I've Been Mugged

Latest Sony Data Breach Affects 93,000 Customers

On Tuesday, Sony announced In its Playstation blog that the entertainment company experienced another data breach affecting 93,000 of its Sony Entertainment Network (SEN), PlayStation Network (PSN), and Sony Online Entertainment (SOE) customers. While the affected customers are less than one tenth of one percent (0.1%) of total PSN, SEN and SOE customers, the affected customers include about 60,000 PSN/SEN customers and about 33,000 SOE customers. In response to the intrusion, Sony has temporarily locked down those accounts.

"We are currently reviewing those accounts for unauthorized access, and will provide more updates as we have them. Please note, if you have a credit card associated with your account, your credit card number is not at risk. We will work with any users whom we confirm have had unauthorized purchases made to restore amounts in the PSN/SEN or SOE wallet."

During May and June of 2011, Sony announced multiple data breaches at its PSN, Canadian eShop, Greece, and Thailand websites, affecting over 77 million customers worldwide, plus another 24 million SOE customers. Several Sony executives apologized publicly for the data breaches. After those attacks, several security experts concluded that Sony used obsolete data security software.

It would appear that with the latest attacks, security at Sony online sites is far from optimal or desired.

 

KPMG Survey: A Typical Corporate Fraudster Is...

KPMG recently released its 2011 Who Is A Typical Fraudster? report, describing the profile of a typical corporate fraudster, the impacts and amounts stolen, industries where fraud tends to concentrate, and the conditions which enabled the fraud. The report included 348 events in 69 countries. The fraud events included "white collar" crimes such as:

"... misstatement of financial results, theft of cash and/or other assets, abuses of expenses, and a range of other fraudulent acts."

The report excludes acts of no material value and misconduct.The report does not mention names. The average duration of the fraud was almost three and a half years from the start until its detection. In 74% of the incidents, fraudsters exploited weak internal controls. Companies fail to read and act quickly on the warning signs:

"The number of fraud cases preceded by a red flag rose to 56 percent of cases in 2011, from 45 percent in 2007... Just 6 percent of initial red flags were acted on in the 2011 analysis... Rarely is an act of fraud a one-off... In 2007, 91 percent of fraudsters were repeatedly fraudulent, compared with 96 percent in the 2011 analysis."

The average loss was $1.4 million in Asia Pacific, $1.1 million in the Americas, and $900k in Europe. The report described the following as one of the most interesting cases in the United States:

"At a U.S. financial institution, a larger-than-life chief executive surrounded himself with an inner circle of "yes men." The fraud, which involved subterfuge and complex bundling and unbundling of loans and transactions to make bad loans appear good... The investigation quickly uncovered conflicting stories told by the CEO's inner circle and the people working with the loans and customers. This case illustrates, in particular, how dominant and bullying behavior can coerce others to participate in fraudulent activity."

The corporate fraud includes identity theft. A case from Switzerland:

"Fraudsters attempt to extract money from dormant accounts or they assume the identity of a customer to trick advisers into making payments or transfers. Often this involves the collusion of an external party with an internal ally..."

I also found the consequences interesting:

• Disciplinary action: 40% of cases (54% in the Americas; 23% in Asia Pacific)
• Regulatory, legal enforcement: in 45% of cases
• Civil recovery: 23% of cases
• Resignation/voluntary retirement: 17% of cases (25% in Asia Pacific)
• Out-of-court settlement: 6% of cases
• No action taken: 3% of cases

The profile of a typical corporate fraudster:

• Male (87% were men)
• 36 to 45 years of age (41% were ages 36 to 45; 33% were ages 45 to 55)
• Committed the fraud against his own employer (90% committed the fraud against their employer)
• Works in the finance function or in a finance-related role (32% worked in finance; 26% were CEOs; 25% were in operations/sales)
• Holds a senior management position (29% were in management; 53% were in senior management)
• Employed by the company for more than 10 years (33% employed more than 10 years; 29% employed 3 to 5 years; 26% employed 6 to 10 years)
• Committed the fraud in collusion with another employee (61% acted with others)

The report mentioned this about collusion:

"... male perpetrators (64%) are almost twice as likely to collude than women (33%). After taking account of male dominance in the perpetrator group, collusive females account for just 4 percent of activity. Perpetrator groups are most typically all-male or mixed gender."

KPMG is a tax, auditing, and advisory firm operating in 144 countries. A KPMG auditor caused a data breach in May 2010 when the auditor lost a flash drive containing 4,500 unencrypted patients records.

Groupon India Subsidiary Suffers Data Breach

Last week, the online deals company Groupon announced that its subsidiary in India, SoSasta, suffered a data breach. According to Reuters, an unnamed security expert alerted the company.

Unencrypted passwords and perhaps email addresses of customers were exposed or stolen. InfoWorld reported the Sosasta database size to be 300,000 customers.

SoSasta posted a notice on its Facebook account that the security issue had been fixed, and that customers' financial information (e.g., credit card and debit card information) had not been exposed nor stolen. SoSasta advised its customers to change their passwords.

While it is good to see breach notices on a scoial networking account, It is a concern that the company didn't discover the breach itself.

The Next War May Well Be About User Data

[Editor's Note: Today's blog post is by guest author Meeta Mathur. Meeta is a UX designer focused on designing and understanding virtual social environments. She blogs at MeetaMathur.Tumblr.com and looks forward to your feedback. I have known Meeta for several years, as previously we were coworkers at a digital agency.]

By Meeta Mathur

The next War may well be about user data.

We live in a world where we are increasing our digital footprint daily by connecting with various social networks and engaging in liking, sharing and commenting with several brands and domains. Every URL we visit we leave behind traces of ourselves, sometimes unknowingly, and more and more due to the power of social plugins these traces follow us around even when we're well aware of it.

With the world population at 6 billion and Facebook alone at 500+ million users, it is no wonder then that the next riches waiting to be mined are not the glittering blood diamonds of Africa or harvesting the oil wells of the Gulf. The next frontier is the gleaming gold mine of user data. And it won't be unthinkable given the history of the human race, that one day we may very well fight over this very data. Not a common brawl, but a full-blown war just like nations in the past have fought.

We may have very well seen a preview of things to come with the Facebook PR disaster a few weeks back when they failed miserably at a smear campaign against Google over user privacy issues.

Likewise, the brouhaha over location data tracking that both Apple and Google have run into in recent months.

We've only just seen the tip of the iceberg, though. The stakes no doubt are huge, as we can see from the interest each of these companies have, with Google tying each employees bonus to the success of its social agenda. On the flip side, this is an equally big opportunity for it to be misused. There's a lot that can be gleaned from this data - from credit card info to where you live, work, your shopping habits and your friends.

In fact Google search results may soon be a mirror of our immediate network, their worries, their issues and what's important to them. They will be a reflection of the environment we live in....and marketers as always are the first to grab on to that, perhaps even your doctor, insurance and others might tap into that in the near future.

The Google Social Circle knows who your friends are.

Corporations going after user-data are one thing. But what happens when a country itself makes it their agenda. This recent article about China making cyber-warfare their military priority is most worrisome.

Are you worried? What are or will you be doing to protect yourself? Fortunately, there are more than just a few of us worried, and already a few tools being designed to tackle this menace head on.

---

© 2011. Meeta Mathur. Reprinted with permission.

Yet Another Data Breach At Sony; Playstation Network Returns Online in Phases

Several news organizations reported that hackers attacked Sony Ericsson's Canadian eShop website. This latest Sony data breach affected only about 2,000 consumers. The Canadian eShop website provides accessories and support for phone customers. At press time, portions of the Canadian eShop website were unavailable.

The Canadian eShop breach is more bad news for Sony after massive data breaches at its Playstation Network and Online Entertainment units. Sony forecasts its breach-related costs in the United States at $171 million for the coming fiscal year ending March 2012, excluding any lawsuits.

On Tuesday last week, Sony disclosed a breach at its Sony Music Entertainment Greece website, which affected about 8,500 customers. Sony also disclosed that an unauthorized user had accessed and changed its Sony Music Indonesia website, and a hacker may have accessed its Thailand website to send e-mail spam.

On Friday May 27, Sony announced a phased restoration of service at its Playstation Network unit:

"... Sony Network Entertainment International (SNEI, the company) will begin a phased restoration of PlayStation®Network and Qriocity Services in Japan and Asian countries and regions including Taiwan, Singapore, Malaysia, Indonesia, and Thailand*1 on May 28. A new identity protection program will also be offered in conjunction with the phased restoration for PlayStation Network and Qriocity customers in Japan..."

Sony Playstation Network Hacked Again

While trying to get its customers up and gaming again after its massive data breach, the Sony Playstation Network suffered another hack, even though the company doesn't call it a hack. The Playstation Network blog reported on Wednesday:

"We temporarily took down the PSN and Qriocity password reset page. Contrary to some reports, there was no hack involved. In the process of resetting of passwords there was a URL exploit that we have subsequently fixed. Consumers who haven’t reset their passwords for PSN are still encouraged to do so directly on their PS3. Otherwise, they can continue to do so via the website as soon as we bring that site back up."

The timing of this latest security problem couldn't be worse. The Sydney Morning Herald reported:

"Sony chief Howard Stringer has warned he can no longer guarantee the security of the electronics giant's gaming network in the "bad new world" of cybercrime..."

What? Bad new world of cybercrime? Data breaches are not new. Stringer's comments are disappointing, at best. If I were a Playstation Network customer, I'd cancel and close my account.

Earlier this month, Sony suffered two data breaches at its Playstation Network and at its Online Entertainment units. In testimony before the U.S. Congress, a security expert stated that Sony allegedly used obsolete data security software.

A former hacker and lead architect at MyKonos Software, Kyle Adams, said that the hackers may have accessed Sony's servers via its blog, which was running an obsolete version of the WordPress blogging software. Adams also suggested that the hack attack probably was not random and was persistent.

Second Sony Data Breach Exposes Personal Data of 24 Million Consumers

You've probably heard of the massive Sony Playstation Network data breach that affected 77 million customers. Well, there has been a second Sony data breach.

In a May 2 press release, Sony Online Entertainment (SOE) announced that hackers had breached its servers and stole consumers' sensitive personal information, including name, address (city, state, zip, country), email address, gender, birth date, phone number, sign-in credentials (e.g., login name and hashed password), and debit/credit card account information:

"Customers outside the United States should be advised that we further discovered evidence that information from an outdated database from 2007 containing approximately 12,700 non-US customer credit or debit card numbers and expiration dates (but not credit card security codes) and about 10,700 direct debit records listing bank account numbers of certain customers in Germany, Austria, Netherlands and Spain may have also been obtained."

The stolen bank account data included bank account number, account holder name, and account holder address. All of the above stolen personal data is sufficient for identity criminals to open fraudulent accounts and/or access existing accounts. SOE is notifying affected consumers via e-mail with Innovyx, their third-party email distributor. Reportedly, the e-mail notifications will contain either 'soe.innovyx.net' or 'soe.sony.com' in the sender field. SOE has also:

"Temporarily turned off all SOE game services; engaged an outside, recognized security firm to conduct a full and complete investigation into what happened; and quickly taken steps to enhance security and strengthen our network infrastructure..."

In a May 3 press release, SOE announced an update of their breach investigation:

"This information, which was discovered by engineers and security consultants reviewing SOE systems, showed that personal information from approximately 24.6 million SOE accounts may have been stolen..."

Since SOE gaming websites are down, SOE will add 30 days onto its customers' subscriptions and compensate them for each day of downtime. SOE produces popular, multi-player online games, including EverQuest, EverQuest II, Champions of Norrath, Clone Wars Adventures, and DC Universe Online.

Given that debit and credit card data was stolen, consumers should check their bank accounts for fraudulent entries and change their sign-in passwords. The SOE breach notification contains the usual disclosures advising consumers to check their credit reports for fraudulent entries and to contact the U.S. Federal Trade Commission's identity theft website for advice and tips about how to protect themselves and their bank accounts.

Sony Apologizes For Its Playstation Data Breach

Forbes reported a Sony press conference on Sunday where the company apologized for its recent Playstation Network (PSN) data breach:

"Kazuo Hirai, head of the company’s networked product division began by saying that, 'we’d like to extend our apologies to the many Playstation Network and Qtriocity service users who we inconvenienced and worried because we potentially compromised their customer data. We offer our sincerest apologies.' ”

Sony executives at the press conference included Kazuo Hirai (Corporate Executive Officer, Executive Deputy President and President of Consumer Products & Services Group), Shinji Hasejima (Senior Vice President, Corporate Executive, Chief Information Officer), and Shiro Kambe (Senior Vice President, Corporate Communications). The company confirmed that PSN customers' passwords were not encrypted and were hashed. The company promised to offer several freebies and premium content for its customers affected by the data breach under a "Welcome Back" appreciation program.

A PSN press release on Sunday repeated much of the information from the press conference (video), the company said that some PSN and Qriocity services, which were shut down immediately after the data breach. The company expects to resume full services within a month. The order of planned resumption of services:

• Restoration of Online game-play across the PlayStation®3 (PS3) and PSP® (PlayStation®Portable) systems. This includes titles requiring online verification and downloaded games
• Access to Music Unlimited powered by Qriocity for PS3/PSP for existing subscribers
• Access to account management and password reset
• Access to download un-expired Movie Rentals on PS3, PSP and MediaGo
• PlayStation®Home
• Friends List
• Chat Functionality

Sony emphasized that it will not ask PSN customers for passwords via e-mail, and asked customers to be alert form phishing spam. Sony also summarized its efforts to strengthen the security of its networks:

• Added automated software monitoring and configuration management to help defend against new attacks
• Enhanced levels of data protection and encryption
• Enhanced ability to detect software intrusions within the network, unauthorized access and unusual activity patterns
• Implementation of additional firewalls

The Welcome Back program makes sense as customer churn is one of the largest expenses companies experience after a data breach.

Sony Playstation Network Data Breach Affects 77 Million Consumers Worldwide

Earlier this week, the Sony notified its Playstation Network (PSN) customers of a data breach affecting as many as 77 million consumers. Hackers accessed PSN between April 17 to 19, 2011 and stole the following sensitive personal information:

"... name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility."

The PSN website includes notifications for consumers living in the United States, Puerto Rico, and outside the United States. The notifications offer the usual advice for consumers to monitor their credit reports for fraudulent entries, and to access their credit reports at either the official free credit report website or via the three credit reporting agencies: Experian, Equifax, and TransUnion.

Sony expected to notify all customers by April 28. Affected PSN customers can visit www.us.playstation.com/support and www.qriocity.com for more information. PSN has about 36 million customers in the United States, 32 million ins Europe, and 9 million in Asia.

In response to the attack, Sony turned off the Playstation Network and Qriocity service to strengthen the security of its network, and hired a security firm to perform an investigation of the breach cause. At press time, PSN is still unavailable.

The unannounced PSN outage caused some anxiety among game users, and some experts believe that anxiety has morphed into "what about my personal data?" At least one PSN customers has filed a lawsuit against Sony for failing to adequately protect their personal data, and for losses from stolen money.

In an update on the PSN blog, Sony said that credit card data was encrypted and personal data was not encrypted. However, the ArsTechnica blog reported that some PSN customers have already experienced credit card fraud. So, the encryption may not be very good, the credit card data was stolen during transmission, or another source caused the credit card fraud. Regardless, PSN customers should check their credit card statements for fraudulent entries.

The type of data stolen allows identity thieves to easily access consumers' online accounts that use the same sign-in credentials (e.g., username and password). This means that money and more sensitive data can be stolen, if a consumer used the same sign-in credentials with PSN and with their online bank, telephone, and social networking websites. Consumers should change the passwords on their online accounts.

The type of data stolen makes it pretty easy for identity thieves to assume a stolen identity either online or offline in the real world. And since e-mail addresses were stolen, breach victims can expect to receive phishing e-mail messages from fraudsters. Consumers should learn how to recognize phishing e-mails and phishing websites.

Where does the PSN dat breach rank among other data breaches? USA Today reported:

"... the PSN intrusion is arguably the second largest data breach ever, trailing only 2009's Heartland Payment data breach, which impacted 175,000 merchants and millions of payment card transactions per month."

Since credit card account data was stolen, banks will ultimately need to re-issue new credit cards and account numbers to affected consumers. When credit card data was stolen during the Heartland breach, Heartland ultimately paid many millions to credit card companies and banks to cover the costs of re-issuing affected card accounts. After its data breach, Heartland saw its stock price drop about 33%.

One I've Been Mugged reader shared a link to this Ars Technica blog post from February 2011, which warned months ago how PSN credit card data could have been stolen:

"A document written by the hackers has clarified what they did and what privacy and security risks they believe the PlayStation 3 poses. The PS3's connection to PSN is protected by SSL. As is common to SSL implementations, the identity of the remote server is verified using a list of certificates stored on each PS3. The credit card and other information is sent over this SSL connection... custom firmwares could subvert this system. A custom firmware can include custom certificates in its trusted list. It can also use custom DNS servers. This raises the prospect of a malicious entity operating his own proxies to snaffle sensitive data. He would distribute a custom firmware that had a certificate corresponding to his proxy, and that used a DNS server that directed PSN connections to the proxy. His proxy would decrypt the data sent to it, and then re-encrypt it and forward it to the real PSN servers."

While many commenters on this February Ars Technica blog post discredited the hackers' claims and defended Sony, those commenters sure look a little silly now.

Identity Thieves Have A Hidden App For That

The other day, I learned what "money-sucking mobile phones" are. Apparently, manufacturers in China are making mobiles phone pre-installed with computer viruses. The problem is so big that China's Ministry of Industry and Information Technology is cracking down on the criminals.

Here is the sucking part: the computer virus, or hidden app, in these buggy phones are designed to send texts, or perform other operations, that directly cost the consumer money. IT World reported:

"Each month, the phones will spend only about 2 yuan (US$0.30) in text messages or other mobile services. The small amount ensures that users will not take notice... The phones make money by accessing mobile services operated or linked to the handset maker..."

Multiply thirty cents by several hundred-thousand infected mobile phones and you have an efficient money-making enterprise. So far, the affected (infected?) knockoffs are Android phones.

What's a consumer to do? First, buy from a reputable retail store. Second, be a smart Internet user. The bigger threat is probably from websites that install malware or viruses when you visit them. So, don't click on links sent to you from strangers via text messages or via social networking sites. I follow Facecrooks to stay aware of scams and viruses on Facebook. At social networking sites, I don't accept friend requests from people I don't know, or can't verify via an alternate method (e.g., call them on the phone) first.

If you think that your smartphone is infected, AARP Scam Alert says it is difficult for consumers to tell for sure. Here are some clues:

"Your bill may show texts to unknown phone numbers, often occurring at the same time as legitimate calls... The battery is warm when the phone isn't in use, or it dies quickly... Your phone flickers when not in use."

Of course, lock down your smartphone with a passcode. A future blog post will discuss "lost and found" apps for your smartphone.

Stolen Data About India, The United Nations, and The Dalai Lama Traced To China

This InformationWeek article caught my attention for two reasons. First, because of the targets:

"... the Indian Ministry of Defense, the United Nations, and the Office of the Dalai Lama, among other organizations.... The security experts who revealed the attacks managed to track the perpetrators over eight months... Some of the stolen data consisted of visa applications provided to Indian embassies, for example. Other data recovered included some 1,500 letters sent from the Dalai Lama's office... The malware used to compromise victims typically involved an element of social engineering, to convince recipients to open infected files. The attackers used PDF, PPT, and DOC files to exploit old and recent vulnerabilities in Adobe Acrobat and Acrobat Reader, Microsoft Word 2003 and Microsoft PowerPoint 2003."

There was a time when PDF documents were safe. I guess that time has passed. And yes, I follow the Dalai Lama on Twitter. The second reason (bold text added for emphasis):

"The report on the attack... is called Shadows in the Cloud: An investigation into Cyber Espionage 2.0... represents an attempt to differentiate between previous hacking methods and an emerging approach that relies on "the misuse of social networking and cloud computing platforms, including Google, Baidu, Yahoo, and Twitter... The researchers identified three Twitter accounts, five Yahoo Mail accounts, twelve Google Groups accounts, eight Blogspot blogs, nine Baidu blogs, one Google Sites account, and 16 blog.com blogs that were part of the attackers' infrastructure. The report concludes by warning that the selling points of cloud computing -- reliability, distribution, and redundancy -- are the very properties that make cloud services attractive to cybercriminals."

IBM Experiences Another Data Breach

IBM's February 2007 data breach exposed the personal information of all of its employees and former employees. China Tech News reported that the sensitive personal information of 1,000 IBM Shenzhen employees was disclosed by a supplier in China:

"Some IBM employees in Dalian reportedly were also victims of this identity theft scam. A Beijing-based company, which is one of the suppliers of IBM, had allegedly applied for the credit cards, which is called Foreign Enterprise Joint Name Card. Though the BOC outlet stated that it did not issue the credit cards since there were no signatures of the employees on the application forms, one of the employees from IBM said that his card had already been used."

According to Forbes Magazine, IBM moved its global procurement headquarters to Shenzhen, China in 2006. This was the first time the headquarters of a corporate-wide IBM division has been moved outside the USA. IBM reportedly has about 3,000 suppliers across Asia and employees in about 60 countries.

You'd think that by now IBM, a company that is frequently hired by other companies as a consultant about data breaches and computer security, would have this breach and supplier security situation figured out -- that it just wouldn't happen to IBM.

Just like in 2007, IBM is tight-lipped when it comes to details. IBM says it is investigating the latest breach and won't release the name of the supplier. In 2007, IBM never disclosed the name of its supplier, nor the results of its breach investigation. In 2007, IBM offered its breach victims 12 months of free credit monitoring with Kroll.

This week, IBM's X-Force released its 2009 Mid-Year Trend and Risk Report about the threats that affect Internet security, including software vulnerabilities and public exploitation, malware, spam, phishing, web-based threats, and general cyber criminal activity. Several news media sources, including Internet News, ran the following quote about the report:

" 'The trends highlighted by the report seem to indicate that the Internet has finally taken on the characteristics of the Wild West where no one is to be trusted,' said IBM X-Force Director Kris Lamb."

IBM should have added its supplier data breaches to the list of threats. Trust nobody indeed. Don't trust IBM either.

Phorm Raises Money

I've written extensively about behavioral advertising. It is important to track the actions of companies that promote and enable behavioral advertising, particularly the Deep packet Inspection (DPI) technology. Revolution Magazine reported:

"Phorm has raised £15 million through a stock sale to fund expansion plans in Britain and Korea. The company said the capital will be used ‘to continue the implementation of its service in the UK and Korean markets, and for general working capital purposes, as it continues partnership discussions with ISPs both in the UK and internationally."

Phorm developed DPI technology that allows Internet Service Providers (ISPs) to track everything their customers do online. The data is sold to media companies and advertisers so ISPs can supposedly serve up more relevant ads and make more money.

"Last year Phorm sold 1.61 million shares for £20 each - more than four times the value of the latest offering... Kent Ertugrul, chief executive of Phorm said the 3.3 million shares sold for £4.50 each, account for 19.4 per cent of the company, and were bought up by existing shareholders and new financial institute investors."

DPI goes far beyond the older tracking technologies, like Web browser cookies, which advertisers have traditionally used. Congress and consumers are right to take a long, hard look at firms using DPI. And, however favorable the FTC's proposed behavioral advertising guidelines are for corporations, those guidelines are not finalized.

My interest in this is not just the consumer privacy concerns, but the data security concerns due to the fact that company data breaches soared in 2008 compared to prior years. Too many companies don't take data security seriously enough.

Plus, ISPs play a key role in providing consumers with trustworthy access to the Internet. Even though NebuAd closed last month, Phorm is part of a larger situation where ISPs rush for advertising revenues and abuse consumer privacy.