Copart site hacked

Copart, a Texas-based company which provides online vehicle auction and remarketing services, is urging its member to change their password for their Copart.com account after the company discovered that an authorized person gained access to its computer network.

As part of our efforts to address the problem, the Copart is requiring all members to change the password for their Copart.com account,` Sean Eldridge, senior vice-president & chief operating officer at the Copart, wrote in a letter. `If you have not already recently been required to reset your password, simply sign into your Copart account and go to the Change Password option under the My Account tab.
Also, if you use the same username and password for any other account, we recommend that you change your password there as well,` he added. On 31 March 2015, when the company identified that the unauthorized person accessed to its network, the company immediately worked to block any further unauthorized access.
A leading cyber-security firm has been hired for the investigation. It helps the company to help determine what had happened to the company's system and to assists in implementing enhanced security measures. `Based on the investigation, we determined that the unauthorized person may have accessed the member's name, address, driver's license number, telephone number, e-mail address, and the username and password for their Copart.com account,` said Eldridge.
In order to protect, the company has recommended its members to remain vigilant by reviewing their account statements and credit reports for any unauthorized activity. Similarly, the members can also get a copy of their credit report, free of charge, in every 12 months from each of the three nationwide credit reporting companies: Equifax, Experian and TransUnion.
According to the letter, in order to order the free credit report, the members should visit www.annualcreditreport.com or call toll free at 1-877-322-8228. Eldridge said that if any member believed that his/her personal information has been misused, he/she should immediately contact the Federal Trade Commission and/or the attorney general's office in respective Home State.

Read original article

Sally Beauty Details

Sally Beauty Supply says that an `illegal intrusion` resulted in access to point-of-sale systems at some of its U.S. stores for a six-week period beginning in March.

In a May 28 statement, the company details the results of a third-party digital forensics investigation, which finds that attackers injected malware into multiple POS systems at Sally Beauty`s U.S. stores at various points between March 6 and April 17. `Payment card information of customers that used cards at affected U.S. Sally Beauty stores during this time may have been put at risk,` it says.

Sally Beauty has not disclosed whether it believes the POS malware was installed physically or by hackers remotely (see Why POS Malware Still Works). But the company reports that it has now eliminated the malware `from all Sally Beauty point-of-sale systems.` The company notes in a FAQ that payment card data appears to have been stolen, including customers` name, credit or debit card number, expiration date, cardholder verification value - not the three-digit security code on the reverse of the card - and service code. Sally Beauty notes that it does not collect or store PIN data, and thus `has no reason to believe, and has received no information to suggest, that debit card PINs may have been impacted.`

Sally Beauty is a Denton, Texas-based retailer that reported 2014 revenue of $3.8 billion, and which operates more than 4,900 stores worldwide.

`We regret any inconvenience this incident may have caused our customers, and we want to reassure them that protecting our customers is our priority,` says Sally Beauty President and CEO Chris Brickman. `Because we cannot pinpoint exactly which cards might have been affected during our reported date range, we are offering credit monitoring services to any customer who used their payment card at a U.S. Sally Beauty store between March 6th and April 17th of 2015.` More information is available via the Sally Beauty website, which also details email and telephone contact points.

The company did not specify how many of its U.S. stores may have had malware-infected POS systems, or the number of customers or payment accounts that may have been affected. Reached for comment, a spokesman referred to the statement published on the Sally Beauty website.

Rapid Notification

Still, the malware-attack report from Sally Beauty has been swift by most data breach notification standards, arriving just four weeks after the company said it first learned of the attacks. The company is also highlighting the breach notification via a prominent `Sally Beauty Data Security Incident Update` link at the top of its homepage.

Sally Beauty first released related public alerts about the apparent intrusion on May 4, saying that it was investigating `reports of unusual activity involving payment cards` used by customers at some of its U.S. stores, and noting that it first received related warnings during the week of April 27. In a subsequent, May 14 warning, Brickman reported that `we now have sufficient evidence to confirm that an illegal intrusion into our payment card systems has indeed occurred.`

The breach follows Sally Beauty confirming in 2014 that a network intrusion exposed payment card data for 25,000 customers` accounts. That led some industry watchers to question whether the 2015 breach resulted from the retailer failing to fully eradicate the 2014 POS malware infections. But multiple information security experts have told Information Security Media Group that they think it is unlikely that the same group of hackers struck Sally Beauty twice.

Read original article

Ransomware As A Service

The ransomware is free to use but site retains 20 percent of any ransom that is collected, McAfee researcher says.

The ready availability of packaged easy-to-use malware kits in underground markets has significantly lowered the barrier to entry for aspiring cybercriminals, and now they have one more tool option.

A researcher at Intel`s McAfee Labs has unearthed what amounts to a ransomware-as-a-service kit for building and deploying ransomware. Dubbed `Tox,` the kit requires very little technical skills to use and appears designed to let almost anyone deploy ransomware in three easy steps.

Jim Walter, the director of advanced threat research for Intel Security said he stumbled across Tox earlier this month when sifting through a stream of dark web data. In the days since then, the site hosting the malware kit has been updated with a new FAQ and design. But the core functionality has remained the same, Walter said in a post.

Tox is free to set up and use. But the catch is that the site hosting the kit retains 20% of any ransom that is paid by victims to attackers who use the software.

Tox runs on the Tor network and is set up to receive payments via Bitcoin, allowing for some degree of anonymity for the attackers, Walter said. The malware works as advertised, so people can use it to essentially encrypt data on victim computers and demand a ransom in return for unencrypting it.

`Out of the gate, the standard of antimalware evasion is fairly high, meaning the malware`s targets would need additional controls in place,` such as host intrusion prevention, whitelisting and sandboxing to catch or prevent Tox, Walter wrote.

What makes Tox interesting is just how easy it is for almost anybody to use it. Would-be cybercriminals have to simply register with the site, enter the ransom amount they want into the specified filed, submit a `cause` for launching the attack, and correctly guess the CAPTCHA.

The three-step process creates a malicious 2MB executable file disguised as a screensaver file, which users can distribute to victims of their choice.

When the malware is executed, it downloads the CURL command-line tool and a TOR client on the infected system. Once the malware encrypts all the contents on the target computer, it serves up a standard ransomware message instructing the victim to pay a fine in Bitcoins for the data to be unencrypted.

A screenshot of the message posted on Walter's blog shows it provides detailed information on how the victim can buy Bitcoins and where to submit the payment. It tells victims to expect their data to be decrypted in about two hours after ransom payment typically, and provides a link where they can get help if the data is not decrypted after the ransom has been paid.

`You can also spam this mailbox with useless stuff or wishing me death, so that mail sent from real people who actually need help won`t be read,` the message informs victims.

The Tox site monitors all the installs and any money paid by the victims. In order to receive money, the Tox user has to supply a receiving Bitcoin address.

From a technical standpoint, Vox`s code appears to lack much sophistication and efficiency and contains several identifying strings within the code, McAfee`s Walter said. But it is easy to use and fully functional. Expect to see more sophisticated encryption and evasion techniques used in similar tools going forward, he said.

Read original article

Angler Exploit Kit

The Angler Exploit Kit (EK) is throwing a new line in the cybercrime waters with the addition of an exploit for Adobe Flash Player, and the CryptoWall 3.0 ransomware as a payload.

FireEye explained that the attack uses common EK obfuscations (SecureSWF) and techniques. The exploit itself meanwhile involves a race condition in the shader class, in which asynchronously modifying the width/height of a shader object while starting a shader job will result in a memory corruption vulnerability. Angler uses this to execute arbitrary code and infect unpatched users' systems.

Once it's able to infect user systems, criminals can use that access to drop any number of payloads. Recently, Angler was seen to be infecting hosts with the CryptoWall 3.0 ransomware, in attacks that SANS found were using the same bitcoin address for the ransom payment.

The CryptoWall ransomware has evolved into a third-generation baddie, with a streamlined dropper and new functionality such as incorporating I2P anonymous network communication.

Uncovered in February, v. 3.0 has had several dropper features removed from its previous iteration, including multiple exploits and an anti-VM check to prevent it from running in virtual environment. The lack of any exploits in the dropper itself seems to indicate that the malware authors are focusing more on using exploit kits as an attack vector, since the exploit kit's functionality could be used to gain privilege escalation on the system—and this is now clearly being played out in Angler.

CryptoWall 3.0 also acquires much of system information (like the computer name, main processor speed and type, and so on), and generates a global MD5 used as Victim ID. Much of this is sent back to the command and control server using anonymous networks. This includes adding support for the `invisible internet project,` known as I2P, which aims to improve the stealth of criminal communications using networks such as Tor and I2P.

Exploit kits (particularly Angler and Nuclear) regularly exploit recently patched Flash vulnerabilities. In this case, the CVE-2015-3090 was patched by Adobe in the middle of May, so users should upgrade as soon as possible.

Read original article

Home Routers Targeted

Attackers attempting to steal sensitive data by diverting home router traffic to malicious domains, security firm says.

Researchers at Trend Micro have discovered a malicious browser script being used to change DNS settings on home routers in some parts of the world in a bid to steal login credentials and other sensitive data from users of the devices.

The campaign is another sign that DNS hijacking is becoming an increasingly popular attack method for criminal hackers.

Earlier this week, security researchers at ESET reported a new malware threat dubbed Linux/Moose targeted at Linux routers that they said could be used for DNS hijacking purposes. In April, attackers hijacked domain name servers at the St. Louis Federal Reserve and redirected traffic meant for its domain to a malicious web page set up the attackers.

In the latest instance, discovered by Trend Micro, nearly 88 percent of the victims of the latest campaign are based in Brazil, but infections have also been observed in the U.S. and Japan, according to Trend Micro.

To compromise routers the threat actors behind the campaign first lure victims to websites containing the malicious script. When someone lands on such sites, the browser script performs a brute-force attack on the underlying home router to try and gain access to its administrative interface.

If it gains access, the script sends a single HTTP request to the router with a malicious DNS server IP address, Trend Micro senior threat researcher Fernando Merces said in a blog post Thursday. `Once the malicious version replaces the current IP address, the infection is done,` he wrote.

`Except for the navigation temporary files, no files are created in the victim machine, no persistent technique is needed and nothing changes.`

After that, all traffic that passes through the compromised router is redirected to the malicious DNS server IP address where the attackers can intercept any data they wish.

For example, if a user tries to access a legitimate banking site they could be redirected to a spoofed version of the site from where the attackers would be able to steal their user credentials, PINs, passwords and other data, Merces wrote.

`Modified DNS settings mean users do not know they are navigating to clones of trusted sites. Users that don't change the default credentials are highly vulnerable to this kind of attack,` he said.

Christoper Budd, global threat communication manager at Trend Micro says the latest malware is another sign of the growing interest in DNS hijacking among criminal hackers.

In the past, attackers have typically tended to do this by tampering with the DNS settings on a victim's computer. But attacks against home routers are more effective because it gives criminals a way to intercept data from all devices connected to the router.

By just tampering with the DNS settings on the home router once, an attacker can literally own all traffic from all devices connected to the router, including smartphones, tablets, PCs and notebooks, he said. Having a compromised router eliminates the need for an attacker to compromise multiple other devices on the same network, he said.

`We are definitely seeing DNS as the new soft spot in a variety of attacks,` Budd says. `As end points have become more and more secure, the bad guys have tried finding something that is new and soft,` to attack. `DNS is proving to be softer than the end points,` for the moment at least he says.

Read original article

Woolworths data breach

Grocery giant Woolworths has scrambled to cancel over $1 million worth of shopping vouchers after a massive leak of customer data, in which it mistakenly emailed the redeemable codes of 8000 gift cards containing the customers` names and email addresses.

Fairfax Media has obtained a copy of the email which contained an excel spreadsheet with the names and email address of thousands of customers and a downloadable link to 7,941 vouchers, worth a total of $1,308,505. It is understood the spreadsheet was emailed to more than 1000 people, all of whom could access the gift card codes and immediately begin shopping.

As a result of the data leak, customers reported they had logged onto the Woolworths site on Saturday only to discover their vouchers had already been spent.

The data breach, which was discovered on Saturday morning, occured after customers purchased the vouchers from the online savings site Groupon, which ran a deal last week offering BIG W eGift cards, valued at $200 and $100, at a 7.5 per cent discount. The cards were redeemable at Woolworths online and in store, Big W stores, and Caltex petrol stations.

Once customers had paid for the vouchers via the Groupon site they were advised they would receive an email from Woolworths` Everyday Gift Cards containing a PDF attachment with the electronic voucher.

But when some customers proceeded to open the attachment they discovered the excel spreadsheet containing the links to over $1 million worth of vouchers.

Luke, a 36-year-old from Perth, WA, said he decided to check the balance on his 10 giftcards, worth $1900, on the Woolworths website after he realised other customers had probably been emailed the same excel spreadsheet with the links to his vouchers.

`One of my gift cards had be used for online shopping already. Another one had been used in store at Woolworths Parramatta,` the father-of-two told Fairfax Media.

`Hopefully my email address doesn`t end up somewhere where it permanetly gets lots of spam.`

Another customer, Jason Wang, said three of his $200 vouchers had been spent at a Woolworths in Ashfield in Sydney`s inner west, about 300km from his home in Canberra.

On Saturday evening, affected customers received an email from Woolworths advising them the gift cards had been cancelled.

But this, too, caused at least one customer further distress.

Mr James, who did not want to disclose his first name, said he `was embarrassed in front of a large number of people` after he attempted to buy his weekly groceries using his gift cards in a Woolworths store on Saturday, only to be told by staff he was using stolen cards.

`They took my money from my credit card and told me I was using stolen cards. I could not take the trolley of groceries home as I did not have enough money to pay.`

`I tried to call Woolworths but no one picked up the phone.`

`I have had a very very horrible day.`

When contacted by Fairfax Media, Woolworths refused to provide any detail on how the data breach occured or the number of customers affected. Instead, they issued a two-line statement.

`Woolworths takes the concerns of its customers and data security seriously,` the statement read.

`We experienced a technical fault with an e-voucher offered to customers this week. We are working to resolve the issue and are assisting customers.`

Read original article

Breaches $154 per record

The per-record cost of a data breach reached $154 this year, up 12 percent from last year`s $145, according to a report released by IBM and the Ponemon Institute,

In addition, the average total cost of a single data breach rose 23 percent to $3.79 million

Loss of business was a significant, and growing, part of the total cost of a data breach. Higher customer turnover, increased customer acquisition costs, and a hit to reputations and goodwill added up to $1.57 million per company, up from $1.33 million the previous years, said Ponemon Institute chairman and founder Larry Ponemon.

Ponemon analyzed results from 350 companies in 11 countries, each of which had suffered a breach over the past year.

Data breach costs varied dramatically by industry and by geography.

The U.S. had the highest per-record cost, at $217, followed by Germany at $211. India was lowest at $56 per record.

Sorted by industry, the highest costs were in the healthcare industry, at an average of $363 per record.

The reason, said Caleb Barlow, vice president at IBM Security, is because the information in a medical record has a much longer shelf life than that of, say, a credit card number.

`With credit cards, the time frame from the breach to mitigation is very short,` he said.

The credit card company just has to cancel the old credit card number and issue a new one.

`But the healthcare record can be used to establish access in perpetuity,` he said, pointing out that healthcare records include a wealth of personal information as well as Social Security numbers and insurance numbers.

`It can be used to establish credit or steal your identity ten or fifteen years from now,` he said. `Once this information is out there, you can`t get the genie back in the bottle.`

That doesn`t include the costs of health care fraud, he added.

Factors that can affect breach costs

The Ponemon report looked at a number of other factors that could potentially influence the cost of a breach, and, unlike industry or geography, many of these factors were under management control.

For example, having an incident response team available ahead of time reduced the per-record cost by $12.60. Using encryption extensively reduced costs by $12. Employee training reduced costs by $8.

If business continuity management personnel were part of the incident response team, costs fell by $7.10. CISO leadership lowered costs by $5.60, board involvement lowered costs by $5.50 and cyberinsurance lowered costs by $4.40.

`Companies that have thought about this ahead of time, that had their board involved, that had insurance protection, that had practiced what they would do, they had a much lower cost per breach,` said Barlow. `This is really compelling. We have tangible evidence that those who were doing that had much lower costs. You don`t have days to respond -- you don`t even have hours. You have minutes to get your act together.`

Factors that increased costs were the need to bring in outside consultants, which added $4.50 per record. If there were lost or stolen devices, costs increased by an average of $9 per record.

The single biggest factor was if a third party was involved in the cause of a breach. That increased the average per-record cost by $16, from $154 to $170.

Costs rise with time

Ponemon found a positive relationship between the time it took to identify a breach and the total cost of the breach, as well as between the time it took to mitigate the breach and the cost.

On average, it took respondents 256 days to spot a breach caused by a malicious attacker, and 82 days to to contain it.

Breaches caused by system glitches took 173 days to spot and 60 days to contain. Those caused by human error took an average of 158 days to notice, and 57 days to contain

Read original article