Hag's Blog by John Haggard

How To Pull a Rabbit Out of Chase’s Hole…

Almost a month ago I entered into the Chase Bank fraud rabbit hole – a world tour of patched together customer service departments that strained my international ear and had me begging for the return of Muzak.

Today I now stand with a new credit card with a matching credit limit of my old card, but with out the balance. Yes, I still have the balance on the old card to pay, but now I have a new card, a new credit limit, and if I wanted, a new spending spree.

To put this into perspective, I get a very well crafted fraudulent email, I don’t bite, but I do check my account online, enter the rabbit hole, and come out with new account with double the credit amount on paper. To be sure only the newly opened account is open, but the account is a fresh account that mirrors the old. WTF? I just wanted my online account reset. What happened to a new password and a new card?

I have no idea yet if I have access to these accounts online (my original objective) because I’m exhausted. I have no stomach for entering the rabbit hole any time soon – even if I have the damned rabbit.

Email Fraud and the Chase Bank Rabbit Hole…

Below is a fraudulent email sent to me in an attempt to obtain my account user id and static password. What makes this email scam particularly attractive is I rarely use my Chase account and when I go to the legitimate site, it seems to echo what is being said below – that my account has problems, and it did!

From: Chase Bank [mailto:online@onlinebanking.chase.com]
Sent: Monday, June 20, 2011 9:16 AM
To: undisclosed-recipients:
Subject: Important Alert!

Chase Bank Online® Department Notice
You have received this email because you or someone had used your account from different locations.
For security purpose, we are required to open an investigation into this matter.
In order to safeguard your account, we require that you confirm your banking details.
To help speed up this process, please access the following link so we can complete the verification of
your Chase Online® Banking Account registration information :
To get started, please click the link below:

https://www.chase.com
Please Note:
If we do no receive the appropriate account verification within 48 hours, then we will assume this Chase Bank account is fraudulent and will be suspended. The purpose of this verification is to ensure that your bank account has not been fraudulently used and to combat the fraud from our community.
Regards,
Chase Bank - Chase Online® Banking Department

Securities (including mutual funds and variable life insurance), annuities and insurance products are not bank deposits and are not insured by the FDIC or any other agency of the United States, nor are they obligations of, nor insured or guaranteed by, JPMorgan Chase Bank, N.A., CISC, CIA, CMIA or their affiliates. Securities (including mutual funds and variable life insurance) and annuities involve investment risks, including the possible loss of value.

Here you see the bogus web site: http://c-spin.net/cgi-sys/suspendedpage.cgi. They were taken down, so no threat.

What sucks is the real URL did this to me when I tried to double check to make sure all was fine:

Note that I get an IE warning about the Chase web site. These types of warnings are danger signals that make me not trust using Chase at all. It creates fear. It is poor web design to use fancy designs that call into question the security of your site.

So, at 10:50 AM on Monday June 20th, I pick up the phone - here is what happened:

10:50, I call the reactivation process (877-242-7372). I followed the automated instructions (hit 2), entered my account number printed on my card statement.

10:52,  #1 person tells me my account is closed. I explain I am staring at my statement which clearly shows no problems. Agent says she handles debit cards and I need to go to the credit card department, long wait transfer

10:58, #2 Tracy came on and said my account was closed.  I explained I don’t use my physical card anyway, but have open account and simply want online access to the account information to manage it. That got me transferred to the Internet desk in India. I have to repeat my personal information for the third time. I get placed on hold with horrible quality loud distorted music. The image of Chase is reaching new lows as I’m listening.

BTW, this log is being generated real time while I’m waiting…… 11:15. I begin to take names and departments as know I’m in the rabbit hole.

11:16, #3 Sushma informed me that I need a new credit card number. I don’t want a new credit card; I simply want online access to my account to monitor an open Chase account. Back on hold…

11:19, Sushma is going transfer me to ISC. I have an online fraud alert on my account it seems (this supports what the fraud email has told me)

11:21, again transfer to hold and loud distorted music. I’m amazed that the 2nd largest US bank has such a poor quality phone system?

11:25, #4 Nancy answers from “Telephone Banking” with poor headset is attempting to pick up this issue. I have no idea how or why Nancy’s department got into this mix. Best she can see is my online access can’t be established because I don’t have an active card. I have an active account, but not a card. It seems a fraud issue was being checked into when the account was flagged. Nancy attempts to adjust headset, but little success. Every sentence has to be repeated.

11:29, put on hold to determine where to transfer and again, loud distorted music.

11:31, Nancy says she is transferring me to “Electronic Money Movement “ – I’m like “Uh?”

11:39, #5 Calandre in “Operations Preventions Department” cannot find the account number and says it is closed and case closed. Calandre said to go into a branch and figure it out. Remember, what started this off is an email and what I want is to NOT go into a bank. She doesn’t see any fraud, gives me 800-945-2006, a tough love lecture, and transfers me.

11:47, Automated system and I enter card number, zip code and it coughs up all my balance details. A bit strange to have all my balance details accessible with only an account number and zip code?

11:49 #6 Tiffany in credit card department answers. Finally a quality phone connection, coupled with an aware person. Tiffany has instant credibility. My card ending in 3832 is indeed marked closed. Tiffany used to work in the security department so she understands to read the account notes to see what is happening – notes indicate 04/10 fraud report which was valid, January 2011 address change request which was valid, then I called in to get something changed and they needed to call me back. I recall this happening and I recall calling Chase back 3 times because they never returned my call to verify me. The account was then closed without any thing being sent. Bill however continued and my payments continued. We both have a clearer picture of what happened.

11:58, Tiffany puts me on hold so she can contact security folks to get this straightened out – I feel comfortable knowing she is working toward a resolution. Chase image rising with Tiffany.

12:15, Tiffany spoke to supervisor and needed to do some research and apologized for long hold. Tiffany is a professional.

12:16, Trish didn’t answer. Tiffany was frustrated and said “never mind, let me explain what the status is.” She explained that since the account was not able to be verified in January, it was closed. Because it has been so long the account has been marked as permanently closed and cannot be reopened. I have to reapply, the balance is forever linked to a closed account and can never be viewable via an online account. Paper is the only option. This account is setup to be paid automatically from my USBank account.

12:26, Call ended 1 hour and 36 minutes.

Whew…. There has to be a better way.

Insyndia, My New Home

 

 

Today I am pleased to announce that I have merged my consulting practice into Insyndia Corporation. Insyndia is led by two likeminded professionals, Lance Gaines and Kevin Casey, who I have the privilege to call business partners.

I met Lance in December of 2006 in the most unlikely manner; I was helping a new firm launch biometric secured USB devices and Lance, as CTO of his company, had purchased some USB products for a very strange purpose – to hold random numbers generated by another company I was helping ID Quantique. I was floored that in my back yard someone not only understood the security implications of using the properties of single photons for random numbers (Quantum Random Number Generators), but they were already basing new products on these properties. Lance was not only using my favorite two company’s products, he was doing it at the same time (something I hadn’t thought to do). I think I made it to Tacoma to visit Lance in record time.

What I found in Lance was an incredibly talented and approachable technologist who was both a dreamer and a realist. He had a firm grasp on the science, the applications, the market potential, and importantly the restrictions all at once. He gained my trust immediately and over the years that trust has grown.

I met Kevin a while later when he was brought in to launch Lance’s team’s resulting product. Kevin had the unmistakable military “can do” spirit and he immediately reminded me of another treasured partner of mine Rick Vaden (now with IBM). Rick and I saw many business battles; some we won and some we survived, barely. I recall taking note of Kevin and wondering if he was as good as Rick, he had the potential clearly, but that is a high bar to cross. I also recall leaving convinced that Kevin had an uncanny ability to know precisely what the next indicated thing to do was (everyone else was considering while Kevin was doing). He did this with enthusiastic humility which made a believer out of me; I knew Kevin was a man to be counted on.

I followed Lance and Kevin as they followed the dream at their former company, I watched them deal with business ethics as they were confronted with tests not of their making; and I witnessed bi-directional loyalty between them and a their team. The whole team has been tested, not just Lance and Kevin.

Lance and Kevin did the right thing and created Insyndia with trusted associates from past business ventures. Initially seen as a vehicle to survive, Insyndia, as an organization, quickly learned they had a viable growing business that was interesting in of itself. By providing large scale integration services in places that no others could or would go has proven to be of enormous benefit. Not only are these projects tough and profitable, they enabled Insyndia to enter into even more interesting business models. They spent last year growing the infrastructure of talent, equipment, customers, and experience that can now be leveraged.

Insyndia is not a simple systems integration company; Insyndia’s team has the imagination to ignite and inspire not only IT customers, but also IT vendors. The tag line is not a marketing throwaway line, it is meaningful; just ask a few clients who have experienced the ignition phase.

Earlier this year several conditions arose that made this union possible: a) I sat down to help Lance and Kevin to discuss launching one of their product ideas b) Kevin reached out to help me with one of my other clients, c) I found myself with yet another exciting new product launch, d) Insyndia received the SDVOSB badge (Service Disabled Veteran Owned Small Business) giving them, and their partners, access to large set aside pools of $$ and e) it became crystal clear that we not only could leverage our collective imaginations and assets, but we needed each other. The three of us bring unique non-overlapping skill and experience sets to the table - and we trust; the most important ingredient.

It should be noted that Ken McLarin is also a Managing Partner who is explicitly trusted by myself through his long history with Lance. I’ve met with Ken and he clearly brings to the team the ability to mobilize staffing for large Microsoft systems implementations. Ken gives us our expanding/contracting technical staff that enables us to engage customers quickly and efficiently. Not only can we engage Microsoft projects, but we can also staff up implementations of our partners’ products over time as well. Ken’s unit, Descry, makes sure we have the talent and the infrastructure to support their needs. Read the press release announcing Descry last week here.

I join the Insyndia team as Managing Partner and SVP of Strategy. My role is to further assist existing business units grow and mature, but more importantly to establish Insyndia as a global launch platform for new and emerging vendors who have exciting products to offer the world. In some cases, new products are being developed under Insyndia’s guidance and capital. In other cases, new products have already been developed by outside vendors and need to be launched in specific markets.

Within a few days we’ll be announcing the launch of an exciting new player into the world of strong authentication. The product is a game changer for One Time Password devices and our job is to tell the world. Insyndia will be compensated for launch coordination, but has a front row financial position to share in the success of the sales. We have numerous such ignitions ahead of us; it should be an inspiring year.

Google One Time Password Setup - Holy Crap!

So you want to secure your Google Account? I know a bit about deploying 2 factor authentication (former COO/CTO of VASCO Data Security).

For a techie, I get goose bumps watching this the QR work. As a sales person trying to explain how it works, I get nervous twitches. As a support person I go “OMG.” And finally as a OTP specialist, I am absolutely horrified by my demo below – it shows the main weakness in the system – the QR code is reusable when knuckleheads like me attempt so show how this works.

Lets walk through the Google use case ….

First, figure out if you are ready to enter….

 

Select your device of choice and my iPhone is the perfect body appendage to select….

 

 

Now the cool part, click “next” and very cool QR code comes up to

 

Pull out your Iphone app (first download the Google Authenticator app from the iTunes App store – free) and fire it up….

1)      2)     3)

Now the really bad part…. The QR code above can be scanned by you (like right now) and you too can have my OTP for my account. If anybody in the middle captures the cool QR code image  and posts it up on the net (like I did), then that sucker will populate any iPhone with my identity.

I have invalidated the above QR code, but not after gasping in horror as my phone scanned the picture above and installed a duplicate OTP displaying the exact same rolling OTP as my first scan produced – it was an “oh God” moment.

Now below you verify the OTP so the loop is closed…

And now comes the creepy backdoor stuff that is why we use OTP’s to begin with – sticky notes with passwords stuck to the computer….

 

 

Yep. here are your 10 passwords you can stick to your computer for when your iPhone is forgotten and you are locked out….

 

 

This is better, but assuming my iPhone is lost, sending a SMS isn’t going to help much, so probably should go with voice messages. If this fails, Google offers a account recovery menu from hell (which is what it should be so people only take this trip a few times).

 

 

They check it out to make sure it works…..

 

And it did….

 

Now for my very complicated static password for all those apps that are not interactive (like Outlook, or email on phones, etc). All Google does here is scare you a bit. Actual static password several pages down….

 

Now it is time to turn this sucker on….

 

 

I’m live (I hope)….

 

Here we go for the first test drive…. user id and my normal password are still required…..

 

And here we are! I’m prompted for 2 factor authentication code which is a time based One Time Based password which I’m assuming is OATH compliant.

 

 

 

I go to my iPhone and fire up Google Authenticator app and there is my OTP along with the account it goes with (not real good to tell someone who picks up my phone which account to use the OTP with)…

 

Enter it in (you have to be fast because this sucker is on a tight 30 second window)…

 

I’m now all set up and ready to roll except I have to take care of those pesky apps that have no dialog capability. I need a static complicated password in addition to my old remembered static password. Click the “Create Passwords” to get started….

Now I get a confusing list of information. First, I see all the places that I’ve allowed my Google id to be used from – if I want I can revoke them here. Thanks. But the real deal is “Application-specific” passwords.

This should be “lets create a list of static passwords that you can give a label to and we’ll accept any of those complicated static passwords instead of your “userid/your old remembered static password/OTP.” Get that?

I didn’t at first, so I created one label and then hit create password and cut and pasted it into my Picasa, Outlook, iPad, and iPhone email apps. I could have created a bunch of passwords if I wanted.

I also could print them out and tape them next to the 10 backup OTP’s taped to the wall too.

 

 

Now I’m all done and totally secure, I get a nice email to tell my how much better things are. I now have the following:

1) Google identity – jhaggard1

2) Google static password – xxxxxxxxx

3) Google Authenticator OTP registered on my iPhone for generating my OTP

4) A List of Google generated static passwords to use when logon doesn’t support interactive OTP’s

5) A list of 10 backdoor OTP’s in case I need them taped to the wall.

 

Wow I feel better already….not.

How to Make Things Right… Great Job (but I’m still irked…)

You can see the comment below on my earlier posting, but it deserves to get lifted to its own blog because, for all the CEO’s out there, this is how you correct things when wheels have come off. In this case, an automated business spam that got personal when their contact management inserted my name instead of a company name.

I sent Christian a LinkedIn invite due to his industry background so maybe we can help each other out in the end – but I’m not purchasing his system :).

 

John,

On behalf of Palisade Systems, let me apologize for what can be interpreted as a FUD email. You're right, this is no way to start a relationship, and I'm personally looking into our email messaging to make sure nothing like this happens again.

Sorry that this was your first contact with our organization. Hopefully future contacts will be much improved.

Best, Christian Renaud, CEO, Palisade Systems

Posted by: Christian Renaud | September 17, 2010 at 07:22 AM

How NOT to Sell Data Security…

Below is an email that takes the “FEAR” approach to selling data security -   by threatening me with a f’ing $5,000,000 fine. Great job in pissing me off Trish!

I’ve been in this business a long time and fear doesn’t result in $$ for security. Even if it does, the customer is a reluctant, captured, draftee that will bolt the first chance they get.

Nothing like a good threat to start off a relationship… Jesus.

….

From: no-reply@salesforce.com [mailto:no-reply@salesforce.com] On Behalf Of Trish Gundy
Sent: Thursday, September 16, 2010 2:24 PM
To: john@haggardmail.net
Subject: $5 million fine for failing to protect customers' data

Hi JOHN,

Nobody wants to be fined for failing to protect their customers’ data. Yet that’s exactly what might happen to JOHN HAGGARD, if you’re not protecting the privacy of information going from your internal network to the Internet.

What are you doing to protect your business and your reputation from data leaks?

Did you know that the average cost of a data leak is roughly $204 per lost record**, according to a Ponemon Institute study this year? The minimum cost of a data loss incident was $750,000 for companies included in the study.

Companies like JOHN HAGGARD are protecting themselves painlessly, enjoying the benefits of Data Loss Prevention (DLP) through solutions from Palisade Systems, Inc.

Palisade Systems, Inc. is the DLP leader. Palisade's PacketSure™ solution provides visibility to help you control and protect proprietary and confidential information leaving your organization's network, without disrupting business processes. Protected information includes:

• Private Health Information

• Credit Card numbers

• Social Security numbers

• Financial data

• Intellectual property

PacketSure™ helps your organization comply with regulations, including HIPAA, GLBA, and Sarbanes-Oxley (SOX), as well as state privacy laws and PCI Data Security standards.

Let’s schedule an interactive web session to discuss your security needs and goals this Friday, September 17 or next Tuesday, September 21 at 9:00am PST.

Will that day and time work with your schedule?

Please confirm the date and time that works for you and I will set up a meeting invitation and send that to you and your team.

JOHN, thank you in advance for letting me introduce Palisade Systems, Inc. If you have any questions please call me at 714-290-3080.

Best regards,

Trish Gundy

Regional Director, West

Palisade Systems, Inc.

714-290-3080

trish@palisadesystems.com

*http://www.businessweek.com/globalbiz/content/jul2009/gb20090723_375115.htm

**http://www.ponemon.org/news-2/23

Control Your Info – Ethical? No. Effective? Yes.

The issue is Facebook Groups where an administrator leaves the group (for a wide variety of reasons) thereby exposing the group’s administrative ownership. Evidently anybody can take control which is what this “Control Your Info” group has done.

I saw this posted today via my CNET feed (http://news.cnet.com/8301-17939_109-10394058-2.html?tag=nl.e703) and checked it out. The comments vary but the actual comments above by an actual victim of the exposure sums it up best – I love Kevin’s zeal.

This group had their administrator die, hence group left open, and their group has been “hijacked” and disrupted.

The counter to this can be seen at: http://www.youtube.com/user/controlyourinfo

The bottom line for FB? Figure out better way to deal with orphaned groups – at least be a member older than 30 days and give notice to those who are members of orphaned status to step up or cease to exist. 

The bottom line for users of groups? Pay attention to your group memberships and consider all memberships to be public knowledge – anyone in that group can disclose your membership status.

I just reviewed my groups and yes, I needed to clean them up.

Thanks “Control Your Info” – I think.

Facebook Privacy Settings

Bev,

I received a friend request from xxxx which I’m letting pass (out of respect for everyone) for now, however, this is a good time to consider ramifications of privacy that everyone needs to be aware of.

So some basics on Facebook Privacy – it is NOT protection by default (my old ACF2 ways are still with me).

First, block who you don’t want to interact with. Select “Settings/Privacy Settings” and enter the name of the person you wish to block. This is a good idea to explicitly block names which you just wish to not have hanging around or who get access through a loophole in another setting.

Next, stop everyone from seeing your stuff by changing the default values of the Privacy Setting to more restrictive options.

Select “Settings/Privacy Settings/Profile” and restrict your information to your friend’s. Note the test area that you can use to see how you look to others – very handy.

Select “Settings/Privacy Settings/Search” and unclick the “My friend list” This is a powerful tool that allows anyone to see your relationships. This halts that.

Select “Settings/Privacy Settings/News Feed and Wall” and understand the highlighted area. If you write on my wall, then all my friends will see that. If you write on your wall and I see it, that doesn’t mean my friends can see that.

Select “Settings/Privacy Settings/Applications (Settings)”  This is an important setting as you restrict how much info of yours gets used by your Friend’s applications (i.e. advertising info gathered this way to target you for ads).

Coolest Mashup for Motorcycle Riders - Automated Google Street View Rides

I recently took a ride through the Gifford Pinchot National Forest and was stunned to see NFD 90 and NFD 30/Wind River Rd were mapped out by Google's van (I want that job/route btw). Problem is I've always been stumped why I had to manually move the little stick figure or click my way down streets and wanted to "fly" down the streets as if in the damn van. This may still be possible and I might just be missing something, but when I checked around, I finally found this life saver:

 

 http://gmaps-samples.googlecode.com/svn/trunk/streetview/streetview_directions.html

 

It has limitations but well worth getting used to them. First, the addresses must be better vetted out before they are accepted by this little sample app. For example, for a section of my trip put in "NFD 90 Rd & Ingress Way, Stevenson, WA 98648" in the "FROM" field and paste "Stabler, Washington" in the "TO" field. This particular stretch of road is simply heaven for bikers of all stripes.

Now you are ready to take a beautiful ride. The "SPEED" setting is a bit flaky and I can only get the "Medium" to work for this particular trip (van probably set to minimum data collection setting?).

You can click the highlighted waypoints listed in the directions pane to jump the view, unfortunately I have found no other way to fast forward to get to the juicy part. At anytime, you can stop and then drag the picture to get a complete 360 view of any spot. This is excellent for locating a point of interest such as viewpoints or simply pull-over spots. 

Enjoy. 

 

Public Copyright Declaration - SSO Stick© & SSO Card©

This describes Single SignOn USB Stick & Smart Card devices whereas the initial authentication of a person is performed by the device itself. Subsequent communication (i.e SSO) of the identity of the user is performed through the exchange of SAML compliant data packets.