By Brian Krebs
Clothing store chain Eddie Bauer said today it has
detected and removed malicious software from point-of-sale systems at
all of its 350+ stores in North America, and that credit and debit cards
used at those stores during the first six months of 2016 may have been
compromised in the breach. The acknowledgement comes nearly six weeks
after KrebsOnSecurity first notified the clothier about a possible
intrusion at stores nationwide.
On
July 5, 2016, KrebsOnSecurity reached out to Bellevue, Wash., based
Eddie Bauer after hearing from several sources who work in fighting
fraud at U.S. financial institutions. All of those sources said they’d
identified a pattern of fraud on customer cards that had just one thing
in common: They were all recently used at some of Eddie Bauer’s 350+ locations in the U.S. The sources said the fraud appeared to stretch back to at least January 2016.
A spokesperson for Eddie Bauer at the time said the company was
grateful for the outreach but that it hadn’t heard any fraud complaints
from banks or from the credit card associations.
Earlier today, however, an outside public relations firm circled back
on behalf of Eddie Bauer. That person told me Eddie Bauer — working
with the FBI and an outside computer forensics firm — had detected and
removed card-stealing malware from cash registers at all of its
locations in the United States and Canada.
The retailer says it believes the malware was capable of capturing
credit and debit card numbers from customer transactions made at all 350
Eddie Bauer stores in the United States and Canada between January 2,
2016 to July 17, 2016. The company emphasized that this breach did not impact purchases made at the company’s online store eddiebauer.com.
“While not all transactions during this period were affected, out of
an abundance of caution, Eddie Bauer is offering identity protection
services to all customers who made purchases or returns during this
period,” the company said in a press release issued directly after the markets closed in the U.S. today.
Given the volume of point-0f-sale malware attacks on retailers and
hospitality firms in recent months, it would be nice if each one of
these breach disclosures didn’t look and sound exactly the same. For
example, in addition to offering customers the predictable and
irrelevant credit monitoring services topped with bland assurances that
the “security of our customers’ information is a top priority,” breached
entities could offer the cyber defenders of the world just a few
details about the attack tools and online staging grounds the intruders
used.
That way, other companies could use the information to find out if
they are similarly victimized and to stop the bleeding of customer card
data as quickly as possible. Eddie Bauer’s spokespeople say the company
has no intention of publishing these so-called “indicators of
compromise,” but emphasized that Eddie Bauer worked closely with the FBI
and outside security experts.
For more on the importance of IOCs in helping to detect and ultimately stymie cybercrime, check out last Saturday’s story about IOCs released by Visa in connection with the recent intrusion at Oracle’s MICROS point-of-sale unit. And
for the record, I have no information connecting this breach or any
other recent POS malware attack with the breach at Oracle’s MICROS unit.
If that changes, hopefully you’ll read about it here first.
Felten has moved on to the White House, where he's deputy CTO, while his grad students have fanned out across the country to take positions at some of America's top universities, where they and their students continue to mercilessly attack the unsound computers that America has put its democracy inside of.
Ben Wofford's comprehensive account of the war on shitty voting machines in Politico is by turns frightening and enraging, and even though the touchscreen voting era appears to finally be drawing to its inevitable close, the remaining machines in the field are, if anything, even more vulnerable to remote attacks, and, worryingly, many are clustered in hotly disputed districts in key battleground states for the 2016 presidential race.
It's not for lack of trying to raise alarms. Felten's team and proteges have gone to far as to meet mysterious whistleblowers in dark New York alleys to take receipt of smuggled-out voting machines to run tests on, and then produced some of the most mediagenic, easy-to-understand videos and articles detailing their findings that you could ask for.
Combine this indifference with North Korea's attack on Sony, China's attack on the Office of Personnel Management, and Russia's (presumptive) attack on the DNC, and you've got a situation where it's all-too-plausible that the coming election will be hacked, and where it's certain that any irregularities will be blamed on hackers, domestic and foreign.
After all, Virgina took 13 years to ditch its wifi-connected Winvote machines, whose crypto key is now known to be "abcde," and which runs a version of Windows that hasn't been updated since 2005.
Jeremy Epstein, the whistleblower who fought for the machines' removal for all that time, says of the elections that were balloted on Winvote systems, "If these machines and elections weren’t hacked, it was only because no one tried."
To make things worse, many of the same vendors who denied, threatened, and obfuscated when caught selling defective voting machines are now trying to sell online voting systems that will have every problem of the worst voting machines, times a thousand.
The Princeton group has no shortage of things that keep them up at night. Among possible targets, foreign hackers could attack the state and county computers that aggregate the precinct totals on election night—machines that are technically supposed to remain non-networked, but that Appel thinks are likely connected to the Internet, even accidentally, from time to time. They could attack digitized voter registration databases—an increasingly utilized tool, especially in Ohio, where their problems are mounting—erasing voters’ names from the polls (a measure that would either cause voters to walk away, or overload the provisional ballot system). They could infect software at the point of development, writing malicious ballot definition files that companies distribute, or do the same on a software patch. They could FedEx false software to a county clerk’s office and, with the right letterhead and convincing cover letter, get it installed. If a county clerk has the wrong laptop connected to the Internet at the wrong time, that could be a wide enough entry window for an attack.
“No county clerk anywhere in the United States has the ability to defend themselves against advanced persistent threats,” Wallach tells me, using the parlance of industry for highly motivated hackers who “lay low and stick around for a while.” Wallach painted an unseemly picture, in which a seasoned cyber warrior overseas squared off against a septuagenarian volunteer. “In the same way,” continues Wallach, “you would not expect your local police department to be able to repel a foreign military power.”
In the academic research, hacks of the machines are far more pervasive; digitized voting registrations or tabulation software are not 10 years old and running on Windows 2000, unlike the machines. Still, they present risks of their own. “There are still plenty of computers involved” even without digital touch screens, says Appel. “Even with optical scan voting, it’s not just the voting machines themselves—it’s the desktop and laptop computers that election officials use to prepare the ballots, prepare the electronic files from the OpScan machines, panel voter registration, electronic poll books. And the computers that aggregate the results together from all of the optical scans.”
“If any of those get hacked, it could could significantly disrupt the election.”
The digital touch screens, even with voter verified paper trail, will still be pervasive this election; 28 states keep them in use to some degree, including Ohio and Florida, though increasingly in limited settings. Pam Smith, the director of Verified Voting—a group that tracks the use of voting equipment by precinct in granular detail—isn’t sure how many digital touch screens are left; no one I spoke with seemed to know. Nor is it clear where they’ll be deployed, a decision left up to county administrators. Smith confirms that after 2007, the number of states that adopted the machines plateaued, and has finally begun to shrink. The number of states using paperless touch screens—and nothing else—is five: South Carolina, Georgia, Louisiana, New Jersey and Delaware. But the number of states with a significant number of counties with the easily hacked machines is much larger, at 13, including Indiana, Virginia, and Pennsylvania. For hacking purposes, there’s little difference: In a close election, only a few precincts with paperless touch screens would be required to deflate vote totals, says Appel, even if the majority of counties are still in the Stone Age. Many of Felten’s mad-scientist experiments were designed to metastasize the nefarious code once it gained entry into a machine system.How to Hack an Election in 7 Minutes [Ben Wofford/Politico]
(via Memex 1.1)