Slashdot Mirror
How Attackers Will Use Epsilon Data Against You
Trailrunner7 writes "What might the criminals who broke into Epsilon do with the email lists they have? The easiest thing to do is to sell these data sets on the black market or, potentially, to competitors of victim firms. According to the latest data from data-breaches.net, totals are up to 57 customers including credit card providers with branded cards — Visa (notices sent for at least 3 cards), the World Financial Network National Bank (12 cards) and Citi (3 cards). The criminals may make some money there and re-invest it into technology or services for other efforts. Once an attacker has gained a foothold on one or more systems used by their mark, they can begin harvesting credentials. The frequency with which average consumers use the same username/password combination across multiple sites is such that such information could lead to accessing other potentially-existing accounts on high-profile social networks."
Always good for a laugh to us 'third world' savages. Where's your 'privacy policy' now, eh?
For justice, we must go to Don Corleone
Visa (notices sent for at least 3 cards), the World Financial Network National Bank (12 cards) and Citi (3 cards)
I have not yet seen notes that VISA itself was hit. Banks that use VISA's services may have been, but the article is lumping the network/transaction processor with the banks. It is possible to be a customer of VISA for other purposes, which surprises me that the article is claiming they were independently hit, that is news here.
Who said anything about passwords being compromised? My e-mail address is now public. Big whoop, it has always been public. If the "public" (don't include me) uses the same password for their checking account as they do their email, shame on them.
If I used a sig over again, would anyone notice?
At least that's what it seems like as my emails about the leak came with a bunch of Automotive Insurance emails despite the fact I no longer own a car.
Comment removed based on user account deletion
Preposterous claims and counter claims all in my name! It's all over for me, now! My credibility is ruins!
Curse you Epsilon Data Thiefs! >:(
A feeling of having made the same mistake before: Deja Foobar
All that was stolen was names and email addresses. It's not like spammers and other online criminals don't have those anyway.
http://blog.wordtothewise.com/2011/04/epsilon-keep-calm-and-carry-on/
the scenario in TFA could happen, but it's mostly masturbatory super hacker fantasy
these email and name lists will be used for spamming and unsophisticated phishing, "IMPORTANT MESSAGE FROM $COMPANY, you account will be terminated unless you log in here [www.example.ru]"
TFA layed out a scenario where targetted espionage is carried out against targets that are somehow more convenient because you got their email address.
Snowden and Manning are heroes.
Shouldn't Visa and other corporate morons pay damages high enough to close them down? And have those money put into schools to raise the educational levels so people will be smart enough not to mess with credits?
I wonder if the 'hacker' used social engineering:
"The final interview question to complete our questions, before we send you your $5 gift certificate, What is your pets' name?"
"Hummm that's hard, let me think, AH! Precious Punkin!"
(sound of typing in the background) as interviewee's work VPN access authenticates with password 'Precious-punkin".
"Thank you so much for your time, your (snigger) $5 gift certificate will be mailed to you. Please wait 7 to 10 work days for delivery!"
Or maybe it was just a lucky guess that "Green Hospital", might have set a setup default password on the VPN as 'greenhospital' and the new VP of elite and creative marketing couldn't think of anything better that was memorable enough to actually remember, so they left the default unchanged.
sigh...
Most of his techniques, such as "Email addresses are easy to figure out, such as Name.Name@Company.com, will make it so any name on the list can be traced to CEO, then use LinkedIn!"
You could just skip the email breach, look up the CEO of a desired company, guess the obvious email address, and you're good to go.
Using a person's business relationship with a specific company whose data was stolen is the value of these addresses... not the person's existence.
Well, as someone who is very vigilant and distrusting of emails in general ... and as someone who has received at least one email indicating that my data may have been compromised, I'm still a little worried.
With better and more specific information, it's easier to craft a phishing email to be far more convincing and likely to catch people out. Instead of casting an extremely wide net and hoping that someone falls for it, you could be sending an email which targets people by name, and convincingly looking like it comes from a company you deal with.
This is made even worse by the sheer number of legitimate emails I see that actually come from a 3rd party because companies farm this stuff out (which is the root cause of this in the first place). Heck, I've lost track of the number of emails I've received on behalf of an employer that send me to a 3rd party site to do something -- usually a site which requires that I allow cookies, flash, and all sorts of crap I usually don't let unknown sites do. All because some twit in HR wanted to use Survey Monkey or something.
Even with a high level of paranoia, it's increasingly difficult to be 100% sure of the origins and authenticity of some things.
Lost at C:>. Found at C.
The author makes the flawed assumption that sending someone an e-mail == being able to install a keylogger on their machine. In reality in order to get a keylogger on the machine it requires the recipient being gullible enough to download an attachment being sent to them by a complete stranger (unlikely, but not out of the question). Or alternatively it requires that the hacker crafts some attack that exploits a vulnerability in the e-mail reader of the recipient's choice which now days can be any number of web-clients, Outlook, Thunderbird, or a smartphone e-mail client even. The suggestion that simply having an e-mail address of somebody will allow an attacker to install a keylogger on the targets machine is idiotic at best.
I get no score in any subject starting at (as far as I can tell) a level 3 post or greater. In addition, everything in any such posts has double line breaks between every post.
It sucks, plain and simple. I'm running Firefox 3.6.16 under Gentoo. So what's up?...is Firefox broken or slashdot???
Tom
Comment removed based on user account deletion
I read with much interest your user manual about exploiting the email list. However I do not see a script or code that I can download and use with your user manual. Please provide the same sir.
Sincerely,
Scrip T K Iddie
All your email addresses are belong to us.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Here is what I got on my New York & Company email address (I had not received anything else - except the breach warning - on this address for years after an order with them in 2007):
(I assume that the german unicode characters will be missing from my post but you will get the picture...)
From: "Mr.Frank Morgan"
Reply-To: frank77morgan3@yahoo.com
Subject: BITTE ANTWORTEN
Guten Tag,
Ich bin Frank Morgan, die ich in der Buchhaltung eines Finance Haus hier in Europa zu arbeiten. Ich sah Ihr Kontakt während meiner privaten Suche im Info-Center, ich glaube, dass Sie ganz ehrlich, engagiert und fähig Unterstützung in diesem Geschäft Venture wollen.
Es ist auf dieser Grundlage, dass ich mich an Sie als nächsten Angehörigen zu einem späten Client des Finance House, so dass die Gesamtsumme von $ 16.5million (Sechzehn Millionen fünfhunderttausend US Dollar) freigegeben wird und bezahlt werden stehen Sie als Empfänger sowie den nächsten Angehörigen des Verstorbenen.
Alle Dokumente und Nachweise, damit Sie bekommen die Mittel wurden sorgfältig erarbeitet, wie ich aus den verschiedenen Büros für die ordnungsgemäße Übertragung der Fonds für Sie besorgt haben gesichert.
Wenn dieser Vorschlag Ihnen gefällt, antworten Sie bitte auf mich mit den folgenden Informationen.
-Vollständige Namen
-TELEPHONE/FAX NUMBER-
-Address-
-AGE-
-SEX-
-BERUF-
Ich erwarte Ihre dringende Antwort, segne alles Gute und Gottes euch.
Mit freundlichen Grüßen,
Frank Morgan
+447031901697
mrfrankmorgan444@hotmail.com
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
everything we say is being used against us? is it a religious problem? queers? what?
the glorious 2nd chance 'day of departure' has come,,, & gone. still here?
we've seen in the genuine american native elders teepeeleaks etchings, whereas our self-appointed rulers & clergy can be less than democratic/christian/human when it comes to certain (other peoples') things.
Yes, it's too simple to actually work, but after data breaches like this, Epsilon should be required to publish all the data that was compromised. It devalues the data held by the malicious entity (a deterrent against future attacks), and allows security personnel to more accurately gauge the risk and present additional strategies for mitigation. Any action that reduces the value of these databases is a step in the right direction.
Read the title as "How Attackers Will Use Epsilon DELTA Against You" and thinking wtf?
"The frequency with which average consumers use the same username/password combination across multiple sites is such that such information could lead to accessing other potentially-existing accounts on high-profile social networks."
Sure, they might manage to get credentials via phishing. This would be far less of a problem if people used a good password scheme for keeping unique passwords on all websites, like I've done for a long time now.
http://lifehacker.com/#!184773/geek-to-live--choose-and-remember-great-passwords
I read the topic and my stomach lurched as I was instantly taken back to a college classroom enduring a long lecture on the works of Cauchy and how epsilon can be thought of as the "error" associated with a given distance "delta" from a function...
I shook my head in disgust and then re-read the topic.
Oh, it says epsilon data...
With so simple it's stupid services like LastPass, I really don't understand how people still can't use unique passwords. For christ's sake, using LastPass is EASIER than using 1 common password, because it auto logs in. I really don't get people. Then again, with so simple it's obvious backup services like Carbonite, you'd think everyone would be backing up, too. Fat chance there.
I8-D
It happened to me last weekend. A woman posing as "Linda Wilson" called AT&T to cancel our phone service. She had enough info to get the rep to believe she could cancel the account. She hung up in the middle of the call when asked to verify the address on the account and the rep tried calling all the numbers on the account to reach her. (The rep didn't ask for any info so he wasn't phishing me. A call to 611 confirmed what he said.)
I don't know if it's Epsilon or the fact that we applied for a couple of credit cards recently or just a random breach. But, phishing/social engineering happen all the time.
For safe measure, we changed our account info and put a fraud alert on our credit reports.
-l
Help cure AIDS, cancer, and more. Donate your unused computer time to worldcommunitygrid.org. Join Team Slashdot!
Exactly how much time do you think the bad guys are going to spend on you? To take the time to craft an ultra-convincing phishing attack, along with the subsequent necessary complex plotting to dissuade your fears, and get you to click seems like an inefficient, and ineffective expenditure of time to me. Maybe it's just me, but the ROI would have to be incredible to justify that kind of attention to detail.
I believe that the majority of these email addresses are going to be passed off as quickly as possible to some sucker on the black market, who'll send out a mass spam of phishing attacks that won't fool a sophisticated user, but will get Ma or Pa Kettle (who has dementia, alzheimers, naivety, or is just plain stupid). It's more cost effective to target stupid people with cheap spam than it is to try and lure smart people in
Here's to hot beer, cold women, and Glaswegian kisses for all.
Epsilon (aka Bigfoot) has been a bunch of spammy fucks for years. Seeing them get rooted by their fellow criminals can only be described as ironic justice.
They can send me emails from a third party. They can direct me to third-party websites. They can't make me turn off NoScript on them, and they can't make me type in credentials.
The security-conscious computer-savvy geek is pretty safe here. It's only the other 99.9% of the population that is at risk.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I'm under the impression that JP Morgan Chase was affected. I've got an account with them, and a debt card with the VISA logo. Though they hit me with "Refinance Your Auto Loan" emails monthly, for a non existent auto loan (uhh I hope?), I've yet to receive one of these emails.. Has anybody else?
I was shocked to learn that they'd scooped Chase Bank's email list. Not because of the theft, but I thought, why would Chase need to hire an outside firm to send out emails? Don't they have their own servers? Marketing types??