MoviePass Left Tens Of Thousands Of Credit Card Numbers Exposed Online

from the whoops-a-daisy dept

MoviePass initially seemed like it might be a plausible idea, though recently the outfit has been exposed for being terrible at this whole business thing. The service initially let movie buffs pay $30 a month in exchange for unlimited movie tickets at participating theaters, provided they signed up for a full year of service. But recent reports have made it clear company leaders had absolutely no idea what they were doing, the service was routinely hemorrhaging cash (particularly after an unsustainable price drop to $10), and execs even tried to change user passwords to prevent users from actually using the service.

Apparently, the outfit wasn't too hot at this whole internet security thing, either.

Mossab Hussein, a security researcher at Dubai-based cybersecurity firm SpiderSilk, recently discovered that the company had left tens of thousands of user credit card numbers exposed to the internet. An exposed database on one of the company's subdomains resulted in 161 million records on various types being exposed (a number, if precedent holds, that could grow even larger). And while much of this data was not sensitive, a good chunk of it was:

"We reviewed a sample of 1,000 records and removed the duplicates. A little over half contained unique MoviePass debit card numbers. Each customer card record had the MoviePass debit card number and its expiry date, the card’s balance and when it was activated.

The database had more than 58,000 records containing card data — and was growing by the minute."

Some customer names and addresses were also exposed to the internet. The data also included logs of failed login attempts, as well as subscriber email addresses. None of the records in the exposed database had been encrypted. The data had been exposed for months, and like so many companies, MoviePass didn't appear to be in much of a rush to address the problem:

"The database was exposed for months. Yonathan Klijnsma, threat researcher at cyberthreat intelligence firm RiskIQ, found evidence that the database was open from early May. Then, after we published this story, security researcher Nitish Shah told TechCrunch he also found the exposed database months earlier. “I even notified them, but they [didn’t bother] to reply or fix it,” he said. He provided a screenshot of the exposed database for proof, which we verified."

With the number of companies that have been embarrassed for leaving sensitive customer data exposed to the internet, you'd think we'd be seeing fewer of these kinds of scandals as companies work to audit and secure their systems. Yet we seem to be seeing more of these breaches (especially private data left exposed in unprotected Amazon cloud buckets) each and every month.

Filed Under: breaches, credit cards, data breaches
Companies: moviepass

Capital One Gets In On The Data Breach Action, Coughs Up Info On 100 Million Customers To A Single Hacker

from the another-company-tells-customers-to-look-under-their-seats-for-free-credit-monito dept

Another day, another major data breach.

In one of the largest thefts of data from a bank, a software engineer in Seattle hacked into a server holding customer information for Capital One and stole millions of credit card applications, federal prosecutors said on Monday.

The suspect, Paige Thompson, left a trail online for investigators to follow, according to court documents in Seattle, where she was charged.

Let's go ahead and move on from the New York Times' use of the words "theft" and "stole" to refer to the exfiltration of a copy of data Capital One still holds and on to the fact that the only thing unusual about this breach is that a suspect has already been arrested and charged.

The timetable is pretty tight too, if Capital One is being honest about when it first discovered the breach.

Capital One Financial Corporation (NYSE: COF) announced today that on July 19, 2019, it determined there was unauthorized access by an outside individual who obtained certain types of personal information relating to people who had applied for its credit card products and to Capital One credit card customers.

That's a big "if" -- one that's certainly called into question by the swift apprehension of a suspect. Maybe this is all on the level. Even if it is, does it matter? Companies collecting massive amounts of data are still, on the whole, pretty cavalier about data security, even as breach after horrifying breach is announced.

Given the data obtained, it almost seems like it would have been far less labor-intensive to just scour the web for a copy of the Equifax breach and download that instead. The Venn diagram of the sensitive data likely has a significant overlap.

Then there's the press release by Capital One, which inadvertently shows how little it really cares what happens to customers' sensitive information.

No bank account numbers or Social Security numbers were compromised, other than:

About 140,000 Social Security numbers of our credit card customers

About 80,000 linked bank account numbers of our secured credit card customers

Wat.

Nothing was compromised but the stuff that was compromised. This is the laziest spin I've ever seen applied to a data breach. And I've seen the federal government in action.

And hooray for American exceptionalism?

For our Canadian credit card customers, approximately 1 million Social Insurance Numbers were compromised in this incident.

Let's not step up to congratulate the G-men for their swift apprehension of the suspect. It appears the person accused of hacking Capital One's data engaged in zero opsec, turning the difficulty level down to "Easy" for investigators.

“I’ve basically strapped myself with a bomb vest,” Ms. Thompson wrote in a Slack post, according to prosecutors, “dropping capital ones dox and admitting it.”

Online, she used the name “erratic,” investigators said, adding that they verified her identity after she posted a photograph of an invoice she had received from a veterinarian caring for one of her pets.

All told, more than 100 million people are affected by this breach. Some are more affected than others, but this puts the Capital One breach on par with the Equifax breach in terms of potential victims. Unlike Equifax, the exfiltrated information was voluntarily given to Capital One by its customers, rather than harvested en masse without explicit consent for the sole purpose of selling to creditors.

And while the data stores of Rome are burning, the US government fiddles. Meaningless settlements do nothing to encourage better security efforts and the head of the DOJ is spending his time arguing against strong encryption. It's time to retire the sunglasses. The future isn't all that bright after all.

Filed Under: credit cards, data breach, hacks, paige thompson, social security numbers
Companies: capitol one

Newly Revealed Documents Show Facebook Gleefully Refusing To Refund Money To Kids Who Ran Up Huge Bills On Mommy's Credit Card

from the coppa-coppa-coppa dept

Because Facebook wasn't looking awful enough already, some newly unsealed documents from a lawsuit going back a few years are now making the company look even worse, and certainly not doing the company any favors in its efforts to rehabilitate its reputation. Unfortunately, so far, Reveal, a project of the Center for Investigative Reporting, seems to only be revealing snippets of what's in the documents, rather than the full documents (come on guys...), but what they're sharing doesn't look great.

Specifically, a judge has unsealed previously sealed records from a 2012 class action lawsuit that was settled in 2016, concerning Facebook profiting off of children. The origins of the lawsuit involved a child who got his mother's credit card to play a game on Facebook, without realizing that the more he played, the more of his mother's money he was spending -- compounded by Facebook then refusing to refund the charges. The latest revelations show that Facebook employees knew that they made this information confusing, in a way that people (kids and adults alike) might not realize they were still spending money off of a credit card, and also having joking conversations about people trying to get their money back. Indeed, the snippet Reveal has released has Facebook employees referring to one teenager as "a whale" -- a term used in casinos to refer to big spenders.

In one of the unsealed documents, two Facebook employees deny a refund request from a child whom they refer to as a “whale” – a term coined by the casino industry to describe profligate spenders. The child had entered a credit card number to play a game, and in about two weeks racked up thousands of dollars in charges, according to an excerpt of messages between two employees at the social media giant.

Gillian: Would you refund this whale ticket? User is disputing ALL charges…
Michael: What’s the users total lifetime spend?
Gillian: It’s $6,545 – but card was just added on Sept. 2. They are disputing all of it I believe. That user looks underage as well. Well, maybe not under 13.
Michael: Is the user writing in a parent, or is this user a 13ish year old
Gillian: It’s a 13ish yr old. says its 15. looks a bit younger. she* not its. Lol.
Michael: ... I wouldn’t refund
Gillian: Oh that’s fine. cool. agreed. just double checking

Fine. Cool. Agreed. Or not. Not cool at all. And that's even if you argue (as some have on Twitter) that the "whale" comment is actually a typo for "whole" (and argument multiple people who worked in the space dispute, noting that "whale"/casino terminology was common in online games).

While you might just chalk this up to a conversation among perhaps lower level Facebook employees with screwed up incentives, Reveal notes that other documents make it clear that people within Facebook knew that their confusing UI was contributing to a problem:

Facebook employees began voicing their concerns that people were being charged without their knowledge. The social media company decided to analyze one of the most popular games of the time, Angry Birds, and discovered the average age of people playing it on Facebook was 5 years old, according to newly revealed information.

“In nearly all cases the parents knew their child was playing Angry Birds, but didn’t think the child would be allowed to buy anything without their password or authorization first,” according to an internal Facebook memo. The memo noted that on other platforms, such as Apple’s iPhone, people were required to reauthorize additional purchases, such as by re-entering a password.

A Facebook employee noted that children were likely to be confused by the in-game purchases because it “doesn’t necessarily look like real money to a minor.”

The documents also note that Facebook didn't send receipts for these purchases, meaning that parents wouldn't know about them until way later when the credit card bill shows up. Oh yeah, also "links on the company’s website to dispute charges frequently failed to work."

While one might try to argue that this is something that happened many years ago, when Facebook wasn't that careful about things, the company's reaction to these documents finally being revealed isn't great either:

In response to a request for an interview, Facebook provided a one-sentence statement: “We appreciate the court’s careful review of these materials.”

That's... not going to cut it. In the past year, almost every internet company I talk to is simply seething about Facebook and how it's basically destroying everything with the hamfisted way it deals with... almost everything. The company's ongoing and never-ending "apology tour" isn't changing anything, and if the company can't figure out that it has to take real ownership of its many problems, past and present, it's never going to fix them, nor rebuild trust. Responding with that sort of PR speak, rather than saying "we royally fucked up, but that was many years ago, and here are all the concrete steps we've taken to fix this" is just incompetent. The company has been in the limelight for so long yet it still doesn't seem to fathom how to deal honestly with a press that is calling out its many faults. While it is true that plenty of press coverage of Facebook in the past year has been misleading or unfair, the unwillingness of the company to take its real problems seriously, is a huge issue not just for Facebook, but for every other internet company as well.

Filed Under: coppa, credit cards, kids, online games, refunds, whale
Companies: facebook

Appeals Court: No Expectation Of Privacy In Credit Card Magnetic Strips

from the TIMELY dept

Just as we're learning of law enforcement's bold new plan to take travelers' prepaid debit cards down to a $0 balance without ever leaving the highway, the Eighth Circuit Court of Appeals comes along [PDF] to remind us that swiping (not as in "taking") a credit card to determine its legitimacy is not a search under the Fourth Amendment. (via Ars Technica)

The court notes a couple of obvious things about the search that isn't. First, it can't be a physical search because swiping the card does nothing more than (if it's legit) return the same information that's printed on the front of the card.

[S]canning the magnetic strips on the cards was not a physical intrusion into a protected area prohibited by the Fourth Amendment. See Florida v. Jardines, 133 S. Ct. 1409, 1417 (2013). The magnetic strip on the back of a debit or credit card is a type of "external electronic storage device, [that] is designed simply to record the same information that is embossed on the front of the card." Accordingly, the information embossed on the front of the card and recorded in the magnetic strip will only be different if the card has been tampered with. Credit card readers reveal whether the information in the magnetic strip on the back of the card matches the information on the front. The process of using a credit card reader "is analogous to using an ultraviolet light to detect whether a treasury bill is authentic, . . . [which is not a] . . . 'search.'" Thus, because "sliding a card through a scanner to read virtual data does not involve physically invading a person's" space or property, there was no Fourth Amendment violation under the original trespass theory of the Fourth Amendment.

Unfortunately for the defendant, none of the dozens of credit cards and gift cards he was caught with returned information confirming him as the owner. All of the cards (which ranged from gas cards to Subway gift cards to Amex credit cards) contained information linking them to other cardholders. There was a seizure, as the Secret Service took control of the cards after the defendant was arrested and scanned them to determine their legitimacy. There may have been an avenue to challenge the seizure without a warrant, but the defendant never raised the issue.

The court also finds the Third Party Doctrine applies here.

Although DE L'Isle claims he had an actual, subjective privacy interest in the cards, he is unable to make that case. As to the ten American Express credit cards, he could not have had an expectation of privacy simply because his name was embossed on the front of the cards. He also could not have had a subjective expectation of privacy in any of the other cards because the purpose of a credit, debit, or gift card is to enable the holder of the card to make purchases, and to accomplish this, the holder must transfer information from the card to the seller, which negates an expressed privacy interest. [...] When the holder uses the card he "knowingly disclose[s] the information on the magnetic strip of his credit card to a third party and cannot claim a reasonable expectation of privacy in it."

The dissenting opinion is an interesting read, as it starts out by suggesting justice would best be served by the throwing of last-minute wrenches into the gears before stalking off into the weeds for a bit.

This appeal presents a narrow legal issue: Does scanning the magnetic stripe on the back of a credit or debit card to access the data stored on it implicate the protections of the Fourth Amendment? In my view, answering this question requires further factual development, and I would remand the case to the district court to hold an evidentiary hearing.⁵

⁵I recognize the difficult position in which the district court found itself, faced with a motion to suppress almost on the eve of trial. The district court would have been within its rights to deny the motion as untimely. In a commendable effort to grant the defendant a full opportunity to present his defense, the district court instead excused the delinquency of the motion and decided it on the merits. Although I recognize that the district court’s decision not to hold an evidentiary hearing is reviewed deferentially, United States v. Hill, 750 F.3d 982, 986 (8th Cir. 2014), I believe an evidentiary hearing is necessary to resolve this case.

Judge Kelly suggests there may be an expectation of privacy in magnetic strips, but only if this information is easily modified by cardholders at their discretion.

In my view, the answer to this question depends on whether there are significant technological barriers to an individual rewriting information on the magnetic stripe of their cards, and I would remand the case to the district court to develop evidence on this point. If the information on the magnetic stripe can be modified without much difficulty, the cardholder may indeed have a reasonable expectation of privacy in the contents of the stripe, based on the straightforward principle that law enforcement conducts a Fourth Amendment “search” when it reads the contents of rewritable digital storage media.

It's safe to say no card issuer is going to let end users alter the coding on their cards. It either matches the info on front or it's not a legitimate credit card. This argument's attempt to equate credit cards with storage media is more than a bit of a stretch. (For gift cards, though, this is a little murkier. There's no name to match against the info uncovered by swiping it through a reader. The only thing that can be discovered is whether the card type matches the encoded data.)

The dissent is on sturdier ground when it argues that swiping cards to match them up with the info printed on the front is still a search. Judge Kelly points out that the majority decision allows the results of the search to determine the legitimacy of the search, which is the wrong way around.

The problem with this approach is that it is only possible to determine whether the information on the magnetic stripe is blank or matches the information embossed on the front of the card by scanning the magnetic stripe to determine its contents. And the results of a search cannot be used to justify its legality.

Even if it were to go Judge Kelly's way, the Third Party Doctrine would undo it, as payments with credit cards are very much a voluntary act in which purchasers know information about them is being relayed to retailers, card processing companies, and the card's issuer.

However, Kelly does make a good point when suggesting the court shouldn't be in such a hurry to declare this a foregone conclusion.

Although the stakes may appear small at this stage, technological progress has a way of ensuring that they do not remain so. The Supreme Court has instructed that “the rule we adopt must take account of more sophisticated systems that are already in use or in development.” What advances are likely to be made in this area is a topic that deserves further factual development by the district court, especially because the available evidence suggests that the amount of information storable on a credit card will not long be numbered in the dozens of characters.

Already many newly-issued credit cards in the United States contain chips that have a storage capacity much greater than that of the old magnetic stripes. As cards are able to store more information, the privacy interests they implicate increase.

This is especially important considering the recent development in law enforcement forfeiture tech. Cards will be seized, read and drained -- all without warrants because there's apparently no privacy interest in the cardholder information printed on the front, or any of the information obtained by running the card through a reader. If a court comes to the opposite conclusion -- that card swipes are searches -- it will make it that much harder for law enforcement agencies with ERAD tech and a fistful of bad incentives to participate in highway robbery.

Filed Under: 4th amendment, credit cards, eight circuit, magnetic strips, privacy

Chip And PIN Meets Facial Recognition: Chipping Away At Privacy, Pinning You Down In A Database

from the are-you-sure-you've-thought-this-through? dept

As part of President Obama's BuySecure initiative, US merchants and the public are being encouraged to adopt the Chip and PIN technology for credit, debit, and other payment cards. As the announcement in October last year noted, these Chip and PIN cards have been used for some years in other parts of the world, notably Europe and Canada. For all the technology's vaunted security, there are inevitably still weaknesses that can be exploited, as with any system. That was true five years ago, and it's still true now, as shown by this story on the BBC Web site about one company's idea for reducing Chip and PIN fraud:

One of the biggest payments processing companies has revealed it is developing a chip-and-pin terminal that includes facial recognition technology.

Worldpay's prototype automatically takes a photo of a shop customer's face the first time they use it and then references the image to verify their identity on subsequent transactions.

The company admits that the system is unlikely to be perfect:

Worldpay is not suggesting that shoppers be blocked from making payments if its computer system failed to make a match.

Rather, it suggests that tills would display an "authorisation needed" alert, prompting shop staff to request an additional ID, such as a driving licence.

It's only an experimental idea at present, but Worldpay says it could roll it out to the 400,000 retailers that use its system within five years if there's sufficient interest. That would obviously create rather a large collection of facial biometrics, which raises questions of how they would be stored. But don't worry, Worldpay has got that sorted:

The firm says it would store the captured images in a "secure" central database.

Well, that shouldn't be a problem, then -- provided you remember to change your face when that database gets broken into….

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: chip and pin, credit cards, facial recognition, payments, privacy
Companies: worldpay

Payment Wars: How Merchants And Carriers Are Trying To Block Payment Systems They Can't Track

from the dangeorus dept

Over the weekend, it came out that two giant pharmacy chains, Rite Aid and CVS, had started blocking Apple Pay, the massively hyped new payment system from Apple that has received much praise for its ease of use. The product had worked for about a week before the two companies started blocking such near field communication (NFC) payments (which also takes out other NFC payment options like Google Wallet). While Rite Aid gave a vague and slightly ridiculous explanation -- that it is "still in the process of evaluating our mobile payment options" -- pretty much everyone knows the truth. A bunch of retailers, led by Walmart, have been creating their own mobile payment system called CurrentC, which cuts out the credit card companies. But, it also builds in all the tracking and spying features of store loyalty cards, expanded across all merchant partners. Apple Pay lets people remain anonymous.

In short: CurrentC lets merchants (1) cut out credit card transaction fees and (2) get more and more data on shoppers. No wonder they want to block out other options.

But this isn't the start of such fights. Last year, mobile carriers like T-Mobile, Verizon and AT&T sought to block Google Wallet in favor of a similar consortium of mobile operators, looking to create their own NFC payment system, which was unfortunately named ISIS until world events led the consortium to change its name to Softcard.

All of these moves should be concerning. They're clearly not being done with the consumer in mind. Nearly everyone who's played with Apple Pay has agreed that the system is a huge leap ahead for mobile payments in terms of ease of use. Instead, we're seeing giant organizations looking to team up to keep competitors out of the market. At the very least, this should raise serious antitrust issues. But it also demonstrates, in a different sphere, why net neutrality is such a concern. When you have large companies that can effectively collude to block or kill certain powerful and useful apps and services, it hinders and blocks important innovations, leaving consumers significantly worse off. Not only are they left with fewer choices and lower quality apps and services, but it also pushes consumers into services -- like CurrentC -- that take away their privacy.

Filed Under: apple pay, collusion, control, credit cards, currentc, google wallet, mobile payments, nfc, operators, payment, retailers, softcard, wireless payments
Companies: apple, at&t, cvs, google, rite aid, softcard, t-mobile, verizon

Airlines, Travel Sites Hand Over Your Full Booking Credit Card, IP Info To Feds, Who Keep It Stored With No Encryption

from the incredible dept

Ars Technica's Cyrus Farivar filed a FOIA request for the Passenger Name Records (PNRs) that had been stored by the federal government concerning his own travel history. PNRs are created by travel companies (airlines, hotels, cruise lines) whenever you book a reservation, and are then handed over to the government. After an appeal, Customs and Border Patrol turned over the records, showing that airlines (1) record a ton of information about you every time you book a flight and (2) hand over all that information to the government. Bizarrely, this includes the credit card number and IP address you used to book your travel, and it appears that the airlines and the US government are ignoring the most basic of cybersecurity protections in that they store the credit card info in the clear. The fourth line in the record above is Farivar's (long-expired and changed) full credit card. While it may not seem like a huge surprise that the government is basically snooping on everything you tell the airlines (including seat changes, food preferences, any special assistance you might need, etc.), it's stunning that they're passing around and storing credit card info in the clear.

Fred Cate, a law professor at Indiana University, said that my story raises a lot of questions about what the government is doing.

“Why isn’t the government complying with even the most basic cybersecurity standards?” Cate said. “Storing and transmitting credit card numbers without encryption has been found by the Federal Trade Commission to be so obviously dangerous as to be ‘unfair’ to the public. Why do transportation security officials not comply with even these most basic standards?”

Farivar also notes that the CBP publicly states that the info is kept for five years, but his own records go back to March of 2005 -- suggesting that the CBP is hanging onto all this info for a lot longer. Of course, as we've seen in the past, if there's one government agency that appears to be able to get away with anything with absolutely no oversight at all, it's Customs and Border Patrol. However, this seems like a fairly serious problem. Beyond the 4th Amendment questions it raises about why they're getting all this information on Americans, it seems like they're creating a much bigger security risk in storing (and passing around) all such info in the clear.

Filed Under: credit cards, customs and border patrol, cyrus farivar, dhs, foia, homeland security, passenger name records, pnr, travel, unencrypted

Intellectual Ventures' Evil Knows No Bounds: Buys Patent AmEx Donated For Public Good... And Starts Suing

from the despicable dept

Intellectual Ventures may be running out of cash, but that doesn't mean it's slowed down the pace of evildoing. If you look over its recent lawsuits, you'll notice that over the summer, Intellectual Ventures was busy suing a bunch of banks, including Capital One (that lawsuit is embedded below). At least some of those lawsuits involve US patent 6,182,894 entitled: "Systems and methods for authorizing a transaction card." In short, it basically describes the concept of the CID or CVV number that is found on the back of most credit cards today, which you often have to enter when purchasing stuff online with a credit card. Now, we may question how the hell the idea of adding 3 numbers to the back of a card as a security measure should be patented in the first place, but let's leave that aside for a moment.

Instead, let's go back a bit to look at the history of this patent, and a man named Bernard Bilski. As you may recall, Bilski was involved in what appeared to be a key lawsuit concerning the ability to patent software. Eventually, the Supreme Court gave a very narrow ruling on the issue that didn't provide very much clarity at all on the question of software patents. However, go back a little bit further, to one of the Bilski appeals, heard by CAFC. Lots of different players on all sides of the patent debate lined up to supply amicus (friend of the court) briefs. One of them was American Express, who (somewhat ridiculously) argued in favor of software and business method patents. And, in a bit of news that is rather important here, it happens to use patent 6,182,894 as an example of why these kinds of patents are so important, wherein it gives us a history of that patent up until 2007 or so. It talks about the importance of CID/CVV numbers for credit card security and fraud reduction, and then notes the following:

Recognizing the value of this fraud reduction process to not only the financial services community, but also to the individual consumer, American Express donated the ’894 patent to the not-for-profit corporation Consumer and Merchant Awareness Foundation ("CMAF"). According to the CMAF, “the core objective of CMAF is the cultivation and encouragement of responsible, proven practices that sustain and build consumer and merchant confidence in the financial services marketplace.” The CMAF seeks to achieve this objective by raising awareness of best practices to protect consumers and merchants. The "CMAF views the ’894 Patent as an asset that should be used to help fulfill its mission." As owner of the ’894 patent, the CMAF can license the process disclosed in the ’894 patent throughout the financial services industry. If patent protection had not been available to drive the initial innovation costs, this method may not have been developed or made available to the CMAF to advance the process industry-wide. CMAF, which is currently developing its licensing policy, states that it is committed to “refrain from actions that will result in enforcement of intellectual property against issuers, acquirers, merchants or consumers related to activity in the retail financial services and payment areas.” As a result of this policy and its licensing efforts, CMAF will make this important fraud-prevention technology available throughout the financial services industry.

Those quotes are from CMAF's website. As a quick aside, I'll note that AmEx's argument here is totally nonsensical. If AmEx was planning to donate the details of this patent to a non-profit and make sure that any card issuer could use it... then what's the patent for? AmEx could have just as easily publicly released a description of the concept or tried to create a standard or something. There's absolutely no reason for a patent since the only thing a patent lets you do is exclude others. The idea that you'd need a patent to come up with this... only to then donate it to a non-profit that promises not to enforce the patent against anyone in the space just doesn't make any sense. You don't need a patent for that.

And, actually, the end result here shows why patents like this are bad. Because even after AmEx got the patent and donated it, and after CMAF flat out promised not to enforce the patent against banks, that's exactly what's happening now -- thanks to the pure evil of Intellectual Ventures. The record shows that, in June of 2009, the patent changed hands from CMAF to an organization called Losipial Wireless, who has been identified as an Intellectual Ventures shell company. And then, just this past May, right before IV started suing banks over this patent, Losipial assigned the patent directly to Intellectual Ventures. And then Intellectual Ventures started suing. So you have a situation where even when the original patent holder donated the patent for "the public good," sooner or later, an obnoxious patent troll like IV comes along and turns it into a weapon.

Again: AmEx patented those little numbers on your credit card, and then for the good of the industry and consumer protection donated the patent to a non-profit, who promised not to enforce the patent against banks... and then proceeded to sell the patent to Intellectual Ventures who is now suing banks over it.

What I haven't yet been able to figure out is what happened to CMAF itself. The website still exists, though it's pure brochureware, and there's little info on the site. If you poke around, the page with the description of the patent still exists (even though AmEx cited the wrong link in its brief). If CMAF sold off the patent in 2009, you'd think somewhere in the intervening 4 years, someone would think to take down the page about that patent -- if anyone actually worked at CMAF. I've sent them two separate emails, but never heard back. It's worth noting that American Express has a deal with Intellectual Ventures. I'm sure AmEx also got a nice tax deduction for "donating" the patent to CMAF (CMAF's website plays up that there are tax benefits to donating patents to it). And then IV gets to still sue a bunch of AmEx competitors over the patent AmEx insisted it was donating for the good of the public... Nice trick.

Filed Under: anti-fraud, cid, credit cards, cvv, fraud, patents, security
Companies: american express, capital one, cmaf, consumer and merchant awareness foundation, intellectual ventures, losipial wireless

The NSA Is Also Grabbing Millions Of Credit Card Records

from the so.-much.-hay. dept

In addition to everything else it's collecting, the NSA also has millions of international credit card transactions stashed away in its databases, according to documents viewed by Spiegel.

The information from the American foreign intelligence agency, acquired by former NSA contractor and whistleblower Edward Snowden, show that the spying is conducted by a branch called "Follow the Money" (FTM). The collected information then flows into the NSA's own financial databank, called "Tracfin," which in 2011 contained 180 million records. Some 84 percent of the data is from credit card transactions.

On one hand, what the NSA is doing is exactly what the NSA should be doing: tracing the money flow of terrorist organizations.

Their aim was to gain access to transactions by VISA customers in Europe, the Middle East and Africa, according to one presentation. The goal was to "collect, parse and ingest transactional data for priority credit card associations, focusing on priority geographic regions."

This is part of the Terrorist Finance Tracking Program, which was set up shortly after the 9/11 attacks and gave the US government access to the SWIFT (Society for Worldwide Interbank Financial Telecommunication) database. This, in and of itself, is not news, having been exposed in 2006. Documents uncovered then showed the program had been in place since 2002, with permission extended to the CIA and the Treasury Dept. as part of Bush's "Global War on Terror."

What is new, however, is the fact that the NSA is targeting transactions from major credit card companies, like VISA. This has quite a bit more potential for misuse than SWIFT, which records only banking transactions. VISA responded to this new information with the same quasi-denial we've seen from several other companies whose links to the NSA have been exposed.

"We are not aware of any unauthorized access to our network. Visa takes data security seriously and, in response to any attempted intrusion, we would pursue all available remedies to the fullest extent of the law. Further, its Visa's policy to only provide transaction information in response to a subpoena or other valid legal process."

Of course, this isn't "unauthorized" access, not when gathered with a court order or subpoena. But this isn't as tightly controlled as the spokesperson makes it appear. If pursuing data for "counterterrorism" purposes, the NSA is allowed to skirt the protections of the Right to Financial Privacy Act, thanks to an amendment in the PATRIOT Act. But even with these legal options, it appears the NSA would still rather pursue this in an extralegal fashion in order to circumvent the warrant process.

NSA analysts at an internal conference that year described in detail how they had apparently successfully searched through the US company's complex transaction network for tapping possibilities.

Whatever's happening now appears to be the NSA grabbing more data simply because it can. It's not as if it didn't already have access copious amounts of financial data, thanks to the government's fully legal (and fully public) collection of bulk financial records through SWIFT.

Remember: in addition to stealing the data, Treasury also gets it via a now-public agreement. The former CEO of SWIFT Leonard Schrank and former Homeland Security Czar, Juan Zarate actually boasted in July, in response to the earliest Edward Snowden revelations, about how laudable Treasury’s consensual access to the data was.

"The use of the data was legal, limited, targeted, overseen and audited. The program set a gold standard for how to protect the confidential data provided to the government. Treasury legally gained access to large amounts of Swift’s financial-messaging data (which is the banking equivalent of telephone metadata) and eventually explained it to the public at home and abroad.

It could remain a model for how to limit the government’s use of mass amounts of data in a world where access to information is necessary to ensure our security while also protecting privacy and civil liberties."

Never mind that by the time they wrote this, an EU audit had showed the protections were illusory, in part because the details of actual queries were oral (and therefore the queries weren’t auditable), in part because Treasury was getting bulk data. But there was a legitimate way to get data pertaining to the claimed primary threat at hand, terrorism. And now we know NSA also stole data.

Even when the government has an advantageous agreement to collect bulk data with little oversight, its agencies can't help but exploit this even further. The collection via "oral queries" is another indicator of these agencies' (FBI, NSA, CIA) unwillingness to follow even the most minimal of rules. (See also the administration's 2010 ruling that made the FBI's warrantless wiretapping legal, which occurred after the agency's process had slid from issuing tons of National Security Letters to simply calling up the telcos and requesting records.)

The untargeted collection of financial data has raised concerns from those on the "collection" side.

[E]ven intelligence agency employees are somewhat concerned about spying on the world finance system, according to one document from the UK's intelligence agency GCHQ concerning the legal perspectives on "financial data" and the agency's own cooperations with the NSA in this area. The collection, storage and sharing of politically sensitive data is a deep invasion of privacy, and involved "bulk data" full of "rich personal information," much of which "is not about our targets," the document says.

When even the spies are concerned about about how much data their spy programs are netting, that's a pretty good sign a bulk records collections effort has gone too far. And it has deeper implications than simply a massive amount of privacy violations. As Marcy Wheeler points out, even the then-Fed chairman Alan Greenspan expressed his concerns about the breadth of the SWIFT collections.

If the world’s financiers were to find out how their sensitive internal data was being used, he acknowledged, it could hurt the stability of the global banking systems.

That's a scary thought, considering the "global banking system" isn't all that stable to begin with. A lack of targeting will leave the NSA open to more accusations of economic espionage, something clearly not related to its supposed "national security" agenda.

Filed Under: credit cards, financial transactions, nsa, nsa surveillance, surveillance, swift
Companies: swift, visa

Sony Admits That Playstation Hacker Got Tons Of Info, Including Passwords

from the this-is-what-you-get-with-a-company-that-rootkits-people dept

We had avoided discussing what was going on with the PlayStation Network hack and subsequent downtime until more details were known, and now Sony is finally revealing what many people feared: a ton of personal info was leaked. According to Sony's blog post, among the information that hackers got was:

• Name
• Address
• Country
• Email
• Birthdate
• PlayStation Network/Qriocity password and login

Sony claims it's not sure yet, but that it "cannot rule out," that credit card info and password security answers may have also been included. To deal with that, they're saying people should assume that such info was compromised. So far, Sony's plan is to tell you to stay alert:

For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking. When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password. Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.

To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports. We are providing the following information for those who wish to consider it:

You hear that sound? That's the sound of a whole bunch of class action lawsuits being filed against Sony as we speak. I'd like to say it's a huge surprise that Sony would even store passwords and credit card data in a place where it could easily be extracted like that, but it's really not. This, after all, is the company that made the word "rootkit" famous, and spent the last few months wasting more resources in a quixotic legal campaign against a guy who added back a feature to the PS3 that Sony had deleted. Perhaps if it spent a little more time actually protecting its users rather than fighting silly battles, there wouldn't be issues like this.

Filed Under: credit cards, passwords, playstation, playstation network, security
Companies: sony