ESET Threat Blog

I'll see your Epsilon mail addresses and raise you 3 1/2 million Texans' personal records.
While the Epsilon leak got an excessive amount of media attention, given its limited potential for phishing (let alone spear phishing), it seems bizarre that there hasn't been much more attention paid to the exposure of all those employment/retirement records exposed for, reportedly, … Read More…

My attention was just grabbed by a Infosec Island post on Social Security Numbers Easily Cracked, by Robert Siciliano. That's because I remembered quite a lot of fuss about it being made back in 2009.
And it turns out that the article, though posted today, is actually referring back to an article from July 2009 by Robert … Read More…

The Register reports that "Home Secretary Alan Johnson has confirmed that the National Identity Register contains National Insurance numbers and answers to 'shared secrets'."
See: http://www.theregister.co.uk/2010/01/07/id_register_includes_ni_numbers/
Johnson was responding to a parliamentary question about "what information will be held on the National Identity Register which is not held on the UK Passport Database."
Inevitably, there will be concerns … Read More…

A number of new papers have been added to the white papers page:

Cristian Borghello’s "Playing Dirty" is a translation of his original Spanish paper, available on the ESET Latin America web site, and describes in detail how criminals make money out of stealing online gaming credentials and assets. http://www.eset.com/download/whitepapers/EsetWP-PlayingDirty20090812.pdf
My paper "Social Security Numbers: Identification is … Read More…

The results (released yesterday) from a study conducted by the Ponemon Institute yielded some interesting data points. The most visible of these was the finding that 85% of U.S. organizations experienced data breaches of varying magnitudes. This study, entitled "U.S. Enterprise Encryption Trends", has completed its fourth annual publication.  The data was directly obtained from … Read More…

How secure is your Social Security Number? If your answer is "Very: I only ever give it to organizations who are entitled to know it", that may not be as safe as it sounds. Of course, there are a couple of fairly generic issues:

some legitimate, convenient organizations may ask for it who are, nevertheless, not … Read More…