Archive

Archive for May 24, 2019

Security Gap Leaves 885 Million Mortgage Documents Exposed by NICOLE PERLROTH and STACY COWLEY


By NICOLE PERLROTH and STACY COWLEY

The data, collected by First American Financial Corporation, included hundreds of millions of detailed and personal financial records.

Published: May 23, 2019 at 07:00PM

from NYT Technology https://nyti.ms/2EvSvvL
via IFTTT

Categories: Internet Tags: ,

Security Gap Leaves 885 Million Mortgage Documents Exposed by NICOLE PERLROTH and STACY COWLEY


By NICOLE PERLROTH and STACY COWLEY

The data, collected by First American Financial Corporation, included hundreds of millions of detailed and personal financial records.

Published: May 23, 2019 at 07:00PM

from NYT Technology https://nyti.ms/2EvSvvL
via IFTTT

Categories: Internet Tags: ,

Cómo abrir el asistente de Google: todas las formas posibles

El Asistente de Google está cerca de celebrar su tercer cumpleaños, y durante su breve tiempo de vida ha logrado convertirse en el mejor aliado de millones de usuarios de dispositivos Android de todo el mundo. Otros, en cambio, aún no se han adentrado en el extenso mundo de la IA de Google, y se están perdiendo todo lo que este asistente virtual puede hacer por ayudarlos. Si eres uno

Entra en Andro4all para leer el artículo completo

Puedes unirte a nosotros en Twitter, Facebook o en Google+

¡Suscríbete a nuestro canal de YouTube!

Publicado recientemente en Andro4all

from Andro4all http://bit.ly/2HPxrBk
via IFTTT

Categories: Internet Tags: , ,

First American Financial Corp Left Mortgage Data Exposed on Website

from Dark Reading: https://ubm.io/2VJueIs
via IFTTT

Gadget Lab Podcast: Samsung’s Innovation Dilemma

David Eun, president of Samsung’s innovation arm NEXT, says younger consumers are shifting towards experiences, not things. What does that mean for a company that makes devices?

from Gear Latest http://bit.ly/2Ey2WPv
via IFTTT

Categories: Internet Tags: ,

Apple’s MacBook Pro Keyboard Fix Comes Down to Tiny Tweaks

There are at least two material differences in the 2019 MacBook Pro keyboard, intended to fix its sticky keys.

from Gear Latest http://bit.ly/2Wrzzs8
via IFTTT

Categories: Internet Tags: ,

First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records

The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. [NYSE:FAF] leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images — were available without authentication to anyone with a Web browser.

First American Financial Corp. Image: Linkedin.

Santa Ana, Calif.-based First American is a leading provider of title insurance and settlement services to the real estate and mortgage industries. It employs some 18,000 people and brought in more than $5.7 billion in 2018.

Earlier this week, KrebsOnSecurity was contacted by a real estate developer in Washington state who said he’d had little luck getting a response from the company about what he found, which was that a portion of its Web site (firstam.com) was leaking tens if not hundreds of millions of records. He said anyone who knew the URL for a valid document at the Web site could view other documents just by modifying a single digit in the link.

And this would potentially include anyone who’s ever been sent a document link via email by First American.

KrebsOnSecurity confirmed the real estate developer’s findings, which indicate that First American’s Web site exposed approximately 885 million files, the earliest dating back more than 16 years. No authentication was required to read the documents.

Many of the exposed files are records of wire transactions with bank account numbers and other information from home or property buyers and sellers. Ben Shoval, the developer who notified KrebsOnSecurity about the data exposure, said that’s because First American is one of the most widely-used companies for real estate title insurance and for closing real estate deals — where both parties to the sale meet in a room and sign stacks of legal documents.

“Closing agencies are supposed to be the only neutral party that doesn’t represent someone else’s interest, and you’re required to have title insurance if you have any kind of mortgage,” Shoval said.

“The title insurance agency collects all kinds of documents from both the buyer and seller, including Social Security numbers, drivers licenses, account statements, and even internal corporate documents if you’re a small business. You give them all kinds of private information and you expect that to stay private.

Shoval shared a document link he’d been given by First American from a recent transaction, which referenced a record number that was nine digits long and dated April 2019. Modifying the document number in his link by numbers in either direction yielded other peoples’ records before or after the same date and time, indicating the document numbers may have been issued sequentially.

The earliest document number available on the site – 000000075 — referenced a real estate transaction from 2003. From there, the dates on the documents get closer to real time with each forward increment in the record number.

A redacted screenshot of one of many millions of sensitive records exposed by First American’s Web site.

As of the morning of May 24, firstam.com was returning documents up to the present day (885,000,000+), including many PDFs and post-dated forms for upcoming real estate closings. By 2 p.m. ET Friday, the company had disabled the site that served the records. It’s yet not clear how long the site remained in its promiscuous state.

First American wouldn’t comment on the overall number of records potentially exposed via their site, or how long those records were publicly available. But a spokesperson for the company did share the following statement:

“First American has learned of a design defect in an application that made possible unauthorized access to customer data.  At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information. The company took immediate action to address the situation and shut down external access to the application. We are currently evaluating what effect, if any, this had on the security of customer information. We will have no further comment until our internal review is completed.”

I should emphasize that these documents were merely available from First American’s Web site; I do not have any information on whether this fact was known to fraudsters previously, nor do I have any information to suggest the documents were somehow mass-harvested (although a low-and-slow or distributed indexing of this data would not have been difficult for even a novice attacker).

Nevertheless, the information exposed by First American would be a virtual gold mine for phishers and scammers involved in so-called Business Email Compromise (BEC) scams, which often impersonate real estate agents, closing agencies, title and escrow firms in a bid to trick property buyers into wiring funds to fraudsters. According to the FBI, BEC scams are the most costly form of cybercrime today.

Armed with a single link to a First American document, BEC scammers would have an endless supply of very convincing phishing templates to use. A database like this also would give fraudsters a constant feed of new information about upcoming real estate financial transactions — including the email addresses, names and phone numbers of the closing agents and buyers.

As noted in past stories here, these types of data exposures are some of the most common yet preventable. In December 2018, the parent company of Kay Jewelers and Jared Jewelers fixed a weakness in their site that exposed the order information for all of their online customers.

In August 2018, financial industry giant Fiserv Inc. fixed a bug reported by KrebsOnSecurity that exposed personal and financial details of countless customers across hundreds of bank Web sites.

In July 2018, identity theft protection service LifeLock corrected an information disclosure flaw that exposed the email address of millions of subscribers. And in April 2018, PaneraBread.com remedied a weakness exposing millions of customer names, email and physical addresses, birthdays and partial credit card numbers.

from Krebs on Security http://bit.ly/2W2dHEl
via IFTTT