Slashdot Mirror
AT&T Breached, Exposes 19,000 Identities
mytrip writes to tell us News.com is reporting that a recent attack on AT&T's systems saw thousands of customers' personal data compromised. About 19,000 customers of AT&T's online store who purchased equipment for a DSL connection were affected. From the article: "AT&T is offering to pay for credit monitoring services for customers whose accounts have been impacted because they could be at risk of identity fraud. The company also has made available a toll-free number to affected customers to call for more information."
Should be "were affected." Or is it "we're affected"? I can never remember.
...for using AT&T.
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
They will pay for credit monitoring services, but will they pay for all the liability from a stolen ID? That can reach into the hundreds of thousands of dollars in real damage.
I choose to be an Anonymous Coward.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
In other news:
"AT&T infects 19'000 of their customers with AIDS, after a 'breach' of their 'security' yesterday.
AT&T is offering to pay for free condoms for all affected customers."
Were you potentially a victim of this crime? You seem to be taking it fairly personally - as evidenced by your rater exagerated counterpoints. I for one am willing to give AT&T credit for at least offering to help in some way - most of the times I've read about this happening the company involved didn't offer to pay for anything.
Affected is preferred.
Effected suggests being brought into being. A database security breach that effects 19000 new customers would not only bring the wrath of the accountants at the Security and Exchange Commission, but also suggests a militant AI broken loose in ATT!
In response to the A/C that suggested we're; you can remember that a comma suggests a contraction of we are.
God is an Iron; Engish was my most hated and worst subject. I leave a glass of Wry for my fellows, but I had to learn this grammer stuff in self-defence. Which I shall maintain in a Court of Law.
Oh, Strunk and White, "the Elements of Style" is a fast way to invigorate your writings. Well worth getting.
This is progress?
Or... did they do that, but the crackers were able to pierce the firewall?
"I don't know, therefore Aliens" Wafflebox1
Steal someone's identity.
Warhammer forums
I'm not saying AT&T is "the best of us," but your proposed remedies are fucking childish. Do you also support capital punishment for late pizza delivery?
And now, a PSA from David Lynch.
You're welcome.
These companies need to stop collecting this information in the first place. There is no need for AT&T to have this at all to do their business. Last I checked they aren't the Social Security department.
The news here isn't that some incompetent set up their systems, nor that they were cracked. The news is that they've responded openly and meaningfully, without trying to deny it or play down the scale of what happened. I wouldn't be hurrying to sign up to their service because of it, but it certainly doesn't bias me against them. Honesty and integrity are rare enough qualities in corporations that we should applaud them when they claw their way past the lawyers and PR weasels.
If you were blocking sigs, you wouldn't have to read this.
Any Slashdot post that begins with "bloodfarts" is worth reading. Wish I had mod points.
And now, a PSA from David Lynch.
. . . AOL is off the hook.
If this were really happening, what would you think?
How can anyone steal someone else's identity? Oh, you mean they stole people's social security numbers. That should not be a problem, because as we all know, ss numbers are not meant to be used for identification.
The real problem is companies and the govt using SS# for identification. At this point, about 50 ppl know my SS# - the librarian, the assistant at my school, the clerk in the bank, etc, etc. - so any of these people can harm if they don't like me for some reason? This is stupid.
So what next? Some company decides they are going to use FIRSTNAME_LASTNAME as the id and we are all supposed to keep our names a secret? And run around complaining when our 'identity' (FIRSTNAME_LASTNAME) is stolen?
In many countries, you need a notarised signature to obtain loans, etc. While not foolproof, you can always prove it was not you and it takes more effort to commit fraud.
About 19,000 customers of AT&T's online store who purchased equipment for a DSL connection were effected.
That's *affected*. Sorry, pet peeve.I wouldn't even be so sure of that. Nowadays whenever I see any corporation saying they take responsibility for something, I immediately suspect another yesmen prank.
Now that may not be very likely, but if I were the yesmen, I'd be perched and waiting for another ID theft scandal, because nothing would be more meta than stealing the ID of a PR person handling an ID theft incident.
Someone had to do it.
"The company also has made available a toll-free number to affected customers to call for more information."
AT&T: Thank you for calling AT&T, how may I help you?
Me: Yes, I'm calling because I have learned through the news that my personal information may have been stolen.
AT&T: Did you have a DSL account with us?
Me: DSL?
AT&T: Yes, sir, high speed internet? This affects DSL customers.
Me: I thought this was for phone calls. You mean the NSA stole my internet data too? Those bastards!
*click*
Me: Oh wait, I have Vonage, the phone is just an old one branded from AT&T... hehe, my bad. Hello? Hello?
I8-D
You should not be able to do so much damage with a simple number and some extra data. It is ridiculous that armed with merely this amount of information one could cause so much damage. The system needs to be completely reworked.
Why am I starting to think that companies feel O.K. with these security breaches?
Maybe it has come to a point where it's cheaper for them to issue free credit monitoring than to enhance their security.
I am sorry but they should be held way more liable than a simple credit monitoring 'consolation' prize.
It affects about 19,000 customers "who purchased DSL equipment through the company's online Web store." The attack occurred during the weekend, and included access to credit card information. AT&T is notifying affected customers and "quicly notified the major credit card companies."
Their mobile phone division is especially vile, in my experience. http://home.comcast.net/~plutarch/malfy.html
That should be "affected", not "effected". There's a difference.
So someone hacks a server and 19,000 new customers are created as a result? HOLY CRAP! YOUR RETARDED!
-=Zeus=And=Hades=-
Maybe it was the NSA.
"We are all geniuses when we dream"
- E.M. Cioran
I know you mean this as a joke, so this isn't directed at the poster really. Still I have to worry that some people might actually believe what you just wrote there. The only thing on a SS-card or a credit card might be the artwork, everything else has no copyright.
And the fact that these people had their ID stolen is extremely sad. Everytime I get an ad in the mail from my bank wanting me to buy id-theift protection I want to call them and ask about racketeering... Have these people zero liability when they lose my data? How can that be so? It makes no sesne. If the RIAA sues me for pirating music yet I cannot expect compensation from AT&T or Citibank or whoever lost my info yet again and thus resulted in my identity being stolen.
What we need is a universal ID, not one that olds my bio-data and crap that can only hurt me, but a public/private encryption key pair which can be used to encrypt transations and force the company to store my data in a personal encryption locker. One that can be used to lock my vote in and prevent alteration by Diebold or whatever moster that comes next. One that is for the people by the people (aka open source) and scrutable by others for security problems.
Pete/Petri "damn, my chainsaw is clogged with 1's and 0's again." --clyde
With the stupid ads that the cable companies has been running lately, I'm wondering if they hired someone to do this.
The credit card information for purchases is not supposed to be stored according to what I have been told. That is why I never ever let companies have access to my bank account or credit cards for recurring charges. I pay recurring charges electroncically from the bank. I think that letting companies take money automatically from one's own account is rather risky since the companies would need to store that info. These breaches certainly don't allay that fear. It is true, the bank's security could be breached as well, but at least there is only one place from where information can be taken rather than 10's of places.
Is the fact that AT&T, who spends more on network security than the gross national income for a lot of countries was compromised, and confidential information was stolen. It doesn't matter how their multi layered defenses got breached, what does matter is they did get breached. The lesson here is IF they can be breached who can't??
IF you can't be famous be infamous. But for GODS sake be something
Corporations should not be allowed to store personal info longer than the duration of the transaction, or transmit it outside the scope of the transaction. AT&T should be prosecuted for liability, including lifetime exposure to ID fraud. AT&T security and policy managers and directors should hold personal liability, piercing the corporate liability veil.
Then we'd see American corporations rush to rewire their databases to protect customers, instead of protecting their advantages in charging and marketing to us, and the risk that their few bucks benefit will destroy our lives.
--
make install -not war
Anyone on /. know the details of this?
Was this an injection attack? Application server vulnerability? Secret page? Worm? Some of us would like to know how this happened, and none of the news stories are blabbing.
I'm one of the folks whose information was stolen. I discovered this not by AT&T informing me, but by the phishing attempt I received via email. The email claimed they couldn't access my bank account to pay for my order, and directed me to what appeared to be the ordering site. Since they had the actual order number, I didn't think anything was amiss (other than another company screw up asking me to pay for an order I'd already paid for), and clicked the link.
I was surprised to be prompted to enter my birthdate and SSN. Which, of course, I did not do. It was also suspicious that all the images were not loading. That's when I noticed the link I'd clicked was not sbcdslstore.com, but sbcdslstore.org. They'd set up a phishing site, linking back to the images on the real sbcdslstore site. (SBC became AT&T, and the company was still using the old site I'd imagine.) At least by shutting down their site, AT&T made the phishing attempt much more obvious.
The ironic thing for me is that I'm not even an AT&T customer. A friend of mine who does use their DSL service moved recently, and lost the AC/DC adapter for their DSL model somehow in the move. Since they didn't have internet, I was nice and ordered a replacement adapter for them. Another good deed punished. Oh well, I was thinking of changing banks anyway.
I think you'll understand why I'm posting anonymous.
*whoosh*
Hey, what's that flying over your head?
"effect", transitive verb: to bring about, accomplish, cause to happen.
"impact", transitive verb: to crush, collide with.
"affect", transitive verb: to act upon, bring about a change in.
Which verb should be used in the two examples above?
After the customers got affected then only they offer the monitoring service. So shocking they should add the feature long time ago..
torrent?
there's fire.
This is small time compared to the egregious breach of privacy experienced by nearly everyone with AT&T's complicity with the NSA's illegal splitting operations in San Francisco and elsewhere. AT&T is at it again time for more anti-trust remedies.
if I claimed I was emperor just because some watery tart lobbed a scimitar at me they'd put me away!
why wasn't the data encrypted
You will never get to heaven with an Ak 47... But A Zu 30 is good for Low Flying Cherubim
Hell, they probably could have just *asked* for the information and AT&T would have handed it over...
There's no place I can be, since I found Serenity.
At this rate we should just go ahead and release EVERYBODY's indentities.
Any more technical info on just how exactly they broke in?
Seriously, that is disgusting. The article is completely unrelated to filesharing, and focusses on poor security. It also overlooks that the "information wants to be free" zealot crowd aren't necessarily the same as those in the information-security crowd. Either crowd also tends to be happy when somebody is nailed for trying to sell copied articles.
Copyright won't protect your personal information in any way. So perhaps you should go troll an RIAA article now. Perhaps if there's an article about how a filesharer with 1000 copyrighted songs had his personal info distributed by a p2p virus you can happily troll away. In the meanwhile, I think your name of "BS artist" pretty much fits.
Not all information wants to be free. Wanting to have free (as in choice) software is different from wanting my personal credit info out in the wild, or having a glass-toilet in a glass-bathroom.
Sorry, but these companies need online presence to offer the services they do. This implies a measured security risk, at which point your points of failure include:
Employees (or ex employees)
The software (and/or software creator)
The operating system (and/or OS creator)
and millions of points in-between. People want the convenience of credit cards and online access, unfortunately there is no foolproof security for this. For ever better vault, a better thief will emerge.
No!!!
1. MD5 is weak/broken. No MD5. Erase it from your vocabulary. Replace it with SHA-256 or better.
2. How many SSNs are there? At max, 1 billion (assuming they go 000-00-0000 to 999-99-9999). A reverse lookup directory of 1 billion 256-bit hashes would take around 36 gigabytes of disk space (if my math is correct).
3. If you add salt to it, then the salt becomes a secret key to the routine. Lose that key, and someone can re-create the lookup in a matter of hours (minutes?).
Really, you want to just create a unique identifier that doesn't mean anything else. SSN should be in a secured table somewhere ELSE that you'd join to if you needed it. Even better, SSN should be reserved for government use ONLY, but that's anotehr story.
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
This email contains important information that requires your immediate
attention. Please do not reply to this e-mail; instead please use the
telephone number provided below if you wish to contact us.
You previously placed an order with AT&T for DSL-related equipment
through the http://www.sbcdslstore.com/ Website, at which time you
provided certain information including your name, address, e-mail
address, phone number, credit card number and credit card expiration.
(This information did not include your Social Security Number, Driver's
License Number, date of birth, or other identifying information.) AT&T
has learned that a computer containing the information you provided has
been accessed by an unauthorized person, who may have obtained this
information about you.
In addition, AT&T also believes that some customers who purchased
DSL-related equipment from us through this same website may be receiving
e-mails that appear to be from AT&T, but actually are being generated by
an unauthorized third-party (a practice known as "phishing"). These
e-mails refer to your prior order with AT&T and request that you
provide additional personal information such as your Social Security
Number, date of birth, or another credit card number and expiration date.
Please be advised that these e-mails are not being sent by AT&T and are not
legitimate. Do not respond to these e-mails or otherwise provide any of your
personal information in response or at any Website to which the e-mail may
refer you.
We sincerely regret that a third party was able to gain improper access
to your order information and we are working diligently with law enforcement
and major credit card companies to limit your potential exposure. Although
your 3-digit credit card verification number (from the back of your card)
was not stored, and therefore not accessed, we strongly suggest that you
contact your credit card company directly to report this suspected incident
and to protect the credit card you used to purchase this equipment from any
unauthorized activity.
In addition, we suggest that you contact the fraud departments of any one of
the three major credit-reporting agencies and let them know you may be a
potential victim of identity theft. That agency will notify the other two.
Through that process, a "fraud alert" will automatically be placed in each
of your three credit reports to notify creditors not to issue new credit in
your name without gaining your permission. For your convenience, we have
included contact information for all three credit reporting agencies:
Equifax
P.O. Box 740241
Atlanta GA 30374
To report fraud: 1-888-766-0008
Website: http://www.equifax.com/
Experian
P.O. Box 2002
Allen, TX 75013
To Report Fraud: 1-888-397-3742
Website: http://www.experian.com/
TransUnion
Post Office Box 6790
Fullerton, CA 92834
To Report Fraud: 1-800-680-7289
Website: http://www.transunion.com/
Lastly, to provide further security, AT&T is arranging to provide you the
option of enrolling for one year, at no cost to you, in a credit monitoring
service specifically designed to notify you of changes to your credit report
activity in order to detect fraudulent bank or credit card use. The service
will be provided by one of the major credit reporting agencies. We will
provide specific information on this option as part of a letter you will
receive via U.S. Mail in the next few days.
Again, we regret this unauthorized and unlawful access to your order
information and are working with law enforcement to pursue those who
are responsible. We are also reviewing applicable security procedures
in an effort to prevent an incident like this from recurring. Should yo
AT&T Call Center Operator: Sir, may I ask you why you're choosing to cancel your service with us today?
Me: Well, let's see, first there was that whole Internet tapping thing.
AT&T: I'm not sure which Internet tapping situation you're referring to...
Me: GOOD GOD, THERE'S MORE THAN ONE?! Hold on, let me pull up my blog!
AT&T: No, sir, I meant I'm not personally aware of any Internet tapping. I assure you that AT&T values your privacy...
Me: And then you cooperated with the NSA in their illegal domestic spying project.
AT&T: While I can't offer any comments on that, I'd just like to state that your privacy is our first concern...
Me: Then you wouldn't mind explaning how just last weekend, you let slip the personal information of over 19,000 customers?
AT&T: Sir, I assure that incidents like this are very...
Me: STRIKE THREE, YOU'RE OUT! *click*
a direct copy-and-paste quote from an earlier post made by the person I replied to
An early post not related to the article-at-hand.
Aside from that, you're talking about the 'rights of others' in reference to corporate ip holders, which insinuates that corporations are entitled to the same rights as private individuals.
But if you want to go back over old different-topic comments made... perhaps I can browse all recent flameish and offtopic moderations you've accumulated recently:
Offtopic
Flamebait
Flamebait
Offtopic
Sometime's a troll is just somebody who's natural inclination is to take an adversarial view or approach. That approach might be their opinion proper, because said person has a combative personality. Personally, if you're going to attack somebody on past comments in other subjects, perhaps you'd be better to send him/her an email rather than wasting our time.
Why did I have to read Slashdot postings to get the number, I'll never know. What ever happened to good journalism?