Slashdot Mirror
LexisNexis and Other Major Data Brokers Hacked By ID Theft Service
gewalker writes "Have we reached the point where it is time to admit that the ID thieves are winning and will continue to win as long as their incentives are sufficient to make it lucrative for them? According to Krebs On Security an analysis of a database pilfered from commercial identity thieves identified breaches in 25 data brokers including the heavyweights Dun and Bradstreet and LexisNexis."
And they had access for months to most of them. From the article: The botnet’s online dashboard for the LexisNexis systems shows that a tiny unauthorized program called nbc.exe was placed on the servers as far back as April 10, 2013, suggesting the intruders have had access to the company’s internal networks for at least the past five months. The program was designed to open an encrypted channel of communications from within LexisNexis’s internal systems to the botnet controller on the public Internet." The companies compromised aggregated data for things like "credit decisions, business-to-business marketing and supply chain management. ... employment background, drug and health screening."
No real excuse for this. This is exactly what network IDS/IPS programs/appliances are for.
Any data center dealing with sensitive information should have an IDS/IPS installation which should have shut down nbc.exe's access out to the Internet, or at least raised a red flag in Splunk or whatever logging console application in use. Most data centers have a list of authorized IPs that internal sites communicate out to, and if some machine communicates to an IP repeatedly on a sensitive network, it would be investigated, or at the minimum, looked at. Multiple machines communicating encrypted data to site out on the Internet is something that IDS applications are designed to detect, and IPS offerings designed to cork until someone takes a look at it.
Security isn't rocket science. It is using basic concepts to compartmentalize information and applications to check for known/unknown attacks, and buying/using the tools needed.
Why should the likes of Dun & Bradstreet or LexusNexus have any fun at all?
Laughter is the Spackle of the Soul.
Dot exe. I think I see the problem.
This might be a good thing. Once we have a major "privacy apocalypse" and millions of people get screwed over something might be done about it. Otherwise there will just be endless "minor" breeches where a few hundred thousand people get ripped off and no-one really cares.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Lexis Nexis has a database of all united states citizens compete with full address history, SSN, DOB, associations such as relatives and neighbors, and you can cross reference and search the different relationships. They purchase the info from the government and then banks use them to verify information on credit applications by paying for the service and simply accessing a web interface via ssl over the public internet. I know this because I used to work for a large bank doing just that.
So how do I opt-out? Where do I get away from companies releasing my information to third parties that track my identity or other things to allow other corporations to peruse at their leisure? Not only do you not get to tell companies where they can and can't store your personal information, you also can't dispute that information when someone uses it for the wrong reasons or enters things that you're not allowed to know about.
For example, let's say LexisNexis had an entry that said I caused a major auto accident involving 15 cars, because an insurance clerk pressed the wrong button that said I was at fault rather than being involved in the accident? How do I correct that data? How do I dispute that entry? How do I even find out about that information?
And how do I get them to delete my personal data rather than allowing their poor network security policies to expose my life to risk? Answer: I can't. I have no agreement with them to host my personal data. I'm not just upset about the breach, I'm upset about the lack of ownership and consequence of such regarding my own life.
Seems like the only way to combat identity theft now is just "loose" your credit card every few months and get a new number. I don't see any other way to mitigate identity theft as long as places like Heartland Payment Systems and LexisNexis are going to just give away the keys to the kingdom through gross negligence, apathy or ignorance.
Join the Slashcott! Feb 10 thru Feb 17!
This should have been easy to catch with their IPS. Why is their an encrypted data stream going from a server to a server outside the organization? Even without using an SSL decryption device to look at the contents of the stream, the mere fact that an encrypted stream of data was going to an unauthorized destination should have set off alarm bells by it's own right.
I've seen any number of environments that simply blocked encrypted data sessions until they had been white-listed. It's something that ought to be in your change management system along with all of your other firewall rules. The fact that a major credit agency got owned by this tells me that they probably outsourced their security to India along with the rest of their staff.
Let's stop calling it that. These numbers we call our identity is not our identity. The whole notion of doing things like this were an invention of mega-business interests who wanted to expand their business range without having to employ a whole bunch of people. You see, long ago, people were given credit by a process which involved references... actual people who could vouch for your reputation. But this is too much of a hassle and involves the use of people and people, of course, are very expensive. So much better to track a whole bunch of people with a computer system where they are tagged with a unique number -- say a social security number which we were promised would never ever ever be used for anything but social security account tracking. Several legal filings surrounded the controversy long ago but the serfs of the USA lost out and here we are.
Stop feeding the machine. Stop being in debt. Stop relying on credit and build a savings instead. It's harder to get started if you're already accustomed to the debt financing game, but it's the difference between LIFO and FIFO where your money is concerned. Stop spending money you don't have. Of course, this message goes out to people who aren't reading this... everyone here has "good reasons" for using credit instead of cash.
It's far more likely that they would spread wide open goatse.cx style for the NSA without having to be hacked for a stipend. Probably some other gov'ts trojan.
My experience is pretty much entirely large enterprise, which means working in environments such as you describe. As you said you 3124 active SSL connections. Start by filtering out which ones are going to sites you know are legitimate. That should filter a fair amount right there, than you start filtering out those connections that are external.
Once you have filtered out the destination ranges for the known good sessions you have a far smaller set of SSL connections to investigate. Look at the source and destination IP addresses of those that remain and start finding out who they belong to and start building a white list.
There may be a very legitimate reason to have an SSL session setup with Estonia (I've seen some great programmers work from there) or not. The point is that you treat SSL connections just like you would firewall ports. What's your destination, source and what are you using it for? The entire idea is to look for SSL connections from servers that you don't already know about. You don't want to investigate all of them, just the new ones that pop that aren't on the change management white-list.
I don't mean to make this sound trivial, it's not, but the process itself is fairly easy. Your working for a large enterprise by the sounds of it, chances are your on a team with a number of security people available and enterprise class resources. It's really just a matter of doing the legwork to run things down. Now if you don't have any kind of change management in place and have to chase down all 3124 connections to find out who's doing what it's no longer easy, but that is an entirely different story.
My guess: 'nbc' here is short for "NSA Botnet Communicator."
Then again, it might never have been found if they'd been smart enough to name it "svhcost.exe" [sic] or "winupdate475YWHV63275278592,bat"
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
Is why does LexisNexis, which has been around since at least the 1970's, trust the use of Microsoft Windows to their server infrastructure. Sounds like they really dropped the ball here. Hopefully heads will roll on this one.