Slashdot Mirror
Data Exposed In Stratfor Compromise Analyzed
wiredmikey writes with an excerpt from an article in Security Week: "Following news that security and intelligence firm Stratfor is downplaying the recent hack of its systems, Identity Finder today shared a detailed analysis of the data released so far by the attackers. Based on the analysis, 50,277 Individual Credit Card Numbers were exposed, but 40,626 are expired, leaving just 9,651 that are not expired. In terms of emails, 86,594 Email addresses were claimed to be exposed by the hackers, but only 47,680 were unique. The hackers have released personal information for Stratfor subscribers whose first names begin with A through M, with N through Z expected to be released soon. In addition to the presently published data compromised during the attack, the attackers claim that 200GB of company email containing 2.7 million emails was captured as well."
As of posting, Stratfor's website is still down.
The credit card numbers they stole and exposed were used to make over one million dollars worth of "donations" to different charities like Red Cross, Save the Children and CARE. Good job Anonymous!
Except that they were all reversed with chargebacks, which not only took back all the money given, it actually cost the charities around $250 000 in chargeback fees which are now off from what other, legit people donated. Awesome job there! Idiots...
A special Category in the Darwin Awards.
The stratfor guys might have been in better shape if they'd kept their systems patched. Just sayin'
2.2.15 is not the latest. 2.2.21 is.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
...but 74kB per email?
"Based on the analysis, 50,277 Individual Credit Card Numbers were exposed, but 40,626 are expired, leaving just 9,651 that are not expired"
Sounds like 80% of the problem evapourated based on card expiry. How do we go about making CCs expire more frequently?
+1 funny as hell.
A successful API design takes a mixture of software design and pedagogy.
Where I live, when your card expires, you just get a new one with the same card number but a few years added to the expiration date. Wouldn't this allow the attackers to reuse some of the expired cards?
I'm Rocco. I'm the +5 Funny man.
Go anon!
...what's the point of having a strong one?
I'm wondering what's the biggest risk with passwords: having it hacked and either stored decrypted or decrypted later, or having someone guess it? I'm starting to think it's the former, which makes me think there's no point in super complex "try and guess THIS one!" passwords.
The reason the authorities can't catch anonymous is that they're all chicks! They go around acting like nerd groupies fawning over admins in a socially engineered hack where they get the root password from the unsuspecting admin. The authorities can't catch them because the only description they get from the admin is "she was purty and soft".
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
HTH.
Deleted
Apache 2.2.15 was released 3/6/10.
Apache 2.2.21 was released 9/13/11.
So yeah, they were almost 2 years out of date.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
I wrote, and rewrote, and rewrote a long and subtle post on the value of contemplating the underlying forces acting in society that lead to events like this, rather than jumping to adulation or condemnation. I came to the conclusion that I could not make it clear that I was advocating contemplation, not support or opposition. That all I would get in response would be some twit turning my post into a straw man then hurling rhetorical vitriol at it.
Then it came to me -- I may be able to extract some value from this thread after all. So, I implore you, read through this thread with this question in mind: Do the histrionic posts add value to the discussion or take it away?
My guess; histrionics cheapen the discussion. An emotional and one-sided post about how Anonymous is a terrorist organization or the savior of true democracy is sound and fury signifying nothing, and a waste of our valuable time.
Inhibit histrionics, however you can. They are pablum for the masses and better left to the professional simpletons in popular media.
Stop-Prism.org: Opt Out of Surveillance
"it would be good PR for a bank to cover it for the charities"
You don't understand. The smart PR move is to let the charges stand without comment. That way the charities talk about it to their donors when asking for more funds to make up the difference.
The banks are already not well thought of currently. This makes no difference to them.
Net result: A lot of people who had never heard of Anonymous before their favorite charity mentioned them now hate their guts.
200GB of email? When I see figures like that, I always ask if they include attachments or not. Of so, reduce the figure by at least 80%.
I hopped over to Stratfor's Facebook page and one of the people who posted on it said their credit card info from Stratfor had been used at the well known charity called the Blizzard Store. ;)
storing credit card numbers attached to account data doesn't sound like intelligence community, sounds more like some douches who went out to find some guys and said "hey you're really smart! give us your cc number and some cash!" to some slobs they found.
real funny shit is how "TEH OFFICIAL ANONYMOUS" is claiming they didn't do it, which is a bit of a what the fuck too, don't they realize they're anonymous - there's no core, there's no agenda, if you don't like it form a hacking group like lulzsec.
but you know why stratfors client list is secret? because when it is secret they can claim that there's all sorts of cool persons there and not just peons, they're an image and guesswork company first and actual security provider second(or 4th or 6th, more probably 666th on the list..). that's why you get to spam them with stupid questions if you're a sub. it's like subbing to a nigerian information minister who happens to know english and reads the news.
why would they do that?(act more poshy than they are) well, to fool new clients into buying their newsletters and analysis - like "if you publish a picture of mohammed having sex with kids you might get suicide bombed" and "if you deal nuke technology to iran don't tell to isrealis unless you're finnish and have immunity and even then don't tell until you have the money in the bank".
world was created 5 seconds before this post as it is.
You can't moderate AND post. Slashdot doesn't allow that. It is impossible for anyone to explain why they moderated any particular way.
Moderation is largely about your presentation of your argument, which is earning you a lot of that mess. It still looks like you cherry-pick the facts that are convenient for your argument, regardless of whether you're actually doing so. There are undoubtedly facts that don't make your argument look as solid. That's what I'm asking: do you, or don't you pay attention to the facts against other OSes? I want the whole truth, not just part of it, and you'd get a lot better moderation if you would post the rest.
Stratfor's site will be secure AND up about the same time in the far, far future when American finally catches up with China and buildts a 500-mile-per-hour bullet train. OR NOT................
Add on 9,651 charges of credit card fraud.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
This lot and similar only pretend to be intelligent - hence the simple doubleplusgood label "think tanks". This incident highlights that better than anything else.
For anything that could cost you money, your job etc you want passwords that you can remember and that are hard to crack even if somebody has a copy of /etc/shadow or similar:
http://xkcd.com/936/
More importantly, don't reuse passwords that you put on anything important. Some idiot may store them in plain text on a blog site, dropbox authentication or whatever useless bunch and then a cracker could use them to get into your bank or wherever else you've used the password.
Now even Facebook passwords could be considered important because HR people love to use the excuse of looking up employees or potential employees so they can spend all day on Facebook.
So I've been led to believe than one unique password per important login is the way to go. For other things that can't be used to establish an online identity for the purposes of fraud (eg. here) it doesn't matter IMHO. I use unique passwords anyway because I've been paranoid about these things ever since my credit card number was used by thieves via carbon copy some years back.
Bzzzt. Thank you for playing. The 2.2.15 doesn't tell you the patch level. Here's from a completely up to date RHEL6 system:
[fnj@baldur ~]$ rpm -qa | grep httpd
httpd-tools-2.2.15-15.el6.x86_64
httpd-2.2.15-15.el6.x86_64
The -15 tells you the patch level. 2.2.15-15.el6.x86_64 was issued this month. As long as Redhat supports RHEL6, and that will be for a goodly number of years more, they will issue security and other patches. For example, their kernel is presently 2.6.32-220.2.1.el6.x86_64, but they track and backport not only the latest security patches but also a lot of hardware support and new feature improvements.
all of those transactions go through Visa and Mastercard, depending on which type of card you have.
seriously. the fact that so few people understand how the CC system works (including you, no offense) is kind of funny.
As another hacked reader, yeah I'm unhappy about this too. Considering that I was donating to wikileaks before, this is just painful.
Stratfor's just come out with their email, 8pm, not great, but here we are. They've done the standard 1yr prepaid monitoring service for identity theft.
I looked around to verify that my CC was actually breached (who knows, maybe it was a card I've already canceled?), but all the primary copies of the CC list seem inaccessible. It'd be lovely if they were taken down before I become collateral damage in all this, but it hasn't exactly been a lucky week.
Canceling the card, and watching the account like a hawk. It's all we can do, and hopefully it's enough.
Care about electronic freedom? Consider donating to the EFF!
I saw a copy of their email. My reaction? Your customers have just been hacked. They're probably checking closely what they click on in any email you send.
Pro Tip:
Using URLs that display as coming from csid.com but when hovered over show up as en25.com is probably not a peachy wonderful idea.
I happen to know that en25.com is eloqua (contact management service) and could check that it was probably legit, but most would figure it was a fishing attack sent out on your compromised email list.
Stratfor may be trying, but they're still doing some seriously newbie things as far as customer contact let alone the glaring errors the initial security of the servers and credit card data that were hacked.
Well, thanks for the info. I haven't touched a RPM based distro in about 10 years, too much RPM hell with shared libraries and nonworking compilers on RH distros. Forgot about their tendency to backport, thereby creating dependence on RH.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
I don't think it makes any difference in principle what the distro is, apart from rolling releases. For example debian squeeze:
root@testvm:~# dpkg-query -p apache2 | grep Version
Version: 2.2.16-6+squeeze4
I'd be surprised if that did not include the latest security patches.
I don't use anything that doesn't just pass on the upstream, so I wouldn't know.
I'd rather just have the Apache (or whatever) release and not have to deal with the delay and potential for problems associated with someone else modifying and redistributing the upstream. The idea that, if I don't like the package maintainer's speed or choices, that I can just grab the upstream directly, compile, and slide it into my distro with minimal reconfiguration is fairly appealing also.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.