Monthly Archives: September 2015

Facebook Hoax Circulates on the Internet

Facebook-logo-PSDThe Internet is full of rumors and hoaxes. The fact that Facebook has its name attached  to any of them is no surprise and neither is the latest hoax. 

Apparently the Internet is buzzing about Facebook charging $5.99 for membership or to keep your information private. Its not true!

Another part of the hoax is that Facebook says you need to post a legal notice on your wall or you’ll lose copyright control of your pictures, links, comments and content you share with your circle of family and friends. That is not true!.

This hoax is not new and can be traced back as far as 2009.  These rumors proliferate because A) people believe them and B) because people have a tendency to share links without truly examining the content of the story. You’d be surprised how many people post a link on their Facebook page or Twitter account without reading the story.

CNN senior entertainment reporter Lisa Respers France has three simple rules for verifying those news stories before you share them, stop drop and roll.

  1. Stop before you hit that share button
  2. Drop over to Google.
  3. And roll around in the information to determine if it is true, recent or even relevant.

Remember AACR Internet Rule #10  Everything on the Internet is real; just not always true. That means that, yes, the news of Eddie Murphy being killed in a skiing accident is really on the Internet. But it is not true. Are you getting this? And for the record Eddie has died about 50 times online.

Now about Facebook and your privacy and that copyright notice; you never had any to begin with and no copyright notice is going to change that. Facebook is the biggest collector of information in the history of mankind. Everything you do on your Facebook page belongs to them. Even the posts you write and then delete. Read your user agreement. Its all there.

For more information check out;

No,Facebook will not be charging you $5.99 to keep your profile private.

Hoax Alert: Facebook to Charge $5.99 to Keep Your Profile

Another Facebook hoax makes the rounds – CNN.com

Breach Brief – Hilton Worldwide, Trump Hotel Collection

September 29, 2015

Hilton Worldwide

PrintHilton Worldwide, a global hospitality company is investigating a possible data breach at its properties. The data breach may have compromised payment card data of its customers.

The data breach was reported by Cybersecurity blogger Brian Krebs on Friday. According to KrebsOnSecurity.com credit card provider VISA alerted financial institutions of a breach between April 21, 2015 and July 27, 2015, and included compromised card numbers. Hilton Hotels have not confirmed any data breach.

The data breach is not isolated to Hilton hotels alone. Besides the flagship Hilton Hotels, the subsidiaries include Embassy Suites, DoubletreeHampton Inn and Suitesand the upscale Waldorf Astoria Hotels & Resorts. All are thought to be affected by this breach. Hotel gift shops, bars and restaurant point of sale (POS) systems may have been affected.

Although Hilton has said nothing officially several financial institutions told KrebsOnSecurity.com that the breach may date as far back as November 2014, and the hotels may still still be at risk.

Hilton has released a vague statement that neither denies nor acknowledges a data breach occurred.

“Hilton Worldwide is strongly committed to protecting our customers’ credit card information. We have many systems in place and work with some of the top experts in the field to address data security. Unfortunately the possibility of fraudulent credit card activity is all too common for every company in today’s marketplace. We take any potential issue very seriously, and we are looking into this matter.”

Trump Hotel Collection

Trump HotelUnlike Hilton Hotels Trump Hotel Collection has confirmed a malware data breach of their POS systems. The hotel confirmed the data breach after three months of investigations and the system may have been infected by malware for over a year.

The Trump Hotel Collection posted a undated “legal notice of potential security incident” on its website. The notice warned of POS breaches at  hotels in  Chicago, Honolulu, Las Vegas, New York, Miami, and Toronto. The notice did not give a specific number of customers who may be affected by the breach.

A statement from Trump Hotels said, “Payment card data, including payment card account number, card expiration date, security code, and names of individual cardholders who used a payment card at the hotel between May 19, 2014, and June 2, 2015, may have been affected.”  The hotel also warns that attackers may have also obtained cardholders’ names at the Las Vegas and Honolulu hotels.

A year of identity theft protection from Experian is being offered to all customers who used a payment card at those properties during the malware-infection period. A breach-notification letter is being sent to affected consumers by the law practice of Norton Rose Fulbright, which was posted by California’s Office of the Attorney General.

September 22, 2015

Systema Software

Systema SoftwareA mysterious data breach has compromised private health records and contact information of as many as 1.5 million Americans. The data was posted on Amazon’s cloud services. The insurers affected by the data breach include Kansas’ State Self Insurance FundCSAC Excess Insurance Authority, and the Salt Lake County Database .

The data exposed included police injury reports, drug tests, names, addresses, phone numbers, biological health information including existing illnesses and current medications used by the patients. The information was posted to Amazon servers by insurers using Systema Software. Systema provides insurance claims administration systems to insurance corporations and governments. The breach could violate HIPAA laws.

It is unknown how or who posted the information and the number of affected patients remains unconfirmed. It is estimated that as many as 1 million Social Security numbers, 5 million financial transactions, and hundreds of thousands of injury reports were exposed. According to Databreaches.net the data included billing prices, various patient identification numbers, and some 4.7 million note entries including data on fraud investigations.

For more information please see Gizmodo.com

 September 10, 2015

Excellus Blue Cross Blue Shield

ExcellusBCBSExcellus BlueCross BlueShield reported a long running cyber-attack that began in December 2013 but wasn’t discovered until Aug. 5, 2015. The breach may have exposed information on as many as  10.5 million individuals. Information exposed includes individual’s names, addresses, birthdates, Social Security numbers, member IDs, financial account information, claims data and clinical information.

Cyber security firm Madiant was hired to conduct a forensic assessment of Excellus’ IT systems and discovered the breach. Excellus which is based in Rochester, N.Y., took the action after a wave of similar major cyber-attacks on other health insurers, including Anthem Inc.Premera Blue Crossand CareFirst Blue Cross Blue Shield.

According to an Excellus spokesman of  the 10.5 million people affected 7 million were health plan members. Data belonging to another 3.5 million individuals belonged to Excellus’ holding company, the Lifetime Healthcare Companies. The individuals affected are Blue Cross Blue Shield plan members who sought treatment in the New York state service area. In a statement Excellus said,  “Individuals who do business with us and provided us with their financial account information or Social Security number are also affected.” Company officials said the that the data was encrypted but that hackers had access to administrative controls making the encryption a moot point.

 The company is cooperating with an FBI investigation.

California State University

California_State_University_SealOfficials of the Chancellor’s office of the California State University System confirmed on Tuesday that a third-party vendor had exposed the personal information of 79,000 students in late August. 

We End Violence, the San Diego based company that operated with the university to offer the course, has contacted students affected by the breach. The chancellor’s office said officials took immediate action to safeguard student information. 

The CSU Chancellor’s Office in Long Beach said the breach, discovered on August 28th, included information such as sexual orientation, gender, email and mailing addresses. According to school officials the breach did not reveal Social Security, driver’s license numbers or credit card data. The data breach affected students at eight CSU campuses who had enrolled in a required sexual assault training class. The affected campuses included Cal State San BernardinoCal State NorthridgeCal Poly Pomona and Cal State Los Angeles.

August 24, 2015 

IRS Breach

IRS_LogoThe Internal Revenue Service (IRS) widened the scope of the breach first announced in May. The government agency is saying that as many as 390,000 taxpayers are now at risk. The hack was centered around the IRS’ Get Transcript system.

The IRS suspended the Get Transcript online service in May. The service was intended to simplify how taxpayers retrieve their tax records, review their tax account transactions, get line-by-line tax return information or wage and income reported to the IRS for a specific tax year.  Hackers circumvented the Get Transcript’s authentication safeguards and are believed to have gained access to taxpayer information, including Social Security numbers.

According to an August 17th statement the IRS stepped up its investigation of the breach. A deeper review of the compromised system included analyzing over 23 million system uses, including the 2015 filing season. Investigators were looking for suspicious activities and identified “more questionable attempts” to obtain taxpayer records through the Web application.

No details were provided on how the agency uncovered the additional taxpayer account breaches. But it is believed that the hackers were very skillful and probably covered their tracks to make it more made it difficult for the tax agency to quickly assess the extent of the breach.

Update-Ashley Madison Breach

ashley-madison-hed-2014Hackers who stole profile and customer data from Ashley Madison have released the data online. According to multiple reports a 10GB file of customer’s personal data including email addresses, member profiles and transaction data is now available online. Some reports say as many as 32 million customer’s information was released including one million UK civil servants, U.S. officials, members of the U.S. armed forces and top executives at European and North American corporations. There already reports of blackmail and divorce petitions because of the data release.

Impact Team, the hacker group claiming credit for the data theft,  released the data after Avid Life Mediawhich owns Ashley Madison and Established Men failed to meet demands that they permanently shut the sites down down. Cougar Life, another Avid Life Media site, was not mentioned and seems to be unaffected.

Additional information;

The Blackmail of Ashley Customer Has Already Begun

People are already starting divorce proceedings because of the Ashley Madison leak.

After the devastating hack, these lawsuits are threatening to wipe Ashley Madison out altogether.

A chart made from the leaked Ashley Madison data reveals which states in the US like to cheat the most.

The Pentagon Is Investigating the Ashley Madison Leak.

How to check if an account was exposed in the Ashley Madison hack

August 4, 2015

United Airlines

united_continental_logo_detAccording to Bloomberg Business United Airlines has reported that it’s customer flight records have been lost to a data breach.

The breach was detected in May or June of this year and involved flight manifests. Chinese hackers are suspected. These same Chinese hackers are suspected of stealing more than twenty million OPM records. Experts believe that Chinese intelligence is constructing a massive database.

United Airlines is one of the government’s largest contractors. It is believed that the stolen data contains vast amounts of information on military and government officials and federal employee’s travel.

Experts have also questioned a possible connection between the hack and the computer glitch that caused flight delays on July 8th. Evidence from the investigation reveal that hackers may have been inside United’s computers for months.

A spokesman for United Airlines declined to confirm that a breach occurred and insisted that customer’s private data is safe.

One of the major concerns is that hackers, tinkering with sensitive systems, could accidently or deliberately, cause massive flight delays or even cripple a major airline causing nationwide and potentially global aviation gridlock. Another concern is backdoors left inside computer networks that allow hackers back in at will.

United spokesman Luke Punzenberger said of customer information that United “would abide by notification requirements if the situation warranted.”

Medical Informatics Engineering

mielogolargeA data breach at Medical Informatics Engineering has compromised the data of over 3.9 million people nationwide. According MIE the information loss includes names, phone numbers, mailing addresses, user names, hashed passwords, security questions and answers, email addresses, birthdates, Social Security numbers, lab results, health insurance policy information, diagnoses, disability codes, doctors’ names, medical conditions, and spouses’ and childrens’ names and birthdates.

MIE creates electronic medical records software for health care providers and the result of the breach could impact as many as 11 healthcare providers including local, national and the federal government.

According to the company the hackers had access to the MIE servers for three weeks and have stolen the information to sell on the black market. Experts suspect the theft was likely and inside job.

MIE has reported the breach to the FBI Cyber squad and said the investigation into the security breach is ongoing. MIE  is offering free credit monitoring and identity theft protection. The company has established a toll free hotline available Monday-Friday 9:00AM-9:00PM EST at (866) 328-1987.

 July 28, 2015

Experian

ExperianLogo

Experian Credit Reporting Services is the target of a class action lawsuit filed in California. The amount is to be determined. According to the suit Experian was negligent and violated consumer protection laws because it failed to realize that for nearly a year a customer of it’s data brokerage subsidiary, Court Ventures, was actually a criminal gang specializing in selling consumer data to identity thieves. Experian purchased Court Vnetures in 2012.

The leader of the identity theft ring was sentenced to 13 years in prison last week in New Hampshire. Hieu Minh Ngo accessed as many as 200 million consumer records by posing as a private investigator based in the United States.

According to the government Ngo collected nearly $2 million from his scheme. The IRS has confirmed that 13,673 U.S. citizens had their personal information stolen and sold on Ngo’s websites Superget.info and Findget.me. The stolen identities were used to file over $65 million dollars in fraudulent tax returns.

Plaintiffs in the case have asked the court to compel Experian to notify all consumers affected by the breach, provide free credit monitoring services, turn over all profits made as a result of the Ngo relationship and to establish a fund to reimburse victims for the time and expenses of fighting fraud and correcting identity theft caused by customers of Ngo’s ID theft service.

U.S Census Bureau

2000px-Census_Bureau_seal.svgThe U.S. Census Bureau reported a data breach early last week. In a written statement released on Friday Census Bureau Director John H. Thompson said a database belonging to the Federal Audit Clearinghouse had been attacked. The FAC collects audit reports from the government agencies and other organizations spending federal money. 

According to Thompson the information included the names of people who submitted information, addresses, phone numbers, user names and other data. According the Bureau no household or business data was lost.

In the statement Thompson wrote that the intruders accessed the database through a configuration setting on an external IT system. That system is separate from the Census Bureau internal systems that stores census data.

In the statement Thompson went to say, “Over the last three days, we have seen no indication that there was any access to internal systems.”

The attack was apparently in protest of the Trans-Pacific Partnership and the Transatlantic Trade and Investment PartnershipBoth are pending trade agreements that have been widely criticized. A group calling itself Anonymous Operations claimed credit for the breach and posted a link on Twitter to four of the stolen files.

July 20, 2015

Ashley Madison

ashley-madison-hed-2014A hacking group calling itself the Impact Team has hacked into the sex hookup website AshleyMadison.com.

According to Krebsonsecurity.com massive caches of customer and company data have been stolen and posted online. The group claims to have totally penetrated the company’s networks taking control of the company’s customer database of 37 millon users, financial records and other proprietary information. As a website dedicated to cheating spouses the damage could go well beyond lost data.

Avid Life Media, which in addition to Ashley Madison also owns hookup sites CougarLife.com and EstablishedMen.com, was attacked in retaliation for lying to customers. According to the Impact Team hackers ALM advertised to customers  a service allowing members to completely erase their profile information for a $19 feeAccording to the hackers the company is not fully deleting user’s information including personally identifiable information, user’s purchase details and real name and address.

The hackers have demanded that Ashley Madison and Established Men websites be taken down immediately and permanently or more information will be released online.  The hackers are threatening to release customer records, including profiles with their secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails.

Avid Life Media CEO Noel Biderman believes the attack maybe the work of one or more persons, possibly an employee or contractor, who had legitimate access to the company’s network.

July 18, 2015

CVSPhoto.com, Costocophotocenter.com, RiteAid Photo, Sams Club, Walgreens & Tesco

CVS PhotoPNI Digital Media  is a third party vendor that handles transactions for these retailers according to KrebsOn Security.com PNI has suffered a data breach of unknown size. But it is known that customer payment information has been compromised.

Neither PNI nor any of the retailers connected with the breach have said much only saying that more information will be released as it becomes available. CVSPhoto.com took down its photo site and posted an announcement indicating an investigation is under way and that other CVS sites such as it’s pharmacy were unaffected by the breach. CVS has asked customers who used the photo service to check and monitor their card statements for suspicious activity or transactions. If anything looks strange they are to contact their bank or card company immediately to report it.

Costcophotocenter.com and RiteAid photo also took their sites down.

UCLA Health

UCLA Health has confirmed health information for as many as 4 million individuals has been exposed as a result of a data breach that may have began last September. The FBI is investigating and UCLA has hired a private forensics experts to beef up the security on it’s servers.

According to a UCLA Health statement released on Friday “criminal hackers” hacked into parts of the organization’s computer network containing personal and medical information.

UCLA Health began investigating suspicious activity on its networks in October of 2014. At the time they  did not believe the attackers gained access to areas of the network containing personal and medical information.

“As part of that ongoing investigation, on May 5, 2015, UCLA Health determined that the attackers had accessed parts of the network that contain personal information such as names, addresses, dates of birth, Social Security numbers, medical record numbers, Medicare or health plan ID numbers and some medical information. Based on the continuing investigation, it appears that the attackers may have had access to these parts of the network as early as September 2014. We continue to investigate this matter.”

Office of Personnel Management

Even though OPM suffered a data breach and the loss of information of 24 million Americans the government still has not notified those invividuals. Its been two months.

Officials from multiple agencies familiar with the investigation say that OPM is working with other agencies to set up a system to inform the victims.

An OPM official, who wishes to remain anonymous, said that because of the complicated nature of the data and movement of contract and federal employees it would be weeks before a mechanism was in place.

According to the official the government is attempting to establish a central notification system rather than rely on separate agencies to make notifications. An outside contractor  is being considered for the task but OPM has not yet asked for bids for the job.

July 16, 2015

OPM Data Breach

An interagenOPM Sealcy task force investigating April’s OPM hacking has determined with “high confidence” that as many as 21.5 million people had their personal information stolen. This includes social security numbers .

The Office of Personnel Management updated its website last Thursday with the startling new information.

According to the OPM 4.2 million former federal employees’ personnel data was stolen. While investigating that theft investigators found a much larger data theft. OPM has not yet notified the 19.7 million additional individuals affected. Those are the people who requested a background check normally for employment purposes or acces to classified information. An additional 1.8 were people were not job appicants but were either married to or co-habiting with an applicant.

In addition to personal information the hackers stole as many as one million fingerprint records.

Applicants who applied for employment had their user names and passwords for investigation forms stolen. It is also highly possible that information such as mental health history and financial history many have also been stolen. Applicants that were interviewed as part of their background investigations often reveal this sensitive information when applying for security clearences.

OPM attempted to take some of the sting from the bad news by saying “there is no evidence that health, financial, payroll, and retirement records of federal personnel or those who have applied for a federal job were impacted by this incident (for example, annuity rolls, retirement records, USAjobs, Employee Express).” The agency assures the public that it’s working to create safeguards to prevent such incidents in the future.

OPM Director Katherine Archuleta resigned her position last week after whitering criticism over the data breach.

Army National Guard Data Breach

Seal_of_the_United_States_Army_National_Guard.svgCurrent and former members of the Army National Guard members dating back to 2004 had personal information including social security numbers, birthdates and home addresses stolen. 

National Guard Spokesman Major Earl Brown, said “The National Guard Bureau takes the control of personal information very seriously,” said Brown. “After investigating the circumstances of these actions, and the information that was transferred, the Guard has determined, out of an abundance of caution, to inform current and past Guard personnel that their Personally Identifiable Information (PII) was among the files that were transferred.”

“The issue was identified and promptly reported, and we do not believe the data will be used unlawfully,” Brown said. “This was not a hacking incident, in which the intent was to use data for financial gain. Nonetheless, the Guard believes that individuals potentially affected need to know about the breach and what actions they can take to protect themselves from potential identity theft.”

If you are a member of the Nationa guard and need more information please  go to http://www.nationalguard.mil/Features/IdentityTheft.aspx or call  toll-free 877-276-4729 8AM to 4PM EST, Monday through Friday. You can also email any questions you have to dod.data.breach.questions@mail.mil

Snoop Dogg Launches MerryJane.com

Snoop-Dogg-Marijuana

azmarijuana.com

Smoking weed is steadily becoming a mainstream practice. It probably has been for sometime but it was kept on the low. But rap icon Snoop Dogg is breaking marijuana out of the shadows by launching weed smoking lifestyle website MerryJane.com

Snoop Dogg has been involved and investing in tech for just over a year and has decided to bring smoking and the smoking lifestyle online in a big way. MerryJane.com is a lifestyle media site that focuses on the Chronic. The password restricted website provides both video and editorial content. MerryJane.com is intended to act as a central hub of information for smokers from the novice to the seasoned weed connoisseurs.

Snoop announced MerryJane.com at TechCrunch Disrupt SF saying MerryJane.com will provide users with “all they need to know” about marijuana, and be the “encyclopedia of the cannabis world.”

For cannabis smokers the website will focus on the lifestyle and offer original shows that cover cooking with weed as well as food pairings with cannabis. Users will also find guidance for first timer smokers who wish to indulge. This is called being ‘deflowered’. MerryJane.com will also have celebrities who are “down with the team”. Names associated with the website include Seth Rogen and Miley Cyrus.

MerryJane will be more than a place to indulge the smoking lifestyle. Snoop plans to examine the serious side of weed smoking including the politics and the business of weed.

Snoop is taking smoking weed to the online business world. MerryJane offers a database of various strains of cannabis. The data base was created by the MerryJane.com editorial team. It lets smokers learn more about cannabis and what strain might be right for them. The site also allows smokers to connect with a local dispensarys that offer their selected brand of weed.  MerryJane.com also lets smokers search by cannabis type, flavors, symptoms, and more and shows listed cannabis products in high-resolution rotating images.

Plans are already underway to allow marijuana dispensaries to set up their own digital store on the MerryJane.com website.

MerryJane co-founder Ted Chung spoke on the website’s business plan saying, “advertising is definitely part of the plan.” But he pointed out providing the cannabis industry with a central destination for brands and retail outlets is vital to creating a strong presence. Chung stated that the demand is there and expects the site to surpass its competitors within 6 months.

Snoop added that MerryJane.com will open the door for people who smoke secretly. “There are so many people in the closet, and we are giving them an opportunity to come out of the closet and just admit they like to smoke. I’m a smoker, my name is Snoop Dogg, and I’m a stoner.”

MerryJane.com launched last week at the Disrupt SF 2015 conference. A limited number of beta testers received invitations to explore the site. The site will be open to the general public over the next few weeks.

Also see Snoop Dogg Starting Marijuana Venture Capital Fund

Now you know.

 

 

How Safe is that ATM?

Remember the good ol’ days when ATM security meant making sure you didn’t get mugged. Well those days aren’t exactly gone. You still have to be careful. But the crooks are now using card skimmers, fake keypads and other devices to rob you. So how safe is that ATM?

Card skimmer courtesy of BBB.org

Card skimmer courtesy of BBB.org

ATM security nowadays means understanding how criminals are using technology to rob you. Its time to learn their methods and technology.

 

 

 

 

Remember that ATM machines do not have to belong to a bank or any financial institution. The can be privately owned by a person or business. There is even an organization of private ATM owners known as the National ATM Council. And you can find websites that show you how to set up your own network. Would you like to buy your own ATM? It’s that simple.

viral4real.com

Fake ATM key pad Courtesy viral4real.com


So how do you spot a fake or suspicious ATM?

  • Avoid standalone ATMs in suspicious locations. Be alert to brand names you are not familiar with.
  • A legitimate ATM machine is very secure. Since they contain cash they will be bolted and secured to a wall or floor. Free standing ATM machines that can be easily moved are to be avoided.
  • Clever criminals will sometimes place their crooked ATM next to a legitimate ATM then place an out of order sign on the legitimate one. That could indicate that the one with the sign may actually be the working ATM.  The out-of-order sign could trick you into using the criminal’s machine. Be aware!
  • Check the card slot and key pad. Is either loose or out of place?  That ATM may have been tampered with.  Check the card reader slot and key pad by trying to remove it. Yank or pull on it. It may come off in your hand. If so you have found a skimmer.  Legitimate ATM machines don’t have loose or removable parts.
  • Look for a micro camera or any other out of place device used to record your PIN.
  • Look for ATM machines with open or loose side panels or broken locks especially at drive through ATMs. Don’t use it and report a suspicious ATM to the bank immediately.
  • Check your balances daily and make sure there are no suspicious charges related to ATM use. Report any strange activity immediately.
  • Report suspicious activity around an ATM machine to the police.

Now you know

Ludachris Jumps into the Tech Game

www.roadie.com

www.roadie.com

Rapper Ludachris, real name Chris Bridges, has decided to join a host of other rap artists and athletes  who have decided to get into the tech game.

Ludachris announced that he will be partnering with Atlanta based delivery company Roadie. Roadie proclaims itself to be the first neighbor-to-neighbor delivery network. The service works by allowing someone who has a package to be delivered to post a “Gig.” Drivers traveling in the direction where the package needs to go will see the posting and claim the job of delivering it. Both parties must to agree on the terms of delivery. The sender can schedule a pick up and delivery the same day or anytime they wish. Senders can track the package to its destination. No pricing information was made available on the website.

In a statement Ludachris said, “I am intrigued by new technology and I love seeing the Atlanta tech scene on the rise so I partnered with Roadie to help spread the word about this brand new, completely unique app created in Atlanta. In a world where I feel we need a lot more people helping each other out, Friendshipping is the future.”

Also seeRap & Hip-Hop Artist Invest in Technology

 

 

ALERT! Apple App Store Hit with Major Malware Attack ALERT!

Apple_logo_blackClean up operations have begun as a result of what has been described as the worst attack ever on the Apple App Store.

Hackers infiltrated Apple’s normally super secure ecosystem by injecting malicious software into popular Chinese mobile apps. The infection could potentially affect hundreds of millions of Apple users. The incident is raising security concerns as Apple is preparing for the launch of its newest iPhone.

More than 300 Chinese apps are infected including popular instant messaging service WeChat and the Uber ride sharing competitor app Didi Kuaidi. The apps were infected with “XcodeGhost” malware. According to Chinese state media the infection could potentially allow access to private user data including passwords. 

Simply put “XcodeGhost” malware can steal data and possibly trick Apple users into surrendering their personally identifiable information. The creators of the malware were able to manipulate a tool used by legitimate Apple  iOS and OSX developers to create apps. Those developers, without knowing it, created their apps using this tampered-with tool resulting in the malware infection.

In a statement Apple said, “To protect our customers we’ve removed the apps from the App Store that we know have been created with this counterfeit software and we are working with the developers to make sure they’re using the proper version of Apple software Xcode to rebuild their apps.”

News of the malware was released by US-based cybersecurity firm Palo Alto Networks. The company said the malware came from computer code uploaded to Baidu’s cloud file-sharing service used by Chinese app developers.

Affected apps on the U.S. market include;

LifeSmart

LifeSmart version 1.0.45 uninstall immediately.

Oplayer

OPlayer HDLite version 2.1.02 uninstall immediately
wechat

WeChat version 6.2.6 has been patched.

winzip-logo

WinZip version version 4.2  uninstall immediately

1000 walpaper

10,000+ Wall Papers for iOS 7, iOS 8, iPhone, iPod, iPad. version 3.6 uninstall immediately.

CamCard     

CamCard Business version 1.8.1 uninstall immediately.

 

Camscanner

CamScaner Free,CamScanner+ version 3.8.1 uninstall immediately,

Because these apps have come directly from the Apple app store it is unknown if anti-virus software will protect your device. It’s best to uninstall the apps immediately.

Apple has reported that is has removed the affected apps from the App Store.

 

 

App of the Week – theScore

theScore-S-LogoThe NFL season is now in full effect. And if you are a football fan then you are probably a year round sports fan. Thats why theScore is the App of the Week.

There are a lot of sports apps on the market, a lot! But when it comes to following multiple sports, multiple teams and multiple players its tough to beat theScore. theScore app is great because sports seasons overlap. Right now we have baseball and football. Then its football and basketball and lets not forget hockey and soccer and collegiate sports. If you are sports hungry this is the app that will feed you.

theScore delivers up-to-the-second game updates and statistics. You can keep track of all the late breaking sports news as well. The calendar permits the user to see upcoming games.

Another great feature is the ability to research past games, stats and most important plays. You can keep an eye on the game of your choice, follow individual players and play-by-play breakdowns and especially the big plays that change games. The social media features of the app allow you to share stories, stats and game summaries with your fellow sports nuts.

theScore is free and available for Apple and Android.

Understanding Medical Data Breaches

canstockphoto24985079Medical data breaches are constantly in the news.  According to iHealthBeat.org 1 in 10 U.S. residents have been impacted by a medical data breach. It is highly likely that millions of African-Americans have been the victim of a medical data breach and probably don’t know it. The sad news is that this has become common.

We need to understand a few things about data breaches. First, what is a data breach? What kind of data breaches are there? How many people are affected and how do you fight back if you think your data has been compromised.

Put simply a data breach is an incident where sensitive, protected or confidential information has been exposed, stolen or utilized by unauthorized individuals often to commit some type of crime.

What kind of data breaches are there? Data breaches may expose personal health information (PHI) this is a medical data breach.  Personally identifiable information (PII) is information that, on its own or combined with other information can be used to identify, contact, or locate a person, or identify an individual in context. Finally there is a data breach that exposes trade secrets or intellectual property. This usually affects businesses and sometimes falls known as industrial espionage.

Medical data breaches often involve massive numbers of people and personal information records. Here are the largest medical data breaches so far this year. Look carefully, your insurance company may be on the list.

Keep in mind that medical insurance companies are not alone when it comes to data breaches. Hospitals and health service providers are a prime target for medical data hackers. The HIPAA Act covers most medical facilities. HIPAA is the federal Health Insurance Portability and Accountability Act of 1996. The law is intended to make it easier for people to keep health insurance, protect the confidentiality and security of healthcare information and help the healthcare industry control administrative costs.

According to Datapipe.com these are the largest HIPAA data breaches of  2014.

According to a report released by KPMG 81 percent of health insurance providers and hospitals have had a data breach. The survey revealed,

  • 15 percent of healthcare organizations have no one whose sole responsibility is information security.
  • 23 percent do not have a security operations center to identify and evaluate threats.
  • 55 percent say they have a hard time staffing their organization.

Why is medical data so valuable? Medical records are ten times more valuable to hackers than your credit cards.

Your medical information is a gold mine. You probably have medical information spread over several doctor’s offices, medical services and hospitals including your dentist, pharmacy and physical therapist. These records contain information such as your Social Security number, address and phone number, email, next of kin information, phone numbers, information about your children or spouse, payment information, insurance information, and much more.

Hackers use stolen medical and insurance data to create fake IDs, buy medical equipment or drugs that they can re-sell and file fraudulent claims with insurance providers. Hackers also have more time to use stolen data to commit fraud because medical identity theft is not immediately apparent.  And mostly because these records are easy targets. According to the KMPG report hospitals and medical insururance companies are poor protectors of your information. According to the security firm Symantec health care providers saw a 72 percent increase in cyberattacks from 2013 to 2014, Health care companies are required by law to publicly disclose big health data breaches. There were more than 270 such disclosures in the last two years.

So how can African-Americans avoid the theft of their medical information?

  • If your wallet is lost or stolen, make sure your insurer(s) are notified along with your financial institutions.
  • Carefully examine all medical bills and insurance statements you receive. Look for fees from health care providers you do not recognize or statements describing benefits paid out for services you did not obtain.
  • Consider an identity protection service which will help you detect most kinds of identity theft, including medical, much earlier than you might on your own and assist you through the fraud resolution process if your information is stolen.
  • Always be alert to strange phone calls or emails from people asking medical questions or insurance questions, especially if you do not know the company.
  • Alert your caregivers of any suspicious calls or activity regarding your care.
  • Keep a close watch on your credit and banking resources. Alert you financial institutions of any suspicious or fraudulent activity.
  • Take full advantage of credit monitoring services if offered.

The loss of medical data can have a devasating personal impact. An unlucky victim may have their medical insurance coverage cancelled or suspended due to fraudulent claims. Insurance premiums may skyrocket. Others may have their identity stolen completely. Changes, intentional or accidental, to medical records could result in mis-diagnosis or mis-treatment of illnesses. Pay attention to data breach notifications. The African American Cyber Report is an excellent source for the latest breach notifications.

Know you know

 

Breach Brief – Excellus Blue Cross Blue Shield, California State University

September 10, 2015

Excellus Blue Cross Blue Shield

ExcellusBCBSExcellus BlueCross BlueShield reported a long running cyber-attack that began in December 2013 but wasn’t discovered until Aug. 5, 2015. The breach may have exposed information on as many as  10.5 million individuals. Information exposed includes individual’s names, addresses, birthdates, Social Security numbers, member IDs, financial account information, claims data and clinical information.

Cyber security firm Madiant was hired to conduct a forensic assessment of Excellus’ IT systems and discovered the breach. Excellus which is based in Rochester, N.Y., took the action after a wave of similar major cyber-attacks on other health insurers, including Anthem Inc.Premera Blue Cross, and CareFirst Blue Cross Blue Shield.

According to an Excellus spokesman of  the 10.5 million people affected 7 million were health plan members. Data belonging to another 3.5 million individuals belonged to Excellus’ holding company, the Lifetime Healthcare Companies. The individuals affected are Blue Cross Blue Shield plan members who sought treatment in the New York state service area. In a statement Excellus said,  “Individuals who do business with us and provided us with their financial account information or Social Security number are also affected.” Company officials said the that the data was encrypted but that hackers had access to administrative controls making the encryption a moot point.

 The company is cooperating with an FBI investigation.

California State University

California_State_University_SealOfficials of the Chancellor’s office of the California State University System confirmed on Tuesday that a third-party vendor had exposed the personal information of 79,000 students in late August. 

We End Violence, the San Diego based company that operated with the university to offer the course, has contacted students affected by the breach. The chancellor’s office said officials took immediate action to safeguard student information. 

The CSU Chancellor’s Office in Long Beach said the breach, discovered on August 28th, included information such as sexual orientation, gender, email and mailing addresses. According to school officials the breach did not reveal Social Security, driver’s license numbers or credit card data. The data breach affected students at eight CSU campuses who had enrolled in a required sexual assault training class. The affected campuses included Cal State San Bernardino, Cal State Northridge, Cal Poly Pomona and Cal State Los Angeles.

 

August 24, 2015 

IRS Breach

IRS_LogoThe Internal Revenue Service (IRS) widened the scope of the breach first announced in May. The government agency is saying that as many as 390,000 taxpayers are now at risk. The hack was centered around the IRS’ Get Transcript system.

The IRS suspended the Get Transcript online service in May. The service was intended to simplify how taxpayers retrieve their tax records, review their tax account transactions, get line-by-line tax return information or wage and income reported to the IRS for a specific tax year.  Hackers circumvented the Get Transcript’s authentication safeguards and are believed to have gained access to taxpayer information, including Social Security numbers.

According to an August 17th statement the IRS stepped up its investigation of the breach. A deeper review of the compromised system included analyzing over 23 million system uses, including the 2015 filing season. Investigators were looking for suspicious activities and identified “more questionable attempts” to obtain taxpayer records through the Web application.

No details were provided on how the agency uncovered the additional taxpayer account breaches. But it is believed that the hackers were very skillful and probably covered their tracks to make it more made it difficult for the tax agency to quickly assess the extent of the breach.

Update-Ashley Madison Breach

ashley-madison-hed-2014Hackers who stole profile and customer data from Ashley Madison have released the data online. According to multiple reports a 10GB file of customer’s personal data including email addresses, member profiles and transaction data is now available online. Some reports say as many as 32 million customer’s information was released including one million UK civil servants, U.S. officials, members of the U.S. armed forces and top executives at European and North American corporations. There already reports of blackmail and divorce petitions because of the data release.

Impact Team, the hacker group claiming credit for the data theft,  released the data after Avid Life Mediawhich owns Ashley Madison and Established Men failed to meet demands that they permanently shut the sites down down. Cougar Life, another Avid Life Media site, was not mentioned and seems to be unaffected.

Additional information;

The Blackmail of Ashley Customer Has Already Begun

People are already starting divorce proceedings because of the Ashley Madison leak.

After the devastating hack, these lawsuits are threatening to wipe Ashley Madison out altogether.

A chart made from the leaked Ashley Madison data reveals which states in the US like to cheat the most.

The Pentagon Is Investigating the Ashley Madison Leak.

How to check if an account was exposed in the Ashley Madison hack

August 4, 2015

United Airlines

united_continental_logo_detAccording to Bloomberg Business United Airlines has reported that it’s customer flight records have been lost to a data breach.

The breach was detected in May or June of this year and involved flight manifests. Chinese hackers are suspected. These same Chinese hackers are suspected of stealing more than twenty million OPM records. Experts believe that Chinese intelligence is constructing a massive database.

United Airlines is one of the government’s largest contractors. It is believed that the stolen data contains vast amounts of information on military and government officials and federal employee’s travel.

Experts have also questioned a possible connection between the hack and the computer glitch that caused flight delays on July 8th. Evidence from the investigation reveal that hackers may have been inside United’s computers for months.

A spokesman for United Airlines declined to confirm that a breach occurred and insisted that customer’s private data is safe.

One of the major concerns is that hackers, tinkering with sensitive systems, could accidently or deliberately, cause massive flight delays or even cripple a major airline causing nationwide and potentially global aviation gridlock. Another concern is backdoors left inside computer networks that allow hackers back in at will.

United spokesman Luke Punzenberger said of customer information that United “would abide by notification requirements if the situation warranted.”

Medical Informatics Engineering

mielogolargeA data breach at Medical Informatics Engineering has compromised the data of over 3.9 million people nationwide. According MIE the information loss includes names, phone numbers, mailing addresses, user names, hashed passwords, security questions and answers, email addresses, birthdates, Social Security numbers, lab results, health insurance policy information, diagnoses, disability codes, doctors’ names, medical conditions, and spouses’ and childrens’ names and birthdates.

MIE creates electronic medical records software for health care providers and the result of the breach could impact as many as 11 healthcare providers including local, national and the federal government.

According to the company the hackers had access to the MIE servers for three weeks and have stolen the information to sell on the black market. Experts suspect the theft was likely and inside job.

MIE has reported the breach to the FBI Cyber squad and said the investigation into the security breach is ongoing. MIE  is offering free credit monitoring and identity theft protection. The company has established a toll free hotline available Monday-Friday 9:00AM-9:00PM EST at (866) 328-1987.

 July 28, 2015

Experian

ExperianLogo

Experian Credit Reporting Services is the target of a class action lawsuit filed in California. The amount is to be determined. According to the suit Experian was negligent and violated consumer protection laws because it failed to realize that for nearly a year a customer of it’s data brokerage subsidiary, Court Ventures, was actually a criminal gang specializing in selling consumer data to identity thieves. Experian purchased Court Vnetures in 2012.

The leader of the identity theft ring was sentenced to 13 years in prison last week in New Hampshire. Hieu Minh Ngo accessed as many as 200 million consumer records by posing as a private investigator based in the United States.

According to the government Ngo collected nearly $2 million from his scheme. The IRS has confirmed that 13,673 U.S. citizens had their personal information stolen and sold on Ngo’s websites Superget.info and Findget.me. The stolen identities were used to file over $65 million dollars in fraudulent tax returns.

Plaintiffs in the case have asked the court to compel Experian to notify all consumers affected by the breach, provide free credit monitoring services, turn over all profits made as a result of the Ngo relationship and to establish a fund to reimburse victims for the time and expenses of fighting fraud and correcting identity theft caused by customers of Ngo’s ID theft service.

U.S Census Bureau

2000px-Census_Bureau_seal.svgThe U.S. Census Bureau reported a data breach early last week. In a written statement released on Friday Census Bureau Director John H. Thompson said a database belonging to the Federal Audit Clearinghouse had been attacked. The FAC collects audit reports from the government agencies and other organizations spending federal money. 

According to Thompson the information included the names of people who submitted information, addresses, phone numbers, user names and other data. According the Bureau no household or business data was lost.

In the statement Thompson wrote that the intruders accessed the database through a configuration setting on an external IT system. That system is separate from the Census Bureau internal systems that stores census data.

In the statement Thompson went to say, “Over the last three days, we have seen no indication that there was any access to internal systems.”

The attack was apparently in protest of the Trans-Pacific Partnership and the Transatlantic Trade and Investment PartnershipBoth are pending trade agreements that have been widely criticized. A group calling itself Anonymous Operations claimed credit for the breach and posted a link on Twitter to four of the stolen files.

July 20, 2015

Ashley Madison

ashley-madison-hed-2014A hacking group calling itself the Impact Team has hacked into the sex hookup website AshleyMadison.com.

According to Krebsonsecurity.com massive caches of customer and company data have been stolen and posted online. The group claims to have totally penetrated the company’s networks taking control of the company’s customer database of 37 millon users, financial records and other proprietary information. As a website dedicated to cheating spouses the damage could go well beyond lost data.

Avid Life Media, which in addition to Ashley Madison also owns hookup sites CougarLife.com and EstablishedMen.com, was attacked in retaliation for lying to customers. According to the Impact Team hackers ALM advertised to customers  a service allowing members to completely erase their profile information for a $19 feeAccording to the hackers the company is not fully deleting user’s information including personally identifiable information, user’s purchase details and real name and address.

The hackers have demanded that Ashley Madison and Established Men websites be taken down immediately and permanently or more information will be released online.  The hackers are threatening to release customer records, including profiles with their secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails.

Avid Life Media CEO Noel Biderman believes the attack maybe the work of one or more persons, possibly an employee or contractor, who had legitimate access to the company’s network.

July 18, 2015

CVSPhoto.com, Costocophotocenter.com, RiteAid Photo, Sams Club, Walgreens & Tesco

CVS PhotoPNI Digital Media  is a third party vendor that handles transactions for these retailers according to KrebsOn Security.com PNI has suffered a data breach of unknown size. But it is known that customer payment information has been compromised.

Neither PNI nor any of the retailers connected with the breach have said much only saying that more information will be released as it becomes available. CVSPhoto.com took down its photo site and posted an announcement indicating an investigation is under way and that other CVS sites such as it’s pharmacy were unaffected by the breach. CVS has asked customers who used the photo service to check and monitor their card statements for suspicious activity or transactions. If anything looks strange they are to contact their bank or card company immediately to report it.

Costcophotocenter.com and RiteAid photo also took their sites down.

UCLA Health

UCLA Health has confirmed health information for as many as 4 million individuals has been exposed as a result of a data breach that may have began last September. The FBI is investigating and UCLA has hired a private forensics experts to beef up the security on it’s servers.

According to a UCLA Health statement released on Friday “criminal hackers” hacked into parts of the organization’s computer network containing personal and medical information.

UCLA Health began investigating suspicious activity on its networks in October of 2014. At the time they  did not believe the attackers gained access to areas of the network containing personal and medical information.

“As part of that ongoing investigation, on May 5, 2015, UCLA Health determined that the attackers had accessed parts of the network that contain personal information such as names, addresses, dates of birth, Social Security numbers, medical record numbers, Medicare or health plan ID numbers and some medical information. Based on the continuing investigation, it appears that the attackers may have had access to these parts of the network as early as September 2014. We continue to investigate this matter.”

Office of Personnel Management

Even though OPM suffered a data breach and the loss of information of 24 million Americans the government still has not notified those invividuals. Its been two months.

Officials from multiple agencies familiar with the investigation say that OPM is working with other agencies to set up a system to inform the victims.

An OPM official, who wishes to remain anonymous, said that because of the complicated nature of the data and movement of contract and federal employees it would be weeks before a mechanism was in place.

According to the official the government is attempting to establish a central notification system rather than rely on separate agencies to make notifications. An outside contractor  is being considered for the task but OPM has not yet asked for bids for the job.

July 16, 2015

OPM Data Breach

An interagenOPM Sealcy task force investigating April’s OPM hacking has determined with “high confidence” that as many as 21.5 million people had their personal information stolen. This includes social security numbers .

The Office of Personnel Management updated its website last Thursday with the startling new information.

According to the OPM 4.2 million former federal employees’ personnel data was stolen. While investigating that theft investigators found a much larger data theft. OPM has not yet notified the 19.7 million additional individuals affected. Those are the people who requested a background check normally for employment purposes or acces to classified information. An additional 1.8 were people were not job appicants but were either married to or co-habiting with an applicant.

In addition to personal information the hackers stole as many as one million fingerprint records.

Applicants who applied for employment had their user names and passwords for investigation forms stolen. It is also highly possible that information such as mental health history and financial history many have also been stolen. Applicants that were interviewed as part of their background investigations often reveal this sensitive information when applying for security clearences.

OPM attempted to take some of the sting from the bad news by saying “there is no evidence that health, financial, payroll, and retirement records of federal personnel or those who have applied for a federal job were impacted by this incident (for example, annuity rolls, retirement records, USAjobs, Employee Express).” The agency assures the public that it’s working to create safeguards to prevent such incidents in the future.

OPM Director Katherine Archuleta resigned her position last week after whitering criticism over the data breach.

Army National Guard Data Breach

Seal_of_the_United_States_Army_National_Guard.svgCurrent and former members of the Army National Guard members dating back to 2004 had personal information including social security numbers, birthdates and home addresses stolen. 

National Guard Spokesman Major Earl Brown, said “The National Guard Bureau takes the control of personal information very seriously,” said Brown. “After investigating the circumstances of these actions, and the information that was transferred, the Guard has determined, out of an abundance of caution, to inform current and past Guard personnel that their Personally Identifiable Information (PII) was among the files that were transferred.”

“The issue was identified and promptly reported, and we do not believe the data will be used unlawfully,” Brown said. “This was not a hacking incident, in which the intent was to use data for financial gain. Nonetheless, the Guard believes that individuals potentially affected need to know about the breach and what actions they can take to protect themselves from potential identity theft.”

If you are a member of the Nationa guard and need more information please  go to http://www.nationalguard.mil/Features/IdentityTheft.aspx or call  toll-free 877-276-4729 8AM to 4PM EST, Monday through Friday. You can also email any questions you have to dod.data.breach.questions@mail.mil

App of the Week – SupportPay

supportpay-logoLet’s be real for a minute, not everyone who gets pregnant is happily married and expecting a child. And when the situation does happen there is a different set of responsibilities and obligations that must be met. That is why SupportPay is the App of the Week.

Child support is serious business. The laws have changed drastically making it extremely difficult to avoid paying child support and extremely painful if you try. Taking your parental financial responsibility seriously and meeting the needs of the child is the best option.

SupportPay is an app that brings automation and record keeping to the child support payment process. The app allows both parents to keep track of and automate child rearing expenses in accordance with the a court order. SupportPay offers the following features;

  • Receive expenses from the other parent, review the receipts and easily pay your portion of the expense or dispute the expense.
  • Automate payments for re-occurring and incremental expenses.
  • Setup automatic payments or schedule payments in the future.
  • Make payments to anyone.
  • Tracking payment status.
  • Receive automatic updates based on your preferences.

The app also allows the parents to record expenses, attach the receipt and send the report to the other parent. The receiving parent can review the expense report and approve the payment right from their smartphone. There is a privacy function to the payment method allowing the parents to use PayPal to send payments thus protecting their financial information.

You can find more information at the SupportPay website.