[ news_security_news ]
AT&T Crack One Part Of Attack
David Utter
Staff Writer
2006-09-01
 Insider Reports RSS Feed
The breach in the AT&T online store that exposed details of customers who purchased DSL equipment through the site was just the first step in a much deeper criminal scheme.
It seems that AT&T's disclosure of an attack on its web store resources was, in the words of Obi-Wan Kenobi, true from a certain point of view.
While the attack did take place, the San Francisco Chronicle reported that the crime had a much greater impact than just the crack that took place:
Internal company documents show that the security breach was only the first step in a more elaborate scam that involved bogus e-mail being sent to AT&T customers that attempted to trick them into revealing additional info that could be used for widespread fraud or identity theft.
"We haven't seen anything like this before," acknowledged Walt Sharp, an AT&T spokesman.
Neither did anyone covering the story based on AT&T's egregiously incomplete information, either. Chronicle writer David Lazarus obtained a copy of an internal memo that zipped around AT&T while its media relations people were putting out the company statement about the break-in:
(T)he security breach occurred Saturday not within AT&T's own system but at "an AT&T vendor that operates an order processing computer" for the online DSL store.
"The information that was provided by customers who ordered DSL-related equipment included name, address, e-mail address, phone number, credit card number and credit card expiration," the memo says, adding that the hacked data didn't include Social Security numbers or birth dates.
The criminals promptly put a phishing scam into play. They sent out emails purporting to be from SBCdslstore.com, and claimed the victim's credit card had been declined. Those emails were faked to look like AT&T orders, and contained details like the person's address and last four digits of the credit card used.
A link from the phishing email led to a spoof site at SBCdslstore.org, a domain not owned by AT&T. That site asked for more personal information, including the important birth dates and Social Security numbers the criminals would need to pull off a number of identity thefts.
---
Tag: AT&T
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
