My Walmart account was hacked

Summary: Lessons from my Walmart account hacking incident.

Out of the blue, I get an email from Walmart:

Dear Alek Davis,

Personal information associated with your Walmart.com account - name, email address and/or password - has been successfully updated as requested. If the account change included an update to the email, for your added security this account update confirmation is sent to both the new and old email addresses. All future emails will be sent to the new address only.

If the account information update is correct, no further action is needed.

If you did not make these changes to your account, please call us immediately at 1-800-966-6546.

If you have any questions, please reply to this email and let us know how we can help.

We appreciate the opportunity to assist you and look forward to your next visit.

Sincerely,

Your Walmart.com Customer Service Team

I try to log on to my Walmart account and fail to authenticate. I attempt to use the I Forgot My Password feature, but get a message stating that my email address is not registered with Walmart. It's obvious: someone hacked my Walmart account!

I call the above mentioned 1-800 number, but the customer support department is closed (it's around 10 PM PST, but apparently, the world's largest retailer cannot afford 24x7 customer support). There is no option to report the problem online. What's a girl to do?

The best thing I can do is send an email reply describing the problem. I get a canned response indicating that I will get a human response within 24 hours. Okay, what's next?

Results from a quick Google search suggest that a common pattern of Walmart hacking involves using saved credit card data to purchase digital goods. So, I log on to my credit card's account (for the card that I normally use at Walmart.com) and see two unauthorized transactions: one in the amount of $60 (turns out to be 2 Straight Talk 1000-Minute, 1000-Text, 30MB Web Access Service Cards), and another in the amount of $50 (2 SKYPE $25 Prepaid eGift Cards). I call the credit card company to report fraud. I also checked other credit cards that could've been on file with Walmart, but do not notice anything suspicious.

I try logging on to Walmart.com again, and notice a strange address popping up in the email field of the Sign In form for a second just before it is overwritten by my original (and no longer good) address filled in by LastPass. Apparently, I have a low-security personalization cookie, that is not good for anything important (like checking or changing account info, or submitting orders), but it could give me some info about the hacker. I disable LastPass and reload the form. Get the email field populated with this address: ssuper981@yahoo.com. Hello, hacker. How're you doing?

Silly idea: what if I try to log in with my original password? The hacker can't be that careless, but... One... two... three... I'm in! Dear, ssuper981@yahoo.com, thank you for failing Hacking 101. I change my email address back, change the password, and remove all credit card info from the account. I see the two orders in the processing state, and successfully cancel one of them. I use a form to send an order cancellation request for the second purchase, but apparently the Skype eGift cards have been already sent. Well, it's now between Walmart and my credit card company to dispute the charge.

What else can I do? I go to the Yahoo! Security Center and try to find an option to report fraudulent activity coming from a Yahoo! email, but Yahoo! does not provide any way to do this (via a form, email, or phone).

The next morning, I call Walmart (thank God Walmart can afford customer support during normal business hours) to report the incident to a human and have a short conversation with a nice woman (btw, have the companies started bringing customer support back from the foreign lands? talking to a motivated native speaker is so refreshing!). Now, it's time to get back to life, but first, lessons learned:

1. Never save credit card information when shopping online! Yeah, it's convenient, but may eventually cause more hassles.
2. Read #1.

And a couple of comments:

• Walmart: No 24x7 customer support? Seriously? Even for security issues? Come on, you can do better!
• Walmart: Good call on sending notification to old customer's email on personal profile changes. Have I not seen this message, it would have taken me much longer to realize that my account was hacked.
• Walmart: Shouldn't user activity that starts with personal profile (and email) changes and is followed by an immediate purchase of digital goods raise a flag for suspicious activity? I know that you rush to get a payment, but you see: you lost $60 (which could've easily been $110), and I'm sure you need that money to hire more support people (at the very least, for security related issues).
• Yahoo!: Would it be too much to ask for some way of reporting fraudulent activity originating from a Yahoo! email account? Just asking.

Have a nice day, everyone. Be safe!

Security Hall of Shame: Lenovo

Summary: What is wrong with password rules at Lenovo?

The winner of today's Security Hall of Shame Award in the category Stupid Password Rules (subcategory: We want you to think that we support strong passwords, but we don't, ha-ha) is... Lenovo.

When you register at Lenovo IBM Shareholder Purchase Program, you are not allowed to specify the password (not sure why, but whatever). Once you submit the registration info, you will receive an e-mail with your user name and random password (not that smart to send password along with user name, but whatever). Now the logical step is to change the password to the one you can remember, so you click the My Account link (not easy to find on the page, but whatever), and then click Change Account Information (would be better to separate security info -- user name, password -- from regular account info -- address, phone, etc. -- but whatever).

Okay, let's change the password. This is not a financial site, so make a new password, which is:

• 8 characters long, with
• upper-case letters,
• lower-case letters, and
• a number.

This should be good enough, so save changes... and... o-ops, error:

"The password is too simple. It must contain at least two numbers."

Hmm, among the passwords I use, none of them has two numbers, but let me try this:

• 9 characters long, with
• upper-case letters,
• lower-case letters,
• a number, and
• a special character.

This one complies with most password security guidelines, so save changes... and... da-ang:

"The password contains special characters. Only letters (a-z) and numbers are allowed."

Hmm, okay let's try this:

• hello123

Save changes... and... no hay problema. Bravo, Lenovo! You know your security.

Now, kids, remember that Lenovo will lose its Security Hall of Shame Award when it changes password rules to:

1. allow special characters (such as: +-*#@!~&%), and
2. not require two numbers (this is not a bad rule, but it's not common).

See also:
What is strong password? by Webopedia
Strong passwords: How to create and use them by Microsoft