Protect your privacy:
Get NordVPN
[
Deal: 73% off 2-year plans + 3 extra months ]
- Meshnet Feature for Personal Encrypted Networks: NordVPN offers a unique feature called Meshnet, which allows users to connect their devices directly and securely over the internet. This means you can create your own private, encrypted network for activities like gaming, file sharing, or remote access to your home devices from anywhere in the world.
- RAM-Only Servers for Enhanced Security: Unlike many VPN providers, NordVPN uses RAM-only (diskless) servers. Since these servers run entirely on volatile memory, all data is wiped with every reboot. This ensures that no user data is stored long-term, significantly reducing the risk of data breaches and enhancing overall security.
- Servers in a Former Military Bunker: Some of NordVPN's servers are housed in a former military bunker located deep underground. This unique location provides an extra layer of physical security against natural disasters and unauthorized access, ensuring that the servers are protected in all circumstances.
- NordLynx Protocol with Double NAT Technology: NordVPN developed its own VPN protocol called NordLynx, built around the ultra-fast WireGuard protocol. What sets NordLynx apart is its implementation of a double Network Address Translation (NAT) system, which enhances user privacy without sacrificing speed. This innovative approach solves the potential privacy issues inherent in the standard WireGuard protocol.
- Dark Web Monitor Feature: NordVPN includes a feature known as Dark Web Monitor. This tool actively scans dark web sites and forums for credentials associated with your email address. If it detects that your information has been compromised or appears in any data breaches, it promptly alerts you so you can take necessary actions to protect your accounts.
“Marketing as Usual? Not a chance.” —Epsilon corporate catch phrase
A series of attacks on the Email Service Provider (ESP) community began in late 2009. The criminals spear-phish their way into these companies that provide out-sourced mailing infrastructure to their clients, who are companies of all types and sizes.
Upon gaining access to an ESP, the criminals then steal subscriber data (PII such as names, addresses, telephone numbers and email addresses, and in one case, Vehicle Identification Numbers). They then use ESPs’ mailing facility to send spam; to monetize their illicit acquisition, the criminals have spammed ads for fake Adobe Acrobat and Skype software.
On March 30, the Epsilon Interactive division of Alliance Data Marketing (ADS on NASDAQ) suffered a massive breach that upped the ante, substantially. Email lists of at least eight financial institutions were stolen.
The obvious issue at hand is the ability of the thieves to now undertake targeted spear-phishing, since they have names, email addresses and who these users did business with, which makes the problem as critically serious as it could possibly be.
What to do?
CAUCE is calling on the ESP and ISP/Receiver industries to implement these measures across the board, to protect the PII of end-users everywhere. What follows are best common practices that have existed for many years. It is time to take a stand against the data-thieves, and begin to properly protect end-users, without fail.
ESP & Senders
- Security must be the top corporate priority. Both Silverpop and Epsilon Interactive were either breached repeatedly, or failed to fully mitigate their initial security lapse in December. I was told by one ESP security staffer that he hadn’t been given sufficient resources to affect all the appropriate changes. That is at best lamentable.
- Two-factor authentication must be implemented for ESP system access for both staff and clients.
- Senders and ESPs must sign all email with DKIM, and authenticate all mailing IPs with SPF.
- ESPs must check all outbound content against domain blacklists such as SURBL and the Spamhaus DBL before deployment.
- ESPs and Senders must deploy extended-validation certificates on web properties.
- ESPs and brand owners should use the services of email authentication services such as Authentication Metrics , eCert, Return Path, and Truedomain as well as anti-phishing services like BrandProtect, Internet Identity and tools such as Lashback’s BrandAlert.
- ESPs must adopt and embrace a culture of transparency and commit to cooperative full disclosure
“Epsilon has refused to provide additional details on what other brands may have been affected.” —Security Week
“SilverPop did not respond to requests for comment” —Krebs on Security
While it is the instinctive corporate reaction to be secretive, such a strategy exacerbates the frustration of the other set of victims of data-theft, namely the end-users. A complete list of breached clients is fundamental to protecting end-users, and allowing them to protect themselves.
Receiving Systems
We need desperate measure for desperate times, CAUCE calls upon the receiving community to better their protection of end-users.
- Email receivers must follow Yahoo! Mail’s lead and deploy multi-layer phishing protection
- Email receivers must deploy DKIM and SPF checking, and treat messaging failing such checks accordingly by labeling the subject line, placing it in a spam folder, or blocking it entirely.
- Email receivers must deploy checks using URI blacklists like SURBL and Spamhaus on message headers and content domains.
- Email receivers must take extreme measures, even if there are false positives. Better safe that sorry, and given the potential damage these breaches can cause to a recipient, far better that there are false positives (legitimate email refused or sidetracked to the bulk folder) than false negatives (illicit email delivered to the inbox).
The list of breached companies
These financial institutions were affected by the breach:
- American Express
- Ameriprise Financial
- Barclays Bank of Delaware
- Capital One
- CITI
- JP Morgan Chase
- Moneygram
- Scottrade
- TD Ameritrade
- TIAA-CREF
- U.S. Bank
- World Financial Network National Bank (Victoria’s Secret card)
As well, these marketing and retail companies have reportedly had their client email, names and in some cases, other information stolen:
- 1800Flowers.com
- AbeBooks (division of Amazon)
- Airmiles
- Beachbody
- Benefit Cosmetics
- Best Buy
- Best Buy Canada Reward Zone
- Brookstone
- City Market
- CollegeBoard
- Dillons
- Disney Destinations
- Eileen Fisher
- Ethan Allen
- Food 4 Less
- Fred Meyer
- Fry’s
- Hilton HHonors
- Home Shopping Network
- Jay C
- King Soopers
- Krogers
- Lacoste
- L.L. Bean credit card
- Marks and Spencer
- Marriott Rewards (Update: Marriottt confirmed NO points totals were taken)
- McKinsey Quarterly
- New York & Company
- QFC
- Ralphs
- Red Roof Inns
- Ritz-Carlton (Update: Ritz-Carlton confirmed NO points totals were taken)
- Robert Half
- Smith’s
- Soccer.com
- Target
- TiVo
- Verizon
- Viking River Cruises (unconfirmed)
- Walgreens (for the second time)
Seemingly *some* people have been contacted by the affected companies to warn them about the breach. I’m on several of these lists and am yet to receive any warnings, which I’m not overly impressed about.