Technical Details in The MLB Baseball Players Signals Hacking 

By Cesar Ortiz (c)

November 24, 2019

The Mayor League Baseball (MLB) organization is updating the ongoing investigative effort on the  2017 baseball games signal hacking issue. The Houston Astros organization is leading the pack of baseball teams under the investigative radar. Astros front-office employees, on-field staff and the Astros manager, AJ Hinch have already been interviewed. Other players allegedly involved are the current Boston Red Sox manager Alex Cora and the New York Mets manager Carlos Beltran. 

The SNY TV Network on November 14, 2019, is quick to state that the MLB has no evidence yet for imposing sanctions to Cora and Beltran,  further stating, “ The league does not have either accusations or evidence that would point to severe discipline for either”.

For years, stealing signals from players was considered an art. It is not illegal, but officials become wary when they find reports of the activity when it is done using banned technology. 

The use of technology to intercept or relay the signals is forbidden. The New York Times reported in 2017 the use of an Apple watch as a means to electronically relay signals to the Red Sox team partners by a Red Sox trainer. The Apple watch use was revealed in a detailed official complaint filed by Brian Cushman, the New York Yankees general manager. Among the exhibits in the complaint was a video shot of the Reds Sox dugout in Boston during the 2017 three-games series. The Red Sox team was fined by the MLB.

Recently, USA Today ran an article explaining how Manny Machado was caught stealing and relaying signals in game two of the 2018 World Series. In the Machado event, there was no violation of any rules because all the signal intelligence was acquired and relayed by Machado using manual signaling skills. No mechanical or electronic devices where used.

 The Athletic ran an article detailing how the Astros in 2017 ran a hacking operation using a video camera and drum beats to relay signals from the catchers to everyone in the stadium, only the hacking partners knew the meaning of the beats and how to decode them.

 Some suspected means of stealing baseball signals are:

 (1) The use of a realistic-looking medical bandage-like device worn by the player at bat that receives a buzzing signal with a  predetermined pattern, for example, one buzz for a fastball. 

(2) Hidden catcher aimed mini cameras that feed data of catchers signals and sends out information on the type of pitch. 

(3) Extended range antennas for radio devices to hear the pitcher-catcher-manager conferences at the mound. 

(4) Lips reading text interpreters for conferences between players (that is the reason players cover their mouth with the gloves when they speak to each other). 

(5) Monitoring of the live video broadcast of the game (MLB mandated a delay in the video monitors that are used in the dugouts and nearby areas). 

Most of the suspected technical equipment techniques used are detectable by specialized equipment and manual signaling stealing can be detected by a trained eye. 

The fact that we may find such hacking practice, even when they can be detected, tends to show the high amounts of monetary rewards involved, that in the eyes of the perpetrators, warrant the risk of detection. So far, no one has been charged with any criminal or civil offense. MLB is offering leniency to those who speak up on the subject and, as of this date,  all technical equipment use events are related to the 2017 year. 

The MLB hacking using information technology techniques and equipment brings to the field a new form of platform to think about, perhaps some Silicon Valley entrepreneurs will design custom hardware and software to detect the hacking devices.

The Target Stores Data Breach Update

A Provocative View of the Event From an Industry Outsider

By Cesar Ortiz - (Article originally published on Yahoo! Contributors/ABC News). Many legal, commercial and social questions regarding the Target data breach will come to see the light after all the dust is settled. The answer to the technical side of one of the biggest security breaches in the United States history is as complex as these other questions. The breach, which was first reported Wednesday by Brian Krebs, a security blogger, began the day after Thanksgiving.The giant merchant said Thursday that about 40 million credit and debit card accounts may have been compromised in U.S. stores between Nov. 27 and Dec. 15, 2013. Included in the hack are Target's own credit and debit REDcards. One interesting note is that cards used for purchases made in the company web site were not affected.

Target advises at their web site in a page named; "Notice: unauthorized access to payment card data in U.S. stores" that "we began investigating the incident as soon as we learned of it. We have determined that the information involved in this incident included customer name, credit or debit card number, and the card's expiration date and CVV (the three-digit security code) ". This is what Target said originally. In reality, there are several "CVV's" and the one with the printed numbers on the card is called CVV2.

The industry regulates the use of credit cards by following several guidelines and standards. Everyone must follow the standards in order to maintain systems compliance. One standard is the PCI Data Security Standard Council (PCI DSS) that deals with security and operational payments handling methodology and the ISO/IEC standard 7811, which is used by banks. ISO/IEC 7811 specifies the hardware and methodology used to handle the transaction and specifies that the bank cards must have a magnetic stripe on the back of a credit/debit card, often called a "magstripe". This magnetic stripe must have three tracks. Your credit card normally uses only tracks one and two. Track three is a read/write track, which includes an encrypted PIN, country code, currency units and amount authorized, Use of track three is not mandatory and its contents is optional. The PIN is encrypted in a data base. It is never in clear text in the magnetic stripe. The Target stolen personal identifier information and financial data was taken from the magnetic strips read out.

The Card Verification Value CVV2 (a three or four digit) number is not included in the magnetic stripe because it will defeat its main purpose, that is, to validate the card manually when using on line, phone purchases and high value transactions. We know that some merchants in North America require the code at the POS to protect the customer by making sure the card is legitimate since it can be a fraudulent card made from information from some stolen data base that does not include the CVV2.

This is a professional well studied attack that must had taken many weeks of planning and careful design to the point that it started one day before the Black Friday major sale event. Breaking encrypted data is a very hard process that requires massive computing facilities and resources. By design, in all retail stores, all data flowing outside of the merchant's stores should be encrypted heavily and it is handled by an independent payment processor facility, a communications carrier(s) and marketing analysis facilities. The possibility of a remote access job to a weak point in the systems is very high.

According to NBC News, Target Spokeswoman, Molly Snyder, released a written statement on Friday that downplayed the initial impact from the event and advised that "To date, we are hearing very few reports of actual fraud, but are closely monitoring the situation,". "the stolen information was limited to data stored on the magnetic strip", "The hackers did not obtain PIN numbers used to access ATM's or the three or four digit that are printed on cards to verify online purchases", Snyder said. The fact is that reports of fraudulent usage of Target stolen cards sold in the Internet are showing up all over the nation, and in the world. JP Morgan Chase & Co is not downplaying the attack. On Saturday 12/21/2013 the bank sent an email to 2 million Chase debit card holders who used the Chase card at Target during the breach period limiting the bank debit card usage and will issue new debit cards, a costly measure. Chase also posted a notice in the bank web page.

If we take into account all the personal identifiers parameters that Target says was compromised, we must conclude that we have three possible alternatives where the hack took place (1) the Point of Sale Module (POS) card scanner (2) in a central card processor system at the merchant and (3) when it arrives at the authorization system processor for approval.

We are ruling out a job at the outside (external) payment processor because they all provide very secure modules, they will not accept unencrypted input from their merchants, that's their business after all, and they service many other merchants. This hack was to Target only. What probably most likely happen, is that the hackers were able to intercept, remotely, using malware scripts, the swipes of cards from the Target hardware card reader devices to the POS modules or from the credit cards in house gateways, specially if it was unencrypted (clear text) or poorly encrypted and the thieves had gotten the encryption key somewhere in the system, the later had happened before to other principals in other hacks. This is a very serious criminal monumental detrimental event, for the banking industry and the business society as a whole, taking into account that it was done to all the stores in the United States and possibly affecting in some way or another 40 million credit card holders, all at the same date time frame, nationwide.

In the original statement , Target's Molly Snyder said the breach had compromised the "CVV". Target has retracted now. Now they claim it was not compromised. Investigators are looking overseas for possible perpetrators. Stolen credit cards are showing up all over the world and many in the United States. Regardless of the downplay efforts by public relations people, this is a serious threat. If you used any debit/credit card at a Target store in the United States during the breach date time frame, including cards issued by non U.S. banks, don't take the matter lightly, act immediately and contact your bank first and then contact Target.

Comment by Cesar Ortiz, 7/30/2014: Looks it was right on the money when I categorized the Target Stores Data Breach as a “very serious criminal monumental detrimental event” in my article in Yahoo! above. Now, several weeks later after my article was published, we are finding out that the customer names, mailing address, phone numbers and email addresses were also compromised and that the impacted customers figure is now 70 million. Now more than ever contact your bank if you used any payment method other than cash at target during the date time frame and if you did, beware of postal letters, emails, phone calls  and IM’s, even if they don’t mention Target.

Google: "Your Computer Appears to Be Infected" This Warning is Not a Scam, But, Beware of Where it Shows and What May Come Next

Google's Virus Warning is NOT a Scam, But, Look Out for Future Postings, They May Be Look-alike Scams

By Cesar Ortiz - (Article first published in Yahoo! Contributors/ABC News). This article is based on a Google blog page posting, this issue has been covered in many publications as a news item, including my own blog and my own article published worldwide on Yahoo!/ABC News. In this opinion I express my concern of what will be coming next as a result of Google bringing up the subject matter in the way they did. In other words, Google is using the same procedure that scammers use every day to get users to link to malware,but this time the link they will click is a real help page. Scammers will copy-cat the virus warning and hit the users with a malware link instead of a help page.

We received a Google Blog posting from Damian Menscher, a security engineer at Google, describing how he identified that infected computers were sending search traffic through proxies to the search engine. When you do a search, it sends you to a Google proxy IP then, just before doing the search, changes the search string and shows malware pay per click sites in a very "professional looking" graphics to trick you to think that you are going to legitimate sites.

Mr. Menscher explains the following "As we work to protect our users and their information, we sometimes discover unusual patterns of activity. Recently, we found some unusual search traffic while performing routine maintenance on one of our data centers. After collaborating with security engineers at several companies that were sending this modified traffic, we determined that the computers exhibiting this behavior were infected with a particular strain of malicious software, or "malware."

Google added that "As a result of this discovery, today some people will see a prominent notification at the top of their Google web search results. We hope that by taking steps to notify users whose traffic is coming through these proxies, we can help them update their antivirus software and remove the infections"

This is a Google's first. They had never done this type of notification before. The notification will ONLY show at the top of the main Google page and it will be a page wide window with a black bar at the top. A similar black bar was seen when Google was testing to launch their Google+ service recently. The body of the window is in yellow and it will read in black letters:
"Your computer appears to be infected.
It appears that your computer is infected with software that intercepts your connection to Google and other sites. Learn how to fix this [Link]"

This message is for real. More than two million computers have been infected worldwide so far. If your receive the message, Google has detected that your PC is infected with a malware that appears to have gotten onto users' computers from one of approximately a hundred variants of a fake antivirus, or "fake AV" software that has been in circulation for some time. This time, one of the variants uses the Google service to scam users, therefore prompting Google to step in. When users click on the "Learn how to fix this" link, they are taken to a real Google page that will help users to get rid of the AV virus.

Up to now everything is running smoothly, but, now comes the catch, we know that scammers will design or copy the warning window that Goggle has been running since July 21, 2011 and that in the "Learn how to fix this" link in the fake window they will send users to an scam malware page. We can expect that Google will make sure that no one will be able to insert a fake message to replace the real one that they are posting in good faith, but no one can prevent hackers to insert a fake look alike window, with a malicious link, somewhere else, including a full fake Google main page.

Users must be alert that when they connect with the Google main page the address bar will show the proper address such as http://www.google.com/. There will be variants because Google routes users according to their detected geographical location. Make sure you have your anti virus software up to date and that is running in real time mode and be aware that Google will post this warning message ONLY at the top of their main page. If it shows somewhere else, it is a scam, no matter how real it may look.

facebook “Eat for Free at Pizza Hut!” Internet Scam is Spreading Virally


By Cesar Ortiz- (Article first published in Yahoo! Contributors/ABC News) Thousands of facebook users are receiving the following message "Eat for Free at Pizza Hut!" from one of their friends who unwillingly posted this scam message to all his or her friends. The scam leads to at least a one "Work at Home advertising" that is designed to steal a user's personal information. The scammers change the contact link so fast that when we did a test, several schemes of pay per click and user information request show up, but all use the "Free Pizza Hut Eat for Free" scheme. Users that fall into this trap receive the following message: Beginning of quote
Eat for Free at Pizza Hut!
[LINK] changes to avoid facebook ban detection
Take advantage of this special Pizza Hut offer! Receive a FREE pizza coupon today! Act quickly before the supply runs out. With only a few coupons left, they'll go fast!
xx minutes ago
End of quote

The scammers went with very professional looking Pizza Hut Logos and graphics that will deceive someone that is in a hurry, don't read security blogs to know what is ahead, or is not very suspicious of scams. Users who receive this message from one of their friends will be taken to a very professional looking web page with a super pretty Pizza Hut logo that explains "that the offer will expire in a certain date or when the remaining xxx offers have been given out!".
In the same graphic, users are then presented with a two step option:

Step 1 is to click the "Share" button. At that point and time victims are sending the scam to all their friends, therefore propagating the scam all over the Internet.
Step 2 is to type "The greatest food!" at the "comments" window. Doing this step redirects your browser to a third party page (pay per click money for the scammers). Users are then taken to a "Work at Home" advertising page that before you make "Tons of Cash" you have to give the following data: Fist Name, Last Name, Address, Country, State, City, Postal Code, e-mail and Phone. After you provide all the information, there is no more communications from the web page and of course, there is no free Pizza Hut offer. As the saying goes, "There is no such thing as a free lunch."

What the scammers do with all the personal information provided is anybody's guess.
Users who fall into this trap should do the following steps:

• (1) Remove any related items from your Facebook newsfeed wall page (2) Notify your friends and make sure you explain that you sent them the scam posting unwillingly (3) Run your Anti-Virus in full mode and set it to real-time scanning.

Opinion by the author - facebook bans scamming addresses (URL's), but scammers change them so fast that is very hard to cope with; incidentally, someone is using the Pizza Hut Logo in an illegal scam all over the Internet, Where is Pizza Hut or parent company Yum! Brands, Inc. the world's largest restaurant company? There is no mention of the scam on the Pizza Hut Facebook page. At least, they can publish a disclaimer or a warning regarding the scam. They sure have the money to hire resources to track this people using their trademark's logo in illegal internet scams. Are they waiting for someone to sue? If someone uses the Pizza Hut logo illegally in a newspaper or a media outlet outside the Internet, it will be a matter of hours before an army Yum! Brands, Inc. lawyers jump into action, why not do the same when it is on the Internet? Pizza Hut and other brands that know that scammers use their trademarks may not be legally bound to do anything, but practically and morally they are.

facebook: “ Facebook Charging in 2011 ” is a Scam. " Facebook Is Deleting Accounts " is Another Scam

By Cesar Ortiz

Now that facebook, suddenly without a major hint, in the f8Conference in San Francisco, dropped a major change to the way they present their interface to the users with a new platform  concept, scammers are having a field day taking advantage of the sweeping change in the facebook interface. Facebook  introduced its Open Graph platform, including the Timeline front end. Facebook does not need to charge for their portal, they make plenty of money on advertising, game sales and other paid for commission and value added services. This is another scam. A similar scam is that “ Facebook is Deleting Accounts ”.

Friends that fall into the trap will unwillingly send you a message post that reads:

Beginning of quote

“IT IS OFFICIAL. IT WAS EVEN ON THE NEWS. FACEBOOK WILL START CHARGING DUE TO THE NEW PROFILE CHANGES. IF YOU COPY THIS ON YOUR WALL YOUR ICON WILL TURN BLUE AND FACEBOOK WILL BE FREE FOR YOU. PLEASE PASS THIS MESSAGE ON, IF NOT YOUR ACCOUNT WILL BE DELETED IF YOU DO NOT PAY”

End of quote

If you take a look at the facebook login page- below the word “Sign Up”- you will see a statement in small blue type that say “It’s free and always will be.” Enough said.  Users who fall into the “ Facebook Charging in 2011 ” trap will be contributing to spamming or worse. According to HUFFPOST, these are the top nine worse case scenarios to this date that a user will fall into this “Facebook Charging In 2011” or similar scams.

(1)     Clickjacking: Clickjackers on Facebook entice users to copy and paste text into their browser bar by posting too-good-to-be-true offers and eye-catching headlines. Once the user infects his own computer with the malicious code, the clickjackers can take control of his account, spam his friends and further spread their scam.

(2)     Fake Polls or Questionnaires: If you click on an ad or a link that takes you to questionnaire on a site outside Facebook, it's best to close the page. When you complete a fake quiz, you help a scammer earn commission.

(3)     Phising Schemes: Phishers go after your credentials (username, password and sometimes more), then take over your profile, and may attempt to gain access to your other online accounts. Phishing schemes can be difficult to spot, especially if the scammers have set up a page that resembles Facebook's login portal.

(4)     Phony Email Or Message: Facebook warns users to be on the lookout for emails or messages from scammers masquerading as "The Facebook Team" or "Facebook." These messages often suggest "urgent action" and may ask the user to update his account.

(5)     Money Transfer Scams: If a friend sent you a desperate-sounding Facebook chat message or wall post asking for an emergency money transfer, you'd want to help, right? Naturally. That's what makes this scam so awful.

(6)     Fake Friends Request: Not all friend requests come from real people, despite Facebook's safeguards against bots. Some Facebook accounts exist purely to establish broad connections for spamming or extracting personal data from users, so watch out whose friend requests you accept.

(7)     Fake Page Scam: Malicious pages, groups or event invitations aim to trick the user into performing actions that Facebook considers "abusive."

(8)     Rogue Applications: Oftentimes, the apps look convincingly real enough for users to click "Allow," as they would do with a normal Facebook app. However, rogue apps use this permission to spread spam through your network of friends.

(9)     The Koobface Worm: Koobface spreads across social networks like Facebook via posts containing a link that claims to be an Adobe Flash Player update.

Twitter: “ Twitter Might Start to Charge in October, Sign This Petition to Keep the Service Free ” Scam is Spreading Fast

By Cesar Ortiz
In this variation of the “scares” scam, hackers are attempting to steal your user name and your password and in turn, your private credentials, and in effect, take control of your account for hidden criminal actions. Users will receive a message from one of their friends passing up the “news” of a possible monetary charge for the social service. Hackers are using human social engineering in making sure they are not mentioning a final determination to charge, but rather they mention that there is a “possibility”. Users will think that there is no harm to sign such a petition. The research firm Sophos warned of the scam originally. In the scam scenario,one of your friends that already have fallen in the scam will unknowingly send you a message post that will say:

"Twitter might start to charge in October, sign this petition to keep the service free! -URL- http:/bitly.zxxx[Link]”

Let’s pretend for a moment you are the victim user. When you click on the short link to access your petition, a problem “appears” to happen. You are then presented with a very, very Twitter professional looking frame with logo and perfect colors and typefaces (a fake). In the window you are warned that your session has timed out and that you need to "re-authenticate" and login again. Users will “need” to proceed and type their password and user name in the Twitter fake window. As soon as the user clicks the login button, a hidden script will propagate the same message received about the scam to all his or her friends, therefore propagating the scam. The same script will record your credentials.

Needless to say, the “petition” is not shown anywhere. Unsuspecting users that clicked the short link may expect that many other unknown actions will take place from that point on, since the criminals have the user name and password. Users who fall into this trap should move quickly and do the following:

(1) Change your password immediately.

(2) Go to the Twitter Web Site using a PC, if you can, and revoke any application with a related name to the scam and revoke and delete any unknown posts, photos, API’s and any post, friends or anything else that does not look familiar to you. Remember, the scammers had full access to your account and a malicious script can create and post anything using a hidden malware. Be on the look out for scam e-mails and scam phone calls. Take your time on this task. Twitter is aware of this scam and is taking measures to block, warn users and mitigate the scam damage, but scammers will change the location of their DNS servers and URL’s sites very fast to keep the scam alive.

(3) Notify your friends of the scam and help them clean up the mess, make sure that you mention that you did not send the scam related post willingly, but rather unknowingly.

(4) Run your anti virus in full scan mode and make sure you set the anti virus program menu to "Real Time" scan.