TexasCHLforum.com

Not to stir up the Freedom Munitions pot any more, but in the spirit of the season this was the gift that just keeps on giving.

Once I confirmed the website breach that was simultaneous with my October purchase, I had my bank retire that credit card number and issue a new card. Never an easy thing nowadays when you have everything from Amazon to the cable company using the on-file card for payment. Gotta manually go change everything and make sure it's timed correctly so any automatic monthly payments or standing order doesn't bounce. Had my new card in hand before the end of October and all was taken care of. Right?

Wrong.

Remember that notice from Freedom that said they had identified a breach spanning October 16 to November 26? Well, the primary card authority, in this instance Visa, was notified of the breach and provided a list of those customers potentially affected. Visa in turn notified the issuing banks. Got this email notification this morning:

[Bank Name] was recently notified by our card processor that your Visa® card ending in XXXX may have been compromised during an exposure window from 10/16/2020 – 11/26/2020 by an unnamed/undisclosed ecommerce merchant. While this kind of news can be alarming, this does not mean any fraudulent activity occurred on your account. However, we are taking every precaution to ensure your account remains secure. Rest assured that [Bank Name]’s system was not compromised.

As a precautionary measure, we have reissued your Visa card with a new number. You should receive your new card within 7-10 business days....

I was on the phone within 30 minutes of the time-stamp on the email, trying to explain that I knew what this was in relation to, and that I had already handled it with a new card and new card number in October. The bank politely apologized and said that it was a done deal, that those notices only go out after a new card has actually been processed. That they can't cancel the operation. That I'm getting another new card and card number whether I like it or not. It's in the mail, as it were.

So, thank you, Freedom Munitions. Because now I have to go through the whole credit card changeover mess yet again, and this time during the holidays when, if I have any issues, it's going to be much more difficult to get the right person on the phone. Woo hoo!

Anybody have a Grinch mask I can wear the rest of the day?

strogg wrote: ↑Wed Dec 09, 2020 10:43 pm

AndyC wrote: ↑Wed Dec 09, 2020 8:10 pm

Rafe wrote: ↑Wed Dec 09, 2020 7:26 pm And what is Freedom doing for those of us who know we were directly affected? Saying, "We are taking this seriously." Oh, and keep an eye on your credit report. Nothing else. No actual apology, not a, "Hey, free shipping on your next order." Not even a letter above the name of one of Freedom Munitions officers taking responsibility.

I'd never order from them either, for those reasons. You want my business, you at least say "Sorry" when you mess up - especially when you put your customers at risk.

I wouldn't put it against them too much. It's literally not their fault. They shouldn't be the ones responsible for compensating for other people's mistakes. Granted, I would like to see good faith gestures too, but for this type of event, I'll give them a pass. The vendor that does payment processing, not so much of a pass.

Respectfully, I'd point you back uptopic. The Trojan files installed were installed on Freedom's website, not on a payment processor's.

The Trojan, that had been known for at least five years, sits on the webhost, not at the payment processor, and the vulnerability that allowed the upload is unique to the Magneto content management system (CMS; one of many popular ones including WordPress and Joomla--website rendering systems, not payment processing mechanisms; none of them have native payment processing features). These JavaScript files intercept the entered credit card information before data is transmitted to a payment processor...but there really wasn't one in this case. Keep reading.

The credit card information was captured on Freedom's website and then automatically transmitted to the hacker's designated destination as set in the JavaScript of the Trojan. The result to the customer (i.e., me) was that simply nothing seemed to happen when the "okay" button was clicked to complete the purchase. No "please wait" or error or completion messages. As proof that the Trojan was on Freedom's website, not elsewhere, I've attached pages 5 and 6 of a scan I did of the Freedom site on October 20 using an online service called SiteGuarding.

All that aside, though, you have to dig a little deeper to find out that the payment processor as indicated on that breach notification letter, Kash CA, is not an independent entity at all, despite the clear attempt to imply that in the Freedom letter. All one happy family.

Here's a link to the free portion of Kash CA, Inc.'s Dun & Bradstreet listing. You'll note three things: 1) The annual reported revenues are tiny, only $86K per that D&B listing. 2) Kash CA is located in Lewiston, Idaho; its phone number of record is (208) 746-0694. 3) The only principal's name associated with the company is David Howell.

Now check the "About Us" page for Kash CA, Inc.: https://dealers.howellmunitionsandtech.com/aboutus.asp. "Kash CA, Inc. is an all-American, vertically integrated company specializing in the development of ammunition, components, loading machinery and OEM production." Their business location of record is 815 D. Street, Lewiston, Idaho.

Hop over to the Freedom Munition website's "Contact Us" page: https://www.freedommunitions.com/contacts. Location? 815 D. Street, Lewiston, Idaho; (208) 746-3668. The Freedom "About Us" page (https://www.freedommunitions.com/about-us) offers info about their 2018 bankruptcy:

NOTE: On June 8, 2018, X-Treme Bullets, Inc., Ammo Load Worldwide, Inc., Clearwater Bullet, Inc., Freedom Munitions, LLC, Howell Machine, Inc., Howell Munitions & Technology, Inc., Lewis-Clark Ammunition Components, LLC and Components Exchange, LLC (collectively, “HMT”) filed bankruptcy in the United States Bankruptcy Court in Reno Nevada (Case No. 18-50609) (the “Bankruptcy”). On October 22, 2019, Kash CA, Inc. (“Kash CA”) purchased the assets, including the trade names, website and Internet domain names, of HMT out of the Bankruptcy, without any liability relating to any claims concerning any HMT products previously sold by HMT. Kash CA does not own or operate any of the HMT entities. Kash CA operates this website through use of the Internet domain name and associated “Freedom Munitions” trade name solely for branding purposes. Any claims concerning ammunition or other products purchased prior to October 22, 2019 from any of the HMT entities are not the responsibility of Kash CA or covered by Kash CA under the posted warranty and/or returns policies, but are subject to the bankruptcy filed in the United States Bankruptcy Court in Reno Nevada (Case No. 18-50609)

Update: finally got a notification from Freedom Munitions, such as it is. See attached. It arrived a couple of hours ago even though it's dated yesterday. What's disappointing is that Freedom takes no responsibility, despite the fact that we followed the October breach real-time, here on this forum, and we know that the malware injection occurred on Freedom's site, not at Kash CA, Inc. It very well might have been a gateway vulnerability in one or more of the files installed in support of the payment implementation, but better website security by Freedom would probably have prevented the issue entirely.

Remember, this was a Trojan that has been known since 2015 and that infected, specifically, websites running the Magneto content management system, which Freedom does. I'll bet 20 bucks that this had been patchable for years on Freedom's website, and that it was ambivalence and ineptitude, not fancy hacking, that ultimately resulted in this breach.

And what is Freedom doing for those of us who know we were directly affected? Saying, "We are taking this seriously." Oh, and keep an eye on your credit report. Nothing else. No actual apology, not a, "Hey, free shipping on your next order." Not even a letter above the name of one of Freedom Munitions officers taking responsibility.

I hadn't ordered from them in years, and then when I did I had to have my credit card cancelled and replaced...a process which is always a nightmare when you have services auto-billed to a card. And then seven weeks later a letter saying, "Your personal information was compromised and we take it seriously."

Well, not as seriously as I do. They will never see another penny from me and, should anyone ever ask me about Freedom Munitions in the future, I'll gladly relate my 2020 experience by way of explanation why I will forever recommend avoiding Freedom Munitions.

Oh, P.S. In the letter they state the period of vulnerability was October 16 to November 26. Note that forum member Syntyr notified them by telephone of the breach on October 20, and I did the same on October 21 after confirming that my credit card had been compromised. They had even taken their online ordering system offline as of that time. Makes one wonder where the subsequent five weeks of vulnerability came from, doesn't it?

Just an update: Freedom Munitions has taken their shopping cart checkout function offline. Online website malware checkers can't evaluate the site now because the infected area is inaccessible. However, there is no notice or warning or explanation at all on the website, and after four days since the breach was confirmed, they've made no email communication efforts to affected shoppers.

Syntyr wrote: ↑Wed Oct 21, 2020 12:24 pm Rafe,

I am so sorry man. I apologize for leading you down the dark path. They seemed surprised when I called them. The comment was "we have been having problems with the website since Monday when we came in." Well yeah... I told her that they needed to get their vendor on ASAP and they needed to send out a note to people that had purchased.

No way this is on you. No apologies. I used to shop at Freedom a lot in the past; was even at the grand opening of their (fairly short-lived) store off 290 in northwest Houston. They'd just slipped off my to-check list after their business contracted and they closed that Houston store. At least I still get some decent .308 hunting rounds out of it.

Syntyr wrote: ↑Tue Oct 20, 2020 6:30 pm Heads up everyone. I just went back to look at some more ammo and got a virus warning. My AVG squashed it but I checked with an online vulnerability scanner and received this report:

Normalized URL: http://freedommunitions.com:80
Submission date: Tue Oct 20 23:22:29 2020
Server IP address: 107.21.212.122
Country: United States
Server: Apache
CMS: Magento
Malicious files: 19
Suspicious files: 0
Potentially Suspicious files: 0
Clean files: 21
External links detected: 0
Iframes scanned: 1
Blacklisted: No
AVG reports it as Java Script Card Stealer Trojan
Probably best to avoid the site until they get it cleaned up. I sent the site admin a note. Also called and spoke with a person there to give them a heads up. THey said they have been having issues with the site since Monday.

I can, sadly, confirm this. The Trojan evidently doesn't install on your local computer. My McAfee subscription never warned me about the Freedom website or blocked/quarantined any files. Concerned because I was able to replicate similar results as Syntyr with website scans, I checked my system with Malwarebytes and Avast. I also let McAfee crunch overnight on my 75% full 4TB C: drive in a full scan. None of them turned up anything.

However, this particular nasty looks to have been around since 2015 and infects, specifically, sites running the Magneto content management system, which Freedom does. Freedom uses Authorize.net to actually process card transactions, but the Trojan sits in between the entry form on the Magneto-generated webpage(s) and the transmission of info to Authorize.net...evidently capturing entered credit card information and sending it someplace none of us would want it to go. When I tried to complete my purchase, clicking "Submit" after my CC info was entered did nothing, no indication of processing at all; not even a page reload or a "please wait" spinner. So I telephoned Freedom; said I had an order sitting in my cart but nothing happened when I tried to complete it; was told the credit card system was down; I finished the purchase over the phone.

No communication from Freedom about this yet to the people, like me, who tried to make online purchases. We'll see if they're going to be proactive in any way. However, though no mysterious charges have turned up since my purchase late Monday afternoon, it's very clear that the card I used has been compromised. And closing that card and having a new one with a new number reissued is going to be a huge pain...certainly more trouble than buying a few rounds of .308 was worth. There are scores of blacklists maintained of websites that are known to be compromised, and Freedom Munitions has started to show up on them.

While I was logged in there, I looked at my purchase history with them. Until last Monday, September 2016 has been my last purchase. I'm afraid, though, that this week's experience with Freedom will be my last. Having my cc info compromised far outweighs anything else.

AndyC wrote: ↑Tue Oct 20, 2020 4:47 pm I'm glad I reload and cast.

You are the future, my friend. Shame on me for never getting into it. Lot of excuses, but no good reasons. (My dear wife would argue that last point, though.) But if Biden wins I don't see the shortages or the prices letting up anytime soon. Scott and other experts would know best, but it might even get worse. First-time gun buying went through the roof this year, and the Biden firearms policy platform should deeply worry every gun owner, potential gun owner, and manufacturer.

On a much brighter note, after hearing stories about ammo shipment delays--and even being told by Freedom that they make every effort to ship within a week to 10 days--I got the UPS tracking number for .308 order about an hour ago. So order to shipped in 25 hours. Not bad! Good on ya, Freedom.

Syntyr wrote: ↑Mon Oct 19, 2020 2:47 pm Rafe, Freedom Munitions has 308 WIN 175 GR HPBT for 1.19 per round. And 308 WIN 147 GR FMJ for .90 cents per round. I haven’t used their 308 yet but I have used 300 Blackout with no problems.

https://www.freedommunitions.com/ammuni ... ester.html

You know, after Freedom had to declare bankruptcy a few years ago and stopped selling the nicely priced reman stuff--that I bought a lot of--I'd stopped looking at them. If I'm not mistaken, they went through a period where their selection was limited and their pricing wasn't very good.

From that link you included, it's the 168gr Boar Buster that got my attention. I've got plenty of mil-surp plinking stuff, and even back in the day the Boar Buster got good reviews for effectiveness. 240 rounds seems like a decent way to divest myself of $300. They even remembered my log-in info. Thanks for causing me to spend more money!

No ammo buys lately, but Brownell's still has a sale on some of the PMAGs at decent prices. For 5.56 I prefer the Gen 3 with window, but happy enough with plain Gen 2. I mean, you can never have too many magazines...especially if Creepy Joe wins and they become hard to come by again. Not the absolute best price in the world, but paid $10.50 per. Remember when you counted yourself lucky if you could find them at twice that?

While I was there I browsed a bit for ammo. Nary a 5.56 round to be had. No .224 Valkyrie or 6.5 Grendel. A couple of options for 6.5 Creedmoor starting at $2.26/round.

Hornady SST 150gr in .308 was available for $1.65/round; was tempted, but didn't pull the trigger. May think on it and go back to see if it's still there tomorrow. Next-best in-stock price was $2.05/round for 155gr Black Hills Gold, then $2.24 for Lapua 175gr. A little too rich for my blood.

No 9mm in stock. No .45 ACP. No .40 S&W. No 10mm. I don't shoot anything else but .22 LR in a handgun, so that's all I checked. We need a good outcome on ACB and a good outcome on November 3 for availability and prices to get sane again.

Looks like that's the only Scheels in Texas. C'mon, Sheels! Texas is a B-I-G state.

I've been periodically looking for some premium SD 5.56 ammo. I have several "that'll do" products on my wishlist, including Speer Gold Dot 62gr or 64gr soft point, Federal 62gr Trophy Bonded, Federal PowerShok 64gr soft point (.223), Hornady 62gr soft point Frontier, Hornady Black 75gr InterLock, Hornady 73gr FTX Critical Defense (.223). Mainly from close-to-50-yard home defense type stuff; heavier, expanding bullet. I'm pretty good on ball and green-tip (even bought a couple of cases of Wolf steel case back in the Obama panic-buying zone...as a very last resort to shoot or as trading stock).

But I'm too light on what I'd most like for home invader scenarios. Only 100 rounds. Don't want to mix and match various brands/weights in charged magazines, so want to buy a minimum 200 rounds. But for the past couple of months I haven't found anything available, even at a premium markup. Nada.