People Broke Into My Starbucks App And Charged Me $100

The timing was perfect on this one.

Last week, just as I finished writing a story about “unauthorized activity” on Chipotle's payment system, I received an email alert from Starbucks. It contained a receipt for reloading $100 onto my Starbucks mobile app, using my saved credit card.

The problem, of course, was I had nothing to do with that transaction. By the time I opened the app to see what was going on, the fraudster had already made three purchases at a Starbucks in San Diego: one for $48.32, one for $49.75, and another for $15.83.

By the time I was on the phone with customer service, my account had been completely emptied.

This is not a new thing — it's called an account takeover, and it's a long-running problem in the Starbucks app. In 2015, customers of the coffee chain reported having their accounts reloaded using their stored credit cards and then emptied, possibly onto gift cards that the scammers then sold at a discount on the black market.

At the time, the company said because many consumers reuse usernames and passwords on multiple sites and apps, criminals were obtaining stolen logins from hacked websites, and trying them out in the Starbucks app.

“We have a team of engineers dedicated to advancing our security and fraud prevention capabilities,” the company said in a statement at the time.

But two years later, the Starbucks app still seems vulnerable to exactly the same weakness. Despite the app being linked to people's credit cards, and capable of charging money to them at will, the company confirmed to BuzzFeed News that it does not support two-factor authentication — a widespread security measure that typically involves the user being sent a code via text message or email when attempting to log in from a new device.

It's a notable weakness, given that mobile payment now represents about 25% of all Starbucks transactions. For a chain that brought in $13.2 billion in sales in fiscal 2016 just through company-operated stores in the US, Canada, and Latin America, that means billions of dollars flowing through the app.

“Relying on usernames and passwords is a failure because no matter what you do, there will always be some percentage of users, probably double digits, who will use a password that they used somewhere else,” said journalist Brian Krebs, author of KrebsOnSecurity.

“I was surprised that in two years, Starbucks hasn’t gotten more aggressive,” said Rob LaMear, CEO of US Cyber Vault. LaMear said his and his wife's Starbucks accounts were both recently compromised. With a global brand, there's “a lot of volume at play here.”

A Starbucks spokesperson said in an email to BuzzFeed News “while account takeover (ATO) activity is an industry wide challenge, we see only a tiny fraction of one percent of our account holders impacted.”

Meanwhile, a slow trickle of complaints from Starbucks customers continues to emerge on social media.

Like many other big restaurant chains launching their own ordering and payment apps, mobile is a critical part of Starbucks' growth plan. While repeat customers are big fans of the convenience of these apps, the companies also benefit from the reams of highly-detailed data they collect on customer habits.

How serious is Starbucks about getting digital right? It's newly-appointed CEO, Kevin Johnson, was previously the CEO of tech company Juniper Networks, and was a senior executive at Microsoft before that. Last month, Johnson singled out “digital relationships with customers” as one of the company's “most important things for the future.”

Asked about rolling out two-factor authentication, Starbucks said, “While we do not share specifics on future security protocol timelines or practices, our security and anti-fraud teams actively continue to develop, and invest in, enhanced protection measures, further strengthening our platforms.”

Starbucks customer service said they would cancel the $100 charge with my credit card company and refund the balance that was on my account before it was compromised. The representative had me change my password while I was still on the phone with her.

Was your Starbucks account compromised? To contact the reporter on this story, email venessa.wong@buzzfeed.com, or go to tips.buzzfeed.com to learn how send your tip securely.

Chipotle Says Its Payment System May Have Been Hacked

Quelle: <a href="People Broke Into My Starbucks App And Charged Me 0“>BuzzFeed

If You Just Got An Unexpected Google Doc, Don’t Open It

Have you gotten an email today (or perhaps several), saying that someone from your contacts list shared a Google document with you? Think twice before opening it or clicking the link to access the doc.

A number of people have been victim of an apparent phishing attempt (where hackers try to get you to click on sketchy links) by an unknown organization starting around 11:30 am PT today.

At least some of the emails are addressed to “hhhhhhhhhhhhhhhh@mailinator.com” and appear to place the intended target in the BCC field. The subject line reads “[someone in your contacts] just shared a Google Doc with you,” imitating the way Google emails appear when people share Google Documents with one another.

If you click on the fraudulent link within the email, it will take you to a real Google page asking for widespread permissions across your Google accounts, which, if granted (don't) would give the attackers access to a vast amount of personal data. For now, it doesn't seem like the hack can access this information unless you give it permission; however, if you open the link, it does seem to forward the email to everyone on your contact list.

The attack hit a number an unknown number of employees within BuzzFeed and seems to also target people outside of the organization, including school districts.

If you search “shared a doc” on Twitter, the results keep piling up.

Here's what to do if you did click the link to the suspicious Google Doc:

• Go to the google security checkup and go through the checklist.
• Pay close attention to the Account Permissions section. Check for anything that looks suspicious and revoke access.

Google did not immediately respond to requests for comment.

Quelle: <a href="If You Just Got An Unexpected Google Doc, Don’t Open It“>BuzzFeed

Waymo Alleges Ex-Employee And Uber Created A Cover-Up Company To Steal Its Self-Driving Tech

Anthony Levandowski, Otto Co-founder and VP of Engineering at Uber

Afp / AFP / Getty Images

In a court hearing on Wednesday, Waymo's lawyers alleged that Anthony Levandowski – its former employee who is at the center of its contentious lawsuit against Uber – started his self-driving truck company Otto as a ruse so Uber could acquire it and steal proprietary information about Google's self-driving car program.

“We've learned that Uber and Levandowski together created a cover-up scheme for what they were doing,” Charles Verhoeven, a lawyer for Waymo, said. “They concocted a story for public consumption. The story was that Mr. Levandowski left Waymo for his own company.”

Waymo's lawyers pointed to a stock agreement that gave Levandowski more than $5 million shares of vesting stock – an amount Waymo's lawyers said was worth about $250 million – on January 28, 2016, the day after Levandowski left Google.

According to state records, Levandowski’s company Ottomotto LLC was incorporated in Delaware on January 15, 2016. Uber acquired Otto and appointed Levandowski as head of its self-driving car program a few months later, in July 2016.

Uber told reporters outside the courtroom that the stock was granted at the time of the acquisition but the vesting was back-dated to account for Levandowski's time at Otto. The ride-hail giant's lawyers didn't address the vesting agreement in court.

The lawyers also pointed to emails sent in January by Brian McClendon, Uber's former vice president of maps who left the company earlier this year, that referenced a meeting with “Anthony,” presumed to be Levandowski.

The hearing on Wednesday is centering around whether US District Judge William Alsup should grant Waymo's request for an injunction to halt Uber's self-driving program pending a trial.

The lawsuit centers around laser technology called LiDAR (Light Detection And Ranging), which helps self-driving cars see and navigate. Uber says its own technology is “fundamentally different” from Waymo’s designs. Waymo alleges Levandowski downloaded 14,000 company files before leaving the company to start Otto.

This is a developing news story. Check back for updates.

Quelle: <a href="Waymo Alleges Ex-Employee And Uber Created A Cover-Up Company To Steal Its Self-Driving Tech“>BuzzFeed