Another Ameritrade break-in
Elvey
disposable email addresses; the address that had ONLY been given to
AMERITRADE included a security checksum, using a secret algorithm.
I've been receiving pump-n-dump spam (and no other kind of spam) to
this address since 11/11/06. This strongly suggests that AMERITRADE or
one of its affiliates has had its security compromised.
Won't be the first time...
http://groups.google.com/group/misc.invest.stocks/browse_frm/thread/a5e2c87a7ec28f3
Wonder what they'll say; I just emailed customer support.
I'm betting they'll send me some boilerplate about avoiding phishing
attempts. That is, if anyone's willing to bet against me.
arthur
They have several aliases too eg antichef
I have several ids so that I can have different 'fwd to' addresses.
I closed 4 Amerivest (owned by Ameritrade) a couple of years ago for
several reasons none of which happened to be spam but rather their
total lack of customer orientation... They made me feel like a sucker,
and lied in their advertising.
On 13 Nov 2006 20:20:28 -0800, "Elvey" <gg-p...@matthew.elvey.com>
wrote:
Dick...@unreachable1.eu
> Another Ameritrade break-in
>
> From: "Elvey" <gg-p...@matthew.elvey.com>
> Reply to: [1]"Elvey"
> Date: 13 Nov 2006 20:20:28 -0800
> Organization: http://groups.google.com
> Newsgroups:
> [2]misc.invest.stocks
> Followup to: [3]newsgroup
>It appears that TD AMERITRADE's security has been compromised. I use
>disposable email addresses; the address that had ONLY been given to
>AMERITRADE included a security checksum, using a secret algorithm.
>I've been receiving pump-n-dump spam (and no other kind of spam) to
>this address since 11/11/06. This strongly suggests that AMERITRADE or
>one of its affiliates has had its security compromised.
>Won't be the first time...
>7ec28f3
>
>Wonder what they'll say; I just emailed customer support.
>
>I'm betting they'll send me some boilerplate about avoiding phishing
>attempts. That is, if anyone's willing to bet against me.
and what is this security checksum and secret algorithm has to do with
preventing spam if one can get the address one way or the other? best joke
of the week!
so you use a disposable email, like from some third party site? one thing
i don't understand is why people think it's ok to store their emails on
other people's computers, especially those provide email service for free.
they use yahoo, gmail and the like to do e-commerce, open brokage
arrounts, etc. and think they have perfect privacy simply because they
have the password.
now, don't get me wrong, i ain't speaking for ameritrade. they've been
having this problem for years. the point is if you don't like it. either
sue them or take your business somewhere ele, but don't say something like
checksum and disposable address, it only hurts your credibility if you
decide to sue, for example.
Lawyerkill
Dick...@unreachable1.eu wrote:
> sue them or take your business somewhere ele, but don't say something like
> checksum and disposable address, it only hurts your credibility if you
> decide to sue, for example.
LK
Read their agreement, you agree not to sue in a court of law when you
sign up with them.
dick...@unreachable1.eu
> Re: Another Ameritrade break-in
>
> From: "Lawyerkill" <Lawye...@aol.com>
> Reply to: "Lawyerkill"
> Date: 14 Nov 2006 07:01:18 -0800
> Organization: http://groups.google.com
> Newsgroups:
> Followup to: newsgroup
> References:
> <1163478028.1...@m73g2000cwd.googlegroups.com>
> <newscache$wb6q8j$bq6$1...@news.rootshell.be>
yeah, so get over it. move your business, change your email or do nothing.
they know they can get away with it because they know (a) people don't
care, why would they if they can intrust their correspondences from secret
affairs to swiss bank emails to hotmail. (b) people are not sophiscated
enough to know what exactly is going on. and (c) they would just
continuously build up their email filter bigger and bigger and hope they
can filter out all spams before they filter all legit emails.
Lawyerkill
dick...@unreachable1.eu wrote:
> yeah, so get over it. move your business, change your email or do nothing.
> they know they can get away with it because they know (a) people don't
> care, why would they if they can intrust their correspondences from secret
> affairs to swiss bank emails to hotmail. (b) people are not sophiscated
> enough to know what exactly is going on. and (c) they would just
> continuously build up their email filter bigger and bigger and hope they
> can filter out all spams before they filter all legit emails.
LK
Get over what? I have no email or Ameritrade problems.
Elvey
Pies de Arcilla
Elvey wrote:
> It appears that TD AMERITRADE's security has been compromised. I use
> disposable email addresses; the address that had ONLY been given to
> AMERITRADE included a security checksum, using a secret algorithm.
> I've been receiving pump-n-dump spam (and no other kind of spam) to
> this address since 11/11/06. This strongly suggests that AMERITRADE or
> one of its affiliates has had its security compromised.
> Won't be the first time...
Same thing happened to me. I get almost no spam, but suddenly started
getting just what you describe. For some reason I didn't think of
Ameritrade...
Elvey
Pies de Arcilla wrote:
> Same thing happened to me. I get almost no spam, but suddenly started
> getting just what you describe. For some reason I didn't think of
> Ameritrade...
Using DEAs makes the difference between suspecting a security breach
(even perhaps a misread privacy policy) at an unknown time and place,
and knowing there's been a security breach, and having some evidence as
to when and where it occurred.
Heard back from Ameritrade.
Donald S., of Technology Support, TD AMERITRADE asked some
less-than-reassuring questions.
At least I got a reply.
He asked:
>To help us get to the source of the spam, we would appreciate it if you would reply to this message and provide the following:
>- The date the e-mail was received
>- The address the spam was sent to (your e-mail address)
>- The e-mail source (the "from" address)
I sent the spams with full headers.
I explained : The "from" address of an email does not indicate the
source. The Received headers reliably indicate the source.
I provided the address to Ameritrade on 10/24/06. It had received no
mail in the prior 4 years.
ynotssor
Elvey <gg-p...@matthew.elvey.com> wrote:
> I explained : The "from" address of an email does not indicate the
> source. The Received headers reliably indicate the source.
Not true: you can only place absolute confidence in the Received: header
place by *your* MTA (Mail Transport Agent), the last one in the list at the
top. All others are just as easily forged (and usually _are_ in professional
spam) as the From: address.
ConservativeCapital
www.conservativecapital.com . We are giving away a free Orlando, FL
vacation for 10. www.conservativecapital.com
On Nov 13, 11:20 pm, "Elvey" <gg-pub...@matthew.elvey.com> wrote:
> It appears that TD AMERITRADE's security has been compromised. I use
> disposable email addresses; the address that had ONLY been given to
> AMERITRADE included a security checksum, using a secret algorithm.
> I've been receiving pump-n-dump spam (and no other kind of spam) to
> this address since 11/11/06. This strongly suggests that AMERITRADE or
> one of its affiliates has had its security compromised.
> Won't be the first time...http://groups.google.com/group/misc.invest.stocks/browse_frm/thread/a...
Elvey
WHEN, exactly, did you get your first spam? If it's within days of
when I did, that's good evidence.
ynotssor wrote:
> In news:1163637911.2...@m73g2000cwd.googlegroups.com,
> Elvey <gg-p...@matthew.elvey.com> wrote:
>
> > I explained : The "from" address of an email does not indicate the
> > source. The Received headers reliably indicate the source.
>
> Not true:
What you say below is correct, but it serves to clarify, rather than
contradict what I said.
> you can only place absolute confidence in the Received: header
> place by *your* MTA (Mail Transport Agent), the last one in the list at the
> top. All others are just as easily forged (and usually _are_ in professional
> spam) as the From: address.
I could have made a more complete true statement, e.g.:
The Received headers reliably indicate the source, however, they need
to be interpreted by a skilled analyst. The fact that some may be
forged in no way makes the statement false.
Hopefully Ameritrade has such a person on staff, or is willing to
consult with such a person.
Oh, and ConservativeCapital is spamming this thread and newsgroup.
ynotssor
Elvey <gg-p...@matthew.elvey.com> wrote:
> Oh, and ConservativeCapital is spamming this thread and newsgroup.
And other newsgroups as well ... I'm grateful for killfiles.
dick...@unreachable1.eu
> Re: Another Ameritrade break-in
>
> From: "Elvey" <gg-p...@matthew.elvey.com>
> Reply to: "Elvey"
> Date: 15 Nov 2006 16:45:11 -0800
> Organization: http://groups.google.com
> Newsgroups:
> misc.invest.stocks
> Followup to: newsgroup
> References:
> <1163478028.1...@m73g2000cwd.googlegroups.com>
you are getting funnier and funnier. even if ameritrade has someone smart
enough to understand what you are talking about and figure out the ip that
connedted to your mail server, then what? what is important is whether
ameritrade has a security problem or whether ameritrade gave your email
address away, you are not likely to answer these "questions" with the
connection source of the spam. the spammer did not pretend to be
ameritrade itself, so whatever action you can or want to take with the
spammer is purely between you and the spammer, ameritrade has absolutely
no role in this.
if i knew your ameritrade-only email address and spam you, can ameritrade
do anything about me? nope. if they can find me broke into their system,
that's another matter. they detect this by looking through their system
logs, not your spam headers.
Don S
the discussions here so I am putting your worthless junk post's on do
not read status forever.
Don S
bob wald
they choose...
bob wald
companys...
are you over 12 yrs old????
com...@webtv.net
address and you will get spam.....
TAX ALL "MONEY TRANSFERS" TO MEXICO
com...@webtv.net
e-mail....which is what you did...
Blash
> I've wondered if pump-and-dump might explain certain stock market
> fluctuations - Autonomy for instance. Having worked for them (see below)
> its amazing how their share price has risen so much recently.
DEFINETLY!!!
According to our resident analyst and typewriter repair-man, anytime a
stock moves, it's just manipulation by "they/them".......
Elvey
evidence corroborating the problem, and pointing to Ameritrade, (not an
ISP between us) as the problem. I wonder if this triggers notice per
any Security Breach Notification Laws. My reading of California's
indicates it doesn't apply, based on the definition of "personal
information" used, but (as of July 18, 2006) at least 34 US states have
passed security breach notification laws; I'm not planning on checking
'em all...
( http://www.pirg.org/consumer/credit/statelaws.htm#breach )
Ameritrade is involved and responsible. Whether Ameritrade was cracked
or sold my address, a crime has occurred. The former is obviously
illegal, the latter violates my contract with TD Ameritrade, including
http://www.tdameritrade.com/privacy.html#whatinfo, which is also
criminal. No further word from them yet.
On Nov 17, 11:52 am, PL <p...@NO.NO.NO.paulSPAMlee.com> wrote:
> I've wondered if pump-and-dump might explain certain stock market
> fluctuation...
A study on stock spam's impact on stock prices was published recently.
The conclusion was that there were statistially significant moves,
consistent with pump-n-dump. I forget where I read of it; asked google.
Found references to 2 studies:
http://techdirt.com/articles/20060825/124422.shtml
Blash
> Ameritrade is involved and responsible. Whether Ameritrade was cracked
> or sold my address, a crime has occurred. The former is obviously
> illegal, the latter violates my contract with TD Ameritrade, including
> http://www.tdameritrade.com/privacy.html#whatinfo, which is also
> criminal. No further word from them yet.
You should sue for damages.....Your time is worth $X/hour and you
probably spent 3 seconds deleting that spam.....
Alan Bowler
Ameritrade had anything to do with it. As I see it he
got an new email address from a "free" email provider.
On of the ways these guys finance their services is by
selling such addresses, and the other is by putting up
ads that can include email harvesting via the browser.
Blash
at atbo...@thinkage.ca wrote on 11/20/06 12:34 PM:
I don't see where he can prove anything, but trying to file a law suit
will keep him busy & maybe cut down on the whining......
Ndugu Omba
if one would like to trace where spam comes from and have a gmail acc you
can use a google gmail trick to do so:
when giving your addy to a vendor do so in the form of --
username...@gmail.com
(Mail will still be delivered to the 'username" box)
So-- if you ONLY give ameritrade the addy --- yourna...@gmail.com -- and
then recieve Spam thru the "amtd" address, then you know it was ameritrade
who gave your addy away.
Elvey
letter saying they see no evidence of a problem, but are looking into
it.
What part of "the address that had ONLY been given to AMERITRADE
started receiving pump-n-dump spam right after I gave it to them" do
they (and the skeptics here) not understand?
Note the add'l details I've provided; the only plausible explanation
for what happened is that Ameritrade sold the address, or got hacked.
The others presented don't fit the facts.
Alan Bowler wrote:
> Actually he really has not offered any convincing evidence
> Ameritrade had anything to do with it. As I see it he
> got an new email address from a "free" email provider.
> On of the ways these guys finance their services is by
> selling such addresses, and the other is by putting up
> ads that can include email harvesting via the browser.
No. I'm talking about DEA services in particular, not generic free
email.
I believe no DEA vendor has ever been accused of doing what you're
proposing.
The address in question was of the form
TDAmer43 <at> matthew.elvey.com, where TDAmer indicates TD Ameritrade,
and 43 is the output of a secret hash algorithm.
matthew.elvey.com is hosted on a secure server; I know the admins well;
we even work together occasionally. I pay for the service, and they
have a good privacy policy and the passion, resources, expertise and
reputation required to provide a truly secure service.
The point of the checksum is obvious to me, but clearly not to the
security-challenged. Using DEAs makes the difference between
suspecting a security breach (even perhaps a misread privacy policy) at
an unknown time and place, and knowing there's been a security breach,
and having some evidence as to when and where it occurred. The point of
the checksum in particular is that it eliminates the possibility that
the spammer or his algorithm simply guessed a valid email address - no
spam was received at TDAmer42@, or TDAmer@...
In other words, what I had done is like what Ndugu Omba just suggested,
but with additional security steps.
(NOW HERE'S AN INTERESTING BIT! ON GOOGLE GROUPS, THIS THREAD IS
MARKED THUS:
In response to a legal complaint we received, we have removed one or
more messages. If you wish, you may read the legal complaint .
I can't find the legal complaint on the EFF's site; searched for
Ameritrade or Elvey, or misc.invest.stocks.
I guess google hasn't had time to post all the C&D's it's received;
only 1 in the past 3 months mentions google. Ok, looked at archives
elsewhere; seems an arguably disparaging post about AutoMUNGEnomy stock
was removed. Odd that anyone would bother to send a C&D about it.
Anyone who desires an archive of the relevant post, can contact me.)
I'm whining? Clearly, a crime has occurred. It's not a big step from
identity theft to outright financial theft, IMO. I have strong
evidence that Ameritrade is guilty of the former. Some folks with
Ameritrade accounts appreciate having the info I've provided.
To all readers with Ameritrade accounts: please login to your
Ameritrade account, and update your email address to a disposable email
address, and let us know what happens.
Yahoo, Gmail and these folks are among providers of DEAs:
http://search.dmoz.org/cgi-bin/search?search=disposable+email
On 11/16/06 12:08 PM, a guy who doesn't understand margin wrote:
> any information ameritrade has on you is thier <sic> property..to do with as
> they choose...
Yeah, in the sense that I could steal whatever I want.
There's just that 'until I'd get thrown in jail' caveat.
Mason G. Zhwiti
> Ameritrade had anything to do with it. As I see it he
> got an new email address from a "free" email provider.
> On of the ways these guys finance their services is by
> selling such addresses, and the other is by putting up
> ads that can include email harvesting via the browser.
Ameritrade is absolutely responsible. I have had this problem with them
several times now.
Each time, I created a unique address for them (on my own mail server),
just as I do for any company. Ameritrade's address was the only one to
ever receive spam out of over 100 unique company addresses I've
created.
On the third time, just to completely disprove their idea that I was
perhaps infected with a virus that revealed the address, or that my
server was dictionary attacked, I created an address with the pre-@
portion consisting of 48 random letters and numbers. I made sure that
that address never appeared on any of my computers. All I ever did with
it was update my ameritrade account with the new address. I even set it
so that any mail sent to it would just be stored, not forwarded
anywhere outside our servers.
I checked back with that address today, and I see 10 spams in the past
week, all for pump-and-dump of QCPC stock. (Incidentally, 95% of all
spam I've ever received at these ameritrade addresses is for pump and
dump scams.)
I just sent a new report into Ameritrade about this issue, since in the
past I never felt I could 100% prove it was on their end.
You might still think, well someone could have hacked my email server.
But please explain then why out of the 100s of custom addresses we've
created, only Ameritrade's have been spammed? And only after we change
our address on ameritrade's servers with the new one? And usually only
with stock scam spam? And corroborated my dozens of others that have
done similar tests here on usenet?
Ameritrade has either a serious security issue, or has performed a
serious breach of our privacy.
And while it may only take 10 seconds to delete all the spam I receive
from them in a week, I'm more concerned with what other of my private
information has been divulged. If Ameritrade was smart, they'd track
down this issue before it comes back to haunt them in the form of
bigger security issues and/or lawsuits related to it.
MGZ
Elvey
disappeared.
http://www.secureworks.com/research/threats/view.html?threat=spamthru-stats
has some more info on what's likely been going on:
It reads in part:
The SpamThru spammer has general lists of millions of email addresses.
In fact, one executable (detected by KAV as Backdoor.Win32.Agent.ail)
that was forcibly installed via the SpamThru bot remote-control
mechanism was specifically designed to harvest email addresses from
the hard drives of the infected systems - giving the spammer the
ability to reach individuals who have never published their email
address online or given it to anyone other than personal contacts.
It also appears the spammer also made an effort to obtain more
targeted lists of email addresses, by hacking into smaller investment
news websites and other e-businesses and downloading their user
databases. This is likely due to the fact that pump-and-dump stock
spam seems to be a primary motive of the botnet.
In the image below, we can see the result of one such hack, in one of
the files found on the control server. In this case, the MySQL
database of an online shop appears to have been downloaded using a
tool called r57shell. We know this was done in order to extract email
addresses, since a file containing just the email addresses from the
MySQL dump was found in the same directory.
I just gave ameritrade a new email address; we'll see what happens.
Most likely, there are key machines in their infrastructure that have
been compromised, and that's the root cause of this problem.
Mason, I emailed you; did you get my email?
This thread: http://snurl.com/ameritrade
Elvey
>
> I just gave ameritrade a new email address; we'll see what happens.
> Most likely, there are key machines in their infrastructure that have
> been compromised, and that's the root cause of this problem.
Well, Ameritrade's security measures are clearly grossly inadequate.
It took a 2 months, but I'm now getting several spams a day to that
new address I only gave ameritrade, (the address got no email at all
in the several years before I gave it to them).
The spam is all pump 'n dump for NWVM
Received: from balam.ceedyucatan.gob.mx (unknown [148.223.141.182])
Received: from thot.tis.com.ar (unknown [200.123.177.30])
Received: from smtp-1.orange.nl (smtp-1.orange.nl [193.252.22.241])
Received: from www.dc4.net (dc4.net [204.2.53.5])
Received: from alpha3.latrobe.edu.au (alpha3.latrobe.edu.au
[131.172.180.2])
Received: from ds-www.bt.com (unknown [62.7.244.97])
> Mason, I emailed you; did you get my email?
(We've been in touch)
> This thread:http://snurl.com/ameritrade
omega2007
spam and opening it. That too could download a spyware that would see other
email addresses.
"Elvey" <gg-p...@matthew.elvey.com> wrote in message
news:1176405832.9...@o5g2000hsb.googlegroups.com...
omega2007
AMTD
"Bill Gates(Email to me without 'this is not spam' in the subject is
directed straight to the trash unread by automatic filters.)"
<RoastedBi...@hotmail.com> wrote in message
news:1176484678.8...@p77g2000hsh.googlegroups.com...
> On Apr 12, 10:32 pm, "omega2007" <omega212...@earthlink.net> wrote:
>> Online broker may not be responsible for your actions like checking some
>> spam and opening it. That too could download a spyware that would see
>> other
>> email addresses.
>
> Spyware almost exclusively plagues Microsoft applications and Windows
> PCs. I'm using a Mac, and not with a Microsoft email application; I
> use Thunderbird. I'm a computer consultant. I have a Computer Science
> degree from Yale. If anyone can keep an Internet-connected computer
> secure, I can.
>
> If there are any infected computers, they're TD Ameritrade's.
>
> Because of TD Ameritrade's failure to resolve the problem, I just
> contacted a law firm that works in the privacy violations and
> securities firm areas doing class action cases and suggested they take
> a look at the matter. (Hello, Manuel.)
>
> http://www.tdameritrade.com/privacy.html is being violated.
>
>
>
>
>
>> >> This thread:http://snurl.com/ameritrade
>
>
VDGOOX...@spammotel.com
>
> It took a 2 months, but I'm now getting several spams a day to that
> new address I only gave ameritrade, (the address got no email at all
> in the several years before I gave it to them).
>
> The spam is all pump 'n dump for NWVM
Similar story here. After years of not receiving any spam on the
unique email addresses I had with TDA (/TDW), I started getting them
last November on 2 of the TDA addresses. At that time, none of the
TDW addresses were ever compromised. I then changed the 2 compromised
TDA addresses, and that was that.
Until April 11, when I received a spam on one of the previously
untouched TDW addresses. On April 12, I got spams on the newly
changed TDA address (I consolidated the 2 TDA addresses to 1). Then
on April 13, the second previously untouched TDW address was added to
the list. Today I'm receiving multiple spams on all 3 addresses.
The email I received from TDA in response to my complaint is word-for-
word identical to the one I received last Nov (except for the Client
Services reps' name). This despite the fact that when I wrote, I
said things that should have received a more serious response. It
appears to me that they really aren't concerned about this problem.
I'm not that concerned either, except for what it indicates about the
rest of their security, which concerns me greatly.
Bill Gates(Email to me without 'this is not spam' in the subject is directed straight to the trash unread by automatic filters.)
> It appears to me that they really aren't concerned about this problem.
> I'm not that concerned either, except for what it indicates about the
> rest of their security, which concerns me greatly.
Yeah, like if someone's TDAmeritrade account gets cleaned out, TDA
will have a hard time trying to claim that it was the victim's
security that was lax. Really dumb move; I'm sure Ameritrade accounts
get cleaned out by thieves on a regular basis, the Identity Theft Data
Clearinghouse is stuffed with records of this.
Blash
> I'm sure Ameritrade accounts
> get cleaned out by thieves on a regular basis, the Identity Theft Data
> Clearinghouse is stuffed with records of this.
I searched Google for these records......NONE showed up......any other
ideas???
Elvey
> Bill Gates at RoastedBillyGoa...@hotmail.com wrote on 4/14/07 10:17 PM:
Well, DUH! It's not a public database, as a google search (like the
one I just did) made clear.
You have to be in Law Enforcement to access the Identity Theft Data
Clearinghouse. We're not talking about n.a.n.a.s posts. (Which a
Google web search wouldn't find either!)