Slashdot Mirror
Microsoft: 'Unlikely' Credit Card Details Lifted From Xbox 360s
An anonymous reader writes with this excerpt from ZDNet: "Security researchers from two universities say they found how hackers can retrieve credit card data and other personal information from used Microsoft Xbox 360s, even if the console is restored back to factory settings and its hard drive is wiped. Microsoft is now looking into their story of buying a refurbished Xbox 360 from a Microsoft-authorized retailer, downloading a basic modding tool, gaining access to the console's files and folders, and eventually extracting the original owner's credit card information. Redmond is still investigating, but it's already calling the claims 'unlikely.'"
This just seems more like bad mouthing about MS and XBOX360. It was already debunked on Slashdot too, because MS doesn't store credit card details on the machine. They only store account details. Microsoft is right - this is just some unfounded rumor that has no basis on reality.
Bad: 'Unlikely' Credit Card Details Lifted From Xbox 360s
Better: 'Unlikely' that Credit Card Details have been Lifted From Xbox 360s
See the difference?
You're special forces then? That's great! I just love your olympics!
IIRC, Sony said something very similar at the beginning of the PSN breach--something along the lines of "This was a minor incident. It was probably only a few accounts. Nothing to see here."
What political party do you join when you don't like Bible-thumpers *or* hippies?
I've been hit twice by fraudulent charges relating to XBox accounts on my CC. The common denominator in both cases was using this particular card at the same gas station in Panama City, FL.
In both cases, several XBox accounts were charged to my card. Microsoft for whatever reason cannot reverse the charges - they actually instruct you to file a complaint with the CC (and in both cases the charges were reversed).
I don't even own an XBox and convincing both MS and the CC of this fact is very difficult.
oh wait this about xbox isn't it
Remember MS-12-020:
Microsoft’s Security Research and Defense Blog stated that they expected to see exploit code in the wild within 30 days according to a quote from their recent blog post addressing the flaws: ”During our investigation, we determined that this vulnerability is directly exploitable for code execution. Developing a working exploit will not be trivial – we would be surprised to see one developed in the next few days. However, we expect to see working exploit code developed within the next 30 days.”
3 days later.......
Well at least MS denies it. Apple just covers it up.
I think there are probably a 1000's different ways to get credit card numbers. Finding them old xbox hard drives is going to be one of the more difficult ways to gather them.
This is the standard boilerplate reply from almost any organization that has been publicly exposed as being compromised. They'll continue to tell the world it's the most minor, harmless possible case until lolsec, wikileaks, etc posts a dump of 10k credit cards or something, and only then will they begin to admit the actual scale of the breach.
In addition to laws that punish groups for being negligent in their security of private data, I'd like to see additional punishments passed out to companies that outright lie about the severity of security breaches. A bit like how the judicial system comes down harder on you if you are convicted after pleading innocent. Tried to game the system? Lost? --> Additional punishment, to discourage others from trying it as a standard response, "because they have nothing to lose"
I work for the Department of Redundancy Department.
If you can get the credit card details off a 'reset' XBox, can you also get photos from the Kinect off it? Seems to me you could make a fake ID with the amount of information you can scrape off an XBox!
this is just some unfounded rumor that has no basis on reality
It's more than a rumour, it's a research paper from some forensics experts that has been submitted to a conference. Of course, that does not mean that it is correct, and afaik it has not been published yet.
The PDF (found via xbox-experts.com:
Identity Theft and Used Gaming Consoles: Recovering Personal Information from Xbox 360 Hard Drives
The relevant text shows that they just got a credit card hit from some forensics tool:
Performing a fast scan on one of the drives resulted in a possible credit card hit as demonstrated in Image 10. Although this does not definitively prove there are any credit card numbers on the hard drive, it is highly probable given the results obtained. The Bank Identification Number in this hit identifies this as a Bank of America Discover Card [37].
The authors appeal to have credible prior experience in digital forensics:
Dr. Asley L. Podhradsky, Drexel University
Dr. Rob D'Ovidio, Drexel University
Cindy Casey, Drexel University
They have published work on XBOX 360 previously, so they may have some experience in this specific area (or not):
The Xbox 360 and Steganography: How Criminals and Terrorists could be Going Dark
A Practitioners Guide to the Forensic Investigation of Xbox 360 Gaming Consoles
After seeing the original article I tried finding my own credit card number on my xbox hard disk. Through a search of the entire hard disk not even the first 4 digits of my credit card were found, which is part of the issuer identification number. http://en.wikipedia.org/wiki/List_of_Issuer_Identification_Numbers
Additionally- the article that put this scare on found a number that matched the issuer identification number for a Discover card issued by Bank of America. Microsoft doesn't even take Discover cards. You can't even give this credit card number to Microsoft's system for storage. I find it very hard to believe that Microsoft is storing the credit card number of a card they can't even process.
I think they should be applauded, for using the word "unlikely" instead of "inconceivable".
Ashley L Podhradsky, Doctor of Science in Information Systems
Education:
Doctoral Information Systems, Specializing in Information Assurance, Dakota State University
M.S., Information Systems, Specializing in Network Security, Dakota State University
B.S., Electronic Commerce and Computer Security, Dakota State University
Certificate: Computer Hacking Forensic Investigator, AccessData Certified Examiner
Areas of Expertise:
Computer Forensics
Digital Forensics
Consumer Privacy
Risk Management
http://goodwin.drexel.edu/sotaps/Ashley_Podhradsky.php
Vs
Jim Alkove
Aliases and Other Names: James Alkove
Bio
Software Design Engineer at Microsoft Corporation
Career
Microsoft Corporation
Software Design Engineer
Achievements and Recognition:
.
.
.
http://www.spoke.com/info/p1N6wTr/JimAlkove
"I've got more toys than Teruhisa Kitahara."
I like this story
Really, who cares? Here is what happens with credit card number fraud. It is used once or twice, the bank catches it early because they watch for unusual spending patterns, sometimes even the vendor does (at places like jewelry or electronics merchants where fraud is more common, and insurance against theft becomes expensive), they expire the number and reissue you a card. The vendor gets reimbursed from insurance against theft. Sometimes you get a phone call, asking if it's really you, based on contact information at the bank, not given at the POS. I don't know a card issuer in the world that would hold you liable for "forensic recovery and fraudulent use of a number recovered from a discarded electronic device." It gets added to the premiums of the vendor's theft insurance, if they don't catch it, and they often do.
You all should be more worried about all those bank people and vendors tracking and monitoring all your purchases, and perhaps sending your daughter expectant mother mailers.
As for the "stolen" number, they can have it for as far as it will get them. If you're deeply concerned about this "problem," you should consider waiters and cashiers with eidetic memories to be a more clear-and-present danger than forensic analysis of discarded hard disks.
It surprises me that so many people actually enter their CC info into their XBox.
Shucks, if it weren't for nice, anonymous, paid-for-by-cash MS Points cards, I wouldn't have any DLC on my box at all...similar to nice, anonymous Visa gift cards for Android Market (sorry, Play) purchases...and nice, anonymous iTunes gift cards for (shudder) iTunes* purchases.
* living in Canada sucks sometimes...we're so close yet at the same time so far from being able to buy digital content from the myriad of vendors available just south of teh border...I would love to switch my music buying habits to Amazon or Google, or try out Pandora, Spotify or Hulu, but I'd have to pretend to be in the States to do so. *sigh*
"I love animals! Some are cute, others are tasty, what's not to like?" - Betsy Schroeder, Jeopardy contestant
The PDF (found via xbox-experts.com:
Identity Theft and Used Gaming Consoles: Recovering Personal Information from Xbox 360 Hard Drives
So, they downloaded a commercial version that does the equivalent of "grep -a '[0-9]\{15\}' /dev/sda" and found a few 15-digit numbers ("OMFG! NUMBERZ! Those must be CREDIT CARD NUMBERZ! What else should there be NUMBERZ for?") in a 250 gigabyte dataset mostly consisting of random savegames, artwork (title caches) and media.
That's... impressive. Impressively stupid for two PhDs and a Research Assistant. And *they* have published work on Xbox 360 before?
It seems they saw Sony get its pants yanked down to its ankles, and all the consequent lawsuits, and thought to themselves, "We could apply the stunning engineering talent we've always claimed to have in this company to audit our systems, network architecture, and customer info handling processes to ensure such a thing never happens to us or our users... Or, we could forbid our customers from suing us."
Schwab
Editor, A1-AAA AmeriCaptions
It occurs to me that *maybe*, the only card info that winds up cached are not the VALID ones MS processes and accepts, but rather, cards like this which don't actually work on the network? (If so, that could be a bug in the XBox code, where they purposely refrain from caching or storing cards that successfully process, but neglected to consider people entering good, valid cards which simply aren't the right TYPE (Discover or AmEx).
Except they have a point. The card number found was a Discover. Microsoft won't even let you enter a Discover to sign up for Live or buy points.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".