Credit card compromised--Amazon ???

[Chip Sylverne]

I got spoofed a couple months ago, so I've been using malwarebytes regularly to scan the system, as well as msdefender on my pc. MB found lots of stuff the other security software was missing. Run it once a week now, no further problems.

 

[zaitcev]

Has anyone ever lost even one dollar (directly) in fraudulent transactions?

I knew people who did, when they use debit cards. Banks find all kinds of excuses in such cases. Mostly though it's some kind of a scam, a fraudulent vendor, or sometimes a lost in transit.

 

[Ghery]

Has anyone ever lost even one dollar (directly) in fraudulent transactions?
The credit card co's seem to cover everything. Not that helping them protect the card is a bad idea, it just seems like it is not motivated by monetary loss, yes?

Not a penny. I've had credit card issuers call about charges, and had a long fight with Amex to clean up fraudulent charges back in 1995, but never lost a penny. And I don't use my ATM card over the net.

 

[Let'sgoflying!]

I knew people who did, when they use debit cards.

Debit cards are a whole nother story, see title - we are discussing credit cards. Although I agree about DCs - I refuse to have one.

 

[denverpilot]

Well, WPS has nothing to do with this thread unless you are sending your credit card information over WiFi, which many are doing now. And I thought that most of the wireless router manufacturers have it implemented and, as in the cast of Linksys, don't even allow you to turn it off.

Now, you should still be protected by transmitting the CC information over SSH or TLS, but I seem to recall that these have flaws too. What this points out is that attacking the consumer side is a relatively easy vector for compromising a credit card number.

If there were gaping holes in SSL (no one uses SSH in a browser, typically... and TLS is a subset of SSL) there'd be much bigger and uglier headlines about it.

That said, OLD browsers DO have SSL vulnerabilities... but if you're using MSIE 3 or 4 to do your online banking, you're probably seriously broke anyway because you haven't upgraded your computer in 15 years. So your risk level is pretty low.

One of the reasons the elderly are targeted by malware and phishing is that the former is very effective on old computers, and the latter is very effective on old brains. The bad guys analyze this stuff as much as the good guys do, and laugh quite a bit at the stuff an up-to-speed geek or even a so-called "power user" frets about.

It's just not the way they're attacking people. They go after the easiest route, just like most folks do in any endeavour.

No one is passing anything to any reputable bank or online vendor like Amazon over WPA without ALSO passing it over fairly high-encryption SSL, unless they're crazy enough to do it on a 15 year old Operating System.

 

[rainsux]

> If there were gaping holes in SSL and TLS ... there'd be much bigger and
> uglier headlines about it.

I disagree. Frankly; I submit that most folks don't begin to grasp enough
of the fundamentals to even make an informed decision re: the
trustworthiness SSL/TLS.

SSL/TLS is built on a foundation of trust & (big) random numbers.

re: Trust (Authentication; are you, who you claim to be?)

This is implemented using Digital Certificates, issued by Certificate
Authorities.

- There are ~600 CA's. If any one [1] them is hacked, it's as-if they are
all hacked. There have been more than six [6] known/successful hacks of
CAs. Security pros have plausible reasons to believe that four [4] more
CA's are presently hacked ... and the CA's don't yet know it.

- Most web browsers implicitly trust 160-250 CAs. Your browser, right
now, probably trusts the Chinese Railroad and/or the Chinese/HongKong
post office. Why? Would you trust a Citibank certificate issued by the
Chinese RR? Do you even know who issues the cert for your bank? Did
you notice when it was renewed? Did the CA issuing the renewed cert
change?

- It's easy to forge digital certificates. The std allows for it - they are
"self-signed" certificates. Does anyone here, besides me, actually study
the digital certificates that are sent to their browser??? Example: A
Class-C airport that I visit, brags about offering free-WiFi for customers.
They serve-up forged (self-signed) certifcates for hotmail, gmail, Yahoo
mail, Facebook, PayPal, eBay, etc. This enables whoever is providing the
forged certs to snoop SSL/TLS encrypted connections. Gulp. There are
waaay too many free hotspots up to such nonsense.

i.e. Having a little padlock displayed on the browser is no guarantee that
you are connecting to who you think you are ... ditto for "https" in the
addr bar. This isn't hard work. Heck, it's even been appliance-ized:

http://www.packetforensics.com/pfli5b.safe

re: (Pseudo) Random Numbers

Recent studies of the pseudo-random number generators (PRNGs) being
used presently, reveal that they are not random enough. This is bad.
It gives anyone trying to crack encryption a substantive head start.

Then there is the matter of size - we once thought 512-bit primes were
plenty large enough. Not any more. Academic institutions have
pre-calculated the 512-bit primes and they are are avail. Ditto 768-bit
primes. Are 1024-bit primes large enough??? These are the backbone
for current certs & encryption technologies. Some CAs are now talking
publicly about offering 2048 (or 4096-bit) certificates ...

So, before I get a PM asking, "do you do on-line shopping? Banking?"

I do online shopping using a credit card issued by a bank where I have no
other accounts/business. I only do it after booting from a CD with an
image that I trust. There's that damn T-word again. <g>

I do NOT do online banking. Never. Not once. Every year, I visit my
bank(s) and give them a letter reminding them:

- No electronic banking
- In person, positive-ID match transactions only. I "test" them,
regularly, in this regard. So far, I have had cause to "fire" four
banks.
- Are you aware that many ATM cards, are also debit cards? Think yours
isn't? Why? Because the min-wage teller said so? Because a brochure or
webpage said so? Test it. Please.

Can I be hacked? It's already happened; three times. Twice by bank
employees, once on PayPal ... where they overdrew the associated bank
account. Quite comforting to know that the higher-risk transactions are
firewalled from my real/regular banking & accounts.

 

[denverpilot]

You were "hacked" or just had information stolen by people with access to the information?

Bank employees? Doesn't sound like it'd take much of a hack if it even was. PayPal? It is a common malware target.

You appear to be at that unavoidable stage where the paranoia sets in that computer "security" is a never-ending Cold War between mathematicians and fallible coders implementing their algorithms. Someone with a few video cards can crack millions of password records an hour these days with brute force. The keys have to get bigger with increases in processor power. That's been the rule since Enigma.

I wouldn't lose much sleep over WPA or SSL having minor holes... Security is layered. I'd worry more about choice of banks and scan the box for malware.

Those are your most likely attack vectors that already harmed you, not bad SSL Certificate Authorities, since good banks aren't utilizing the six cheap-assed CAs for signing their digital certs.

The bad guys use the easy attack vectors first. Attacking WPA gets you nothing but unencrypted traffic on that wifi network. Attacking SSL isn't cost effective. Easier and cheaper to bribe a bank janitor than to capture a ton of unknown encrypted traffic and find a way to salt it with a known message to brute-force it.

Unless perhaps you work for NSA and have a much less restricted time and money budget.

 

[BillTIZ]

If that happened I'd have a very hard time. Like Scott I spend a fair amount of time away from home. When I dig out the cards I expect them to work. So far, they have.

Your history shows how you use the card. As long as its "ops normal" for you, no problem.

I don't normally travel more than 3 states away by small plane, when I do, I call the CC ahead of time and say, between day1 and day20 I'm moving a plane across the country. They make a note and no problems.

We have big states to cross.

 

[Henning]

This happened to me today. I got an email from amazon.de telling me that someone had opened and account using my name and visa no., but that the addresses given did not match any of those in my "other" account (my real one), and that this had been discovered during a "routine" check of accounts. I phoned my VISA provider to be told that, yes, $350 had been charged to my VISA via Amazon.de three hours previously. It was marked as fraud, credited back to my account, and my card was cancelled. I happen to be away on holiday - good thing I brought my laptop and checked my emails! Strange that the fraud involved Amazon use, and that Amazon picked it up so quickly - makes me think that they must be aware that their data has been compromised.

How do you conclude their data is compromised?

 

[rainsux]

> good banks aren't utilizing the six cheap-assed CAs for signing their
> digital certs.

It has nothing to do with being "cheap-assed." Some of those hacked
are/were considered to be among the best.

Nor is it a matter of good vs bad CAs. If just one of the ~600 is hacked,
it's essentially as-if all are hacked. I believe that the current "trust" model
if fundamentally broken.

It should be about end-users not blindly trusting the browser padlock
(https/SSL/TLS) ... and being able to recognize:

- When a certificate has changed
- If the change makes "sense"

Why the heck KFNT feels that they need to impersonate PayPal, Hotmail,
Gmail, et. al. using forged certs is beyond me. Many other open/free
access points are up to similar shenanigans.

I've also found the following businesses bridging their internal business
systems to open/public WiFi:

- My dentist
- My doctor
- 'bout half the docs in the same bldg
- The fire dept
- The tax assessor
- The auto mechanic

 

[denverpilot]

Your story just went from six to six hundred. Care to cite any credible sources on that?

Please define "bridging" to the public Internet. Without more information about those businesses other lines of defense, it makes no sense. Bridging has a very clear definition in network architecture engineering and the context of your message seems to indicate you don't have even the faintest clue of that definition.

Sorry but without a discussion in standard network engineering terminology you're just making yourself look like a Chicken Little with all the rants about WiFi networks.

I've been interconnecting networks and systems to each other safely since 1991 or so for a living. Would you like to continue the discussion and learn something or are you set on some other fear-based agenda? If you're scared of other people's networks, here's a clue... don't use them.

You might be surprised to learn they actually might have had a network engineer recommend a particular setup. Or not.

Claiming "all WiFi is unsafe" is like claiming "all time spent in the Sun is damaging to your health". Both are truisms that only capture a tiny piece of the story and generate mostly FUD that has no place in Systems Engineering.

Please consider adding more value to the public discussion than "OMG! Wireless is bad, mmm-Kay?!"

 

[Palmpilot]

Please consider adding more value to the public discussion than "OMG! Wireless is bad, mmm-Kay?!"

Did his advice to stop using WPS-assigned WiFi keys not add value? Or is it unimportant for some reason

 

[denverpilot]

He's been saying in multiple threads to stop using WPA/WPA2 routers in general, which seems to be his main point. Which is just FUD.

 

[rainsux]

> He's been saying in multiple threads to stop using WPA/WPA2 routers in general,
> which seems to be his main point. Which is just FUD.

Incorrect. I have been advising folks to disable WPS and then
change the WPA/WPA2 keys.

WPS is a recent/new attack vector that substantively changes the balance. I have summarized the:

- root cause
- the affected communities
- the unaffected communities
- mitigation methods
- sheer stupidity that resulted in this vulnerability.

> > "OMG! Wireless is bad, mmm-Kay?!"

Never said it. Please do not attribute to me, comments that I did not make. Kind'a
wonder why you are choosing to "go personal." Please, reconsider.

> Your story just went from six to six hundred. Care to cite any credible
> sources on that?

There are ~600 certificate authorities. Do you disagree?

Or; do you disagree that CAs have been hacked? The most recent
examples are Diginotar, Realtek and JMicron.

Or; do you disagree that hacking one has essentially the same result
as having hacked all?

Like you, I make my living in the computer/netw security world. I cannot
imagine any [cough] "network professional" that would recommend allowing
Joe Sixpack netw access (via WiFi) to networks hosting internal business
systems.

In the examples of the dentist, doc, fire dept & auto repair shop, I
volunteered my time & skills (free) to fix the problem. The doc, fire dept
and auto repair shop had paid "netw professionals" for their respective
messes. The dentist dork'd it up his own self.

 

[denverpilot]

Okay it appears I misunderstood some of your posts. That's fine but the average joe has zero chance if you confused a fellow networking pro.

I do NOT agree that one trust organization being hacked necessarily leads to the others being any less trustworthy. Could you explain that thought process?

You revoke the keys of the one hacked and reissue if they even survive. None of the trust organizations you mentioned were top-tier nor would anyone serious about their certs purchase them from them. Certainly not banks worthy of anyone's business.

As far as the local businesses go, I hope they sued the false pros who set up their networks for whatever you charged them to make it right. Including all the time spent scanning every machine in the office. If their customer's data leaks, I hope the customers sue them for gross negligence. There's far too much published information freely available on not allowing customer's to access internal networks out there that it's far beyond negligence and well into gross negligence considering the risks they're putting the rest of the world's networked systems at from botnets these days, doing retarded stuff like that.

Small business IT could use some weeding out of the ninnies who install crap like that and no one holds them fiscally accountable.

I foresee a day where that will be the norm, bonding and insurance will be required to install a $25 router, and people will realize their old filing cabinet was more secure and faster than the computer technology they purchased in a hope of making their business more efficient. If the market doesn't clean up the bad practices, government eventually will -- and you and I will be wasting a lot of time sitting for licensure tests.

 

[Palmpilot]

Okay it appears I misunderstood some of your posts. That's fine but the average joe has zero chance if you confused a fellow networking pro.

I'm a relative novice at networking, and I wasn't confused by his posts in this thread. I don't know what he may have written about it in other threads.

 

[rainsux]

> the average joe has zero chance if you confused a fellow networking pro.

Several average Joe's here seemed to have grasped the issue and
disabled WPS, then changed their keys.

> I do NOT agree that one trust organization being hacked necessarily leads to the
> others being any less trustworthy. Could you explain that thought process?

Are you familiar with the Comodo and Diginotar hacks? Diginoatar was not (seemingly)
a fly-by-night operation. But they failed to act swiftly even after they discovered the
hack and the scope of the hack. 532 forged certificates were issued ... for most all of
the popular web destinations:

https://svn.torproject.org/svn/projects/misc/diginotar/rogue-certs-2011-09-04.csv

Note that the hacker(s) issued forged root certs for Verisign, Thawte,
Google and others. Those certificates were used for successful MITM
attacks against most of the popular email services, Skype, etc.

The browser vendors all rushed-out patches to blacklist everything that
Diginotar ever touched. Shame on Apple for being so bloody slow to
patch Safari.

 

[denverpilot]

Diginotar was actually the only one that I had payed any attention to. I had not seen evidence that they accomplished successful, confirmed, MITM attacks though. I had seen that it was possible, but not confirmed attacks.

Protocols like WPS are nightmare engineering right from the start. They're there to "make things easier" for folks, which almost always leads to pain. Heck, even DHCP set up incorrectly often leads to pain. I watched a telecom device with an embedded DHCP server essentially wipe out an entire Corporate network once, because the network folks didn't limit where DHCP traffic could go to/from. Pretty dumb...

So what were the confirmed MITM attacks accomplished with the fake certs targeting?

 

[rainsux]

> ... if it was a problem, we'd be reading about it in the media

> I had not seen evidence that they accomplished successful

There's been plenty of reporting in the tech & security press ... consider
adding both Schneier and Krebs' blogs to your daily reading.

> So what were the confirmed MITM attacks accomplished with the fake
> certs targeting?

Iran is reported to be the primary culprit (using the forged certs) to hack
email, Skype, Twitter, blogs ... pretty much any of the sites for which the
532 certs were forged.

The guy(s?) that pulled-off the Diginotar hack proved himself by using
Diginotar's private-key to sign (prove) his claim. He followed that up with
the claim that he powned 4 other CAs. When some scoffed, he then
claimed & proved that he also powned Globalsign.

Summary:

- He's claimed responsibility for the prior Comodo hack - the forensics
suggest "very plausible."

- He has proven that he he powned both Diginotar and Globalsign.

- He claims he to pown three more CAs. Given his past accomplishments
[crimes] - plausible.

Opinion:

Given the prior hacks of CAs; and the vast number of CA's; and the lack
of effective auditing of CAs ... the existing 'trust' model on which SSL/TLS
are based, ain't sufficiently trustworthy.

 

[denverpilot]

Schneier's stuff is great. I just haven't kept up on him recently.

Krebs' stuff is a little too biased toward the "I'm in Security to make money" crowd, for me.

SANS is by far the worst... Northcutt... Wow, that guy...

Talk about making money off the backs of "students". His early students wrote his entire curriculum he now pushes like a crack dealer at every government agency in the country. Brilliant and wickedly simple at the same time. He applied 80's Multilevel Marketing techniques straight out of the Amway and Herbalife playbills to Security training and certification, with a twist of Cisco religious zealotry for taste.

Today's top advertisement in the SANS newsletter with, "This guy doing all this expensive stuff at X government agency, will give you great top-cover against your bosses saying it can't be done..." was a eye-roller.

Top-cover. In a Marketing blurb. Ha.

Gotta get those military/government buzzwords in there when you're a $300K a year "Government Security Consultant".

Wasn't even Northcutt either. I forget who wrote today's blurb.

Northcutt's hanging at his pad in Hawaii and letting the Lieutenants make him money these days.

What a Ponzi scheme. Impressively effective.

Jr. Security Admin today asked me if any colleges would give him a degree for his (open-book mind-you!) SANS Security certifications.

I didn't have the heart to tell him that I'm absolutely sure there's some two-year program somewhere that'd gladly take his money to do it, but no one would care.

Network Security is the new Cold War, worldwide.

It's entertaining but similar to MAD in the nuclear version, at some point you just unplug from the untrusted network for anything you truly deem important.

Like the Cold War, big money, bunch of noisy alerts, etc. Geiger counters are selling like hot cakes. (Intrusion Detection, logging systems complete with "Artificial Intelligence Engines", Layer 7 "firewalls" that jack up everything that passes through them... It's a great circus right now.)

The reality is, everything's hackable.

And ... usually social engineering is faster and cheaper.

A very nice guy who moved from NSA to Verisign to teach security classes long before it was "cool" taught me that... in his Security classroom... with a phone book.

(Gives an idea how long ago it was.)

3 minutes after he dialed the main business number, he had the root password of a targeted company's webserver.

The entire classroom watched him do it, and his skill was impressive. He could have talked the company into shipping the thing to him, I swear. NSA taught him well.

Network Security doesn't exist. You just play catch-up forever. I lost my zeal for keeping up with all of it some time ago. I watch for the really dangerous coding mistakes and plug those holes with the couple of fingers I have left for the dyke, and the rest on a nice boring regular schedule that minimizes risk, since the ratio of security patches that kept out bad guys vs blew up a critical business system sits (in my experience so far) at around 10 blow-ups for every one serious hole plugged.

As far as SSL goes, if it's truly breached as you suspect, it's already game over. I'm quite suspicious of examples given that only show MITM successful attacks against tools like Skype and Twitter and such, instead of say... an internal server transaction log between an employee and a bank system behind an SSL-based VPN. Skype and Twitter style traffic are pretty easy to mimic in controlled environments and the amount of disinformation right now is as high as I've ever seen it.

When you have IT "pros" by the hundreds of thousands who couldn't describe the TCP three-way handshake in a conversation, the FUD is so deep even hip-waders won't protect against it. I've watched technical managers argue that a TCP socket isn't two-way in an hour long meeting, and a customer with a mis-configured and malfunctioning F5 load-balancer panic and think they were under a massive DDoS attack -- to the point where their most Senior network admin was actually looking up the FBI's cybercrime phone number -- before someone sat down and looked carefully at the packet capture with a laptop and told 'em what was really going on.

You seem to have a clue. I just worry about the mass quantities of Chicken Little's out there with "Certifications" that leadership listens to in IT management. It's amazingly bad to actually know what you're doing in some environments right now.

My favorite one I hear regularly is, "If we weren't using that free Operating System, none of this would happen!" Oh man, that one is always a side-splitter. My most recent response to that one was, "If we weren't using this free Operating System, you realize that this company wouldn't exist and you wouldn't have a job, right? You understand that it runs our core and replacing it with a Commercial OS and Brand X's telecom gear would instantly bankrupt the company, right? Juuuuust checking!"