Send In The Clones!

1. Send In The Clones! The Fact and Fictionof Identity Theft

2. About Neal O’Farrell • CEO of My Security Plan and working in information security for more than twenty five years. • Taught security to more than 3 million users in 120 countries, • Awareness programs endorsed by Department of Homeland Security and the United States Secret Service. • Creator of the nation's first Cyber Security Day, on November 4th 2002 • Founder of Think Security First!, the nation's first community-based cyber security awareness initiative and a unique experiment in raising the security awareness of an entire city. • Creator of the Identity Theft Score

3. About My Security Plan • My Security Plan teaches consumers and small business owners how to "plan their protection" against the threats of cybercrime and identity theft. • We also create solutions to help our partners teach their customers better security habits, so they can reduce the growing costs associated with lack of security awareness, and at the same time enhance their brand reputation and build greater customer trust. • Our content and tools can be found on numerous web sites and ISPs. • Current projects include a nationwide consumer id theft awareness campaign in partnership with NBC. • Based in Walnut Creek CA, and on the web at www.mysecurityplan.com

4. What You’ll Learn • What is identity theft and how did we get here? • Who commits identity theft, how, and why • Hacking, phishing, and identity theft • Are we making progress, or treading water? • What next – attacks and responses • The Cost of Failure • What You Can Do To Protect Yourself • What Your Organization Can Do

5. Send In The Clones • How big is the problem? • Gartner estimates 7 million victims annually • Better Business Bureau estimates 8 million • FTC estimates 10 million • Harris Interactive estimates 44 million • Confusion is understandable: • Different methodologies • Different motives • Different definitions • Identity cloning is a better definition • You don’t actually lose your identity • The difference helps explain the explosion in the crime • Little disagreement over the cost • $56 billion annually and rising

6. The Busboy That Started It All • March 20th 2001, MSNBC reported the first identity theft case to gain widespread public attention • Thief assumed the identities of Oprah Winfrey and Martha Stewart, took out new credit cards in their names, and accessed their bank accounts • Stole more than $7 million from 200 of the world’s super rich - Warren Buffet and George Soros, tech tycoons Paul Allen and Larry Ellison • Used a library computer, public records, a cell phone, a fax machine, a PO Box, and a copy of Forbes Richest People • 32-year-old Abraham Abdallah was described as “a high school dropout, a New York City busboy, a pudgy, disheveled, career petty criminal.”

7. How Identity Theft Has Changed America • Changed the way we work and communicate • Changed the way we use technology • Changed the way we trust • Changed our postal system • Changed our credit and banking system • Changed our criminals • Changed the way the police “police” • Changed our national security and sense of security

8. How Did We Get Here? • A unique financial system with easy access to credit • Lack of awareness by consumers • Poor education and slow response by the financial community • Identity theft has been a cost of doing business • Prosecution is rare, around 5% of reported cases • The meth epidemic has fuelled growth • Organized crime and hackers have brought their own unique skills • Media exposure has created a new appetite • It’s where the money is!

9. Why Identity Theft Is SuchA Unique Crime • Anyone can commit it, and you don’t have to be a genius • Everyone does, from organized crime to mom and pop • It’s a delayed action crime, with many months between the crime and its detection • It’s often a multipart crime, starting with the theft of a single piece of information • The crime can be committed from thousands of miles away – the victim and culprit often never meet • You don’t have to own or even use a computer • It costs everybody money

10. Identity Theft Vs. Other Crimes • Typical California city, population 64,000, 60 police officers. • Using FTC statistics, there could be 2,000 ID theft victims a year in this city. • That’s 4 times the number of burglaries, 20 times the number of assaults, and 60 times the number of thefts. • The department recently had to let go its only (part time) cybercrimes investigator.

11. Identity Theft and Methamphetamine • Meth users see mail theft and check washing as a low risk way to pay for their habit • The best chemicals for brewing meth are also the best chemicals for washing checks • Identity thieves and fraudsters see meth users as lucrative “partners in crime” • Meth gangs see the double payoff in identity theft, and have the right connections

12. Meth, Check Washing, and Mail Theft • In Salt Lake City, police report that 95% of all check washing is done by meth users • In Phoenix AZ police report that 99% of all check washing is by meth users • “Arizona is the number one state in the country for mail theft. Our state also is plagued with the crimes that come with it-- meth dealing and identity theft.” KGUN News Tucson, September 2003. • Nearly 90% of domestic disputes reported in Contra Costa County involve meth.

13. Who, Why, and How • More than 50% of all identity thefts are committed by people known to the victim – family, friends, and co-workers (FTC) • 70% of thefts can be traced to workplace thefts by employees (University of Michigan) • Organized teams and gangs are responsible for a growing number of large crimes • Petty criminals understand the attraction of the crime • Opportunists can read the headlines • The “nearest and dearest” threat • Perhaps more offline thefts than online

14. Why Identity Theft? • It’s where the money is • Anyone can commit identity theft, with no special tools, training, or skills • A bank robbery raises $3,500, an identity theft $17,000 • Payoffs can be staggering – a theft of customer identities by an employee in New York in 2003 netted him $7 million • There’s a ready market for any ID information, from credit cards to SSNs • It’s a very low-risk crime • Many believe it’s a victimless crime

15. Hacking Phishing and Pharming Mail theft Insider crimes Dumpster diving Check theft Burglary Car theft Hard drive rebuilding Laptop theft Theft of credit card receipts E-mail and internet scams How Is Identity Theft Committed?

16. Hacking And Identity Theft • Organized crime gangs, from Russia (6,000 gangs approx.) to Bolivia • Professional hackers selling any information for a gain • Disgruntled insiders, often after they’ve left the workplace • Opportunists scanning home computers for open doors • Petty criminals keeping up with the times • Traditional hackers/virus authors seeking profit for the risk • New partnerships between organized crime, virus authors, spammers etc.

17. Hacking Incidents On The Rise • More than 50 of the reported data breaches in the last year attributed to hacking • Hacking accounted for the largest number of compromised personal records in the last 12 months – 43 million approximately • Well-known brands include DSW Shoes, Polo Ralph Lauren, BJ’s Wholesale • Educational institutions a major target • Card Systems was one of the biggest to date, at 40 million customers exposed

18. Hacking For Cash • Russian hacker Maxus stole 300,000 credit card records from CD Universe in 1999. • Demanded a ransom of $100,000, then gave away 25,000 credit card records free on the web (The Maxus Credit Card Pipeline) • Stolen data networks have flourished in the open, including Network Terrorism Forum, Shadowcrew, Carderplanet, Dark Profits, and Mazafaka • Shadowcrew had 4,000 members, 1.5 million stolen credit cards, and created $4 million in losses • Ransom trojans offer specific instructions to avoid data deletion or encryption

19. How Data Selling Networks Work • A new generation of organized crime that never meets • Credit card numbers are posted on public web sites for either purchase or “joint venture” • In a joint venture, other network members use stolen numbers to send good to drop sites for pick up, goods are sold and proceeds shared with the original poster • Sellers required to prove their credibility with multiple dummy runs • Criminal community operates a rating/review system for sellers and data • Sites accept request for specific types of stolen information and will also sell complete phishing web sites and emails

20. Phishing And Identity Theft • Jan ’05 – Jan ’06, more than 190,000 different phishing attacks reported (The Anti Phishing Working Group) • January ’06 saw 4 times as many new phishing web sites as Jan ’05 (The Anti Phishing Working Group) • January ’06 – 101 brands hijacked by phishers (The Anti Phishing Working Group) • January ’06 – the highest recorded number of phishing-based keylogger Trojans (184) • The U.S. is the largest host of phishing web sites (36.57%) followed by China (8.98%) and Korea (7.7%) (Websense) • Don’t forget its cousins pharming and phowning

21. Why Phishing Works • "Why Phishing Works" study (Harvard University/UC Berkeley) 90% of subjects were unable to pick out a highly effective phishing e-mail when simply judging whether or not it was genuine • Spoofed Bank Of the West e-mail with phishing Web site www.bankofthevvest.com (with a double "v" instead of "w"), a padlock in the content, spoofed VeriSign logo and certificate validation seal, and a pop-up consumer security alert. 91% of participants guessed it was legitimate. • Presented with a genuine E*Trade e-mail that directed recipients to a legitimate secure site with a simple, graphic-free design optimized for mobile browsers, 77 percent of participants guessed it to be a fake. • Nearly a quarter of participants in the research study didn't look at the address bar, status bar or security indicators on the phishing sites.

22. One Recent Phishing Trip • First half of March 2006 experts tracked a single hacker group stealing between 1.5 and 2 megabytes of text data from victims each day.* • Roughly 1,000 credit card numbers or login credentials for Web mail and online banking sites. • The third week in March, when the latest IE exploit surfaced, the same group's dead drops increased to 80 to 115 megabytes of stolen data each day. • On just one day phishers stole 13,677 accounts, including 3,536 credit card account numbers, 255 Paypal accounts, 1,038 eBay accounts; 93 user names and passwords for Bank of America online accounts; and login credentials for some 2,609 Hotmail e-mail accounts. • But is all this really identity theft, or just credit card fraud? *Washington Post/Secure Science Corp. March 2006

23. From Phishing To Phowning • Phishers are moving from email to VoIP to trap unwary users • Instead of directing users to phony web site, offers users a phony phone number to call • An easy scam to set up: • Create a VoIP account, such as Vonage • Install a voice recognition system • Manage with a PC-based PBX • Create an elaborate and convincing call-in system • For the phisher, a faster deployment, lower cost, and less risk • Lack of awareness and familiarity makes the crime more effective • This could represent an entirely new class of cyber attack *Washington Post/Secure Science Corp. March 2006

24. Mail Theft • Opportunists and meth users looking for anything of value • Organized local gangs planning attacks, monitoring routes • Impersonation of mail staff • Theft or hijacking of mail vans • Theft by neighbors • Thefts from businesses

25. Insider Crimes • 50-70% of identity thefts traced to trusted insiders. • That means family, friends, co-workers, and employees • This type of attack is much easier to hide, harder to trace • Knowing a friend or colleague is the culprit adds to the victim impact • Small businesses are especially vulnerable • Even employers have resorted to identity theft • First major insider theft cost an estimated $100 million in losses

26. Burglary • Expect identity theft to drive a new wave of burglary, especially by meth users • ID theft by burglary is a much easier crime to conceal • It’s a more profitable crime, because information can be sold many times over • It’s a crime that leaves little evidence, and can go undetected for months or even years • The merchandise has no protection and can’t be engraved with an SSN

27. Hard Drive Rebuilding • Few computer users properly erase their hard drives before dumping or selling their computer • Most old hard drives contain some useful information • A study by MIT found nearly 50% of used drives purchased had usable data including medical correspondence, pornography and 5,000 credit card numbers • A Nevada woman bought a used computer with prescription records on 2,000 customers • Many identity thieves focus solely on purchasing old computers

28. Are We Making Progress? • The number of adult victims of identity fraud has declined marginally between 2003 and 2006, from 10.1 million people to 8.9 million people, in the United States. Better Business Bureau • Consumers don’t bear the brunt of financial losses from identity fraud, Internet use does not increase the risk; and seniors are not the most frequent targets of fraud operators. Javelin Research • Greater commitment to technology, including two-factor authentication, anti-phishing toolbars, and increased credit monitoring. • Greater understanding by consumers - nearly 40 percent of citizens are willing to pay fees for more protection, according toUnisys study

29. Are We Really Making Progress? • Nearly 55 million Americans had their personal information compromised between February 2005 and April 2006 (Privacy Rights Clearinghouse) • Only covers “reported” breaches • January – March 2006, at least 75 incidents of “data disclosure” have been reported, potentially affecting more than 4.9 million individuals (ChoicePoint) • ChoicePoint was one of the most infamous insecurity cases of 2005 • "Only one percent of bank employees report that their bank provides special identity theft training for employees". International Communications Research (ICR) • 2005 described as “the year of the breach” with 130+ reported breaches

30. Are We Really Making Progress? • More than 180,000 PCs are turned into zombies every day, and that figure is continually rising (Ciphertrust) • Pumping out spam, launching Denial of Service attacks, and stealing personal information • 40 of the Top 50 threats identified in 2005, including viruses, worms and trojans, were designed to steal confidential information from the user's computer.Symantec • "In the last six months of 2005 there were an average 7.92 million phishing attempts per day."Symantec's Internet Security Threat report • 1 in 10 consumers reported receiving notification of their personal data being compromised (August 2005)

31. What Next? Attacks • Dawn of the Bots • Botnets and bot herders. Dutch trio infected more than 1.5 million PCs with Toxbot trojan to steal credit card numbers and other personal data, and to blackmail online businesses. • “Meta Fisher” bot Trojan known to have infected 1 million+ computers to attack personal bank accounts (March 200). Dubbed “the most sophisticated bot Trojan ever” • Encrypted bots • Debit card attacks • “Could mark the dawning of a new age in computer crime.” Gartner • Exploits weak policies and practices • Denial of Service/Blackmail • Million Dollar Home page • 23,000+ hosts attacking the site • $50,000 ransom demanded • Personal attacks • Spear phishing • Individual blackmail and ransom

32. What Next? Responses • Consolidation of data protection laws • H.R.3997 - The Financial Data Protection Act of 2005, to amend the Fair Credit Reporting Act • H.R.4127- reasonable security policies, better procedures to protect computerized data containing personal information, nationwide notice in the event of a security breach. • 23 states already have enacted disclosure laws requiring various forms of notification of data breaches. • Authentication, identification and other technologies • Tokens and biometrics • Bank of America and Wells Fargo initiatives • Personal anti-phishing tools • McAfee Site Advisor • Google, Firefox, Microsoft • More laws, fines, personal accountability, firings

33. The Cost of Failure • Providence Health Systems, Portland – loss of $7- 9 million in “financial and legal aftereffects “ from theft of computer tapes • BJ’s Wholesale – losses estimated at $10 million +, before litigation, for data theft incident. • 163 Credit Unions filed suit as a result of breach. • ChoicePoint - paid $15 million in fines after unwittingly selling consumer credit reports to thieves posing as legitimate customers. • Cardsystems – took 15 years to get to processing more than $15 billion annually in credit card payments. • Took less than 8 months after losing customer data to national humiliation, Congressional hearings, loss of major clients, payment of fines to the FTC, and fire sale of assets.

34. The Cost of Failure • “In a climate of heightened consumer awareness and concern about online security and fraud, 37% of online banking consumers believe some banks are more secure than others, while 43% place online banking security among the top-three factors in selecting where to bank.”Jupiter Research • “12 million consumers have switched banks to reduce the risk of becoming victims of identity theft.“Financial Insights • More than two thirds of the American public have lost confidence in the handling of their personal information.”Privacy and American Business and Harris Interactive study

35. The Cost of Failure • “One in four Web users say they have stopped shopping online because of perceived security risks, and more than half no longer give personal information, such as addresses or birthdates, over the Internet.” Consumer Reports • “The combined effect of all these attacks is exacting a steep toll on consumer confidence in online commerce. More than 42 percent of surveyed consumers say their concerns about online attacks such as phishing18 affect their online shopping behavior. More than 28 percent say that online attacks have influenced their online banking activity.” Gartner, June 2005 • “Nearly 20 percent of respondents say they have terminated a relationship with a company after being notified of a security breach and 40 percent say they are thinking about terminating their relationship” The Ponemon Institute, 2005

36. The Cost of Failure • “Any company that fails to do what is necessary to help protect consumers is putting its corporate reputation at risk.” Harriet Pearson, chief privacy officer, IBM. • “There is a hidden threat to this digital future: It's not some cyberattack, but the loss of consumer confidence in the online experience. If consumers don't believe that their critical information is protected from irreparable damage or unauthorized access, they won't continue to embrace the digital lifestyle. And that won't just hurt the digital economy, but the economy as a whole. “ John Thomson, CEO. Symantec, Feb 06 • "The main thing we've lost is not the money; it is not the credit ratings. The main thing we've lost is trust.” David Perry, global director of education, Trend Micro at RSA 2006

37. How You Can Protect Yourself • Create a simple security plan – a checklist of what security gaps they need to fill • Security rules for the home • Use of credit cards • Use of web and e-mail • Regular credit checking • Physical and document security • Use of security technologies • Care in the office

38. How You Can Protect Yourself • Create an ID theft response plan: • What credit agencies to contact and how • All bank and credit card account details • Bank and credit card company contacts • Copy of an ID theft affidavit • Local police contact • List of all SSNs in the home • List of all missing or misused checks, with numbers • Outstanding ATM and check cards

39. How You Can Protect Yourself • Check credit reports at least every three months • The more often you check, the less damage will be done • Understand what you’re reading • Consumers need to be careful of the service they choose • Use strong passwords for credit accounts • Consider using a credit monitoring service

40. How You Can Protect Yourself • Don’t leave mail unattended in public places • Mail theft is often the first, last and easiest step in identity theft • Don’t leave mail to be collected in a public place • Avoid making payments by mail. Pay online instead • Collect check books and ATM cards from the bank – don’t have the bank mail them • Have your mail collected when on vacation

41. How You Can Protect Yourself • Shred all unnecessary financial documents • Shredding minimizes the threat of dumpster diving • Immediately shred pre-approved credit card offers • Shred old hard copies of financial records and receipts • Use a cross-cut shredder • Fellowes is a popular brand, starting at around $50

42. How You Can Protect Yourself • Protect social security numbers or other personal financial information • Most ID thefts are based on combining pieces of information. The SSN is the holy grail • Never reveal your SSN over the phone, or send by e-mail • Don’t give it to businesses that request it as an identifier • Make sure that third parties that have it, such as CPAs, protect it - Beware of phishing and email scams • Protect it from family and friends

43. How You Can Protect Yourself • Protect every computer you use in the home • Firewall • Virus protection • Spyware protection • Data encryption • Patching and updating • Privacy measures

44. What Your Organization Can Do • View identity theft as a brand enhancer and a brand enabler • It’s time to capitalize on the crime • Have a plan in place for prevention, response, and notification • Customers don’t recognize data theft as the real crime • The real crime is (a) what’s done with the data and (b) what you failed to do • Educate your customers • They’re a captive audience • They want to trust you • They’ll appreciate the help • Talking about security is not a bad thing • Focus on phishing

45. What Your Organization Can Do • Educate your employees • Saturation awareness training • Policies and rules • Data classification and protection • Encryption • Communicate and Counsel • Notify quickly, clearly, and honestly • Provide a hotline • Provide victim assistance and resolution • View a breach of trust as an opportunity • to create better trust and a stronger relationship