Gareth Wright, a U.K.-based app developer for Android and iOS, has discovered a security hole in Facebook’s native mobile apps that he says can be used to steal personal information about you. The problem is that Facebook’s apps for the two platforms do not encrypt your login credentials, meaning they can be easily swiped over a USB connection, or more likely, via malicious apps.

http://liarcatchers.com/identity_theft_investigation.html

Wright detailed the issue in a blog post titled “Facebook Mobile Security Hole allows Identity theft.” He explained that all a hacker needs is to grab your Facebook plist file (.plist is the extension used for a property list file, often used to store a user’s settings), which Facebook reportedly sets not to expire for another 2,000 years.

From there, he or she can back up his or her own plist, log out of Facebook, and copy yours to his or her device. When the Facebook app is opened, the hacker is logged into Facebook as you. He or she has complete access to your account. If that’s not bad enough, this also means the hacker can log into other apps on his or her device that require a Facebook login.

This all started when Wright began poking around in a few application directories using the free tool iexplorer (previously iphone explorer), and stumbled into a plain text Facebook access token in the popular Draw Something app by OMG POP (now owned by Zynga). Since Draw Something requests offline access to your account, he copied the hash and tested a few Facebook Query Language (FQL) queries. He said he could pull back pretty much any information from his Facebook account. These tokens run out after 60 days, but that’s enough for hackers to grab some confirmed e-mail addresses and other basic information.

That’s not all. When Wright checked the Facebook app, he quickly discovered a whole bunch of cached images and the “com.Facebook.plist.” It didn’t just contain an access token, but a full oAuth key in plain text. Even more worryingly, the expiry for the plist was set to Jan 1, 4001.

Here’s what happened when Wright sent his .plist over to his friend and blogger, Scoopz:

After backing up his own plist and logging out of Facebook he copied mine over to his device and opened the Facebook app…
My jaw dropped as over the next few minutes I watched posts appear on my wall, private messages sent, webpages liked and applications added.
Scoopz then opened Draw Something on his iPad which logged him straight into my account where he sent some pictures back to my friends.

In his post, Wright outlined five proof of concepts for the attack:

A hidden application which runs on shared PC’s Any device plugged in to charge has the Plist copied.
A recompile of an open source iphone explorer like program with the added code.
A saved game editing tool with the added code.
A credit card sized hardware solution that takes all of two seconds to copy the plist should you have physical access to an iDevice.
A modified speaker dock.

Wright wrote some code to harvest Facebook plist file from phones. Over the course of a week, he grabbed more than 1,000 plist files. He said he deleted them and contacted Facebook.

Menlo Park is already working on a fix, according to Wright, but he says that’s not enough:

Facebook are aware and working on closing the hole, but unless app developers follow suit and start encrypting the 60 day access token Facebook supplies, it’s only a matter of time before someone starts using the info for ill purpose…if they aren’t already. Until Facebook plug the hole, I’ll be thinking twice about plugging my devices into a shared PC, public music docks or “charging stations”.

Unlike on other platforms, Facebook develops the social network’s apps for Android and iOS. Everyone else develops the Facebook app for their respective platform (RIM for BlackBerry, Microsoft for Windows Phone, HP for webOS, and so on). As such, Facebook appears to be the only party responsible for this vulnerability.

Pierce County law enforcement officers are searching for a man suspected of using stolen identifications and credit cards to buy expensive power tools.

Investigators say their suspect, Keith Thomas Whiteman, then sells the tools to make a cash profit.

Pierce County prosecutors have charged Whiteman, 36, with two counts of forgery and one count each of identity theft and theft in a Gig Harbor case and identity theft and attempted theft in a Tacoma case.

http://liarcatchers.com/identity_theft_investigation.html

Warrants have been issued for his arrest in both cases.

Tacoma-Pierce County Crime Stoppers reports that law enforcement agencies throughout the state have investigated Whiteman for identity theft and forgery. He has at least seven warrants for his arrest and 14 prior felony convictions.

In the Tacoma and Gig Harbor cases, Whiteman walked into home improvement stores and selected expensive power tools. He presented the clerk with the identification and credit card belonging to another man, court documents state. The other man later told officers that he’d lost his wallet a year before and had been an identity theft victim since.

A friend of Whiteman’s told police that Whiteman recently relapsed and started using methamphetamine again, according to court documents. Since then, Whiteman “has been going crazy stealing,” the documents state.

Whiteman is 5 feet 10 and 190 pounds. He has brown hair and hazel eyes. He’s known to frequent Kitsap and Pierce counties. He’s been known to drive a 1999 gray Chevrolet Tahoe to transport stolen goods, according to charging documents.

Crime Stoppers is offering up to $1,000 for information leading to Whiteman’s arrest. Tipsters may remain anonymous and can reach Crime Stoppers at 253-591-5959.

A federal indictment accuses 13 California residents of participating in an identity-theft scheme that employed electronic devices at ATMs around Las Vegas to illegally glean data from credit and debit cards.

The indictment was handed up March 13 in U.S. District Court in Las Vegas but remained sealed until Tuesday so that arrests could be made, federal officials said.

The indictment accuses the defendants of installing “skimmers” into exterior door readers at JP Morgan Chase bank branches around the valley. Swiping a bank or debit card though an exterior door reader allows customers after-hours access to the bank’s ATM. Defendants also installed a pinhole camera on the ATM pin pads to capture the account holders’ personal identification number (PIN), the indictment charges.

http://liarcatchers.com/identity_theft_investigation.html

The skimmers captured account holders’ data, including account numbers, names and card expiration dates. The information, along with the PIN, allowed the defendants to manufacture and use counterfeit credit cards.

The office of Daniel Bogden, U.S. attorney for Nevada, announced the indictment, along with a warning to other would-be identity thieves, in a news release today.

“We are working vigilantly with our federal, state and local law enforcement partners to identify, arrest and prosecute criminals who are stealing personal information and using it to manufacture counterfeit credit and debit cards,” Bogden said. “If you are involved in this type of criminal activity and are convicted, you are going to federal prison.”

The data, according to the indictment, was skimmed from bank and debit cards used at JP Morgan Chase ATMs on Sky Pointe Drive, West Flamingo Road, West Craig Road, West Sahara Avenue, South Fort Apache, Camino Al Norte, East Charleston Boulevard and South Rainbow Boulevard.

According to the indictment, the data thefts began in approximately November 2009 and continued through Nov. 4, 2011.

The indictment does not specify the estimated amount of loss.

The defendants, ranging in age from 21 to 44, are charged with one count of conspiracy and two counts of aggravated identity theft. Six defendants were arrested Tuesday in California, five were already in state custody on other charges, and two have not yet been arrested, the news release said.

Charged in the indictment were: Jacob Villanueva Jr., 34, Fontana, Calif.; Javier Panuco, 36, Los Angeles; Derek Anthony Salazar, 31, Riverside, Calif.; Daniel Miguel Castro, 44, Santa Fe Springs, Calif.; George Mario McKenna, 36, Norwalk, Calif.; Rolando Marquez; Vanessa Ruiz, 25, Colton, Calif.; Navaz Dowling, 34, currently in a halfway house in Greenville, S.C.; Luis Carlos Avila, 29, Fontana; Katie Arias, 24, Fontana, Calif.; Ronald Bowers, 21, San Bernardino, Calif.; Michael Sabicer, 34, Monterey Park, Calif.; and Corrine Ruelas, 33, Covina, Calif.

Initial court appearances will be scheduled in Las Vegas in the near future, the news release said.