Consumer education key to cybercrime war

Is it better to try to chase down cybercriminals, or educate computer users? That’s the ongoing debate among security experts.

On one hand, there have been some huge victories recently in the battle against the bad guys. This week, three men were arrested in connection with a creating a “botnet” that infected an estimated 13 million computers from 190 countries and stole personal and financial information.

In 2008, the alleged mastermind of the largest cybercrimes in history was arrested. Albert Gonzalez is responsible for the greatest data breaches in history, including Heartland Payment Systems, TJX, Hannaford Brothers, 7-Eleven, Citibank, J.C. Penney, and Dave and Buster’s, according to his indictments.

Gonzalez also supervised an online forum in which more than 160 million credit cards, birth certificates, Social Security cards, PIN numbers and computer login information was exchanged.

So, the good guys must be winning the war, right? Probably not.

Security firm Symantec says it identified 2.9 million discrete viruses in the last 15 months—more than the total found over the last 18 years.

“The virus writers and the Trojan [horse] writers, they’re still out there,” said Tom Karygiannis, a computer scientist and senior researcher at the National Institute of Standards and Technology. “So I don’t think they’ve deterred anyone by prosecuting these people.”
It would be smarter, Karygiannis said, to develop new anti-virus technologies and to teach people how to protect themselves from Internet crime.

Considering the magnitude of these recent hackings, how can individuals protect their computers and their information? What can they do to protect themselves from massive data breaches when many corporations and financial institutions aren’t applying even the most basic security practices?

Individuals can protect themselves in two ways: They can follow the basic rules of PC security, and subscribe to services that comprehensively monitor their financial and identifying information.

To protect PCs:
• Never click on attachments in email or instant messaging, or from social media if you don’t know the sender.
• Install a firewall.
• Install security software with anti-malware.
• Use the latest operating system.
• Immediately apply patches and updates.

The second line of defense—monitoring your information—is best left to the professionals. The fact is, their technology and resources are more powerful and effective than anything available to individuals. Additionally, overseeing every aspect of your identity and finances is a full-time job.

LifeLock now provides an extensive suite of services designed for the utmost in security. Command Center™ watches illegal Internet forums, court records, peer-to-peer (P2P) networks, payday loan applications, address change requests, and requests for mortgages, utility hookups, cell phone contracts and more. If they ever detect an indication that your information is being misused, they contact their member immediate and begin remediation and restoration services.

Bookmark It

Hide Sites

LifeLock and Life Quotes team up to protect consumers and help them save money

LifeLock has partnered with Life Quotes to bring more consumers an opportunity for more complete identity theft protection to safeguard their personal finances and their personally identifying information.

It is a perfectly logical marriage of the leaders in their respective industries. LifeLock has long been considered the industry leader in proactive identity theft protection services, and Life Quotes was the first company to provide consumers with comprehensive insurance comparison services.

The collaboration also joins two companies committed to serving consumers looking for the best value in the products that protect their families and finances. That mission has become doubly important at a time when so many families are affected by the economic downturn.

“Through this partnership with LifeLock, we hope to provide our users with a necessary tool for helping to protect against identity theft. Just as life insurance and other forms of insurance are important protection measures, an identity theft service is crucial to keeping a stronger hold on finances.”

Since its inception in 2005, LifeLock has consistently provided its members—now numbered at more than 1.6 million—with innovative, effective identity theft protection services.

Last December, LifeLock introduced Command Center™, a suite of global protections that scours public records, bank check reorders, payday loan applications, court documents and sex offender registries for any signs of misuse of their members’ personal or financial information. Should any red flags appear, LifeLock immediately contacts their member by phone and email and begins remediation and recovery work with them.

The following year, LifeLock introduced eRecon™ and TrueAddress™, services that continually monitor Internet sites for evidence of identity theft warning signs.

In 2007, they introduced WalletLock™, to help members immediately with lost or stolen wallets cancel and replace their driver’s licenses, Social Security cards, credit and bankcards, etc. WalletLock™ allows consumers to stay a step ahead of would-be identity thieves.

Life Quotes has been similarly innovative in the services they have been providing consumers since 1984 when they incorporated as Quotesmith. Thanks to Life Quotes, consumers can visit a single website to compare products and prices for their autos, health, homes, boats and businesses. That means a savings of time and money at a time when people are experience a shortfall of both.

To learn more about LifeLock and LifeLock Command Center, visit http://www.lifelock.com. Enroll using the promotion code DEFENSE to save 10% and receive 30 days of free coverage.

Bookmark It

Hide Sites

Data breaches in hotel industry higher than any other sector in 2009, according to Trustwave report

Which is most worrisome: (A) that hackers hit the hotel industry in 38% of data breaches last year; (B) that it took the hotels an average of five months to notice a data breach; (C) that the hackers often got into the data by using software glitches that had patches available 10 years ago; or, (D) all of the above?

A new report from security firm Trustwave indicates that the hotel industry was targeted for data breaches more than any other last year primarily because they were such an easy target and the takings were so rich. The hackers gained access to potentially millions of credit card account details from hotels that did little to protect the data, and never reported the resulting identity theft risk to officials or customers. (Picture a frisky young pit bull gleefully trotting after a fat, blind, three-legged cat while the cat’s owner sleeps in a hammock nearby.)

Nicholas Percoco, a Trustwave security auditor and data breach investigator, presented the report at an annual gathering of cyber security experts, the Black Hat Conference. The data was drawn from the results of 1,900 audits and 200 post-data breach investigations.

The Trustwave report also points out an interesting negative correlation between sectors that proactively hired Trustwave to attempt penetrations to identify weaknesses, and those sectors that hired Trustwave to conduct post-data breach forensic investigations. Last year, companies in the hospitality industry accounted for only 3% (roughly 60) of the 1,900 proactive audits Trustwave performed in 24 countries last year. However, the hospitality industry accounted for 38% (roughly 76) of the forensic investigations they were for after data breaches had taken place.

Most companies avoid reporting data breaches if they can, but data breaches Radisson Hotels, Wyndham Hotels and Hilton Hotels all reported data breaches in 2009.

Bookmark It

Hide Sites

Father arrested for using dead son’s identity

It goes against the laws of nature for parents to have to bury their children. But, that’s what David Frank Pflegl had to do in 1987 as the survivor of an auto accident that killed his 19-year-old son, David Frank Pflegl II. It is probably one of the hardest most painful things for any parent to do. However, the senior Pflegl, 63, found a way to keep his son’s memory alive: he committed ID theft, forgery and communication fraud using his dead son’s identity, according to his December indictment.

Pflegl was arrested a week ago in Utah on the identity theft and related charges. Pflegl used his son’s identity to obtain a $140,000 mortgage in Lindon, Utah. He also had driver’s licenses in Oregon and Utah. Additionally, he held a passport in his deceased son’s name—a crime that resulted in a federal investigation by the State Department. Oregon investigators and the Utah Department of Public Safety participated in the identity theft investigation.

Pflegl owns a temporary power supply company and committed identity theft to obtain jobs and auto loans.

The identity theft is believed to have begun in 1995, when the father’s Oregon driver’s license was suspended because of all the traffic tickets he had accumulated. It was then that he first used his son’s information to obtain a new driver’s license.

Pflegle and his family moved to Utah in 2005, and Pflegle again committed identity theft, using the stolen information to get a Utah driver’s license. At the same time, he committed identity theft by using his son’s stolen identity to qualify for a $140,000 mortgage to buy a new home for his family because he had such bad credit.

There are active arrest warrants in the son’s name because his father continued to drive recklessly and be ticketed for it.

Officials say they believe there are more fraudulent loans still outstanding in the son’s name.

Bookmark It

Hide Sites

Identity theft and tax season

It’s tax season. It’s an annual occurrence, happening at the same time of year, every year. And in observance, here’s our annual phishing, scamming and identity theft warning with tips for avoiding getting taken to the cleaners … by anyone but the IRS.

Your mailbox

• If you don’t already have one, buy a locking mailbox before your W2 is delivered. Just think how easy it is to commit identity theft with just that one piece of stolen mail.
• If you’re going to mail in your tax return, don’t leave it in your mailbox. Instead, mail it from the post office or US Postal Service mailbox.
• Employers are required to send W2s by January 31. If you haven’t received yours within a few days after that date, call your employer to confirm it was mailed. If so, immediately order a credit report to see if you’re already an identity theft victim. Contact the IRS to alert them that your W2 may have been stolen.

Your phone

• The IRS would never call you asking for personal information regarding your taxes – that would be too fast and easy. If someone calls under this pretense, it’s a sure bet they’re vishing and are bent on identity theft.

Your computer

• Most people files their taxes over the Internet, leaving millions of people vulnerable to phishing scams. Just like the IRS would never contact you by phone requesting your personal or financial information, it would never email you asking for it either.
• Scammers often include a “click here” link within their emails. Never click on it. If you do you’ll likely be led to a website that will deliver spyware to your computer to commit identity theft.
• Using file-sharing software leaves your computer and all the information on it wide open to identity theft. If you share your computer with other people, make sure they know not to install file-sharing software for music or movie downloads.

Bookmark It

Hide Sites

Health Net data breach prompts attorney general’s “historic lawsuit”

Connecticut Attorney General Richard Blumenthal said last November that he was “outraged and appalled” upon learning of Health Net’s massive data breach and their keeping it hush-hush for six months. He acted on those feelings this week by filing suit against the insurer and its new owners, United Health Group and Oxford Health Plans.

The data breach occurred May 2009 when a hard drive containing the information of 1.5 million customers went missing. Records were for the period 2002 through 2009. Roughly 446,000 of the members are from Connecticut.

Blumenthal’s lawsuit asserts Health Net gave its employees inadequate supervision and training on appropriate maintenance, use and disclosure of protected health information.

The company explained the six-month lag time between their awareness of the breach and their notifying state officials by saying the time was necessary to complete a “detailed forensic review.” Kroll, a computer forensic consulting firm hired to complete the investigation determined the information wasn’t encrypted or protected in any way from access or viewing.

The unsecured data included a total of 27.7 million scanned pages of 20 types of documents such as insurance claims forms and medical records. Members’ Social Security numbers, names, birth dates, prescription information, credit card numbers and bank account numbers were exposed.

Blumenthal also alleges Health Net violated the Health Insurance Portability and Accountability Act (HIPAA) by not encrypting medical information stored on a portable electronic device.

“Sadly, this lawsuit is historic—involving an unparalleled health care privacy breach and an unprecedented state enforcement of HIPAA,” Blumenthal said in a statement.

Regarding the lawsuit, a Health Net spokesman said only that they’ve received a copy of the lawsuit and are reviewing it, and that they “will continue to work cooperatively with the Connecticut Attorney General on this matter.”

The company issued a statement in November when they notified the public of the data breach. In it they said, “Protecting the privacy of our members is extremely important to us. We apologize for any inconvenience or concern this may cause our members.”

Bookmark It

Hide Sites

It’s impossible to write about the Red Flag Rules without an apologetic “stop me if you’ve heard this one before” preface. So don’t shoot the messenger, but the deadline for the Feds’ identity-protecting Red Flag Rules has been delayed. The newest deadline—the fifth—replaces the January 1 deadline with one of June 1, 2010.

Congress created the program in 2003 in an attempt to stem the tide of identity theft by forcing creditors to use a common sense approach to identity theft prevention. It was originally slated to take effect in November 2008.

From its inception the rules have met with formidable pushback from the American Medical Association, the American Bar Association and the nation’s bankers, each group taking exception to the FTC’s interpretation of “creditor.”

According to the FTC, anyone who provides goods or services but allows for later payment is a creditor, but the FTC website explains the delays are because of an “ongoing debate about whether Congress wrote this provision too broadly.”

Ironically, the Red Flag Rules aren’t particularly onerous; they require only that businesses have written policies for recognizing signs of identity theft, training programs for their employees and response plans. In most cases, the entire process can be contained in a one-inch binder at the front desk or presented to employees within five minutes.

Perhaps the real contention is that powerful lobbies represent the doctors, attorneys and bankers that refuse to be regulated. Perhaps they don’t particularly care that the identity theft of millions of Americans could have been prevented since 2003 if only creditors were willing to take common sense steps to protect them.

Anybody want to place money on whether the Red Flag Rules take effect June 1?

Bookmark It

Hide Sites

Apparently, hackers stole even more of Express Scripts’ member information than was initially revealed last fall. An additional 1,771 New Hampshire residents are being sent data breach notification letters this week, according to a September 14 letter from Express Scripts.

Express Scripts, one of the world’s largest pharmacy benefits management companies, revealed in November 2008 that hackers demanded ransom in exchange for stolen customer information. Unless the ransom was paid, the hackers threatened to reveal the members’ information.

To strengthen their threat, the hackers sent personal information–including names, birth dates, Social Security numbers and some prescription details–of 75 of the firm’s 50 million customers.

Express Scripts publicly refused to pay the ransom, even after some of their customers received similar letters, extortion attempts and sample employee information. Toyota, government agencies and labor unions were among those contacted by the hackers.

In response to the hackers ramped up threats, Express Scripts offered a $1 million reward to anyone providing information leading the arrest and conviction of the hackers.

The identification of additional data breach victims in New Hampshire came from new information from the FBI, according to the recent letter sent from Express Scripts’ Vice President and Deputy General Counsel Janice Forsyth to New Hampshire Attorney General Michael Delaney.

It is unclear whether FBI forensics discovered more victims or the hackers contacted them with additional information.

Express Scripts has never revealed how many members were affected by the data breach, or how much ransom the extortionists demanded.

“There are thousands of companies that have already paid off extortionists in return for not having their customer’s data exposed,” Alan Paller said when Express Scripts made their initial announcement. Paller is research director of SANS Institute, a computer security training group.

“This is especially true in the financial industry, as some banks are getting more than one new extortion demand a day,” Paller said.

Bookmark It

Hide Sites

I just recently upgraded my LifeLock membership to include their new LifeLock Command Center™. I felt good about the services I was already getting from LifeLock, but because I know so many ID theft horror stories—some of them firsthand—I decided to pony up the extra $4 a month for the additional services available with Command Center™.

I’m impressed. Less than 48 hours after my upgrade I received extensive Command Center™reports from LifeLock that summarize the findings of all the efforts they’ve taken to protect me.

• LifeLock checked more than 10,000 websites for any fragment of my personally identifying information, i.e. Social Security number, address, birth date, etc. They also looked for any pieces of my financial information, i.e. bank account numbers, credit card numbers or PINS. This is part of the standard eRecon™, but with LifeLock Command Center™ I get the reports.
• They checked my county’s court records, as well of those as the Department of Motor Vehicles, Department of Corrections and administrative courts to make sure no one has usurped my identity or any part thereof to conceal their own identity when arrested. This is a new service available only with LifeLock Command Center™.
• They checked to be sure no one used my name, Social Security number or checking account numbers to take out payday loans—another new Command Center™ service.
• They specifically checked all sex offender registries for any piece of my identifying information, and sent me a list of registered sex offenders within my zip code. This service is only available from LifeLock with Command Center™.
• They sent me a record of all addresses I’ve lived at in the last 25 years. This allowed me to confirm no one but me has used my address or identity. I’ve never seen this list before, and it’s a comfort to see that there were no unfamiliar addresses.
• They’ve also started monitoring P2P networks for any of my information to make sure no one has taken advantage of programs like LimeWire to access the contents of my home computer.

And all of these Command Center™ reports are in addition to the standard eRecon™ and TrueAddress monitoring, annual credit reports and WalletLock™ protection I was receiving with my standard LifeLock service.

You can enroll in LifeLock or upgrade to Command Center™ here. Just use the LifeLock promo code DEFENSE to receive discounts.

Bookmark It

Hide Sites

LifeLock’s new Command Center service provides an additional level of ID theft protection that’s very good news for their nearly 1.5 million current members and for new LifeLock members.

For current members, LifeLock Command Center is an optional add-on to the already extensive steps LifeLock has been providing. New enrollees can choose between LifeLock’s existing, industry leading suite of service and LifeLock’s Command.

LifeLock Command Center includes:

LifeLock Identity SDS (Search Detect, Secure)
• Monitors usage of your Social Security number to be sure no one uses your identity to obtain cash advances or payday loans.
• Provides report of sex offenders in your areas, and confirms none of them uses your personal information to circumvent sex offender registration laws—a shockingly common occurrence.
• Monitors non-financial activities such as apartment rentals to make sure no one uses your identity.
• Public records are searched so you can be assured no one but you uses your personal information to obtain a driver’s license, passport or other documents. Also confirms your previous addresses so you’ll know, not just about new ID theft, but those that may have occurred years ago.
• Court records monitoring creates a report of any criminal activity recorded with your identifying information.

LifeLock Personal Breach Detection

• Peer-to-peer (P2P) networks carry one of the biggest threats to your online security, and have even been identified as a source of national security breaches. LifeLock scours these networks for your name, Social Security number and credit card numbers.

Current LifeLock members can visit LifeLock to upgrade to LifeLock Command Center. New customers can use our promo code DEFENSE to receive a 10% discount on LifeLock services, with or without LifeLock Command Center.

Bookmark It

Hide Sites