158 Million Records Exposed (And Counting) 106
Lucas123 writes "According to the
The Privacy Rights Clearing House 158 million records have been exposed over the past two years as a result of inadequate security. Data's less secure today because as fast as banks, merchants and consumers add new layers of security to their storage systems and networks, new technologies — or simply careless users — create new security holes, according to Bob Scheier at Computerworld."
Fixed? (Score:2, Funny)
Re:Fixed? (Score:4, Funny)
i read it somewhere else (Score:4, Insightful)
Re:i read it somewhere else (Score:5, Interesting)
Re:i read it somewhere else (Score:5, Interesting)
What about a DNS attack, where legitimate customers going to the legitimate YourBank.com site are redirected to a man-in-the-middle site? Everything looks legit (albeit slow) and it's a near-picture-perfect real-time clone of the bank's site and the user's account info. Who has to pony up in this case? Linksys/Cisco for making a router susceptible to DNS hijacking? IE or Firefox for somehow not recognizing the MITM? Verisign for legitimately issuing a certificate to a hacker that he then later misused?
At some point a lot of these fall into the category of technological failings. Are we suddenly going to see disclaimers on routers and ethernet switches claiming "Not suitable for secure financial transaction data"?
The only way to truly end this is to remove the ability to use the data online, and require face-to-face authentication. Shut down commercial use of the internet. Not a likely scenario.
The next best solution would be to train employees and end-users how to safely transact business over the internet. Joe Sixpack can't even identify every button on his TV remote control -- what are the chances he can learn how to check certificates for authenticity? Even if he could be trained, would you then shoulder the responsibility for training him how to spot hacks just in time to have a new hack come out and steal his account information anyway? "Mr. Trainer, I followed your instructions exactly and I still got hacked. Here's a lawsuit for damages due to your incompetence."
And before you place too much faith in IPV6 to solve all these problems, you should take a look at every other piece of technology claiming to solve security problems. They're all flawed -- some more than others. It's just that we don't know IPV6's vulnerabilities yet.
Re:i read it somewhere else (Score:5, Insightful)
Because, as we all know, fraud and identity theft did not exist before the advent of the internet.
Re: (Score:3, Interesting)
Very true. Technology, as it stands now, is very open to phishing, etc. You're entirely right - the technology needs to change.
However, such failings of technology is only a part of the problem. It seems like every time I visit /. there's a new article about how some company or another just lost the SSN, bank account numbers, passwords, identification numbers, DNA signatures and biometric iris scans of another 40 million people. It seems like these companies are actually at fault for this lost data, so wh
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
At some point a lot of these fall into the category of technological failings.
Did you scan the list? I saw far more data loss because of shoddy management than average Joe's being scammed via a technical exploit. Dumpsters filled with paper records of employee SSN's and DL's. Backups being lost on non-encrypted media. Systems containing data that are stolen. Some people got scammed via e-mail, but most of this was because of shoddy physical security.
Put in place real penalties for these corporations (Kaiser fined 200k for putting patient info online? Their whole legal department pro
Re: (Score:2)
Even if this was done right, the information would still not be "secure". There are implementation issues that will always leave data open. The point is, however, that you would always know who to blame, and could create laws accordingly.
Re: (Score:3, Insightful)
For phishing sites, etc. There are technological solutions to this sort of problem. Just require better verification than 'the domain name matches the SSL certificate'.
Re: (Score:3, Insightful)
The problem is
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:1, Redundant)
Re: (Score:2)
All banks in the UK (I've dealt with several) use your birthday as one of the "secrets" for authenticating when you telephone them. They also use your mother's maiden name and place of birth, both of which are a matter of public record.
Oh, and for the extra-secure part of their password, most places prompt you to use a "memorable name" or "memorable date", so no prizes for guessin
Re: (Score:2)
We should be using personal pass-phrase protected keys and certificates to encrypt and sign our communications (in addition to the current certificate based authentication we use to verify their identity on secure web sites), and everything required to do this should be provided to us by the banks by snail mail.
--
Martin.
Re: (Score:3, Insightful)
Re: (Score:2)
Yes, that will motivate banks to use better security but in the end it all comes down to the fact that people need to do their part to uphold the security that is already there. Protecting passwords, keeping information secret unless absolutely needed, understanding computer security enough to avoid keyloggers, trojans, spyware etc.. a lot of the security is the bank's responsibility but it
But it has to be reasonable for Joe Sixpack (Score:3, Interesting)
Yes, that will motivate banks to use better security but in the end it all comes down to the fact that people need to do their part to uphold the security that is already there.
The problem with that is that current mechanisms are far too much of a burden for the average member of the public to avoid carelessness and/or social engineering attacks.
It simply isn't reasonable to expect people to create and remember a different, properly secure password for each of numerous services, some of which will only be accessed occasionally, perhaps as little as once per year or less. Nor is it reasonable to expect average people using typical software on typical computers to understand all
Re: (Score:2)
It also makes it much harder to prove that you have been stolen from. I wonder how much of the reduction you claim is due to actual reduction and how much is due to people being unable to prove the crime ever happened.
Re: (Score:2)
It also makes it much harder to prove that you have been stolen from. I wonder how much of the reduction you claim is due to actual reduction and how much is due to people being unable to prove the crime ever happened.
Interesting theory, but it's much harder to commit that casual fraud in the first place now, so I suspect the effect you describe is insignificant in practice. People got wise very quickly to the fact that you check the amount before keying in your PIN, and the hardware set-up is pretty effective for preventing casual fraud by shop staff and the like, so PIN-verified transactions are usually legitimate.
There's always been the problem of someone using a card to pay for something over the phone or Interne
Re:i read it somewhere else (Score:5, Insightful)
Re: (Score:1)
Re:i read it somewhere else (Score:5, Insightful)
Oh, if it were that easy. Pass a law and Windows bugs are fixed. Pass a law and dishonest employees will never steal again. Pass a law and a hard drive will never be misplaced, or a delivery service will never lose a tape en route, or a destruction service will never hire a corporate spy.
California (and a few other states) has a law requiring notification. Minnesota has almost exactly the law you would like requiring the leaking parties to be responsible for the costs, yet continues to have breaches.
Laws aren't like some magical "wand of protection +5". Sure, they give people incentive to do something, but they can't actually stop the dishonest people, nor do they protect us from the incompetent until after the damage is done.
Re: (Score:2, Interesting)
Re: (Score:2)
Re:i read it somewhere else (Score:5, Interesting)
You're missing the point.
Right now, the companies whose data is stolen have no financial incentive to beef up their security, but they have plenty of PR incentive to cover up breaches. If such breaches were to hurt their bottom line, the shareholders would make them take their security seriously.
As for the effectiveness of laws, look at Sarbanes-Oxley: corporations have created whole departments just to manage compliance. Sure, they bitch and moan abotu the hassle, but they comply because it's the law. Why can't they be obligated to put the same effort into customer data security?
Re: (Score:3, Interesting)
Re: (Score:2)
Because phishing is easily 100% preventable through technological means. All a bank has to do is use digest authentication [wikipedia.org] for the website. Then, even if somebody set up a fake phishing site on an actual https link, they could not obtain your password. If the bank's website implemented digest auth correctly, an attacker could only obtain the authorization needed to make a single specific HTTP request to the bank's website on the client's behalf. Of course,
Re: (Score:2)
Either you have to sign all traffic both ways with a shared secret (such as the username and password), or you have to build endpoint authentication into HTTPS in a way that *includes* the username and password for the web site.
Re: (Score:2)
I would note that most phishing attacks aren't actually trying to get access to passwords. They're trying to obtain other secret information by presenting pages that rarely look much at all like any legitimate page from the bank, asking for things like SSN, etc. with the goal of full blown identity theft. These are, of course, only such a crisis because of the fundamentally weak authorization used when granting credit.
All it would take to permanently prevent the bulk of identity theft would be a law tha
a *nonce*? (Score:2)
Re: (Score:2)
Mandatory callback on opening lines of credit would be a big help, though it wouldn't solve the problem of someone just taking all the money one has in the bank (more of a threat for some than others, I guess).
Re: (Score:2)
Because the banks are the professionals whose job it is to protect the money they are holding on behalf of others?
There are numerous ways to prevent phishing from working, they just all cost more than blaming the customer. Right now we have banking security that is only slightly more rigorous than making people pinkie-swear they are who they say they are.
Re:i read it somewhere else (Score:5, Insightful)
As many people will point out, at some point you have to take responsibility for your own information. It's not the data breaches themselves that are really the issue, but the fact that once your data gets into the wild, it can be used for nefarious and often illegal purposes, and that's there is no easy way to deal with the problem. Anyone who gets their identity stolen literally spends years writing letters and making calls to various companies to indicate that in fact their identity was stolen and they are not responsible for the misuse of it. When it comes to clearing things up with the major credit monitoring services, it can be downright frustrating to get them to make necessary and factual changes to your credit report in order to get the matter cleared up.
We don't just need laws to make companies liable, we need a system in place to make sure that when data breaches do occur, that those affected can restore some semblance of normalcy to their lives with the minimum of fuss. And we need laws in place to define just what data any particular company can collect (remember: your SS# is not supposed to be used as any kind of identifier except for tax purposes) and more importantly, how that data should be stored (mandatory encryption).
Bah! (Score:2)
You aren't addressing the core issues though.
1. It's perfectly legal to collect personal information and resell it. Criminalize both issues and the "identity theft" problem improves dramatically.
2. It's perfectly legal to keep decades-old records available on-demand. This is the Data At Rest problem which is only getting bigger.
Re: (Score:3, Insightful)
We don't just need laws to make companies liable, we need a system in place to make sure that when data breaches do occur, that those affected can restore some semblance of normalcy to their lives with the minimum of fuss. And we need laws in place to define just what data any particular company can collect
Yes and yes. I've been arguing the same way ever since a probably inadvertent mistake by a minimum wage local government staffer screwed up my tax record by linking me to someone else. The mistake itself wasn't too damaging, fortunately, but the really nasty things were the fact that the first I knew about it was when my paycheque was well short one month because of over-charged tax, and that it took me several months contacting several different tax offices to get it fixed. (Hint to tax offices: if I'm c
Re: (Score:3, Interesting)
And how exactly am *I* supposed to do that? There are hundreds, perhaps thousands of companies who are continuously buying and selling information about *me*. And you can bet that when these companies sell someone else information they have collected about me, I am the last person on the notification list.
Furthermore, these companies actively resist you being able to contact them. Thanks to modern voice-mail trees, it's pretty mu
Re: (Score:2)
Identity theft has many faces, and while some are the result of negligience on the part of corporations too worried about short-term growth and profits, only some of them are, and many others not.
Re:i read it somewhere else (Score:5, Interesting)
It continually baffles me that credit card numbers are assumed to be somehow secret, despite the fact that you hand a waiter making $2.15 an hour a little piece of plastic with that number written on it without a thought.
The customer is in no position to create a new technology that ends this "open secret" way of verifying identities. There are much better mechanisms available, using public-key cryptography and some combination of passwords (entered into a smart card, not passed over the Internet), biometrics, and physical identity tokens.
That's up to the credit card companies. The reason people steal the numbers is that all they have to do is steal the number. Make it harder to steal and they'll stop stealing it. Until then it will continue to shock me that mere knowledge of a password which is regularly transmitted all over the place, and can be stolen from my wallet or my mail, is used as an identifier.
They blame it on the customer because they can, not because it's the customer's fault.
Re: (Score:2)
Make it harder to steal and they'll stop stealing it.
I dare say you've not been actively fighting spam for the past 10 years or so.
A lot of people have put a lot of effort into making spamming harder. Know what? Spammers have not stopped spamming. They've worked equally hard to get around the anti-spam features.
Credit card fraud is likewise a big, profitable business. So you have this fancy biometrics smart card thing. Then the scammers will run a man-in-the-middle attack, instead of grabbing your CC number they'll steal an actual transaction. Or they will f
Re: (Score:2)
"-making the financial institutions responsible" Anything that costs any corp money gets passed on in the price of their service. Ultimately all you accomplish is giving some new pencil pushers a job counting more money that YOU LOOSE.
The simple way to solve this is what I have done for many many years: when someone asks you for your personal information: LIE. Give them a mis-spelled name, transposed
Wrong! Wrong! Wrong! (Score:2)
There are private companies collecting all kinds of data about you and I. It's why you get junk snail mail when you buy a house or have a child to name two examples.
2. The notion of "identity theft" is a tactic to legitimate personal data warehousing.
It separates the Evil identity thieves and the Good identity vendors. Except the root of this evil is the companies and institutions collecting and storing your personal data for decades beyond it's usef
Re: (Score:1)
You get junk mail with frighteningly accurate details about your loan, value of your house, equity position, etc.
>have a child
What's really scary is that when someone in your household dies, the junk mail *stops*.
Re: (Score:2)
Re: (Score:1)
Phone bill and phone book aren't junk mail. Besides, your grandmother might legally be "Mrs. Your Grandpa". I'm talking about gift and gardening catalogs, coupon books, etc., and I've seen this stuff *stop* with no action taken (other than people dying.)
Re: (Score:2)
The poster's reply does sound a bit glib, but he's not far off. Of course no law magically causes bugs to be patched; the point is, hit these data custodians (companies) in the pocketbook.
Ask yourself: why do these kinds of thing happen so infrequently in the EU? The reason is that they have a more comprehensive approach to data security and personally identifiable information (PII) that permeates government and private industry. In the U.S., our laws take a sectoral approach. This myriad of laws and
EU More Secure - Wrong (Score:2)
I've not bought furniture in the EU or other big-ticket items but from what I understand it doesn't work that way at all. You could get a loan from a bank but that is about it. Finance com
But HOW would it "never happen again"? (Score:2)
Does the consumer win in that case?
Re: (Score:2)
all you would have to do is pass a law making the financial institutions responsible for all of the costs and hassles involved with identity theft, and it would never happen again.
The reason it would never happen again is because banks would take away all online banking and access to their customer information. Yep, back to the days of going into the branch to check a balance and sending money orders to buy things on ebay. What a great idea!
It's all about risk management for them. They don't care about about whether an individual gets taken for all he is worth, as long as it's a small percentage of the individuals they manage. To keep their good names they will even compensate th
Re: (Score:1)
Re: (Score:2)
I live in Eastern Europe and communism left us with so much bureaucracy, that it's impossible to arranage even the simplest thing without being there in person and signing in on a leaflet of paper and showing your ID.
I'd say it's very difficult for us to do something when it's legitimate even harder for an impersonator and, not surprisingly you don't hear about many abuses of id theft in eastern Block.
Can you give some examples ho
Re: (Score:3, Informative)
Re: (Score:2)
The essential thing in the US is that the banking system has become quite enamored of easy credit in the last few decades -- the policy of extending credit to essentially anyone for any reason, based on nothing more than an application and a promise to pay it back at some later date. [...] So long as the creditors themselves don't suffer too much financially from fraud (which they don't, thanks to their generous campaign contributions and strict avoidance of responsibility through their merchant contracts) it's a winning business strategy because it also brings in more legitimate customers.
Perhaps you didn't notice, but exactly such an attitude as you described is the reason the US economy is in danger of collapsing into deep recession, and taking a significant chunk of the rest of the world with it. Have you looked at the stock markets in the past fortnight, or noticed the sub-prime mortgage lenders in financial difficulties or outright going bust?
Solution is simple... (Score:5, Interesting)
Bottom line: Lock up your data!. We learned this back in the days of the wild west. Now we must - relearn; reinvent the safe for the 21st century data.
Sucks (Score:5, Interesting)
The people running these companies should be considered criminally negligent. Maybe then they'll start to take security seriously.
Monster.com data theft today (Score:1)
At least you knew! (Score:4, Interesting)
In my case, I got a letter from my credit card saying that a merchant whom I had transacted with, was the source of a breach. No more information on when this occurred, who the merchant was, how many people were impacted or how long they knew of the situation, before they informed me. Instead, the Credit Card company re-issued me a new credit card, at 'my request' prior to me doing or asking for anything.
The letter in fact was so unsettling, it was written to evoke a feeling that I had somehow reported fradulent activity... I called the company and spent 45 minutes before realizing that there was one of me and a seemingly unending supply of pod-people who kept repeating the same line to me. I obtained my own credit report a few weeks after and guess what, the aforementioned account was "closed at the customer's request".
The outrage in me continues, and I wonder what kind of risk I'm exposed to, but I don't know what to do against an army of droid? May be a letter will do some good? How much time should I invest in all of this without the faintest glimmer that anything will happen?
I second your thoughts on higher penalties. With credit cards being an increasing singular means of carrying out transactions, I would certainly modify my business behaviors with people who are not careful with my information!
Re: (Score:2)
Instead, the Credit Card company re-issued me a new credit card, at 'my request' prior to me doing or asking for anything.
...
I obtained my own credit report a few weeks after and guess what, the aforementioned account was "closed at the customer's request".
Maybe it's some internal metric they want to have low numbers for, or maybe there is some higher SEC/other reporting requirement they're trying to look good for.
But they probably did it "at your request" because it looks better for them than having to declare "XYZ accounts were closed due to fraud".
The outrage in me continues, and I wonder what kind of risk I'm exposed to, but I don't know what to do against an army of droid? May be a letter will do some good?
A letter to the Better Business Bureau may get you some response.
Complaining to your State Attorney General's office is also a productive move.
You could also try getting a reporter interested in your story.
As a
stats on what the breaches were (Score:4, Informative)
Numbers (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
Always going to be a problem (Score:5, Insightful)
The big question is: What can be done to minimize the impact of the breaches.
The short answer - make it harder to get credit cards, loans, etc.
Once you change the way that money is handed out by financial institutions, all that stolen data becomes worthless.
But... that will never happen. Easy access to credit is the lifeblood of the debt driven American economy. So really, no matter how much moaning goes on about fraud, they still want a system that allows everyone to easily have access to debt at the drop of a hat.
Re: (Score:3, Insightful)
Re: (Score:2)
Hum... (Score:3, Insightful)
2 years = 365*2 = 730
158,000,000/730 = 216,438.36
wow thats a lot of data to be "compromised." I think some of these people should have had better measures in place to prevent this type of thing. Others just shouldn't piss off there staff to the point that they sell company information to the highest bidder. Especially when that information is mine.
I am getting spam to my gmail account (Score:1, Offtopic)
This is REALLY sad.
Re: (Score:3, Insightful)
"aaaaaaaaa@gmail.com"
"aaaaaaaab@gmail.com"
"aaaaaaaac@gmail.com"
If you dig through your SMTP logs every once in a while, you see that stuff. Usually coming from a compromised home machine in short bursts of fifteen or thirty tries.
A few minutes later, another block is tried from another IP on the other side of the planet.
Plus, did you read the fine print on your Gmail account agreement? Did they SAY they wouldn't sell the address? Or did they SAY the wouldn't sell delivery of email to ac
And there are potentially 22 million more (Score:2)
And to top it all off, there's talk in some areas about sending
Re: (Score:2)
It's reasonable to assume lots of data is being compromised because there is very little, if any regulation.
Given that data collection is an industry makes billions annually, I'd argue they behave like the tobacco companies. Cancer? What cancer? Addiction? Nah. That's a personal problem. Roughly translated to "Your personal data is safe with us!"
Re: (Score:1)
Re: (Score:2)
I would guess that it is more beneficial for a public entity to admit to a data breach than for a private entity. Private companies get bad publicity and lose customers if they admit to a security problem, so they do everything they legally can to keep it hushed up. Government agencies, however, get immediate priority to security funding when there is a
Don't use personal info for identification! (Score:1, Informative)
As long as brain-dead morons at financial institutions and in government insist on using personal information for identification we will have issues. This is such a flawed approach that it really is negligent.
Security is an illusion (Score:3, Insightful)
Genuine security costs companies millions of dollars. Insecurity costs them NOTHING. They could expose every single piece of every person's information and it would have no penalty. None.
The government and corporations have no interest in protecting your information. So much is in the wild already that it makes no difference to them. 158 million people? What's 50 million more? 100 million more?
Stop complaining about this. The horse was out of the barn a long time ago. Security and privacy are illusions. They are gone and they are NEVER coming back. Your security and privacy have no value to the government or corporations.
Re: (Score:1)
Re: (Score:2)
Unless is is protected medical information, if they release that information they are facing serious fines. See the Health Insurance Portability and Accountability Act (HIPAA) [wikipedia.org] for more. "Protected Health Information (PHI). PHI is any information about health status, provision of health care, or payment for health care that can be linked to an individual."
Some states, including Minnesota where I live,
TJX (Score:1)
Need a New form of ID (Score:2)
If I were "king 'o the world" I would get some international org together to develop an ID standard, then require all employers, agencies, and lenders and such to convert over (say in five years) to use that for all transactions, etc. Also set up laws and education curriculum about "your ID" and punish t
Re: (Score:2)
I would propose the opposite solution, although it's unlikely to be popular with governments. Make it easier to make throw-away identities. The identity I use for buying a house, I would protect very carefully. One I used for buying something cheap on eBay I wouldn't. Because there is less information associated with the unimportant identity, it has a lower credit rating, and can maybe only buy things worth $100 per week. If it's compromised, I don't lose much, I just destroy the identity and carry on
Re: (Score:2)
-M
Re: (Score:2)
Re: (Score:2)
Pay the customers who get hurt (Score:2)
I've said it before [slashdot.org] and I'll say it again, there's a great opportunity here for an enterprising business to make money by providing insurance against ID theft, IF THEY PAY THE AFFECTED CUSTOMERS!
Summary: Leverage best practices and reward for it AND involve the customer to demand better protection.
Imagine if insurance companies offered a policy that would:
This might play out as
weakest link (Score:2)
Could this be for another reason? (Score:2)
Could it be, that the Total Information Awareness project (TIMA), run by federal criminal John Poindexter, just went privatized? Could it be that he and other people are doing an end-run around spying on citizens, and creating a massive database for this purpose and subsidizing the costs with
Re: (Score:2)
So BrightPlanet is working on "document Federation" for the Enterprise? I thought we were supposed to be the silly nerds and not ex-uncontrolled spooks like Poindexter?
America - where petty crims lose the ability to vote bu
Reporting agency (Score:1)
Glass walls (Score:1)
Gartner says identity theft is up 50% since 2003 (Score:1)
So at least at first impression, the routine leaks of personal information correlate with increased identity theft. Of course it might just be coincidence
jon
Not THE Bob Scheier? (Score:2)
Coincidentally... (Score:2)