Slashdot Mirror
JP Morgan Chase Breach Compromised Data of 76 Million Households
JakartaDean writes with news that the cyberattack on J.P. Morgan Chase this summer resulted in stolen information on 76 million households and 7 million businesses. The compromised data included names, email addresses, phone numbers, and addresses. The bank said the attackers were unable to gather account numbers, social security numbers, or passwords.
The hackers appeared to have obtained a list of the applications and programs that run on JPMorgan's computers — a road map of sorts — which they could crosscheck with known vulnerabilities in each program and web application, in search of an entry point back into the bank's systems, according to several people with knowledge of the results of the bank's forensics investigation, all of whom spoke on the condition of anonymity. ... Even if no customer financial information was taken, the apparent breadth and depth of the JPMorgan attack shows how vulnerable Wall Street institutions are to cybercrime.
To Big To Be Accountable
Politics; n. : A religion whereby man is god.
"If you still have it it is not stolen."
*mv* is theft, *cp* is not.
... Everybody listens.
This is the best restaurant I ever eat in
The hackers appeared to have obtained a list of the applications and programs that run on JPMorgan's computers — a road map of sorts — which they could crosscheck with known vulnerabilities in each program and web application
I find this interesting because it shows both the usefullness but ultimate inadequacy of security through obscurity. Had the hackers been unable to obtain this information, the implication is that the breach would not have happened, or at least not happened as soon. Without the ability to create a road map, they would have had to take the less efficient approach of randomly guessing and probing with the hope that something worked. So keeping that list of applications and programs a secret has some value.
On the other hand, it underscores the importance of the point that people have been making about security through obscurity for decades: it's very weak security, and once that layer of the security onion is breached, there had better be stronger security layers underneath. Like patched and updated programs and web applications that close known vulnerabilities. I'm guessing that didn't happen, because the JP Morgan Chase management has probably acted like many other management teams I've had the "pleasure" of working with - they placed higher value on the secrecy than actually fixing stuff, because the former costs less, and it kind of works until it doesn't (and then that policy fails in a big way).
I sincerely hope that these breaches light a fire under the asses of lax management at these large companies and they realize that spending the time and resources to *really* secure their systems is worth it in the long run.
And then I laugh sadly, because that's wishful thinking.
six months ago and went over to USAA. Best thing I ever did banking wise. I left because of Chase's nasty debacle with the London whale and the way they handle business. I don't want to reward shady behavior. It angers me that they behave in this manner yet their CEO gets millions in bonues. No way I can support this...
I seem to recall hearing JP Morgan and FIVE other banks were compromised in this attack. At the time, the news (and /.) only mentioned JP Morgan by name. The consensus as I remembered was the other five banks were small and WERE too little to fail.
Well, I would still like to know who these other victims were. What if it was a banking institution I use? I want to know if I have been exposed.
Maybe it's time for the law to require notifications and possibly penalties to those institutions which don't take cyber security seriously.
... legislate to regulate.
Until the likes of JP Morgan Chase feels pain, this crap will continue.
We need security liability laws.
It little behooves the best of us to comment on the rest of us.
Why have Visa and Mastercard not changed their purchase validation system?
A static number that, once discovered, allows anyone to make a purchase until that number's use is deactivated? I should have 2-factor auth on all purchases, my credit card number should only act as a public key, or I should have the ability to generate new disposable numbers on the fly.
They've pushed this nominclature of "identity theft" (which attempt to make consumers feel as though they've been robbed) when in truth these are just cases of fraud that were made possible and likely because Visa and Mastercard haven't improved THEIR security for about 20 years.
We should learn what we need to know about issues, before we decide what we need to feel about them.
Sounds like NSA technology and technique. Escaped into the 'wild'?
http://www.spiegel.de/international/world/snowden-documents-indicate-nsa-has-breached-deutsche-telekom-a-991503.html
Who did what now? We don't know! So we're throwing out lots of scary sounding words out! But we're not informing, shame on us. -- the journo hacks.
...they used to print all of that information up in a four-inch-thick book and leave it on your doorstep every six months or so. (Minus the email addresses, of course.)
Chase is really spinning this by saying that no sensitive information was taken in the hack.
Well, it seems that the crackers now have tens of millions of *confirmed* Names, addresses, phone numbers, and emails at the very least. That is a freakin treasure trove of information.
I like my privacy and take great care not to let information out into the world. But Doctors, banks, and gov always want every bit of info on you so they make the best targets.
There are only 115 million households in the US. JP Morgan lost info on 76 million. I find it hard to believe that 2/3 of the households in the US are JPMorgan/Chase customers.
I wonder if the info stolen was actually some sort of master marketing file, perhaps from one or all three of the credit bureaus.
Reminds me of a post I saw on Twitter the other day:
"Why hack celebrity nudes? Do something useful - hack Experian and give us all 800 credit!"
Personally, I thought it a brilliant idea.
-- CanHasDIY, too lazy to log in
> Why have Visa and Mastercard not changed their purchase validation system?
This story has nothing whatsoever to do with credit cards. The bad guys got a list of names and email addresses - a phone book.
76 million households? Isn't that the entire population of USA?
Why have Visa and Mastercard not changed their purchase validation system?
Really? You have to ask why Visa and MasterCard who are paid a percentage of every transaction haven't made it a bigger PITA to make a transaction with one of their cards?
Are you unaware that most of the costs of a fraudulent transaction fall on the merchants?
When they implement EMV card security in the US they aren't even going to require a PIN to authorize purchases because American consumers might forget their PINs and end up putting fewer transactions on credit cards.
Soon we'll ALL be Anonymous Coward.
Then we can finally correctly implement our socialist utopia. Everyone will always get first post.
According to the TV news this morning, the breach was one employee password. One employee password granted this level of access.
My workplace gets regular audits from our clients, usually every 3-24 months depending on how big/paranoid the client is. JP Morgan Chase is one of them.
We could tell the audit this summer was a bit different. It took about twice as long and went into much more detail than usual specifically regarding our tech side. After the audit, we got an unexpected list of demands related to stopping leaks.
Now, we don't handle sensitive financial information for them, so it's possible they were just trying to cover all their bases and we got stuck with security theater. Irritatingly, everyone in IT immediately recognized that the demands wouldn't actually prevent leaks. When you have a company full of employees who regularly use FTP, email, and even dropbox to send files to clients, you're simply not going to be able to prevent it.
After months of back and forth trying to kill some of the more ridiculous demands -- like blocking access to Gmail, which we use for company email -- they simply wouldn't budge. We've been wondering why they're standing so firm about it, and now it all makes sense.
that if i took a little bit of time on Google, I could find all this information as well...in the yellow pages...SMH
There are three kinds of people in the world. Those that can count, and those that can't.
That can only means one thing:
BIG BONUSES for JP Morgan execs this year!
The compromised data included names, email addresses, phone numbers, and addresses.
Holy defecation Batman! Hackerz stole a phone book!
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
I have worked with JPMC several times, and can tell you you are way off base. They spend an ENORMOUS amount of money on IT and especially security.
No system is perfect. Given enough incentive, anything can be broken. And, make no mistake, there is a TON of incentive to successfully breach a banking system. In fact, it would seem that the fact all they got was names, etc, and not banking details, shows that there systems are not near as weak as you think.
As someone who has done research on banks and disclosed security holes (plug -- live exploits posted to http://privacylog.blogspot.com... not always obvious, not always interesting) I can tell you NOBODY cares.
I am still working up the balls or requesting legal advice to tell me I am in the clear so I can tell you the details. But to summarize, there are still **egregious** security failures out there and they can be found by just one person. If you find one of these things you will see too that it is possible to get the federal and industry agencies on the phone that you would expect to be interested in this stuff. But it is purely a courtesy. As soon as you hang up, they will go back to focusing on botnets or revenue-impacting issues.
-- I was raised on the command line, bitch
That phrase is quickly turning into the newest oxymoron.
Hey I know lets stitch together these 8 completely open and utterly un-certifiable frameworks, have everything talk to each other through XML files, store high value passwords in them so we can just look at the database like a black box. Then lets expose all that to the world of hackers and madmen and then act surprised when we discover its been broken into!
Hey KID! Yeah you, get the fuck off my lawn!
> ! You shouldn't be able to obtain a static number and then have the right to start charging money. . The story just highlights how wrong the current system is.
No, it doesn't. The story has absolutely nothing whatsoever to do with credit cards. That's a completely unrelated topic. Maybe credit card numbers are stupid, maybe Obama is stupid, maybe you're stupid. This story has absolutely nothing to do with any of those things.
Well, that's hardly comforting. So even spending an ENORMOUS amount of money on IT and security can't prevent your system from being breached in a big and spectacular way? Then either that enormous amount of money was spent poorly, or that information should not have been exposed to the internet in the first place until it was properly secured. They were breached, in a big way. So their systems were exactly as weak as I think, enormous expenditure aside. I fail to see your point. "They tried REALLY hard" doesn't count for beans if they don't succeed.
Doesn't Chase SELL this info to every Tom, Dick, & Harry who ponies up a few bucks?
"The point" is that no system is, or will ever be, perfect. You are the one making the claim that they are too cheap to patch systems, etc. They aren't.
Even with their precautions someone breached them. That does not mean the money was not well spent, it just means that their system (including all the users of their system) is not perfect. I suppose YOU could make a 'perfect system' for them?
Of course they COULD have kept that valuable customer name/email information off the internet. That would kind of make it impossible to offer on-line banking (something probably 99% of their customers want), wouldn't it.
There will ALWAYS be tradeoffs between usability and security. A perfectly secure system would be virtually useless. The trick, of course, is finding the right balance. A breech like this does not show that balance is not currently right.
You also forget that there is spending a metric shit ton of money on products and actually being effective. Working in the field of computer security I see an awful lot of buy our magic product and it will do everything but get the cute girl in accounting to suck you off type of stuff. When you actually dig in you find out that most of it is a presentation targeted towards managers who know buzzwords and PowerPoint slides but the tool is completely worthless. I'm looking at you "event correlation tools" as they seem to be the popular ones now. Then there is the check box security where they buy products to check something off but never configure it properly. Why yes we have LDAP, network firewalls, as well as a software firewall on each host, none of them do a fucking thing but they are all fully patched. Don't forget your AV that you never bother to check the results of. I go to customer sites all the time most of which are targeted by state actors and there is a lot of check box security and security theater that they have spent a lot of money on but there is real functional security as well that even in it's limited capacity stops most things. Think of it like this it is the difference between what is done in Israel for airport security and what is done the the US for airport security, one wastes a lot of money for no real actual security but looks like it is doing something while the other actually stops threats and secures things.
Time to offend someone
Well that's an unexpectedly gracious and humble reply to a post which included the words "maybe you're stupid".
I'm sorry for including those words. Maybe you're a gentleman and a scholar, fine sir.
JPM's audits have been "qualified" by PWC for the last couple of years, because (despite inhouse reports) the CIO has refused to implement proper controls. People in JPM who have reported these problems have been fired - from what I've heard, three heads of Risk Management have been fired in the last three years, each time after telling the CIO that he needs to fix these before their pension fund clients have to take action.
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/