Slashdot Mirror
Consumer Database Company Hacked
fermion writes "The NYT(FRR) and others are reporting that a hacker has broken into a Acxiom server. Acxiom evidently is "one of the world's largest consumer database companies" and serves most top credit card companies and retail banks. There are a few items that stand out in this case. First, Acxiom had no idea that the breach occurred until the company was contacted by the police. Second, the theft was an inside job. The suspect, now in police custody, was an employee with legitimate access to the information. It amazes me that a such a company would have such lax security as to allow an insider to browse supposedly private data at will. Third, the company is taking no responsibility for the break in other than reporting it to the clients, who then may or may not inform their customers." Acxiom is a Certified Participant in the BBBOnline Privacy Program.
This is, unfortunately, the real world. Lax security such as this is the norm. "Need-to-know" is a term which doesn't seem to exist in the security policies of these companies. Insider information will always be leaked by someone out of curiosity or some malicious impulse. They're lucky they were able to find out who it was! At least maybe now they're more likely to improve their security and get it up to scratch. (But probably not.)
Bash script for FP whores
Translation: The names of the directories weren't personal data...The files in the directories? well they had the SSN/DOB/Address etc. So, technically, some of the data was personal and some wasn't.
Science is a lot like sex. Sometimes something useful comes of it, but that's not the reason we're doing it
ZOMG.
It amazes me that a such a company would have such lax security as to allow an insider to browse supposedly private data at will.
love is just extroverted narcissism
whenever a company gives you a chance to Opt Out, take it, no matter what the hassles. this keeps your personal information from getting into databases like this and ensures that even if - as in this case - the information "owner" denies accountability, you still have some protection from recent state and federal legislation.
...
sometimes it's good to use the system
when it rains, it gets real soggy. when it pours, i'm under the tap just _waiting_ for the joy
At least as of a couple of years ago, INTERNAL security threats were really the major issue for most companies. Despite the fact that insider breaches probably tend to get less press, I bet this is still the case, although I don't know for sure. Anyone?
Roving Web-Teleoperated Robot
It amazes me that a such a company would have such lax security as to allow an insider to browse supposedly private data at will.
Have you been under a rock for the past...100 years?
I setup AS/400 web solutions for my clients. They are ultimately secure because no hacker would know what to do if he broke into the system.
Conformity is the jailer of freedom and enemy of growth. -JFK
When hackers say they want to hack into a system to "expose the security flaws" of the system, I want to kick them square in the groin to "expose the security flaws" of their pants.
And I have a question to ask: what kind of data exactly was left vulnerable by this hacking? Is it credit card information, names and addresses, phone numbers, credit ratings, all of the above?
Bash script for FP whores
While it isn't really anyones fault if a good hacker gets to them (especially on the inside!) This raises a really good legal point. YOU SHOULDN'T DATA MINE UNLESS YOU CAN PROTECT THE DATA!
That company took on a huge responsibility when they started tracking millions of consumers. And they should be held responsible for any damages that occur do to dissemination of private information.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
Since the alleged hack was an 'inside job' by a person who had access to the data, is it news at all? I mean, we heard recently that some Pakistani broke into Passport .Net and could reset passwords at will. That was more dangerous.
Mere access to credit card numbers and the corresponding user list does not constitute a major threat, IMO. Most credit card users are indemnified against thefts, misuse etc. The same can't be said about Hotmail hacks or even Windows hacks.
-
If you keep throwing chairs, one day you'll break windows....
Acxiom warned TRUSTe members in late 2002 that "conditions look right for the 'Perfect Storm' of privacy legislation next year." Yeah, scary, the government might insist that customers have some privacy.
I wish I could have seen the look on their faces when the government called them up to let them know their own employee had stolen their customers' private data.
So not a hacker then. Or a cracker either, to keep another section of the crowd happy.
This sounds like straight abuse of confidential information. No computers required, no lax security required. A person with legitimate access to data went bad. As such, it's not really a criticism of Axiom's security policies . It is, however, a criticism of their hiring and monitoring policies.
Cheers,
Ian
for how long will that be true?!
I work for a small 8 person IT business in the town I live in. I'm computer help while I go back to college.
When I first started, I found out there's a bunch of clients (many medical), but when we install, we usually use simplistic passwords. Simplistic as in Roberts' wordlist. We dont even change them either. We also have a Winnt4 domain controller for our internal fileserver that simply shares 4 directories. ALL OF THEM HAVE GLOBAL +RWX ON EVERYBODY.
Even the shcool I go to has decent protections on their shares.
Anybody know how the recent California law requiring companies to disclose when their data is compromised would apply to this case? If the primary victim in this case notifies its clients (call them secondary victims), are they then required (if they do biz in California) to notify the tertiary victims (their customers)?
Just wondering how all of this may play out...
That doesn't amaze me at all. Who knows what kind of access that employee had. Maybe he was the person responsible for security. Besides, it was a "Break-In" which implies circumvension[sic] of security measures. Now, what's so amazing about that?
you post as AC, but include a sig?
heh
silly billy
Didnt CA recently pass a law requiring disclosure of breaches involving CA residents? Anyone know if this applies here? Are Axcion's client companies mandated to contact their clients, and so on down the tree?
I'm not in CA, but there's a strong liklihood someone from CA had data in this system.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
Over the news I heard thm saying chances of identity theft are slim, by using the stolen data. :)
Ha!
Chances of identity theft are high even when the data is not stolen.
Consensus is good, but informed dictatorship is better
The person had legitimate access to the system. I wouldn't call using your legitimate access to then, *GASP*, access that system, a hack.
One of my first jobs was running some hot laser printers for a junk mailer. I believe we used lists from Acxiom. The most damage you could do with one of these lists would be to shill for publishers clearing house. No identity theft with this list. When you would check the test pages you would often find names that were clearly misspelled or total garbage. Wake me when it's a credit card/banking database.
Either one can be rcok solid or practically hand out private information dependng whether set up by someone in the know or a barrel of ass monkeys.
I know nothing about MySQL but Linux is doing better with security than Microsoft in my books. With redhat i can push updated rpm's from RHN and the system is always as secure as possible barring foolish configuration errors. Furthermore because the only patches that require a reboot are kernel patches (and even those can be done without rebooting immediately, just won't take effect until it is) I can do the majority on the fly. Can you say that about your precious windows rebootathon?
Yes, Windows yes it's advantages. Yes Linux has its advantages.
And as a final thought, how long has 2003 server been out? And what of your Windows 2000 e-commerce sites before that?
tick the box folks, ditch the loyalty cards. don't give them any more data.
All I Want For Christmas Is My Constitutional Rights
right, no one ever hacks IIS servers ....
... I and many others run Linux/Apache/MySQL for years, never once had a single machine hacked.
;)
FYI
I suspect this is a troll
Don't be so sure. He might suddenly remember that he played a game like that on his PS, and then it would be all over.
About a year or so ago people started getting spam addressed to the wrong "John Smith". Some folks tracked the spam to Axciom. It appears that they'd started selling epending services for their clients.
Basically a client supplies information about the consumer (name, partial address, etc.) to Axciom. Axciom then takes their best guess as to what the Email address for the consumer might be.
Where the problems come with this approach when you have a common name and your address information is incomplete. Axciom will happily give the client the buest guess, and the client will happily spam the living ****loads out of whoever's email address they can get their hands on.
But, hey, you can always opt-out...one client at a time...
Proletariat of the world, unite to kill spammers
In Soviet Russia, I ruled you
Just a question about the terminology used in the headline there.
I'm no walking dictionary, but I thought the word "hack" (translated as "crack" to technical folks- I don't even want to open that can of worms)-suggested someone somehow getting access to something that they do not legitimately have access to.
--something witty
"Acxiom is a Certified Participant in the BBBOnline Privacy Program. " Wow, but the BBB is
a totally useless organization. Why do people think they are worth anything? You pay to get their Plaque to hang on your wall. They do nothing else....
"Third, the company is taking no responsibility for the break in other than reporting it to the clients, who then may or may not inform their customers."
Saddly, our government doesn't seem to be too... enthusiastic about stopping this type of stuff. Don't get me wrong, I'm a libertarian at heart, I think the government should stay out until absolutely necessary, but this is a case where it's gone too far. I don't trust the consumer enough to protect his own rights.
Anyway, with the current corporate situation, and the examples set by Microsoft et al, IT has grown into a industry with no personal responsibility and very questionable morals.
I can't say this surprises me much.
~Dalcius
Rome wasn't burnt in a day.
if that was the case, serve them right for using a crappy multi-user OS
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Five years ago, I was called in to do consulting for this company, Axciom. The company's database server was running what was essentially a glossy front-end to Microsoft Access. I explained to them that an open-source database would improve their system's security, functionality, and reliability.
Their response was the most shocking thing I have heard in 20 years as a computer user.
"Does it run in Windows?"
Of course it doesn't run on Windows!! Windows is a mine-field of security through obscurity. Because nobody -- not even a Microsoft engineer -- can do a thorough inspection of the source code, that means that 568 vulnerabilities have been discovered in the five years since I flipped off Mr. Neil Haiman, Axciom's chief of security. By comparison, Linux has had fewer than 40 vulnerabilities, all of which could have been fixed by upgrading to the newest packages. A quality distribution like Debian will upgrade all your software automatically.
Did Axciom do that? No, of course not. They stuck with MICRO$OFT WINBLOWS, and now they're paying for it.
Rot in hell, you SCO-loving bastards.
I'm not Seth Finkelstein. I still speak the truth.
"I can say this about the data, much of it was nonsensitive information."
I can say this about this gun I'm pointing at you, much of it is innert material.
"with their freedom lost all virtue lose" - Milton
I believe that's called Security through Obsolence. Using older systems oftentimes rebuffs the script kiddies and their insistence on using the latest and greatest hacks.
Doesnt protect much against teh determined attacker who knows his target well, and doesnt necessarily rely on the most recent attacks.
"Need-to-know" is a term which doesn't seem to exist in the security policies of these companies.
At some point, at some level, there will be someone (or a group of people) with access to information who would not have a watchman over his shoulder -- how can you be sure you can trust them?
Pre-screening of employees and logging of all transactions is necessary, but some times you just can't deny someone access to something if it hinders their work significantly (e.g. the work they were hired for in the first place) and/or puts that work on your plate instead.
I'm not saying that this is good. I'm saying that, too, is real world.
Have EVDO, will travel.
Did they use nmap with a xmas tree scan then found a buffer overflow on a service which gave them root ? did they install a trojan that ripped root passwords as it traversed the internal network ? was it social engineering hack ? did they construct an asm or c exploit ? did they use zombies ?
or maybe they was actually allowed to see the data (dba,sysadmin,manager) and they just copied it to a cdrom
this gives us real hackers who spend hours/years poking and prodding systems to get root a bad name
A.C
{+_+}
General Conditions
The organization's website or service is online. If not yet launched, the organization's website or service is substantially complete and available for evaluation.
The organization has adopted and implemented an online privacy notice (including an effective date) and posted this notice on the website or online service.
The organization has paid the application and evaluation fees; completed the BBBOnLine Privacy Business Application and required portions of the BBBOnLine Privacy Assessment Questionnaire. The organization has signed and returned the BBBOnLine Privacy Participation Agreement.
A specific individual has been charged with the responsibility for implementing and overseeing the privacy notice for the website or online service. If the organization's application for a BBBOnLine privacy seal does not cover all its websites or online services, and all the websites and online services of its corporate affiliates, then it must be clear to web-visitors relying on the display of the seal, which parts of the websites or online services are covered and which parts are not.
Any organization whose website or online service is directed to children under the age of 13, or who collects personally identifiable information from a particular individual actually known to be under the age of 13, must comply with the substantive requirements of the BBBOnLine children's seal program in addition to the requirements of the general BBBOnLine privacy seal.
Geez, even the submitters don't RTFA, do they? From the NYT:
The suspect was not an Acxiom employee, but an employee of one of Acxiom's clients (banks, cc companies, etc.). He had access to the server, but he cracked the server to access information from other Acxiom clients as well. So yes, this is a cracked server, which BTW was placed outside the company firewall. I'm no security expert, but doesn't that sound stupid to anybody else?
"No, no, no. Don't tug on that. You never know what it might be attached to."
It amazes me that a such a company would have such lax security as to allow an insider to browse supposedly private data at will.
And why should this "amaze" you? At some level in any company there needs to be people who can do this. Your human resources department has a ton of information about you that they can pretty much look at whenever they want. Medical professionals are the same way. If you are an interesting case, do you honestly believe doctors/nurses will not talk about you? You are naive if you think that, despite laws (HIPPA) prohibiting such behavior.
You need to be able to trust these people and while there does need to be security and surveillance of people with access to sensitive information, you can't keep them completely away from it. This is especially true in a company (or government agency) whose business is based upon such information. It's also nearly impossible to prevent a knowledgeable insider from getting access to sensitive information, so I'm double confused why this should be surprising.
While it is unfortunate that it happened, the fact that it happened should "amaze" no one. Give enough people a chance to make money by breaking the law and guess what? Some of them will.
Nothing to see here. Move along...
I've seen in the web logs of a big multinational that they've had entire databases downloaded and then spent literally weeks trying to get a manager, any manager, to understand they're being hacked whilst at the same time watching as the bad guys slowly extend their reach through the systems.
:), life is just too short at these sort of companies. They're not interested to the point of wanting to fire people for giving them a heads up that there are problems.
If it's not in my job description I don't bother anymore, but look to see how they do it, for the sake of science and all that
I would suspect this is what has happened here.
threadeds blog
So you're "amazed" that a database company has employees who have access to their database(s)? How excactly is it that Acxiom should do its job while preventing its employees from ever working with the data? Unless the description of the theft is inaccurate, this has nothing to do with hacking and is merely a misuse of priviledges. If the armored car driver steals the contents of the armored car, is it because the car wasn't secure enough?
If you would like to be a leader with a large following...drive slowly down a windy two-lane road
Do you have anything worth hacking?
I used to work for a consulting group who managed websites for several big name companys, all of which took online orders. Part of my job was to code pages that analyzed the databases and presented an overview of sales statistics. I recall being suprised at the thousands of credit card numbers listed in the databse and how easily I could have taken them. There was no password protection except for the general login/password used for ALL our databases which most employees knew. Luckily im an ethical person but it would have been excedingly simple for anyone in the company to access the servers and take down credit card numbers, experation dates, names, addresses, and other personal information. Its realy scary when you think about it...
Uh, yeah, at the risk of -1 redundant, of course an insider will be able to browse private data at will. _Someone_ has to be able to get to the data, unless you're postulating SkyNet.
I suppose this could have been a hack, if this person became employed at the company in order to get the data -- that comes under social engineering hacks (and industrial espionage). But "disgruntled or avaracious insider abuses position of trust" is hardly news.
I know several developers there...I almost worked there myself actually. I've heard them mention on several occasions that they develop against production "real world" data simply because there is no test database large enough to test scaling and performance. I remember asking them if they could actually get consumer information on ME and they didn't act like it would be too difficult. Scary...
There was a bank robbery in Shelbyville today when 48 year old Steve Lekowski found $10 on the floor in the rest room and instead of handing it in, he put it in his pocket.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Why ? Do you think all hackers are pimple face 16 yearolds
There are 5 types of hackers out here let me give you the run down as professional security consultant
Casual hackers
Skill level Low - high
Treath Moderate
Varying levels of skills ranging from beginners to seasoned veterans. Often rely on widely available automated tools to locate exploit or weakness
Employees/Insiders
Skill Level Low - High
Treath Moderate - high
Direct access to internal resources. Mayy have detailed knowledge of a company's computer systems and security mechanisms.
Theives and Career Criminals
Skill level Moderate - High
Treath High
May be higly skilled at evading discovery and capture. Detailed understanding of financial and accounting systems.
Corporate SPies and Other Highed professionals
Skill level High - Very High
Treath - High Very High
Proven level of skill often insiders with direct access to confidential information
Foregin Goverments and terrorst organizations
Skill level Very High
Treath - Very High
Highly trained with proven level of skill. Focused on intelligence gathering and effective information warfare tactics.
Now depending on what your data is worth will define the type of hackers that pray on your network.
- I came I saw I Conquered
I read three versions of the story (courtesy of the Google News link). None of them specified what the job description of the perpetrator was, although I'll infer that because he had "legitimate access" (wording per the SilconValley.com verison of the story) to the servers where the information was kept, he wasn't, say, a janitor. So why the histrionics on the submitter's part about how "such a company would have such lax security as to allow an insider to browse supposedly private data at will." Dude, the guy had access. I'm a systems administrator, I can read my co-workers' email at will. If I suddenly "went rogue" without warning, not a lot you could do about it, huh? At some level, you just have to trust your employees.
What's funnier is the universal use of the word "hacker" in the various writeups of this incident. The guy had access already. He didn't hack his way into anything. Back when I worked retail, if our credit card receipts didn't add up to what the system thought we should have at the end of the day, we'd have to do a "list print" - we'd go to our little VeriFone CC terminals and have it print a record of every transaction it could remember. It had a 255 transaction memory, if my own memory serves, complete with amount, timestamp, and - wait for it - credit card number. So, if I printed out a list of 255 credit card numbers and went on a buying spree with other people's money, would you say I was a "hacker" then?
Contrary to popular belief, a DBA should not have access to sensitive data. A database can be set up in such a way that a DBA will be able to manage users, table space etc, but is unable to just browse/export the data itself. We are doing just that on one of our databases, using Row-level security.
Of course a DBA can grant himself access to data, but such changes in policies should be logged into an audit trail file, which must be unalterable by the DBA, and inspected on a regular basis by a sysadmin or security officer.
Allowing (potential) access to all your sensitive data by a DBA or sysadmin may be unavoidable, but not implementing an audit trail and inspecting the audit trail (so that you can at least tell that they've accessed the data), is what I would call 'lax security'. As a bonus, you can catch and fire any BOFH-type admin.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
What's your name, I'll look your SSN up and send you a birthday card
My job is so that I have access to all info on a credit card (Name of the person, date of expiration and full number), and even worst since the demand of the US governement (CAPS) on airline I have acess to the people their visa and their passport. Would it be possible to protect those data against me ? No way. I can acess the data at all level, and since I am the programmer , even if it is encrypted I can still acess it by putting a nice placed trap. Would I do it ? No way, I am honest. Is it possible for me to do it ? Yes.
You cannot protect yourself against all your employe, because at one point or another you have to to have some trust (at least at the facture time).So IMO this is a no new here, and I barely call that hacking. Rather insider stealing.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
All your base jokes are still funny? I must've missed a memo.
---
When I grow up, I want to be a kid again.
Acxiom is a Certified Participant in the BBBOnline Privacy Program. :-)
Not no more they aint
-- DuckWing
Acxiom wasn't listed first because they were the biggest or most important. They're listed first because that's alphabetical order for you.
CLASS. ACTION. LAWSUIT.
The Anti-Blog
This database housed millions of user information so right off the bat you should know this was not implemented on RHAT on intel. Most likely Oracle running on Solaris or AIX
- I came I saw I Conquered
"The suspect, now in police custody, was an employee with legitimate access to the information. "
.. da da .. da da (shark music))..
Well break in is hardly the right term then if legitmate access was granted to this individual. This is just malfeasance.
My wife used to work for them and the information they have and how they match credit card purchase with census with demographic data against sales going on at the time gives an incredibly detailed look at how a sale works for add on sales or a view into groups that can be effectively target marketed. They do a massive data mining on individuals. We are talking large retail customers as well as some government ones.
Any you thought is was safe to go back into the Mall. (da da
Would you use a homemade security system made out of string and tin cans to secure your home?
No?
Then why in the hell would anyone use a homemade, third rate, half-stolen copy of lunix to secure their data?
It's ridiculous, there ought to be a law. Once the warez rings that distribute it are brought under control, though, I'm sure the rightful owners of the code can tighten it up and sell it with some real security.
I don't need no instructions to know how to rock!!!!
Now had this criminal act occurred overseas, there would be nothing domestic authorities could do.
... PROFIT!
They will never know the simple pleasure of a monkey knife fight
That's right. The cuplrit didn't hack or crack anything. He simply embezzled the data.
Greetings Professor Falken.
Shall we play a game?
He then had to play tic-tac-toe against a chicken, and decide if 'Eliza' passed the Turing test to actually acces the data.
Once it was fully printed on tractor feed paper, he then had to bribe a small child with Pokemon cards, and juggle three rolls of tape and sing 'You Are the Wind Beneath My Wings' in front of Ryan Seacrest in order to abscond with the wheelbarrel full of printouts.
I think we can all agree that security was not at issue here, it certainly had to be an inside job.
look here
Grundgesetz * 23. Mai 1949 - 30. November 2007 - http://www.vorratsdatenspeicherung.de/
"I setup over a dozen e-commerce solutions for my clients, and they all are running Win2003 server with IIS 6.0 and MSSQL2000, and not a SINLE ONE has ever been hacked."
Since you seem to think that a few months with no breakins is a noteworthy accomplishment, you unintentionally highlight the fact that Windows/IIS is well known for breakins.
Those of us who have done more than a dozen installs over the course of more than a few months are well aware of the overall security trends of the various platforms.
Unfortuately there isn't much you can do to prevent it. There will always be a number of people in any company that will have complete access to data. The only way to prevent it is to have stringent auditing and have someone who's job is to review the logs.
A number of places i've worked for, mainly governemnt, audit everything they can but they don't have the resources to scan the logs. If there is a security breach they use the logs to backtrack. But like this situation, it the breach isn't discovered (which can be difficult depending on the skill level of the person doing it and their access level), then no one will ever know. Also, as an employee it is probably very easy to find out which protection mechanisms are in place, through documentation or just simply asking.
I'm a DBA and in each company i've ever worked in i've had complete access to all corporate data. At some point your going to have to trust someone and sometimes you just make the wrong choice.
"Thanks to the remote control I have the attention span of a gerbil."
So not a hacker then. Or a cracker either, to keep another section of the crowd happy.
*sigh* You should know better than to trust the poster, headline, the commentary, or the summary of any story posted to Slashdot. I know it is odd, but this isn't a news site where "editors" verify things that are posted. As always, RTFA...
My beliefs do not require that you agree with them.
"Barrett said the offender gained access by hacking encrypted passwords from clients who access the server. The server, which was outside a firewall, was used "for clients to transfer files to us and for us to transfer files back to the clients," she said."
>From the Washington Post
Could these be from using FTP?
Actually it was "a former employee of an Acxiom client." Not exactly an inside job for Acxiom -- sounds more like the problem was really at the client's end?
The U.S. health insurance and medical "industries" are seriously under the gun with this sort of thing, getting well ahead of the working world generally. I have tangential contact with some substance abuse and behavioral health businesses, and it's absolutely unreal the security they have within their organizations. "Need to know" doesn't start to describe the levels of security. They're serious.
Medicine is doing it under the threat of HIPAA, the massive new law that protects patient privacy among many other things. The government really did regulate an iffy situation into a much safer one; traditional models of sharing patient information based on professionalism and so on just didn't hack it in the new world of data warehousing and so on.
You'd think the banking industry would've taken the same precautions out of self-interest -- but then if I read this right Acxiom is a database company they contract with. (One case where the government's regulatory presence seems to have established some standards that protect consumers better than a private industry's self-interest? HIPAA has always seemed like a bureaucrat's dream to me, but seeing this...)
Oh, and how cute is this?
No such thing as data in custody, newsie; once it's out, it's a feral cat.
"Fundamentalism" isn't about divine morality. It's about human authority.
The reaction of the company in this case, not notifying potential targets, and not putting safeguards in place, suggests that their attitude is to wait and hope that the problem will go away. However, the biggest security hole (in terms of potential damage) in any system is the possibility of abuse by trusted insiders. This suggests that Axciom will have this problem again.
Oh, and some kind of link to an article would have been nice.
The Amazing Bread Nipple
We take no responsibility...
Where are consumer rights in this country???
Mere access to credit card numbers and the corresponding user list does not constitute a major threat, IMO. Most credit card users are indemnified against thefts, misuse etc.
Perhaps, but it would still be nice to know if it's likely to happen, wouldn't you think? If I wanted/needed to change my credit card numbers, I'd rather do it proactively than after the fact. It's easier to clean up the mess, if nothing else.
Proves not a single person who's posted has RTFA yet.
Not sure why I'm responding to an AC but I did RTFA. I wasn't responding to that. I was responding to the stupid comment about the article in slashdot by the submitter.
Pot, kettle, black...
are belong to us!
And yesterday I was talking about the lax security
Just spend the hours since waking with my bank, a fresh load of unauthorized cc activity as of this morning. It's a big bank, and it's brand new crapola, and I use the card only with reputable vendors. Joy. Not compromised my ass.
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
We obviously need to push for similar requirements used to secure our medical information.
While some may argue that it will increase the cost of doing business, the leeches who profit from our personal info without our consent don't deserve our sympathy. There are many companies that buy and sell our personal info daily without our consent or knowledge.
Besides, having rules for security related to our personal info will create new jobs as existing systems are modified and business processes are reengineered. Perhaps even more jobs than HIPAA.
Perhaps an even better solution is to require our written consent before any company sells our personal info to another and the consent deemed non-transferable.
When the people whose data was stolen have their identities assumed by some third party, I imagine the last thing on their mind will be the horrors of someone stealing their hotmail account.
Of course this is newsworthy. Everytime one of these companies has a security breach because of stupidity and unpreparedness, the news should be spread as far and wide and as loudly as possible. It would seem that corporate embarrassment and public outcry is the only way to get through to these companies.
With the growing level of criticality these databases are being endowed with, it is essential that they be secure and accurate. If the companies can't handle that responsibility, they should have it at all. If you ask me, the level of importance things like credit reports have reached is a disaster waiting to happen. The databases they are created from are full inaccuracies and have huge access holes. It's part of the reason why identity theft is exploding in the US.
I have worked as a short term contractor at one of the "Big 3" credit agencies, and was responsible for adding code to the Mexico codebase that added credit "scoring" to the list of items tracked. It was a 3-month contract where I, coming in off the street, had basically root access to the worldwide databases of this particular credit agencies customer database. It was necessary for my testing that, after I ran my modifications on a test dataset, which I got to expose my changes to a development mirror of the actual database before checking the code into the build tree.
Thinking about it, there was really no way to deny me access to that database, for without the ability to test against live data, there would be no way to verify that my code would not cause someone else huge headaches if it did not work properly.
My point is this...as long as programmers exist they will HAVE to have access to sensitive customer data. It really come down to a typical employer-employee trust issue, and this problem as been with us since the development of merchant/consumer transactions. The idea that sensitive data can be protected in this day and age is as silly as thinking State secrets are safe.
never bring a twinkie to a food fight.
"To confine our attention to terrestrial matters would be to limit the human spirit." -Stephen Hawking
Whilst we have Bill Gates scream "secure computing", Palladium and other buzz word compliant clap trap as if it was some sort of magic silver bullet, the real issue has nothing to do with security of the software but the people who have access to it.
Read ANY security analysis and they will always tell you that the weakest link in the security chain is always the human operator.
This weaknes is either via two things, social engineering by an outside cracker or privilages being abused by an inside employee either for themselves (as this case) or for a third party, as the case 2 years ago in New Zealand when 3 public servants were found selling social welfare records to debt collecting agencies.
Unforunately in this day in age there is a sizable portion of people who have absolutely no integrity and as a result give the whole business a bad name.
Although this sort of thing DID happen years ago, it didn't happen on the large scale it does now because there was always a paper trail to follow vs the virtual electronic one which can be easily manipulated by those with the knowledge and desire to do so.
What has happened today/whenever was not only a lack of integrity by one person but a lack of safe guards in place from day one to ensure that this sort of this can't be repeated.
For example, the credit card number should not be available to anyone. The only things that should be allowed to happen is for it to be replaced or deleted. Since everything is done electronically, there is no need for anyone to see those numbers.
Another safe guard would be to install monitoring software onto all computers to track the interaction of the employee and the data and cameras (of decent visual quality) to monitor not only the user on the computer but their body behaviour so that if any tell-tale signs of dishonesty are detected such as taking notes and trying to secretly "hide" a document in their pocket then the employee should be questioned then and there.
Yes, this does sound like big brother, however, ultimately, until the minority realise that there behaviour is completely and utterly unacceptable, this sort of thing will repeat itself.
"The difference between pornography and erotica is the lighting" - Woody Allen
I changed the name of the AP from "linksys" to "WhatAboutHIPPA" and left. Hopefully SOMEONE will see that and realize they screwed up, but I'm not counting on it.
Given the level of technical expertise I've come to observe in most medical offices (translation: extremely low) they probably will not get it. The best thing you could do (if you are worried about lawsuits & such) is to notify them anonymously and include some relevant articles from trusted sources they might recognize. (PC Magazine, etc) Even better, start yourself a little "business" and send them some flyers offering to help fix the problem. Maybe you can make some jack and do a good deed in the process.
Granted they might not get it anyway and I applaud you for any effort but the staff which manages that stuff is very unlikely to be security savvy. You'll have to be more obvious than that. Stupid I know but remember that they are trying to help people, so their heart is in the right place.
The individual in police custody is a former employee of one of Acxiom's clients and that the information was stolen while the person had legitimate access to Acxiom servers. ``They used that access to hack into the passwords of other clients,'' she said.
This was not a hacker as such, it was a dishonest employee with legitimate reason to access their data, and a poorly configured system that did not separate the client data into separate, firewalled rooms. If Acxiom had taken the rudimentary precaution of access control to servres by user groups, that "hacker" would never have been able to see the other client names, servers or anything.
This utter bullshit of allowing private companies free reign over my private personal data should end NOW! First of all, its "legitimate uses" are appalling: the assembling of subjective data, the marketing, the way that your credit rating declines based on who looks at it, ALL BULLSHIT. Now, the feds are buying data from these fucks.
But this takes the cake. Not only are they peddling the most private details of your life, but they can't even safeguard them.
This company should be driven out of business immediately. Its corporate officers jailed, and the managers responsible severely punished, in a court of law. The assets should be divided, and everyone who is listed on their database should receive a check. In order to raise this money, the personal accounts of the corporate officers should be seized. Furthermore, the creditors and shareholders should be left with nothing.
POWER TO THE PEOPLE!
Barrett says the alleged hacker is a former employee of an Acxiom client.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Credit Card information? That's nothing....
I work in Benefits Delivery, and odds are if you work for a Fortune 100, I have access to every bit of your retirement income data. The depth and breadth of the personal information we store is staggering. The number of people with unfettered and untraceable access to that information is disturbing. The fact that we will begin outsourcing many of our operations to India in a few months is downright frightening.
At any point, someone who has been with the company for only a few days would be able to change your 401(k)investment elections, transfer your retirement savings money between funds, set up an unauthorized beneficiary for you... all without the possibility of being traced.
Even assuming that all of our employees are honest, the possibility for errors is enough to make you want to start storing all of your savings under your mattress in a sock! Without going into too much detail, last week one of our client teams accidently wiped out all of the balances for the entire population in their production database. That was 10,000 people who suddenly lost their retirement incomes! How was it fixed? They used a week old backup and guessed about what the updated amounts should have been.
Of course, there is nothing that you can do about any of this but keep a vigilant watch on your retirement accounts. There is no "opt-out" option. In many cases, you wont even know that we are managing your benefits.
This is the world we live in. There is no privacy any more and nothing is ever truly secure.
Meanwhile the self-regulation model seems to have left Acxiom open to a problem at one of its clients -- it was a former employee of a client who filched the data.
Not enough bureaucratic regulation?
"Fundamentalism" isn't about divine morality. It's about human authority.
One line blog. I hear that they're called Twitters now.
People carry their wallets in their back pockets. People leave windows unlocked. People trust their neighbors. People think their data is secure.
A good thief/crook/whatever is someone who exploits this feeling of security, not breaking into a secure system.
This guy just screwed up and got caught. I bet this happens a lot more than we think, thanks to our sense of security.
The summary is misleading. The attacker was not an acxiom employee. He had legitimate business using the acxiom server to access one account (that of his employer). He used this access to get the passwords of other clients. If that doesn't count as being hacked, I don't know what does.
See the SecurityFocus article.
Obviously, the database isn't a plain-text or an excel sheet. It's gotta be some sort of SQL server (I would hope so!)
...."
So our "cracker" had to be smart enough to take a look at things like netstat and see where his tool/application was connecting and then maybe he could do some sort of "select *
Maybe those commands were viewable via "string" or "notepad.exe" (if Windows).
You can't simply "access" that data, you have to dig for it. Maybe he was an IT guys as well and then, things are much easier (unfortunately).
-- Leeeter than leet
If you put everyone's personal information on the internet, you would probably find that after a while, most people wouldn't even really give a hoot about it.
How bad is a bankruptcy or something else, anyway?
The only people privacy rules protect are the rich.
Medical records should be kept private. But, financial records, why not make them all public?
This is my sig.
First rule of database administration..
THE ADMINISTRATOR DOES NOT EVER, FOR ANY REASON, TOUCH THE DATA.
Second rule?
The people inputting the data cannot query the data.
Third rule?
The people who query the data, cannot modify the queries.
The second and third are not nearly as important as the first. If you work in a company that violates the first rule, you should immediately walk into the office of your CEO and demand he commit seppuku.
I keep seeing posts from the clueless whining about, "Well of course they had access!" True, someone ultimately has to have some type of access to the data. However, the access should be restricted far beyond the idea of, "Oh, the DBA can just pull up whatever he wants."
Sheesh. Now I know why I can't get a job, and companies who are laying you people off are checking out India and Russia.
I'd be fucking sour on US 'techs', too.
Acxiom is a Certified Participant in the BBBOnline Privacy Program.
It's sad, but my experience is that the BBB exists simply to collect money from members for a rubber stamp.
I was being spammed by www.inphonic.com, who had a BBB logo on their page. They weren't directly spamming, they were using 3rd party spamhausen (fantasticrewards.com, freeze.com, consumerpackage.net, etc.) Even after the BBB had forwarded my email address to them, and inphonic.com had replied *to me* saying "we'll take you off our list", I continued to receive email from them. (side note: this is why opt-out doesn't work; being off their list is irrelevant if the spammers that they hire don't do the same).
I sent their certifying BBB all the proof. The BBB's response was to literally change the written policy from disallowing spamming to allowing spamming as long as the merchant includes an opt-out mechanism. I pointed out that they weren't honoring opt-outs, either, since I kept getting spammed, but the BBB didn't care.
Anyway, I'm not convinced that the BBB really does anything aside from collect money. All organizations like that have the same problem: you can't shit on your customers. And ultimately, inphonic.com is their customer, not me.
Michael
Do you have ESP?
Acxiom doesn't care if people have access to personal data gathered about you; that's what they do; it's their purpose in life.
So what really pisses Acxiom off about this? Those big clients are going to go over their bills and demand a refund for the stolen access.
One line blog. I hear that they're called Twitters now.
Since when does that matter?
You can have a pissing contest all damn day if you want to - no OS is infallible. It doesn't matter if you wrote the OS yourself - if nobody took the time to do basic security on it - not to mention physical security, it's immaterial.
Until security is taken seriously, this will happen regularly. The difference is - we heard about this one.
And Bill; so what? Small fish like your clients aren't attractive enough targets, THAT'S why you haven't been 'hacked'.
Legitimate access to the server may not imply legitimate access to the same data. While it's generally stupid to house lesser apps on a critical-data server, it is entirely possible that this user had certain rights to the server, but wasn't supposed to be able to access the specific information which was taken.
This isn't news -- it's a daily occurence. However, netizens and hackers find break-ins newsworthy when the database is larger and/or more sensitive. The greater the target's security investment, the greater the challenge. You can bet that copies of this database have already been tarballed, bzipped and scp'd to 50 countries.
If you place first in a 500 lap race, there is more associated with that victory than a shorter 100 lap race. Why? Time investment necessary to be victorious, equipment and bandwidth required. Concentration needed. Similarly, if a company has stateful inspection firewalls, network and host-based intrusion detection, regular vulnerability assessment and a proactive group of sysadmins and security experts protecting the network -- and you can still break in -- that's newsworthy. Good examples of truly newsworthy break-ins would be Yahoo! News Hacked, and FBI Investigating Qualcomm Hacker.
Here we have an article about yet another internal employee that was layed off and screwed around with the databases in retaliation (YAIETWLOASAWTDIR). Sure it's a problem, but it is not insurmountable. Just how common is this problem? Check out my recent blog entry, "Sacked staff turn to sabotage because they still have access."
Because places like this exsist really bothers me. RL example. I have my yahoo account for spam/ebay//. whatever. I have my sneaky RR account that never gets spam. Started building an MI home 4 months ago, on my contact info, i put down my RR account. Withing a few days, i'm slammed with refinance, mortgage, home improvment, and contractor info. A few days later, viagra and breast enhancement... A collects info, but will only sell to partner B, B gets the info, but only will sell to C,D.. Whenever someone says they will only share infomations with thier "partners" is bogus. The whole spam/marketing arena are "parters" eventually.
What a mess. I wonder what their E&O insurance is going to look like after this little nightmare?
"I'd say 'Have a good time,' but arson is still illegal.
Awhile back I requested a credit report from Equifax using their web site. I had to set up an account to access my report online. Shortly afterward, I received an automated email response from Equifax. In their reply they sent me my username and password, in an unencrypted email. Anyone who saw that email go through their server has complete access to my credit report.
I complained to Equifax, their reply came several days later and by text of the response it was clear that they didn't even read my complaint.
I sent a complaint to the BBB Online Privacy group, of which Equifax is a founding member. You know what they did? Nothing. I didn't even get a reply back.
So what have we learned? Don't trust that a company's participation in the BBBOnline program is any kind of guarantee of security. And, get your credit reports through some third party website, not from Equifax directly.
If only you could choose which credit bureau got to handle your credit info...
Steve Knoeck
knoeck@yahoo.com
It's part of the job. For example, i work for a company through which millions of pieces of confidential consumer data flow each and every day. It is my job to look at this stuff. Now the only thing preventing me from behaving immorally with respect to this information is my own personal sense of morality, and i suppose also the legal consquences of such action.
There are situations where it is not possible to do one's job without access to data. Now, i will mention that i work in a facility that deals with quite a bit of financial data, and have had to be screened for government "Secret" level classification. That being said, i didn't have to pass that until AFTER i was hired, and i'm not even sure that passing was a condition of keeping my job.
The point is, i read many posts in this thread where it is the opinion of the author that any employee of any company having access to personal data of any kind is a most grievous security breach. How do you think anyone does any work on the systems which maintain and process your data? Things like bank/credit card statements, financial/investment confirmations, bills, and a host of other things you recieve in the mail each month and probably don't give a second thought to all contain an enormous amount of personal information (which of course it has to to be able to mail it to you and print the information on the page), and that is all farmed out from the card provider or financial institution to some third party printing company for mailing. And you're worried about someone who may have legitimate access to the data?
No method is fool proof but here is what should happen.
1. No person should be known my their identity but by their card number.
That is I can only find the people groups located in the region of. There should be no way to track an individual, period.
2. No information from credit card ID's to bank ID's should be permitted in the database.
Basic principle should be is I am offering my self as an anonymous statistic period.
Lastly there should be a World Wide agreement on this issue with local laws against using companies who do not subscribe to the law. That is no collecting agent can collect in US or Canada unless they accept and are audited to have no means of data mining for Identity Theft.
It amazes me that people still think computers can be secured at all.
Computer security is exactly this: You pretend I am an idiot. I pretend I am an idiot. And we both pretend your computer is secure.
There hasn't been a system yet that hasn't been hacked. I don't mean that can't be hacked. I mean that hasn't been hacked.
If you want your data secure then turn off your computer; unplug it from the wall; burn it into a molten mess; then eradiate the remains.
Keyboards can be videotaped, networks can be sniffed, disks can be analyzed, people will be stupid, cpu-s emit RF, hell power LEDs on the front of your computer can be scanned and everything running through your box can be decoded from across the street!
Don't be amazed that the guy who has access to the disk drives, the operating console, the tape drives, and the patch panels can get at your data.
Crackers aren't cool. The cool people are the people who walk away from an open candy dish.
As a former employee at Acxiom (Conway offices), let me jump in here.
I worked as a developer on one of their primary marketing campaign management tools. As part of this, I had access to all of our particular customers (not in the company, just the customers who used our tool) data. This was absolutely nececesary for us to track down client-specific problems.
The comapny did have very good policies restricting access to data access to only those who needed it (and only the data that they needed). Keep in mind that Acxiom is one of the largest data processing centers in the world.. manay many many terrabytes of information are processed at their facilities. So it's possible for someone to get at quite a bit of data if they worked for the right company.
More than once people where fired during the two years I worked there for misuse of data. Usually, it would be people looking up data about famous people or someone that was making news for whatever reason. Curiosity and all..
The person that did the 'break in' was likely either a programmer or more likely a data auditor. The auditors are people who randomly grab information from the database and check it against other sources to verify that a 3-year old kid didn't somehow make it into the database or what not. They have access to the data, and can pull out large pieces of it without raising eye-brows. I know this was raised as a security concern at some point..
Turn s60 photos into awesome videos with mScrapbook for all S60 3rd edition phones!
Ummm, anyone else see a problem with these two statements?
Of course he had access to an FTP server that his company never bothered to ask Acxiom to change the password on once he was no longer an employee.
The guy was *not* a DBA, he was a simple user who could access data when he had a job and his access rights were not taken away as they should have been (after he was no longer an employee). This has nothing to do with your three golden rules or the general incompetence of US techs as you allude to. It was a breakdown in corporate policy, not technical skills.
Human Resource departments in many companies are notorious for not taking all of the necessary steps before and after an individual is terminated, particularly when it comes to coordinating with IT.
Just a thought (which you'll likely toss in the recycling bin in your brain anyway): You might want to be a little more sensitive to people who just might be out of a job right now here in the US too ...
as long as there are people who have access to power, (or privelages), then there will be the chance that they will abuse it, and cause havoc.
unfortunatly, the only way to stop it would be to to background checks, and keep all employees uner surveilance etc etc... it is not practical, and would not be worht the company's while.
Until more events such as this happen, companies will not invest the money needed to protect them from inside jobs.
This type of activity is innevitable.
At least if the parent poster is smart enough to use a credit card that returns some sort of reward, Discover, Amex, or a reward-paying visa/mc. I pay for everything using mine, and so effectively receive a 1% discount everywhere I shop. Over time, it really adds up. If the stores don't like it, they can refuse to honor credit cards-- I go to a couple of great restaurants that are cash only and are well worth it. If a merchant doesn't want to pay the fees, they don't have to accept credit cards.
1984 was supposed to be a warning, not an instruction manual.
Actually, for serious bombs (i.e., nuclear) the above cannot happen. Yes, the pilot can drop the bomb. It will then fall to the ground and go "BONK" since the arming codes have not been sent to the bomb.
The US military is very, very careful with nukes. A lot of thought has gone into finding ways to prevent unauthorized use of these things.
In a similar vein, there are ways to protect the data in a DB from a malicious admin. The story doesn't give enough details to know if any of them were used.
"Seven Deadly Sins? I thought it was a to-do list!"
1. A Trollbot may not be modded insigtful or, through inaction, allow another Trollbot to come to Insightful status
2. A Trollbot must obey orders given it by geeks except where such orders would conflict with the First Law
3. A Trollbot must protect its own existence as long as such protection does not conflict with the First or Second law.
Just a lazy, Karma-burnin' friday...
Acxiom employs an 11 Digit Universal Identification number for main ID in the Oracle database they employ. For the work of Database Administrators, which Acxiom understandably employs a great deal of, they have to have access to the entire database at large in order to process scripts to weed out duplicates, of which there is a great amount of. For instance, John Smith and John B. Smith, while the same person, may be recorded as two different people, so two mailings get sent out to this same address, costing a company that purchased this mailing list that could have been saved. And in terms of accounting procedures, the SQL access is logged to an extent, but with millions upon millions of transactions going on every minute, a pull of a hundred thousand records is insignificant.
The great wonders of a company based in Arkansas.
We have so much time, and so little to do - strike that! Reverse it. Tryn Mirell
While I understand what you're saying, I think credit cards have been overrated in recent years for providing "consumer protection". The credit card companies love it when people spread around the notion that "buying with cash leaves you with no recourse if the product isn't as advertised". There are plenty of laws governing these issues - and your main issue when using cash is making sure you get (and hold onto) your receipts!
You have to really read the fie print on your credit card policy too. I had a corporate American Express card one time that didn't offer the purchaser any extra recourse if he/she was sold a faulty product, or something arrived that wasn't what was ordered. It stated right in the policy that these issues were strictly between the purchaser and the merchant!
If you're serious, I hope you have a close eye on object authority and have good security settings on user accounts. Just because IBM won't talk much about what's under the hood in OS/400 doesn't mean someone hasn't figured it out.
There are plenty of laws governing these issues - and your main issue when using cash is making sure you get (and hold onto) your receipts!
Sure there are laws. But do you want to waste your time trying to get your cash back, or would you rather tell your bank/credit card company/whoever that the service/merchandise/whatever wasn't provided, have them refund you your money quickly and easily, and then let them go about squeezing blood from the stone?
Personally, I know which one I'd choose. I'll take the one that gets me my money back with a minimum of effort and time on my part, thank you very much.
It stated right in the policy that these issues were strictly between the purchaser and the merchant!
A good reason to not use American Express frankly. Because the traditional AmEx isn't a credit card. I don't recall the terminology for it, but basically AmEx doesn't give you a credit limit, percentage rate, etc. because you MUST pay the money back at the end of the cycle. The newer AmEx cards (like AmEx Blue) are traditional credit cards, but the older ones are not. As such they're not governed by the same rules that Mastercard, Visa, Discover, etc. are and don't have to offer the protections that credit cards do. Just because it's plastic doesn't mean it's a credit card. Remember that when you pull out the debit card too.
Oh, and what's the issue with the debit cards (no, you didn't ask this, but I suspect some people are)? Simple -- they're directly tied to your bank account. If a fraudulent charge is made on your card it can wipe out your entire bank account. Sure, they now have the same protections that credit cards have (as long as the Visa or MC logo is on them -- if they don't have the logo, refuse to accept one of these cards from your bank!), but there's a twist. The bank is allowed up to 30 days to investigate your dispute. If they wiped out your entire checking account, can you go 30 days without that money? What about if you had checks outstanding? Guess who's liable when those checks bounce? Not the bank. Some banks are starting to rectify this, but you're still better off using a real credit card -- as long as you pay off the balance in full every month.
was an employee with legitimate access to the information
how does this make him a hacker then?
some of the top security people are actually ex-hackers hired for their extensive knowledge of vulnerabilities and ability to ecognize potential vulnerabilities. Talk about risky hiring practices.
Oops, they were running MS. Please see netcraft.com http://uptime.netcraft.com/up/graph/?host=www.Acxi om.com
Also, please check out thier home page and view the graph that shows market share, comparing IIS and Apache, I think you will find the trend interesting.
Shaky setup? Perhaps you could ask the good people that have done it at one of the following...
cnn.com
weather.com
yahoo.com
whitehouse.gov
nasa.gov
Have to ask the question, how do you know you haven't been hacked?
...WE NEED MORE LAW.
In this case, the law should be to regulate how "consumer information" is stored, protected and regulated. The "Fair Credit Reporting Act" does many nice things for the consumer but clearly not enough with the constant threat of misuse of information.
First of all, I would like to see the use of social security numbers more tightly regulated in the form of requiring a business or individual to have a FEDERAL LICENSE to collect and use such information. We all know the SSNs are the primary key to all of the rest of the information collected on us. The law states that SSNs are only for the purpose of managing your social security account. Not for any other purpose. Law states that no other institution, private or public, can require that you disclose that information for any other purpose. That said, you can and are routinely required to disclose this information else you will be denied credit and/or many other factors of "modern life" in the USA. These abuses can be battled but I do not see a victory against this proliferous abuse.
But with more controls in place regulating the use of this information and PUNISHING those who do not handle it properly and by revoking a business license to use it and by criminally prosecuting individuals found responsible for illegally collecting this information, we can hope to contain the damage done to privacy in the U.S.
Identify fraud has been identified by various security agencies in the US as a threat to homeland security as it has been found that profits gained through "identity theft" are in fact funding terrorist organizations. Lax security does not only endanger individual credit or individual identities, but endangers the safety of the entire US public at large.
We can protect our country by requiring that those who do business by collecting our information do so in a safe way. If a data system is identified as unsafe (for example, a MS Access database) then that business function should be enjoined to halt activity until it can me migrated to a "safe" system that is deemed safe by the public agency that deems the system as being safe for holding this class of data.
This agency would be the equivalant of the FDA. Who knows what it would be called (there are a lot of creative minds out there who could create a clever acronym for a "Federal Privacy Agency"... so let's hear some ideas) but its function should be to police and regulate the use of private information. It should, however, be barred from collecting private information itself except where it is using such information as a way to conduct investigations.
Because technology has improved significantly in the past 30 years, I think new law should be in place to protect consumers from identity theft. We need regulation of WHO can legally collect information, HOW it can be used, WHO it can be sold to and how the clients can use it themselves. Within that usage criteria, how it is stored and maintained should be strictly regulated. We have laws that require food venders store and distribute food, so why not critical and vital information?
You have a new lifestyle magazine designed for the 30-40 year old programmer, making between $40k and $60k, and owning at least one ferret? Axciom will get you a list with most every one of those living in the geographical region you want.
More FUD. That's simply not true.
A modern day witchhunt.
"Transactional data permits companies to segment their customer base into best, worst, and average customers. This permits much more focused marketing expenditures. But it doesn't provide any clues as to who your customers are as individuals. How old are they? What's their income and family status? Do they own a home or autos? What are their lifestyle preferences?"
"InfoBase List--the largest collection of U.S. consumer and business data available in one source for list rental. As a comprehensive resource for marketing data, InfoBase provides accurate and effective information to better direct your marketing efforts. With access to more than 176 million consumer records and thousands of demographic, lifestyle and behavioral selectors, no other list source can match the combination of accuracy and coverage of InfoBase data..."
I have been working for a comapny that does the wage calculations for empoyees in companies like BASF and Siemens... I had, as a UNIX admin/Oracle DBA, rights to search every paycheck in the databases.
It's normal that some people have access to those kind of things.I think it's all a matter of ethics.
My manager would look up people who earned thousands of euro's a month. I didn't care.
People who have access to such information should have ethics and companies handling information that is so sensitive should select their administrators very carefully.
The fact that this person did make abuse of his/her rights to that information is a big mistake, made by that company in my opinion.
42 + 1 = 42
What did he do with the data, and what banks have had their data compromised at this point. I'd like to know if my data has the possibility of being one of the ones he had access to.
THE ADMINISTRATOR DOES NOT EVER, FOR ANY REASON, TOUCH THE DATA.
Sheesh. Now I know why I can't get a job, and companies who are laying you people off are checking out India and Russia.
Since you're such an expert, please justify the first statement. I say it's BS. (Hoping that the AC will come back and actually read replies...)
We have more to fear from the bungling of the incompetent than from the machinations of the wicked.
Connecting to a really obvious hostname at acxiom.com reports this:
220 millennium Microsoft FTP Service (Version 4.0).
How 'bout them apples, mister MCSE?
"...It amazes me ...such a company would have such lax security as to allow an insider to browse..."
Are you kidding me???
> Saddly, our government doesn't seem to be too... enthusiastic about stopping this type of stuff. Don't get me wrong, I'm a libertarian at heart, I think the government should stay out until absolutely necessary, but this is a case where it's gone too far. I don't trust the consumer enough to protect his own rights.
Yep, that's the question.
Once the government is out of the way, who will protect you from the corporations?
...the company is taking no responsibility for the break in other than reporting it to the clients, who then may or may not inform their customers.
Good thing I have theft/fraud protection on all my CCs. Here's to everyone who said I'd never need it. *clink*
If you disagree with the parent post, you're wrong. Completely and utterly wrong. That is all. YHBT. YHL. HAND.