Slashdot Log In
AT&T Crack Part of a Phishing Operation
Posted by
Zonk
on Fri Sep 01, 2006 03:21 PM
from the crafty-crackers dept.
from the crafty-crackers dept.
JohnGrahamCumming writes "According to a story in the San Francisco Chronicle the AT&T store crack was the prelude to a very sophisticated phishing operation. The phishers were aiming to use the information from the store to fool existing customers into divulging SSNs and other personal information." From the article: "'The information that was provided by customers who ordered DSL-related equipment included name, address, e-mail address, phone number, credit card number and credit card expiration,' the memo says, adding that the hacked data didn't include Social Security numbers or birth dates. But the hackers had a scheme to get this extra info. After accessing the customer data, they incorporated it into phishing messages that were promptly sent to AT&T's DSL customers ... Each message included a legitimate order number culled from the AT&T vendor's database to create an illusion of authenticity. Messages also included the recipient's home address and the last four digits of his or her credit card number. "
Related Stories
[+]
AT&T Breached, Exposes 19,000 Identities 143 comments
mytrip writes to tell us News.com is reporting that a recent attack on AT&T's systems saw thousands of customers' personal data compromised. About 19,000 customers of AT&T's online store who purchased equipment for a DSL connection were affected. From the article: "AT&T is offering to pay for credit monitoring services for customers whose accounts have been impacted because they could be at risk of identity fraud. The company also has made available a toll-free number to affected customers to call for more information."
[+]
Next Gen Phishing Improves on Simple Spam 112 comments
An anonymous reader writes "ZDNet has a writeup about the next generation of phishing. According to the article, as anti-spam engines improve and user education levels increase, phishers will find it easier to hack into web servers and deliver password stealing trojans using browser vulnerabilities or Web 2.0 technologies than spam. Tom Chan from Messagelabs is quoted: 'They are trying to compromise poorly protected Web sites — they basically go in and enter their own code into that Web server,' said Chan, who explained that victims of this new phishing era would not have to do anything wrong in order to get hooked. 'You have gone to a legitimate Web site, you have not made a mistake and done everything right, but then your information gets compromised... because [the phishers] have taken over servers that belong to other people.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Privacy violations rampant (Score:5, Insightful)
Re: (Score:3, Insightful)
That seems to be always how these scams work. Someone calls and uses some credentials to get people to reveal personal information. No company worth dealing with would ever initiate contact with customers over the phone were it not previously arranged.
When will this become common knowledge
Re:Privacy violations rampant (Score:5, Funny)
I would never call you uncolicitated. Now, can I have your information?
Parent
Re:Privacy violations rampant (Score:4, Informative)
Licit is the opposite of illicit. "co" means "between two (or more) parties". "un" is a prefix that denotes a negative (see "United Nations").
Therefore "uncolicitated" must mean "illegal between two parties".
(That whirring noise you hear is Samuel Johnson revving up.)
Parent
Re:Privacy violations rampant (Score:4, Insightful)
Parent
Re:Privacy violations rampant (Score:4)
As the word stands you are perfectly correct. I bow to you, Herr Grammatikkommandant
Parent
Re: (Score:3, Informative)
People respond to this because they are l
Re: (Score:3, Insightful)
Re:Privacy violations rampant (Score:4, Insightful)
When I train individual on Social Engineering techniques, I always tell them that if they receive a message (voice or email) claiming to be from their bank, to do a call back using a known good number from their previous correspondence.
I've noted that some banks, when communicating via email, will tell you to log into your account by manually TYPING in an URL in your browser rather then providng any types of hyperlinks.
Parent
Re: (Score:3, Insightful)
In an ideal world, we could build some kind of peer-to-peer GPG web of trust, where the person themself has full control of establishing their identity.
One thing's still true (Score:5, Insightful)
I wish we could get more people to realize this.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Isn't security fun?
Never give out your SSN (Score:4, Insightful)
SSN is needed for credit checking (Score:5, Informative)
The solution is to ban the use of SSN for credit files. Use a number that the consumer controls.
Also, let customers pre-pay monthly. I know how much my monthly cell phone billing is going to be, let me pre-pay and avoid the forced use of credit (which gets reported to the credit agencies).
Parent
Re:SSN is needed for credit checking (Score:5, Insightful)
No, no it's not. It's needed for a credit check from lazy-assed credit companies who can't be bothered to do the legwork to actually identify you.
That's why we have this identity theft problem in the first place. If we threw away the SSN and replaced it with any other identifier, the exact same thing would happen. If we replaced it with biometric ID cards, the exact same thing would happen (it would just be a little more work. You might be [cardandathumbprint] in person, but in the computer you're still going to be card #555-55-5555).
If consumers started storming equifax and all these other credit companies' offices with pitchforks and torches for giving away their credit over such a lousy identifier, it'd get fixed. They would figure out a real way to identify the people. As it is, nobody even thinks "gee why did TransUnion tell MegaCorp that Mr. 555-55-5555 can handle taking a out a $422523523 loan without even making sure they were talking about the right person?"
Hell, if the debt laws would be fixed so that companies who fucked up and issued credit cards or loans to the wrong people were saddled with the bad debt writeoffs instead of being allowed to send collectors after the real person, they'd be the first in line to kick down doors and get this shit fixed.
Parent
Never give out your SSN: Sooner said than done (Score:5, Interesting)
When I was in the emergency room with chest pain and they handed me a form, with a place for my SSN on it, and I asked if I had to give it, and they said "you won't be seen until you fill it out," what would you have done? Argued with them? Called a lawyer? Whipped out a copy of the law that says they can't do this? Asked them to get an ambulance to take me to another ER? Raise the ante and see whether they were bluffing? No, I did what I thought would affect my blood pressure least, and get me seen soonest, which was... to cave in. I gave it to them, and I believe anyone with any sense would have done the same thing. Worry about it later. I had more important things to worry about.
And I think I'm _reasonably_ assertive about such things. Back Massachusetts drivers' licenses had SSN's by default, I was one of the people who always asked for and got a different number. When the Red Cross wanted my SSN for blood donations, I said I wouldn't give it to them and they issued me a donor card with a non-SSN.
When my company's medical insurance wanted my SSN, I said I wouldn't provide it. They said fine, but we won't insure you. So I called the Social Security office, and said "do I have to give it to them?" And their answer, practically verbatim, was, "No, you certainly don't. However, they are under no obligation to provide you with insurance unless you do."
Whenever I'm asked for my SSN, I always ask if there's an alternative. (And wait while they check with their supervisor). I succeed maybe half the time. The other half, well, I usually cave.
If you can get along without credit cards, auto loans, medical insurance, and emergency rooms, more power to you.
That line on every social security card that says "Not For Identification Purposes" is a lie, plain and simple.
Parent
Re: (Score:3)
I would have said, "No problem! My SS# is 1234-56-7890."
You can be less obvious about it if you like, but I find being extremely vocal and obvious about such issues works better in the long run.
This isn't a court where you have been sworn-in. You can lie your ass off, Mr. Smith, and it's
SSN (Score:3, Interesting)
Affected Customer (Score:5, Informative)
Also, for anyone else, follow in my footsteps: DO NOT GIVE THE PHONE CALLERS ANY PERSONAL INFORMATION. PERIOD. If there is an issue, call your bank number personally on a known verified phone number and have the clerk verify ALL NAMES AND NUMBERS AND REASONS. (I've gotten calls already with people asking for my account information this morning as well from unverified numbers. Its happening).
Re: (Score:3, Informative)
If I were you, I would wait a while (for the theif to set up bogus accounts), then check out your credit reports, see if there are fraudulent accounts, and then follow up.
How did they miss the .org? (Score:4, Informative)
"To update the credit card information details for your order, please select this link," the message instructed, directing people to a "spoof site" with an illegitimate sbcdslstore.org (not
A personal website is one thing -- you might grab the
Well, at least they've learned their lesson and scooped up the other major extensions... as [domaintools.com], of [domaintools.com] yesterday [domaintools.com]. What was that story about a cat, a bag, and a barn door?
What's your personal information's potential? (Score:5, Insightful)
My mother works for Wells Fargo Home Mortgage; an independent company that was auditing their health insurance had one of their laptops stolen with similar information for thousands of WFHM employees (possibly other Wells Fargo employees too).
Here's the bottom line: Expect every person in the world to try and get at your life in anyway they can. That said, it's your job to protect yourself. Inconvenience, lack of technical knowhow, lack of time and etc. are not valid excuses; it's just too damn important. If someone nabbed Newegg.com's database right now, how many of you would be in great risk? Particularly if your record was the only one they stole; a Newegg.com employee could probably do that without Slashdot or ABC News ever knowing about it.
If they got the card number you use at Newegg, how much money could they take? Is that a check card linked with your bank account? Your only bank account? Most credit card companies will immediately call you if there's all of a sudden a much greater than usual balance on your card. Banks won't call you of a large sum of money disappears out of your account.
So, is most of your money in a savings account that NOBODY has the information for (except you)? Is your home address well secured? Do your kids know how not to get kidnapped? You do check your own credit semi-frequently, don't you? Does (whatever company) really need your SSN to sell you their product? Do you think their system will blow up if that field is left blank when you throw a fit? Do you refuse to send sensitive information over e-mail or IM or SMS (with a preference for telphone or in-person business)?
Does your garage door opener hang proudly from your sun visor (with the corresponding home address on your registration & insurance in the unlocked glovebox)? Is a key to your house sitting in a Supra lockbox hanging on the door handle so the maid can get in? Or is it, perhaps, in that fake looking rock next to the porch? You know, the one your kid picks up every day when he gets home from school?
Think. It's your job, not your government's, not the sheriff's, and not some corporation's... yours. There may be laws in place to protect you; people will break them. And then you're still out your valuables. Really: think.
Education seems to be key. (Score:3, Insightful)
Paypal, for instance does not need your SSN, but by supplying it, you can earn 5% interest on the money sitting in your account. There are countless other legitimate examples.
How do you educate the world on a single issue, especially when there are more pressing issues that are higher on the global priority list? Hell, I bet most of you have a few friends on your instant messenger friends list, who still pass on those mass messages threatening to shut down the service if the message is not forwarded to everyone? All 4 of the biggies, Y!, AIM, MSN, and ICQ all state clearly in multiple places they will never do this... they will never send out a system wide message that has to be forwarded. Yet people still don't know this, even after 7 years. And those messages don't even look nearly as legitimate as some phishing sites.
No need for phishing... (Score:3, Funny)