Home » Security » Recent Articles:

No Patriot Act? Snuggly the NSA Security Spy Bear Might Just End Up Working for Verizon or AT&T

Phillip Dampier June 2, 2015 AT&T, Editorial & Site News, Public Policy & Gov't, Verizon, Video Comments Off on No Patriot Act? Snuggly the NSA Security Spy Bear Might Just End Up Working for Verizon or AT&T

snuggly

[flv]http://www.phillipdampier.com/video/United States of Surveillance.mp4[/flv]

United States of Surveillance: Don’t Worry… We’re Watching You… ALL OF YOU. (2:29)

[flv]http://www.phillipdampier.com/video/Mitch McConnell and Snuggly the Security Bear Beg to Spy.mp4[/flv]

“After tracking your every move and spying lovingly on each and every one of you, I feel like I know you all personally, because I do!”

Is this the end of our domestic spying pal, Snuggly the Security Bear? Most likely not. Snuggly will probably still be in business and up to his usual tricks, he just may have to work with Verizon or AT&T or some kind of NSA-corporate partnership. (1:27)

Comcast Blames Victim’s Family, Not Its Alarm System, for Failure to Alert Police Their Son Was Being Tortured

Phillip Dampier May 21, 2015 Comcast/Xfinity, Consumer News, Public Policy & Gov't Comments Off on Comcast Blames Victim’s Family, Not Its Alarm System, for Failure to Alert Police Their Son Was Being Tortured
comcast home

If it works properly

Comcast has blamed its customer for the failure of its home security system to detect a break in and alert police before intruders terrorized and tortured their son.

Last fall, Stop the Cap! told readers about the plight of the Rawat family, in Kirkland, Wash., who depended on home security services provided by Comcast and now wished they didn’t.

In November 2013, police say Vincent Sisounong and Blessing Gainey planned a home invasion to steal vehicles, electronics, and money from the family. To achieve their plan, the 21 and 19-year old had to defeat Comcast’s Xfinity Home security system. According to a lawsuit now being heard in a bench trial this week, the two men didn’t have to do anything because the system never worked properly.

After entering the Rawat home, the two planned to find the family’s 18-year old son Deep and “chop off one of his arms and legs with various cutting tools” as an intimidation tactic. The attack started in Deep’s bedroom. The two men dragged him to the basement, where Sisounong instructed Gainey to hack at Rawat’s leg down to the bone, and then stabbed Rawat himself. Court documents said Sisounong told detectives that he wanted the victim to “fight for his life,” and when asked if the experience was enjoyable, he said, “yeah.”

vin

Sisounong (L) and Gainey (R)

For nearly half an hour, the struggle between the two intruders and Deep continued inside the home and finally ended when the intruders walked out the door. At no time did Comcast’s security system sound. The family had to ask neighbors to call police.

Comcast quickly blamed the family for not installing and using its system properly, despite the fact its installation was planned and performed by a Comcast subcontractor.

This week, the torture victim and his parents, Leena and Manoj Rawat, argued that Comcast and its contractor Pioneer Cable Contractors, Inc. improperly installed the Xfinity Home system. A recommendation from the installer placed the system’s motion detector in the basement, where it provided no protection when the family was home. The installer allegedly told the family they did not need window sensors because the motion detector was a suitable alternative. Although window sensors are usually constantly monitored, motion detectors are not when a family is home to prevent false alarms.

“This advice runs counter to every standard in the industry,” Rawat family attorney Ken Friedman argued during his opening arguments Monday. “The system as set up was useless, or in some cases worse than useless, because it provided a false sense of security.”

Friedman is also fighting to overcome Comcast’s terms and conditions, which require customers to protect Comcast’s interests above their own at all times, even when the company is found negligent. To emphasize the point, Comcast places it in bold, extra-large capital lettering:

Comcast's security contract lets the company walk away from responsibility for virtually everything.

Comcast’s security contract lets the company walk away from responsibility for almost everything.

YOUR DUTY TO PROTECT/INDEMNIFY THE COMPANY APPLIES EVEN IN THE CASE OF THE COMPANY’S OWN NEGLIGENCE.

“If their argument is to be accepted, they could put in empty black boxes throughout the house and say, ‘That’s your system.’ And then something goes wrong, and they say, ‘We never promised you it would work,’” said Friedman.

A better option?

A better option?

The Rawat’s lawsuit alleges negligence, breach of contract and express and implied warranties, and a violation of the Washington Consumer Protection Act.

Comcast’s response is that their alarm system was never at fault.

“The malicious attack by the two criminals was motivated by pure evil and warrants every last second of punishment that they receive,” Comcast attorney Timothy Pastore said. “However, what happened to Deep Rawat is not the result of anything that Comcast or Pioneer did or did not do.”

Pastore claimed the family specifically ordered the alarm as it was installed, and it was working properly. The fault lied with the family because they failed to arm the system’s motion detectors by setting it to the “away” mode while they were asleep.

But if they had done as Pastore suggested, the motion sensor would have sounded the alarm if any family member moved around inside the home. The window sensors were designed to work at all times and would not sound unless a window was opened or broken. For added security and peace of mind, you can click here to visit Maverick Windows for free consultation and expert guidance in choosing the ideal windows for your home.

Simple Website Flaw Discovered by 18-Year Old Exposed Personal Data of Millions of Charter Customers

Phillip Dampier May 20, 2015 Charter Spectrum, Consumer News Comments Off on Simple Website Flaw Discovered by 18-Year Old Exposed Personal Data of Millions of Charter Customers

cyber hackA security flaw exposed the personal data of millions of Charter Communications customers nationwide, including payment details, account holders’ names and addresses, and specifics about the equipment used to receive Charter service.

Eric Taylor, 18, discovered the simple website flaw which could be exploited to expose private account information with the use of a simple header modification using a browser plug-in.

The flaw was similar to one discovered recently in Verizon’s online customer service portal. But Taylor claims Charter’s vulnerabilities exposed “way way way more” private customer information.

Fast Company, which first published the story about the security breach, notified Charter in advance of publishing the story, allowing the company to close the breach within hours before it became widely known.

Charter immediately downplayed the security risks involved.

charter-communications“The vast majority of Charter customers use a version of the site on which this security vulnerability was not an issue,” a company spokesperson explained, noting the number of customers affected was less than one million. The company is auditing its systems, he said, and has so far “seen no evidence of any password or data hacks.” The exposed data did not include credit card numbers.

Taylor and other security researchers believe the flaw was more serious than Charter was willing to admit.

“In theory, anyone with minor programming skills could code an automated program that scans every Charter IP and returns the customers billing info,” Taylor explained. Because ISPs like Charter distribute Internet services through blocks of IP addresses, an ambitious hacker could have incrementally added the number 1 to the end of a targeted address and see a different Charter customer’s account details each time.

“Personal information leakage as a result of such a vulnerability opens customers up to being attacked on other services such as email providers, cellular providers, and work-related functions with many untold consequences,” said Hector “Sabu” Monsegur, a former black hat hacker and security consultant.

Verizon Broadband Customers: Your Security May Have Been Compromised

Phillip Dampier May 14, 2015 Consumer News, Verizon Comments Off on Verizon Broadband Customers: Your Security May Have Been Compromised
Tell me everything about me.

Tell me everything about me. (Image: BuzzFeed)

Since April 22, a website programming error has been responsible for exposing the personal information of up to nine million Verizon broadband customers.

BuzzFeed News reported a vulnerability in Verizon’s account portal allowed anyone capable of spoofing an IP address of a current customer to get instant access to account information and arrange a password reset to take full control of the customer’s account.

BuzzFeed was able to verify the vulnerability with the help of cooperating Verizon customers and immediately notified Verizon about the problem before publishing the story. The vulnerability has since been corrected, but not before three weeks of ‘open access’ to Verizon customer account information to those proficient at manually changing their IP address:

Within a few hours of the tip, and despite having no technical background, with the explicit permission of several Verizon account holders, I was able to convince Verizon customer service to reset an account password, giving me total control of a Verizon account. It was surprisingly easily done.

It took me only two downloads, copy and pasting some information from an email, and a few interactions with Verizon customer support. It was just a matter of following step-by-step instructions. In other words, if you can follow a recipe, you could have probably gotten a Verizon password reset.

[…] These pieces of information — name, telephone numbers, and email — were all I needed (and more frighteningly, all a malicious hacker would have needed) to convince Verizon customer service that I was a customer in need of a password reset.

Even worse, customer support gave me that reset information despite the customer having a security PIN set up.

With that information, a hacker could gain enough personal insight to trick other businesses into giving up additional personal information.

“Once it was brought to our attention, our experts immediately investigated the issue and repaired the error within hours,” a Verizon spokesperson told BuzzFeed. “We appreciate the responsible manner in which Buzzfeed brought this matter to our attention. Addressing issues like this collaboratively is a constructive addition to our continuous actions to safeguard the security of customers’ information.”

Verizon hoped to reassure customers the security damage was minimal, telling BuzzFeed. “We have no reason to believe that any customers were impacted by this, other than those who’s information was used by Buzzfeed. If we discover that any were, we will contact them directly.”

Apple Stores Accused of Allowing Crooks to Buy Smartphones and Bill Them to Random AT&T/Verizon Customers

Phillip Dampier March 12, 2015 AT&T, Consumer News, Verizon, Video, Wireless Broadband 1 Comment
KMGH Denver reporter Marshall Zelweger holds up some of the emails received in the newsroom from victims that had new iPhone 6 smartphones billed to their account. (Image: KMGH-TV/Denver)

KMGH Denver reporter Marshall Zelinger holds up some of the 50 emails received in the newsroom from victims that had new iPhone 6 smartphones billed to their Verizon Wireless account in February. (Image: KMGH-TV/Denver)

If you want a new iPhone 6 and don’t want to bother paying for it, buy one from an Apple store and they just might bill your purchase to a unknowing third-party with few or no questions asked.

The scam, which first emerged last month, has now spread coast to coast and now involves more than 100 illegally obtained iPhones that victims complain were billed to them with little or no verification by Apple or wireless carriers. Many of those orders, but not all, originated inside Apple retail outlets and AT&T told one Connecticut victim they are being hampered in their fraud investigation by Apple, which is allegedly not cooperating with the wireless carrier.

In Denver, dozens of victims shared their stories with KMGH-TV back in February when the fraud first appeared.

“We have heard from more than 50 customers who said their accounts have been charged for new iPhone 6s, and new service plans or altered service plans, that they never requested,” reporters told viewers.

Verizon Wireless and their customers were the original targets, and Verizon initially blamed their own customers for the fraud.

Denver area resident Terri Olson was livid after Verizon accused her son of ordering new iPhones on her business account.

“He happened to be in the office that day,” said Olson. “We’re like, ‘Wow, he’s here. He’s not on the phone with Verizon.'”

Verizon promised it would drop the charges and tighten security on her account, but two days later, Verizon called confirming they had just accepted and shipped an order for four new iPads.

“She explained to me that she had my son on the other phone line, on hold. Funny thing, he was here with me,” Olson told KMGH. “We proceed, later that day, to get an email confirmation from Verizon that our order is shipping to Henderson, Nevada — (the order) that was supposedly stopped.”

Olson was able to get FedEx confirmation the four iPads were indeed sent to Henderson and signed for by someone, and it was not her son.

“It’s no way to run a business. If I did this to my customers, oh my God, we’d be out of business,” said Olson.

A few days later, more than $2,000 in fraudulent charges showed up on her Verizon bill, and the company was stalling on crediting her account.

“Basically, I’m risking my entire fleet of cell phones and data plans and iPads and everything because I don’t want to pay thousands of dollars ahead, waiting for this supposed credit,” said Olson. “I have already gone up the food chain. I’ll continue to go up the food change. We’re not taking no for an answer.”

Another Denver victim suddenly received news he was the proud new owner of four new iPhone 6 smartphones from Verizon Wireless, despite the fact he was an AT&T customer and had never authorized the purchase of the phones or the two-year contracts that came with them. A Verizon store told him if he didn’t return the phones, he’d be on the hook for their full value — $449 each as well as $160 in service charges.

[flv]http://www.phillipdampier.com/video/KMGH Denver More than 50 Verizon customers tell 7NEWS they are victims of unauthorized charges on their accounts 2-10-15.mp4[/flv]

In February, KMGH in Denver reported more than 50 viewers were billed for illegally obtained Apple iPhones charged to their Verizon Wireless accounts. (2:35)

Verizon couldn’t believe the security problem was on their end or at their authorized resellers, so they initially blamed customers in a statement:

As we have stated before, there is no evidence of a data breach at Verizon Wireless that would put our customers’ information at risk. In order for us to look into this further, we will need to work with our customers one-on-one.

In fraud cases, we often find customers have been tricked or persuaded to provide information that allows fraudsters to compromise their accounts. But without the further information you have offered to provide on these particular cases, we cannot determine what has happened.

That triggered a social media backlash.

“For them to suggest that this was phishing and effectively blame the customer is even more appalling,” wrote one victim. “I realize phishing happens too and folks are duped, but that is not the way this happened in my case.”

A North Carolina church was billed for 17 illegally-obtained iPhone 6 smartphones, totaling more than $10,000. (Image: WAVY-TV/Norfolk)

A North Carolina church was billed for 17 illegally-obtained iPhone 6 smartphones, totaling more than $10,000. (Image: WAVY-TV/Norfolk)

Verizon Wireless has been the victim of phishing attempts inviting customers to use their Verizon Wireless login credentials and a four digit billing code which many might assume to be the last four digits of their Social Security number to get a one-time credit on their account. The link actually leads to a fraudulent website, where information obtained by the hacker could be used to log into a legitimate customer’s Verizon Wireless account. But a Verizon store representative tells Stop the Cap! that alone would not be enough to complete a purchase at a retail store.

“A phishing fraud victim would be providing the crook login information that could be used to order equipment off Verizon’s website, which seems to be a lot less risky than walking into a retail store to commit fraud,” a Verizon store employee not authorized to speak to the media tells Stop the Cap! “Verizon confirms direct online orders right away with customers, so they would know immediately if there was something wrong with their account. They wouldn’t usually know if a third-party retail reseller billed a phone to their account until the bill or the phone came.”

After the number of fraud reports ballooned, Verizon Wireless evidently tightened its own internal security because by late February, the fraudsters moved on to AT&T.

In Hartford, Conn., Meg O’Brien found out she was a victim when her own phones stopped working.

“Three of our four phones had no service,” O’Brien told Hartford’s WFSB-TV. When she called AT&T, they knew straight away what was happening. “They responded by saying ‘oh – hold on a minute – there’s obviously some fraud…you have three new iPhone 6’s’ and I said ‘ah no we have no iPhone 6’s’.”

AT&T told O’Brien she was far and away not the only victim, and AT&T was concerned because Apple reportedly was not cooperative assisting AT&T in tracking down the Apple retail store(s) where the theft originated. AT&T did confirm the thieves were able to acquire the equipment by charging it to random AT&T wireless accounts.

The Apple store(s) involved allegedly did not need proof of identity or a credit card to complete the transactions, and that leaves O’Brien fuming.

She told WFSB she found it unbelievable Apple stores were handing out phones to customers with nothing more than an AT&T customer’s phone number, and she’s unhappy Apple isn’t being forthcoming.

“So I have no idea what other information has been sold or bought or anything,” O’Brien said. She is filing a complaint with Connecticut’s attorney general.

An Apple spokesperson tells us nobody is supposed to be able to walk out of an Apple store with a new phone without a complete wireless account number, the last four digits of the account holder’s Social Security number, photo ID, and final approval from a wireless carrier. Apple claims the purchase met all four criteria, something O’Brien disputes.

[flv]http://www.phillipdampier.com/video/WFSB Hartford Hacker charged 6 iPhones to woman ATT account 3-11-15.mp4[/flv]

WFSB in Hartford reports AT&T customer Meg O’Brien was victimized by fraudulent purchases at an Apple retail store Apple is refusing to name. (2:39)

The Fountain of Life Ministries in Elizabeth City, N.C., has been victimized at least twice by a crook using the church’s name to get at least 17 iPhone 6 smartphones for himself, leaving the church with the bill from AT&T.

special reportChurch employees first learned they were targets when the thief tried to acquire the phones from Verizon Wireless, which apparently learned its lesson from earlier fraud cases and rejected the purchase.

AT&T was more receptive, authorizing the purchase of more than a dozen phones bought on different days.

“I’m just amazed somebody would do that,” Pastor Preston Pitchford told WAVY-TV.

Church employee Christy Wells was even more stunned when the bill arrived.

“When I saw it was from AT&T, I was like, I know this has got to be him. He probably succeeded,” Wells told WAVY. “I see a charge to Fountain of Life for $10,000, and I knew that wasn’t for us. Who would even think to do something like this?”

The church doesn’t use iPhones and doesn’t have an account with AT&T.

[flv]http://www.phillipdampier.com/video/WAVY Norfolk Church billed 10K for fraudulent iPhone purchases 3-3-15.flv[/flv]

The Fountain of Life Ministries in Elizabeth City, N.C. was victimized twice by iPhone 6 fraud. Verizon Wireless rejected the fraudster’s first attempt, but AT&T accepted his second… for 17 iPhones. From WAVY-TV in Portsmouth, Va. (2:12)

Search This Site:

Contributions:

Recent Comments:

Your Account:

Stop the Cap!