August 18, 2009Simple: Theft Of 130 Million Credit Card Numbers Didn't Take MuchHow did Albert Gonzalez and his alleged co-conspirators access all that credit and debit card data with so much ease?
Gonzalez and the two other men indicted Monday for their role in the thefts of more than 130 million credit and debit card numbers allegedly spun a web of cybercrime and deceit that affected, among other corporate entities, Heartland Payment Systems, Hannaford Bros. and 7-Eleven. And as further details emerge in what U.S. authorities are calling the largest known incident of hacking and identity theft in U.S. history, those details suggest that the simplicity of their means might be even more alarming than the scope of their crimes.

The alleged ringleader, 28-year-old Miami resident Gonzalez, and two unidentified Russian accomplices, are being indicted for five incidents of corporate data breach, including Heartland, Hannaford, 7-Eleven and two unnamed companies.

Gonzalez is already awaiting trial for the now-infamous data breach of TJX, whose indictment attributes another 40 million stolen card numbers to Gonzalez's efforts. That indictment, dated Aug. 5, 2008, alleges that Gonzalez and 10 other perpetrators -- three of them U.S. citizens, one from Estonia, two from Ukraine, two from China and one from Belarus -- broke into the networks of TJX Companies and other retailers like BJ's Wholesale Club, OfficeMax, Sports Authority and DSW.

The new indictment, filed in United States District Court in New Jersey, is more descriptive of Gonzalez and his cohorts' alleged methods.

According to U.S. investigators, Gonzalez and his ring would scan lists of Fortune 500 companies to assess potential victims, gain information about the types of point-of-sale systems used in those corporate entities' locations, and then launch "hacking platforms," which would precede a SQL-injection attack and the use of malware to extract credit and debit card numbers. The group communicated through instant message and also used sniffers to absorb card data rapidly. The computers they used were based in California, Illinois, New Jersey, Latvia, Ukraine and the Netherlands.

They were also able to stay ahead of corporate cybersecurity, as the indictment description indicates: "They allegedly accessed the corporate websites only through intermediary, or "proxy," computers, thereby disguising their own whereabouts. They also tested their malware by using approximately twenty of the leading anti-virus products to determine if any of those products would detect their malware as potentially unwanted. Furthermore, they programmed their malware to actively delete traces of the malware's presence from the corporate victims' networks."

The methods used by Gonzalez and his team weren't all that sophisticated, either; the long and short of it is that they were able to exploit end users that didn't know how poor their security was, according to security experts interviewed by ChannelWeb.com Monday night.

"When companies make the decision to work with law enforcement and disclose a data breach at the earliest possible opportunity, it provides the best chance at apprehending a hacker and demonstrates that those corporate victims will actively defend their systems," said Ralph J. Marra Jr., acting U.S. attorney, in the statement released with the indictment.

Does that make you feel any safer about swiping your credit card next time you're out shopping?

Posted by Chad Berndtson at 7:40 AM

A Judge on Tuesday ordered Microsoft (NSDQ: MSFT) to stop selling its popular Word document creation application in the United States after finding that the software contains technology that violates a patent held by a third party.

Microsoft Office, which includes Word, accounted for more than $3 billion in worldwide sales in Microsoft's most recent fiscal year and is used by literally millions of businesses and consumers for everyday tasks like word processing and making spreadsheets and presentations.

The judge said the ruling, which applies to Word 2003 and Word 2007, takes effect in 60 days.

Investors shrugged off the news—perhaps in anticipation of a higher court overturning the ruling, which arose from the plaintiff-friendly Eastern Texas federal jurisdiction. Microsoft shares were up 1.6% to $23.50 in early trading Wednesday.

Judge Leonard Davis, of U.S. District Court for Eastern Texas, said Microsoft "unlawfully infringed" on a patent that describes how programs go about "manipulating a document's content and architecture separately." The patent, No. 5,787,449, is held by Toronto-based i4i, Inc. i4i develops "collaborative content solutions," according to its Web site.

i4i originally sued Microsoft for patent infringement in 2007. Microsoft officials said the company plans to appeal, adding that the software maker is "disappointed by the court's ruling." The company said it believes i4i's patent is "invalid."

Davis on Tuesday ordered Microsoft to pay $240 million in damages to i4i, plus court costs and interest. More significantly, he enjoined Microsoft from continuing to sell Microsoft Word, in its current form, in the U.S.

Specifically, Davis said Microsoft can't sell versions of Word that can open documents saved in the .XML, .DOCX, or .DOCM formats that contain custom XML. Those formats were at the heart of the patent dispute. .DOCX is the default format for the most current version of Word, which is included in Microsoft Office 2007. Custom XML is used by businesses to link their corporate data to Word documents.

"Microsoft Corporation is hereby permanently enjoined" from selling Word 2003 and Word 2007 in the U.S. Davis, wrote in his order.

Davis also prohibited Microsoft from providing technical support for infringing products sold after the injunction takes effect, or from "testing, demonstrating, or marketing the ability of the infringing and future Word products to open an XML file containing custom XML."

Davis said the injunction does not apply to versions of Word that open an XML file as plain text or which apply a transform that removes all custom XML elements—possibly paving the way for Microsoft to issue a patch that rectifies the problem.

Microsoft retired mainstream support for Windows XP and Office 2003 today - but that doesn’t necessarily mean anyone should be in a hurry to upgrade to Vista yet.

The firm will continue to offer extended support packages on both products through to 8 April 2014, allowing businesses and individuals plenty of time to consider their options before plumping for a new operating system.

From today Redmond will charge XP and Office 2003 customers who need assistance on a per-incident, per hour, or alternative basis. The changes apply to all editions of the Office suite as well as all versions of XP with the exception of Embedded.

Non-security critical fixes will be available to those punters who signed up to Microsoft’s Extended Hotfix Support program 90 days before mainstream support was killed off.

Security updates will be pumped out free of charge for Office 2003 and XP until 4 August 2014.

Microsoft released Service Pack 3 for XP in April last year, while the third service pack for Office 2003 landed in September 2007.

Any customers that bought a computer with the eight-year old XP pre-loaded onto the system will need to contact their OEM for support.

Microsoft also sounded the death knell for Windows Server 2003 Service Pack 1 support today. In effect, the company wants users to upgrade to SP2 of the product.

Meanwhile, Microsoft wonks are hard at work with the vendor's forthcoming wake-up-Dorothy-Vista-was-just-a-bad-dream OS, Windows 7, which many speculate will rock up later this year. ®

By Kelly Fiveash

The malicious worm affecting Twitter over the weekend has now mutated and continues to invade the popular microblogging network. Although Twitter is taking action against the problem, security analysts fear that further mutations of the worm will continue to wreak havoc on the network over the week.

The worm, appearing as "" or "StalkDaily", was created by the 17-year-old Mike Mooney "out of boredom" and is now generating thousands of spam messages containing the word "Mikeyy." This is the fourth attack by the worm in the last four days, which sends Twitter messages from infected accounts, without the owners' knowledge.

How to keep safe from Mikeyy

First of all, experts advise Twitter users not to click on any links from messages containing the words "Mikeyy" or "Stalkdaily." It is recommended you use third-party Twitter desktop clients like Twhirl or TweetDeck (both PC and Mac) and that you do not use the Web-based version of Twitter, especially for viewing user profiles (as this is where the attack seems to originate).

As an additional security measure, you can disable JavaScript in your browser. Firefox users can use the no-script add-on, which stops any unwanted scripts from running.

How to remove Mikeyy

If you've noticed any suspicious activity from your profile that includes the words above, then most certainly you're infected. It is very important for users not to retweet (RT) any of the fake messages.

Clear your browser cache and turn off JavaScript. Log into Twitter and delete any messages your profile automatically posted that contain the word "Mikeyy". You can turn JavaScript back on so you change your bio and URL, and reset your color scheme from your profile. Additionally, changing your password could be a safe measure.

After all the steps above were completed, log out of your account and you can continue using Twitter via a desktop client.

Using the 'mount' Command

The simplest way to get something mounted is at the command line. You use the command mount <device name> <mount point>. For example, to mount my CDROM drive from the command line

# mount /dev/hdc /mnt/cdrom

This tells Linux to take the file system found on device /dev/hdc and cause it to appear as part of the Linux file system in the directory /mnt/cdrom. We could have specified the type of file system to be found on /dev/hdc, but since we did not, Linux will try to automatically detect it. /dev/hdc is known as the device-name

There are a few items of note here...

First, I performed this operation as root (The # indicates that it the root and not a normal user). When mounting drives this way, you will usually need to be Superuser. There are ways to allow normal users to mount drives, but this will be covered later.

Second, the mount point /mnt/cdrom is a directory that already exists on my hard drive. If the mount point does not exist, you will get an error. Most distributions include a directory called /mnt that is intended for this purpose.

Third, you should make special directories just for mounting devices, and leave them empty. Technically you can mount your cdrom anywhere in the directory tree, even a directory that is not empty. However, any files in that directory will become invisible in the virtual file system. They will still exist on disk, but you will be unable to access them until the file system that obscures them is unmounted. There are rare cases where this might be desirable, but in general it can create unexpected behavior and is not advisable. For example, If you mount your CDROM at /usr, you would not be able to access to most of your installed programs in that directory as long as the mounted filesystem remains mounted.


Using the 'umount' command
Once you have finished your work with the mounted filesystem, you need to unmount this filesystem. This would typically be the case when you finish using one CDROM and would like to use another CDROM, you need to unmount the first one before removing the CDROM from the drive. To unmount a filesystem (such as the one we mounted above) type the following

# umount /mnt/cdrom

Remember to type 'umount' and not 'unmount'. There is no "n"!

This would unmount the filesystem. In case you view the contents of the /mnt/cdrom directory, you would see that it is empty.



Where does <device-name> come from?

The most common type of hard drives and CDROMs in personal computers are IDE drives. These drives require a controller, and there can only be two drives per controller, a Master and a Slave. Most PCs made in recent years have two IDE controllers built in, a Primary and a Secondary, which allows you to install up to four IDE devices. Each IDE device under Linux has a fixed device name.

Linux device IDE Controller Drive Designation
/dev/hda Primary Master
/dev/hdb Primary Slave
/dev/hdc Secondary Master
/dev/hdd Secondary Slave


CDROM drives typically ship from the factory as the Secondary Master device, /dev/hdc . Occasionally you will find one slaved to the hard drive as /dev/hdb .

The mount command will accept many options, but the defaults will do for quick mounts. For details, read the man page. For devices that you mount frequently like CDROM drives and floppy drives, you can store default mount settings in a special file, /etc/fstab (File System TABle).



The File System Configuration File - /etc/fstab

This is a plain text file that stores default mount settings for various file systems. When Linux is booting up, it uses the settings in this file to determine what file systems should be mounted automatically. It is laid out in columns, like a table as the name suggests. Although there are various tools that can be used to edit this file (see linuxconf below), it can also be edited with any text editor. Let's take a look at mine

Device Mount Point FS Type Mount Options Dump Check
/dev/hda2 / ext2 defaults 1 1
/dev/hda6 /home ext2 defaults 1 2
/dev/hda5 swap swap defaults 0 0
/dev/fd0 /mnt/floppy ext2 noauto 0 0
/dev/fd0 /mnt/a vfat noauto 0 0
/dev/cdrom /mnt/cdrom iso9660 noauto,ro 0 0
/dev/hda7 /share vfat user,rw,exec,uid=500 0 0
/dev/hda1 /win vfat noauto,user,ro 0 0
none /proc proc defaults 0 0

I have added a comment line at the top to serve as column headers. Let's examine them one at a time.

The first column lists the device where the file system may be found. As you can see, there are entries for more than just a CDROM and floppy drive. Since this is a dual boot system running both Linux and Windows 95, I have a lot of hard drive partitions that need to be mounted as well. Notice that the last entry has a device of "none". That's because the /proc file system is not really a device, but a window into the Linux kernel itself. The files found there don't exist on disk, but are generated by Linux to provide information about itself. Also notice that I have two separate entries for /dev/fd0 (the floppy drive), using different information in the other columns. More on this later.

The second column lists the place in the directory tree where its contents will appear. Remember that this directory must already exist on your drive or you will receive an error and the mount will fail. The sole exception to this is the partition set aside as "swap" space. This is hard drive space that Linux uses as virtual memory when there is not enough physical memory to handle all the running programs. It is not actually mounted anywhere in the Virtual File System (VFS), but is listed here for informational purposes. Don't mess with it.

The third column lists the type of file system that lives on the device. The "ext2" file system is the native file system for Linux. My root (/) and /home partitions are of this type. I also have several "vfat" (Windows 95) file systems. I use these to share files between my Windows and Linux installations. The file system type for any and all CDROMs is "iso9660". The "swap" and "proc" file system types are special cases, as described above. The only other file systems you might run into are "msdos" (obvious) and "minix", which is sometimes used for boot floppies because it is more efficient on small file systems than ext2.

The fourth column is a comma separated list (no spaces!) of any options you wish to enable when the file system is mounted. For a complete list of options, check the man page for mount. The most common options are shown here. "Defaults" is usually fine for file systems that are mounted at boot time. However, for removable media, you should use the "noauto" option to prevent Linux trying to mount this at boot time. You may also want normal users to be able to mount and unmount the media (rather than just root), so include the option "user". By default, user mountable file systems are mounted with the implicit options "ro,noexec", which means it is read only and no programs can be run from that file system. You should include "rw,exec" if you want users to have full access. The "uid=" option is only used for vfat or msdos file systems. Since ownership information is not stored on these file systems, this option tells Linux who the owner will be. Without this option, the file system is owned by whoever mounted it, or root if it was mounted automatically. The /share file system shown here will always be owned by user 500, me.

The fifth column is used by the dump command to determine what needs to be backed up. One means back it up, zero means don't.

The last column is used by fsck to determine what file systems to check for errors and in what order when Linux boots. A value of zero means the file system will not be checked automatically (floppies and CDROMs should not be checked). The root file system should be given a value of 1, and others should get 2.

Notice how I have two separate entries for /dev/fd0, the floppy drive. This is because there are two types of floppies I may want to use, those formatted under Linux and those formatted under Windows. Formatted "vfat" diskettes, get mounted on /mnt/a while ext2 diskettes get mounted on /mnt/floppy. It is not strictly necessary to have these entries, but I have done it for convenience. You see, if you use the mount command but give it only one parameter (e.g. mount /mnt/a ), mount searches the /etc/fstab for an entry that matches the parameter, either in the device column or the mount point column. If it finds one, it uses the settings listed. If there are multiple listings that match, it uses the first one from the top. So if I type ' mount /dev/fd0 ', Linux will try to mount an ext2 file system. If the floppy was formatted for Windows, it will fail with an error because it is the wrong file system type.


Using linuxconf to modify fstab

linuxconf is your best tool for system configuration. Any time you have to pull some kind of administrative duty, you can pretty much trust that linuxconf can do it for you. First off, you must be Superuser to do this. Type the following at the prompt or alternatively you could click on linuxconf link present in the KMenu

# linuxconf

Select the Config menu -> Select File Systems -> Select Access local drive. You should now be viewing a list of mounted file systems. Select Add. Now we fill out the form.

Partition

/dev/hdc , If your CDROM drive is the master drive on the second IDE controller. I think this is the most common setting.

/dev/hdb , If your CDROM is slaved to the hard drive on the primary IDE controller. If your option doesn't appear on the list, type it in.

Type

iso9660 . This is same for all PC CDROM's. Just select it from the list.If this option isn't on the list, you'll probably have to recompile the kernel or something. Don't ask me how to do that. When it happened to me, I just reinstalled Linux from the CD.

Mount Point

/mnt/cdrom Probably this directory already exists on your system specifically for this purpose. If not, linuxconf will create it.

Now select Options and choose 'Read Only' and 'User Mountable'. Set Dump Frequency and Fsck Priority both to 0 (zero). Select Accept.

Now your system knows all about how to mount the CDROM... but it still hasn't done it. To actually mount it, type the following at the prompt

# mount /mnt/cdrom

Now the contents of the CDROM will appear in the folder /mnt/cdrom. You can follow a similar procedure to access floppies or a secondary harddisk as well.