Slashdot Mirror
Walmart Stored Value Cards Compromised
morcheeba writes "It appears that Walmart's pre-paid gift cards have been hacked. Customers are buying cards and finding that criminals have already emptied them of value. It seems someone has access to Walmart's database and/or registration data, and can create clones of recently activated cards. (via engadget)"
Wal-Mart does not need anymore bad publicity, this should be a non-issue, if people got cheated, they need to provide recompense. It's not like they can't afford it.
I remember reading a while back that one of the major retailers, possibly walmart had gift cards with sequential serial numbers, stored on the magstripe in plaintext, so anyone with a card reader/writer can easily change the id stored on the gift card.
Theres an 800 number you can call to find out the card's balance, so it just takes a little time and guesswork to find a card number with a balance on it.
I know a little bit about Wal-Mart's Networking layout.
Your typical store has at least 6 sets of switches: UPC office (where the servers are kept), GM (general Merchandise), GRC (Grocery), Garden Center, PICS (In the electronics Department, and Receiving. These switches are laid out into at least 3 vlans: POS, Non POS, and Wireless. By Default, the POS vlans are set to ports 1-12 on the switch. The switches are connected by a fiber backbone that usually involves two separate physical routes...so if one is cut, the other will be able to pick up the load. They're concnentrated to some cisco routers, and it'll go out either a 56K modem line or a T1 line, using a Hughes Sattelite link as a backup.
You've got your usual mixture of IBM Cash register controllers (CC and DD), what they call their "SMART" system (I think it's running a flavor of AIX), BOSS (Best Optical Selling System), MMS (Multi-Media Server, runs the Wal-mart TV Network), and a few others.
It's trivial to get into a UPC office to gain access to these things. Most stores don't check ID's, let alone work orders. Default passwords are commonplace ("ma5t3r", "9052/9052" and the like), and it's very easy to get an employee to Log in for you if needed. WalMart keeps printed logs of just about every transaction that is created, as well as in electronic form.
If it were an inside job (which I doubt knowing the intellect of most Wal-Mart Workers. Do you want to be the squiggly?), all someone would have to do is gain access to the UPC office, bring yer good ole' hub, a WAP, and volia....no one would ever notice (usually because there are boxes stacked in the UPC offices, and well, no one really has a clue to what really needs to be in there, anyway).
(Posted AC to protect my job)
In that case, people were writing down the number of a card still on the shelf, or taking pictures of the bar code or something, and then noting what the sequence is (they are in order, after all) and then going home, and using the 1-800 number to see how much money was on the card to see when it was sold.
Once they found a number with money on it, they'd modify a card that they had (printing bar codes and reprogramming magnetic strips is easy) to have that number, and go and spend somebody else's money. Easy.
Seems easy enough to track, as 1-800 numbers include caller ID type info, so just see what number was called to check the balance of the card before it was depleted of funds, and if the same number shows up a few times, call the police ...
To make matters worse, the fine print basically said that this sort of loss was the customer's problem, not the retailer's. So the retailer was refusing to pay people for the lost money ...
In any event, giving a gift card sucks, even without this scam. It has *all* the tackiness of giving cash, but with the additional tackiness of telling you where you can spend this money. If you're going to buy me a present, buy me a present. If you want to give me cash, I certainly like cash. But don't spend cash on a gift card ... either use it to buy me something, or just give me the cash.
And if this does happen to you, scream bloody murder. Do not accept anything less than all the lost money, even if the fine print says that it's not their responsiblity. Call the local media if you have to. Make a scene in the store. Call the corporate office if you have to ... you'll probably eventually get your money.
I know how this is being done, our local Walmart has a big problem with this over the last holiday, and after some investigation they figured out how it was being done. Here's the know-how:
e aders/
You can also by rather cheap swipe formatters/programmers with a quick google.
Quick background:
-None of the "amount data" is stored on the gift card. It's all server side, interfaced by the cash registers when swiped. All the card has is a unique ID number to identify itself to the register when swiped.
-The cards used have credit card type stripes on the back, easily readable by *many* cheap swipe readers. http://www.barcodediscount.com/cats/credit-card-r
-The cards are also sold on shells that anyone can get to, and they are on cardboard backing packaging where is it *very* easy to just bend the package and have full access to swiping the card.
The procedure:
-First the criminal buys a bunch of cards for the lowest possible amount. I think this is $5. They now have valid cards.
-Next the criminal takes a small Credit Card swiper into the store, grabs a hand full of the cards and swipes a ton of them..stores the card info into memory on the device or a small laptop/pda in their pocket or purse. then they place the card back on the shelf and go home.
-They go home and use the numbers they have taken from cards at the store and program them over the valid $5 card they had bought.
-A few days later, under the assumption that the cards they had copied have been legitimately sold and not yet used they go into the store with their copies and use them. All it takes to verify the card is working is to find a stupid wal-mart drone and ask them to scan it and tell you the worth of the card. As far as the cash register system is concerned the card is valid because it has a valid ID number. If it comes back with more than $5 on the card available for spending, they criminal wins. Spend the card and go on their way.
-Now when the actual owner of the card comes in it will appear to have been spent, as its ID number is the same as the one used by the criminal has been used, even though the card technically has not.
Its rather ingenious actually, and works best at Xmas. You scan cards the 15-23 assuming they will be activated and you will have a few days until they are spent (at least until the 25th) as they are popular Xmas gifts. It's also hard but not impossible to track the criminal, as you have to find the time of the transaction and dig up video of the transaction taking place...and most walmarts have rather shotty video quality at the registers, but the chance of getting caught in the act are slim and none. But if you do it, don't be surprised if cops show up at your door a week later. Snoogins.
adventure-today.com