Data Theft Notifications - How Soon is Too Soon?

Do more by omeomi · 2006-09-22 15:45 · Score: 3, Insightful

They should do more to keep it from happening in the first place. Seriously, there's a new breach at some major corporation or government office every other week or so. It's ridiculous.

--
ZuluPad, the wiki notepad on crack

Re:Do more by bky1701 · 2006-09-22 15:47 · Score: 2, Funny

Damn software pirates stealing data!!!!1!111!11one

--
Great Intellect...
Re:Do more by AusIV · 2006-09-22 16:24 · Score: 3, Insightful

That's easy to say, but it's really not so simple. Some data leaks happen because of software issues. More likely an employee figured they could make a buck selling data. Hiring more trustworthy employees requires paying more money, and that has to get passed on to the customers, who in turn take their business somewhere cheaper and less trustworthy. Customers want security, but they're not willing to pay a little extra for it.
Re:Do more by omeomi · 2006-09-22 16:39 · Score: 3, Insightful

Hiring more trustworthy employees requires paying more money, and that has to get passed on to the customers, who in turn take their business somewhere cheaper and less trustworthy

For companies and agencies that have to have highly sensitive information like SSN's on file, there should be an exceptionally small number of people who have access to that information. A small enough number that I can count them on one hand. And none of those people should ever be allowed to take any portion of that list out of the system in any way, not on a thumb drive, not on a laptop, nothing. The vast majority of the employees should only be able to access the last 4 numbers of any given person for varification purposes.

--
ZuluPad, the wiki notepad on crack
Re:Do more by sumdumass · 2006-09-22 17:57 · Score: 1

I had a two simular email address that I used only for two seperate things. Everything was fine and dandy untill they started being flooded with spam.

Turns out someone misconfigured a mailserver and someone was able to havest the email acounts for all the domains configured on the server. The other problem was traced to some bullshit E-Greeting card that my girlfriend devided to open when she checked her mail. Several weeks after the problem started on that address, the same E-card she sent me was implicated in some spyware-trojan thing were it scanned your hardrive and collected all the email addresses it could find when you clicked on a licanse that allowed you to view it.

Two seperate incedents, two seperate times on two seperate computers. There could be a number of reasons spamers have your supper secrete email adresses besides the company you use them at having a breach. It could be that a breach never happened at that company and the fault could be yours, your providers, a repair shop's, your wife/girlfriend/reletive/brother's-uncle's-sister in law's-dog. So, do we know there was even a breach to report? Obviously if the answer is yes, they
should disclose it as soon as it is secured in that it won't happen again. But if the breach consists of someone going to a public accesable terminal and havesting all the E/web-mail addresses entered from the internet cache, who is supposed to report it? I suppose they could even get the passwords and use that to harvest email addresses from the email servers hosting the domain.
Re:Do more by Asic+Eng · 2006-09-22 20:01 · Score: 1

Customers are not willing to pay more on the mere chance that the data is more secure. This is a great example of a market not delivering what customers want, because finding out whether one company is better at providing the service than the other, is close to impossible. (I'm joking of course, the market is the only perfect thing in the known universe.)
Re:Do more by houghi · 2006-09-22 21:06 · Score: 3, Insightful

For companies and agencies that have to have highly sensitive information like SSN's on file

First start with the fact wether or not the company needs the SSN or not. When in doubt, the answer is no.
employees should only be able to access the last 4 numbers of any given person for varification purposes.

It is a Social Security Number, not a Person Verification Number. If you use it for anything else then for Social Security reasons, you do not need to get it in the first place.
The best way not to loose the data or be tempted to sell it is not to have it.

--
Don't fight for your country, if your country does not fight for you.
Re:Do more by aussie_a · 2006-09-22 22:56 · Score: 1

That's funny. I know plenty of people who buy doors with better locks then cheaper doors. Guess they're just fictional people though?
Re:Do more by lrichardson · 2006-09-23 00:01 · Score: 1

First start with the fact wether or not the company needs the SSN or not. When in doubt, the answer is no.
In this day and age, the answer is Yes. Names change - people get married, divorced, decide to use Chuck or Charly instead of Charles. People move. Matching things up on these two - name and address - works 99.9% of the time (with a little effort) - but isn't absolute. SSN (and SIN for those in the Maple Leaf state) allows a match for that final 0.1% percent. (Yes, SSN change occasionally too, but so far it hasn't been for one of the 0.1%, in my experience)
The best way not to loose the data or be tempted to sell it is not to have it.
Amen. Put together what is rapidly becoming a very popular database at the company, and simply did not include SSN (nor name, address) - these aren't necessary for most people's jobs. That said, there is another alternative - complete data encryption. My corp uses PointSec - people lose (or have stolen) laptops on a regular basis. We're not worried about that anymore.
Re:Do more by bendodge · 2006-09-23 00:53 · Score: 0

By law, the government and your employer are the only people you must give your SSN. A lot of places require businesses to provide services without you giving them an SSN. Try it next time you sign up for a bank account.

--
The government can't save you.
Re:Do more by canuck57 · 2006-09-23 02:13 · Score: 1

That's easy to say, but it's really not so simple. Some data leaks happen because of software issues.
It is actually simple, it is about priorities. Business says "Gotta have that (insecure unstable) app at all costs". Security says "It is a big risk". Management derates security over a vendor lunch until a breach occurs. Senior management does a knee jerk. Repeat until lesson learned or out of business.
Hiring more trustworthy employees requires paying more money
Very true, yet you get a drug test but how many firms do a background or credit check on everyone who comes in contact with the data? Are your contractors liable?
...and that has to get passed on to the customers...
This is a myth, although could become true if "Security" drives the business. Security needs to be part of the business model, not the business itself.
Secure systems tend to be more reliable, more stable with higher levels of service up time. They tend to require LESS maintenace and thus less people to run them. Less people is less risk. Would you rather have 100 UNIX servers and 10 poor admins with certs, or 100 UNIX servers and 3 seasoned and skilled admins? Efficiencies come from the fact that more secure environemnts spend far less time reacting and much more time securing and evolving.
Re:Do more by The+Snowman · 2006-09-23 02:35 · Score: 2, Informative

Try it next time you sign up for a bank account.

Your bank reports capital gains on your accounts to the IRS. They need your SSN. If you don't give it to them, they probably won't give you an account.

--
24 beers in a case, 24 hours in a day. Coincidence? I think not!
Re:Do more by The+Snowman · 2006-09-23 02:38 · Score: 2, Interesting

Very true, yet you get a drug test but how many firms do a background or credit check on everyone who comes in contact with the data? Are your contractors liable?

Employees and contractors coming in contact with money, financial data (of which SSN is one piece), and any other customer data should be bonded. That is not a perfect solution, but a good first step. Try working in a bank branch without being bonded -- probably not going to happen. Banks know there's a lot at risk (and the government probably requires it anyway), and they want the employees to be accountable for their actions.

--
24 beers in a case, 24 hours in a day. Coincidence? I think not!
Re:Do more by AusIV · 2006-09-23 04:03 · Score: 1

When you buy a door with better locks, you can see out right that you're getting better security. If it costs a little bit more to do business with a company, but the extra security is not obvious, customers will go somewhere else that charges less. If someone does a lot of research to find out that a company has a much beter track record than a cheaper competitor, they might go to the more expensive company, but this is probably a small enough percentage of people that businesses can't depend on them to make up a customer base.
Re:Do more by bendodge · 2006-09-23 04:48 · Score: 0

No, your employer is supposed to report that to the IRS. (Unless you work for the bank.)

--
The government can't save you.
Re:Do more by arekq · 2006-09-23 06:17 · Score: 1

Are you sure?
For many people, their employer is not their only source of income.
What about interest on bank accounts, mutual funds, stock...?
Re:Do more by sgt_doom · 2006-09-23 06:56 · Score: 1

Hmmmm...Commerce "loses" over 1,100 laptops -- about the same number of laptops required for a coordinated national elections rigging.

Hmmmmm....
Re:Do more by ultranova · 2006-09-23 09:39 · Score: 1

And none of those people should ever be allowed to take any portion of that list out of the system in any way, not on a thumb drive, not on a laptop, nothing.

And who's going to enforce this rule ?

It is impossible to design a system that is immune to corruption, especially if the designers/maintainers themselves could possibly be prone to it. The only solution is to pay enough money to your employees that they don't want to risk their job, and treat them well enough that they don't want to screw you - and that means no firing anyone to drive up stock price, since that makes people wonder if they're going to be next and need to prepare themselves a nice severance package / revenge.

I repeat, restate and reiterate: there is always someone who can both betray you and not get caught. Now matter how draconian security measures you come up with, you will always face the same problem: who will guard the guards ?

--
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Re:Do more by omeomi · 2006-09-23 09:59 · Score: 1

And who's going to enforce this rule ?

I never said it should be a rule/law or anything like that. However, I think it's a policy that corporations / gov't agencies / universities should get through their thick skulls, and the only way that's going to happen is if the consumer gets fed up enough to do something about it. Losing customer's private information is not acceptable. Ever. When I was in college, I had to argue with one of my teachers to keep her from posting my SSN on the wall in the hallway with my grades. I could care less if my grade was posted, but having my SSN on the wall was completely unacceptable. I asked her repeatedly to stop doing it, but didn't get any result until I went to the dean.

--
ZuluPad, the wiki notepad on crack
Re:Do more by ultranova · 2006-09-23 23:51 · Score: 1

I never said it should be a rule/law or anything like that. However, I think it's a policy that corporations / gov't agencies / universities should get through their thick skulls, and the only way that's going to happen is if the consumer gets fed up enough to do something about it.

You missed my point. If there's a corporate policy that only select few may access the data, then there must be someone who enforces this policy and keeps everyone not authorized to access the data from accessing it. Who guards that guy and keeps him honest ?

--
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Re:Do more by Flendon · 2006-09-24 04:21 · Score: 1

No, your employer is supposed to report that to the IRS. (Unless you work for the bank.)

They said capital gains tax, not income tax. Your bank, mortgage broker, etc would be much more likely to know about your capital gains than your employer.

--
chown -R us ./base
Re:Do more by it074813 · 2006-09-27 20:02 · Score: 1

The main concern of any company that suffer from a security breach is to identify the source of the breach and determine whether it is an internal or external problem, according to KPMG's 2001 global e-fraud survey. The Urgency to resolve the problem the internal system administrators and IT personnel will often compromise the integrity of the data, thus causing the evidence of the breach to be corrupted. As a result, the likelihood of the company to be in a position to recover assets or take corrective actions will be more difficult or impossible,the report says. Alex Plavsic, fraud investigations partner at KPMG, advised that companies should work with a professional computer forensic team. ONE WAY TO DO MORE !!

Safe/sorry by sporkme · 2006-09-22 15:52 · Score: 4, Informative

Lock it down. Cancel the email account and have any attached credit cards cancelled/changed. Change your checking account number. Keep thorough records and dig to find recent bank statements, etc. This can be a huge hassle.

File complaints with the federal and your state Attorney Generals against the trading company immediately. Consider a 6-month paid monitoring service from a major credit reporting bureau. Both the feds and your state will have advisory hotlines. IANAL and slashdot is not the place you want to go for this kind of information. Basically, don't fsck around if you think anything has been compromised.

I've been there, and these steps cost me a few dollars but saved me tens of thousands. Overseas types are pretty damned creative with your numbers. paranoid != not out to get you.

--
FairTax baby!

Re:Safe/sorry by petes_PoV · 2006-09-22 19:02 · Score: 1

Overseas types are pretty damned creative with your numbers
So what are you saying? American fraudsters are dumb?
Maybe someone should start a campaign to get them up to the same level of skill as those from other countries. Or is this more of a reflection of the level of education.
Anyone going to start offering college courses in electronic fraud. If you do, don't accept any form of payment except cash.

--
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Re:Safe/sorry by flying_monkies · 2006-09-22 19:02 · Score: 1

Consider a 6-month paid monitoring service from a major credit reporting bureau.

With how often it's happening, it may already be paid for for him.

--
I disagree with what you say, but I'll defend your right to say it to the death - Voltaire
Re:Safe/sorry by sporkme · 2006-09-22 19:32 · Score: 1

No, genius, US Attorney Generals do not exactly have jurisdiction over the overseas types --hence the emphasis. Please, don't anyone train US resident scammers! What are you arguing here? Just felt like posting? Did I somehow indicate that I am prejudiced against US Citizen scammers vs. foreign ones? Are you standing up for some group, whose rights I have trampled? I mean, really... bouncing off the walls.

--
FairTax baby!
Re:Safe/sorry by TheOtherChimeraTwin · 2006-09-22 19:33 · Score: 1

Oh, and don't forget to change your SSN as well. And just to be safe, have that tattoo altered. Pick something else obvious for your dog's name. And for God's sake, change your luggage combination!
Re:Safe/sorry by Electronik · 2006-09-22 23:11 · Score: 1

I think what petes_PoV was picking up on is just the fact that 'overseas types' is such a crass and outdated notion and turn of phrase. For a start, the internet is an international audience, so using this term is very US-centric and out of place. It is also a really easy way to offend all of us 'overseas types'. It's like me saying "those USA types are really dodgy characters" - IOW it's a sweeping generalisation with no basis in fact.

Is Canada overseas? How about Mexico? Columbia? It's a fairly big continent!

Finally, the notion that all the scammers are 'overseas' and that the US is a haven of law abiding citizens is also quite incorrect.

Less 'them-and-us' please :-)

--
-=test-sig_0.1.5(NoWhitespaceVersion)=-
Re:Safe/sorry by nexu56 · 2006-09-23 00:07 · Score: 1

bugfix: paranoid != out to get you
Re:Safe/sorry by Anonymous Coward · 2006-09-23 02:07 · Score: 0

Lock it down.http://www.ftc.gov/bcp/conline/pubs/credit/id theft.htm#Identity
Aside from whatever good info is in that link, check with your own state to see what disclosure requirements there may be. California has some pretty stiff requirements. Other states will likely vary from that.
Re:Safe/sorry by Alchemar · 2006-09-23 05:08 · Score: 1

A lot of people think this is extremem, but they just don't understand that once someone has established your SSN, there is nothing you can do that works. You can get letters to show people that run a credit check, but it will not come off your record for 7 years, and most people that are running a credit check won't give you the chance to explain. This includes housing, employers, and your car insurance. If you can get by without those, you probably don't need to worry about ID theft anyway.
I went to rent my first apartment, and they said I couldn't because of my outstanding loans. I had turned 18 that week. It was obvious that ther was no way for me to have accumulated and defaulted on loans 5 years prior, but that is what the paper said, so that is what happened.
You can not get a new SSN. The social security department does not support using your SSN for credit checks, and so does not see that it is a problem. I have heard several people that worked for the social security department say that the best bet is to move out of the country and start over. At least then you have a blank credit history instead of a negative one. Creditors will most likely not help you, because if the agree that it is fraud, they have to swallow the loss. At the very least monitor everything, and be ready to cancel all cards, pins, and have all your creditors numbers on hand to call and tell them not to add anything to the account unless it is in person. They will usually do everything to prevent fraudulent charges, it is after they are charged that they have an interest in not helping.

It's already too late by Jack+Pallance · 2006-09-22 15:53 · Score: 1, Interesting

It turns out there is an 'ongoing investigation,' which includes 'outside agencies,'

Kudos to you! I'm surprised that you have gotten as much information from them as you have. When a breach occurs, a company's first response is always to circle the wagons and cover up the mishap a soon as possible. This means keeping the bad press from anyone that doesn't already know, especially including the people in their customer service department who could let a thing like this slip.

But in answer to your question about how soon should people be notified, it's kind of a funny question. Your personal information has probably been aquired by four or more fraudsers already. So it's like asking, "How soon would you like to know that your phone number has been published in the phone book?" Or "How soon would you like to know that anyone can get your house number by walking down your street and looking at the mailboxes?" How soon would you like to know that your personal information has gotten out? It's already out there. Your social name, address, birth date, driver's license number, social security number, etcetera, have already been gotten by the criminals. If they didn't steal it, they probably just bought it from the credit bearueas.

Or Credit Card Company.

Or magazine publisher.

Or your state's Department of Transportation...

http://www.cioinsight.com/article2/0,1540,201239 8,00.asp

Well... what would you do? by Anonymous Coward · 2006-09-22 15:54 · Score: 0

You just realized that you made a programming mistake that could cost your company millions. How soon would you tell them? How long would you scramble in the hopes that you could possibly fix it and cover your error?

Hours?

Days? (no one's said anything yet).

Weeks? (I think I fixed it!).

Months? (Oh shit!)

Plug the hole first by ShaunC · 2006-09-22 15:55 · Score: 3, Interesting

Should they wait until they have all the details and have plugged the breach, or should they let customers know that there is a possible problem as soon as they recognize it?

If there's actually a security situation, I'd rather they plug the hole first prior to making an announcement.

As soon as it becomes public knowledge that they've got a vulnerability somewhere, the number of people poking around their interface attempting to stumble upon that hole (or other ones) will skyrocket. Better to fix known problems before they essentially invite the community to look for chinks in their armor. That said, as soon as any known holes are patched, they should inform the affected users; or, if they can't determine whose information was nabbed, they should alert all of their customers.

Keep in mind that no matter how suspicious the circumstances, unless you use that email address solely for your brokerage account, there's really no way to prove a connection unless the company admits it. A friend of mine started playing online poker, used his email address to sign up for the site, and doesn't get any poker spam. A week or so later, his wife started getting a ton of poker-related spam at her email address. It's just a coincidence, though it's about impossible to convince her of that.

I've seen a huge uptick in stock spam lately, across the board (I have a number of email accounts and only one of them is tied to a brokerage). Maybe you're just on the same spam lists :)

--
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!

Re:Plug the hole first by pthisis · 2006-09-23 06:47 · Score: 1

They should disclose immediately. There are clear steps you can take for your own protection (cancel online access if possible, close accounts, etc). The longer they wait before disclosing, the more vulnerable you are.

The argument that they need time to fix the system before disclosing is a common one from places that don't care about security; they hate full-disclosure lists, favor only vendor disclosure, etc. And the "we need time to fix it" argument is a core part of their anti-security stance; it ignores the fact that even if the particular bug isn't fixed, there are almost always steps you can take to mitigate your risk. It also gives them less incentive to fix things quickly since the problem is public.

--
rage, rage against the dying of the light

D'oh! by ShaunC · 2006-09-22 15:58 · Score: 1

I missed the part about "dedicated to my online trading account account." It sounds like there's definitely been a breach, but my opinion of when customers should be notified remains the same.

--
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!

Ameritrade? by Anonymous Coward · 2006-09-22 15:58 · Score: 0

I've been receiving spam to an email account I used only with Ameritrade.

Re:Ameritrade? by Anonymous Coward · 2006-09-23 06:25 · Score: 0

I believe we are. I realized that the address I'd given them, exclusively, was the 'to' address on a SPAM message last week. I wrote to them asking for more information, but haven't received anything but a programmatic acknowledgement of their receipt of my request, so far.

Not a lot of SPAM gets past my ISPs filter, and most of what I do get is caught by Thunderbird. So I was surprised to see this one, not just because of the address it was sent to but that it also got past two layers of SPAM filtration.

This isn't an isolated incident. I do wish Ameritrade would respond.
Re:Ameritrade? by Paradoks · 2006-09-23 09:56 · Score: 1

I had the same problem with Ameritrade, asked them about it, and got this response:

Please know that even though you provided your e-mail address only to Ameritrade, it does still sit on a server that other people can see and may gain access to. If you receive an e-mail from one of the following addresses, it is ours: ...
In the case you are speaking of, we have not yet been able to rid ourselves of the spam. The issue is still being worked on.
I also had the same problem with match.com(as has my brother, who lives several states away), and they sent me a nice form letter blaming me--err, reminding me that if I give my e-mail address to other websites, the e-mail address will be out there.

Full security is difficult. However, owning up to mistakes when caught(and trying to fix them) shouldn't be.

How stupid is E*Trade? by Jah-Wren+Ryel · 2006-09-22 15:58 · Score: 5, Interesting

Here's my story, it meanders off-topic but I think it is worth posting as an example of another kind of data breach, one caused by corporate greed:

Like the article-poster I'm one of those guys who uses individualized addresses for each online entity they deal with, as in slashdot thinks my email is slashdot@mydomain.com, amazon thinks it is amazon@mydomain.com and etrade thinks it is etrade@mydomain.com - those examples are simplified for illustrative purposes.

A while back, before the bubble burst, I dabbled in some options trading in my etrade account. Therefore, Etrade's marketing department decided that would make my contact information something they could sell to the CBOE and I started getting bi-weekly spam from somebody on behalf of the CBOE trying to sell me all kinds of bullshit options information -- all sent to my etrade-only address.

After about a year of that crap, it finally stopped on its own. But then I started to get spam from the same mailing-list operator that the CBOE had used, but this time they were promoting other brokerages like TD Waterhouse, and most recently "TradeKing" which seems very questionable.

Whenever I get one these brokerage spams, I have to laugh. Etrade breached my privacy to make a buck or two and I'm sure they did the same thing to tens of thousands of other customers. But the end result is that their competition now has a confirmed mailing list of etrade customers, and the stupid greedy bastards GAVE it to them.

I've since opened an account with TD Waterhouse (aka Ameritrade) and make most of my trades through them, in part because of etrade's callous treatment of my privacy. I wonder how many others have done the same...

--
When information is power, privacy is freedom.

Re:How stupid is E*Trade? by (H)elix1 · 2006-09-22 16:15 · Score: 4, Informative

And for those who can't run their own email servers, a handy trick for those using a gmail account is to add a '+' to the user name, and it will deliver. Say I had a gmail account called slashdot@gmail.com. I could email slashdot+etrade@gmail.com and it will resolve to the slashdot@gmail.com address. Very handy for finding out who is being bad with privacy information when they ask for an email address.

--
+++ UGUCAUCGUAUUUCU
Re:How stupid is E*Trade? by Anonymous Coward · 2006-09-22 16:21 · Score: 0

Personally, I would not do business with anyone. You might want to look into some secluded property and just withdrawl from the world.
Re:How stupid is E*Trade? by chgros · 2006-09-22 17:21 · Score: 1

a handy trick for those using a gmail account is to add a '+' to the user name
The problem is that at least 1/2 of the services on the web will consider this an invalid address (despite it being perfectly valid). Very annoying.
Re:How stupid is E*Trade? by jfengel · 2006-09-22 17:30 · Score: 2, Insightful

I would expect that a spammer would automatically strip out anything after the +, but I don't have any experimental data on that.
Re:How stupid is E*Trade? by ptbarnett · 2006-09-22 17:37 · Score: 2, Interesting

Like the article-poster I'm one of those guys who uses individualized addresses for each online entity they deal with [....]
I do the same thing. So, I'll get to the point quickly...
The email address that I use for my Hertz rental membership has been distributed to spammers, twice. The first time, I sent a complaint and after a while I got a patronizing response about how it couldn't be them, and was instead someone else to whom I had given the address. It must have been a form response, as I had already explained that it was an address I had given only to them. I sent a second and rather strident message, repeating that they were the only company that had the email address in question, and that if they didn't want to be black-listed by my company's travel agent, they would do something beside blow me off.
I got a relatively quick response the second time, apologizing for their mistake and a further explanation about how they were pursuing the spammers in court to determine the source of the leak. I apparently wasn't the only one that followed up with a similar message, because I subsequently got spam addressed to hertz@mydomain, hertz@anotherdomain, hertz@yetanotherdomain and so on -- for about a dozen similar addresses. I changed the address on my car rental profile to another address, and again started getting spam a few years later. Since my profile is accessible to any agent with a terminal at a Hertz rental office, spammers can probably always find someone that is willing to make a few bucks.
But, I've always wondered: how secure are ISPs? For a while, every article about "Carnivore" made the front-page of Slashdot. Forget the feds for a moment: how difficult would it be for a network technician to configure a router/switch and modify an open-source network sniffer to snatch email addresses from the stream of email going to/from their customers -- and keep it hidden from anyone else that isn't in on it?
Re:How stupid is E*Trade? by phopon · 2006-09-22 19:06 · Score: 1

how difficult would it be for a network technician to configure a router/switch and modify an open-source network sniffer to snatch email addresses from the stream of email going to/from their customers -- and keep it hidden from anyone else that isn't in on it?
Well that wouldn't be technically difficult, but most ISPs that I have experience with work VERY hard to prevent people from doing this and you would be an idiot to use this resource to steal email address's. The more prudent thing to do if you had this kind of access is to simply pick off their credit card information/bank information. The content of the emails is far more valuable than the actual address and many people do not realize that email is not secure.
Re:How stupid is E*Trade? by 12AU7A · 2006-09-22 19:45 · Score: 0

Actually, this trick will work with any mail server running Sendmail, not just at gmail.
Re:How stupid is E*Trade? by Asic+Eng · 2006-09-22 20:07 · Score: 1

Another good option would be to use http://sneakemail.com/ You can generate addresses there each time you need to specify an email address - all the mail to these addresses will then be forwarded to your main account. If one of the addresses starts to bring in spam you can just remove it - and you know who caused the problem, too.
Re:How stupid is E*Trade? by ccarr.com · 2006-09-22 23:34 · Score: 1

And for those who DO run your own email servers (and DNS servers) I offer this method: your_name@etrade.example.com, your_name@slashdot.example.com, etc. In other words, but the unique part in the third-level domain instead of the user name.

Down sides: creating a new address is more involved; if you don't control your own DNS servers, you have to wait for the zone to reload. I've scripted most of this so that I can set up a new one in under a minute.

Up side: when an address is abused, you just yank the third-level domain from your zone. That way, not only are YOU not bothered by spam, but your SERVER isn't either. Without a domain, the sending node can't establish a connection, and your server doesn't have to go to the trouble of accepting a connection only to reject the mail after the rcpt to: command.

Important supplement: Thunderbird with the virtual identity extension!

I've been doing this for about a year and a half, and it's been extremely effective.

--
I don't know half of you half as well as I should like, and I like less than half of you half as well as you deserve. BB
Re:How stupid is E*Trade? by DieByWire · 2006-09-23 01:23 · Score: 1

I've since opened an account with TD Waterhouse (aka Ameritrade) and make most of my trades through them, in part because of etrade's callous treatment of my privacy. I wonder how many others have done the same...

That's ironic, because the email account I used for Ameritrade only became the target of pump and dump spam.

To give them some of the benefit of doubt, it was ameritrade@somedomain.com. I wouldn't be surprised if the pump and dumpers use similar addressesfor all the domains they spam.

--
Never shake hands with a man you meet in a fertility clinic.
Re:How stupid is E*Trade? by edp · 2006-09-23 01:48 · Score: 1

I will add "me too" on the Ameritrade issue. My unique Ameritrade address was leaked before 2005-10-31, and a different unique Ameritrade address was leaked between 2005-11-24 and 2006-8-11. They did not respond to the first letter I sent about it, but now they have acknowledged the problem. At this point, they have to know when it happens, people will know.
Re:How stupid is E*Trade? by fimbulvetr · 2006-09-23 01:52 · Score: 1

You could always setup a wildcard mx/wildcard dns servers, so even foo@thisdoesntexist.mydomain.com works.
Re:How stupid is E*Trade? by NevarMore · 2006-09-23 02:16 · Score: 1

"But then I started to get spam from the same mailing-list operator that the CBOE had used, but this time they were promoting other brokerages like TD Waterhouse, and most recently "TradeKing" which seems very questionable."

"I've since opened an account with TD Waterhouse"

So you have done buisness with a company knowing that they advertise by spam.

I do give you some credit, a 5 minute search failed to yield an email address though you are an avid Slashdot poster and a home theatre afficionado.

Still. WTF man. You seem savvy, why are you doing buisness with a company that spamvertises.
Re:How stupid is E*Trade? by Jah-Wren+Ryel · 2006-09-23 03:34 · Score: 1

So you have done buisness with a company knowing that they advertise by spam.

Depends on how you look at it. Although I use the term spam loosely, I blame etrade for giving my address away in the first place, not the mailing list operator for using it - as far as I know, they have every right to think it is legit since they got it officially from etrade. If I were to interpret it strictly, I would never trade options either as it was the CBOE itself that first spammed me via etrade.

--
When information is power, privacy is freedom.
Re:How stupid is E*Trade? by /dev/trash · 2006-09-23 06:12 · Score: 1

here's a little secret for ya. Every company is a spammer.
Re:How stupid is E*Trade? by kelnos · 2006-09-23 08:03 · Score: 1

I guess what I'm now wondering is... if TD Waterhouse/Ameritrade is willing to go and buy lists of competitors' customers' email addresses and then start spamming them, are they trustworthy enough not to sell out their own customers? Not saying that one implies the other, but IMHO both are at minimum somewhat-sketchy practices.

--
Xfce: Lighter than some, heavier than others. Just right.
Re:How stupid is E*Trade? by fm6 · 2006-09-23 11:01 · Score: 1

To answer the question in your subject line: about as stupid as most companies nowadays. Selling your customer list to your competitors is bad for long-term growth, but good for beefing up your short term numbers. And it's the numbers dweebs that own 21st century capitalism, so that's all they care about.
I used to buy a lot of stuff from Lands End. Then I got poor for a while, and switched to cheaper sources. Now I'm rich again, and I returned to my khaki addiction. During the interim, Lands End was bought out by Sears. So soon as I started buying from them, I started getting clothing catlogues from everybody under the sun — some of them, companies I never heard of.
Consider the sheer stupidity of this situation. Would Sears put an ad for Target in one of their stores? And yet they directly facilitate the marketing efforts of their competitors in the clothing catalog business. Of course, they made some money doing this...
Re:How stupid is E*Trade? by mibus · 2006-09-24 14:22 · Score: 1

You could always setup a wildcard mx/wildcard dns servers, so even foo@thisdoesntexist.mydomain.com works.

That would mean his server still has to respond to the spam. His way, the spammer's DNS lookup of the domain fails and there's absolutely no effort on his part to deal with the deluge of spam to that address.
Re:How stupid is E*Trade? by Anonymous Coward · 2006-09-25 16:02 · Score: 0

I like, I like! I haven't thought of doing this before, but it's going in this weekend... :)
Re:How stupid is E*Trade? by GigsVT · 2006-09-26 02:24 · Score: 1

There's some issues. One, they might have hired some advertising agency that used the list. Two, most of those brokerages have affiliate programs that pay a lot for conversions.

Of course having an affiliate program like that is kinda indirectly condoning spamming, but it is one layer of separation.

--
I've had enough abrasive sigs. Kittens are cute and fuzzy.

I got that too by Anonymous Coward · 2006-09-22 16:06 · Score: 1, Interesting

I think I have been getting the same spam, which really bugs me because until a few weeks ago I only got ~1 per month that missed the junk filter in my catchall account, but not I get ~5 per week to my personal email address (that I try not to give away). Do the emails go something like this:
--

Explosive pick for our members.

A massive PR campaign is starting now! MAJOR NEWS!!!

Trade Date: Monday September 18, 2006
Company: LAS VEGAS RESERVATIONS
Ticker: LVCC
Current price: $1.25
5-day Target: $4.00-$6.00
Get In Now!

--

with the text as an image?

Re:I got that too by Anonymous Coward · 2006-09-23 04:45 · Score: 0

mine do
reception rate is 0-4/day

Comment removed by account_deleted · 2006-09-22 16:08 · Score: 2, Insightful

Comment removed based on user account deletion

This has happened to me before... by heldlikesound · 2006-09-22 16:12 · Score: 1

I create addresses specifically to receive mail from retailers I order from. For example: companynameorderjunk@mydomain.com.

I NEVER type these addresses anywhere, and they are not something a wide net spam sender would guess...

Over the last few years i have had about 4 situations where those very account specific addresses began receiving a LOT of spam.

The sites included Dell, and PCMall. The PCMall ones very primarily sexual in nature...

I have thought of every possible way they could have gotten that address, and a security breach seems like the only feasible way. I have never typed those addresses anywhere else (no forums, no re-use on other sites, etc...), have never had a virus or spyware on my machine (OSX, thank you very much), so there is really one source for those addresses, the companies internal database.

anyone else experience this before?

--

Cloud City Digital: DVD Production at its cheapest/finest

Re:This has happened to me before... by Propaganda13 · 2006-09-22 16:51 · Score: 1

I used to do the same thing with Sneakmail(ranomly generated disposable email addresses). These spam floods aren't necessarily from breaches, but from sharing with partner companies. Companies' information policies are subject to change, and once your info starts flowing to other companies, it's hard to control.
Re:This has happened to me before... by EtherMonkey · 2006-09-22 17:20 · Score: 1

I NEVER type these addresses anywhere, and they are not something a wide net spam sender would guess...
You think that nobody has ever come up with this idea before, creating unique mailboxes for various relationships? I've been doing it for 6 or 7 years, and I've taught dozens others the same idea. I probably got the idea from someone else or an article I read online or in print. But regardless, it is a simple and logical scheme that some savvy spammers are bound to figure out on their own (more so now that it's been covered here). You could be looking at a refinement of the common usernames/brute force spam attack.
I'm not saying this is not something to worry about, because it is an indicator that, possibly, the brokerage was compromised. It could also be an indication that someone has compromised your mail host, or an upstream network of yours or your brokerage. Too many variables to be certain without investigation.

--
--- A man with a briefcase can steal more money, than any man with a gun. [Don Henley]
Re:This has happened to me before... by John+Hasler · 2006-09-23 01:05 · Score: 1

> These spam floods aren't necessarily from breaches, but from sharing with
> partner companies.

Same thing.

--
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Re:This has happened to me before... by Rick+Zeman · 2006-09-23 03:59 · Score: 1

I have thought of every possible way they could have gotten that address, and a security breach seems like the only feasible way. I have never typed those addresses anywhere else (no forums, no re-use on other sites, etc...), have never had a virus or spyware on my machine (OSX, thank you very much), so there is really one source for those addresses, the companies internal database.

anyone else experience this before?

Yeah, my wife and I both use Macs at home ("Rick, you work with Windows every day at work; why do you use Macs at home?" "Why for the same reason that someone who shovels out stables takes a shower at the end of the day.") and I run my own postfix server on our domain, and I have recipient_delimiters set to "-" so rick-foo@ and rick-bar@, etc, all get passed through to the mailbox on the left of the hyphen.
My wife online shops a lot and always uses exclusive addresses for EVERYWHERE she shops. She started to get spam on one of them and angrily confronted them, and they tried to blame HER for the address getting into the wild via a harvesting virus, or her giving to someon less secure.

The upshot is that a) she'll never do business with them again and b) since I have my own mail server I get some petty revenge:

: host a.mx.example.net [00.11.123.101] said: 550
5.7.1 : Recipient address rejected: Rejected
due to address being sold to spamming scum (in reply to RCPT TO command)

Dictionary attacks? by spinfire · 2006-09-22 16:14 · Score: 1

As an operator of a mailserver I know I do frequently get dictionary attacks (searching through names for mailing addresses) and sometimes these turn up addresses which aren't used (like my "stats" account or mail sent to "apache" or "mailman"). Usually these addresses later received subsequent spam - and often it is the most shady kind of spam such as the stock scam emails. So it is possible that the address may have been discovered through this means.

--
isomerica.net | Foonetic IRC

Are we talking about Ameritrade? by SysKoll · 2006-09-22 16:19 · Score: 3, Informative

"I started getting a bunch of stock-tout spam in the last month or so. The other day, I happened to look and see it was coming in to an email address I had dedicated to my online trading account account. I've spoken to the online trading company, and I've given them the info on these spams. It turns out there is an 'ongoing investigation,'

Is the trading company called Ameritrade by any chance? They got a leak problem, maybe an insider job. Look at this thread on spamgourmet (an anti-spam site that I help with): http://bbs.spamgourmet.com/viewtopic.php?t=81&star t=60

--

--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/

Re:Are we talking about Ameritrade? by dangitman · 2006-09-22 18:57 · Score: 2, Funny

[spamgourmet.com]
Damn, I went there looking for recipes. Please stop using misleading domain names.

--
... and then they built the supercollider.

Re:Maybe YOU were hacked by Anonymous Coward · 2006-09-22 16:22 · Score: 0

Except that, if that were the case, he'd be seeing a lot more spam to his other addresses too.

Case in point: I gave a cycling advocacy group an email address. Two letters @ my domain. Some time later, I got spam to that address. It wasn't a dictionary attack: I didn't receive any spam to any other two letter addresses (my domain accepts *all* email to it, save for specific, known compromised addresses). It wasn't a compromise of my email traffic, because there was very little genuine traffic to that address; I would have expected other addresses to be compromised before that one if somebody were sniffing traffic. Etc. Etc.

There's also the fact that it's spams that are targetted towards the type of email address he has: stock pump and dump schemes sent to his trading account address.

If it walks like a duck, and quacks like a duck ...

Consider benefit to the customer by Anonymous Coward · 2006-09-22 16:28 · Score: 0

Like all "ethical" behavior you have to consider the effects on those involved.

If they suspect the breach is still under way they need to keep it quiet to try to catch the intruder, which has a variety of benefits to the customer.

If there's any reasonable chance that silence could result in recovery of data before it's re-transmitted then it would be justified.

If silence gives them a few extra days to assess & secure their network then it might be justified.

It's never justified to keep it quiet for the company's benefit, only for the customers' benefit. Of course, without inside knowledge you can never conclusively know. That's why we have governments to enforce laws and regulate business (at least in theory).

'ongoing investigation'? by cranesan · 2006-09-22 16:36 · Score: 1

Ongoing Investigation? Was the company hacked? Was a CIA Agent's name leaked?

Immediate but reserved by mikesd81 · 2006-09-22 16:37 · Score: 1

Victims should be told right away that it is suspected that there was a breach, and outlined how an investigation will be performed. But it should be careful (mostly for legal reasons) that it be reserved and only enough information be given.

--
That which does not kill me only postpones the inevitable.

As stupid as Ameritrade by DuctTape · 2006-09-22 16:43 · Score: 2, Informative

I've since opened an account with TD Waterhouse (aka Ameritrade)...

Ameritrade/TD-W also let its email addresses out, too. My specifically-for-Ameritrade email address got vanilla (same type as my other accounts; not investing at all) spam. So I changed it. Again.

DT

--
Is this thing on? Hello?

certain laws may apply by sharp-bang · 2006-09-22 16:44 · Score: 2, Informative

In the banking industry, the applicable regulation is fairly strict... the institution must "promptly" notify customers of a material breach and there are relatively few loopholes. So if your broker or whoever was part of a bank, then this would apply. However, if your e-mail address was all that was compromised, they don't really need to notify you. By definition, e-mail addresses are not private information, any more than your physical address is. A number of states, notably California, have privacy laws that can be invoked, but the trigger for a material breach is usually the compromise of a combination of personal identifying data such as name and address (including e-mail addresses) and sensitive nonpublic personal information such as login credentials, account numbers, etc. You might see whether there is a law in your state that applies.

--
#!

Oops by sharp-bang · 2006-09-22 16:48 · Score: 1

assuming that you live in or are doing business in the USA

--
#!

I'm a vet by PHAEDRU5 · 2006-09-22 16:50 · Score: 0, Troll

So, there I am, riffling through the mail. I see a letter from the VA. I read it. It says "Dear Vet, Apart from hating you, we also might have lost enough information to allow Russian gangsters simple access to all your financial holdings."

Then I get a letter that says "Never mind."

I really do believe that the Feds have begun to channel Rosanne Rosanna-Danna.

Oh. PS from the Feds: "We still really hate you. Please die soon. Quietly."

--
668: Neighbour of the Beast

How soon is too soon??? by st0rmshad0w · 2006-09-22 16:51 · Score: 1

Before it happens?

VMWare too by theskipper · 2006-09-22 16:53 · Score: 1

Lately I've gotten lots of stock spam through a sneakemail address assigned to VMWare. The interesting thing is that I used two separate sneakemail addresses, one for the demo download and one for the purchase of VMWare Workstation. All the spam goes to the demo address so it's tempting to think that they sold it. There's probably a less sinister explanation but the point is that blatant stuff like this does happen with reputable companies.

Sneakemail users will recognize the format in the From line:

Received: from abhll.ozlhz ([70.144.236.219])
by adsl-144-233-36.aby.bellsouth.net (8.13.3/8.13.3) with SMTP id k8KHYm5t078080;
Wed, 20 Sep 2006 13:34:48 -0400
From: "Lesley Horne xnray-at-ddzine.com |VMWare|"
To: sneakemail@xxx.com
Subject: conjunction
Date: Wed, 20 Sep 2006 13:24:51 -0400

Re:Maybe YOU were hacked by Anonymous Coward · 2006-09-22 17:11 · Score: 0

Objectively you did not prove how the spammer got your email address. It might have been a breach at the trading account company. It might have been someone capturing traffic at your ISP.

Right! Someone has been capturing traffic to his ISP, and instead of grabbing his credit card info and his passwords, they are just content to snatch his e-mail address. If he was hacked, the hackers would have done lot worse than stealing his email addy you dumbass!

This was the most retarded comment I have read. You must be an American. Sheesh.

How do you know? by buzzn · 2006-09-22 17:18 · Score: 1

Spam is often sent to made up addresses. So, if your email address was "joetrader@foo.com", it is entirely possible that a spammer synthesized the address. You need to use addresses that are not easily guessable, for example, joetrader@foo.com. If you already had a hard-to-guess address, then you have a point.

--
Join the window installer's union, where prosperity is a brick throw away!

Re:How do you know? by Who235 · 2006-09-22 17:47 · Score: 1

So, if your email address was "joetrader@foo.com", it is entirely possible that a spammer synthesized the address. You need to use addresses that are not easily guessable, for example, joetrader@foo.com

I agree.

Change your address to your address. . .
Re:How do you know? by buzzn · 2006-09-23 08:05 · Score: 1

That'll teach me to not use angle brackets... I meant joe(randomnumber)trader@foo.com. Doh!

--
Join the window installer's union, where prosperity is a brick throw away!

Sometimes hard to tell by dtfinch · 2006-09-22 17:27 · Score: 1

If a tape is missing, how do they know if it's been stolen? If a system is infected with a general purpose trojan, how do they know the extent to which the data was compromised, or if anything was downloaded at all? There would be a lot of false alarms if companies had to alert customers every time there was a possibility of data theft.

But if you believe that sensitive data was probably stolen, then you should have to alert the people you believe were probably affected immediately. The only problem with this is that it's near impossible to write and enforce laws based on non-absolutes such as beliefs and probability, and it's in a company's best interest to keep such problems secret, pushing the envelope of minimal regulatory compliance to its extreme.

Re:Sometimes hard to tell by dtfinch · 2006-09-22 17:34 · Score: 1

I suppose that when data theft is confirmed, a fine could be levied in proportion to the time it took between the actual theft and its publication. That would encourage companies to report probable thefts, if the threat of fine is severe enough, while allowing them to keep the less probable breaches secret.

It's a balancing game... by ChePibe · 2006-09-22 17:34 · Score: 1

Sometimes, a company can only make a security threat worse by declaring the problem exists.

Let's take a stolen laptop, for example. If Company A's suffers a laptop theft, and the laptop (for whatever stupid reason) has the personal data of thousands of customers or employees on it, how should that company respond? This is obviously an example of poor security to begin with (no one should have that kind of information on a laptop taken off the premises), but how do you keep a bad situation from getting worse?

I see no clear best answer. Do you announce it to the world and all of your customers? While this would be a perfectly acceptable and reasonable knee-jerk response, I'm not convinced it's the best one. What happens if the punks who took the laptop are only interested in pawning it, ditching it at the first possible moment, likely to someone who doesn't really care about the data on there (obviously, however, they might)? If you notify the world of the theft and what was lost, you've just greatly increased the likelihood that information could be used against you and let the crooks know they have something of much more value - you could (and that is the key word here) make a problem worse while acting with the best intentions.

On the other hand, hiding this problem from your customers is certainly not ethical. It's their data, their money after all. But by assuming the worst could happen and informing people, do you ensure the worst will happen?

I'm not sure there's always a best way to handle these things - sometimes it could be informing everyone, at other times it could just mean scrutinizing accounts more closely while keeping everything quiet. It's a hard thing to balance.

I'm no security professional, but I'd like to ask those who are - is my reasoning correct, or am I totally off? If I'm off, please feel free to critique/correct at will, as I would love to hear more.

Re:It's a balancing game... by laughingcoyote · 2006-09-22 19:50 · Score: 1

I'm not sure there's always a best way to handle these things - sometimes it could be informing everyone, at other times it could just mean scrutinizing accounts more closely while keeping everything quiet. It's a hard thing to balance.

The same rule as always applies here-SECURITY THROUGH OBSCURITY DOES NOT WORK. You could be dealing with a couple of punk kids who randomly stole a laptop and are off at the first opportunity to pawn it-or you could be dealing with organized gangsters who know damn well what they got and are going to set out to exploiting it the second they can get started. You've no way to know. If you've had a potential breach (virus/keylogger infection, stolen tape/backup record/laptop containing sensitive data, ANYTHING) then you notify your customers right away. This should be required by law and punishable by jail time if anything else is done. If they suffer expenses as a result of your negligence, you pay them immediately and unquestioningly. If they have to sue you to get payment out of you, you pay triple plus attorney's fees. And next time, maybe you remember to be more careful.

--
To fight the war on terror, stop being afraid.

Are they incorporated in California??? by soren42 · 2006-09-22 17:37 · Score: 2, Interesting

So, according to Bill AB 424 in the Great Sovereign State of California, any company negligent in the protection of customer identity data must immediately inform the offended party upon being made aware of the breach.

I understand that there have been several attempts to leverage that law on behalf of US citizens who can't afford to live in California (us poor, ol' east coast folks!) to require major corporations transacting any business in California to immediately disclose based on that law.

I'm sure there's jurisdictional issues, but there's at least some chance in hell that virtue jurisprudence will prevail.

Anyone with an actual Litt.D, SJD, or otherwise more qualified care to add fact to my hype and speculation? :)

--

"Adventure? Excitement? A Jedi craves not these things."

Re:Are they incorporated in California??? by sharp-bang · 2006-09-22 17:53 · Score: 1

32 states have similar laws. Disclosure of identity data *only* may not be sufficient cause. But if you think there's an issue and you're in the proper jurisdiction, a letter to the firm copying the state attorney general might be helpful.

--
#!

Transfer your account to another broker. Now. by Animats · 2006-09-22 17:40 · Score: 1

Get out of that broker now. Move all your assets to another broker. You don't want to have assets with a broker in trouble.

I've been through a broker bankruptcy, and it's a huge hassle. Yes, you eventually get the assets back, but you may be trapped in a position and unable to trade out of it.

priorities by macadamia_harold · 2006-09-22 17:40 · Score: 3, Funny

How soon should such a company let its customers know that their data has been compromised?

that depends, how long does it take to finance a new ferrari and a yacht to ship it out of the country?

--
Push Button, Receive Bacon

Re:Maybe YOU were hacked by ptbarnett · 2006-09-22 17:45 · Score: 1

Right! Someone has been capturing traffic to his ISP, and instead of grabbing his credit card info and his passwords, they are just content to snatch his e-mail address. If he was hacked, the hackers would have done lot worse than stealing his email addy you dumbass!

Credit card info and passwords will be encrypted, if a user is taking any precautions at all.

However, most connections between MTAs (Message Transfer Agents like Sendmail, Postfix, etc.) are not encrypted. My Postfix server offers TLS to anyone that connects, but very few MTAs actually use it.

It would be difficult to capture credit card numbers, but trivial to capture email addresses from RFC-822 headers.

I really wonder who the dumbass is.

Immediately by SniperClops · 2006-09-22 17:54 · Score: 1

They should tell you right away so you can make any necessary changes to protect yourself, especially if the info compromised is a credit card or bank account number.

Notify Immediately by ErichTheWebGuy · 2006-09-22 17:55 · Score: 2, Interesting

I bought a CD from an online store a few years back. They got hacked, and customers' credit card numbers were stolen. I got a call that same day from the store, saying that they were aware of a problem and that I should take measures to protect myself. I really appreciated that. I have gone back to them several times, because of their honesty with me, and also because of the borderline-paranoia about security that follows a successful attack/theft.

--
bash: rtfm: command not found

Re:Notify Immediately by DerekLyons · 2006-09-22 20:20 · Score: 1

I bought a CD from an online store a few years back. They got hacked, and customers' credit card numbers were stolen. I got a call that same day from the store, saying that they were aware of a problem and that I should take measures to protect myself. I really appreciated that. I have gone back to them several times, because of their honesty with me, and also because of the borderline-paranoia about security that follows a successful attack/theft.

Myself I'd run screaming from such an online store, and warn everyone I know about how poorly they handle security and what little they do about it.

They never should have been storing your credit card information on a public facing computer in the first place!
Re:Notify Immediately by PlasticMonkey · 2006-09-23 09:00 · Score: 1

Myself I'd run screaming from such an online store, and warn everyone I know about how poorly they handle security and what little they do about it.

They never should have been storing your credit card information on a public facing computer in the first place!

Unfortunately, it's not as easy as that. The machine may not have been public facing at all, and a public facing machine that had some level of access to it was. Granted, there should be precautions to stop even this from happening, but it can be very, very difficult when your site software has been wriiten by another company and you have not had others to verify the code for holes.

It's dead easy to jump to conclusions, but you must remember that if even *one* public machine has been compromised, there is a chance that every single machine on both their internal and external network(s) could be accessed to a certain degree.

-plasticmonkey

Uptick in Stock SPAM, ISP Sold My Address by SAPtraveler · 2006-09-22 18:00 · Score: 1

I too have noticed an update in 'stock' related SPAM.
When, I left my previous ISP host, netmegs.com, I immediately begin receiving spam on the address I used to correspond with them on.

I just figured it was sour grapes for them and eventually began filtering that address.

Recently, I begin receiving SPAM on 2 addresses that I use exclusively for my online trading account. At first, this made me thing there was a breach at by broker. Then I noticed that many other email addresses that I used to use for specific vendors began spamming me, even addresses that I have not used since switching hosting services. This makes me believe that my brokerage is not at fault but it's my old hosting company that has either compromised old email data or outright sold it to spammers.

I contacted my brokerage about 4 weeks ago when I first noticed the problem. They responded quickly but the more I investigate the problem the more I think it's my old hosting service. They are named in this message so buyer beware.

Ameritrade? by mtbf · 2006-09-22 19:02 · Score: 1

Are we talking here about Ameritrade? We used a dedicated email address when we registered with them a few years back and we started getting spam on that address maybe 2 or 3 months ago. I changed our email correspondence addresss just two weeks ago, and I'm hoping that the California law that requires companies to reveal identity theft security breaches will kick in and force Ameritrade to fess up if something bad had gone down.

Ameritrade & VirtualBank too by Anonymous Coward · 2006-09-22 19:02 · Score: 0

I had a Datek account, which was acquired by Ameritrade. Before closing the account (if I had wanted to be an Ameritrade customer, I would've joined them to begin with), I changed the associated email address to ameritrade@mydomain. I have since received spam at that address. So Ameritrade either sold out its customers, or had a privacy breach.

Additionally, VirtualBank has either been hacked or has sold my email address, and who knows what other privileged information. I've been getting hundreds of spams to my virtualbank address all year. They refuse to even respond to my inquiries.

Their "Approved Partners" by Anonymous Coward · 2006-09-22 19:18 · Score: 0

but they didn't sell it, they are quite clear on that

*cough* bullshit *cough*

Ameritrade leaks your email too... by Anonymous Coward · 2006-09-22 19:22 · Score: 0

Ameritrade leaks your email too. I own several domains and I use one as a check to see if anyone is selling my email address. When I register an account I give them a email that looks like:

somedomain.com.(64-bit number in hex)@mydomain.com

I generate the 64-bit number for each address, only address that have the correct 64-bit number get though. This way I know for sure (nearly) if someone has sold my email address.

I only receive stock spam though the address associated with ameritrade.com. When I called ameritrade to complain they insisted they don't sell email address and the problem was not their fault, despite multiple attempts to explain to them why this is highly improbable. They claimed my computer or mail server must of been hacked. But they offered me 25 free trades as a show of good faith, I declined and moved my account to Charles Schwab and so far they haven't sold my email address.

Why omit the name of the company? by Anonymous Coward · 2006-09-22 19:28 · Score: 0

This happened to me too, and in the same timeframe you describe. I changed my e-mail address used with the company, and the spam stopped. So I knew that someone had compromised their database of e-mail addresses briefly.

The company is TD Ameritrade.

It's spam but who cares? by Anonymous Coward · 2006-09-22 19:47 · Score: 0

Carnage Blender

Of course you can refuse to click, but that would make you a gay!

ANSI and BBB Standards by joeflies · 2006-09-22 19:54 · Score: 2, Informative

Although this was JUST announced a few weeks ago, ANSI and the Better Business Bureau are setting up a working group to define standards and best practices for how to address identity theft. The scope is to first catalogue what standards and best practices exist, and then go beyond and define what else needs to be documented.

Whether or not this results in the answer to your question (how long notification should be given), at least this is a step in the right direction for some centralized thinking instead of everyone doing it on their own.

Re:Maybe YOU were hacked by Asic+Eng · 2006-09-22 20:11 · Score: 2, Informative

The trading company might also have given out the address voluntarily (and now doesn't want to admit to that) or it could be a lucky guess of the spammer (maybe a dictionary attack of sorts). I know they used to try use commonly-used nicks on my domain for a while. (Then I turned the catch-all off...)

Identity Theft Issues Can take Years to Fix by Anonymous Coward · 2006-09-22 21:31 · Score: 0

I had my identity stolen in 2000 or so and am still trying to fix it, even though I've notified all the relevant authorities numerous times... It wasn't until that I think the person took a mortgage out in my name that they cleared the fraudulent charges... and they still wont clear the drivers licences or addresses the guy took out in my name without showing up at police station on the other side of the country!

Hiring a lawyer to fix this may have been quicker, but would have costed thousands, so I'd say, change any accounts immediately that may have been compromised.

It's not possible to steal Data. by master_p · 2006-09-22 22:08 · Score: 0, Offtopic

...After the incident with Kivas Fajo, all of Federation's androids have been outfitted with a subspace alarm that goes off when the androids' signal is lost.

Why should they care? by Asmor · 2006-09-22 22:22 · Score: 1

How soon is too soon? At all. For them, at least. There is no real reason for them to admit anything. They don't really lose a whole lot by not admitting things. A couple savvy users isn't really worth the cost of the bad PR. Yeah, ideally they'd let everyone know as soon as the possibility of a leak was made known to them, but this world doesn't run on ideals.

True security only comes when it's in the best interests of the person for whom the security is a cost, particularly at a corporate level. I'm sure they spare no expense on the armored car that takes their booty to the bank*.

*Yeah, I know that they probably do all their transactions financially. I suck at coming up with real-world examples.

I'm getting a new spate of stock spam, too. by Anonymous Coward · 2006-09-22 22:46 · Score: 0

I had an account with Datek, which was bought by Ameritrade, which... was it recently bought by someone else?

disposable addresses by jqh1 · 2006-09-22 23:02 · Score: 1

There's a long-running thread on the bbs for spamgourmet discussing a bunch of events like this -- spamgourmet users generally use a unique email address for each of their accounts, and so can quickly identify a problem (unless it was with spamgourmet itself, of course, but records so far show that hasn't happened). The response of the companies varies from complete denial and reticence to surprising accountability. None of it ever ended up in court, afaik.

--
who's moderating the meta-moderators?

Re:Maybe YOU were hacked by RealSurreal · 2006-09-22 23:05 · Score: 1

Or it might just have been a guess. I have email addresses which I have NEVER given to ANYONE and they still attract spam. These guys just randomly combine names with domains in the hope of hitting a live account.

Now Is Not Soon Enough by John+Hasler · 2006-09-23 00:59 · Score: 1

> How soon should such a company let its customers know that their data has
> been compromised?

They will do so shortly after you go public with their name. Don't you think you should tell us who they are so we will know who not to do business with?

--
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.

Same thing, two high profile brokers... by FriendlyLurker · 2006-09-23 01:04 · Score: 1

This has happened to my accounts, *twice*. TDAmeritrade and Interactive Brokers have both compromised my one off email addresses for their systems to stock touts - not once, but TWICE. I changed the two one off email's in their systems after noticing the stock tout scum spam scams, only to have the two newly generated emails compromised yet again within weeks. I ask, what other information have they sold/stolen??? These clowns are protecting my life's savings in brokerage accounts, but can't even keep my email account locked down?! Try complain - I did... what a farce. Wasted my breath and insult to my intelligence the complaint process was...

If Aliens from another Galaxy contact Bush .,.. by Anonymous Coward · 2006-09-23 01:12 · Score: 0

If Aliens from another Galaxy contact Bush, should the gub'ment freak out the citizens by have a press conference about the contact? I say no! We have wars to win and a couple more to start = freaking out the citizens is NOT in the game plan. Carry on!

And Guess What? by Anonymous Coward · 2006-09-23 01:16 · Score: 0

It might've been dumb freaking luck.

My primary e-mail account is presently suffering a deluge of stock scam spam. Sure, my main account, that's been around for ages.

The fun part is, accounts I have created but have never used (even on different domain names) are also suffering the deluge.

Unless your e-mail address is 9fjxj28_dcj29j2@whatever.com, there's always the chance that they've simply stumbled across your address by accident. No bounce = send more mail. Send lots more mail.

(Hell, often times bounce = send more mail, send lots more mail. :P)

The problem is by Anonymous Coward · 2006-09-23 01:22 · Score: 0

that after W. took office, he had the FBI stop notifying the victims. Prior to that, the victims were notified right away.

stripping * after + by MollyB · 2006-09-23 01:39 · Score: 1

Have to admit I'm clueless about "allowable" characters in an email address, but suppose a user happened to use the plus sign (+) in their username, but not in the context of the discussion. It would mean the spammer would possibly miss a target (by stripping everything after the +), which they'd avoid if possible, presumably. I guess most likely they'd spam every possible iteration since it costs them nothing to cover all bases.

Dictionary Attack? by G4from128k · 2006-09-23 01:43 · Score: 1

Is it possible you're the victim of a dictionary attack? These days spammers are sending junk to $RANDOMNAME@knowndomainname.com. I've seen this on both big national ISP domain names and dinky domain names that I own. If your user name a common name and letter, it might be getting hit at random without any need for compromising your account.

--
Two wrongs don't make a right, but three lefts do.

There should be more effort by HatchedEggs · 2006-09-23 01:59 · Score: 1

On the part of companies to inform their customers when there is a security breach and that might compromise their information. That is something that, despite efforts by many security professionals, most companies still fall quite short in.

Unfortunately, we as the customers are often the ones that suffer from company's attempts to always escape from this sort of thing unscathed.

--
Justin - Don't be afraid of my blog, it won't bite.

When effective by Anonymous Coward · 2006-09-23 02:08 · Score: 0

You should notify as soon as you have reason to think that a customer can do anything to mitigate problems. If the customer can't do anything, or there is no problem to mitigate, delay is more a matter of PR. But if you delay when a customer who knew about a breach could have prevented further problems, well, you're culpable.

Not necessarily data theft by kbahey · 2006-09-23 02:23 · Score: 1

The company you are dealing with (the broker), probably outsources its email list to some other company. That other company may be shady/aggressive, or it may be offshore, or some of its employees may pilfer the email addresses and sell them to spammers.

That could be all there is.

--
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.

Pending Federal Laws on data theft may preempt by SafetyNeal · 2006-09-23 03:15 · Score: 1

The Law Librarian Blog has a post about bills pending in the US Congress that would regulate data theft, many of these bills would preempt more strict state laws, like California's data theft law.

Another concern raised is that many companies don't even realize they've been hacked. "Data breach notification laws assume companies are able to detect the loss of personal data in the first place and then determine if lost data contained personally identifiable information.|LLB|"

The post cites to a recent Ponemon Institute study that found most companies don't have sufficient data security detection measures in place to even detect data thefts.

81% of respondents report that their organizations have experienced one or more lost or missing laptop computers containing sensitive or confidential business information in the past 12 month period...When asked how long it would take to determine what actual sensitive data was on a lost or stolen laptop, desktop, file server, or mobile device, the most frequent answer was "never"...On average, 64% of respondents admit that their companies have never conducted a data inventory to determine the location of customer or employee information contained in various data stores.|Ponemon Report PDF|(emphasis added)

I had the same thing happen.... by Anonymous Coward · 2006-09-23 04:18 · Score: 0

I'm 100% certain the same thing happened to me, too, as I also have a dedicated email account for that purpose which I have *never* given to anyone else. Heck, I've never even sent an email from that account.

I've, too, contacted the firm--twice in fact--and have gotten the same story, and I'm beginnning to get pissed off about it. Same run around. And this has been going on for at least six months.

A friend of mine who's a former trader recommended I go to the compliance office; if some announcement isn't made in the next couple of weeks, I'm going to have to resort to that because, like you, I know in my core there was either

* an theft by an insider
* a security breach

If not, they're violating their contract and have sold our information to third parties. Seems like for any of the above, they're in trouble.

Other Ways to get Leaks by Anonymous Coward · 2006-09-23 04:18 · Score: 0

At my local university, they routinely leak my e-mail address by sending out e-mail messages with my address in them. (This could either be for internal correspondence or for a bulk sending to a bunch of people.) Invariably, someone's PC eventually gets a virus, and presto my e-mail address goes out to a hundred million different recipients. I actually think that viruses, spyware, and botnets generate a significant fraction of e-mail spam addresses.

In case the above didn't work, my local university is also good at the following activities:

a) Posting e-mail addresses on websites. I can't randomize my e-mail address fast enough when dealing with my university.

b) Getting their own out-going e-mail messages blocked as spam (sometimes by their own spam filters.) Then wondering why I didn't get the e-mail message.

c) Forwarding the class list to some terrorist sympathizing individual, who helpfully forwards the list to his buddies. I then get Anti-American hate propaganda.

d) Complaining about the amount of spam e-mail they receive.

Don't assume that companies actually understand why people complain about released e-mail addresses. Some of the individuals can be the smartest intellectuals around, and not understand how their own actions cause problems.

This probably has nothing to do with your account by mr.mighty · 2006-09-23 06:14 · Score: 1

This probably has nothing to do with your account. I started getting stock touting emails, and was suspicious that someone had sold my email address. However, now I get at least 1 a day on 5 different email accounts, including at work.

I've heard these emails being cited as evidence that this or that brokerage, investor service, or whatever has been compromised. However, email addresses I never used to sign up for anything, internal email aliases at work, etc., are all being hit. The most reasonable explanation is a spate of dictionary attacks.

Let's all stop being hysterical about this for a minute, stop and think.

This is overkill by sirwired · 2006-09-23 13:07 · Score: 1

If some nefarious evildoer got ahold of EVERYTHING, not just your e-mail address, you would be getting a lot more than spammed stock touts. I really doubt the OP's SSN/Checking Account has been compromised.

Think about it, if you are some bad guy with the complete customer records of XXX,000 brokerage customers, what are YOU going to do with it? Send out a measly XXX,000 e-mails touting some worthless stock, or just steal the money out of the checking accounts outright?

To me, this sounds like some greedy marketing dept. out to make a quick buck, not complete ID Theft.

SirWired

What sporkme meant by "overseas" by tepples · 2006-09-23 14:15 · Score: 1

'overseas types' is such a crass and outdated notion and turn of phrase.

I'll try to guess what sporkme meant: In context, two countries are considered "overseas" if they have not agreed to help each other investigate fraud that occurs in the course of international commerce. The metaphor "overseas" applies because in the developed world, investigative cooperation correlates with sharing a border.

Is Canada overseas? How about Mexico? Columbia? It's a fairly big continent!

I'm pretty sure that Canada and US police work together. I'm not sure how far NAFTA and associated agreements go however.

SPYWARE/MALWARE by Anonymous Coward · 2006-09-24 13:05 · Score: 0

Same thing happened to me or so I thought. I accused the library system of having a security breach when I started getting 5-6 spams a day with an unusual email address I had used for their system. Then a few more days went by and I started getting more spams from other dedicated email addresses I have. Guess what, malware or spyware was on my system and had grabbed the addresses out of my email client address book.

Somewhere, a witch is burning. by Switche · 2006-09-25 08:06 · Score: 1

The fact that I get spam mentioning penis enlargement does not mean that Shoprite must have lost my value club card data to Sum Yung Gai who now knows I buy "modest" size Trojans. I hope the correlation is clear.

Similarly, an "ongoing investigation" with "outside agencies" can mean they've got a private security firm analyzing their systems; which is normal, and nothing to be worried about if they even said as much. Companies are always vague about things like this, but they're not necessarily the evil empire.

Don't get me wrong; spam can come from some pretty shady activity. What you are, and everyone else is saying is not impossible, but your example shows a lack of understanding, and does not prove or even suggest any correlation to this trading company aside from both parties having something to do with stocks.

Hell I get stock spam. Everyone does. You don't need to sign up for stuff these days to get spam. That much has been said already. If you don't want spam, talk to your email provider. They're probably already blocking a few hundred spam messages a day. And who knows where those come from? *creepy music*

Ameritrade spam by finfife · 2006-09-25 16:24 · Score: 1

My unique Ameritrade address was leaked before 2005-10-31, and a different unique Ameritrade address was leaked between 2005-11-24 and 2006-8-11.

My unique Ameritrade email address also started receiving stock-related precisely on the same day (2005-10-31). Clearly the same incident. I changed the email address the following day, and reported the issue to Ameritrade. After several layers of denials, the message finally got through to someone aware of the incident, who replied:

Ameritrade has received reports of clients receiving spam at e-mail addresses that were only provided to Ameritrade. We are currently investigating this situation in order to put a stop to it as soon as possible....

No more spam to the new email address for almost 8 months, then it started receiving spam on 2006-07-28. So the second leak must have been between 2005-11-24 and 2006-07-28, probably toward the end of that period. Again consistent with your report.

Getting back to the question of whether a company should go public about a security breach, I think it would depend on the circumstances. If publicity would hinder an undercover investigation or sting operation, a delay could be justifiable.

For what it's worth, on another occasion last year, Ameritrade did lose a data backup tape containing customer account information during shipment back in February 2005, and went public about it two months later (http://www.networkworld.com/news/2005/0420ameriwa rns.html) after notifying customers who may have been affected.

And here's an extensive blog entry about the Ameritrade incidents-- with many corroborating comments pointing to the late July early August 2006 timeframe: http://www.billkatz.com/node/77.

How soon is too soon? by Mr.BoBo-TT074226 · 2006-09-25 17:37 · Score: 1

How soon is too soon? i think that is not the question..i think the question is who well people know about spam. clearly people do not complain about the spam because they might think that spam is harmless. that is until they know that they have been deceived.

notification by sitiit072044 · 2006-09-28 03:42 · Score: 1

It requires a business or government entity to notify an individual in writing or email when it is believed that personal information - such as a Social Security number, driver's license, or credit card number - has been compromised. Only two exceptions to notification exist. First, upon the written request of law enforcement for purposes of a criminal investigation; and second, for national security purposes. You can't tell the true impact of identity theft by looking at the numbers. You see it in the stories of the victims.

hi and bye by PK075840 · 2006-09-28 19:19 · Score: 1

Later on whenever the unauthorize party want to breach the information they could say "hello there".

Slashdot Mirror

Data Theft Notifications - How Soon is Too Soon?

137 comments