ATM Fraud , Fraud , Payments Fraud

FICO: Debit Card Fraud Spiked in 2016 Non-Bank ATMs and Point-of-Sale Devices Hit Hard Jeremy Kirk (jeremy_kirk) • April 3, 2017    

Despite a years-long move to shore up the security around payment cards in the U.S., certain types of fraud are on the rise.

See Also: Three and a Half Crimeware Trends to Watch in 2017

FICO, the financial risk and analytics consultancy, says the number of debit cards that were compromised after the hacking of ATMs or point-of-sale devices rose by 70 percent in 2016 versus a year prior.

The statistic comes from companies that subscribe to FICO's Card Alert Service, a paid-for product used by payment card issuers to analyze card purchases en masse to identify fraud trends.

FICO says it also detected a 30 percent rise in hacked ATMs and POS terminals at restaurants and merchants.

The statistics would seem to contradict the investments made in U.S. payment card infrastructure over the past few years. The U.S. is moving to EMV, which uses payment cards with a microchip containing security features designed to counter illegitimate card use (see EMV Rollout: Are We There Yet?).

But a closer look at how the U.S. is transitioning to EMV reveals why this uptick in ATM skimming attacks is really not so surprising. Most ATMs, especially off-premises ATMs at retail locations, have not yet been upgraded to accept EMV chip cards. And they aren't likely to be EMV compatible anytime soon.

Visa's liability shift date for fraud that results from compromised cards used at ATMs takes effect in October 2017. (MasterCard's shift was October 2016, but the card brand has not reported totals for ATMs that are now accepting chip transactions on its cards.) Still, many experts predict that a majority of off-premises ATMs, which are often run by retailers or independent operators, will never be upgraded to accept EMV chip cards. If fraud losses shifted back to merchants and independent ATM owners become too high in the wake of the liability shift, then most of these retailers and independent operators may opt to have the ATMs taken out, rather than pay for upgrades.

Stand-alone ATMs

FICO notes in its report: "As in 2015, the most compromises occurred at non-bank ATMs, such as those in convenience stores. About 60 percent of compromises were at non-bank ATMs, with the rest occurring at bank ATMs or point-of-sale devices, such as card payment machines at retailers."

If an ATM can't read an EMV chip, it reads the magnetic stripe on the back of the card, which contains account information. EMV was designed, in part, to counter skimming, in which fraudsters copy the magnetic stripe's information and encode it on a dummy card that is then used to withdraw money.

ATMs that haven't been upgraded to accommodate EMV may also be targeted by fraudsters to use those cloned cards. Non-bank ATMs are also viewed as easier targets than bank ATMs for installing skimming devices that collect payment card details.

POS

POS terminals, as well as the back-end payments infrastructure, are targeted with malicious software by cybercriminals. The aim is the same: to capture large number of card details that can be replayed in fraudulent transactions.

Over the past few years, card breaches at merchants have become routine. Merchants are supposed to follow the Payment Card Industry's Data Security Standard, a set of security practices designed to protect card information. Smaller merchants with less IT support tend to be more disadvantaged, and it's well known that a single mistake can expose weaknesses that could lead to a breach.

Still, the amount of time in which an ATM or POS device was compromised until when the breach was detected fell last year, FICO reports. FICO say that average compromise period for either an ATM or POS was 11 days, down from 14 days in 2015. Keep in mind, however, that this statistic is for FICO subscribers, and its fraud alert service may have been a contributor to the improvement.

Dodgy ATMs

It can be tricky to identify a skimming device on an ATM, but FICO dispensed the usual advice: If an ATM looks like it has been tampered with, find a different one.

If your card gets stuck in an ATM, it could be a sign of an attack. "Sometimes you may think that your card was captured by the ATM when in reality it was later retrieved by a criminal who staged its capture," FICO says. "Either way, you will need to arrange for a replacement card as soon as possible."

Another common sense tip is to avoid an ATM if someone is hanging around it. FICO advises to "never engage in conversations with others around an ATM. Remain in your automobile until other ATM users have left the ATM."

(Executive Editor Tracy Kitten contributed to this report.)

Splunk last week released an update for Splunk Enterprise to address an information theft bug and a persistent Cross Site Scripting (XSS) vulnerability.

Discovered last year by security researcher John Page (who goes by the online handle of hyp3rlinx), the information theft issue is tracked as CVE-2017-5607 and has been assessed a CVSS Base Score of 3.5. The vulnerability can be exploited by a remote attacker to siphon information from Splunk Enterprise when the user visits a malicious webpage.

In an advisory, the security researcher notes that an attacker exploiting this vulnerability could access data such as the currently logged in username and if remote user setting is enabled. With the username in hand, the attacker could either phish or brute force the Splunk Enterprise login.

The attacker can use JavaScript to exploit the issue, as the root cause of it is the global Window JS variable assignment of config?autoload=1 '$C', the security researcher notes in his advisory.

“To steal information we simply can define a function to be called when the '$C' JS property is ‘set’ on webpage, for example.

Object.defineProperty( Object.prototype, "$C", { set:function(val){...

The Object prototype is an Object that every other object inherits from in JavaScript, if we create a setter on the name of our target in this case "$C", we can get/steal the value of this data, in this case it is very easy as it is assigned to global Window namespace,” the researcher explains.

Splunk has confirmed that affected Splunk Enterprise versions include 6.5.x before 6.5.3; 6.4.x before 6.4.6; 6.3.x before 6.3.10; 6.2.x before 6.2.13.1; 6.1.x before 6.1.13; 6.0.x before 6.0.14; 5.0.x before 5.0.18; and Splunk Light before 6.5.2.

The security researcher discovered the bug in November 2016 and reported it to Splunk the same month. He received acknowledgement of the bug a couple of days later, but the patch was released only last week. The researcher published not only details pertaining to the vulnerability, but also proof-of-concept JavaScript code and a video to demonstrate the flaw.

The second vulnerability addressed in Splunk Enterprise last week was a persistent Cross Site Scripting in Splunk Web, which was found to allow an attacker to inject and store arbitrary script, but only if they are authenticated in Splunk web before exploiting the bug. Assessed with a CVSS Base Score of 6.6, the flaw impacts Splunk Enterprise versions 6.5.x before 6.5.3; 6.4.x before 6.4.6; 6.3.x before 6.3.10; 6.2.x before 6.2.13; and Splunk Light before 6.5.2.

Related: Splunk Unveils New Threat Detection, Analytics Offerings

Original author: Ionut Arghire

Fraud , Risk Management

Fraudsters Diversify from Fake Tech Support to Voice Capture Mathew J. Schwartz (euroinfosec) • March 31, 2017     Scams recently reported to the Better Business Bureau's Scam Tracker.

Don't pick up the phone to answer calls from unknown numbers. Instead, let them go to voicemail.

See Also: 2017 Predictions on Data Security: Insights on Important Trends in Security for the Banking Industry

That's the operational security advice being promulgated to Americans by the U.S. Federal Communications Commission in response to an ongoing series of attacks designed to trick victims into uttering a single word.

The FCC says in a March 27 alert that the scam centers on tricking victims into saying the word "yes," which fraudsters record and later use to attempt to make fraudulent charges on a person's utility or credit card accounts.

"The scam begins when a consumer answers a call and the person at the end of the line asks, 'Can you hear me?' The caller then records the consumer's 'Yes' response and thus obtains a voice signature," the FCC warns. "This signature can later be used by the scammers to pretend to be the consumer and authorize fraudulent charges via telephone."

Fake Tech Support

This isn't the first time that fraudsters have "weaponized" the telephone.

Scammers have long phoned consumers, pretending to be from a government agency such as the Internal Revenue Service. Another frequent ploy is pretending to be from the support department of a technology firm, such as Microsoft or Facebook, and then trying to get victims to pay for bogus security software meant to fix nonexistent problems on their PC (see Researcher Unleashes Ransomware on Tech-Support Scammers).

Authorities have made some related arrests. Last year, Indian police arrested 70 suspects as part of an investigation into a fake IRS call center scam.

Also last year, the FTC announced a $10 million settlement with a Florida-based tech-support scheme, run by an organization called Inbound Call Experts, also known as Advanced Tech support. The FTC and the state of Florida said the organization ran "services falsely claiming to find viruses and malware on consumers' computers."

Researchers Study Scammers

In a recent paper, "Dial One for Scam: A Large-Scale Analysis of Technical Support Scams," researchers at the State University of New York at Stony Brook described how the tech-support version of these scams work, as well as how they might be disrupted by targeting the infrastructure on which scammers rely.

"Scammers use specific words in the content of a scam page to convince the users that their machines are infected with a virus," the researchers say.

The Stony Brook researchers designed a tool called ROBOVIC - for robotic victim - that found that of 5 million domains that it successfully connected to during a 36-week period beginning in September 2015, it logged 22,000 URLs as serving tech-support scams, connecting to a total of about 8,700 unique domain names.

But those 22,000 different web pages used a total of only 1,600 phone numbers, of which 90 percent were connected to one of four VoIP services: Bandwidth, RingRevenue, Twilio and WilTel.

The researchers also phoned 60 scam telephone numbers to log the social engineering tactics - aka trickery - used by scammers. The researchers found that on average, scammers waited until 17 minutes of a call elapsed before offering their services in exchange for money. Most would offer support packages that ranged from a one-time fix to multi-year support, with costs ranging from $69.99 to $999.99. Scammers would typically offer multiple options, then try to persuade victims to pick the middle-priced one, the researchers found.

Freelance attacks appear to be rare. "Through the process of interacting with 60 different scammers, we are now convinced that most, if not all, scammers are part of organized call centers," the researchers write.

Fake Support is Lucrative

These attacks are relatively easy to launch, inexpensive to run, potentially very lucrative and show no signs of stopping.

Peter Kruse, head of the security group at Danish IT-security firm CSIS, this week warned via Twitter that multiple websites were pretending to be related to the technical support group from Czech anti-virus software developer Avast and urging individuals to call one of the listed phone numbers.

A large number of websites have been injected with @avast_antivirus customer support number scam, https://t.co/NPeGVjZ4fV

Needless to say, these numbers don't lead to Avast, which develops free security software that's used by many consumers. Instead, the numbers go to call centers tied to fraudsters. Avast has repeatedly warned that this a well-worn scam, with attackers often claiming to be connected to Avast, Dell, Microsoft, Symantec or other technology firms.

Advice for Victims

There's no way to prevent criminals from running these types of scams.

But law enforcement and consumer rights groups have long urged victims to file a report, even if they didn't suffer any financial damage as a result.

For anyone targeted by the "yes" scam, the FCC recommends immediately reporting the incident to the Better Business Bureau's Scam Tracker and to the FCC Consumer Help Center. The FCC's site also offers advice on tools for blocking robocalls, texts and marketing calls.

Anyone who thinks they may have been the victim of phone scammers, for example, by paying for fake tech support, can file a fraud report with their credit card company.

Authorities also recommend they report the attempt to relevant authorities, such as the FBI's IC3 Internet Complaint Center or to the U.K.'s ActionFraud. Law enforcement agencies use these reports as a form of crowdsourcing, helping them secure funding to battle these types of scams, as well as take them down.

New "USB Canary" Tool for Linux Monitors USB Ports 24/7

A new open source tool can provide Linux users with the ability to receive an alert any time someone attempts to plug a device into one of their machine’s USB ports.

Dubbed USB Canary, the tool uses pyudev to monitor USB devices and can be set to do so either at all times or only when the computer is locked. More importantly, the tool can be configured to alert users when someone is tampering with their USB ports. It can either send an SMS via the Twilio API, or send a Slack notification via an inbuilt Slack bot.

Released in open source not long ago, the tool aims at overcoming some of the shortcomings of other monitoring tools that inform the user on USB port-related incidents only after login. USB Canary aims at keeping an eye on systems at all times when they are unattended.

According to the researcher, who goes by the online handle errbufferoverfl, although the tool is available only for Linux at the moment, Windows and macOS versions are also planned (but no specific details on them have been revealed so far).

Written in Python, the author explains that the tool was initially created as a personal utility while he was between jobs and that the use of third-party libraries.

Users can configure the tool to detect the type of screensaver running on the computer (it can detect XScreenSaver and gnome-screensaver, but can be used with unsupported screensavers as well), to turn a “paranoid” mode on, and set the notifications to arrive either via Twilio or Slack.

“Paranoid mode is also suitable for people who want to monitor if their servers have had USB's plugged into them, although I haven't tested them on Linode, Amazon Web Services, or Digital Ocean it is suitable for those with physical servers that may need this sort of monitoring,” the researcher notes.

Although this was a personal project in the beginning, others already picked it up and helped improving it through their contributions.

The open source tool is available via GitHub.

Related: Sophisticated USB Trojan Spotted in the Wild

Original author: Ionut Arghire

Breach Response , Data Breach , Fraud

GAO Says OPM Lacks Guidelines for Determining Whether to Offer Beach Victims Services Eric Chabrow (GovInfoSecurity) • March 31, 2017    

The U.S. Office of Personnel Management may not be getting the best bang for its buck on its investment in identity protection services provided to federal government employees who have been victims of data breaches, according to a congressional audit.

See Also: Three and a Half Crimeware Trends to Watch in 2017

The Government Accountability Office audit - titled Identity Theft Services: Services Offer Some Benefits But Are Limited in Preventing Fraud - points out that the OPM provided duplicate identity protection services for about 3.6 million people affected by both of its 2015 breaches. And the Office of Management and Budget - which issues IT security guidance to federal agencies - has not explored options to help federal agencies avoid potentially wasteful duplication, according to the report.

In early 2015, OPM discovered a breach of the personnel data of 4.2 million current and former federal employees. In June 2015, OPM then uncovered an apparently related hack that exposed the personal information of 21.5 million individuals, many with security clearances. The two breaches are believed to have emanated from China.

The lack of an plan for how to provide identity protection services led to the duplication of services, GAO says.

"OPM didn't have policies and procedures in place to dictate how to offer the services or to decide whether or not to offer the services, and there was no assessment of effectiveness when they did it, and they didn't document how they made a decision," Lawrance Evans Jr., GAO director of financial markets and community investment, said in a GAO podcast interview.

Monday-Morning Quarterbacking

Evans expressed sympathy for OPM decision makers having to make a quick decision on offering employees identity protection services. "It's difficult to Monday-morning quarterback," Evans said in the interview. "It was an unprecedented situation for OPM. They had to make a decision fast. But one can go back, and start to ask why other alternatives were offered, and that's where it gets pretty tricky. And, because there was no documentation on the decision-making, it's left to speculation."

Contrary to key operational practices previously identified by GAO, auditors say OPM's data breach response policy does not include criteria or procedures to determine when to offer identity protection services. Also, OPM has not always documented how it chose to offer the services in response to past breaches, which could hinder informed decision making in the future.

After revelation of both breaches, Congress enacted legislation to offer identity protection services to victims for 10 years, including $5 million in identity theft insurance. "However, this level of insurance coverage is likely unnecessary because claims paid rarely exceed a few thousand dollars," Evans said. "Requirements such as this could serve to increase federal costs unnecessarily, mislead consumers about the benefit of such insurance coverage and create unwarranted escalation of coverage amounts in the marketplace."

Contracts Awarded

In June 2015, OPM awarded a contract for identity protection services to the Winvale Group to cover the 4.2 million people affected by its personnel records breach.

Three months later, the Defense Department's Naval Sea Systems Command, acting on behalf of OPM, awarded a second contract to ID Experts, which covered the 21.5 million people affected by the second breach of background investigation data. Some individuals were victims of both breaches.

OPM told GAO that the duplicate services offered to about 3.6 million affected individuals overlapped by more than a year, from Sept. 1, 2015, to Dec. 1, 2016. Through last Nov. 22, OPM was obligated to pay $28.9 million to Winvale and $209.1 million to ID Experts.

The duplication ended on Dec. 1, when the Winvale contract expired. Before that contract expired, OPM had modified both contracts to reduce duplication related to identity protection coverage. That left 600,000 people without ID protection services, and OPM awarded a new contract to ID Experts to provide them with services.

Contract Terms

According to the GAO report, the contracts included three-bureau credit monitoring; access to an initial credit report and identity monitoring, provided through the same subcontractor; as well as identity theft insurance and identity restoration services. Those affected by the breaches must enroll with the companies to receive credit and identity monitoring, but they receive the insurance and access to restoration services whether or not they enroll.

GAO recommended that OPM adopt procedures for how to assess whether it wants to offer identity protection services. Acting OPM Director Kathleen McGettigan concurred with the recommendation, saying OPM is updating its breach response plan to assess the risk of harm to individuals affected by a breach to determine how best to mitigate the damage, including what identity protection services to offer. That assessment should be completed in July, McGettigan said.

Leading the latest edition of the ISMG Security Report: A breakdown of testimony presented at a Senate Select Committee on Intelligence hearing on Russia's attempt to influence the U.S. presidential election.

Also in the Security Report, you'll hear:

Testimony delivered at the Senate hearing disclosing that Hillary Clinton wasn't likely the only presidential candidate targeted by the Russians in the last presidential election; ISMG Security and Technology Editor Jeremy Kirk report on an FBI warning of hackers aggressively targeting insecure file transfer protocols; ISMG Editorial Director Tom Field explain the evolution of the Smart Card Alliance to the Secure Technology Alliance; A remembrance of Trend Micro Chief Technology Officer Raimund Genes, who died last week at age 54.

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Check out our March 24 and March 28 reports that respectively analyze how blockchain could be used to secure shared, cyberthreat information and British Home Secretary Amber Rudd's call for an encryption workaround.

The next ISMG Security Report will be posted on Tuesday, April 4.

Theme music for the ISMG Security Report is by Ithaca Audio under the Creative Commons license.