Slashdot Mirror
LexisNexis and Other Major Data Brokers Hacked By ID Theft Service
gewalker writes "Have we reached the point where it is time to admit that the ID thieves are winning and will continue to win as long as their incentives are sufficient to make it lucrative for them? According to Krebs On Security an analysis of a database pilfered from commercial identity thieves identified breaches in 25 data brokers including the heavyweights Dun and Bradstreet and LexisNexis."
And they had access for months to most of them. From the article: The botnet’s online dashboard for the LexisNexis systems shows that a tiny unauthorized program called nbc.exe was placed on the servers as far back as April 10, 2013, suggesting the intruders have had access to the company’s internal networks for at least the past five months. The program was designed to open an encrypted channel of communications from within LexisNexis’s internal systems to the botnet controller on the public Internet." The companies compromised aggregated data for things like "credit decisions, business-to-business marketing and supply chain management. ... employment background, drug and health screening."
Probably meant http://en.wikipedia.org/wiki/Intrusion_Countermeasures_Electronics
Lexis Nexis has a database of all united states citizens compete with full address history, SSN, DOB, associations such as relatives and neighbors, and you can cross reference and search the different relationships. They purchase the info from the government and then banks use them to verify information on credit applications by paying for the service and simply accessing a web interface via ssl over the public internet. I know this because I used to work for a large bank doing just that.
Any IDS/IPS is only as good as its signatures. The problem with these devices is that attackers can use a flurry of heuristic tactics to completely bypass these systems as well as DLP. There is a difference had you mentioned SIEM which *may* have worked if there were vigilant analysts looking at logs repeatedly. In order to understand why IDS/IPS' fail, you need to understand attacks. At any point in time, when I perform pentests, I ALWAYS start off sending a barrage of data to generate junk. This is done for a few reasons: 1) it tests responses from DFIR teams and 2) allows me to get in under the radar. Now when you state: "machines communicating encrypted data to site out on the Internet is something that IDS applications are designed to detect" you're 10000000% wrong. Any IPS/IDS admin doing this is giving themselves a headache. Do you have any idea how many false positives it would generate from employees going to log into say Gmail, their banks, or anything else using SSL.
http://en.wikipedia.org/wiki/Intrusion_detection_system
http://en.wikipedia.org/wiki/Intrusion_prevention_system
I believe there is more going on to this than you would understand. For example, the Zeus/Qakbot strain always downloads a file. Most times it will be randomized. For arguments sake, lets say it was named nbc.exe. What Zeus/Qakbot did was communicate out via IE. Even though the nbc.exe was the application responsible for running the show, the communications portion was done via good ole GET and POST via HTTPS. At issue with detecting nbc.exe where Zeus/Qakbot was/is concerned, is the fact that the operators of the malware were/are changing the executable N amount of hours. So most AV systems wouldn't even detect it. So no... IPS/IDS here means nothing. Blacklisting *may* have worked to stop the communication, but even then a fast flux would have trumped that.
You're missing the gist of it here. The reality on production server is, most are locked down from egress attacks. This does not stop, minimize, and or deter an attacker from hitting you up with a client side attack on a non-production machine, passing a hash, then to and from trusted sources until it gets out: Attacker --> client side --> workstation workstation --> attack --> production server production server workstation workstation --> via SSL --> attacker. This would fill a wiki page so I will stop there. There was a point to be made without me having to spell things out
Freeze your credit.
I was the victim of identity theft. Someone got access to my name, address, SSN, and DOB and used it to open up a credit card account in my name. (Thank you, Capital One, for not caring that the Mother's Maiden name was wrong! And for stonewalling both me and the police every step of the way in the name of YOUR liability.)
The credit agencies will recommend fraud alerts but these have two major flaws: 1) They are optional. Credit Card Company A *should* check for a fraud alert before issuing a credit card in your name, but doesn't *have* to. (You can bet that the ID thieves know which companies check and which don't.) 2) They expire after 90 days. Your information isn't going to magically disappear from the ID thieves after three months. It's out there for good now. So why should the check against ID theft expire?
If you freeze your credit then nobody (you or anyone else) can open a new line of credit on the account. If you actually do want to open a new line of credit (or get a loan or have a background check performed), you thaw your credit report for a set period of time. The downsides are that you have to pay for each thaw and you can't sign up for credit on the spot. (We actually consider the latter to be a perk. "Would you like to save 10% by getting our store card?" "No thanks. Credit frozen thanks to ID theft.")
Of course, the credit agencies HATE credit freezes because they make money by offering your credit file to anyone and everyone to send you offers for credit cards and the like. A frozen credit card file takes away that income opportunity.
Come to think of it, that's another bonus to freezing your credit file.
This site has some good information on Credit Freezes including links/phone numbers to freeze your credit file: http://www.clarkhoward.com/news/clark-howard/personal-finance-credit/credit-freeze-and-thaw-guide/nFbL/
My sci-fi novel, Ghost Thief, is now available from Amazon.com.