Krebs on Security not working

I'm getting an error on http://krebsonsecurity.com/feed/. The W3C validator says it is valid and I get what appears to be valid XML when I curl it but elfeed is giving me:
Elfeed parse failed for https://krebsonsecurity.com/feed/: (error XML: (Not Well-Formed) Only one root tag allowed)
Any hints?

I'm getting this from edebug:
Debugger entered--Lisp error: (void-variable url-http-response-status)
  apply(debug error (void-variable url-http-response-status))
  edebug(error (void-variable url-http-response-status))
  url-http-parse-headers()
  url-http-chunked-encoding-after-change-function(107256<PHONE_NUMBER>)
  url-http-generic-filter(#<process krebsonsecurity.com> " with information and security resources to individuals who may have been affected. The security of our networks is our top priority and we are acting accordingly.”
\n
“The few employees who may have been affected were notified promptly, and at this point the impact appears to be quite small.”

\n
According to a LANDESK employee who spoke on condition of anonymity, the breach was discovered quite recently, but system logs show the attackers first broke into LANDESK’s network 17 months ago, in June 2014.
\n
The employee, we’ll call him “John,” said the company only noticed the intrusion when several co-workers started complaining of slow Internet speeds. A LANDESK software developer later found that someone in the IT\302\240department had been logging into his build server, so he asked them about it. The IT department said it knew nothing of the issue.
\n
John said further investigation showed that the attackers were able to compromise the passwords of the global IT director in Utah and another domain administrator from China.
\n
“LANDESK has found remnants of text files with lists of source code and build servers that the attackers compiled,” John said. “They know for a fact that the attackers have been slowly [archiving] data from the build and source code servers, uploading it to LANDESK’s web servers, and downloading it.”
\n
The implications are potentially far reaching. This breach happened more than a year and a half ago, during which time several versions and fixes of LANDESK software have been released. LANDESK has thousands of customers in all areas of commerce. By compromising LANDESK and embedding a back door directly in their source code, the attackers could have access to large number of\302\240computers and servers worldwide.
\n
The wholesale theft of LANDESK source code also could make it easier\302\240for malware and exploit developers to find security vulnerabilities in the company’s software.
\n
A LANDESK spokesperson would neither confirm nor deny the date of the breach or the source code theft, saying only that the investigation into the breach is ongoing and that the company “won’t comment on speculation.”
\n
Update, 6:51 p.m. ET: Landesk just posted a statement on its support site. The relevant bit is here: “Given the recent online speculation about the security of our product, we want to reassure you about the security of our products and provide some best practices to help you increase your security posture if needed.\302\240 We can\342\200\231t comment on the specifics of the investigation, but based on the information we know so far, we have not confirmed a risk to our customers\342\200\231 environments, and there are no known primary attack vectors using LANDESK software.”
\n]]></content:encoded>\n			<wfw:commentRss>https://krebsonsecurity.com/2015/11/breach-at-it-automation-firm-landesk/feed/</wfw:commentRss>\n		<slash:comments>59</slash:comments>\n		</item>\n	</channel>\n</rss>\n
\n
\n0
\n
\n- Peer has closed the GnuTLS connection\n")
  recursive-edit()
  edebug--recursive-edit(after)
  edebug--display([t 0 0 10000 nil url-queue-run-queue nil idle 0] 1 after)
  edebug-debugger(1 after [t 0 0 10000 nil url-queue-run-queue nil idle 0])
  edebug-after(0 1 [t 0 0 10000 nil url-queue-run-queue nil idle 0])
  (lambda nil (edebug-after (edebug-before 0) 1 (elfeed-update-feed "https://krebsonsecurity.com/feed/")))()
  edebug-enter(edebug-anon90501 nil (lambda nil (edebug-after (edebug-before 0) 1 (elfeed-update-feed "https://krebsonsecurity.com/feed/"))))
  edebug-enter(edebug-anon90501 nil (lambda nil (edebug-after (edebug-before 0) 1 (elfeed-update-feed "https://krebsonsecurity.com/feed/"))))
  eval((edebug-enter (quote edebug-anon90501) nil (function (lambda nil (edebug-after (edebug-before 0) 1 (elfeed-update-feed "https://krebsonsecurity.com/feed/"))))) nil)
  eval-expression((edebug-enter (quote edebug-anon90501) nil (function (lambda nil (edebug-after (edebug-before 0) 1 (elfeed-update-feed "https://krebsonsecurity.com/feed/"))))))
  edebug-defun()
  #<subr call-interactively>(edebug-defun record nil)
  ad-Advice-call-interactively(#<subr call-interactively> edebug-defun record nil)
  apply(ad-Advice-call-interactively #<subr call-interactively> (edebug-defun record nil))
  call-interactively(edebug-defun record nil)
  command-execute(edebug-defun record)
  helm-M-x(nil "edebug-defun")
  #<subr call-interactively>(helm-M-x nil nil)
  ad-Advice-call-interactively(#<subr call-interactively> helm-M-x nil nil)
  apply(ad-Advice-call-interactively #<subr call-interactively> (helm-M-x nil nil))
  call-interactively(helm-M-x nil nil)
  command-execute(helm-M-x)

Actually, looking at it more, I think this might be a repeat of #87. Feel free to close if that's the case.

I see a multi-line comment. Not sure if that is the same as multiple comments:

It's working fine for me with the latest version of Elfeed and Emacs
24.4. Everything about the feed looks correct, too. What version of
Elfeed and Emacs are you using?

I'm on emacs 24.5.1 and elfeed 1.3.0. I just updated from melpa.

I'm still unable to reproduce the issue with the latest version of
Elfeed and Emacs 24.5. Your error message mentions a problem with
url-http-response-status, but Elfeed doesn't make use of any of the
url-http-* variables (in fact, Elfeed has little concern about the
chosen protocol). Some other code is triggering that error.
Check for problems in your config and see if you can reproduce the
problem without loading your config (-q). It may also be a problem with
your local network meddling with content. Corporate firewalls have
caused problems for Elfeed before.

I tried the following after emacs -Q:
(add-to-list 'load-path "~/.emacs.d/elpa/elfeed-20151215.938/")
(require 'elfeed)
(setq elfeed-feeds
      '(("http://feedpress.me/CoolTools" tech)
        ("http://www.osnews.com/files/recent.xml" tech)
        ("http://toucharcade.com/feed/" tech)
        ("http://www.marco.org/rss" tech)
        ("https://news.ycombinator.com/rss" tech)
        ("http://www.loopinsight.com/feed/" tech)
        ("http://emacs-fu.blogspot.com/feeds/posts/default" tech emacs)
        ("http://feed.torrentfreak.com/Torrentfreak/" tech)
        ("http://feeds.dashes.com/AnilDash" tech)
        ("https://krebsonsecurity.com/feed/" tech)
        ("http://feeds2.feedburner.com/hackaday/LgoM" tech)
        ("http://syndication.thedailywtf.com/TheDailyWtf" tech)
        ("http://feeds.feedburner.com/readwriteweb" tech)
        ("http://www.engadget.com/rss.xml" tech)
        ("http://feeds.feedburner.com/makezineonline" tech)
        ("http://www.aaronsw.com/2002/feeds/pgessays.rss" tech)
        ("http://gearhungry.com/feed" tech)
        ("http://feeds.feedburner.com/boingboing/iBag" tech)
        ("https://planet.archlinux.org/atom.xml" tech)
        ("https://www.schneier.com/blog/atom.xml" tech)
        ("http://www.theverge.com/rss/full.xml" tech)
        ("http://feeds.feedburner.com/codinghorror/" tech)
        ("http://feeds.arstechnica.com/arstechnica/index/" tech)
        ("http://feeds.feedburner.com/Makeuseof" tech)
        ("http://lambda-the-ultimate.org/rss.xml" tech)
        ("http://daringfireball.net/feeds/main" tech)
        ("http://feeds.feedburner.com/werdcom" tech)
        ("http://randsinrepose.com/feed/" tech)
        ("http://rss.slashdot.org/Slashdot/slashdot" tech)
        ("http://feeds.feedburner.com/Phoronix" tech)
        ("http://feeds.feedburner.com/TheWirecutter" tech)
        ("http://feeds.feedburner.com/Letterheady" design)
        ("http://feeds.feedburner.com/acontinuouslean/" design)
        ("http://feeds.kottke.org/main" design)
        ("http://feeds.feedburner.com/InformationIsBeautiful" design)
        ("http://feeds.feedburner.com/alistapart/main" design)
        ("http://www.typorn.org/rss.xml" design)
        ("http://www.smashingmagazine.com/feed/" design)
        ("http://feeds.feedburner.com/ucllc/brandnew" design)
        ("http://postsecret.com/feed/?alt=rss" misc)
        ("http://motherboard.vice.com/rss?trk_source=motherboard" misc)
        ("http://feeds2.feedburner.com/slashfilm" misc)
        ("http://longreads.com/rss/" misc)
        ("http://feeds.feedburner.com/AskMetafilter" misc)
        ("http://feeds.feedburner.com/tedtalks_video" misc)
        ("http://feeds.feedburner.com/everyday-carry/bQTf" misc)
        ("http://what-if.xkcd.com/feed.atom" misc)
        ("http://longform.org/feeds/site.rss" misc)
        ("http://feeds.feedburner.com/Metafilter" misc)
        ("http://feeds.boston.com/boston/bigpicture/index" misc)
        ("http://feeds.feedburner.com/LettersOfNote" misc)
        ("http://feeds.feedburner.com/volokh/mainfeed" politics)
        ("http://gregmankiw.blogspot.com/feeds/posts/default" politics)
        ("http://feeds.feedburner.com/scotusblog/pFXs" politics)
        ("http://www.footnoted.com/feed/" politics)
        ("http://feeds.feedburner.com/Popehat" politics)
        ("http://feeds.feedburner.com/CafeHayek" politics)
        ("http://feeds.feedblitz.com/loweringthebar" politics)
        ("http://feeds.feedburner.com/abovethelaw/" politics)
        ("http://feeds.cato.org/Cato-at-liberty" politics)
        ("http://notalwaysright.com/feed/atom" humor)
        ("http://tragedyseries.tumblr.com/rss" humor)
        ("http://feeds.theonion.com/theonion/daily" humor)
        ("http://feeds.feedburner.com/passiveaggressivenotes" humor)
        ("http://shitmystudentswrite.tumblr.com/rss" humor)
        ("http://www.somethingawful.com/rss/frontpage.xml" humor)
        ("http://www.badassoftheweek.com/rss.xml" humor)
        ("http://basicinstructions.net/basic-instructions/atom.xml" humor)
        ("http://oglaf.com/feeds/rss/" humor)
        ("http://feeds.feedburner.com/Hyperbole-and-a-half" humor)
        ("http://feeds.feedburner.com/oatmealfeed" humor)
        ("http://feeds.feedburner.com/CrackedRSS" humor)
        ("http://www.xkcd.com/rss.xml" humor)))
(setf url-queue-timeout 60)
(setq elfeed-search-date-format '("%Y-%m-%d %H:%M" 16 :left))
(setq elfeed-sort-order 'ascending)

On refreshing I still get:
[2015-12-18 11:01:44] [error]: Elfeed parse failed for https://krebsonsecurity.com/feed/: (error XML: (Not Well-Formed) Only one root tag allowed)

Hmmm, using your exact config I'm still unable to reproduce on either
24.4 or 24.5. I'm trying to think of what would be different between us.
Elfeed uses Emacs' Elisp XML parser, so the parser shouldn't vary
between platforms (i.e. Emacs linked against differing versions of
libxml2). The only thing I can think of is that you're being served
different content than me.
Could you wget/curl the Krebs feed and share it? That way I can parse
the exact same bytes as you (elfeed-xml-parse-region).

Here's what I'm getting:
<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Krebs on Security</title>
	<atom:link href="http://krebsonsecurity.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://krebsonsecurity.com</link>
	<description>In-depth security news and investigation</description>
	<lastBuildDate>Thu, 17 Dec 2015 20:11:37 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>https://wordpress.org/?v=4.4</generator>
	<item>
		<title>Banks: Card Breach at Landry’s Restaurants</title>
		<link>http://krebsonsecurity.com/2015/12/banks-card-breach-at-landrys-restaurants/</link>
		<comments>http://krebsonsecurity.com/2015/12/banks-card-breach-at-landrys-restaurants/#comments</comments>
		<pubDate>Thu, 17 Dec 2015 18:55:37 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[Data Breaches]]></category>
		<category><![CDATA[Landry's breach]]></category>
		<category><![CDATA[Bubba Gump]]></category>
		<category><![CDATA[Claim Jumper]]></category>
		<category><![CDATA[McCormick & Schmick's]]></category>
		<category><![CDATA[Morton]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=33315</guid>
		<description><![CDATA[Fraud analysts in the banking industry tell KrebsOnSecurity that the latest hospitality firm to suffer a credit card breach is likely Landry's Inc., a company that manages a nationwide stable of well-known restaurants -- including Bubba Gump, Claim Jumper, McCormick & Schmick's, and Morton's. Landry's has not responded to multiple requests for comment.]]></description>
				<content:encoded><![CDATA[
Fraud analysts in the banking industry tell KrebsOnSecurity that the latest hospitality firm to suffer a credit card breach is likely Landry’s Inc., a company that manages a nationwide stable of well-known restaurants — including Bubba Gump, Claim Jumper, McCormick & Schmick’s, and Morton’s.

Update, 2:57 p.m. ET: Landry’s has acknowledged an investigation. Their press release is available here (PDF).

Original story:

Houston-based Landry’s Inc. owns and operates more than 500 properties, such as Landry’s Seafood, Chart House and Rainforest Cafe. Last week, I began hearing from banking industry sources who said fraud patterns on cards they’d issued to customers strongly suggested a breach at the restaurateur. Industry sources told this author that the problem appears to have started in May 2015 and may still be impacting some Landry’s locations.

It remains unclear how many of Landry’s 500 properties may be affected. The company says it is investigating reports of unauthorized charges on certain payment cards after the cards were used legitimately at some of its restaurants. An online FAQ about the incident posted to Landry’s site says the company does not yet know the extent of the breach.

Restaurants are a prime target for credit card thieves, mainly because they traditionally have not placed a huge emphasis on securing their payment systems. The attackers typically exploit security vulnerabilities or weaknesses in point-of-sale devices to install malicious software that steals credit and debit card data.

Thieves can encode the stolen data onto new plastic and use the counterfeit cards at big box retailers like Best Buy and Target. Indeed, multiple sources in the banking industry say they are now seeing fraudulent purchases at big box stores on cards that all were used at apparently compromised Landry’s locations.

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/banks-card-breach-at-landrys-restaurants/feed/</wfw:commentRss>
		<slash:comments>13</slash:comments>
		</item>
		<item>
		<title>Skimmers Found at Some Calif., Colo. Safeways</title>
		<link>http://krebsonsecurity.com/2015/12/skimmers-found-at-some-calif-colo-safeways/</link>
		<comments>http://krebsonsecurity.com/2015/12/skimmers-found-at-some-calif-colo-safeways/#comments</comments>
		<pubDate>Wed, 16 Dec 2015 05:10:37 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[A Little Sunshine]]></category>
		<category><![CDATA[All About Skimmers]]></category>
		<category><![CDATA[Barnes & Noble]]></category>
		<category><![CDATA[Michaels Stores]]></category>
		<category><![CDATA[Safeway skimmers]]></category>
		<category><![CDATA[Brian Dowling]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=33285</guid>
		<description><![CDATA[Sources at multiple financial institutions say they are tracking a pattern of fraud indicating that thieves have somehow compromised the credit card terminals at checkout lanes within multiple Safeway stores in California and Colorado. Safeway confirmed it is investigating skimming incidents at several stores.]]></description>
				<content:encoded><![CDATA[
Sources at multiple financial institutions say they are tracking a pattern of fraud indicating that thieves have somehow compromised the credit card terminals at checkout lanes within multiple Safeway stores in California and Colorado. Safeway confirmed it is investigating skimming incidents at several stores.

Banking sources say they’ve been trying to figure out why so many customers in the Denver and Englewood areas of Colorado were seeing their debit cards drained of cash at ATMs after shopping at Safeways there. The sources compared notes and found that all of the affected customers had purchased goods from one of several specific lanes in different compromised stores (the transaction data includes a “terminal ID” which can be useful in determining which checkout lanes were compromised.

Safeway spokesperson Brian Dowling said the fraud was limited to a handful of stores, and that the company has processes and procedures in place to protect customers from fraudulent activity.

“We have an excellent track record in this area,” Dowling said. “In fact, we inspect our store’s pin pads regularly and from time to time find a skimmer, but findings have been limited and small in scale. We immediately contact law enforcement and take steps to minimize customer impact.”

Dowling said the problem of checkout skimmers is hardly limited to Safeway, and he hinted that perhaps other retailers have been hit by this same group.

“This is not unique to our company, and we understand some other retailers may have been more significantly impacted,” Dowling said, declining to elaborate.

Safeway would not name the affected locations, but bank industry sources say the fraud was traced back to Colorado locations in Arvada, Conifer, Denver, Englewood and Lakewood. In California, banks there strongly suspect Safeway locations in Castro Valley and Menlo Park may also have been hit. Those sources say ATM fraud has been linked to customers using their debit cards at those locations since early September 2015.

In order to steal card data and personal identification numbers (PINs) from Safeway customers, the thieves would have had to open up the card processing terminals at each checkout lane. Once inside, the thieves can install a device that sits between the keypad and the electronics underneath to capture and store PINs, as well as a separate apparatus that siphons account data when customers swipe their cards at the register.

Either that, or the skimmer crooks would have to secretly swap out existing card terminals at checkout lanes with pre-compromised terminals of the exact same design. In any case, skimming incidents involving checkout lanes in retail locations generally involve someone on the inside at the affected retailer.

In late 2012, bookseller Barnes & Noble disclosed that it had found modified point-of-sale devices at 60 locations nationwide. The year prior, Michaels Stores said it had replaced more than 7,200 credit card terminals from store registers nationwide, after discovering that thieves had somehow modified or replaced card machines to include technology capable of siphoning customer payment card data and PINs.

Sadly, I don’t have any skimmer photos to share from this story, but I have written about the growing sophistication of these point-of-sale skimming devices. Here’s a look at one compromised card reader, and the handiwork that went into the thieves’ craft. Descriptions and images from other skimming devices can be found in my series All About Skimmers.

The mass-issuance of chip-based credit and debit cards by U.S. banks to consumers should eventually help minimize these types of scams, but probably not for some time yet. Most cards will continue to have all of the cardholder data stored in plain text on the magnetic strip of these chip-based cards for several years to come. As long as merchants continue to let customers swipe instead of “dip,” we’ll continue to see skimmers just about everywhere swiping is still allowed.

Remember that you are not liable for fraudulent card charges, but that it’s still your responsibility to alert their card issuer quickly to any unauthorized charges. So keep a close eye on your bank statements. Also, this attack is another reminder of why it makes more sense to shop with a credit vs. a debit card: Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/skimmers-found-at-some-calif-colo-safeways/feed/</wfw:commentRss>
		<slash:comments>61</slash:comments>
		</item>
		<item>
		<title>13 Million MacKeeper Users Exposed</title>
		<link>http://krebsonsecurity.com/2015/12/13-million-mackeeper-users-exposed/</link>
		<comments>http://krebsonsecurity.com/2015/12/13-million-mackeeper-users-exposed/#comments</comments>
		<pubDate>Mon, 14 Dec 2015 20:51:07 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[A Little Sunshine]]></category>
		<category><![CDATA[Security Tools]]></category>
		<category><![CDATA[Shodan]]></category>
		<category><![CDATA[MongoDB]]></category>
		<category><![CDATA[Kromtech]]></category>
		<category><![CDATA[MacKeeper]]></category>
		<category><![CDATA[Chris Vickery]]></category>
		<category><![CDATA[computer fraud and abuse act]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=33269</guid>
		<description><![CDATA[The makers of MacKeeper -- a much-maligned software utility many consider to be little more than scareware that targets Mac users -- have acknowledged a breach that exposed the usernames, passwords and other information on more than 13 million customers and, er...users. Perhaps more interestingly, the guy who found and reported the breach doesn't even own a Mac, and discovered the data trove merely by browsing Shodan -- a specialized search engine that looks for and indexes virtually anything that gets connected to the Internet.]]></description>
				<content:encoded><![CDATA[
The makers of MacKeeper — a much-maligned software utility many consider to be little more than scareware that targets Mac users — have acknowledged a breach that exposed the usernames, passwords and other information on more than 13 million customers and, er…users. Perhaps more interestingly, the guy who found and reported the breach doesn’t even own a Mac, and discovered the data trove merely by browsing Shodan — a specialized search engine that looks for and indexes virtually anything that gets connected to the Internet.

IT helpdesk guy by day and security researcher by night, 31-year-old Chris Vickery said he unearthed the 21 gb trove of MacKeeper user data after spending a few bored moments searching for database servers that require no authentication and are open to external connections.

Vickery told Shodan to find all known instances of database servers listening for incoming connections on port 27017. “Ports” are like doorways that govern access into and out of specific areas of a server, and each port number generally maps to one or a handful of known Web applications and services. Port 27017 happens to be associated with MongoDB, a popular database management system.

In short order, Vickery’s request turned up four different Internet addresses, all of which he later learned belonged to Kromtech, the company that makes MacKeeper.

“There are a lot of interesting, educating and intriguing things that you can find on Shodan,” Vickery said. “But there’s a lot of stuff that should definitely not be out there, and when I come across those I try to notify the owner of the affected database.”

Vickery said he reached out the company, which responded quickly by shuttering public access to its user database, and publicly thanking him for reporting it.

“Some 13 million customer records leaked from is aware of a potential vulnerability in access to our data storage system and we are grateful to the security researcher Chris Vickery who identified this issue without disclosing any technical details for public use,” the company said in a statement published to its site totday. “We fixed this error within hours of the discovery. Analysis of our data storage system shows only one individual gained access performed by the security researcher himself. We have been in communication with Chris and he has not shared or used the data inappropriately.”

Kromtech said all customer credit card and payment information is processed by a 3rd party merchant and was never at risk.

“Billing information is not transmitted or stored on any of our servers. We do not collect any sensitive personal information of our customers,” the statement continues. “The only customer information we retain are name, products ordered, license information, public ip address and their user credentials such as product specific usernames, password hashes for the customer’s web admin account where they can manage subscriptions, support, and product licenses.”

Vickery said Kromtech told him its database had been inadvertently exposed as a result of a server misconfiguration that was introduced just last week. But Vickery said he doubts that’s the case, because some of the Shodan records he found that pointed back to Kromtech’s database were dated mid-November 2015.

“The funny thing is, I don’t even own a Mac, and I had never heard of MacKeeper until last night,” Vickery said. “I didn’t know it was some sort of scamming scareware or software that pushes itself on people. The irony here is pretty thick.”

Vickery said he was able to connect to the database that Shodan turned up for him just by cutting and pasting the information into a commercial tool built to browse Mongo databases. Asked whether he’s worried that some clueless organization or overzealous prosecutor might come after him for computer hacking, Vickery said he’s not concerned (for background, see the controversy over bone-headed cases brought against researchers under the Computer Fraud and Abuse Act).

“It’s a concern, but I’ve made peace with that and you can’t live your life in fear,” he said. “I feel pretty confident that if you configure a server for public access — without authentication — and it gets publicly accessed, that’s not a crime.”

I admire Vickery’s courage and straightforward approach, and his story is a good reminder about the importance of organizations using all of the resources available to them to find instances of public access to sensitive or proprietary data that shouldn’t be public.  Consider taking the time to learn how to use Shodan (it’s actually fairly intuitive, but some data may only be available to paying subscribers); use it to see if your organization has unnecessarily exposed databases, networking devices, security cameras and other “Internet of Things” devices.

Finally, if you’re a MacKeeper customer and you re-used your MacKeeper user password at other sites, it’s now time change that password at the other sites — and not just to your new MacKeeper password! For more password do’s and don’ts, check out this primer.

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/13-million-mackeeper-users-exposed/feed/</wfw:commentRss>
		<slash:comments>21</slash:comments>
		</item>
		<item>
		<title>Don’t Be a Victim of Tax Refund Fraud in ’16</title>
		<link>http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/</link>
		<comments>http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/#comments</comments>
		<pubDate>Mon, 14 Dec 2015 14:51:04 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[Tax Refund Fraud]]></category>
		<category><![CDATA[Equifax]]></category>
		<category><![CDATA[turbotax]]></category>
		<category><![CDATA[H&R Block]]></category>
		<category><![CDATA[Michael Kasper]]></category>
		<category><![CDATA[John Koskinen]]></category>
		<category><![CDATA[Julie Magee]]></category>
		<category><![CDATA[Isha Sesay]]></category>
		<category><![CDATA[IP PIN]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=32957</guid>
		<description><![CDATA[With little more than a month to go before the start of the 2016 tax filing season, the IRS and the states are hunkering down for an expected slugfest with identity thieves who make a living requesting fraudulent tax refunds on behalf of victims. Here's what you need to know going into January to protect you and your family.]]></description>
				<content:encoded><![CDATA[
With little more than a month to go before the start of the 2016 tax filing season, the IRS and the states are hunkering down for an expected slugfest with identity thieves who make a living requesting fraudulent tax refunds on behalf of victims. Here’s what you need to know going into January to protect you and your family.

<img class="alignright wp-image-25751" src="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg" alt="The Growing Tax Fraud Menace" width="260" height="260" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-150x150.jpg 150w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg 285w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-600x600.jpg 600w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg 693w" sizes="(max-width: 260px) 100vw, 260px" />The good news is that the states and Uncle Sam have got a whole new bag of technological tricks up their sleeves this coming tax season. The bad news is ID thieves are already testing those defenses, and will be working against a financially strapped federal agency that’s been forced to cede much of its ability to investigate and prosecute such crimes.

Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.

By all accounts, the IRS has improved at blocking phony refund requests. The agency estimates it prevented $24.2 billion in fraudulent identity theft refunds in 2013. Trouble is, it paid out some $5.8 billion in fraudulent refunds that year that it later determined were bogus, and experts say that is only the fraud the agency knows about, and the true number is likely much higher annually.

Perhaps in response to the IRS’s increasing ability to separate phony returns from legitimate ones, crooks last year massively focused on filing bogus refund requests with the 50 U.S states. To head off a recurrence of that trend in the 2016 filing season, the states and the IRS have hammered out an agreement to examine more than 20 new data elements collected by online providers like TurboTax and H&R Block.

Those new data elements include checking for the repetitive use of the same Internet address to rapidly file multiple returns, and reviewing computer device information (browser user agent string, cookies e.g.) tied to the return’s origin. Another check involves measuring the time it takes to file a return; fraudsters involved in tax refund fraud tend to breeze through returns in just a few minutes because they are generally copying and pasting information into the tax forms, or relying on an automated program to do it for them.

The hope is that the these new checks will let investigators more accurately flag suspicious refund requests processed by tax preparation firms, which also have agreed to beef up lax security around customer accounts. Under the agreement, online providers will enforce:

new password standards to include a minimum of eight characters, with upper, lowercase, alphanumerical and special characters;

a lock-out feature that blocks users with too many unsuccessful login attempts;

the addition of three security questions;

some sort of out-of-band verification for email addresses — sending an email or text to the customer with a personal identification number (PIN).

Julie Magee, Alabama’s chief tax administrator, said the state/IRS task force opted not to disclose all 20 of the data elements they will be collecting from tax prep firms.

“The thieves are going to figure these out on their own, and they’re already testing our defenses,” Magee told KrebsOnSecurity. “We don’t want to do anything to make that easier for them.”

ANALYSIS

Whether or not we see an increase in tax refund fraud next year, one thing seems certain: the IRS will prosecute far fewer of the crooks involved. Congress has persistently underfunded the IRS, and budget cuts have pushed prosecutions of identity thieves to a new low. According to the IRS’s 2015 Annual Report, IRS identity theft criminal investigations are down almost 50 percent since 2013.

<img class="aligncenter size-medium wp-image-33236" src="http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15-580x164.png" alt="irs-idtheftprosecutions13-15" width="580" height="164" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15-580x164.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15-768x218.png 768w, http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15-940x266.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15.png 1270w" sizes="(max-width: 580px) 100vw, 580px" />

Tax fraudsters were so aggressive last year that they figured out how to steal consumer identities directly from the agency itself. In August 2015, the IRS disclosed that crooks abused the “Get Transcript” feature on its Web site to steal Social Security numbers and information from previous years’ tax filings on more than 334,000 Americans.

The IRS has responded to the problem of tax ID theft partly by offering Identity Protection PINs (IP PINs) to affected taxpayers that must be supplied on the following year’s tax application before the IRS will accept the return. However, consumers still have to request an IP PIN by applying for one at the agency’s site, or by mailing in form 14039 (PDF).

Incredibly, the process that thieves abused to steal tax transcripts from 334,000 taxpayers this year from the IRS’s site also works to fraudulently obtain a consumer’s IP PIN. In fact, the following redacted screen shot from a notorious cybercrime forum shows a seasoned tax fraudster teaching would-be scammers how to use the IRS’s site to obtain a victim’s IP PIN.

Both the Get Transcript and the process to retrieve an IP PIN from the IRS’s site are vulnerable because they rely on the applicant supplying static information that is trivial for thieves to obtain, including the taxpayer’s name, date of birth, Social Security number and filing status. After that data is successfully supplied, the IRS uses a service from credit bureau Equifax that asks four so-called “knowledge-based authentication” (KBA) questions.

These KBA questions — which involve multiple choice, “out of wallet” questions such as previous address, loan amounts and dates — can be successfully enumerated with random guessing, but much of the data is readily available via free online social networking and consumer tracking services like Spokeo.

If any readers here doubt how easy it is to buy personal data on just about anyone, check out the story I wrote in December 2014, wherein I was able to find the name, address, Social Security number, previous address and phone number on all current members of the U.S. Senate Commerce Committee. This information is no longer secret (nor are the answers to KBA-based questions), and we are all made vulnerable to identity theft as long as institutions continue to rely on static information as authenticators.

My guess is that a huge chunk of 334,000 victimized via the IRS’s site this year probably will not request the IP PIN and will in fact have fraudulent tax returns filed with their info — whether they request the IP PIN and it is stolen or not. The IRS should just issue the IP PINs to affected taxpayers, instead of asking victims to do it themselves.

Incidentally, the IRS’s Twitter account is still promoting the online Get Transcript capability, even though it no longer offers the service online. For now, the only way to obtain a transcript is via snail mail.

IRS’s Twitter account urging followers to use a service that hasn’t been available since May 2015.

DON’T BE THE NEXT VICTIM

In notifying 334,000 taxpayers affected by its Get Transcript debacle, the IRS predictably offered victims free credit monitoring services from Equifax. The IRS makes no mention of a more effective way to block ID thieves: Placing a “security freeze” on one’s credit files with the major credit bureaus. See this tutorial about why freezes are more effective than credit monitoring in blocking ID thieves from assuming your identity to open up new lines of credit.

While it’s true that having a security freeze on your credit file won’t stop thieves from committing tax refund fraud in your name, it would stop them from fraudulently obtaining your IP PIN. Also, anyone who has a freeze in place will need to temporarily lift that freeze to take advantage of any credit monitoring services (in this case, the consumer would need to briefly thaw a freeze at Equifax).

-File before the fraudsters do it for you – Your primary defense against becoming the next victim is to file your taxes at the state and federal level as quickly as possible after the 2016 Tax Filing Season begins — which is usually the second or third week in January. Remember, it doesn’t matter whether or not the IRS owes you money: Thieves can still try to impersonate you and claim that they do, leaving you to sort out the mess with the IRS later.

-Get on a schedule to request a free copy of your credit report. By law, consumers are entitled to a free copy of their report from each of the major bureaus once a year. Put it on your calendar to request a copy of your file every three to four months, each time from a different credit bureau. Dispute any unauthorized or suspicious activity. This is where credit monitoring services are useful: Part of their service is to help you sort this out with the credit bureaus, so if you’re signed up for credit monitoring make them do the hard work for you.

–Monitor, then freeze. Take advantage of any free credit monitoring available to you, and then freeze your credit file with the four major bureaus. Instructions for doing that are here.

-File form 14039 and request an IP PIN from the government. This form requires consumers to state they believe they’re likely to be victims of identity fraud. Even if thieves haven’t tried to file your taxes for you yet, virtually all Americans have been touched by incidents that could lead to ID theft — even if we just look at breaches announced in the past year alone.

FIGHT BACK

Thieves involved in tax return fraud may be laughing all the way to the bank, but that doesn’t mean we have to suck it up and take it: Exercise your rights to obtain a copy of the phony return, and you may just help put crooks in jail.

If you become of the victim of tax fraud and are motivated to learn who helped to defraud you and Uncle Sam, you can file form 4506 (plus a $50 fee) to get a copy of the return. That information can be shared with your local police, who may be able to use to track down people who help launder the proceeds from tax refund fraud.

Earlier this year, I wrote about Isha Sesay, a Pennsylvania woman who was arrested for receiving phony IRS refunds on behalf of at least two tax fraud victims. Among Sesay’s victims was resident Mike Kasper, whose request for the filing led to Sesay’s arrest. Kasper’s hard work helped expose the IRS’s pervasive authentication weaknesses and later testified to Congress about his ordeal. Sesay is currently scheduled to plead guilty (PDF) to the charges on Dec. 18.

Turns out, Kasper’s sleuthing was key to Sesay’s prosecution. When he found out he’d been victimized, Kasper requested the copy of returns that fraudsters filed in his name, but he did so before filing form 14039 to request an IP PIN.  Had he done it in the opposite order, the IRS would have redacted all of Ms. Sesay personal and financial information.

Poughkeepsie, NY victim Michael Kasper testifying before the Senate Homeland Security Committee in June 2015.

In testimony before the Senate this year, IRS Commissioner John Koskinen explained the reasoning behind that decision: A fraudulent return could include the personal information of other people. The end result is that it is better to file form 4506 and pay $50 to request a photocopy of the fraudulent return before you file form 14039 to formally report the fraud.

“There is a section 6103 of the US code that imposes stiff criminal penalties for sharing tax return information  and the IRS’s tortured view of reality interprets this law, which is intended to protect personal information, so that once you report fraud and they know some information on the return might not be yours, they believe it is against the law for them to ever share that information with you,” Kasper said.

“As a result, when they recently created the process above for victims to get a copy of the fraudulent tax returns filed in their name, the IRS decided they need to redact any personal info that could possibly belong to a criminal,” Kasper continued. “They do everything they can to protect the privacy of the criminal who already violated your privacy. You actually lose all of your rights once you report the crime so it’s better to wait.”

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/feed/</wfw:commentRss>
		<slash:comments>50</slash:comments>
		</item>
		<item>
		<title>The Role of Phony Returns in Gift Card Fraud</title>
		<link>http://krebsonsecurity.com/2015/12/the-role-of-phony-returns-in-gift-card-fraud/</link>
		<comments>http://krebsonsecurity.com/2015/12/the-role-of-phony-returns-in-gift-card-fraud/#comments</comments>
		<pubDate>Thu, 10 Dec 2015 19:48:17 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[Web Fraud 2.0]]></category>
		<category><![CDATA[Starbucks]]></category>
		<category><![CDATA[Damon McCoy]]></category>
		<category><![CDATA[gift card fraud]]></category>
		<category><![CDATA[New York University]]></category>
		<category><![CDATA[Petsmart]]></category>
		<category><![CDATA[Petco]]></category>
		<category><![CDATA[H&M]]></category>
		<category><![CDATA[Chevron]]></category>
		<category><![CDATA[Cabelas]]></category>
		<category><![CDATA[The Return Exchange]]></category>
		<category><![CDATA[giftcardgranny.com]]></category>
		<category><![CDATA[cardpool.com]]></category>
		<category><![CDATA[raise.com]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=33217</guid>
		<description><![CDATA[On any given day, there are thousands of gift cards from top retailers for sale online that can be had for a fraction of their face value. Some of these are exactly what they appear to be: legitimate gift cards sold through third-party sites that specialize in reselling used or unwanted cards. But many discounted gift cards for sale online are in fact the product of merchandise return fraud, meaning consumers who purchase them unwittingly help thieves rob the stores that issued the cards.]]></description>
				<content:encoded><![CDATA[
On any given day, there are thousands of gift cards from top retailers for sale online that can be had for a fraction of their face value. Some of these are exactly what they appear to be: legitimate gift cards sold through third-party sites that specialize in reselling used or unwanted cards. But many of the more steeply discounted gift cards for sale online are in fact the product of merchandise return fraud, meaning consumers who purchase them unwittingly help thieves rob the stores that issued the cards.

This type of scam mainly impacts brick-and-mortar retailers that issue gift cards when consumers return merchandise at a store without presenting a receipt. Last week I heard from KrebsOnSecurity reader Lisa who recently went online to purchase a bunch of steeply discounted gift cards issued by pet supply chain Petco.

Lisa owns two Rottweilers that both eat a good chunk of their weight each month in dog food, so Lisa said she felt like she’d really hit on a bargain when she found a $165 Petco gift card for sale at a popular online gift card retailer for $120 (a nearly 30 percent discount on the value).

“When I went to Petco to get my monthly supply of dog food and snacks for my Rotties, I used my merchandise card and the manager shared with me that folks are stealing merchandise from one Petco store and returning the items to another without a receipt and then selling the cards to places like raise.com and cardpool.com at a discounted price,” Lisa recounted.

Petco’s official policy is that for returns more than 60 days after the purchase — or if the receipt is unavailable — the value of the goods returned will be refunded to a merchandise card. Lisa said she bought the Petco card from raise.com, but she said the company never disclosed that the card was a merchandise return card — a fact that was printed on the front of the card she received.

“I feel really bad now because my purchase of these cards may have contributed to unlawful activities,” Lisa said. “Even though I saved $40+, Petco actually lost money as a result.”

Neither Raise nor Petco responded to requests for comment. But a look at the available Petco cards for sale via one gift card tracking site — giftcardgranny.com — shows Petco cards routinely sell for at least 25 percent off their value.

In any case, this fraud scheme is hardly specific to Petco. Cards from Petsmart, a competitor that also offers merchandise return cards, generally sell at 20 percent off their value. Clothier H&M’s cards average about 30 percent off.

Contrast these discounts with those for gift cards from restaurants, fuel stations and other businesses that generally don’t have to deal with customer returns and you’ll notice two interesting patterns: For starters, the face value of the cards from merchants that don’t take customer returns are far more likely to be even amounts, such as $50, $25 and $40. The percentage off the face value also tends to be much lower — between 3 and 15 percent. For example, see the discount percentage and value of cards from Starbucks and Chevron.

“Twenty-five percent off is really high, and there aren’t many that offer that high of a discount,” said Damon McCoy, an assistant professor of computer science at New York University and an expert on fraud involving stored value cards. “Normally, it is around 5 percent to 15 percent.”

According to a study conducted jointly by KingRogers International and The Retail Equation, approximately nine percent of all returns in the United States are fraudulent. The National Retail Foundation estimates that the problem will cost U.S. retailers nearly $11 billion this year.

Investigators say the crimes very often are tied to identity theft rings and drug addicts. Last month, authorities in Michigan convicted a 46-year-old father of four for running a large-scale fencing operation that used teams of prostitutes, heroin users, parolees and panhandlers to steal high-priced items from local Home Depot stores and then return the goods to a different Home Depot location in exchange for store debit cards.

Of course, another huge source card of gift card fraud are cards purchased with stolen credit cards. Thieves will buy “dumps” — card data stolen from brick-and-mortar businesses — and encode that data onto anything with a magnetic strip and try to buy high-dollar gift cards from a range of retailers. The carded gift cards very often wind up for sale online at steep 20-30 percent discounts.

Earlier this year I saw part of this process in action at a Giant grocery store in Maryland. The man in front of me in line looked and smelled homeless. The only items he was trying to buy were several $200 gift cards that Giant had on sale for various retailers. When the first card he swiped was declined, the man fished two more cards out of his wallet. Each was similarly declined, but the man just shrugged and walked out of the store. I asked the cashier if this sort of thing happened often, and he just shook his head and said, “Man, you have no idea.”

Lisa admits she remains conflicted over whether she would buy another steeply discounted card to help feed her dogs. But she said retailers could help stem this type of fraud by tying merchandise return cards to the identity of the person who returned the merchandise in the first place. Most stores that issue merchandise return cards now require the person returning the goods to show a valid state driver’s license, but the cards are not tied to that customer, nor do stores check ID when consumers use merchandise return cards at the store to purchase goods.

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/the-role-of-phony-returns-in-gift-card-fraud/feed/</wfw:commentRss>
		<slash:comments>71</slash:comments>
		</item>
		<item>
		<title>Adobe, Microsoft Each Plug 70+ Security Holes</title>
		<link>http://krebsonsecurity.com/2015/12/adobe-microsoft-each-plug-70-security-holes/</link>
		<comments>http://krebsonsecurity.com/2015/12/adobe-microsoft-each-plug-70-security-holes/#comments</comments>
		<pubDate>Wed, 09 Dec 2015 00:45:25 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[Time to Patch]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=33202</guid>
		<description><![CDATA[Adobe and Microsoft today independently issued software updates to plug critical security holes in their software. Adobe released a patch that fixes a whopping 78 security vulnerabilities in its Flash Player software. Microsoft pushed a dozen patch bundles to address at least 71 flaws in various versions of the Windows operating system and associated software.]]></description>
				<content:encoded><![CDATA[
Adobe and Microsoft today independently issued software updates to plug critical security holes in their software. Adobe released a patch that fixes a whopping 78 security vulnerabilities in its Flash Player software. Microsoft pushed a dozen patch bundles to address at least 71 flaws in various versions of the Windows operating system and associated software.

Three-quarters of the patches Microsoft issued earned the company’s most dire “critical” rating, meaning malware or attackers could use the flaws fixed in these patches to fully compromise vulnerable systems with zero help from users. What’s more, two of the vulnerabilities are actively being exploited, including a bug in Windows and Microsoft Office.

As per usual, a patch for Internet Explorer addresses a huge chunk (30) of the individual security flaws tackled in this month’s update cycle. Microsoft also released a critical patch to correct 15 weaknesses in Microsoft Edge, the browser meant to supplant IE.

According to security firm Shavlik, supported versions of IE will be changing quite a bit in January. After January 12, 2016, only the latest IE version available on each operating system will be supported. This means if you are not running the latest version of IE available for the version of Windows you are on, you will no longer be getting security updates. More information about this change is available here.

The SANS Internet Storm Center is reporting that some Windows users who have Outlook installed are experiencing some difficulties using the program after applying this month’s updates. If you use Outlook, it may be wise to put off installing this patch for a few days until Microsoft addresses the issue.

Another vulnerability — fixed by a patch for domain name system (DNS) servers that run on Windows Servers — could prove extremely dangerous for organizations that rely on Windows Server for DNS services. According to SANS, Microsoft rates the exploitability as “2”, but doesn’t provide much details as to the nature of the vulnerability other than the fact that it can be triggered by remote DNS requests, which is bad news if you are using a Microsoft DNS server exposed to the public internet.

Adobe’s Flash update brings Flash to version <IP_ADDRESS> for Internet Explorer and Chrome on Windows and Mac systems, and <IP_ADDRESS> for Windows and Mac versions of Firefox and Safari.

As I noted in a previous post, most users can jump off the incessant Flash-patching merry-go-round by simply removing the program — or hobbling it until and unless it is needed for some purpose or site.

Disabling Flash in Chrome is simple enough, and can be easily reversed: On a Windows, Mac, Linux or Chrome OS installation of Chrome, type “chrome:plugins” into the address bar, and on the Plug-ins page look for the “Flash” listing: To disable Flash, click the disable link (to re-enable it, click “enable”). Windows users can remove Flash from the Add/Remove Programs panel, or use Adobe’s uninstaller for Flash Player.

If you’re concerned about removing Flash altogether, consider a dual-browser approach. That is, unplugging Flash from the browser you use for everyday surfing, and leaving it plugged in to a second browser that you only use for sites that require Flash. Another alternative to removing Flash is Click-To-Play, which lets you control what Flash (and Java) content gets to load when you visit a Web page.

If you decide to proceed with Flash and update, the most recent versions of Flash should be available from the Flash home page. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/adobe-microsoft-each-plug-70-security-holes/feed/</wfw:commentRss>
		<slash:comments>40</slash:comments>
		</item>
		<item>
		<title>When Undercover Credit Card Buys Go Bad</title>
		<link>http://krebsonsecurity.com/2015/12/when-undercover-credit-card-buys-go-bad/</link>
		<comments>http://krebsonsecurity.com/2015/12/when-undercover-credit-card-buys-go-bad/#comments</comments>
		<pubDate>Mon, 07 Dec 2015 10:50:58 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[A Little Sunshine]]></category>
		<category><![CDATA[Spam Nation]]></category>
		<category><![CDATA[Web Fraud 2.0]]></category>
		<category><![CDATA[Home Depot breach]]></category>
		<category><![CDATA[no pigs allowed]]></category>
		<category><![CDATA[pig detected]]></category>
		<category><![CDATA[rescator]]></category>
		<category><![CDATA[Sally Beauty breach]]></category>
		<category><![CDATA[target breach]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=33186</guid>
		<description><![CDATA[I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar's own security system triggered a "pig alert" and brazenly flagged the fed's transactions as an undercover purchase placed by a law enforcement officer.]]></description>
				<content:encoded><![CDATA[
I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar’s own security system triggered a “pig alert” and brazenly flagged the fed’s transactions as an undercover purchase placed by a law enforcement officer.

Law enforcement officials and bank anti-fraud specialists sometimes purchase stolen cards from crime forums and “carding” markets online in hopes of identifying a pattern among all the cards from a given batch that might make it easy to learn who got breached: If all of the cards from a given batch were later found to be used at the same e-commerce or brick-and-mortar merchant over the same time period, investigators can often determine the source of the card breach, alert the breached company and stem the flow of stolen cards.

Of course, such activity is not something the carding shops take lightly, since it tends to cut into their criminal sales and revenues. So it is that one of the more popular carding shops — Rescator — somehow enacted a system to detect purchases from suspected law enforcement officials. Rescator and his crew aren’t shy about letting you know when they think you’re not a real criminal. My law enforcement source said he’d just placed a batch of cards into his shopping cart and was preparing to pay for the goods when the carding site’s checkout page was replaced with this image:

<img class="size-medium wp-image-33189" src="http://krebsonsecurity.com/wp-content/uploads/2015/12/pigdetectionoccurednopigsallowedonpremises-580x562.png" alt="A major vendor of stolen credit cards tries to detect suspicious transactions by law enforcement officials. When it does, it triggers this "pig detected" alert." width="580" height="562" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/pigdetectionoccurednopigsallowedonpremises-580x562.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/pigdetectionoccurednopigsallowedonpremises.png 583w" sizes="(max-width: 580px) 100vw, 580px" />
A major vendor of stolen credit cards tries to detect suspicious transactions by law enforcement officials. When it does, it triggers this “pig detected” alert.

The shop from which my source attempted to make the purchase — called Rescator — is the same carding store that was the first to move millions of cards on sale that were stolen in the Target and Home Depot breaches, among others. I’ve estimated that although Rescator and his band of thieves stole 40 million credit and debit card numbers from Target, they only likely managed to sell between 1 and 3 million of those cards. Even so, at a median price of $26.85 per card and the median loss of 2 million cards, that’s still more than $50 million in revenue. It’s no wonder they want to keep the authorities out.

The analysis method used by my source — the buying of stolen cards to determine a breach source (also called “common point-of-purchase or “CPP” analysis) — was critical to banks helping this reporter identify some of the biggest retail breaches on record in recent years (including Target and Home Depot).

But the CPP approach usually falls flat if all of the cards purchased from the fraud shop fail to reveal a common merchant. More seasoned fraud shops have sought to achieve this confusion and confound investigators by “making sausage” — i.e., methodically mixing cards stolen from multiple victims into any single new batch of stolen cards that they offer for sale. Rescator’s site earned its infamy in part by flouting this best practice with cards stolen in separate breaches at Target, Home Depot, Sally Beauty, P.F. Chang’s and Harbor Freight. But according to banking industry sources, more recently it seems Rescator and other card shops have been flooded with cards from hacked point-of-sale machines at small restaurants across North America.

I told my law enforcement source that it’s not unheard of for cyber thieves who run online stores to employ blacklists of Internet address ranges known to be frequented or assigned to government and law enforcement agencies worldwide. The cybercrime kingpins I wrote about in my book Spam Nation used blacklists to block purchases of rogue pharmaceuticals by fraud investigators (a Spam Nation excerpt showing two key cybercrooks arguing about how best to flag suspicious purchases is in the second half of this story).

Then again, perhaps Rescator’s site simply noticed something amiss when my source funded his account with Bitcoin. The criminals running the fraud shop seized his carding store account and bitcoin balance after the pig alert flashed on my source’s screen — effectively stealing hundreds of taxpayer dollars directly from the authorities.

Unsurprisingly, my source was unwilling to divulge anything about his undercover operations, including any foibles he might have made that led to his outing. He just wanted advice about how to avoid the pig alert in future undercover buys. But I found his case fascinating and yet another example of the growing sophistication of large-scale cybercrime operations.

If the idea of fraudsters using intelligence to outwit investigators sounds fascinating, check out this Nov. 2015 story at PaymentsSource.com, which references the above-pictured pig alert and some other ways many of the more savvy black-market card shops are getting less welcoming to outsiders.

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/when-undercover-credit-card-buys-go-bad/feed/</wfw:commentRss>
		<slash:comments>54</slash:comments>
		</item>
		<item>
		<title>OPM Breach: Credit Monitoring vs. Freeze</title>
		<link>http://krebsonsecurity.com/2015/12/opm-breach-credit-monitoring-vs-freeze/</link>
		<comments>http://krebsonsecurity.com/2015/12/opm-breach-credit-monitoring-vs-freeze/#comments</comments>
		<pubDate>Wed, 02 Dec 2015 14:10:26 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[A Little Sunshine]]></category>
		<category><![CDATA[Security Tools]]></category>
		<category><![CDATA[credit freeze]]></category>
		<category><![CDATA[Equifax]]></category>
		<category><![CDATA[Experian]]></category>
		<category><![CDATA[ID Experts]]></category>
		<category><![CDATA[Innovis]]></category>
		<category><![CDATA[OPM Breach]]></category>
		<category><![CDATA[security freeze]]></category>
		<category><![CDATA[Trans Union]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=33095</guid>
		<description><![CDATA[Many readers wrote in this past week to say they'd finally been officially notified that their fingerprints, background checks, Social Security numbers, and other sensitive information was jeopardized in the massive data breach discovered this year at the Office of Personnel Management (OPM). Almost as many complained that the OPM's response -- the offering of free credit monitoring services for up to three years -- won't work if readers have taken my advice and enacted a "security freeze" on one's credit file with the major credit bureaus. This post is an attempt to explain what's going on here.]]></description>
				<content:encoded><![CDATA[
Many readers wrote in this past week to say they’d finally been officially notified that their fingerprints, background checks, Social Security numbers, and other sensitive information was jeopardized in the massive data breach discovered this year at the Office of Personnel Management (OPM). Almost as many complained that the OPM’s response — the offering of free credit monitoring services for up to three years — won’t work if readers have taken my advice and enacted a “security freeze” on one’s credit file with the major credit bureaus. This post is an attempt to explain what’s going on here.

OPM offices in Washington, DC. Image: Flickr.

Earlier this week I got the following message from a reader:

“I just received official notification that I am affected by the OPM data breach. I attempted to sign up for credit monitoring services with the OPM’s contractor ID Experts at opm.myidcare.com, but was denied these services because I have a credit security freeze. I was told by ID Experts that the OPM’s credit monitoring services will not work for accounts with a security freeze.”

The reader continued:

“This supports my decision to issue a security freeze for all my credit accounts, and in my assessment completely undermines the utility and value of the OPM’s credit monitoring services when individuals can simply issue a security freeze. This inability to monitor a person’s credit file when a freeze is in place speaks volumes about the effectiveness of a freeze in blocking anyone — ID protection firms or ID thieves included — from viewing your file.”

I reached out to my followers on Twitter to gauge their reactions to this. I wrote: “Finish this sentence: Lifting a freeze to enable credit monitoring is like….” Here were some of the notable responses:

@sdweberg 10:22pm …shooting your rottweilers and paying the neighbors a monthly fee to “keep an eye on” your house.

@shane_walton 10:15pm …installing flash to watch a flash video about the evils of flash.

@danblondell 10:13pm …leaving the storm doors open to keep an eye on the tornado

@flakpaket 12:48am …leaving your doors and windows unlocked so that burglars can set off your indoor motion sensors.

@ShermanTheDad 8:25am …taking your gun off safety to check and see if it’s loaded.

Removing a security freeze to enable credit monitoring is foolhardy because the freeze offers more comprehensive protection against ID theft. Credit monitoring services are useful for cleaning up your credit file *after* you’re victimized by ID thieves, but they generally do nothing to stop thieves from applying for and opening new lines of credit in your name.

As I discussed at length in this primer, credit monitoring services aren’t really built to prevent ID theft. The most you can hope for from a credit monitoring service is that they give you a heads up when ID theft does happen, and then help you through the often labyrinthine process of getting the credit bureaus and/or creditors to remove the fraudulent activity and to fix your credit score.

Many of these third party credit monitoring services also induce people to provide even more information than was leaked in the original breach. For example, ID Experts — the company that OPM has paid $133 million to offer credit monitoring for the 21.5 million Americans affected by its breach — offers the ability to “monitor thousands of websites, chat rooms, forums and networks, and alerts you if your personal information is being bought or sold online.” But in order to use this service, users are encouraged to provide bank account and credit card data, passport and medical ID numbers, as well as telephone numbers and driver’s license information.

If you have already been victimized by identity theft (fraud involving existing credit or debit cards is not identity theft), it might be worth signing up for these credit monitoring and repair services. Otherwise, I’d strongly advise my US readers to consider freezing their credit files at the major credit bureaus.

Depending on in which state you reside, there may be a small fee to place and/or thaw a freeze on your credit file, and freezing them at all four major bureaus (Equifax, Experian, Innovis and Trans Union) could cost as much as $60. But this is a small price to pay for peace of mind.

In a report released last month, the consumer US-PIRG urged all consumers to place a security freeze on their credit files. US-PIRG suggests if you already have freezes on your reports, you will need to lift your freezes before signing up for the credit monitoring and reinstate the freezes. If you don’t have freezes on your credit reports yet, sign up for the free credit monitoring first, then place your freezes.

In a perfect world, breached organizations would offer to pay the costs involved in freezing your credit files, but sadly the standard playbook in corporate breach response is to pay for credit monitoring.

PROTECTING DEPENDENTS FROM ID THEFT

One area where credit monitoring makes more sense is with dependents and children under the age of 18. That’s because it’s impossible to freeze a credit file that doesn’t exist, and most minors aren’t going to have one (hopefully).

According to Experian, if your children already have credit reports in their names, one of three things has happened: You have applied for credit in their names and the applications were approved; you have added them as authorized users or joint account holders on one or more of your accounts; someone has fraudulently used their information to apply for credit and they are already identity theft victims.

One way to find out is to visit annualcreditreport.com to apply for a copy of their credit report. The most important precaution parents can take is to keep a close eye on dependent credit files when kids reach their mid-teens. That way, if a credit file materializes for your child because of identity theft, there is still time to sort it out before the kid actually needs a line of credit or loan. However, if your child becomes the victim of ID theft at a very young age, it probably makes more sense to freeze the kid’s credit file.

Most credit monitoring services will allow you to enroll your children as well, but that coverage generally expires after they reach 18. KrebsOnSecurity reader Michael found this out when he tried to sign up his five kids after receiving a notice from the OMB.

“For some reason, coverage for adult children was not provided when I signed up and is discontinued once they reach 18, so at the outset, only 2 of my 5 kids were included even though their data was also compromised,” Michael wrote.

If you’re considering freezing your credit file, have a look at this primer which walks through the various steps needed to place a freeze. It also includes pointers to additional steps that consumers can take to avoid becoming victims of identity theft.

Were you or your family impacted by the OPM breach? How have you responded? Sound off in the comments below.

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/opm-breach-credit-monitoring-vs-freeze/feed/</wfw:commentRss>
		<slash:comments>86</slash:comments>
		</item>
		<item>
		<title>DHS Giving Firms Free Penetration Tests</title>
		<link>http://krebsonsecurity.com/2015/12/dhs-giving-firms-free-penetration-tests/</link>
		<comments>http://krebsonsecurity.com/2015/12/dhs-giving-firms-free-penetration-tests/#comments</comments>
		<pubDate>Tue, 01 Dec 2015 05:05:29 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[A Little Sunshine]]></category>
		<category><![CDATA[Cyber Hygiene]]></category>
		<category><![CDATA[Dave Aitel]]></category>
		<category><![CDATA[DHS]]></category>
		<category><![CDATA[Immunity Inc]]></category>
		<category><![CDATA[National Cybersecurity Assessment and Technical Services]]></category>
		<category><![CDATA[national security agency]]></category>
		<category><![CDATA[NCATS]]></category>
		<category><![CDATA[Risk and Vulnerability Assessment]]></category>
		<category><![CDATA[Sy Lee]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=32876</guid>
		<description><![CDATA[The U.S. Department of Homeland Security (DHS) has been quietly launching stealthy cyber attacks against a range of private U.S. companies -- mostly banks and energy firms. These digital intrusion attempts, commissioned in advance by the private sector targets themselves, are part of a little-known program at DHS designed to help "critical infrastructure" companies shore up their computer and network defenses against real-world adversaries. And it's all free of charge (well, on the U.S. taxpayer's dime).]]></description>
				<content:encoded><![CDATA[
The U.S. Department of Homeland Security (DHS) has been quietly launching stealthy cyber attacks against a range of private U.S. companies — mostly banks and energy firms. These digital intrusion attempts, commissioned in advance by the private sector targets themselves, are part of a little-known program at DHS designed to help “critical infrastructure” companies shore up their computer and network defenses against real-world adversaries. And it’s all free of charge (well, on the U.S. taxpayer’s dime).

<img class="size-medium wp-image-33139" src="http://krebsonsecurity.com/wp-content/uploads/2015/11/cyberhygienemap-580x388.png" alt="Organizations participating in DHS's "Cyber Hygiene" vulnerability scans. Source: DHS" width="580" height="388" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/11/cyberhygienemap-580x388.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/11/cyberhygienemap-940x628.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/11/cyberhygienemap.png 1059w" sizes="(max-width: 580px) 100vw, 580px" />
Organizations participating in DHS’s “Cyber Hygiene” vulnerability scans. Source: DHS

KrebsOnSecurity first learned about DHS’s National Cybersecurity Assessment and Technical Services (NCATS) program after hearing from a risk manager at a small financial institution in the eastern United States. The manager was comparing the free services offered by NCATS with private sector offerings and was seeking my opinion. I asked around to a number of otherwise clueful sources who had no idea this DHS program even existed.

DHS declined requests for an interview about NCATS, but the agency has published some information about the program. According to DHS, the NCATS program offers full-scope penetration testing capabilities in the form of two separate programs: a “Risk and Vulnerability Assessment,” (RVA) and a “Cyber Hygiene” evaluation. Both are designed to help the partner organization better understand how external systems and infrastructure appear to potential attackers.

“The Department of Homeland Security (DHS) works closely with public and private sector partners to strengthen the security and resilience of their systems against evolving threats in cyberspace,” DHS spokesperson Sy Lee wrote in an email response to an interview request. “The National Cybersecurity Assessments and Technical Services (NCATS) team focuses on proactively engaging with federal, state, local, tribal, territorial and private sector stakeholders to assist them in improving their cybersecurity posture, limit exposure to risks and threats, and reduce rates of exploitation. As part of this effort, the NCATS team offers cybersecurity services such as red team and penetration testing and vulnerability scanning at no cost.”

The RVA program reportedly scans the target’s operating systems, databases, and Web applications for known vulnerabilities, and then tests to see if any of the weaknesses found can be used to successfully compromise the target’s systems. In addition, RVA program participants receive scans for rogue wireless devices, and their employees are tested with “social engineering” attempts to see how employees respond to targeted phishing attacks.

The Cyber Hygiene program — which is currently mandatory for agencies in the federal civilian executive branch but optional for private sector and state, local and tribal stakeholders — includes both internal and external vulnerability and Web application scanning.

The reports show detailed information about the organization’s vulnerabilities, including suggested steps to mitigate the flaws.  DHS uses the aggregate information from each client and creates a yearly non-attributable report. The FY14 End of Year report created with data from the Cyber Hygiene and RVA program is here (PDF).

Among the findings in that report, which drew information from more than 100 engagements last year:

-Manual testing was required to identify 67 percent of the RVA vulnerability findings (as opposed to off-the-shelf, automated vulnerability scans);

-More than 50 percent of the total 344 vulnerabilities found during the scans last year earned a severity rating of “high” (4o percent) or “critical” (13 percent).

-RVA phishing emails resulted in a click rate of 25 percent.

Data from NCATS FY 2014 Report.

 ANALYSIS

I was curious to know how many private sector companies had taken DHS up on its rather generous offers, since these services can be quite expensive if conducted by private companies. In response to questions from this author, DHS said that in Fiscal Year 2015 NCATS provided support to 53 private sector partners.  According to data provided by DHS, the majority of the program’s private sector participation come from the energy and financial services industries — with the latter typically at regional or smaller institutions such as credit unions.

DHS has taken its lumps over the years for not doing enough to gets its own cybersecurity house in order, let alone helping industry fix its problems. In light of the agency’s past cybersecurity foibles, the NCATS program on the surface would seem like a concrete step toward blunting those criticisms.

I wondered how someone in the penetration testing industry would feel about the government throwing its free services into the ring. Dave Aitel is chief technology officer at Immunity Inc., a Miami Beach, Fla. based security firm that offers many of the same services NCATS bundles in its product.

Aitel said one of the major benefits for DHS in offering NCATS is that it can use the program to learn about real-world vulnerabilities in critical infrastructure companies.

“DHS is a big player in the ‘regulation’ policy area, and the last thing we need is an uninformed DHS that has little technical expertise in the areas that penetration testing covers,” Aitel said. “The more DHS understands about the realities of information security on the ground – the more it treats American companies as their customers – the better and less impactful their policy recommendations will be. We always say that Offense is the professor of Defense, and in this case, without having gone on the offense DHS would be helpless to suggest remedies to critical infrastructure companies.”

Of course, the downsides are that sometimes you get what you pay for, and the NCATS offering raises some interesting questions, Aitel said.

“Even if the DHS team doing the work is great, part of the value of an expensive penetration test is that companies feel obligated to follow the recommendations and improve their security,” he said. “Does the data found by a DHS testing team affect a company’s SEC liabilities in any way? What if the Government gets access to customer data during a penetration test – what legal ramifications does that have? This is a common event and pre-CISPA it may carry significant liability.”

As far as the potential legal ramifications of any mistakes DHS may or may not make in its assessments, the acceptance letter (PDF) that all NCATS customers must sign says DHS provides no warranties of any kind related to the free services. The rules of engagement letter from DHS further lays out ground rules and specifics of the NCATS testing services.

Aitel, a former research scientist at the National Security Agency (NSA), raised another issue: Any vulnerabilities found anywhere within the government — for example, in a piece of third party software — are supposed to go to the NSA for triage, and sometimes the NSA is later able to use those vulnerabilities in clandestine cyber offensive operations.

But what about previously unknown vulnerabilities found by DHS examiners?

“This may be less of an issue when DHS uses a third party team, but if they use a DHS team, and they find a bug in Microsoft IIS (Web server), that’s not going to the customer – that’s going to the NSA,” Aitel said.

And then there are potential legal issues with the government competing with private industry.

Alan Paller, director of research at the SANS Institute, a Bethesda, Md. based security training group, isn’t so much concerned about the government competing with the private sector for security audits. But he said DHS is giving away something big with its free assessments: An excuse for the leadership at scanned organizations for not doing anything after the assessment and using the results as a way to actually spend less on security.

“The NCATS program could be an excellent service that does a lot of good but it isn’t,” Paller said. “The problem is that it measures only a very limited subset of of the vulnerability space but comes with a gold plated get out of jail free card: ‘The US government came and checked us.’ They say they are doing it only for organizations that cannot afford commercial assessments, but they often go to organizations that have deep enough pockets.”

According to Paller, despite what the NCATS documents say, the testers do not do active penetration tasks against the network. Rather, he said, they are constrained by their rules of engagement.

“Mostly they do architectural assessments and traffic analysis,” he said. “They get a big packet capture and they baseline and profile and do some protocol analysis (wireless).”

Paller said the sort of network architecture review offered by DHS’s scans can only tell you so much, and that the folks doing it do not have deep experience with one of the more arcane aspects of critical infrastructure systems: Industrial control systems of the sort that might be present in an energy firm that turns to NCATS for its cybersecurity assessment.

“In general the architectural reviews are done by younger folks with little real world experience,” Paller said. “The big problem is that the customer is not fully briefed on the limitations of what is being done in their assessment and testing.”

Does your organization have experience with NCATS assessments? Are you part of a critical infrastructure company that might use these services? Would you? Sound off in the comments below.

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/12/dhs-giving-firms-free-penetration-tests/feed/</wfw:commentRss>
		<slash:comments>75</slash:comments>
		</item>
		<item>
		<title>Gas Theft Gangs Fuel Pump Skimming Scams</title>
		<link>http://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/</link>
		<comments>http://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/#comments</comments>
		<pubDate>Mon, 30 Nov 2015 14:29:05 +0000</pubDate>
		<dc:creator><![CDATA[BrianKrebs]]></dc:creator>
				<category><![CDATA[A Little Sunshine]]></category>
		<category><![CDATA[Other]]></category>
		<category><![CDATA[Aaron Turner]]></category>
		<category><![CDATA[bladder trucks]]></category>
		<category><![CDATA[fuel theft]]></category>
		<category><![CDATA[fuel theft gang]]></category>
		<category><![CDATA[gas pump skimmers]]></category>
		<category><![CDATA[pump skimmers]]></category>
		<category><![CDATA[Steve Scarince]]></category>
		<category><![CDATA[US Secret Service]]></category>
		<category><![CDATA[VeriFone]]></category>
		<category><![CDATA[Visa]]></category>

		<guid isPermaLink="false">http://krebsonsecurity.com/?p=32878</guid>
		<description><![CDATA[Few schemes for monetizing stolen credit cards are as bold as the fuel theft scam: Crooks embed skimming devices inside fuel station pumps to steal credit card data from customers. Thieves then clone the cards and use them to steal hundreds of gallons of gas at multiple filling stations. The gas is pumped into hollowed-out trucks and vans, which ferry the fuel to a giant tanker truck. The criminals then sell and deliver the gas at cut rate prices to shady and complicit fuel station owners.]]></description>
				<content:encoded><![CDATA[
Few schemes for monetizing stolen credit cards are as bold as the fuel theft scam: Crooks embed skimming devices inside fuel station pumps to steal credit card data from customers. Thieves then clone the cards and use them to steal hundreds of gallons of gas at multiple filling stations. The gas is pumped into hollowed-out trucks and vans, which ferry the fuel to a giant tanker truck. The criminals then sell and deliver the gas at cut rate prices to shady and complicit fuel station owners.

Agent Steve Scarince of the U.S. Secret Service heads up a task force in Los Angeles that since 2009 has been combating fuel theft and fuel pump skimming rings. Scarince said the crooks who plant the skimmers and steal the cards from fuel stations usually are separate criminal groups from those who use the cards to steal and resell gas.

<img class="size-medium wp-image-33103" src="http://krebsonsecurity.com/wp-content/uploads/2015/11/externalcardskim-580x483.png" alt="External pump skimmers retrieved from LA fuel stations." width="580" height="483" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/11/externalcardskim-580x483.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/11/externalcardskim-940x783.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/11/externalcardskim.png 1126w" sizes="(max-width: 580px) 100vw, 580px" />
An external pump skimmer is attached to the end of this compromised fuel dispenser in Los Angeles (right).

“Generally the way it works is the skimmer will sell the cards to a fuel theft cell or ring,” he said. “The head of the ring or the number two guy will go purchase the credit cards and bring them back to the drivers. More often than not, the drivers don’t know a whole lot about the business. They just show up for work, the boss hands them 25 cards and says, ‘Make the most of it, and bring me back the cards that don’t work.’ And the leader of the ring will go back to the card skimmer and say, ‘Okay out of 100 of those you sold me, 50 of them didn’t work.'”

Scarince said the skimmer gangs will gain access to the inside of the fuel pumps either secretly or by bribing station attendants. Once inside the pumps, the thieves hook up their skimmer to the gas pump’s card reader and PIN pad. The devices also are connected to the pump’s electric power — so they don’t need batteries and can operate indefinitely.

<img class="size-medium wp-image-33104" src="http://krebsonsecurity.com/wp-content/uploads/2015/11/internalskim1-580x308.png" alt="Internal pump skimming device seized from a Los Angeles fuel station." width="580" height="308" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/11/internalskim1-580x308.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/11/internalskim1-940x499.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/11/internalskim1.png 1212w" sizes="(max-width: 580px) 100vw, 580px" />
Internal pump skimming device seized from a Los Angeles fuel station.

Most internal, modern pump skimmers are built to record the card data on a storage device that can transmit the data wirelessly via Bluetooth technology. This way, thieves can drive up with a laptop and fill their tank in the time it takes to suck down the card data that’s been freshly stolen since their last visit.

The Secret Service task force in Los Angels has even found pump skimming devices that send the stolen card data via SMS/text message to the thieves, meaning the crooks don’t ever have to return to the scene of the crime and can receive the stolen cards and PINs anywhere in the world that has mobile phone service.

MOBILE BOMBS

Scarince said the fuel theft gangs use vans and trucks crudely modified and retrofitted with huge metal and/or plastic “bladders” capable of holding between 250 and 500 gallons of fuel.

“The fuel theft groups will drive a bladder truck from gas station to gas station, using counterfeit cards to fill up the bladder,” he said. “Then they’ll drive back to their compound and pump the fuel into a 4,000 or 5,000 [gallon] container truck.”

<img class="size-medium wp-image-33105" src="http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck1-580x323.png" alt="A bladder made to look like it's hauling used tires." width="580" height="323" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck1-580x323.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck1-940x523.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck1.png 1370w" sizes="(max-width: 580px) 100vw, 580px" />
A bladder truck made to look like it’s hauling used tires. The wooden panel that was hiding the metal tank exposed here has ben removed in this picture.

The fuel will be delivered to gas station owners with whom the fuel theft ring has previously brokered with on the price per gallon. And it’s always a cash transaction.

“The stations know they’re buying stolen gas,” Scarince said. “They’re fully aware the fuel is not coming from a legitimate source. There’s never any paperwork with the fuel driver, and these transactions are missing all the elements of a normal, legitimate transaction between what would be a refinery and a gas station.”

<img class="size-medium wp-image-33106" src="http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck2-580x316.png" alt="Fuel theft gangs converted this van into a bladder truck. Image: Secret Service." width="580" height="316" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck2-580x316.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck2-940x511.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck2.png 1518w" sizes="(max-width: 580px) 100vw, 580px" />
Fuel theft gangs converted this van into a bladder truck. Image: Secret Service.

Needless to say, the bladder trucks aren’t exactly road-worthy when they’re filled to the brim with stolen and highly flammable fuel. From time to time, one of the dimmer bladder truck drivers will temporarily forget his cargo and light up a smoke.

“Two or three summers ago we had this one guy who I guess was just jonesing for a cigarette,” Scarince said. “He lit up and that was the last thing he did.”

<img class="size-medium wp-image-33107" src="http://krebsonsecurity.com/wp-content/uploads/2015/11/crispycritters-580x216.png" alt="This bladder truck went up in smoke (literally)." width="580" height="216" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/11/crispycritters-580x216.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/11/crispycritters-940x350.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/11/crispycritters.png 1542w" sizes="(max-width: 580px) 100vw, 580px" />
This bladder truck went up in (a) smoke.

Other bladder trucks have spontaneously burst into flames at filling stations while thieves pumped stolen gas.

“There have been other fires that took place during the transfer of fuel, where some static sparked and the whole place caught on fire,” Scarince said. “These vehicles are not road-worthy by any means. Some of the bladder tanks are poorly made, they leak. The trucks are often overweight and can’t handle the load. We see things like transmissions giving out, chassis going out. These things are real hazards just waiting to happen.”

How big are the fuel theft operations in and around Los Angeles? Scarince estimates that at any given time there are 20 to 30 of these deadly bladder trucks trundling down L.A. freeways and side streets.

“And that’s a very conservative guess, just based on what the credit card companies report,” he said.

Aaron Turner, vice president of identity service products at Verifone — a major manufacturer of credit card terminals — leads a team that has been studying many of the skimming devices that the Secret Service has retrieved from compromised filling stations. Turner says there is a huge potential for safety-related issues when it comes to skimmers in a gas-pump environment.

“Every piece of equipment that is installed by gas station owners in the pump area is approved by reviewed and approved according to industry standards, but these skimmers…not so much,” Turner said. “One of the skimmers that we retrieved was sparking and arcing when we powered it up in our lab. I think it’s safe to say that skimmer manufacturers are not getting UL certifications for their gear.”

COUNTERING FUEL FRAUD

With some fuel theft gangs stealing more than $10 million per year, Scarince said financial institutions and credit card issuers have responded with a range of tactics to detect and stop suspicious fuel station transactions.

“A lot more card issuers and merchant processors are really pushing hard on velocity checks,” Scarince said, referring to a fraud detection technique that reviews transactions for repeating patterns within a brief period. “If you buy gas in Washington, D.C. and then 30 minutes gas later gas is being purchased on opposite side of the city in a short period of time. Those are things that are going to start triggering questions about the card. So, more checks like that are being tested and deployed, and banks are getting better at detecting this activity.”

Card issuers also can impose their own artificial spending limits on fuel purchases. Visa, for example, caps fuel purchases at $125.  But thieves often learn to work just under those limits.

“The more intelligent crooks will use only a few cards per station, which keeps them a lower profile,” Scarince said. “They’ll come in a swipe two to three cards and fill up 40-80 gallons and move on down the road to another station. They definitely also have what we determine to be routes. Monday they’ll drive one direction, and Tuesday they’ll go the other way, just to make sure they don’t hit the same stations one day after another.”

Newer credit and debit cards with embedded chip technology should make the cards more costly and difficult to counterfeit. However, the chip cards still have the card data encoded in plain text on the card’s magnetic strip, and most fuel stations won’t have chip-enabled readers for several years to come.

On Oct. 1, 2015, Visa and MasterCard put in force new rules that can penalize merchants who do not yet have chip-enabled terminals. Under the new rules, merchants that don’t have the technology to accept chip cards will assume full liability for the cost of fraud from purchases in which the customer presented a chip-enabled card.

But those rules don’t apply to fuel stations in the United States until October 2017, and a great many stations won’t meet that deadline, said Verifone’s Turner.

“The petroleum stations and the trade organizations that represent them have been fairly public in their statements that they don’t feel they’re going to hit the 2017 dates,” Turner said. “If you look at the cost of replacing these dispensers and the number of systems that have been touched by qualified, licensed technicians…most of the stations are saying that even if they start this process now they’re going to struggle to meet that October 2017 date.”

Turner said that as chip card readers take hold in more retail establishments, card thieves will begin targeting fuel stations more intensively and systematically.

“We’re moving into this really interesting point of time when I think the criminals are going to focus on the approaches that offer them the greatest return on their investment,” Turner said. “In the future, I think there will be a liability shift specifically for petroleum stations [because] the amount of mag-stripe-facilitated fraud that will happen in that market is going to increase significantly along with chip card deployment.”

Part of the reason Los Angeles is such a hotbed of skimming activity may be related to ethnic Armenian organized crime members that have invested heavily in fuel theft schemes. Last month, the Justice Department announced charges against eight such men accused of planting skimmers in pumps throughout Southern California and Nevada.

Scarince and Turner say there is a great deal of room for the geographic spread of fuel theft scams. Although the bulk of fuel theft activity in the United States is centered around Los Angeles, the organized nature of the crime is slowly spreading to other cities.

“We are seeing pump skimming now shoot across the country,” Scarince said. “Los Angeles is still definitely ground zero, but Florida is now getting hit hard, as are Houston and parts of the midwest. Technology we first saw a couple of years ago in LA we’re now seeing show up in other locations across the country. They’re starting to pick on markets that are probably less aware of what’s going on as far as skimming goes and don’t secure their pumps as well as most stations do here.”

WHAT CAN  YOU DO?

Avoid sketchy-looking stations and those that haven’t started using tamper-evident seals on their pumps.

“The fuel theft gangs certainly scout out the stations beforehand, looking for stations that haven’t upgraded their pump locks and haven’t started using tamper seals,” Scarince said. “If some franchised station decided not to spend the money to upgrade their systems with these security precautions, they’re going to be targeted.”

Scarince says he also tends to use pumps that are closest to the attendants.

“Those are less likely to have skimmers in or on them than street-side pumps,” he said.

Consumers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the phony transactions. There is no substitute for keeping a close eye on your card statements. Also, use credit cards instead of debit cards at the pump; having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/feed/</wfw:commentRss>
		<slash:comments>63</slash:comments>
		</item>
	</channel>
</rss>

This is on OSX BTW. Could that make a difference? Here is my otool output:
/usr/local/Cellar/emacs/24.5/Emacs.app/Contents/MacOS/Emacs:
	/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 1347.57.0)
	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
	/usr/lib/libxml2.2.dylib (compatibility version 10.0.0, current version 10.9.0)
	/usr/lib/libncurses.5.4.dylib (compatibility version 5.4.0, current version 5.4.0)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1213.0.0)
	/usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.5)
	/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices (compatibility version 1.0.0, current version 48.0.0)
	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 1153.18.0)
	/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics (compatibility version 64.0.0, current version 600.0.0)
	/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText (compatibility version 1.0.0, current version 1.0.0)
	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (compatibility version 300.0.0, current version 1153.20.0)
	/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)

And here's the output of the elfeed-xml-parse-region:
``
((rss ((version . "2.0") (xmlns:content . "http://purl.org/rss/1.0/modules/content/") (xmlns:wfw . "http://wellformedweb.org/CommentAPI/") (xmlns:dc . "http://purl.org/dc/elements/1.1/") (xmlns:atom . "http://www.w3.org/2005/Atom") (xmlns:sy . "http://purl.org/rss/1.0/modules/syndication/") (xmlns:slash . "http://purl.org/rss/1.0/modules/slash/")) "
" (channel nil "
" (title nil "Krebs on Security") "
" (atom:link ...) "
" (link nil "http://krebsonsecurity.com") "
" (description nil "In-depth security news and investigation") "
" (lastBuildDate nil "Thu, 17 Dec 2015 20:11:37 +0000") ...) "
"))

Hmm. That seems truncated. I ran it with C-u M-:

Got the complete output: https://gist.github.com/carlf/517a5a7fef9687492f75
It seems to be parsing the text fine. I'm mystified as to why it is showing up that way in the log.

Closing since this is old and I wasn't ever able to observe the problem in order to come up with a fix.