Learning from the Home Depot and Target Breaches

Posted on September 23rd, 2014 by Dan Rampe

Home Depot

How Banks Are Reacting In the Wake of the Home Depot Disaster. How Breaches Affect Consumers. And What Was Learned from Target’s Response?

Natural disasters such as tornadoes, hurricanes and earthquakes or man-made disasters like major data breaches share one thing. When they’re over, somebody has to clean up the mess and attempt to put things right. In her thoughtful and far-ranging piece on forbes.com, Paula Rosenblum explores how it’s believed the Home Depot breach was carried out, what was learned from the Target breach experience that might be applied to this latest breach, how banks and consumers are reacting and much more. The following has been excerpted from Rosenblum’s article and edited to fit our format. You may find the complete story by clicking on this link.

Skimming

The technique [the cybercriminals] used to grab the data was similar to, but not identical to the one used at Target.  It’s called “skimming,” and can take several forms. In earlier days, thieves would place a hardware chip inside payment terminals and capture the keystrokes entered during every transaction. Now, they’ve written software to grab the data as it comes in. We know how the thieves got into Target’s main systems in the first place.  Thus far, the technique they used to get into Home Depot’s network has not been exposed, nor have the techniques they used to exfiltrate (remove) the data from Home Depot’s systems been revealed.

The bad guys got there first

Sadly, Home Depot had already started taking steps to mask (or encrypt) the data as it passed through these credit card terminals, but the crooks beat them to the punch.  This is a familiar story…institutions improve security methods, but criminals evolve faster.

Target — not a good role model

The question being asked now is What will consumer response be?”  By all accounts, Target handled its data breach badly. Rather than replace potentially compromised co-branded “Red” debit and credit cards, it opted to put dollar limits on suspect debit cards in the middle of the shopping season.  Shoppers often learned this as they were checking out of another store, preparing to pay for holiday gifts.

This was the worst possible response given the time of year. The enmity against Target can still be seen in the comments section of any piece that discusses data security, or even mentions the word “Target.” So what’s the right approach?

A better approach

I spoke with Jon Delano, a reporter for …CBS affiliate KDKA [who said] a small regional bank, Dollar Bank, acted quickly to replace all the potentially affected customer cards.  The [Wall Street Journal] reports that J.P. Morgan Chase and Capital One have already started replacing cards as well.

Pick your poison

In truth, in times like these, a consumer and a bank have to pick their poisons.  It costs banks money to replace cards.  And when you’re talking about 36 MILLION cards, you’re talking about a lot of money.  And it’s not all that much fun for consumers to replace their cards either.

Mr. Delano observed how inconvenient it is for consumers when their credit card numbers are changed. One of the ironies of today’s “omni-channel world” is that consumers have credit numbers on file at all kinds of institutions, for all kinds of payments.  From electric companies, to retailers like Amazon.com, consumers are exhorted to “go paperless,” “pay electronically,” anything that will insure payments come in on time and that they won’t have to look up credit card information every time they make a purchase.

While Dollar Bank has opted to pick the inconvenience, Mr. Delano reports the PNC Bank…is taking a “wait and see” approach….

This is the decision banks have to make now:  issue new cards which will be costly and create an inconvenience for customers, or wait and see, and risk serious consumer backlash.

Uh-oh, are we talking conspiracy theory?

Meanwhile, the timing of this breach is interesting, because it comes just after the introduction of Apple Pay. Suddenly, with this breach, the notion of not exposing credit card information to individual retailers, regardless how large, starts to seem appealing to shoppers.

Banks are certainly lining up behind the initiative.  Since roll-out, Chase, Bank of America, Citi and others have all thrown their full support behind Apple Pay. While banks may be ambivalent about their response to credit card theft, they’re very un-ambivalent about Apple Pay.  After all, just like the use of debit cards has eliminated a boatload of paper check processing, the use of mobile payment technologies has the potential to eliminate a lot of plastic. A cardless world seems more interesting by the day.

But that’s the future. Today, we’re dealing with a real data security problem. At the end of the day, the consumer will cast the final vote. Some banks are taking calculated risks.  Others are just paying the money, replacing cards and carrying on.

ThreatMetrix builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 850 million monthly transactions and protects more than 210 million active user accounts across 3,000 customers and 15,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

 

 

KorBanker at Core of New Mobile Bank Attacks

Posted on September 23rd, 2014 by Dan Rampe

Malware

KorBanker Malware App Accesses SMS Text Messages, Steals Info and Sends It on to Remote Servers for Cybercriminals to Retrieve

First used in Korea, the KorBanker malware app proved to be effective at stealing passwords, two-factor authentication passcodes and other sensitive data.

KorBanker steals anything “not nailed down”

In his piece on crn.com (link to article), Robert Westervelt cites a researcher who’s been tracking KorBanker attacks over the last eleven months. Researcher Hitesh Dharmdasani said that in the latest round of attacks in August, KorBanker infected more than 1700 devices. In one fifty-five day period, Dharmdasani and his fellow researchers discovered 10,000 SMS messages from nearly 100 devices. The messages contained two-factor authentication codes from social networks and other services, passwords to VPN services and location sharing and mobile banking information.

Dharmadasani noted that, “Since such information can potentially be used to access corporate networks, mobile malware plays an important role in the newly evolving multivector threat landscape.”

Mobile threats growing fast at unprecedented rate

According to several recent reports, mobile threats, which are widespread in Eastern Europe and Asia, are growing around the world. One report stated that mobile malware and high-risk apps numbered 2 million in the first half of 2014 and are growing at a rate of 170,000 apps per month.

Watch what you download

Bob Coppedge, owner of Simplex-IT, an Ohio managed service provider, observes that people have to be more aware of the apps they’re downloading. “I don’t really know how a flashlight app works, but I know it doesn’t need to have access to who my contacts are or require a password to function. Millions of consumers are giving up their security and privacy by blindly installing applications, and it may have a future impact on data protection.”

Adware may be greatest threat

A report by San Francisco-based Lookout Mobile Security said the greatest threat to U.S. mobile device owners is adware that relies on device data, such as location for display ads.

So, which countries have the most malicious mobile app downloads? Israel is number one, followed by Vietnam, China and South Korea according to another security company report which attributes the number of malicious downloads to the pirating of apps.

ThreatMetrix builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 850 million monthly transactions and protects more than 210 million active user accounts across 3,000 customers and 15,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

 

 

 

 

 

 

 

Apple’s Second Launch: User Privacy

Posted on September 22nd, 2014 by Dan Rampe

Tim Cook

CEO Tim Cook “Launches” into Rant on Companies That Collect and Sell Data on Their Customers. Points to Google and Facebook.

In an interview with Charlie Rose, Apple’s CEO may have been talking about how Apple is better at protecting customers’ privacy, but he sure wasn’t private about his feelings toward some competition.

Juxtaposing Apple, which he says only sells products, against internet companies that make their money “collecting [and selling] gobs of personal data” Cook suggested Apple would do a better job of protecting user privacy.

In his piece on venturebeat.com (link to article), Gregory Ferenstein says Cook may have been a bit prickly (our word not Ferenstein’s) about the subject of privacy because of last month’s iCloud hack resulting in nude pix of female celebs circulating all over the internet. And, Ferenstein notes a possible link between that event and Apple Pay, Apple’s new credit card transaction payment system. Ferenstein observed that, “Purchase data is perhaps the most personal data of all, and Cook was out to assure the public that the new system won’t actually keep any data, so it would be impossible for a government agency (or a hacker) to steal it from Apple’s servers.”

So why is Apple better at protecting customer data than, say Google? Maybe Rose and Cook will discuss that in a future interview. Till then, here is Cook’s riff on Apple vs. Google, Facebook, et al. when it comes to money and data:

Our business is not based on having information about you. You’re not our product. Our product are these [points to iPhone], and this watch, and Macs, and so forth. And so we run a very different company.

I think everyone has to ask, how do companies make their money? Follow the money. And if they’re making money mainly by collecting gobs of personal data, I think you have a right to be worried. And you should really understand what’s happening to that data, and the companies — I think — should be very transparent.

If you want to use an Apple product, you pay Apple from your own bank account and you’re the customer. But if you’re using products from Google, Facebook and much of the ad-supported information economy, advertisers are the customers — and you’re the product. The more valuable data they can extract from you, the more money their customers (advertisers) will pay.

“I’m offended by lots of it,” said Cook of the way the Information economy operates.

ThreatMetrix builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 850 million monthly transactions and protects more than 210 million active user accounts across 3,000 customers and 15,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

 

 

ThreatMetrix Wins Two Gold Awards in the 6th Annual 2014 Golden Bridge Business Awards

Posted on September 19th, 2014 by Dan Rampe

Company Named Gold Winner in “Innovative Company of the Year” and “Integrated Security (Software) Innovation” Categories

San Jose, CA – September 19, 2014 – ThreatMetrix®, the fastest-growing provider of context-based security and advanced fraud prevention solutions, recently earned two Gold Awards at the 2014 Golden Bridge Awards for “Innovative Company of the Year” and “Integrated Security (Software) Innovation” for the ThreatMetrix TrustDefender™ Cybercrime Protection Platform.

The coveted annual Golden Bridge Awards program encompasses the world’s best in organizational performance, innovations, products and services, executives and management teams, women in business and the professions, innovations, case studies, product management, public relations and marketing campaigns, and customer satisfaction programs from every major industry in the world. Organizations from all over the world are eligible to submit nominations including public and private, for-profit and non-profit, largest to smallest and new start-ups.

More than 40 judges from a broad spectrum of industry voices from around the world participated and their average scores determined the 2014 Golden Bridge Business Awards winners. The winners were honored during the awards dinner and presentation in San Francisco attended by the finalists, industry leaders, and judges.

“We’re honored to have received this industry recognition and two Gold Awards,” said Bert Rankin, chief marketingofficer at ThreatMetrix. “Innovation is what drives our business and industry acceptance of our ThreatMetrix TrustDefender Cybercrime Protection Platform. Our focus is to help businesses fight cybercrime and build trust on the Internet by enabling them to not only keep out the bad players, but also to protect and streamline the online experience for trusted employees and customers.”

The TrustDefender Cybercrime Protection Platform leverages analytics from the ThreatMetrix™ Global Trust Intelligence Network, which profiles tens of millions of users and their devices every day to differentiate between authentic and suspicious transactions. This enables the platform to go beyond traditional measures of cybercrime protection, such as malware and device identification, creating a comprehensive persona of each user attempting an online transaction.

Additional ThreatMetrix 2014 awards include:

  • Named “100 Most Promising Technology Companies in the U.S.” by CIOReview
  • Recognized as a Silver Winner in the “Enterprise Product of the Year – Software” Category by the Best in Biz Awards 2014 International
  • Named to the 2014 AlwaysOn Global 250 Top Private Companies List
  • Named to the 2014 Lead411 Hottest Companies in Silicon Valley list
  • Products Guide (NPG) 2014 Hot Companies and Best Product Award Winner for the “Best Products and Services – Information Security and Risk Management” category and also in the “Best Products and Services – Security Software” category.
  • Judges Choice for Best Overall Fraud/Security Solution at the 2014 CardNotPresent.com (CNP) Awards for the ThreatMetrix TrustDefender Cybercrime Protection Platform
  • A 2014 Info Security Products Guide Global Excellence Award for Most Innovative Company of the Year (Security)
  • 2014 Cyber Defense Magazine Award Winner in 2 Categories: Most Innovative Anti-Malware Appliances Solution & Best Product Network Access Control Solution

ThreatMetrix Resources

About the Golden Bridge Awards

Golden Bridge Awards are an annual industry and peers recognition program honoring best companies in every major industry from large to small and new start-ups in North America, Europe, Middle-East, Africa, Asia-Pacific, and Latin-America, Best New Products and Services, Best Innovations, Management and Teams, Women in Business and the Professions, Case Studies, Customer Satisfaction, and PR and Marketing Campaigns from all over the world. Learn more about The Golden Bridge Awards at www.goldenbridgeawards.com

About ThreatMetrix

ThreatMetrix builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 850 million monthly transactions and protects more than 210 million active user accounts across 3,000 customers and 15,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

© 2014 ThreatMetrix. All rights reserved. ThreatMetrix, TrustDefender ID, TrustDefender Cloud, TrustDefender Mobile, TrustDefender Client, the TrustDefender Cybercrime Protection Platform, ThreatMetrix Labs, and the ThreatMetrix logo are trademarks or registered trademarks of ThreatMetrix in the United States and other countries. All other brand, service or product names are trademarks or registered trademarks of their respective companies or owners.

Media Contacts
Dan Rampe
ThreatMetrix
Tel: 408-200-5716
Email: drampe@threatmetrix.com

Beth Kempton
Walker Sands Communications
Tel: 312.241.1178
Email: beth.kempton@walkersands.com

 

ThreatMetrix Is Good as Gold – Two Golds

Posted on September 19th, 2014 by Dan Rampe

Golden Bridge

Takes Gold for “Innovative Company of the Year” and for “Integrated Security (Software) Innovation” at the 2014 Golden Bridge Business Awards

The ThreatMetrix TrustDefender Cybercrime Protection Platform brings home the gold at the 6th Golden Bridge Awards, an annual industry and peers recognition program honoring the best companies in every major industry from all corners of the globe. And organizations from all over the world are eligible to submit nominations.

Forty judges selected the winners

More than forty judges from a broad spectrum of industries around the world determined the 2014 Golden Bridge Business Awards’ winners who were honored during an awards dinner and presentation in San Francisco.

Bert Rankin ThreatMetrix’s CMO

“We’re honored to have received this industry recognition and two Gold Awards,” said Bert Rankin, chief marketing officer at ThreatMetrix. “Innovation is what drives our business and industry acceptance of our ThreatMetrix TrustDefender Cybercrime Protection Platform. Our focus is to help businesses fight cybercrime and build trust on the Internet by enabling them to not only keep out the bad players, but also to protect and streamline the online experience for trusted employees and customers.”

The TrustDefender Cybercrime Protection Platform and The Network

The TrustDefender Cybercrime Protection Platform leverages analytics from the ThreatMetrix Global Trust Intelligence Network (The Network), which profiles tens of millions of users and their devices every day to differentiate between authentic and suspicious transactions. This enables the TrustDefender Cybercrime Protection platform to go beyond traditional measures of cybercrime protection, such as malware and device identification, to create a comprehensive persona of each user attempting an online transaction.

ThreatMetrix awards in 2014 include:

  • Named “100 Most Promising Technology Companies in the U.S.” by CIOReview
  • Recognized as a Silver Winner in the “Enterprise Product of the Year – Software” Category by the Best in Biz Awards 2014 International
  • Named to the 2014 AlwaysOn Global 250 Top Private Companies List
  • Named to the 2014 Lead411 Hottest Companies in Silicon Valley list
  • Products Guide (NPG) 2014 Hot Companies and Best Product Award Winner for the “Best Products and Services – Information Security and Risk Management” category and also in the “Best Products and Services – Security Software” category.
  • Judges Choice for Best Overall Fraud/Security Solution at the 2014 CardNotPresent.com (CNP) Awards for the ThreatMetrix TrustDefender Cybercrime Protection Platform
  • A 2014 Info Security Products Guide Global Excellence Award for Most Innovative Company of the Year (Security)
  • 2014 Cyber Defense Magazine Award Winner in 2 Categories: Most Innovative Anti-Malware Appliances Solution & Best Product Network Access Control Solution

ThreatMetrix builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 850 million monthly transactions and protects more than 210 million active user accounts across 3,000 customers and 15,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

 

“Do-Nothing” House Does Something

Posted on September 18th, 2014 by Dan Rampe

House of Reps

U.S. House of Representatives Passes Bill That Comes Down Hard on Tax Return ID Thieves

Who says Congress doesn’t do anything? Well just about every American of voting age (Headline from August 2014 on politico.com: Poll: Congress approval hits new low).

Could the House passing H.R. 744 be a portent of things to come? Maybe, but it would be kind of like Apple donating the gross sales for iPhone 6 to charity.

In any case, if the bill passes the Senate and is signed by the President, tax return identity thieves will be facing 20 years in jail.

In her piece on thehill.com, Cristina Marcos details some of the major provisions of the legislation. The following has been excerpted from her piece and edited to fit our format. You may find the full article by clicking on this link.

Victims to include organizations

The measure would further broaden the definition of tax return identity theft victims to include organizations, instead of only individuals.

Another provision of the bill would direct the Justice Department to submit a report to Congress within 180 days on trends in tax return identity theft and recommendations on how to prosecute the crime.

Similar bill failed in 2012

The House passed a similar version of the legislation in 2012 in the previous Congress, but it never received action in the Senate.

For more on tax fraud and identity theft, please see our previous blog posting and infographic, “ThreatMetrix Tax Tips to Avoid Losing Your Identity and Uncle Sam’s Taxes to the Cyberthieves Who Stole Close to $4 Billion Last Year.”

ThreatMetrix builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 850 million monthly transactions and protects more than 210 million active user accounts across 3,000 customers and 15,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

 

 

Is Buying an iPhone 6 Buying Trouble? Or Peace of Mind?

Posted on September 17th, 2014 by Dan Rampe

iPhone6

ThreatMetrix Explores the Pros and Cons of iPhone 6 as They Relate to Privacy and Cyberfrauds’ Shift to Online Channels

When it comes to security, do the “I”s have it? ThreatMetrix takes a hard look at iPhone 6 and iPhone 6 Plus, exploring whether some of their newest features will be making their owners more secure or bigger cybercrime targets. (For a quick overview, ThreatMetrix prepared the following infographic on iPhone 6 and iPhone 6 Plus cybersecurity pros and cons.)

“The most recent iPhone has received a ton of buzz, especially regarding some of its latest features such as Apple Pay, which has the potential to revolutionize the way consumers and retailers alike do business,” said Alisdair Faulkner, chief products officer at ThreatMetrix. “However, the fact remains that these features may also potentially make Apple the new prime target for cybercriminals all over the world, as the iPhone 6 increasingly becomes the remote control of its owners’ life.”

By the end of 2014, some 25 million iPhone users will have upgraded their devices. Following ThreatMetrix security experts critique the newest features and how they affect security.

  • Apple Pay a Safer Way– Passbook isn’t an entirely new feature of the iPhone, which previously enabled users to store purchased tickets and other virtual goods. These could then be presented on their iPhones in lieu of tickets, etc. Now, Passbook enables users to register credit cards at the click of a button and access them for secure, one-touch transactions using the iTouch fingerprint reader. The Passbook does not store credit-card details on the actual device or in iCloud. Instead it stores a token on a Secure Element. This means that any malware attempting to intercept a transaction will not be able to get access to the real credit card number. This is a net positive for transaction security.
  • Fraud Pushed from Banks to Online Merchants –Apple supports Near Field Communications (NFC) technology, which prevents store employees from taking copies of card data. In October 2015, EMV payment systems become mandatory in the U.S. and will cause criminal gangs to shift more of their attention to online channels. Modern card terminals typically support both EMV payment systems and NFC, and the new Apple Pay functionality will further drive adoption of these new readers in stores. Now, unlike in-store purchases that are covered by banks, online merchants have to cover the costs of inadvertently accepting fraudulent transactions. The other major impact will be a significant increase in online credit card origination theft. If it’s more difficult to breach data in-store and create counterfeit cards because of EMV payment systems and Apple Pay, criminals will focus more of their efforts online.
  • Increased Account Compromise Risk – iCloud is like a remote control for users’ lives. If hackers gain access to a username and password, which is often shared across sites, they can use the Find My Phone feature to not only disable Apple Pay purchasing from your device, but also get access to backup photos and remotely delete and reset your password as well.“Consumers have the opportunity to upgrade to two-factor authentication for better online protection as account compromise risks increase,” said Julie Conroy, research director at Aite Group. “However, very few consumers will do so due to inconvenience and added effort of such security measures.”
  • Privacy Concerns – Apple has stated that it does not track Apple Pay purchases, and that health data collected by HealthKit will remain encrypted on the phone and not stored on Apple’s servers. However there may be future business pressure to better monetize Apple’s iAd network. While HealthKit App Developers require an iPhone owner’s consent to access health data, consumers do not have good ways of ensuring their data remains protected once it is stored off their phones.
  • Selling and Gifting Older Models – Many consumers will want to get rid of their older iPhone models and this can lead to multiple security risks, such as previously jailbroken devices, devices that have pre-stored malware and unwiped devices that still have personal information stored on them. Before selling or gifting older models, consumers must make sure that they have deleted all content (Settings > General > Reset > Erase All Content and Settings) and remove the devices from their iCloud accounts.

“The newest iPhone has the potential to be one of the most groundbreaking models to date,” said Faulkner. “However, consumers making the switch should be aware of the pros and cons of doing so, especially if they are in the first round of buyers. Consumers need to be mindful that the data they sync to iCloud is now likely only protected by a weak username and password combination.”

The widespread adoption of the iPhone 6 means there will be new threats to consumers’ sensitive information and privacy. Businesses such as Apple need a way to protect their customers beyond simple username and password combinations. They need a collective, global network. The ThreatMetrix® Global Trust Intelligence Network analyzes more than 850 million monthly transactions and combines device identification, threat assessments, identity and behavioral intelligence to accurately identify cybercriminals without creating friction for good users.

ThreatMetrix builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 850 million monthly transactions and protects more than 210 million active user accounts across 3,000 customers and 15,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

ThreatMetrix Outlines Cybersecurity Pros and Cons for Consumers Purchasing the New iPhone 6

Posted on September 17th, 2014 by Dan Rampe

As Millions of Consumers Make the Shift to the Newest iPhone, They Must be Aware of Privacy Concerns and Fraud Shifting to Online Channels

San Jose, CA – September 17, 2014 – ThreatMetrix®, the fastest-growing provider of context-based security and advanced fraud prevention solutions, today announced the security pros and cons associated with some of the newest features of the iPhone 6 and the iPhone 6 Plus, both hitting shelves today.

“The most recent iPhone has received a ton of buzz, especially regarding some of its latest features such as Apple Pay, which has the potential to revolutionize the way consumers and retailers alike do business,” said Alisdair Faulkner, chief products officer at ThreatMetrix. “However, the fact remains that these features may also potentially make Apple the new prime target for cybercriminals all over the world, as the iPhone 6 increasingly becomes the remote control of its owners life.”

With 25 million iPhone users planning to upgrade their devices by the end of 2014, there are a multitude of security pros and cons associated with the features of the latest iPhones that those making the switch should be aware of prior to purchasing. These include:

  • Apple Pay a Safer Way– Passbook isn’t an entirely new feature of the iPhone, which previously enabled users to store purchased tickets and other virtual goods that they could then present on their iPhones in place of its physical counterpart. Now, Passbook enables users to register credit cards at the click of a button and access them for secure, one-touch transactions using the iTouch fingerprint reader. The Passbook does not store credit card details on the actual device or in iCloud. Instead it stores a token on a Secure Element. This means that any malware attempting to intercept a transaction will not be able to get access to the real credit card number. This is a net positive for transaction security.
  • Fraud Pushed from Banks to Online Merchants – With Apple supporting Near Field Communications (NFC) technology, this prevents store employees from taking copies of card data. In addition, when EMV payment systems become mandatory in the U.S. in October 2015, criminal gangs will shift more attention to online channels. Modern card terminals typically support both EMV payment systems and NFC, and the new Apple Pay functionality will further drive adoption of these new readers in stores. Unlike in-store purchases that are covered by banks, online merchants have to cover the costs of inadvertently accepting fraudulent transactions. The other major impact will be a significant increase in online credit card origination theft. If it’s more difficult to breach data in store and create counterfeit cards due to EMV payment systems and Apple Pay, then criminals will focus more efforts online.
  • Increased Account Compromise Risk – iCloud is like a remote control for users’ lives. If a hacker gains access to a username and password, which is often shared across sites, they can use the Find My Phone feature to not only disable Apple Pay purchasing from your device, but also get access to backup photos and remotely delete and reset your password as well. “Consumers have the opportunity to upgrade to two-factor authentication for better online protection as account compromise risks increase,” said Julie Conroy, research director at Aite Group. “However, very few consumers will do so due to inconvenience and added effort of such security measures.”
  • Privacy Concerns – Apple has stated that it does not track Apple Pay purchases, and that health data collected by HealthKit will remain encrypted on the phone and not stored on Apple’s servers, however there may be future business pressure to better monetize Apples iAd network. HealthKit App Developers need consent to access health data, but consumers do not have good ways of ensuring their data remains protected once data is stored off their phone.
  • Selling and Gifting Older Models – Many consumers will want to get rid of their older iPhone models and this can lead to multiple security risks, such as previously jailbroken devices, devices that have pre-stored malware and unwiped devices that still have personal information stored on them. Before selling or gifting older models, consumers must make sure that you have deleted all content (Settings > General > Reset > Erase All Content and Settings) and remove the devices from their iCloud accounts.

“The newest iPhone has the potential to be one of the most groundbreaking models to date,” said Faulkner. “However, consumers making the switch should be aware of the pros and cons of doing so, especially if they are in the first round of buyers. Consumers need to be mindful that the data they sync to iCloud is now likely only protected by a weak username and password combination.”

In the wake of the new potential threats to consumers’ sensitive information and privacy with the widespread adoption of the iPhone 6, businesses such as Apple need a way to protect their customers beyond simple username and password combinations with a collective, global network. The ThreatMetrix® Global Trust Intelligence Network analyzes more than 500 million monthly transactions and combines device identification, threat assessments, identity and behavioral intelligence to accurately identify cybercriminals without creating friction for good users.

ThreatMetrix Resources

About ThreatMetrix

ThreatMetrix builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 850 million monthly transactions and protects more than 210 million active user accounts across 3,000 customers and 15,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

© 2014 ThreatMetrix. All rights reserved. ThreatMetrix, TrustDefender ID, TrustDefender Cloud, TrustDefender Mobile, TrustDefender Client, the TrustDefender Cybercrime Protection Platform, ThreatMetrix Labs, and the ThreatMetrix logo are trademarks or registered trademarks of ThreatMetrix in the United States and other countries. All other brand, service or product names are trademarks or registered trademarks of their respective companies or owners.

Media Contacts
Dan Rampe
ThreatMetrix
Tel: 408-200-5716
Email: drampe@threatmetrix.com

Beth Kempton
WalkerSands Communications
Tel: 312.241.11178
Email: beth.kempton@walkersands.com

 

 

 

Reminder: October Approval Expected for New EU Breach Notification Law

Posted on September 16th, 2014 by Dan Rampe

European Union

Law Applies to All Companies Doing Business in Europe

The European Union’s updated data protection law requires any business that suffers a data breach involving personal information to alert regulators and directly notify affected individuals “without undue delay.” What makes a delay an “undue delay”? Could there be some legal wiggle room?

In his article on bankinfosecurity.eu (link to article), Mathew J. Schwartz cites security expert Jacky Wagner, managing director at the consultancy PricewaterhouseCoopers, observing that current EU laws “don’t have any explicit requirement around notifying either regulators or individuals if there’s been some sort of breach of their personal information.”

Wagner adds, “”We’ve seen – over the last several years – most of the states in the U.S. pass notification laws that require explicit notification if an individual’s data has been breached.” The revised EU law includes a similar provision.

Schwartz writes that in addition to tough breach notification requirements, the measure also would require businesses of a certain size to hire data protection officers.

Included in the new law may be the” right to be forgotten” where EU Internet users could demand Google and other search engines remove certain sensitive information about them from searches.

While the new law may burden some businesses, it might help others who, instead of having to comply with a patch-work of regulations country-by-country, now only have to comply with one law.

ThreatMetrix® builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 500 million monthly transactions and protects more than 160 million active user accounts across 2,500 customers and 10,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.

 

 

Who Says Mac OS X Doesn’t Need Malware Protection?

Posted on September 15th, 2014 by Dan Rampe

mac os x

…Not the 18 Companies Creating Anti-Malware for It

Okay, compared to attacks on Windows and Android operating systems, there are a lot fewer Mac attacks. Not exactly news. And the reason why is also not news. With fewer devices running OS X rather than Windows or Android, it just makes sense hackers would look for targets with better returns. Every day, independent test lab AV-TEST.org captures more than 400,000 new malware samples for Windows and 5,000 new samples for Android compared to less than 100 per month for Mac.

18 anti-malware products tested

In his piece on zdnet.com, Larry Seltzer discusses the 18 anti-malware products now available for OS X and how they made out in AV-TEST.org tests. The following has been excerpted from his article and edited to fit our format. You may find the full article by clicking on this link.

  • avast! Free Antivirus 9.0 (41877)
  • AVG AntiVirus 14.0 (4715)
  • Avira Free Antivirus 2.0.5.100
  • Bitdefender Antivirus for Mac 2.21.4959
  • Comodo Antivirus 1.1.214829.106
  • ESET Cyber Security Pro 6.0.9.1
  • F-Secure Anti-Virus for Mac 1.0.282 (13406)
  • G Data Antivirus for Mac 2.30.5095
  • Intego VirusBarrier 10.8.1
  • Kaspersky Internet Security 14.0.1.46c
  • McAfee Internet Security 3.1.0.0 (1702)
  • Microworld eScan for Mac 5.5-8
  • Norman Antivirus for Mac 3.0.7664
  • Panda Antivirus 10.7.8 (772)
  • Sophos Anti-Virus 8.0.23
  • Symantec Norton Internet Security 5.6 (25)
  • Trend Micro Titanium 3.0.1251
  • Webroot SecureAnywhere 8.0.6.105: 181

You can find complete results [on the a-v test.org site.] Five of the products (avast!, Sophos, AVG, Comodo and Avira) are free.

About testing methods

AV-TEST used “…the products which are offered at the AV vendor’s websites as downloads. The versions available at the Mac App Store might be limited in functionality, as they cannot access all APIs.”

AV-TEST provides test results for malware detection, both on-access and on-demand; false positives; impact on system performance; and ancillary features, specifically anti-spam, anti-phishing, personal firewall, safe browsing, parental control, backup and encryption.

How some products fared

The products from avast!, Bitdefender, G Data, Norman, ESET, Intego, Panda, Microworld, F-Secure, Sophos and Kaspersky detected a very high percentage of the malware on-access. AV-TEST also gives results for on-demand scanning, but their importance pales (in our opinion) in comparison to those of on-access. Kaspersky detected 95.2% on-access, several others detected 97.6% and 98.8% and four products detected 100% of malware on-access. All of these numbers are excellent, but obviously it doesn’t get better than 100%.

Disappointing products

Several products, all with well-known brands, had disappointing results. Trend Micro (33.3%), Webroot (22.6%) and McAfee (21.4%) all stand out in a bad way.

None of the products had a single false positive. This may be possible because of the relatively low number of samples.

Compared to PC products, the Mac products offer very few additional features. Eight of them add no extra features (as counted by AV-TEST). Only five offer more than one. The only real stand-out is ESET Cyber Security Pro, which offers anti-spam, personal firewall, safe browsing and parental control.

ThreatMetrix® builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 500 million monthly transactions and protects more than 160 million active user accounts across 2,500 customers and 10,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.