Hacker Steals 130 Million Credit Card #s

This kind of theft will only get worse for the next several years - there's lots of money to be made and that is strong motivation for these criminals.

I advise keeping your funds in multiple institutions, being careful when you shop both online and in stores, and signing up with a credit reporting service so you can learn of breaches ASAP.

Hacker Indicted For Stealing 130 Million Credit Cards -- InformationWeek:
"A federal grand jury has indicted Albert Gonzales, 28, of Miami, Fla., for allegedly hacking into computers belonging to retail and financial companies and stealing more than 130 million credit and debit cards.

Gonzales, . . . and two unidentified co-conspirators located in or near Russia, are charged with conducting SQL injection attacks on corporate computer networks.

The U.S. Department of Justice says the indictment represents the largest data breach indictment ever brought in the United States.

. . .

The companies compromised by the alleged hackers are known for being compromised in some of the biggest data breaches in recent years have been reported. They include: Heartland Payment Systems, 7-Eleven, and Hannaford Brothers.

Two other major U.S. retail companies are mentioned in the indictment but they are identified only has "Company A" and "Company B," presumably because they are not under an obligation to publicly report the breaches attributed to the alleged hackers.

Gonzales was indicted in New York in May, 2008, and in Massachusetts in August, 2008, for alleged involvement in the theft of over 40 million credit and debit cards from other companies including TJX Companies, BJ's Wholesale Club,OfficeMax (NYSE: OMX), Boston Market, Barnes & Noble, Sports Authority, Forever 21, DSW and the Dave & Buster's restaurant chain.

The indictment claims Gonzales and alleged co-conspirators relied on sophisticated techniques to avoid detection, like connecting to corporate computers through proxy servers, testing approximately 20 different antivirus programs to determine whether their malware might be detected, and using malware that attempted to erase signs of its presence.

. . . "

Malware attacks U.S. Marshals & FBI

The solutions were bought and paid for, but installations of them are months & years behind. PC security has to be a priority even when it seems like a waste of time. This is one reason why turning on automated updates is important for personal and business systems.

Malware knocks out U.S. Marshals Service network - Network World:
"Malware Wednesday crippled Windows-based computer systems at the U.S. Marshals Service, which hunts federal fugitives and operates the country's witness protection program, knocking the agency’s network offline.

The agency's press office confirmed it was having network problems and that its e-mail system was down this morning, but it was unclear if the outage extended across the entire network.
. . .
The agency's Web site was up and running this morning, but a receptionist in the press office said "the agency's whole e-mail system is down, and the agency is unable to receive e-mail."

Later, another press office staffer confirmed that there were network problems.

Members of the agency's IT staff were communicating with vendors via Gmail accounts as they attempted to work through the issue.
. . .
The U.S. Marshals Service runs Trend Micro’s OfficeScan, an anti-malware software that installs on desktops, laptops and mobile devices.

The agency, however, runs the 5.0 version, which is more than three years old. Trend Micro says protection against Neeris has been in OfficeScan since version 8. The current version is 10.

'[Their version] is a vastly out-of-date, end-of-life product,' said Sweeny.

In addition, Sweeny said the U.S. Marshals Service maintenance contract was up-to-date, meaning the agency had paid for upgrades to the software but had failed to install them.
. . .
23 of 24 major federal agencies had weaknesses in their agency-wide information security programs. Those agencies included the DOJ.

While the Neeris worm has been around since 2005, a new version was discovered just last month that used the same vulnerability targeted by Conficker. The new version spreads via the Windows "autorun" command.

A patch to close the critically-rated vulnerability that Neeris and Conficker exploit was issued in October by Microsoft."

The FBI was also affected but is saying less.

Computer virus strikes US Marshals, FBI affected:
"Law enforcement computers were struck by a mystery computer virus Thursday, forcing the FBI and the U.S. Marshals to shut down part of their networks as a precaution.

The U.S. Marshals confirmed it disconnected from the Justice Department's computers as a protective measure after being hit by the virus; an FBI official said only that that agency was experiencing similar issues and was working on the problem.
. . .
Marshals spokeswoman Nikki Credic said the agency's computer problem began Thursday morning. The FBI began experiencing similar problems earlier.
. . .
In addition to their external networks, most federal law enforcement agencies have an internal-only network to prevent cyber-snoopers from sensitive data.

In Thursday's incident, the Marshals Service shut down its Internet access and some e-mail while staff worked on the problem. The FBI made similar moves to protect its system."

Our Military Bans USB ThumbDrives, etc.

If you remember "Don't Copy That Floppy!", then you've been through this before. The Viruses, Trojans, and other crud collectively called Malware will get onto computers via any path available. USB Thumbdrives are now very cheap and easy to use as part of a sneaker-net. Unfortunately, they're just as convenient for personal use and this is how malware usually finds it's way into corporate / work / military systems. Scan a computer used by a young adult, and you'll likely find a variety of malware waiting for a chance to spread itself around. In theory, we should all scan our systems before writing files to an external device, but in practice most of us don't even scan our systems on a regular schedule.

In the near future I expect the technology to scan and secure thumb drives will be miniaturized and built into the devices themselves. A few years later, the prices will have come down to the level that we mere mortals consider reasonable, and the hackers will have to find another delivery mechanism. History shows that they will succeed.

Practice Safe Computing!

Under Worm
Assault, Military Bans Disks, USB Drives Danger Room from Wired.com:
"The Defense Department's geeks are spooked by a rapidly spreading worm crawling across their networks. So they've suspended the use of so-called thumb drives, CDs, flash media cards, and all other removable data storage devices from their nets, to try to keep the worm from multiplying any further.

It applies to both the secret SIPR and unclassified NIPR nets. The suspension, which includes everything from external hard drives to "floppy disks," is supposed to take effect "immediately." Similar notices went out to the other military services.

In some organizations, the ban would be only a minor inconvenience. But the military relies heavily on such drives to store information. Bandwidth is often scarce out in the field. Networks are often considered unreliable. Takeaway storage is used constantly as a substitute."