What's New More proof that simple hacks sometimes work. (And also that they sometimes get you caught.) IDG News Service's Jeremy Kirk writes of the March indictment of Shahin Abdollahi, a former Subway restaurant franchise operator, on charges of Wire Fraud, Conspiracy and Criminal Forfeiture. Abdollahi and another man allegedly sold point-of-sale systems to other Subway stores, then accessed those systems remotely after hours to load value onto Subway gift cards. The scheme was strikingly straightforward. According to the indictment, Abdohalli became co-operator of POS Doctor, selling POS systems to Subway franchise operations. He and Jeffrey Wilkinson surreptitiously loaded the remote access application LogMeIn onto some of these systems before shipping them to Subway locations in various locations including Massachusetts, California and Wyoming. They then accessed those systems and loaded dollar value onto gift cards already in their possession, either selling the cards on eBay and Craiglist--and delivering them by hand, or "making purchases at Subway restaurants" for themselves. The Fierce Take: At least that indicates they believed in the product… For more:
- See the indictment on DocumentCloud.org
- Read Kirk's version on Computerworld More on fraud and POS systems:
'Swatting' Brian Krebs earns Canadian teen arrest
Newly rich Bitcoin users likely target for fraudsters, SEC warns
7 deadly sins: The most dangerous new attack techniques for 2014 Read more about: fraud
back to top
| This week's sponsor is HP. |   | State of Security Ops
As the incidence and cost of cyber crime have escalated, organizations have responded by establishing security operations centers (SOCs) to detect and counter cyber attack and to assure compliance with industry guidelines. But how capable are SOCs, and where is the greatest opportunity for improvement? Read this report now for more details. |
A hacking group dubbed the Ajax Security Team, believed to be operating out of Iran, shows capabilities that have evolved in recent years from defacing websites to conducting malware-based espionage. That's the lead conclusion in the new "Operation Saffron Rose" report issued by security vendor FireEye. FireEye's research finds the Ajax group has used malware-based attacks to target U.S. defense organizations and successfully breached the Navy Marine Corps Intranet. They also take aim at dissidents within Iran, seeding versions of common anti-censorship tools, such as Psiphon and Ultrasurf, with malware and gathering information about users of those programs. The report says the Iranian group comprises between five and 10 individuals. Their relationship to other groups and activity originating within Iran is unclear. FireEye says the capabilities and actions of the group mirror the earlier evolution of espionage groups operating out of China, though they are currently smaller in scale and less advanced. For more:
- see FireEye's report [PDF]
- read Dark Reading's summary
- see TechTimes' writeup More on advanced threats and cyber espionage:
Hackers get better while IT security falls further behind, says Verizon
Some security pros would lie to CEO about cyberattacks
Mathematical model may predict next StuxnetSpotlight: US panel calls for action against China for industrial cyberespionage Read more about: cyber attacks
back to top
Tired of being bullied in the digital arena, major retailers are jumping onboard a new information sharing program under the auspices of the Retail Industry Leaders Association. The Retail Cyber Intelligence Sharing Center comprises three elements: - a Retail Information Sharing and Analysis Center (ISAC)
- an educational program
- and a research program, in collaboration with academia.
Al Pascual, a Javelin Strategy and Research Analyst, tells BankInfoSecurity that retailers "have gotten significant heat" for not having an active ISAC like numerous other vertical industries (though ISACs are most plentiful in critical infrastructure industries). The RILA says it consulted with the FS-ISAC in financial services, as well as other long-standing information sharing groups, in forming the R-CISC program. The Fierce Take: Retailers have been sharing information about organized retail crime and other shoplifting activities for many years. Interesting that it took so long to get together on cybercrime. For more:
- see the RILA official announcement
- read BankInfoSecurity's coverage More on retail security and information sharing:
'Dark web' behind massive retail breaches, says McAfee
Target data breach: A timeline
FS-ISAC threat information sharing helped thwart DDOS attacks against US banks Read more about: Information Sharing
back to top
It's hard to keep data breaches straight any more, but maybe you'll remember this one: In 2011 an SAIC employee was driving unencrypted backup tapes from one facility to another for Tricare, a military health program provider. The tapes were stolen from the car, exposing personal data of about 4.9 million Tricare customers. Eight different class-action lawsuits ensued, and eventually consolidated to one lawsuit with 33 plaintiffs. After last Friday, only two of those plaintiffs are still standing. A U.S. District Court ruled that the other 31 plaintiffs failed to meet the criterion of "plausibly assert[ing] that their data was accessed or abused." The key question, according to the judge's statement, is when loss of data can confer legitimate standing on claims of injury. "Most [courts] have agreed that the mere loss of data--without evidence that it has been either viewed or misused--does not constitute an injury sufficient to confer standing. This court agrees," he wrote. Two of the plaintiffs showed sufficient evidence of harm and are being allowed to proceed to the next phase of the lawsuit. For the other 31, appeals may follow (don't they always?) Speaking to HealthInfoSecurity.com, privacy attorney Adam Greene made several important points about the ruling. First, a District Court ruling is not binding on other districts. So this decision may or may not have any effect on other class action suits. Second, *most* court decisions seem to be following the same line of thinking. However, some don't--Greene cites recent settlements paid by Stanford and AvMed over data breaches. Cases such as those "likely provide plenty of incentive for class action plaintiffs to continue bring claims," he said. The Washington Business Journal notes that the judge's decision also made mention of the fact that a GPS and car stereo were also taken, giving the impression of a "low-tech, garden-variety" theft as opposed to "a black-ops caper." For more:
- read the report on HealthInfoSecurity
- and coverage in Washington Business Journal More on data breaches:
Hospitals hit with largest-ever HIPAA fine over patient data exposed to search engines
After pledging to protect customer data, Orange reports second major data breach
33 lawsuits against Target over data breach will be heard by one Minnesota judge Read more about: encryption
back to top
| 
No comments:
Post a Comment
Keep a civil tongue.