taking, like you said, the  lesser of two evils and shutting down the service. I just wasn’t  comfortable knowing that they were examining all the data that  was coming in and out of my network without any kind of  transparency or auditing by myself to ensure that they were only  collecting the information they were legally authorized to and  continuing to run the service with that knowledge. So I made the  only decision I felt was appropriate. In terms of being arrested,  I think the only reason they didn’t is because if they had the  system would have had nobody to maintain it. That’s one of the  advantages of being a small business owner, you wear many  hats. 

 

http://rt.com/usa/govt-implications-internet-control-lavabit-752/

Sen. Feinstein’s NSA Alleged Reform Bill To Add Surveillance Authority

A bipartisan group of US senators is trying to ban the NSA’s blanket surveillance program in a radical bill proposed to the Senate Intelligence Committee. But a milder bill from chairwoman Diane Feinstein would sanction more snooping on US citizens.

Thursday’s Committee hearing on reforming the Foreign Intelligence Surveillance Act (FISA) reviewed the two rival bills in an effort to find a balance between security and privacy. The Committee is expected to have further lively debate on the proposed legislation next week, before the bill is sent for consideration by the full Senate.

 Feinstein’s bill would also seek to expand the US government’s spying capabilities by authorizing the monitoring of terror suspects the NSA is tracking overseas when they arrive in the US. 

Currently, when a suspected terrorist arrives in America, the NSA has to halt its surveillance, creating a legal loophole.

“I call it the terrorist lottery loophole,” said Republican Senator Mike Rogers, the chairman of the House Intelligence Committee. “If you can find your way from a foreign country where we have reasonable suspicion that you are … a terrorist … and get to the United States, under a current rule, they need to turn it off and do a complicated handoff to   the FBI,” Rogers said.

The new bill would allow the NSA to legally continue eavesdropping on a person for seven days after arriving to the US without asking for authorization from a court.

Democratic Senator Wyden, who has been for years working with classified data as a member of the Senate Intelligence Committee, also derided the NSA’s complaints about the damage to US national security caused by the recent leaks.

“You talk about the damage that has been done by disclosures, but any government official who thought this would never be disclosed was ignoring history. The truth always manages to come out,” he said.

http://rt.com/usa/nsa-snooping-senators-feinstein-439/

Senate Intelligence Committee Hearing: The NSA Wants Unlimited Citizen and Business Data in National Database

[NSA Director Keith] Alexander acknowledged that the NSA is interested in compiling the largest national database possible, and that there is no limit to the number of records that can be gathered. The storehouse holds billions of records, former officials have told The Washington Post.

Is it the goal of the NSA to collect the phone records of all Americans?” Udall asked.

I believe it is in the nation’s best interests to put all the phone records into a lockbox that we could search when the nation needs to do it, yes,” Alexander said.

 

The government has claimed the authority to gather the data under Section 215 of the USA Patriot Act, also known as the “business records” provision of the Foreign Intelligence Surveillance Act. The FISA court in 2006 agreed that the government could use that statute to order phone companies to hand over “all call detail records” daily to the NSA.

 

Asked by Udall if that statute gave NSA the authority to collect other data — such as utility bills — Deputy Attorney General James M. Cole offered a qualified answer. “It’s given them the authority to collect other bulk records if they can show that it is necessary to find something relevant to a foreign intelligence investigation of particular types. . . . It’s not just all bulk records. But it’s also not no business records. It’s all dependent on the purpose.”

 

 

[Sen. Ron Wyden (D-Oregon)], Udall and other lawmakers have introduced reform legislation that would, among other things, end the phone records collection, while allowing for a more limited program.

On Thursday, Wyden accused U.S. officials of not being more forthcoming about intelligence-collection programs.

“The leadership of your agencies built an intelligence-collection system that repeatedly deceived the American people,” he said. “Time and time again, the American people were told one thing about domestic surveillance in public forums while government agencies did something else in private.”

 

http://www.washingtonpost.com/world/national-security/nsa-leaks-extremely-damaging-national-intelligence-director-tells-senate-hearing/2013/09/26/a01b4e08-26d3-11e3-b75d-5b7f66349852_story.html

 

Wyden infamously showed down with Clapper earlier this year when he asked the lawmaker if the intelligence community collects information on millions of Americans. Clapper responded “not wittingly,” then later apologized to Committe Chairwoman Dianne Feinstein (D-California) for his “clearly erroneous” remark after Snowden’s leaks suggested otherwise only weeks later.

So that he would be prepared to answer, I sent the question to Director Clapper’s office a day in advance. After the hearing was over, my staff and I gave his office a chance to amend his answer,” Wyden told the Washington Post after the March meeting. “Now public hearings are needed to address the recent disclosures, and the American people have the right to expect straight answers from the intelligence leadership to the questions asked by their representatives.”

On Thursday, Alexander phrased questioning directed at Gen. Alexander in an attempt to determine if the NSA collected information from cell phone towers that could be used to locate customers. Alexander decline to provide a straight answer during an unclassified hearing.

 

If you’re responding to my question by not answering it because you think thats a classified matter, that is certainly your right,” said Wyden. “ We will continue to explore that because I believe that is something the American people deserve to know.”

 

http://rt.com/usa/fisa-hearing-nsa-surveillance-410/

How Safe is Your Web Use? What You Need to Know About Email and IP Headers

After a few decades of being in existence among average, everyday human beings, the internet has become quite ubiquitous and pervasive in our lives. Most of us take it for granted like we do electricity and water. But when we send emails, do we really understand how it is delivered to the final destination, and what computers are involved in taking our emails and routing it to our friends and families? And when we visit a website, do we really understand how those clicks and personal data we entered is packaged and delivered to the ultimate website?

With what we now know about the major weaknesses the National Security Agency (NSA) and other intelligence agencies have injected into our common communication paths (telephone (traditional, mobile and Voice over IP, or VOIP), television, desktop and mobile internet), it’s probably time we at least have a basic idea of how the internet works. I will avoid getting too bogged down in technical detail and keep the conversation as short and simple as possible (though at times I may have to touch on some fairly technical terms if it can’t be avoided).

Let’s go over some common ways you communicate with friends and family first, and then go into details about how the communication happens. We’ll cover text messaging, email, and voice calls.

Text Messaging Basics

When you send a text, you probably think only you and your friend’s mobile devices are involved. Yeah, you probably know that AT&T, Verizon, Sprint, T Mobile, or other provider has a network that sends your message to your friend, but there’s a bit more to it. When you turn on your phone, it automatically connects to your provider’s network. This means that every so often, your phone says “Hi, I’m still here” to make sure your texts and voice calls are able to either be sent by you to a friend, or from a friend to you.  So let’s say you decide to say “hello” as a text to a friend. When you click Send, your mobile phone packages your message in a way very similar to what the postman or Fedex shipper does with a regular mailing. A physical mail needs a From address and a To address in order to get it to its destination.  Similarly, your phone puts the From and To info into the text message. In order to keep your provider’s network from confusing the From and To info with the actual body of your text message, the From and To info, along with date and time, is put into a “Header.” A header is like your envelope that you put your letter in. The letter and envelope are two separate things, and the letter is inserted into the envelope. Similarly, your text message is put into an electronic envelope that contains the header info (the From and To info – your phone number plus the number of your friend). Once the electronic envelope is ready, your phone sends it to your provider’s network.

The first point your electronic envelope goes to is your provider’s closest tower. This is similar to your mail going to the nearest post office to get entered into the system. From there, your regular mail goes to a major area postal hub, where it is then routed to the next logical postal hub closest to your final destination: the intended mail recipient. Similarly, the local phone tower sends your text to the nearest satellite, which then sends your text message to the next logical satellite en route to your friend. The process is reversed once your friend’s nearest phone tower is found: the final satellite in the route sends the text to your friend’s nearest phone tower, which then sends it to your friend’s mobile phone. The phone then unpacks the text and displays it on your friend’s phone.

Keep in mind that though this is a simplified example, notice that there are multiple devices involved: towers, satellites, and your provider’s computer servers for coordinating the sending of messages from one satellite to another and for archiving. I will explain why this is important to remember shortly.

Email

Email works pretty much the same way that text messaging does. Assuming you’re at your laptop typing an email up while logged in to your internet provider’s system, you will ultimately include the email address of a friend or team member from work. You click Send or Submit, and off your email goes. But it’s not quite that simple. Your email software (presumably Outlook or some free online email provider like Yahoo or Gmail) has to package your email just like with text messaging. But there’s far more info that gets added to the electronic envelope (aka “email header”) than just email addresses; Wikipedia has a good listing that I’ll provide a snippet of here (please forgive the technical jargon):

Common header items for email include:

  • To: The email address(es), and optionally name(s) of the message’s recipient(s). Indicates primary recipients (multiple allowed), for secondary recipients see Cc: and Bcc: below.
  • Subject: A brief summary of the topic of the message. Certain abbreviations are commonly used in the subject, including “RE:” and “FW:”.
  • Bcc: Blind Carbon Copy; addresses added to the SMTP delivery list but not (usually) listed in the message data, remaining invisible to other recipients.
  • Cc: Carbon Copy; Many email clients will mark email in your inbox differently depending on whether you are in the To: or Cc: list.
  • Content-Type: Information about how the message is to be displayed, usually a MIME type.
  • Precedence: commonly with values “bulk”, “junk”, or “list”; used to indicate that automated “vacation” or “out of office” responses should not be returned for this mail, e.g. to prevent vacation notices from being sent to all other subscribers of a mailinglist. Sendmail uses this header to affect prioritization of queued email, with “Precedence: special-delivery” messages delivered sooner. With modern high-bandwidth networks delivery priority is less of an issue than it once was. Microsoft Exchange respects a fine-grained automatic response suppression mechanism, the X-Auto-Response-Suppress header.[57]
  • References: Message-ID of the message that this is a reply to, and the message-id of the message the previous reply was a reply to, etc.
  • Reply-To: Address that should be used to reply to the message.
  • Sender: Address of the actual sender acting on behalf of the author listed in the From: field (secretary, list manager, etc.).
  • Archived-At: A direct link to the archived form of an individual email message.[58]

Note that the To: field is not necessarily related to the addresses to which the message is delivered. The actual delivery list is supplied separately to the transport protocol, SMTP, which may or may not originally have been extracted from the header content. The “To:” field is similar to the addressing at the top of a conventional letter which is delivered according to the address on the outer envelope. In the same way, the “From:” field does not have to be the real sender of the email message. Some mail servers apply email authentication systems to messages being relayed. Data pertaining to server’s activity is also part of the header, as defined below.

SMTP defines the trace information of a message, which is also saved in the header using the following two fields:[59]

  • Received: when an SMTP server accepts a message it inserts this trace record at the top of the header (last to first).
  • Return-Path: when the delivery SMTP server makes the final delivery of a message, it inserts this field at the top of the header.

Other header fields that are added on top of the header by the receiving server may be called trace fields, in a broader sense.[60]

  • Authentication-Results: when a server carries out authentication checks, it can save the results in this field for consumption by downstream agents.[61]
  • Received-SPF: stores the results of SPF checks.[62]
  • Auto-Submitted: is used to mark automatically generated messages.[63]
  • VBR-Info: claims VBR whitelisting[64]

Source: http://en.wikipedia.org/wiki/Email#Message_header

 

I know that was a lot of information. All you need to really understand is that email messaging has more header info than text messaging, but is quite similar in concept. An email can have messages that contain more than just text. It can contain pictures, songs, video, voice recordings and other data as determined by what’s called a MIME type. I won’t go into details about MIME types, but just know that in order for the email server to know how to handle your email, it must know what kind of content it has inside your electronic envelope. Just like when you send a DVD or CD along with a letter, it is good to let the post office know if your envelope contains fragile content for special handling.

Voice Calls

By now, you probably get the pattern. Voice calls are very similar to text messages and emails. You dial a friend’s number and click Send or Talk. A connection is established from your phone to the nearest phone tower (wireless calls) or landline home office for landline phone calls. The call is routed to the next satellite or server along a path that is the shortest distance to your friend. Once your friend clicks Send or Talk (or whatever graphical icon on your smart phone represents picking up the call), your provider establishes and monitors the quality of the call until one of you hangs up – or the network drops your call for whatever reason. Voice over IP (VOIP) uses your internet connection instead of the plain old telephone network and is very similar to text messaging, except the message content is your voice being sent in a continuous stream of electronic envelopes (called packets. Refer to http://en.wikipedia.org/wiki/VoIP for more info). Digital television transmission works very similarly, but is broadcast by TV stations and content providers in a way that is closer to what Twitter does with each tweet.

Websites

You have a few common ways we discover websites to visit. You do a search through Google, Bing or other service. You need to pay a bill or buy stuff online. A TV program we’re watching mentions a website. You get the idea. So what do You do to display that site on your computer or mobile phone/device? You either click on it or type it in to the part of your internet web browser called the Address box near the top. It starts off with http:// or similar.  But what is happening to make that web page display on your browser? It’s not magic, but several hardware and software components at work:

1)      Your web browser, which has to package your request for a web page into an electronic envelope similar to text messaging described earlier

2)      Your internet provider’s set of big computer servers (called the Provider Network)

3)      The website owner’s website, which is software that is inside a computer that either the website owner directly owns, or rents from its internet hosting provider if it is too expensive to own a dedicated computer server

When you click on a link (or enter it in manually in the Address bar at the top of the browser and click a button to send it), your web browser puts your request for the page in an electronic envelope and places a header on it that, among other things, has your computer or mobile device’s IP address (mobile phones have IP address, too, for internet purposes). Your browser sends the request to your internet provider’s computer server, which in turn passes it on to the nearest computer server that can forward it on to another one until it gets to the website computer server you asked for. The website server has the equivalent of a “bodyguard” who’s job is to make sure the request won’t cause trouble in paradise. This bodyguard snoops through your electronic envelope, makes sure there’s nothing bad in it, and passes it along to the web application of the website you requested. Every website has some kind of application software that offers the features that you come to expect in a modern website. So when you go to pay a bill online and click “Checkout” or “Pay Now,” the logic for making that happen is within the website application software that is housed on the website. A website can have one or more web applications, which is why it is important to keep the two separate in your mind. When the web application needs to send a confirmation back to you, it also puts that confirmation inside an electronic envelope and sends it back to you as a response to your request.

 

What Can Go Wrong?

Now that we’ve gotten that out of the way, have you noticed any potential problem areas with the various ways you communicate? Earlier I asked you to keep some things in mind regarding the multiple devices involved in establishing and maintaining your communications. It’s the fact that it takes several devices (called routing points) between you and your friends, family members and co-workers that is something to consider. Similar to wire-tapping of traditional phones, tapping of text messages, emails, digital voice calls and website visits can occur on any device. Each computer server and each satellite between you and your friend or the website you request has a unique address assigned to it that can be tapped into and compromised without your even knowing it. A server administrator working on any of the computer servers your communications rely on can compromise the system and secretly allow access to it at a price to the highest bidder. There are technology companies that specialize in IP tracing and recording that are already gathering tons of information on your communications and have been for many years. The Eric Snowden NSA leak scandal has become a wakeup call for the entire world, not for just governments, but businesses and individuals as well. The NSA has intentionally created weaknesses (called back doors) in every online security encryption method you use every day. So when you buy stuff online at a site that has an HTTPS in the beginning, that “s” (which stands for “secure”) should now become “I” for “insecure” because it has been very compromised. IP tracing is one of the key areas of compromise that you have to deal with.

What is IP tracing?

Ip-address.org has this to say:

Tracking down an IP address will give you a general idea of what city, state and other geographical information pertains to the original sender. You can also determine what ISP a computer user is networked with through an IP address lookup tool…Tracing an email gives other information, such as how many times an email was sent to various servers and is an important method used for determining the original source of an email. By tracing an email you can determine the original sender’s IP address, therefore giving you a geographical location of the email sender…Email tracer tools take out the confusion of searching and tracing headers and are an easy and convenient way to track down an email. By copying and pasting the header information into the form the tool will return results showing you the IP address of the original email sender…You can determine the sender’s IP address manually but it takes more time. Though you won’t be able to determine an exact name of the original sender, the received information is valuable and will offer you many clues as to the original sender.

In and of itself, IP tracing is not bad. But in the wrong hands, it can be damaging. There are already technology companies that are proudly selling advanced tracking and recording technology to intelligence and military organizations around the world, chiefly the NSA, FBI, CIA, and others. There’s a company in France that sells web browser vulnerability information to the highest bidder, thus it has no incentive to privately inform the browser maker (Internet Explorer, Chrome, Safari, etc) of weaknesses it is exploiting. So not only can you communications be tapped into, your keystrokes at your computer can be recorded to go along with the IP tracing profile that snoopers can summarize about you.

The game of internet and telecommunications security is a cat and mouse game that both the honest and dishonest are working at every day. And we have seen that sometimes, our government can fail us (they’re human) and so we need to ask our representatives to strengthen laws regarding surveillance and recording as the risk of a major terrorist attack do not rise to the level of damaging digital security and privacy rights violations. As we see with the Navy Shooter massacre in September 2013, acts of terror are not always preventable even with all of the NSA/CIA/FBI surveillance going on now. So why compromise our security online and push us several steps closer to widespread paranoia?