Posts Tagged ‘Privacy’

Okay, so maybe Sony can’t say it didn’t happen…again.  It did. But, there is one bright spot from the latest hacking. The company learned something from previous break-ins.

As reported in Wired.com, hackers broke into more than 93,000 Sony customer accounts. Sony believed those customers used the same Sony login credentials to log on to other sites and that the other sites were hacked, providing access to the customers’ PII (personally identifiable information).

Phil Reitinger, Sony’s new chief information security officer, announced the break-in. Hired last month as part of Sony’s efforts to improve security after two previous break-ins, Reitinger had been Deputy Under Secretary of the National Protection and Programs Directorate and Director of the National Cyber Security Center at the Department of Homeland Security. Prior to that, he was Microsoft’s chief trustworthy infrastructure strategist.

What Sony learned from previous breaches was to get the bad news out as fast as possible. Last time it took Sony a week to tell customers hackers had stolen 75-million of its customers’ personal information. And, there was no hurry to admit breaches had taken place at Sony Pictures, Sony BMG and Sony Online Entertainment. The last resulting in an additional 25 million customers’ information compromised.

This time it took Sony just two working days to fess up. The quick response may have been a reaction to a class-action lawsuit accusing Sony of failing to adequately secure data, depriving customers of the use of the network for an extended period of time (an almost Biblical 40 days) and failing to notify customers of the breach in a timely manner.

Reitinger explained hackers had tested a “massive set of sign-in IDs and passwords” at websites for several of its properties — Sony Entertainment Network (SEN), PlayStation Network (PSN) and Sony Online Entertainment (SOE). Most of the login credentials failed to gain the intruders access, but about 60,000 credentials matched those used by SEN and PSN users, and another 33,000 matched credentials for SOE accounts.

Observed Reitinger, “[G]iven that the data tested against our network consisted of sign-in ID-password pairs, and that the overwhelming majority of the pairs resulted in failed matching attempts, it is likely the data came from another source and not from our Networks.”

He noted that a “small fraction” of the accounts showed activity after they were breached, but that the intruders couldn’t access credit card account information. Sony had since locked all of the accounts accessed through the attack until customers could be notified to change their passwords.

Reitinger promised to “work with any users whom we confirm have had unauthorized purchases made to restore amounts in the PSN/SEN or SOE wallet.”

Including expenses for shoring up its network against future attacks, Sony estimated the breaches last spring would cost it more than $170 million.

If users don’t have to create a profile with personal information, such as birth dates, maiden names and Social Security numbers, to log on to a website, hackers can never have access to that information. Because the ThreatMetrix Cloud-Based Fraud Prevention Platform uses anonymous data from the computer, its connection to the Internet and contextual data from a transaction, ThreatMetrix avoids the pitfalls of PII as an authentication method.

Customer confidentiality is respected at the same time online fraud is being detected.

What? Not an Oscar?

Oh, ThreatMetrix won Red Herring’s much coveted “Top 100 North America Award.” In all honesty, it seemed like there was something fishy about ThreatMetrix winning an Academy Award.

Now, a Red Herring “Top 100 North America Award” on the other hand — nothing fishy about that. After all, without relying on passwords and cookies, ThreatMetrix solutions preserve user privacy while its ThreatMetrix Cloud-Based Fraud Prevention Platform, which uses anonymous data from the computer, its connection to the Internet and contextual data from a transaction, is the ultimate weapon against fraudsters. In short, ThreatMetrix offers the best of both worlds: protection for the e-company, privacy for the user.

The Top 100 North America Award is based on financial performance, technology innovation, quality of management, execution of strategy, and integration into the industry. Given by Red Herring editors, the award has become a mark of distinction for identifying promising new companies and entrepreneurs, such as Facebook, Twitter, Google, Yahoo, Skype, Salesforce.com, YouTube, and eBay.

And, now ThreatMetrix.

ThreatMetrix and the Ponemon Institute have announced the second set of findings from their recent survey around consumers’ reactions to online fraud today. This second round of data was gathered from survey questions around behavioral advertising specifically, on the heels of the recent McCain-Kerry privacy bill.

The study revealed the majority of consumers are comfortable with online behavioral tracking for fraud prevention purposes, but remain hesitant around advertising and promotional purposes. The results are outlined in a report, “Consumers’ Reaction to Online Fraud.”

Other highlights of the findings include:

• Seventy-four percent of consumers expressed some level of concern about online advertisers collecting and using their information for future promotional activity. Half of the respondents, however, feel it acceptable to use information about their online behavior as long as it’s to detect potential fraudsters.

• Twenty-four percent of consumers said they don’t think behavioral targeting in any form is appropriate, whereas 26% said it is okay for online businesses to use their information to either send them ads or monitor potential fraudsters.

• Only 16 % of consumers said that advance consent is necessary for each transaction, when asked about the extent of obtaining consent to use their online behavior information for fraud detection. One third said consent was not necessary at all, while the majority (36%) said consent only once in advance is sufficient.

• The majority of consumers (70%) reported that if they were assured their personal information was not collected when used for fraud detection purposes, they were comfortable with an online business authenticating their identity through a digital fingerprint. Another 22% said they were unsure.

The research also looked at consumer sentiment about fraud prevention across the banking, social media and Web 2.0 industries and mobile channel. For more information about the findings, download a copy of the report at http://info.threatmetrix.com/ConsumerSurveyOnlineFraud2011.html.

Findings from the recent AWPG report reveal that fraud remains a serious issue in the credit card/payments information category. This is often downplayed to account for rises in cases of smaller categories such as Classified Advertising and Banking. These categories, however, only account for less than 10% of all phishing cases. Statistics show that more than one-third of phishing attempts to steal credentials are directed at collecting credit card/payments information, making this the largest category affected by fraudsters.

One reason this issue may not seem as relevant might be the decrease in brand attacks since 2009. It is important to keep in mind, however, that while the number of brands hijacked by phishing attacks is down 22% from October 2009, fraudsters are finding unique ways to target specific brands through personalized phishing attempts that make these efforts more difficult to track.

According to ThreatMetrix Chief Product Officer Alisdair Faulkner in a recent Security Week article, the attacks on the credit card/payment information category may be decreasing, but continue to affect the largest number of people: “‘Unfortunately the pain is not just felt by the brands targeted by phishing attacks, it is every other online business that is then attacked with the stolen identity and credit card information,’” he said.

Within a period of 24 hours (from Feb. 1 – Feb. 2) ThreatMetrix detected 135,000 fraudulent transactions attempted against 350 of the top online companies, data we pulled for Security Week.

Stolen consumer information continues to be a serious issue. It is essential that innovative efforts continue to block fraudsters before they have the opportunity to cause significant damage. Statistics like those gathered from the AWPG report illustrate the rapid pace the fraud protection industry needs to move in order to maintain a solid approach to fraud prevention.

The FTC has recently proposed legislation in an effort to protect consumer privacy, made in response to the privacy implications arising out of behavioral advertising. While the recognition of the unique role of data collection for fraud prevention was recognized by the FTC staff, there will likely be tradeoffs between privacy and security.

ThreatMetrix recently submitted commentary to this FTC Staff Preliminary Report on Protecting Consumer Privacy (the “Preliminary Report”). Due to an influx of requests to submit commentary, the FTC actually extended its deadline from January 31 to February 18.

So what is ThreatMetrix’s stance? The FTC should be applauded for its view that data collection for fraud detection purposes is a commonly accepted practice and should not be subject to consumer choice. However, companies engaged in cyber security — particularly fraud detection – should not be covered under the framework as proposed in the FTC’s Preliminary Report.

Read the full letter ThreatMetrix submitted to get an overview of why cyber security should not be covered here, as well as suggestions for how the FTC should approach such legislation.

I wish all of the websites I do business with would fingerprint my computer to validate my identity. I’d sleep better at night knowing that computers used by criminals attempting to steal from me would be barred from entry because their computer’s unique fingerprint could never match that of my computer. I know more than the typical consumer about the high risk that goes with entering your PII (personally identifiable information) like your mother’s maiden name and social security number into a web form. I also know that it’s getting very hard not to surrender PII to accomplish anything of substance online.

Dr. Larry Ponemon knows a lot about what consumers are thinking about when it comes to their online privacy. He founded Ponemon Institute, dedicated to independent research and education that advances responsible information and privacy management practices within business and government. Several months ago we asked Dr. Ponemon to look into what consumers think about having their computers fingerprinted as a means to help protect them from online fraud. Read the rest of this entry »

According to a new study by researchers at Carnegie Mellon University it is now possible to exploit an individual’s place and date of birth to predict his or her Social Security number. Most of us have fed the worldwide web (often willingly, sometimes not) enough personal data about ourselves to leave pieces of us in the form of data that fraudsters can use to identify us: credit card numbers, birthdates, personal tastes…just about anything and everything that could be used to identify us. The Carnegie study reveals that personal data available from online sources such as Facebook can now be used to construct our Social Security numbers-personal private data that until now was considered reasonably save from intelligent guessing by networks of compromised computers.

Here’s an excerpt from the Carnegie study that spells out the problem:

‘Although defense mechanisms to detect repeated abuses are in place at those services [for instance, the SSNVS tracks incorrect attempts at verifying SSNs, and financial institutions blacklist (for various days or months) IP addresses originating 3 or more failed logins or transactions], ‘‘botnets” of compromised computers allow attackers to test-cheaply and covertly-vast numbers of variations of targets’ SSNs, strategically distributing simultaneous attempts across services, compromised machines, and target accounts.’

Device Identification would make it difficult to “strategically distribute simultaneous attempts across services” because ThreatMetrix would identify the source of the attempts, even if the fraudster is hiding behind a proxy. “Cheaply and covertly” are consistent with what I’ve said in previous blog entries about how the technology tools and means to commit fraud are making a bad problem much worse as they enable far more people to jump into the online fraud business. The more we reveal about ourselves online, the more easily we can be identified by who we are and what we do. Online banking, purchasing, gaming, dating and social networking rely on the ability for us to identify that we are who we claim to be without our physical presence-this creates the opportunity for fraud. On the web, we’re defined by data in the form of attributes that can be (and are) used to authenticate our identity: birth date, street address, favorite pet, height, color of eyes, Social Security number and more. The Carnegie study shows that it’s quite possible to correlate those data from various sources to get a more complete and accurate picture of a person for credentialing. This is something new that has the potential to wreak havoc in the online world.

Those personal data attributes scattered across the worldwide web present a new form of risk. Device Identification (when it’s done right) can take back some of that risk by providing a reliable point of reference to authenticate who’s at the computer. By profiling the computer instead of the person, ThreatMetrix Device Identification offers these advantages as a method to authenticate identity online:

• Instantly identify a computer within seconds at the moment a connection is made: manage the risk of a device connection before you provide someone access to your web site
• Passive, non-intrusive identification: because data is supplied by the visiting computer and its connection instead of the person, authentication requires no knowledge of or inputs from web site visitor
• Even if personal data such as Social Security numbers are compromised, ThreatMetrix Device Identification helps companies and institutions prevent fraudsters from using them to establish illicit accounts

Will device identification become a must-have factor to authenticate identities on the worldwide web in the next few years?