Abney and Associates Security 2014 News: Big Returns from Big Data for Security

Big data can help draw insights for better security. Photo: iStock

Big data is proving a powerful tool in companies’ never-ending struggle to keep data and networks secure.

Big data, or more specifically data analytics, allows vast amounts of information from disparate sources and often in different formats to be  analysed for patterns and anomalies.

Gartner predicts that, by 2016, 25 per cent of large global companies will have adopted big data analytics for cyber security or fraud detection, up from 8 per cent today.

Avivah Litan, vice-president and distinguished analyst at Gartner, said enterprises could achieve significant savings in time and money by using big data analytics to stop crime and security infractions. They should achieve a positive return on investment within the first six months of implementation, which she said was too big to ignore.

From helping pinpoint phishing attempts to screening out scam calls to financial institutions, big data is proving its worth.

Mathew Benwell, senior information security specialist, IT risk management, at the University of Adelaide, said the university turned to general data analytics tool Splunk when an external security audit revealed problems in dealing with phishing attacks.

‘‘Like many organisations, the threat of phishing attacks pose a growing problem,’’ he said. ‘‘These attacks could result in compromised accounts, which at times can have a big impact.’’ 

Mr Benwell said the university had tried a number of traditional security and event management products but had adopted Splunk for its do-it-yourself simplicity.

He said further security applications had emerged since. ‘‘Our use cases are expanding across more IT teams. It is very much about using the electronic log data to try and build useful security analytic.

A quite different example of how data analytics tools can aid in security comes from Verint.

Mark Lazar, Verint’s global vice president for identity and fraud solutions, said the company's Impact 360 product uses passive voice biometrics to help call centre operators combat persistent attacks from fraudsters who talk their way past caller verification checks to gain access to bank accounts. From a recording of a caller’s voice the system is able to identify that person on subsequent calls.

Data analytics make this information even more powerful.

“We can take a fraudster’s voice and track it across time and across accounts and see what they are doing to attack a call centre and from that we can develop patterns of how they do their calling: what is the frequency of the calls, what is the order in which they do certain kind of transactions. Those patterns are very different from the patterns that genuine customers use when they're calling.”

Gartner's Litan said the real security benefits of big data are yet to emerge. “Big data analytics is ahead of most organisations' abilities to successfully adopt them, and most vendors have barely begun to prove their software's effectiveness, so it's still early days for this market,” she said.

She urged organisations to start small, but think big and develop a road map that encompasses multiple applications.

“The return on investment on big data analytics is typically too big to ignore.”

Additional Reading:

Abney Associates Internet Technology: Phishing, Email and Internet Scams

Abney Associates Scam And Fraud Prevention Group

Indian Hustle: How Fraudsters Prey on Would-be US Tech Workers

The Facebook logo is reflected in a young Indian woman's sunglasses as she browses on a tablet in Bangalore on May 15, 2012. Indians eager for US work visas are prime targets for con-artists. (Manjunath Kiran/AFP/Getty Images)

NEW DELHI, India ­— It’s a simple equation: India has millions of tech geeks who would love to work in the US.

But they need visas.

And the US issues just 65,000 of these per year, under its so-called H-1B program for high-skilled workers.

For freelance techies, the temptation is overwhelming.

And that, naturally, has opened up a world of opportunity for fraudsters.

Hundreds of small companies in India and the US claim to be able to arrange an H-1B visa — for the right price. Some Indians hand over money and never see the broker again — a scam similar to the loan brokerage racket featured in the movie “American Hustle.”

True, most H1-B visas go to Indians, but the majority of these are snapped up by big outsourcing firms like Cognizant, Tata Consultancy Services and Infosys.

That only serves to amp up the desperation felt by freelance techies. 

Some are lucky enough to get a visa — only to find that the promised job in the US doesn’t materialize. Then the visa holders are forced to return to India after spending thousands of dollars just surviving.

No official figures are available for the number of frauds in India, but an unclassified document released by Wikileaks showed that in 2009, US consular officials cited H-1B scams as one of the two most common fraud categories in India.

Jaspal Singh, a Delhi-based software professional, told GlobalPost that in 2010 he fell victim to a New York-based company called IT Holdings Inc.

“They took $2,500 from me for visa filing, but they did not file anything,” he said. “After few months they refunded $500.”

Singh was not the only victim. Nitin Mohan, also from Delhi, lost $1,000 to IT Holdings Inc in Jun 2010, he told GlobalPost. After months spent trying to persuade them to refund his money, he eventually posted a thread on Trackitt, an immigration site. Four other people came forward with similar stories.

Although Mohan tried to file a criminal complaint, attempts to contact the New York Police Department from India proved fruitless. He has written off his loss. The IT Holdings Inc website is defunct and a phone number listed as its main contact point is not in service.

“They just disappeared,” Mr Mohan said. “They could be out there acting as a different company and nobody would know.”

Techies use internet forums such as trackitt.com and on Goolti.com to post reviews of working conditions at some of the thousands of IT companies around the world.

Another victim claims to have lost $3,400 to a company that promised to file an H-1B application but vanished instead. Others say they are promised free or cheap training when they arrive in the US, but this was either substandard or never materialize.

Crackdown?

Rajiv Dabhadkar, the chief executive of the National Organization for Software and Technology Professionals (NOSTOPS), has been campaigning for better conditions for IT workers for more than a decade.

“Between 25 and 40 people write to me every week saying they would like to get to the US and asking which company we could recommend,” he said. “These companies are a major problem. The main difference now is that it has become so much more expensive to get H-1B visas. The visa process fees have increased a lot.” Immigration officials ask more questions and check documents more thoroughly than in the past, he added.

While there’s little evidence that the Indian government has pursued the matter, in the US federal officers have had some success in fraud investigations over the last few years.

•          In March 2013, the founders of a Texas-based company called Dibon Solutions were arrested and charged with conspiracy to commit visa fraud. Court documents filed by prosecutors claimed the brothers, Atul and Jiten Nanda (and four of their employees), had recruited Indian workers on the pretence they would work at the company headquarters in Carrollton, Texas. Instead, they were hired out to other companies. (Attempts to contact the company were unsuccessful.)

•          In a separate investigation, Phani Raju Bhima Raju, an Indian national based in Charlotte, North Carolina, pleaded guilty to five federal charges relating to H-1B visa fraud. His company, iFuturistics, made an estimated $13.2 million in six years by persuading Indians to pay for their H-1B visas and work in the US. “On one occasion a foreign national H-1B visa holder had paid $2,500 to iFuturistics as a security deposit for processing her H-1B visa,” according to a US Immigration and Customs Enforcement spokesman in a press release. She was promised a salary of $60,000 but “iFuturistics never provided the worker with any work assignments and failed to pay her any wages.”

•          Federal investigators arrested 11 people in 2009 on suspicion of a similar scam. Vision Systems, a New Jersey company, faced forfeitures of $7.4 million for placing foreign workers in jobs they weren’t entitled to do, replacing American workers. After a plea bargain, the two brothers who ran the firm were given three years’ probation for unlawfully hiring aliens and paid restitution of $236,250 to the US Citizenship and Immigration Service.

Efforts to deal with the problem in India are limited. Data on attempted visa fraud are not collected by the Indian Government or any of the bodies that represent tech companies.

US officials in India make regular reports about fraudulent attempts to get visas. These are not ordinarily published, but Wikileaks released a 2009 paper titled “India Semi-Annual Fraud Update.”

At the time, according to the report, the vast majority of fraudulent applications came from the southern city of Hyderabad. Officers investigated 150 companies in the city and discovered that 77 percent “turned out to be fraudulent or highly suspect.”

Officials uncovered a scheme where Hyderabadis were claiming to work for made-up companies in Pune so the Mumbai consulate would be less suspicious about their applications. “The Hyderabadis claimed that they had opened shell companies in Bangalore because ‘everyone knows Hyderabad has fraud and Bangalore is reputable,’” according to the internal communiqué.

Ameet Nivsarkar, vice president of global trade development for NASSCOM, the trade association for Indian IT companies, said: “Unfortunately this does cause problems for the industry because of the way they operate. They throw the entire H-1B programme into disrepute. This is a legitimate industry that has a legitimate use of the H-1B program.”

Recommended Reading:

Abney Associates Scam and Fraud Prevention

Abney Associates Hongkong

Abney Technology News: Get Social, Your Future May Depend On It

You’ve probably never heard of Bulletin Board System (BBS), or CompuServe; these were arguably the social media of the pre-internet era. AOL (America Online) is what most people however regard as the precursor to today’s social networking sites. Some even call it the internet before the internet.

Although the history of internet can be traced back to the late 1960’s, the World Wide Web came in 1990, but it was not until 1993 that it became accessible to basically everyone around the world.

From the highly successful Classmates.com and the not so successful SixDegrees.com, Hi5, BlackPlanet, down to the Facebook, LinkedIn and Twitter era, the social media world has evolved to become integral part of our everyday lives, and we now celebrate it as one of the greatest gifts technology has given us.

Social Media Week (SMW), which takes place twice a year worldwide, explores the social, cultural and economic impact of social media.

Founded by Toby Daniels, CEO of Crowdcentric, SMW is arguably the largest social media event in the world. Cities of the world where strong local organizers can be gotten are chosen to host each event. Lagos, Nigeria has been chosen as one of the eight cities in the world to host the event this year.

The global theme for the event in 2014 is ‘The Future of Now: Always On, Always Connected.’ The first event of 2014 will hold from February 17 – 21.

This year’s team borders around some of those things we’d easily pick out as the ills or disadvantages of social media and how it has destroyed some social structures in our society.

It has reduced productivity and has led to loss of billions of dollars for many companies. Morse claimed that British companies lost 2.2 billion a year to the social phenomenon and Nucleus Research reported that Facebook shaves 1.5% off office productivity. These two studies posted by Wired.com highlight one of the effects of social media.

“How can we balance and preserve humanness — meaning the ability to listen, empathize, engage, focus and be present in the moment — despite the constant disruption that technology enables?” The question was posed on the SMW website with a promise to discuss it at the event.

Several other topics to be discussed will address virtually everything we’d identify as the ills of social media, with posers like; ‘What does it mean to be “more human” in an age of digital technology?’, ‘How can we find and embrace the technologies that lead us to have more time and focus, not less?’, ‘How can we facilitate meaningful conversations, practices for devoting time to creative thinking and mindful contemplation, and automation of technologies that create more time for you?’, etc.

Social media has made us more aware of the world we live in. It has also driven campaigns and spread news faster than any medium has ever done. The world can now know about breaking news in seconds, while media houses can grow faster with their social media activity.

This medium has also become a learning hub. People engage in intellectual discussions, tutorials, interviews and research via social media platforms.

Perhaps the industry to have fully harnessed the potentials of social media is the marketing industry. Several e-marketing/e-payment solutions have used the social media to push their brands. We now have folks whose day job is social media marketing, and believe me, they are doing fine.

Data Breach Abney and Associates on Phishing Scams News: Target Data Breach could Result in Phishing Scams

MUNCIE — If you did any Christmas shopping at Target, you’ve probably had at least twinges of concern with each new report of the fallout from hackers having stolen credit and debit card information from the store’s files during that period.

Customer names, mailing addresses, phone numbers or email addresses for up to 70 million people were stolen from the retail chain’s system in a breach discovered in mid-December, according to the Target website.

In addition to keeping an eye out for suspicious charges on their accounts, consumers are being warned of another potential attack stemming from the information theft.

STAR Financial Bank last week sent out a warning about email phishing scams related to the data breach. “Phishing attacks use spoofed e-mails (messages from forged addresses, often made to look as if they come from a bank, online retailer or similar business) and fraudulent websites designed to fool recipients into divulging personal financial data,” a release from STAR stated.

Almost anyone using email probably gets the occasional suspicious message purportedly from a bank, business or social media site “checking” on their personal or account information. But those whose information was stolen in the Target data break could be particular targets for current phishing attempts, warned Michael Krouse, STAR’s information security officer.

The American Bankers Association and STAR offer these tips for avoiding becoming the victim of a phishing scam:

• If you have responded to a spoofed email, contact your bank immediately so they can protect your account and identity.

• Never give out your personal or financial information in response to an unsolicited phone call, fax or email, no matter how official it seems.

• Do not respond to emails that warn of dire consequences unless you validate your information immediately. Use a telephone number or web address you know to be legitimate — not any links or contact info from the email — to contact the company to confirm the email’s validity.

• Delete email and text messages that ask you to confirm or provide personal information (credit card and bank account numbers, Social Security numbers, passwords, etc.). Companies don't ask for this information by email or text.

• Check your credit card and bank account statements regularly and look for unauthorized transactions, even small ones. Some thieves hope small transactions will go unnoticed. Report discrepancies immediately.

• When submitting financial information online, look for the padlock or key icon at the bottom of your Internet browser, or in the address bar. Also, most, though not all, secure Internet addresses begin with https://.

• Forward phishing emails to spam@uce.gov and to the company, bank or organization impersonated in the email. Phishing emails also can be reported to reportphishing@antiphishing.org. The Anti-Phishing Working Group, a group of ISPs, security vendors, financial institutions and law enforcement agencies, uses these reports to fight phishing.

• You also can report suspicious activity to the Internet Crime Complaint Center (ic3.gov/default.aspx), a partnership between the FBI and the National White Collar Crime Center.

For information on protecting yourself online, visit the ABA’s consumer section on phishing at aba.com/consumers/pages/phishing.aspx.

Read more related articles:

Abney Associates Scam and Fraud Prevention

International Internet and Technology Warning, Abney Associates Review

Abney Technology News: Bitcoin cyber attack a big warning to users

A massive cyber attack from unknown sources that has been spamming bitcoin exchanges is highlighting some of the dangers people can encounter when they exchange cash for digital currencies like the bitcoin, experts said on Wednesday.

The attack, which is technically known as a distributed denial of service attack, involved thousands of phantom transactions, forcing at least three of the online platforms that store bitcoins and trade them for traditional currencies to halt withdrawals of bitcoins until they can determine which transactions were real.

It showed that bitcoin, which exists solely in cyberspace and operates on a software code written by an unknown programmer or group of programmers, is as vulnerable to such an assault as any other internet-based business. It exposes the higher risks involved in owning and trading the instrument compared with the dollar and other traditional currencies. Bitcoins slumped in value as a result of the disruptions.

"Bitcoin is still an experimental protocol in its infancy," said Micky Malka, a venture capitalist who is on the board of Bitcoin's trade group, the Bitcoin Foundation.

"It will grow and mature over time," he added. "No one should be investing an amount they cannot afford to lose."

This week's attack was not the first, said Andreas Antonopoulos, chief security officer for blockchain.info, a website that tracks bitcoin activity and provides online storage services for bitcoin users.

Antonopoulos is also a member of a group of core bitcoin programmers and is part of an emergency response team of programmers who have been working to fix the flaws in the code governing some bitcoin transactions that the attackers were exploiting. He said that work that should be completed by the middle of next week, echoing an estimate provided by a spokeswoman for the Bitcoin Foundation who said its core developers were all participating in the effort to fix the code.

Bitcoin is a decentralised digital system of value transfers that is not governed by any central bank, company or government. No assets back the bitcoin, whose value has fluctuated widely as its visibility has increased. Last September, a bitcoin was worth around US$150. By late December the value was near the US$1000 mark.

Regulators around the world are struggling how to categorise the bitcoin. Some want to call it an asset class, others a commodity. Bitcoin users call it a currency and many advocate for its mass adoption, claiming it can help solve problems created by expensive and time-consuming bank transactions.

Early adopters also liked the anonymity bitcoin has offered, since it can be transferred between users without any exchange of personal identification information. However, moves by various authorities to pursue bitcoin users who they say have laundered money using the currency and attempts to regulate bitcoin exchanges could soon lower the level of anonymity in transactions.

On Tuesday, Slovenia-based Bitstamp became the second major bitcoin exchange to halt customer withdrawals in the past several days, citing "inconsistent results" and blaming a denial-of-service attack.

That was a day after Mt Gox, based in Tokyo and the best-known digital marketplace operator, said a halt on withdrawals would continue indefinitely. Traders reacted to the halt by sending the bitcoin value to its lowest level in nearly two months.

A Bulgaria-based bitcoin exchange also had to halt withdrawals, Antonopoulos said.

The price of bitcoins, which have gained wider acceptance in recent months, dropped in the wake of the attacks from around US$850 late last month. On Wednesday, they were quoted down nearly 2 percent for the day at US$656 per coin on the bitcoin tracking website CoinDesk.

"Anyone who plays in this space, you better have a plan for when an attack happens because it's going to be a when, not an if," said Brian Krebs, a Washington-based cyber security expert who runs the blog KrebsOnSecurity.com.

The lesson for investors was that the bitcoin wasn't as liquid as initially advertised, said Jason Scharfman, a financial due diligence expert and managing partner at consulting firm Corgentum.

"These types of attacks, they're effectively freezing some of the accounts because the exchanges don't want to pay out to the wrong person," he said. "If something's frozen or there's a question about me being able to redeem my bitcoins, the value of them drops."

"Does this spook financial investors?" he added. "The answer is yes."

Scharfman said one way to mitigate the risks of such attacks would be to spread holdings of bitcoins out among several different online storage facilities. That way if one were attacked the other might still have a chance at being safe.

Scharfman said the more regulatory scrutiny that bitcoin exchanges received, the safer they were likely to be.

"Regulation will sort of normalise which exchanges are the most secure. They'll mandate security measures and smaller exchanges just won't be able to afford it," he said.

Hackers by Abney and Associates Internet Technology Blog: Internet Trolls, Scammers and Hackers Targeted by New Gloucestershire Cyber Crime Squad

Internet trolls, scammers and hackers targeted by new Gloucestershire cyber crime squad

A NEW team is being set up to crackdown on cyber crime in Gloucestershire, including harassment on social media sites, hacking and internet fraud.

Gloucestershire Police will be identifying and training a specialist network of its officers to combat the growing number of offences committed on the internet in the county.

New figures reveal there were hundreds of internet fraud and other online offences against victims in Gloucestershire in the last ten months.

The statistics show 89 people or businesses fell prey to hackers and 240 people were targeted by fraudsters on internet auction sites between April and December last year.

IN addition, the number of people making reports of offences in which social media sites were mentioned, which typically include allegations of harassment, increased from 55 in 2010 to 2011 to 78 in 2012 to 2013.

Between April and December in 2013, there were 75 offences involving computer software such as malware and viruses, 100 offences of computer software service fraud and 12 dating scam offences and seven lottery scams.

Detective chief superintendent Bernie Kinsella said cybercrime was right at the top of the force’s agenda because of the increased number of offences and the impact it was having on society.

 “You just have to look at the number of people affected right here in Gloucestershire to realise how big a concern this is,” he said.

"These cases could cover malicious communications via Twitter and Facebook and internet trolling, for example.

“The law is complex and we're determined all officers are trained to understand and implement it consistently.

"It's vital we do more to clamp down on these crimes and send a clear message out to those abusing others via the internet that we won't stand for it."

The new team will be partly funded by the increase in the police’s council tax precept and officers are being identified to train and specialise in overseeing investigations.

Part of the new team’s role will also include working with agencies such as the Child Exploitation and Online Protection Centre to bring down online criminal gangs, such as those carrying out sexual abuse and internet fraud.

Recommended Reading:

Abney Associates Hong Kong Cybercrime Reports: Internet Fraud

Abney Associates Scam And Fraud Prevention Group

Abney Technology News: Warning to public over web piracy

Fans who illegally download TV shows such as Game of Thrones are under threat, with the Abbott Government flagging tough new rules to crack down on online piracy.

Attorney-General George Brandis said yesterday that hundreds of thousands of Australians who illegally downloaded content were thieves and he was considering ways to make internet service providers block users of pirate websites.

Senator Brandis' speech to the Australian Digital Alliance comes after the Law Reform Commission recommended a "fair use" provision for copyrighted works, a move opposed by movie studies and other rights holders.

The commission claims fair use would legitimise consumer activity currently against the law, such as copying a legally acquired movie to a personal device and was not an argument for legalising piracy.

Senator Brandis said he was yet to be persuaded about fair use provisions but pledged to revamp copyright law so that it was shorter and simpler, and would be technology-neutral with "no more amusing references to videotapes".

He cited how the High Court's ruling in 2012 against movie companies who had tried to force WA-based internet service provider iiNet to stop its users from downloading copyrighted material changed the understanding of the law.

He said he was sympathetic to those against the "scourge of online piracy" and was considering a "legal incentive" for internet service providers to co-operate with copyright holders.

Although complex, one option would be to make ISPs liable for issuing graduated warnings to consumers using websites to break the law. Another idea was allowing third parties to seek an injunction against ISPs, ordering them to take down websites hosting infringing material.

Greens' communications spokesman Scott Ludlam said Senator Brandis was siding with Hollywood rather than ordinary Australian users.

Abney Technology News: Record-Breaking High-Speed DDoS Attack Strikes Europe

A distributed-denial-of-service (DDoS) attack on Monday reached more than 400Gbps at its peak. This is about 33 percent greater than the Spamhaus attack last year, which was the previous DDoS record holder. This massive attack exploited key vulnerabilities in the infrastructure of the Internet and has been called the “start of ugly things to come.”

Online security specialists Cloudfare said this attack was the biggest of its kind, reported the BBC.

In this particular attack hackers utilized weaknesses in the Network Time Protocol (NTP), a system that is used to synchronize computer clocks. Through this vulnerability hackers were able to flood servers with huge amounts of data and security experts warn that this technique could be used to force popular services offline.

The attack appeared to have been directed at a specific customer of content delivery network and security provider CloudFlare, which first reported the attack.

“Very big NTP reflection attack hitting us right now. Appears to be bigger than the #Spamhaus attack from last year. Mitigating,” Cloudflare CEO Matthew Price said via Twitter. “Someone’s got a big, new cannon. Start of ugly things to come.”

NTP servers are designed to keep computers synchronized to the same time, and the fundamentals of this protocol date back to 1985 when NTP began operating. Despite updates to the system it still operates much as it had since it first went online. Computers need to synchronize time via NTP by sending small amount of data to make a request, which then results in a reply that sends data back.

There reportedly exists a significant vulnerability in that the amount of the data that NTP sends back is larger than that which it receives. Thus any attack is instantly amplified, but the other problem is that the original computer’s location could be “spoofed,” which could trick the NTP into sending the information back to somewhere else.

This could result in an amplification attack, which CloudFare explained in a blog post in early January: “Amplification attacks like that result in an attacker turning a small amount of bandwidth coming from a small number of machines into a massive traffic load hitting a victim from around the Internet. Until recently the most popular protocol for amplification attacks was DNS: a small DNS query looking up the IP address of a domain name would result in a large reply.”

CloudFare did not identify the specific customers targeted in the attack, but Cnet reported that Price said it was directed at servers in Europe and that “these NTP reflection attacks are getting really nasty.”

Cnet also reported that the frequency of NTP reflection attacks has grown in recent months and that a recent NTP attack was used to take down game servers hosting EA’s Origin, Blizzard’s Battle.net and League of Legends, amongst others.

US-CERT had issued a warning to companies about the growing popularity of this specific threat.

“Due to the spoofed source address, when the NTP server sends the response it is sent instead to the victim,” CERT warned. “Because the size of the response is typically considerably larger than the request, the attacker is able to amplify the volume of traffic directed at the victim.”

CloudFare warned of impending NTP attacks in a report published last October and it detailed how web hosts could best work to protect customers.

CloudFare offers services that protect websites and users by placing an extra layer of digital defense between the sites and its customers and this includes the caching of sites to allow visitors to have their web content loaded more quickly. Its services are so popular and deliver so many page views per month that if it were an actual website it would be the 10th largest in the world.

However, last year CloudFare suffered a server crash that resulted in more than 785,000 websites experiencing an outage.

Pc Speak: Abney Associates Review, 3 Reasons Card Data Breaches Are Here to Stay

The Target breach is just the beginning, experts told Credit Union Times. Thieves will continue to find ways to access valuable financial and personal data.

Here are three reasons why:

1. Because they can.

By far, the main reason thieves have begun to steal card data from U.S. firms, some experts say, is because they can.

“The U.S. payments industry has become the one household in the neighborhood that has not upgraded its security system while everyone else has,” explained Karisse Hendrick, program manager in payments and fraud for the Merchant Risk Council, an international trade group that is organized to help firms fight card fraud. “When you are perceived to have security that is the easiest to beat, she added, thieves will try to beat your security.”

Breaches have their roots in the three large shifts in the global payments, technology and U.S. economic and political environments. Hendrick pointed out that the payments industry in the U.S. is perceived as among the richest, further heightening its desirability as a target.

“Those two things combine to make U.S. firms the biggest targets for data security breaches and subsequent fraud,” Hendrick said.

Further, the U.S. has not become the leading data theft target overnight in the country, Hendrick noted. International criminal interest in the U.S. has been growing for years, as Verizon documented in its 2013 Data Breach Investigations Report.

As other countries have gradually tightened their security systems and implemented tools such as smart-chip cards with the EMV standard, the U.S. fraud prevention protocols have fallen farther behind, the Verizon report said. It's not that the Payment Card Industry Data Standards have not done a good job, the technology they were protecting is simply not as secure as other payment's technology, Hendrick explained.

2. Thieves have upgraded their programming skills.

The second reason data breaches are here to stay is because thieves have gotten better at writing programs to steal the card data, industry watchers have found.

For instance, even though the phenomenon of a malware package that infected POS terminals came to widespread attention with the Target breach, the FBI has reported there were at least 20 breaches that used a similar approach. Further, the agency said it appeared thieves had used at least one malware package to test out firm's defenses. When that package they were developing had not performed well enough, the thieves created another one that worked better from their point of view.

3. Card issuers and retailers lack unification.

The third reason that breaches are likely to continue is the lack of a coordinated or unified approach to the challenge they represent. Previously, the U.S. payments industry was cohesive because card issuers and retailers agreed they better when consumers used a card to pay for goods and services as opposed to cash.

Retailers benefited from not having the risk of theft that came with cash and from the quick and guaranteed payments that cards represented over checks. Card issuers also gained from the interchange that card transactions generated by not having to pay for check processing. But the unified front has largely broken down in the face of retailers’ legal and legislative challenges to interchange and the resulting controversy has undermined the payments industry's ability to work together to confront the problem.

Executives with the National Retail Federation, one of the organizations that supported the Durbin Amendment's cap on debit interchange for issuers with more than $10 billion in assets and sued the Federal Reserve to lower them, complained that the current approach to card data security does not work and is costly to retailers.

Doug Kantor, a partner with the Washington-based law firm of Steptoe and Johnson, helped represent the NAR in its legal fight with the Federal Reserve and laid out some of the trade group's complaints about the current card data security regime in an interview with Credit Union Times.

Kantor said retailers already pay nearly all the costs of card data security on the acquirer side by making sure their systems comply with industry security standards. However, those retailers currently have no say in setting those standards.

“The data security standards come entirely from the card brands and card issuers without any input from retailers,” Kantor said. “Also, the data security standards don't provide full proof protection from breaches and, if there is a breach, the retailers face enormous expenses in fines from the card brands and possible legal action.”

He said retailers believe the new chip cards on the EMV standard provide a very promising means of combating the threat but retailers want to play an active part in the new technology.

To illustrate, the card brands are currently adopting a standard for EMV cards that will not always require a PIN. These cards will have a magnetic stripe that will allow them to be swiped and a chip to provide data in real time which authenticates the transaction and the card.

Retailers believe this leaves them open to greater fraud risk and want the U.S. to mandate the use of PINs, Kantor said. Visa and the other card brands argue that in an economic environment like the U.S., where almost all transaction are going to be online and thus verifiable in real time, the PINs are not needed.

Pc Speak: Abney Associates Review, Beware: Cyber fraudsters sending out 'court summons' emails to steal details of computer users

Computer users are being warned to steer clear of a bogus court summons email that has been designed to steal their bank details.

Once opened, the attachment releases a virus that allows crooks to access all personal information from dates of birth and passwords to credit card numbers and bank accounts.

The Trojan Horse virus gives cyber crooks full remote control of the computer - from anywhere in the world - and lays bare every sensitive detail on it.

Fraudsters are hijacking real names of court officials to panic internet users into opening the malicious file which contains the virus.

Claiming to be from the court clerk, the fake email says all the relevant details are in the attachment which should be read “thoroughly”.

And it adds: “If you do not attend the hearing, the judge may hear the case in your absence.

“Yours truly, L McNamara, Clerk to the Court.”

Millions of scam emails are believed to have been sent out and the Business Crime Reduction Centre (BCRC) has traced them to a server in America.

It is now urging anyone who receives an email with “notice to appear in court” in the subject box to contact Action Fraud on its hotline number 0300 123 2040.

And it is warning Brits not to open the attachment, forward the email or try and contact the senders.

BCRC’s cyber security specialist, Mark Connell, said: “Provoking a panicked, impulse reaction has become a very common scam technique for cyber criminals.

“Opening the attachment allows the criminal to spy on the victim, use their computer to commit crime, or steal personal and financial information. This email is difficult to block as the subject headers change frequently.”

Today, a spokesman for the Court Service said court summons were always posted and would not arrive by email.

Pc Speak: Abney Associates Review, Keeping Swindlers Out of Your Bank and Brokerage Accounts

Data breaches at Target and Neiman Marcus were certainly scary. Personal information from tens of millions of people fell into the hands of cybercriminals.

But an equally threatening and perhaps more personal attack is a hacker getting into your email and then using it to take money from your bank and brokerage accounts.

It is a problem that is increasing at all wealth levels, from individuals with small investment accounts to family offices that serve the wealthiest clients. Naureen Hassan, senior vice president of client experience at Charles Schwab, which is the largest custodian of independent advisers in the country, said the firm had seen a fivefold increase in email-related fraud over the last two years.

“The biggest type of fraud we see is the fraudster takes over the person’s email, and emails the adviser asking for urgent money,” Ms. Hassan said. “The other problem is related to clients storing signed pieces of paper in their email, which allows fraudsters to forge their signature.”

One of the better-known cases involved a client of GW & Wade, a Focus Financial Partners firm in Wellesley, Mass., that manages about $4 billion. The firm, which settled in October with the Securities and Exchange Commission, sent $290,000 of a client’s money in three separate wires to a foreign bank, in response to a hacker sending emails from the client’s account requesting the transfers.

The S.E.C. accused GW & Wade of not having adequate safeguards to prevent the thefts and fined it $250,000 for executing the transfers. In its censure of the firm, the agency required it to take remedial steps to increase data security.

“When alerted to the situation, we took immediate action and ensured our client was never at financial risk,” Neil Goldberg, a principal of the firm, said in a statement. “Since then, we have put into place both new systems and procedures to prevent any similar occurrence.”

While GW & Wade ended up being penalized financially and took a reputational hit, its mistake served as a warning to other independent advisers eager to respond to client requests.

A client of a Boston adviser said that he and his wife were traveling in Asia in the fall when their account was hacked and emails were sent to everyone at the adviser’s firm who had ever emailed him, asking for a wire transfer.

He said the adviser tried to contact him, unsuccessfully, and then reached out to his son to let him know what was happening.

“They read my emails, and they mimicked my tone for requests for money,” said the man, a retired financial services executive who requested anonymity. “The whole system appeared to be more sophisticated than these notes from Nigeria.”

The Nigerian prince email swindle, in which a supposed royal offers riches in exchange for a bank account number, is to today’s phishing scams what a Brother word processor from the 1980s is to a MacBook.

Abney Associates Review

A security executive at a trust company told of a hacker who got creative in trying to fool the firm. The executive, who requested anonymity, said the firm received an email from a client’s account asking that $137,000 be wired to Italy to buy some art. He said this client was part of a large family that traveled frequently, so the request was not odd on its face. But he said the family had put a procedure in place in which no wires went out without a call being made to the person requesting the money.

The executive said clients can be frustrated by this level of bureaucracy, until someone they know gets hacked. “Once it’s happened to one of their family members,” he said, “it’s amazing how they’re much more accommodating.”

This is where the solution to a sophisticated swindle can sometimes be the simple action most people would take if a stranger knocked on their door at night: They would not answer it.

“I called my wealth manager and said, ‘If I emailed you to wire $25,000 to a third party or someone with the same last name as me, what do you do?' ” said Ken Springer, a former F.B.I. agent who is now president of Corporate Resolutions, an investigations firm. “He said they would want to get a verbal confirmation, and they’ll document what phone number I used. Most reputable firms require that.”

It wouldn’t hurt to ask the same question of your wealth manager. Where some advisers slip up, though, is in thinking they have received several levels of verification when they have not.

“An email with an attached, signed letter is not enough because it’s all the same communication,” said Jeffrey R. Bedser, founder and chief executive of iThreat Cyber Group. “That’s not two forms, that’s one communication. There should always be a secondary verification.”

Beyond employing offline common sense, individuals need to be vigilant about how they use technology and the systems their advisers have to prevent their accounts from being hacked, or, if they are hacked, to keep their money from being transferred.

A common area where security breaches occur is an unsecured public wireless network, say in a coffee shop or park. People who commit fraud set up fake hot spots that will still give you access to the Internet but will capture everything you do on the swindler’s computer.

Another mistake is using your email address as your login for any banking or investment account. “You’re giving hackers half the battle,” said Bill Wyman, chief executive of Summitas, a firm that builds encrypted communications portals for financial services companies.

PC Speak: Abney and Associates Internet Technology Review: Avast Internet Security (2014) Review: Short on Security

Source

Avast's suite has some premium features and is generally easy to use, but it fell short in the crucial area of protection.

Avast is a company perhaps best known for its free antivirus software. But paying for Avast Internet Security 2014 ($40 for one year of protection on one PC) will get you such premium features as a robust firewall, online banking security, and phishing and scam email protection.

Avast blocked 89 percent of zero-day (unknown) attacks in our real-world tests. That result may sound pretty good, but most of the suites in our roundup blocked 98 percent or more of such attacks. In our roundup, only Vipre Internet Security 2014 (at 87 percent) and Webroot SecureAnywhere Internet Security Complete (at 82 percent) fared worse in the real-world tests.

When it comes to known malware attacks, Avast looks better on paper, blocking 98 percent of those attacks, except that all nine other security suites in our test group blocked 99 percent or more of them. Avast’s detection system properly ignored all of the innocuous programs, websites, and installations that AV-Test threw at it.

In AV-Test’s performance evaluations, Avast scored a low-impact 2—below average (in a good way) for a security suite. You system won’t take much of a performance hit by using Avast.

Installing Avast Internet Security 2014 takes you through just a couple of screens. Regrettably, one of those screens is a software push for installing Google Chrome as your default browser and the Chrome Toolbar for Internet Explorer. Ironically, one of the suite’s services is a browser cleanup tool that “removes annoying browser toolbars from your computer.” Avast’s installer relies heavily on the Internet, so the installation process can be time-consuming if you have a slow connection.

Avast’s interface is easy to use, but its multiple colors and font sizes say “freeware” rather than “premium security suite.” The main screen features a large banner that indicates protection level: A green checkmark is good, and a red x is bad. Under the main status are four buttons: ‘Quick scan’, ‘Browser cleanup’, ‘Mobile protection’, and an empty button that you can use to add a quick link to any feature (even help and support).

The rest of Avast’s options, including tools such as SafeZone (for banking and shopping protection), SecureLine (VPN), and a link to Avast’s online store, are discoverable through a menu on the left. VPN service is a nice extra: If you connect to a new network, Avast prompts you to select a protection level (private or public) to keep you safe while you’re browsing the Web.

Average users might find Avast’s settings menu intimidating. Few explanations accompany the top-level menus. The sheer quantity of advanced settings is daunting, and Avast’s explanations are geared toward fairly experienced users. Though the buttons and toggles are touchscreen-friendly, none of the menus let you tap and drag to scroll—you have to use the tiny, thin scrollbars instead.

Despite its clunky interface, Avast Internet Security 2014 offers many features you won’t find in other security suites. It could be worth considering if you favor range of features over ease of use.

Want to read more? You can visit our website

PC Speak: Abney and Associates Internet Technology Review: Suspicious Emails Spark Concerns with Amazon

Check my Source

With all of these data security breaches lately, customers of Amazon and Turbo Tax are letting me know they’re concerned.

But do they need to be?

Let’s take a look at the Amazon issue first.

Nicki from the West Valley, emailed about a deal she was making on Craigslist.

She was looking for a motor home and found one for a good price.

Then she got this email from the seller saying she wanted to use Amazon payments for the transfer of money.

Here’s part of the email:

“I had prearranged the deal with Amazon FPS. The trailer is located at Amazon’s shipping company, ready to be delivered. It will arrive at your address in 3 days. You will have 5 days to test it and inspect the motorhome and if by any reason you find something you don’t like about it you can send it back at my expense but I’m sure will not be the case.

If you are interested in knowing more info about how it works, I can ask Amazon to send you an email with more information on how to purchase it. Amazon will contact you shortly after they have the details with all the information that you need to complete this deal and you will also have proof that I am covered by them and a legitimate seller. If you would like to receive the email from Amazon with all the transaction information go on Amazon Payments by clicking on this link.”

Amazon payments are a legitimate site.

We sent Nicki’s concerns to Amazon. They say it appears this site is a scam.

Here’s Amazon’s statement to us:

“Thank you for bringing this to our attention. The URL in your email is not owned or operated by Amazon.com or any of its affiliates. The site appears to be a scam and Amazon will take immediate steps to have it taken down. We also encourage any victims of these types of phishing scams to contact law enforcement.

“Amazon Payments was designed to help millions of Amazon customers securely pay on a third party website or mobile site with the information already stored in their Amazon account. When you click on ‘Login with Amazon’ or ‘Pay with Amazon’ the login page or pop-up window should only ask for your Amazon credentials (email address and password) and the URL should read either: payments.amazon.com or amazon.com. We will not ask you for your shipping or credit card information outside of the secure Amazon.com site. Customers trust Amazon with their payment information and we take that responsibility very seriously.

“There is more Amazon Payments security information here. We also encourage our customers to review the Amazon FAQ on phishing and Internet scams here. Please send any concerns to stop-spoofing@amazon.com.”

So Nicki’s email to us may have saved others from getting scammed.  

Make sure to check your credit report for any activity you don’t recognize.

Go visit this website