Guest Post - Nick Volpe - Identity Theft - 500K American impacted annually

Nick Volpe is a Spring Semester Cybersecurity Research Analyst at Fortalice®, LLC.  He is a student at Immaculata University.

Research Outline  

Topic: Stolen Identity
Date: 2/23/10 

TEASER/TITLE: Don’t be one of the 500,000 Americans that will have their identities stolen this year! 

SUMMARY PARAGRAPH: Personal information and the privacy of that information has always been an issue. At the same time, there have always been exploiters of that information and privacy that goes along with it. As technology advances, both information and privacy gets stronger and much more complex and the methods used by thieves must catch up to the technology. According to CBS News, this year 500,000 Americans will have their identities stolen with up to $4 billion in damages. 

KEY FINDINGS
(List 3-5 bullets)

• Popular ways identity thieves are stealing personal information:
• Dumpster diving – getting information out of the trash
• Skimming – using a device to steal your credit or bank card number
• Phishing – using trickery usually in the form of SPAM e-mail or Pop-up solicitations to get a victim to reveal personal information
• Change of address – using a change of address form to divert personal mail to another location
• General theft – stealing electronics as well as wallets and purses to gather personal information

   
BACKGROUND
2-3 PARAGRAPHS
Theft is always a prevalent issue in any society. From mass looting to pick pocketing, criminals come up with new and sneaky ways to make money and satisfy their greed. When it comes to identity, thieves find it to be a very comfortable and sometimes easy way to steal assets from an unknowing victim. All it takes is a phone call with a fake name or some social engineering to convince a company that you are another person.
There are many laws afforded to us by our government that try to protect our right to privacy in terms of identity. Some of those laws include the Identity Theft and Assumption Deterrence Act, the Fair Credit Reporting Act, and the Gramm-Leach-Bliley Act which were put in place to help American consumers gain control over their information.
However, this is still not enough. Protecting oneself from identity theft requires effort and proactive measures.
STRATEGIC PLANNING ASSUMPTIONS:
(3-5 Bullets that talk about any future trends noted for beyond 2010)

• Companies using more and more factors of authentication to protect the identity of their customers/clients (e.g. banks using images and key fobs as a form of authentication)
• Government pressing harder and stricter laws for companies to protect data using multi-factor authentication such as biometrics

   
ANALYSIS:
2-3 PARAGRAPHS
Identity theives are a new kind of criminal. With vast resources like the internet, they are able to gain valuable personal information on a person with a small amount of effort if the victim is not careful enough. They are using new tactics like phishing and skimming as well as older tactics including dumpster diving and theft. Regardless of how the identity is stolen, a person must be proactive with their own identity and personal information including mail, financial information, and government documents.
Many Americans have had or will have their identity stolen at some point and it will cost them billions of dollars and massive amounts of time cleaning up from it. The cheapest, easiest, and most effective way of recovering from identity theft is never letting it happen by being very cautious and following all recommendations. Consumers must safeguard their information as best as possible in order to keep their identity to themselves.
IMPLICATIONS:
5-10 BULLETS

• You may be a victim of stolen identity if:
• You detect fraudulent charges or unknown payments on your financial accounts such as bank accounts and credit card accounts
• You suspect or know that you aren’t receiving all your mail, especially statements
• You find accounts have been opened in your name without your knowledge
• You are confused or suspicious about information appearing on your credit report
• How to recover from/get out of identity theft:
• Contact your local police department to report the crime
• Keep documents of all contact with financial institutions and authorities
• Place a security freeze or fraud alert on your credit report at all 3 major credit bureaus
• Monitor closely all credit accounts and contact the creditor if fraudulent activity is suspected
• Use a credit monitoring service as a third party method of getting yourself out of identity theft
• Change all your PINs/passwords and close accounts that have been accessed fraudulently
• Contact the DMV, U.S. State Department, the FTC, your local postal inspector, Social Security Administration (SSA) to make sure other documents or assets haven’t been utilized in your name

   
RECOMMENDATIONS:
5-10 BULLETS

• Tips for protecting personal identity:
• Be aware of what information is out there about identity theft so that you can protect your own
• Sign your name on all credit and debit cards and only carry the ones you need on your person
• Shred documents with personal information including social security number
• Get a free copy of personal credit report annually from all 3 major credit bureaus
• Equifax
• TransUnion
• Experian
• Protect and encrypt personal information stored on laptops and mobile electronics such as smartphones and PDAs
• Always confirm the use of Secure Socket Layer (SSL) certificates on sites where you make financial transactions or deal with financial or personal information like e-merchants and online banking

   
SOURCES:

1. "Fighting Back Against Identity Theft." Federal Trade Commission. FTC, Web. <http://www.ftc.gov/bcp/edu/microsites/idtheft/index.html>.
2. "Stolen Identity: A Consumer Nightmare." Infoplease. Pearson Education, Web. <http://www.infoplease.com/ipa/A0903927.html>.
3. "What To Do If Your Identity Is Stolen." Nolo. Web. <http://www.nolo.com/legal-encyclopedia/article-29691.html>.
4. "If Your Identity Is Stolen." BBB Online. Better Business Bureau, Web. <http://www.bbbonline.org/idtheft/stolenid.asp>.
5. Lipka, Mitch. "6 Signs Your Identity May Have Been Stolen." Wallet Pop. 16 Oct 2009. AOL, Web. <http://www.walletpop.com/fraud/eim/article/6-signs-your-identity-may-have-been/721005>.
6. "Learning Center: Facts and Statistics." Equifax. Equifax, Web. <http://www.equifax.com/cs/Satellite/EFX_Content_C1/1172182371408/5-1/5-1_Layout.htm>.
7. Reynolds, George. Ethics in Information Technology. 2nd ed. Boston, MA: Cengage Learning, 2007. 105-131. Print. 

APPENDIX 
"More than 27 million Americans have been victims of identity theft in the last five years.... To deal with the problem, consumers reported nearly $5 billion in out-of-pocket expenses."
-The New York Times
"Stealing someone's identity to acquire -- and use -- new credit cards has become one of the most popular white-collar crimes today, according to fraud investigators from across the country."
-Knight Ridder/Tribune Business News
"This year alone more than 500,000 Americans will be robbed of their identities...with more than $4 billion stolen in their names."
-CBSnews.com
"In one notorious case of identity theft, the US Department of Justice reported that the criminal incurred over $100,000 of credit card debt, obtained a federal home loan, and bought homes, motorcycles, and hand guns in the victim's name all the while calling his victim to taunt him."
-US Department of Justice Web site
"The number of identity thefts in the U.S. has skyrocketed during the past 15 months."
-CNN.com
"According to a convicted ID thief in Denver, CO, "On a good day I could make $5,000 in cash and another $7,000 to $8,000 in merchandise..."
-CBSnews.com
"A recent report on identity theft warned that there is likely to be "mass victimization" of consumers within the next two years. The report said consumers should be extra careful to monitor all their financial transactions for unexplained account activity, withdrawals, or fund transfers."
-The Gartner Group, a technology research group
"Every 79 seconds, a thief steals someone's identity, opens accounts in the victim's name and goes on a buying spree."
-CBSnews.com
"Experts report that a victim can spend anywhere from six months to two years recovering from identity theft."
-CNNfn.com
"Most people don't find out they have been a victim of a stolen identity until they are turned down for a loan or credit card. A copy of their credit report explaining the denial may unveil weeks or months of fraud."
-CNNfn.com

Source: Equifax

Guest Post - Nick Volpe - Small Businesses Need More Banking Protection

Nick Volpe is a Spring Semester Cybersecurity Research Analyst at Fortalice®, LLC.  He is a student at Immaculata University.

Research Outline 
by Nicholas W. Volpe 

Topic: Small and medium sized businesses are getting hacked and their bank accounts wiped out.
Date: 3/22/10 

TEASER/TITLE: Small Businesses Need More Banking Protection Like Consumers Do 

SUMMARY PARAGRAPH: Cyber-attacks by crooks are being targeted at businesses and their banking institutions. This can be attributed to the fact that small and medium sized businesses do not have all of the protections that consumers have on their banking accounts. This means that many fraudsters will exploit the flaws in the banking system to steal money from companies who may never get that money back. 

CASE 1

• Pennsylvania housing development company
• Cumberland County Redevelopment Authority
• Theft took place against their bank, M&T on September 22, 2009
• $479,000+ was stolen from their bank account
• About $109,000 was originally recovered with no record of additional recovered amounts
• The criminals used a Clampi Trojan to infect a computer to get the necessary information required in the theft of the money
• Money was dispersed to other accounts at numerous other banking institutions

CASE 2

• Bullitt County, Kentucky
• $415,000 stolen from the county’s payroll accounts beginning on June 22, 2009 and lasting a few weeks
• Criminals used a key logging Trojan known as “Zeus” or “Zbot” on county treasurer’s PC
• Stolen information is sent via instant message
• Creates a tunnel between infected computer and infector’s computer so that the criminal can log on to the bank account with the infected computer
• Criminals dispersed funds to about 25 co-conspirator third-parties throughout the country
• Some if not all of the co-conspirators, or “money mules”, were recruited via Careerbuilder.com.
• Money was wired to the criminals in the Ukraine
• Bank told county that some of their money probably could be recovered but they weren’t sure of how much could or would be as of the writing of this article

CASE 3

• Western Beaver School District outside of Pittsburgh, PA
• More than $700,000 was stolen from the school district’s account
• The school district filed a lawsuit against their bank, ESB Bank, alleging that the bank should have prevented or flagged the fraudulent transaction because of the excessive amount of transactions in the school district’s account. The lawsuit seems to still be open.
• Criminals used some type of malicious software to steal the funds
• Funds were transferred between December 29, 2008 and January 2, 2009 in 74 transactions to 42 random individuals throughout the country

CASE 4

• Slack Auto Parts in Gainesville, GA
• About $75,000 was stolen from company’s bank account between July 3 and July 7, 2009
• An additional $69,000 theft was attempted but blocked by the bank
• Criminals used malicious Clampi Trojan, or "Ligats" and "Rscan", key logger on the company controller’s Windows PC to steal bank account passwords and access information
• Malicious software was found by a computer investigator to have been present on the system for over a year
• 9 transactions were wired to at least 6 “money mules” all over the country
• The bank was able to reverse $14,000 worth of wire transfers and the CEO of the company worked with the bank to try and recover the rest of the funds

   
IMPLICATIONS & RECOMMENDATIONS:
5-10 BULLETS

• Consumers are protected from unauthorized transactions by US law
• Businesses are not protected by the same laws
• Many banks do not have algorithms to detect fraud against business transaction processing systems, commonly ACH systems
• Businesses should only do online banking from locked down workstations with web browsing and email disabled
• Businesses need to be more vigilant and constantly checking their account to see exactly what is happening with their money

   
SOURCES:

1. Krebs, Brian. "PC Invader Costs Ky. County $415,000." Security Fix. The Washington Post, 2 July 2009. Web. <http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html>.
2. Krebs, Brian. "The Growing Threat to Business Banking Online." Security Fix. The Washington Post, 20 July 2009. Web. <http://voices.washingtonpost.com/securityfix/2009/07/the_pitfalls_of_business_banki.html>.
3. "$479,000 heist from small business bank account lends weight to calls for online banking 'lock-down'." Finextra. Finextra Research, 16 Oct. 2009. Web. 23 Mar. 2010. <http://www.finextra.com/News/fullstory.aspx?newsitemid=20617>.

Guest Post - Nick Volpe - Summary of What's Hot in the Security Headlines

Guest Post from Nick Volpe.  Spring Semester Intern at Fortalice®, LLC.  Attending Immaculata University.

Facebook Expect to Launch Location-Aware Feature

It seems as if Facebook has long been put into the hot seat over its data privacy features. More specifically, what settings Facebook deem are appropriate defaults have come under scrutiny with less sophisticated users not knowing what information from their profile is available to whom and how to change that selection of information. In April 2010, Facebook will begin to allow its registered users to share their geographical location with their friends in their news feeds. The supposed location-based feature(s) are expected to be unveiled in late April at Facebook’s annual f8 developer conference in San Franscisco. According to company reports, the feature will be opt-in allowing users to choose if they wish to participate or not. Given the companies track record on security, however, users should be vigilant and check changes to privacy policies and settings. The news comes after popular micro blogging competitor, Twitter, announced a similar location-based feature for their offering. Officially, Facebook will neither confirm nor deny the anticipated announcement.

Sources:

AllFacebook.com: “Facebook Prepares To Release Location Service At f8” by Nick O’Neil http://www.allfacebook.com/2010/03/facebook-prepares-to-release-location-service-at-f8/
NYTimes.com Bits Blog: “Facebook Will Allow Users to Share Location” by Nick Bilton http://bits.blogs.nytimes.com/2010/03/09/facebook-will-allow-users-to-share-location/
PC Magazine: “Report: Facebook to Add Location Info to Updates” by Brian Heater http://www.pcmag.com/article2/0,2817,2361237,00.asp

New Statistics Show About 12% of Employees Willingly Violate Company IT Policy

One of the biggest and most difficult to address points of failure in terms of IT security problems is employee error. According to a new survey conducted by firm Harris Interactive, 12% of the United States workforce claimed to have willingly violated their companies IT policies. The employees are something that IT departments need to worry about maybe even more so, in some sense, than antivirus and malware infection in the network. IT departments and companies simply are not tough enough on enforcing their policies as they should be thus making employees the largest cause of corporate data loss.

Sources:

Ars Technica: “Bad employee! 12% knowingly violate company IT policies” by Jacqui Cheng http://arstechnica.com/business/news/2010/03/bad-employee-12-knowingly-violate-company-it-policies.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss
Pivotal Payments: “12% of employees intentionally breach corporate IT policy, study shows” by Kristen Lawrence http://www.pivotalpayments.com/ca/industry-news/12-of-employees-intentionally-breach-corporate-it-policy-study-shows-19667517/                                                               

Highly Marketed Identity Protection Agency LifeLock Fined by FTC

The identity protection industry is highly lucrative and popular amongst individuals that aim to keep their confidential information private. There are firms that, for a monthly fee, claim to protect your identity by closely monitoring credit reports and other identifying accounts and information in order to protect your identity or at least attempt to do so.
LifeLock, one of these identity protection services, was fined by the US Federal Trade Commission for false advertising. The company guaranteed its clients that for as long as they paid, their identity would never be stolen and they would not be susceptible to fraud. As it turns out, you really can’t guarantee that a person’s identity can’t or won’t be stolen. There are simply too many factors in that. Ironically, the CEO of LifeLock, who freely gave out his social security number publicly as a testament to his service, fell victim of identity theft himself.

Sources:

Total Bankruptcy: “LifeLock Fined for Inappropriate Identity Theft Protection Claims” http://www.totalbankruptcy.com/blog/lifelock-fined-for-inappropriate-identity-theft-protection-claims/
Ars Technica: “LifeLock fined $12 million over lack of life-locking ability” by Jacqui Cheng http://arstechnica.com/tech-policy/news/2010/03/lifelock-cant-guarantee-id-theft-prevention-after-all-settles-with-ftc.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss

Guest Post - Nick Volpe - Stealing Your Identity!

Guest Post from Nick Volpe

Nick Volpe is at student at Immaculata University.  He is also a cybersecurity research analyst intern for Fortalice®, LLC.

Research Outline  

Topic: Electronic ID Theft
Date: 3/1/10 

Electronic identity theft jumped by 12% over last year. 

SUMMARY PARAGRAPH: Identity theft online is on the rise. The crime itself is expanding as criminals and ID thieves are finding new means of stealing a consumer’s identity either through consumer mistake or a corporate lack of security. All sectors are affected by this crime including government, business, consumers, etc. Overall awareness is up yet the crime is still very serious and very lucrative for evil doers. They want everyone’s money.  

KEY FINDINGS
 Electronic ID theft is on the rise because of thieves finding new holes in the system to exploit and more consumers are being targeted by more ID thieves than ever before

• Total cost to consumers in 2007 was $1.2 billion according to FTC estimate
• About $691 loss on average
• Total cost to business in 2007 was about $6.3 million per incident
• In 2009, in increased number of people were affected by ID theft however the average dollar loss and time loss dropped

   
BACKGROUND
The rise in ID fraud is happening in many new ways electronically. Thieves are using public Wi-Fi to sniff the data from other people on the network, using sophisticated software to crack passwords to online accounts, and using skimmers at ATMs and the like to collect personal data that can be distributed or sold online. There have been increases in phishing attacks that trick consumers into giving a fraudster their personal information, malware attacks that capture the information on a workstation or personal computer, and attacks against processing systems that store critical financial or personal data.
Electronic ID theft makes up about 10 to 12 percent of all identity theft. Another interesting and less heard of form of electronic ID theft is vishing, or voice phishing, which involves the use of an electronic telephone system to trick a consumer into giving a fraudster their sensitive information for whatever purpose.  

STRATEGIC PLANNING ASSUMPTIONS:


ANALYSIS:
 Businesses, like consumers, also fall victim to electronic identity fraud schemes. Individuals tend to be easier targets for fraudsters than businesses but businesses take the bigger hit. Businesses should make a major effort to protect their employees and especially their customers so that nobody has to fall victim to this crime that can destroy reputations and financial aspects of people’s lives. There are simple cost effective steps that businesses can take to prevent this crime from happening within their brand.
Consumers, however, have the biggest burden to protect themselves from this crime as they have to use their own time and money getting out of ID theft. Consumers are also much easier for ID thieves to target online because many victims are unaware of what information is out there about them. It can even be as simple as doing a Google search to find out a victims date of birth in order to fraudulently change the victims password by answering security questions on banking websites. People simply need to take action and think outside to box rather deny that it can happen to them. Once a person agrees that it can happen to them, they are already on the way to protecting their identity.


IMPLICATIONS:

•  Steps that businesses need to take in order to effectively prevent electronic ID theft on consumer or employee/company data
• Securing the corporate network with firewalls, anti-malware protection, and intrusion protection
• Keeping all systems up to date including operating systems and web browsing software
• Insuring an employee web/technology use policy to protect both the company and employees
• Enforce strong passwords in all systems online and off as well as changing of the passwords frequently
• Complete regular maintenance and security checks on all company PCs and systems regularly

RECOMMENDATIONS:

•  Guarding against consumer electronic ID theft
• Be wary of e-mails requesting any kind of personal information
• Most companies will never ask you for personal information such as SSN, online username, and password via e-mail
• If an email looks suspicious, it is better not to open it
• Purchase an internet security suite to help aid in protecting your data and privacy which will in turn help protect your identity
• Never download unknown files from the internet especially from websites you don’t trust
• Monitor all online accounts for fraudulent activity such as banks and other financial institutions
• Do a simple Google search of your name – what information is out there about you?
• Businesses can protect themselves by educating their employees to take the same proactive measures as consumers within the workplace

   
SOURCES:

1. Hines, Matthew. "Report: ID Fraud Grows At Record Pace." eWeek Security Watch. 11 Feb 2010. Ziff Davis, Web. <http://securitywatch.eweek.com/identity_theft/report_id_fraud_grows_at_record_pace.html>.
2. "Javelin Study Finds Identity Fraud Reached New High in 2009, but Consumers are Fighting Back." PRNewswire. 10 Feb 2010. Javelin Strategy & Research, Web. <http://www.prnewswire.com/news-releases/javelin-study-finds-identity-fraud-reached-new-high-in-2009-but-consumers-are-fighting-back-83987287.html>.
3. "More Consumers Experience Fraud, but Mean Consumer Costs and Resolution Hours Drop." NewsCom. 10 Feb 2010. NewsCom, Web. <http://www.newscom.com/cgi-bin/pub/s?f=PRN/prnpub&page=1&xtag=PRN-prnphotos-89538&redir=detail&TAG_ID=prnphotos089538>.
4. Steiner, Sheyna. "The costs of ID theft." Bankrate.com. 21 Apr 2008. Bankrate, Inc., Web. <http://www.bankrate.com/brm/news/Financial_Literacy/identity_theft/costs_of_identity_theft_a1.asp?caret=92a>.
5. "New Research Shows Identity Fraud Growth Is Contained and Consumers Have More Control Than They Think." BBBOnline. 31 Jan 2006. Better Business Bureau, Web. <http://www.bbbonline.org/IDtheft/safetyQuiz.asp>.
6. "Don't Be an On-line Victim: How to Guard Against Internet Thieves and Electronic Scams ." FDIC. Web. <http://www.fdic.gov/consumers/consumer/guard/>.

Guest Post - Nick Volpe - Groups Working on our Cyber Problem

Guest post from Nick Volpe.

Nick Volpe is at student at Immaculata University.  He is also a cybersecurity research analyst intern for Fortalice®, LLC.

Research Outline  

Topic: Groups that Track Emerging and Current Security Threats
Date: 4/9/2010 

GROUP 1: CERT/CC 

• GROUP DESCRIPTION:

The CERT/CC is the Computer Emergency Response Team Coordination Center run by Carnegie Mellon University in Pittsburgh, PA. It is federally funded and serves as a major reporting center for internet security threats and problems including breaches at the software and system levels. CERT/ CC staff coordinates responses to security issues and offer technical assistance. 

• COST TO JOIN: N/A, Free resources available

• SIMILARITIES WITH OTHER GROUPS:

• Deals with cyber security response much like US-CERT and other CERT groups
• Collaborates with information between government and the private sector
• Federally funded

• UNIQUENESS FROM OTHER GROUPS:
• Run by an academic institution

GROUP 2: InfraGard 

• GROUP DESCRIPTION:
  
  InfraGard is a collaboration of the US Federal Bureau of Investigation and private sector businesses and organizations with the intention of promoting the open communication between business and law enforcement for the purpose of protecting proprietary information and assets. Local chapters are available to facilitate information sharing and various member benefits including training. 

• COST TO JOIN: Free for US citizens

• SIMILARITIES WITH OTHER GROUPS:

• Federally funded
• Facilitates information sharing between sectors

• UNIQUENESS FROM OTHER GROUPS:

• Gives access to sensitive government data
• Local chapters with access to information and training
• Close ties with the FBI for coordination

GROUP 3: US-CERT 

• GROUP DESCRIPTION:

The US-CERT or United States Computer Emergency Readiness Team of the National Cyber Security Division at the US Department of Homeland Security provides response support and defense against various cyber attacks for the Federal Civil Executive Branch and information collaboration between government agencies and industry. 

• COST TO JOIN: N/A, Free subscriptions

• SIMILARITIES WITH OTHER GROUPS:

• Deals with cyber security response much like CERT/CC and other CERT groups
• Collaborates with information between government and the private sector

• UNIQUENESS FROM OTHER GROUPS:
• Part of the Department of Homeland Security
• Defends the Federal Civil Executive Branch

   
GROUP 4: SANS 

• GROUP DESCRIPTION:

The SANS (SysAdmin, Audit, Network, Security) Institute is a cooperative research and educational organization with programs for security professionals all over the world and is one of the most trusted and largest source of information security training and certification. SANS also operates the internet early warning system called “Internet Storm Center.” 

• COST TO JOIN: Free information security research documents, training, and whitepapers

• SIMILARITIES WITH OTHER GROUPS:

• Offers training to information security professionals
• Cooperative with training and certification programs

• UNIQUENESS FROM OTHER GROUPS:
• Has its own early warning system

GROUP 5: FS-ISAC 

• GROUP DESCRIPTION:

The FS-ISAC or Financial Services Information Sharing and Analysis Center gather information about both cyber and physical risks for the financial services sector. It was established to protect critical US infrastructure and constantly gathers information that is reliable and timely for financial providers and firms. 

• COST TO JOIN: Ranges from $850/year to $49,950/year depending on organizations assets and revenue

• SIMILARITIES WITH OTHER GROUPS:

• Protects US infrastructure
• Coordinates sharing of critical data

• UNIQUENESS FROM OTHER GROUPS:

• High cost to join
• Specifically intended for the financial services sector
• Deals with both cyber and physical attacks

SOURCES:

1. CERT Coordination Center (CERT/CC) http://www.cert.org/certcc.html
2. CERT/CC Definition from PC Magazine Encyclopedia http://www.pcmag.com/encyclopedia_term/0,2542,t=CERTCC&i=39534,00.asp
3. About InfraGard http://www.infragard.net/about.php?mn=1&sm=1-0
4. US-CERT: About Us http://www.us-cert.gov/aboutus.html
5. SANS: About SANS http://www.sans.org/about/sans.php
6. About the FS-ISAC http://www.fsisac.com/about/

Guest Post - Nick Volpe - Skimming, we're not talking about milk, we're talking about ATM $$ theft

Nick Volpe is at student at Immaculata University.  He is also a cybersecurity research analyst intern for Fortalice®, LLC.

Here is his guest post regarding ATM Skimming

Research Outline  

Topic: ATM Skimming
Date: 2/23/10 

TEASER/TITLE: ATM Skimming is among the top forms of fraud 

SUMMARY PARAGRAPH: There are more than 360,000 ATMs in America. Some belong to banks and others belong to malls, stores, hotels, and airports. Despite the fact that most ATM skimming crimes happen at an ATM machine, the crime can also be committed at restaurants and retail establishments where ATM/debit or credit cards can be used. There are skimming devices that can read cards in retail points-of-sale or with a manual swipe by any person that comes in contact with your card.  

KEY FINDINGS

• 2 types of ATM skimming
• Devices that interact with ATM machine
• Causes ATM to malfunction and not dispense cash
• Devices that do not interact with ATM machine
• Allows ATM to function normally
• Using skimmed ATM card information, scammers can create fake duplicates and use them in ATM machines to withdraw money very quickly and easily
• Many times ATM skimming scammers will using a card-skimming device in conjunction with a hidden camera to record the users PIN number when it is typed on the ATM keypad

BACKGROUND
 Crimes at ATMs started around 20 years ago when a person would be injured and their money stolen after using the ATM. As the crime got more sophisticated, it would be a person looking over another person’s shoulder to get their ATM card number and PIN. ATM Skimming has been a problem since the 90s. It has recently became a much more massive problem because of smaller and more mobile computing devices that allow the criminals to store lots of data they need to steal and sell many ATM cards and PINs.


There are 2 common types of ATM skimming. The first type interferes with the operation of the ATM machine and the other type does not interfere with it. The second type is simply a device that records the card and PIN information from the magnetic strip of the card without being suspicious. The first type, however, interferes with the ATM by replacing it’s built in card reader thus not allowing the ATM user to get their money which is much more suspicious.  

STRATEGIC PLANNING ASSUMPTIONS:

•  Jitter is a new technology being utilized in brand new motorized card readers in ATMs. The technology ultimately randomizes the speed and direction of the card insertion/ejection which confuses or nullifies skimming devices that may be in use.
• Criminals will bypass card readers to collect ATM card and bank account information by hacking into payment processing databases or other databases that store the same information

   
ANALYSIS:
Recent cases of ATM skimming include an Australian fast-food chain’s point of sale system which compromised about AU$2.5 million in October 2009. In November 2009, some new high-tech skimmers were discovered with Bluetooth transmitters to steal the stolen information. A terminal in a 


New Zealand car park was compromised and potentially exposed about 100,000 people in a short time period. Some co-operation has existed between USA and Europe to prosecute suspects in an earlier compromise of major US processor, RBS WorldPay.


Although much of the crime of ATM skimming started and is occurring in the UK and parts of Europe and Asia, much of the crime is happening right here in the US where stand-alone ATM machines are very common in many venues around the country. There are many tactics that criminals use to skim necessary information to perform the crime including cameras, wireless pin pads, Bluetooth transmitters, laptops, mobile devices, external card readers, skimmers, etc. At the same time ATM manufacturers, banks, and authorities are using their own tactics to combat the criminal activity including swipe card readers versus manual card readers, surveillance cameras, PIN encryption, etc. 

IMPLICATIONS:

•  Avoid ATMs in public locations such as malls, hotels, and airports. Stick with ATMs in bank lobbies and ATMs monitor with security surveillance.
• ATM skimming will continue to be on the rise as the crime becomes more and more lucrative with bigger and bigger amounts of money being scammed.
• ATM card readers will get more and more advanced with emerging technologies but criminals will use other methods to steal ATM card information such as hacking into databases of payment processors that contain that necessary information.

   
RECOMMENDATIONS:

•  Safeguard your ATM pin at all times
• Never let a stranger give you assistance at an ATM
• Always check statements to beware of fraudulent activity on the account
• Inspect the machine before use and if the machine has any visual defects or something seems odd, don’t use it
• Beware of people around you that may be able to see your information
• If your ATM card is not returned after your transaction, contact your financial institution immediately
• Never use an ATM that exhibits a sticky substance such as glue which is sometimes used to trap cards

SOURCES:

1. "ATM Camera." Snopes.com. 01 Feb 2010. Web. <http://www.snopes.com/fraud/atm/atmcamera.asp>.
2. Bruce, Laura. "Skimming the cash out of your account." Bankrate.com. Bankrate, Web. <http://www.bankrate.com/finance/checking/skimming-the-cash-out-of-your-account-1.aspx>.
3. "ATM Skimming is on the Rise." Complaints Board. Consumer Complaints Board, Web. <http://www.complaintsboard.com/news-stories/atm-skimming-is-on-the-rise.html>.
4. Russell, Douglas. "2009 - Skimming Review." ATMSecurity.com. 19 Jan 2010. DFR Risk Management, Web. <http://www.atmsecurity.com/monthly-digest/atm-security-monthly-digest/2009-skimming-review.html>.
5. "How to Protect Against ATM Skimming." eHow. Demand Media, Web. <http://www.ehow.com/how_5025049_protect-against-atm-skimming.html>.

APPENDIX 
Timeline of 2009’s biggest data breaches at major financial institutions (including major skimming crimes): http://www.bankinfosecurity.com/articles.php?art_id=1766&pg=1

Guest Post - Nick Volpe

Nick Volpe is at student at Immaculata University.  He is also a cybersecurity research analyst intern for Fortalice®, LLC.

Here is his guest post regarding some key headlines:  1.  VISA  2.  TOP 10 THREATS FOR 2010 3.  GOOGLE


Credit Giant Visa Acquires Payment Security Firm


Credit card giant Visa has announced plans to acquire a provider of electronic payment, risk management, and payment security solutions for online services. The company, CyberSource, processes just about 25% of all online transactions in the US including on Facebook, Home Depot, and Google among others.  Once combined, Visa will have a better advantage at helping companies minimize loss of dollars in fraud. Joseph W. Saunders, Chairman and CEO of Visa said in regards to the news, "Online commerce continues to grow rapidly and this acquisition will enable Visa to offer new and enhanced services that will better meet the growing demand among merchants globally for robust, secure online payment processing capabilities which in turn will grow the entire eCommerce category."  The transaction still has to be approved by stockholders and regulators but looks promising.

Source: “Visa Inc. to Acquire CyberSource to Accelerate eCommerce Growth”  http://corporate.visa.com/media-center/press-releases/press1010.jsp

Inside Tech’s Top Info Security Threats of 2010

Malware is a very serious and escalating threat that tops Inside Tech’s list. Many software vulnerabilities still exist today and will continue to exist but another major component of getting malware is human error. IBM reported that during the first half of 2009, malicious links on sites increased 508%.

Also, that same year, the FBI reported that cybercrime cost more than $1 billion in profits, surpassing drug trafficking as the most lucrative illegal business.

Malicious Insiders come usually in the form of disgruntled employees. Fannie Mae and United Way are two cited cases where former employees disrupted operation of the company soon after leaving the company.

Exploited Vulnerabilities are a major issue separate from malware because many consumers and organizations are not patching their systems properly. Microsoft’s Security Intelligence Report notes Conficker as the top threat to enterprise during the first half of the year 2009.

Careless Employees can be a major threat to an organization. Sometimes, people do not realize they can fall victim to social engineering attacks and other malicious attacks intended to steal information important or insignificant. According to research done by RSA, 52% of respondents admitted to accidental data loss while 19% admitted to deliberate data loss.

Mobile Devices are easy ways for people to obtain information from corporate network remotely. Some malicious software target these type of devices because they are not usually protected from such types of software and can be a means of access to these pools of valuable data. A USB drive infected with
Conficker shut down a town council for a few days costing them just short of a million dollars.

According to the CTO of SMobile Systems, over 400 mobile viruses and malware are known.

Social Networking compromises personal data because malicious software can be designed to specifically target these users. More and more employees are also accessing these sites from company systems which increase the threat against the organization.

Social Engineering takes place on just about every medium. As security software and hardware gets more and more sophisticated, hackers depend on social engineering increasingly.

Zero-Day Exploits happen when hackers exploit vulnerability before a patch or fix exists. This is especially bad for companies depending on software vendors to develop the fix hence putting the company at risk in the meantime. These exploits are an ongoing and steady risk. Microsoft alone has 3 exploits in IE 6, 7, and Windows 7.

Cloud Computing Security Threats is a problem in that web-based services aren’t necessarily secured in the way we would normally expect. Many use encryption for security and some use no security which puts a lot of information at risk. Many exploits are also designed to attack web services like a recent Yahoo Mail incident that exposed accounts to hackers.

Cyber Espionage is occurring more and more. This mostly happens in government organizations but is still a major threat to us all. The U.S. Department of Defense has seen an about 60% increase over 2008 in targeted cyber attacks.

Sources: “The Top 10 Information Security Threats of 2010”

http://insidetech.monster.com/careers/articles/8056-the-top-10-information-security-threats-of-2010 page=11&utm_content=artmini&utm_source=nlet

“Incompetence a bigger IT security threat than malign insiders” http://www.theregister.co.uk/2009/08/25/rsa_accidental_security_breach_survey

CNET Reports Google Systems Attacked by China, Passwords Stolen


Google’s Gaia system, which allows users to sign in to their services, was compromised in December when a Google employee clicked on a link in an IM in China which gave access to the company’s headquarters in California. As a result, Google revealed some information to the public about the attack including that it would cease to censor Chinese search results and that some intellectual property of theirs was stolen along with that of other organizations by the country. Gaia is still in use at this time and Google now gives Chinese visitors to its site, unrestricted access to search results.

Source: “Report: Google password system attacked” http://news.cnet.com/8301-1009_3-20002890-83.html?part=rss&subj=news&tag=2547-1_3-0-20