Credit card info stolen...

[RossAllen]

Re: Anyone else get this message

People pick silly passwords because the password system is silly. You need a database system to track the 50 or more passwords required to be even moderately connected.

Roboform is one. How secure it is I haven't a clue but any thoughts on that program or others would be appreciated.

[CraigSchumacker]

Re: Credit Card Info Stolen

Greetings:

There is a parallel thread to this running under the announcements section.

A gentleman over there has stated his PayPal was compromised. He and I are of the opinion this is a related incident.

As your Paypal account is your email address, and the hacker has this, please consider the fact that if you used the same password on Alpha's site as you do for PayPal, you have an open door to a secondary wave of attacks.

Please consider that it would be possible to have two or more accounts at Alpha's Store. You may have other info exposed if the data is paired.

Please think carefully about where else you use your passwords.

On a side note, Windows servers are great. I have several. But they require regular and routine updates, and you MUST run virus software on them.

If I were Alpha Software, I'd be looking elsewhere for hosting the site. Their present hosting company isn't up to the task.

Craig

Ut, just got an email from an associate. He was also compromised, and isn't too happy with Alpha Software right now.

Craig

[aRob]

Re: Anyone else get this message

Steven,
Big Brother already knows where you are. Your position can be determined within a few meters from your cell phone or Blackberry signal. GPS in your car may be giving away your position. Credit card and bank transactions leave a trail. Connecting to the internet gives away your position and sends out a steady stream of data which can be 'analyzed'.
Not just Big Brother knows about you but a lot of Little Brothers know more than they should.

[csda1]

Re: Credit Card Info Stolen

Anyone who is posting to this thread and the other one. Please stay on the topic, and don't post other stuff/requests here.

A gentleman over there has stated his PayPal was compromised. He and I are of the opinion this is a related incident.

As your Paypal account is your email address, and the hacker has this, please consider the fact that if you used the same password on Alpha's site as you do for PayPal, you have an open door to a secondary wave of attacks.

This is true, if and only if you used the same email and password. If the password was even slightly different, a hacker would probably be shut down before he found a successful variation of the password. One way of using the same password for all sites and yet be different is to incorporate part of the site's name into the password at a consistent position, e.g. beginning, end, or some fixed position in the middle. E.g for PayPal, Ebay, Mastercard

12345PP6789
12345EB6789
12345MC6789

By choosing a position known only to you, and an abbreviation method (could be last 2 letters of name, 1st 2 letters, 2 letter Initials as one choice. Maybe 3 letters, etc.) you will have a method that is specific to the site, yet different for all. It would take several of your passwords to determine the pattern, an unlikely scenario.

Many of the people choose a name as part of the main text of the password. On sites that don't monitor multiple attempts at access, hackers just run through a dictionary of names and values in the hope of cracking your password. It works surprisingly well.

You can make it harder by picking an odd name or initials or value that has nothing to do with you, e.g. a childhood friend's phone number with his initials or lastname with some or all of the 1st name. It should never be something someone could easily research. It should also be easy enough for you to remember, because the moment you write it down, it has the ability to be taken.

Just consider how easy it is to break into a system at work by turning over some keyboards and reading the attached slip of paper, or look at the post-it note on the side of the computer. If you must write it down, place it in a list of similar items, like using a list of phone numbers and placing it somewhere in it.

If I were Alpha Software, I'd be looking elsewhere for hosting the site. Their present hosting company isn't up to the task.

Without knowing the methodology used to get into the site, that is a strong statement that I'd disagree with. Maybe it was an Alpha employee's machine had a virus with the access to the server keys (ftp program). Maybe it was the server company. Maybe it was new security hole in a Windows server (Nahhhh. Microsoft products never have any holes :D ). You can't blame 1 or more companies without knowing the source and method. Maybe it was the store application that had the whole in it. Maybe it's a hole in PHP. The list goes on.

[jkletrovets]

Re: Anyone else get this message

Ross,

I am not sure how secure it is to some techno-freak person trying to break into it but I think it is pretty good.

This is from their FAQ.

Q: If somebody steals my RoboForm Passcard files, can they get into my accounts?
A: If you password-protect all sensitive Passcards and Identities and then it will be very difficult. Specifically, all password-protected Passcards and Identities are stored in files that are encrypted by your Master Password using AES, BlowFish or 3DES. So a person who stole your computer or password files, will have to break these encryption algorithms in order to get your passwords from Passcards.
As long as you observe these rules, it should be very hard to use the stolen info:
* Password-protect all sensitive Passcards and Identities. Anyone can see and use Passcard or Identity that is not password-protected.
* Make your Master Password long enough and un-obvious enough, so that it cannot be defeated by a simple dictionary attack. Do not use any words or names from any widely used languages, make your Master Password at least 10 characters long.
* Use AES, BlowFish, or RC6 for encryption, they are harder to break than other algorithms.
* More info on RoboForm security: click here.

I have used Roboform for years and it is one awesome piece of software!

Regards,

Jeff

[BrentG]

Re: Anyone else get this message

I have not yet been notified, and I purchased the V9.0 upgrade recently (do not wish to disclose exact date). The failure to notify me is really disappointing. It was only through reading the posts on this forum that I gained knowledge of the breach. I now check daily with the source of my original charge to be certain that I have not become a victim.

I have used 'TurboPassword' for years, and I am completely satisfied with its ability to generate inconspicuous passwords, and provide me with an affordable and efficient tool to reduce the chance of pw cracking. As has been articulated in this thread, use strong pw protection, and don't take the 'easy' path.

Just my 2 cents worth, and still awaiting my notification.

[Steve Wood]

Re: Anyone else get this message

The failure to notify me is really disappointing.

I know only those whose data was in a position to be compromised were contacted. So you should feel the opposite.

[milesjg]

Re: Anyone else get this message

"I know only those whose data was in a position to be compromised were contacted. So you should feel the opposite."

NOT TRUE. My CC was used for a gift card from Cabels on
10/14/09. The only thing I ever purchased (and I do mean only thing)on it was V8 & V9. Over the phone. I received NO notification... More than "disappointing."

[Steve Wood]

Re: Anyone else get this message

You should call Alpha directly and tell them so. My understanding was they could tell who was at risk, who was not.

[RossAllen]

Re: Anyone else get this message

"I know only those whose data was in a position to be compromised were contacted. So you should feel the opposite."

NOT TRUE. My CC was used for a gift card from Cabels on
10/14/09. The only thing I ever purchased (and I do mean only thing)on it was V8 & V9. Over the phone. I received NO notification... More than "disappointing."

You should ask if the CC's taken over the phone were entered into the same system. I placed my order online and I've been expecting to see others report that their cards were used to purchase domains and hosting because a guy at one of the hosting companies my card was used on recognized the address in Vietnam and said this guy has been hitting ton's of cards.

I have a hard time feeling disappointed on this one. I've been at hit least 7 times in the last 10 years on 7 different cards and this is the first time anyone has notified me of a security breach. 3 of those cards were never used on the net. I learned in the news that 2 of my cards were breached probably as the result of a gang that was working with gas station employees to somehow grab CC info. 2 from two leaks at the world's largest online law database. The others I have no clue. They say, believe it or not, the least secure method is giving out your CC over the phone.

The majority of security breaches go unreported. The Identify Theft Resource Center publishes a list of high profile security breaches that have been reported, so far in 2009 they have 429 breaches on their list alone affecting 220,427,887 records: http://www.idtheftcenter.org/ITRC%20...ort%202009.pdf

Check this one out from 2007:

TJX Cos reporter that intruders broke into computers sometime in mid December and stolen an unknown amount of customer data including credit card, debit card, check and merchandise return transactions for TJ Maxx, Marshalls, HomeGoods and AJ Wright stores in the US. TJX's Bob's Stores and TK MAX stores are also involved. In addition, Bruce Spitzer, a spokesman for the Massachusetts Bankers Association, said at least eight banks have been affected by a similar breach of information, related to debit cards they issued. The breach may have started as early as 2003. A multi-state and FBI investigation is underway.

Update: March- the number of affected consumers revealed in a filing with the SEC is 45.7 million customer records. TJX also reported in the filing that another 455,000 customers who returned merchandise without receipts had their personal data stolen, including drivers' license numbers. Update: A settlement has been reached based on info from VISA and Mastercard. Total records updated to 94 million.

[donjan]

Re: Credit Card Info Stolen

Reading this thread I now know why I had credit card charges from Cabela (2 for $100). The credit card company caught the entries and closed the card and issued a new one and removed the Cabela charges at once. This occured well over a month ago so I guess I was early on the list and didn't connect this when Alpha sent the e-mail concerning the theft. I'm sure glad the credit card company was on the ball.

[StevenMcLean]

Re: Credit Card Info Stolen

Given the recent US court ruling giving the police the ability to seize data stored on servers hosted by 3rd parties without a warrant, I think some WEB App developers my rethink that platform.

[MikeC]

Re: Credit Card Info Stolen

Steven...Link please to this court ruling? or specific search terms?

[Rick Sloan]

Re: Credit Card Info Stolen

Hi Mike

I am not sure about a court ruling, however I did see something about that some months ago here in Canada on one of our news channels. It was in the "ticker tape" news flashes scrolling on the bottom.

It had something to do with passing a law specifically for authorities and police to view all e-mails without warrant as part of the war on terror. I am not sure if it was the for the U.S., since I saw it here in Canada. It is most likely for here, but it could be both.

The ticker tape scroll went by quickly but it was definitely there. I was shocked. I waited as long as I could with the time I had for it to go by again, but was unsuccessful. I had to leave. I tried some time later to see if it would go by again, but it must have been at the end of its "news worthiness'. I never saw it again.

After recent years events, I think we would all be "dreaming in technicolor" if we were naive enough to think that is not happening right now anyway.

Cheers (to the authorities as well)

Rick

[MikeC]

Re: Credit Card Info Stolen

Hi Rick,
I wasn't disagreeing with Steven at all....just wanted to make certain I would read/find the same article....I did just look and found this but seems to contradict what Steven alluded to (maybe this appeal overturned what Steven read?).
http://www.complianceweek.com/articl...ry-protections

Getting a bit off topic and was just curious so hopefully we don't dwell on this in this thread.