Security Breach Exposes 40M Credit Cards

The Good Reverend writes "MasterCard International announced today that a security breach at CardSystems Solutions, a third party processor of payment card data, potentially exposed more than 40 million cards. Mastercard is aware of the specific card numbers affected, and is giving its member financial institutions the numbers that may have been compromised. Unlike many of the past high profile cases this one involves a hacker rather than lost packages. CNN Money, the New York Times, Reuters, MSNBC, ZDNet, C|Net, and the Washington Post are also covering the story."

Comments

Proves that the hackers...

[bpuli]

will always exploit the weakest link in the chain. MasterCard itself might have the best security but what about all the systems downstream? Wonder how many more of these transactions processors have been compromised and don't even know it yet.

Re:Proves that the hackers...

[whovian]

will always exploit the weakest link in the chain. MasterCard itself might have the best security but what about all the systems downstream?

Agreed. One wonders how to trust your contractees and outsourcees. It would argue for the most data-secure companies to cut out the middleman and do their own processing.

The cynical side of me says that there lurks a propaganda campaign to be pushed here by those in favor of introducing new credit card feature, perhaps RFID or biometrics. I cannot say whether those are good solutions, but it certainly seems that some form of security that requires you to present physical evidence of your credit card or account seems in order -- may even a PIN?

Re:Proves that the hackers...

[Ian Jefferies]

Just wait for the spam social engineering angle to kick in:

"Just enter your credit card details into this site to see if your credit card number was one of those stolen"

(Answer: not until 5 seconds ago)

Re:Proves that the hackers...

[Anonymous Coward]

Have to agree here. I work for a large mailing house company which processes client data and sends out bank statements and tax details and all sorts of other private information.

Having a in depth security background, I can safely say that the security of this place is shocking. The guys handling this sensitive data are just kids straight out of uni. The banks etc themselves can go to great lengths to protect their clients data, but then they outsource to 3rd parties and hand over all their data to be processed.

Posting anonymously for obvious reasons.

Re:Proves that the hackers...

[IWannaBeAnAC]

The UK has recently introduced PINs with their credit cards, and my credit card (with Dutch bank ABN-Amro) was just replaced, the new one also has a PIN with it. I haven't tried it out yet, but apparantly the ONLY way to authorize payments with it is to supply the PIN.

Re:Proves that the hackers...

[beardz]

You do of course mean Chip and PIN. Credit cards in the UK have always had PIN #s to allow card holders to withdraw cash from ATMs.

Re:Proves that the hackers...

[IWannaBeAnAC]

Of course. But prior to now the PIN had nothing to do with it being a credit card. But I guess you were not born very long ago if you think credit cards have always had a PIN ;-)

Re:Proves that the hackers...

[Michael Spencer Jr.]

(I work in the payment processing industry, but other than the article I don't know any more about this incident than you guys do.)

That makes me wonder: how does the security of different payment processors correlate with their processing rates and operational cost? It seems to me, as a First National employee, that our fancy well-designed computer systems, our multiple security-related departments, etc., increase our cost of doing business, so we get beat on price by a lot of other processors. We're not the cheapest processor out there.

Since I'm not an industry expert, and I don't know what everybody else charges for processing, I'm curious: for any Slashdotters who are also merchants (own a business, accept credit card payments), does this ring true? Big company, big systems and good security, higher internal cost, higher prices? Small company, smaller systems and maybe less security, lower internal cost, lower prices?

Re:Proves that the hackers...

[Phil Wherry]

It's about time for the financial services industry to step up and take responsibility for designing a payment infrastructure that can accomodate the current threat environment. A sixteen-digit reuseable number can't provide adequate security, even when coupled with real-time billing address and CVV2 tests. Payments need to be authorized individually by the accountholders, and these authorizations need to be tied to a specific date, time, merchant, and amount (or in the case of recurring payments, a time span, number of payments, and maximum aggregate amount). In this scheme, leakage of an account number doesn't connote authorization for payment--and leakage of a payment authorization doesn't enable re-use by others.

It will be hugely difficult and very expensive to make this change, of course, as it involves replacing a great deal of infrastructure. But ultimately it will be required due to the simplicity of fraud using today's technology. It's gotten to the point where most of the difficulty and expense isn't the technology for payment authorization; it's instead the cost associated with the changeover itself and with retraining consumers and merchants.

So, from where I sit, it looks like the costs of fraud being absorbed by the financial services industry (and, of course, being passed on to consumers in the form of higher fees) aren't being offset by a decrease in the eventual cost of making the system secure. It's time for the financial services community to take responsibility, then: accept the fact that it will be difficult and expensive to make the change, but also accept its necessity and inevitability.

Re:Proves that the hackers...

[kinzillah]

and now people can shoulder surf in stores, have someone grab your wallet, withdraw money, and you have no recourse because they got your pin.

Re:Proves that the hackers...

[kevstar31]

...and then it pops up it is now!

Re:Proves that the hackers...

[squeee]

Mine had a PIN long before chip and pin, because how else was I goint to get at cash from an ATM at 5% charge.

I think that we'll see more of this

[udderly]

As the complexity and number of features that are added to information systems increase, the opportunities for compromises grows--probably exponentially. We will see a real change in the security policies only after one of the companies has an enormous financial loss.

Re:I think that we'll see more of this

[mark(florida)]

>We will see a real change in the security policies only after one of the companies has an enormous financial loss.
Amen!!

Re:I think that we'll see more of this

[vought]

We will see a real change in the security policies only after one of the companies has an enormous financial loss.

Ha ha ha! This is the United States, man. You seriously think MasterCard, Visa, Amex or anyone besides the middle management "responsible" for the defrauded property of these companies is going to be held accountable?

There will be no "enormous financial loss". Your point about complexity is completely true, but the companies that build such terrrible infrastructure in such a hurry will never take it in the shorts. They'll just fire somebosy and band-aid the situation.

Re:I think that we'll see more of this

[Xyrus]

Here's the ting though, the credit card companies aren't suffering financial losses.

When fradulent charge is made, you call them. They call the merchant and say, "Sorry bud, you just got pwned."

The merchants take the hit. So credit card companies could really care less.

~X~

Re:I think that we'll see more of this

[NewStarRising]

"So credit card companies could really care less."

So they do care. They _could_ care less, so their level of care must be high.

If they could _not_ care less, then their level of care must be as low as you tried to say (non-existant).

Re:I think that we'll see more of this

[snorklewacker]

Captain Anal, the Anal Alert is flashing! To the Analmobile!

"I believe you mean that the indicator light associated with the Anal Alert is flashing. Secondly, your second sentence was not even complete..."

Re:I think that we'll see more of this

[AnonymousCowheart]

That's because its up to the merchant to verify the (current) cardholder is the actual owner of the card. If in doubt with the signature - they are to check an ID. If no ID is provided, they are to ask the consumer to call the bank on the card and verify it is them. Of course, nobody does this - but after a few times a mom-and-pop shop gets "pwned" they will. This is likely all in the agreement when you get the sticker that says "mastercard" on your shops doorfront.

A bit over 1/4 were mastercard branded...

[the packrat]

But that leaves a little under 3/4 who aren't mastercard branded. If it was a typical third-party payments system then it is likely that they handled other types of credit cards, just that those companies havent commented yet.

So when is the other shoe going to fall?

Re: A bit over 1/4 were mastercard branded...

[Black Parrot]

> But that leaves a little under 3/4 who aren't mastercard branded. If it was a typical third-party payments system then it is likely that they handled other types of credit cards, just that those companies havent commented yet. So when is the other shoe going to fall?

The news has been reporting for the last 14 hours (at least) that the four major credit cards are all affected.

Also, this has been known since May 22, but everyone was keeping it quiet.

If there's another shoe, it's going to be that the breach was even larger than reported, or that they got more information than we're being told.

Re: A bit over 1/4 were mastercard branded...

[the packrat]

The news has been reporting for the last 14 hours (at least) that the four major credit cards are all affected.

News other than ./, and quite a few of them are equating this breach with a 'Mastercard breach', which I why I added this comment here.

Also, this has been known since May 22, but everyone was keeping it quiet.

And given the current lack of comments from everyone except Mastercard, they are still keeping quiet. Most of the creditcard gateway product companies seem... overly disinterested in security. I expect this will prompt a long overdue audit of their collective security and turn up a bunch of other unrealised breaches. B>

Re: A bit over 1/4 were mastercard branded...

[44BSD]

It may have been known abt since 5/22, sure. But how long was this "script" running undetected on CardSystems' equipment?

Two possibilities spring to mind immediately (and of course others are possible as well):

1. An insider did this.
2. Unpatched boxes were subverted and this really is a break-in.

Either way, these folks had unauthorized, undetected code running and snarfing up some of their most critical data. That isn't good for the company image. Moreover, we *know* that the snarfed data made its way out of the organization (i.e., it wasn't just being dumped to a file which somebody found), because this was only detected when it caused SOMEBODY ELSE"S fraud detection systems to trigger. This is bad. Somebody got evil code in. Somebody got evil code to run undetected. Somebody got evil code to transmit data out (or did the data walk out in an employee's iPod? Hmmmm....).

MasterCard dropped this bomb for a reason. The press (I'm looking at you, Bob Sullivan) needs to be asking the right questions.

RTFA PEOPLE

[Anonymous Coward]

About 25 MILLION of the 40 WAS NOT a MasterCard, so there are a WHOLE bunch of credit card providers who like leaving you in the dark here people.

And in other news...

[Kaorimoch]

And in other news, the WidgetCard from the WidgetCard corporation, breaking tradition from the main Credit Card corporations, are proud to announce that they have not lost any cardholder's data. This is an especially newsworthy event due to its rareness.

More news at five.

US numbers only?

[mr_tap]

I wonder if it was only US CC numbers or if we all have to worry?

Re:US numbers only?

[Curtman]

I think we all have to worry anyway. This kind of shit happens all the time. They're going to find the people responsible for these, and the corporations that allow it to happen will get off with only a bit of bad publicity. That's the real tragedy. There ought to be a law that if you are going to retain someone's personal information then you are responsible for keeping it safe. Same as I'm responsible for keeping my PIN number safe.

Re:US numbers only?

[thogard]

No it wasn't just US cards.

This is a 3rd party processor that I expect processes payments from someplace like retail stores. Anyone that used any credit card at those merchants may have had their card recorded.

Re:US numbers only?

[eamonn_sullivan]

Why don't they just make it a criminal offense to negligently disclose someone's personal information. There's nothing like the possibility of jail time to motivate a board of directors.

Re:US numbers only?

[dabigpaybackski]

Boards of directors of major corporations are comprised of privileged people, and are therefore more or less above the law. Credit card companies most definitely enjoy such protection in our society.

The legislative and executive branches of the U.S. government are so intertwined with corporate interests that they function as one criminal entity. Libertarians call it "crony capitalism," and the leftist Ralph Nader calls it "corporate socialism." Both labels describe the phenomenon admirably.

My suggestions for beleaguered credit cardholders, which comprises the majority of Americans, is:

1. Demand stricter accountability of the issuing banks and credit card companies on pain of boycott. Tell Visa or Discover that you are going to reduce or eliminate your credit card expenditures until they produce tangible evidence that incidents of this kind will never happen again. They have the incentive to comply.

2. Use cash, for heaven's sake. We are being socially engineered to conduct financial transactions by easily-monitored and insecure electronic methods. It doesn't help that our own lust for convenience is spurring us toward the abandonment of cash transactions, which Uncle Sam can't get his hooks into. We do not want a "cashless society," which is the wet dream of social engineers and institutional counterfeiters.

Re:US numbers only?

[eamonn_sullivan]

> Boards of directors of major corporations are comprised of privileged people, and are therefore more or less above the law. Someone should tell Tyco's former CEO, Kozlowski. He can just go home, then.

Re:US numbers only?

[gstoddart]

There ought to be a law that if you are going to retain someone's personal information then you are responsible for keeping it safe. Same as I'm responsible for keeping my PIN number safe.

In Canada, there is one already.

The problem is when companies out-source to US companies, the US decides to extra-territorially apply the PATRIOT act to that data and some of the legal protections get lost in the haze of multi-national companies.

It'd be interesting to see what would happen if an out-sourced data centre holding US data decided to apply the same thing -- there would be outrage.

Re:US numbers only?

[Curtman]

In Canada, there is one already

I know. Look down. ;)

Lesse

[yotto]

Interest rate: 20%
Annual Fee: $40
Randomly being declined because the machine is on the fritz: $1-$1000 purchase down the drain.
Being the target of fraud through no fault of your own: Priceless.

Re:Lesse

[StupidKatz]

I fail to see why this is made out to be such a big deal by the consumers. Have any of you read the service agreement/contract for any of the major credit cards? Do you know what you are liable for in the event of a fraudulent/unauthorized charge? If you did, you'd probably be unable to care less about stories like this.

The basic liability for consumers under MasterCard and Visa is $50 (probably per incident). Now, that could be a problem, except for the fact that MC and Visa waive that liability. So, what are your responsibilities when it comes to reporting fraud? Simple: you report the unauthorized charge to your bank, usually via the 800 number on the back of the card, within 24 (or possibly 48) hours after discovering the fraudulent activity. This means that if you don't open your bill for two months, and so discover the charge six weeks after it happened, you can call in the next day and have ZERO liability. The best part is, since it was a credit card, it's not YOUR money that is lost - unlike a debit card. Hint hint: always use a credit card to buy stuff, not debit or ATM cards.

The real losers here are the merchants, who get stuck with the ~4% per transaction fee and often have to eat the cost of the fraudulent purchase. OTOH, how many merchants can afford NOT to honor the major credit cards?

Re:Lesse

[mrmtampa]

-- The real losers here are the merchants, who get stuck with the ~4% per transaction fee and often have to eat the cost of the fraudulent purchase.

The real loser is always (ALWAYS!!!) the consumer. The merchants pass the loss back to the consumer in higher prices.

Re:Lesse

[shmlco]

Or in this case, generally higher interest rates, fees, and charges.

Cost of re-issuing cards

[00squirrel]

I've always wondered why credit card companies don't simply cancel and re-issue cards when somthing like this happens. I read in the MSNBC article that it costs $10.00 per card to do that, which means this particular incident would cost the credit card companies about $400,000,000.00 to reissue cards. That is a ton of money!

Re: Cost of re-issuing cards

[Black Parrot]

> I read in the MSNBC article that it costs $10.00 per card to do that, which means this particular incident would cost the credit card companies about $400,000,000.00 to reissue cards. That is a ton of money!

One story I read on this said that it would cost banks a billion dollars to replace the cards, which is why people weren't being sent new cards already. (They've known about this for several weeks now.)

Re:Cost of re-issuing cards

[ChiRaven]

Besides the cost, there's the convenience factor. I have at least half a dozen routine bills charged to my MasterCard debit card every month. If they change that number, I have to (a)remember which bills they are and (b)notify all of them of the new number. Of course, I guess that's better than having a few EXTRA unauthorized bills charged to that number every month.

The glories of outsourcing, coming home to roost on the idiots that gave up end to end cocntrol of their data streams. Too bad that those idiots will never have to pay the price. It's the rest of us who will have to pony up.

Re: Cost of re-issuing cards

[CommiePuddin]

It sounds like a cost-benefit comparison. The total of lawsuits that the card holders will file for exposing them to fraudulant use must be less than the $400M being reported here (or whatever the splits may be across the card networks).

Re:Cost of re-issuing cards

[Xyrus]

Compare that to the $0 dollars they have to pay on fraudulent charges (merchant has to cover it).

I don't think they'll be rushing to reissue cards.

~X~

Re:Cost of re-issuing cards

[Qfix]

Umm, try an average of $82 per card. These fuckers are back and they're gonna fight for the right to provide you with a line of credit 7x your annual income.

What I would like to see

[Timesprout]

since people here (Ireland) and the UK are basically being encouraged to rack up debt is some one to crack Mastercard/Visa and wipe out all the amounts owed on credit cards. Might encourage the financial institution to be a little less carefree with their lending policies.

Re:What I would like to see

[antifoidulus]

I wonder if some unscrupulous people will do this on a smaller scale. Most credit card companies have fraud protection. Usually in cases where an individual's card is stolen the companies refund the person whose card was stolen and then try to track down whoever stole the card. However, with 40 million of these stolen, it is going to be very hard for the companies to figure out who really was victimized and who is trying to get some free stuff.
Well, consideringi the way CC companies abuse interest rates, I hardly have pity on them though....

Re:What I would like to see

[timmyf2371]

On the other hand, we could always ask the "responsible" adults who take out these credit cards to actually take responsibility for once and only take out and use credit they can afford to pay back?

My father has many many credit cards which give him potential credit facilities to the tune of over twice his annual salary. His credit file is near perfect with the exception of a few late payments to cards (by a few days) and he has certainly never taken on more credit than he can afford.

Yes, maybe credit card companies should have a "responsibility test" which takes into account whether potential customers are willing to take responsibility for their actions and reject those who would rather not, however their current checks such as credit reference checks and the like do give a fairly accurate picture of people's finances and the people applying for these cards should take responsibility rather than blaming the card companies themselves.

Re:What I would like to see

[bigtallmofo]

I agree with your common sense post.

Just thought I'd add that your father's credit might be better than he thinks. You don't appear to be in the U.S., but the big credit reporting agencies in the U.S. don't even have a record of "a few days late". Typically, one must be 30+ days, 60+ days, 90+ days or 120+ days late on a payment for it to fall into one of the negative slots that affect one's credit.

Of course, that doesn't stop the credit card company from penalizing you for being a few days late with late charges, increasing your interest rate, etc. That's becoming more and more common.

Re:What I would like to see

[Kinetix303]

If you can't pay a mere 2.1% of your bill on time, only once a month, then you deserve whatever late charges get heaped upon you. Don't like it? Go see a credit counsellor.

Re:What I would like to see

[j0e_average]

It's a double-edged sword....what responsiblity should the card companies take for thier irresponsible lending practices. For goodness' sake, if you can fog a mirror, you can get credit. If fact, the way the rates are structured on credit cards, the credit card companies EXPECT to write off a percentage of the portfolio. This write-off is insignificant (in relative terms) to the profit they make on the poor saps out there paying 21+% on their accounts. The overnight rate on this money is what, 4%? And being the ever-greedy corporate pigs, the banks now petition congress to pass "Bankruptcy reform" laws, which essentially prevent Mom and Pop consumers from walking away from their debts after filing bankruptcy. I'm not saying it's morally or ethically right to allow folks to take a free ride on the system, but at the same time, the credit card companies have at least half the blame due to their lending policy. The difference is that they (the banks) have deep pockets with which they can buy legislation. Yes, I do work at a bank...and no I would NEVER contribute to their PAC.

Re:What I would like to see

[timeOday]

On the other hand, we could always ask the "responsible" adults who take out these credit cards to actually take responsibility for once and only take out and use credit they can afford to pay back?

It's counterintuitive, but I don't think this is what the creditors want, really.

Yes, they would like everybody to be in debt up to their eyeballs and still get 100% repayment, but the simple fact is some percentage of people who borrow to the max will have a period of unemployment, or divorce, or health problems, or simply get discouraged and choose to flake out.

Getting closer to 100% repayment would require significantly lower levels of personal debt and higher savings. It works out better for creditors, and perhaps even for the GDP of nations, to keep individuals highly motivated - on the edge of financial disaster. The ocassional losses are more than compensated by high balances at high interest.

Creditors like to take on this victim complex whenever somebody fails to repay. But in fact, all investments have risk, including loaning money to people through credit cards. That level of risk is already reflected in the high interest rates that borrowers pay on the cards. Why do companies offer these risky "payday loans"? Because the usurious interest rates and penalty fees more than make up for the losses.

Creditors also like to blame deadbeats for placing an extra burden on the rest of us good, hardworking and honest citizens. But this too is mostly false, since people are placed in different pools depending on their payment history. Those with significant credit history blemishes are already paying sky-high interest rates - a sort of security against the credit, which they will never get back even if they are perfect borrowers for the rest of their lives.

And in case you're wondering, no, I don't have bad credit. But I do have only so much pity for the credit card companies, with their crocodile tears, as they demand bankruptcy reform (favorable to themselves, of course) while socking away truckloads of profit. If our law were really putting creditors in an unfair disadvantage, credit would be hard to get, and that would be a problem. Instead, payday loan outfits are sprouting on every corner like mushrooms, and college students with no income can get as many credit cards as they like. That doesn't sound like an under-profitable industry to me.

Re:What I would like to see

[Xugumad]

While I think society's general attitude towards borrowing (and putting problems off until later, in general) is terrible, and the media's encouragement of this (it seems every time lending goes down, they panic about the economy is slowing), I've got to agree with the people that talk about personal responsibility.

Re:What I would like to see

[Ark42]

Of course, the CC companies DON'T CARE if you are trying to get some free stuff. They will happily issue chargebacks and give you your money back. The only person hurt here is the merchant, who loses the amount of the sale, a transaction fee of a few percent of the sale price in both directions (one for the sale, one for the chargeback), and a chargeback fee of at least $35 per item being forcefully refunded.

So as you can see, it is the merchants that people are abusing, not the CC companies. The CC companies pocket the chargeback fee as well as double the transaction fees, without having to pay out a cent to the merchant. The customer gets their free item and all of their money back, and the merchant is out one item and probably $40 or more, depending on that items cost.

I'm not suggesting that people should withhold from reporting fraudulant use of their cards, but it is easy for people to get away with stealing from merchants, and neither the theifs taking the CC numbers, nor the people abusing the situation and getting free stuff are hurting the CC companies at all.

Re:What I would like to see

[suwain_2]

Might encourage the financial institution to be a little less carefree with their lending policies.

Or a little more strict in their security policies.

Re:What I would like to see

[shmlco]

...the big credit reporting agencies in the U.S. don't even have a record of "a few days late". Typically, one must be 30+ days, 60+ days, 90+ days or 120+ days late on a payment...

I believe that "30 days late" has come to mean the first 30 days, and late, with 30 days the assumed term. As such, if you're payment is due 20 days from now, and you pay on the 22nd day, you're still "30" days (1 payment) late in their, and the credit bureau's, eyes.

Re:What I would like to see

[kosmicki]

"Reason for decline of credit: Insufficient credit history."

*Breathes on mirror*

Yep fog.

Guess that card has higher standards.

*looks for another offer to try*

Re:What I would like to see

[corpsiclex]

you saw fight club too?

Re:What I would like to see

[karnal]

Nope.

Every credit card has a billing cycle - take your due date on your statement and add 5-7 business days to it.

Then, if you don't get your payment to the company by the cycle date, your days start adding. The day after your account cycles, you are 1 day late.

In addition (Discover Card does this...) some credit card companies are "nice". That in if you miss 2 payments, they don't report you at 30 days until your 60th day past due.

As well, if you make a partial payment, you can still be deemed overdue, since you didn't make the total minimum. Unless of course, you work out a deal with the creditor....

*Used to do collections for previously mentioned company whilst in college.... was kinda fun...*

being a site full of geeks

[circletimessquare]

everyone here will be proposing a technical solution

but let me posit my own nontechnical solution: the processor must pay for a replacement card for every single victim

Re:being a site full of geeks

[gweihir]

the processor must pay for a replacement card for every single victim

An one more: Processors should have mandatory insurance against this event. Then the insurance company would check their security with a keen eye....

Re:being a site full of geeks

[EggyToast]

Being that this is a credit card company, most likely they will do this already. Of course, they probably won't do it until the person with the number requests a new card, but all it takes is a phone call to get one.

Since pretty much all credit card companies are under contract to research fraud on someone's card and not charge their customer for fradulent charges, it's FAR, FAR cheaper for them to send out a new card and cancel the old number than it is for them to wait and get stuck covering those fraudulent charges.

That's one reason why I like credit cards over debit cards. It's one step removed from my real money, so if it gets stolen or abused by someone, I don't have to contend with a drained bank account and a bank that's less than willing to help recover my money.

Re:being a site full of geeks

[timeOday]

That's a fabulous idea, except currently they have no liability that would necessitate insurance! Fake charges are pushed back on retailers.

Considering the credit card companies are paragons of individual responsibility and have no qualms about charging a $40 late fee for a payment 1 day late, what should their liability be for this sort of collosal screw-up?

Re:being a site full of geeks

[Joe Jarvis]

Actually, if we should do anything, it's stop holding vendors responsible for fraudulent charges and move that accountability to the banks, credit card companies, and third party processors. This would create an immediate incentive to stamp out ID theft and CC hacking. As it stands now, the vendors will bear the brunt of any of these thefts and the banks will actually make money on them.

Re:being a site full of geeks

[Anonymous Coward]

I work for a credit card payment processor (not the one in question), so I can speak to this directly:

Visa and other credit card companies have recently been getting VERY demanding regarding security practices. They have literally forced everyone that processes payments for them to secure their networks, or face losing their processor license, and with it, all of the customers that use Visa.

The security requirements are part of a new program called CISP (Cardholder Information Security Program), which requires safeguards that are at least as demanding, if not more so, than federal reserve requirements for banks. You can read more about CISP here.

Some of these requirements are:

- All cardholder data is encrypted whenever stored.
- Firewalls need to protect perimeter networks (of course).
- All passwords used by sysadmin or developers need to be changed on a regular basis, and must adhere to strict guidelines about length and password strength. This forced us to deply LDAP.
- OS level auditing must be turned on, and all employee access to any cardholder data must be audited and stored in a secure location.
- All hosts on the network must be scanned regularly using Nessus or other commercial scanning tools.
- Security patches must be applied regularly, based on the results from the scans.
- Intrusion Detection Systems must be installed on the network.
- No insecure protocols can be used such as telnet, rlogin, etc. All communication must be secured using SSH or some other type of encryption.
- There are also a ton of safeguards to prevent developers from sneaking malicious code into production systems (ala Office Space). No one developer can modify code without another developer signing off on it, and a security officer approving the code before it is released from development to QA, and from QA to production.
- Different teams of developers work in Dev, QA, and Production in order to prevent any one team from being able to hack the system.

This all adds up to millions in extra costs for the credit card processors. It has been a huge burden on the industry. These safeguards are a good idea, but the problem is that the credit card system is only as good as it's weakest link. The company I work for might be as secure as humanly possible, but because some processor that's a hell of a lot bigger than us in Arizona got hacked, the security at my company does those people no good.

Anyway, I'm posting this anonymously so you can't tell where I work at.

Re:being a site full of geeks

[Qfix]

You mo-fo's in Columbus better be CISP/PCIDSS compliant cuz daddy's bettin' his retirement nut on you. Hmmm...surely they're not.... telnet www.tsys.com 80 Server: Microsoft-IIS/6.0 OMFG!! Sell! Sell! Sell!

Re:being a site full of geeks

[zanderredux]

mandatory or not, CC companies might actually get insurance since a lot of their processes are outsourced and they just cannot possibly ensure that each one of their outsourcees comply to security norms (PHBs actually like to come up with or use a provider of some standardized security test which mean absolutely nothing, since the PHBs themselves do not know what to look for).

in the end, insurance or not, expect the cost of credit to increase in the future. take note: the interest rate spread will increase!!!!

The card number / expiry-date system is stupid

[mukund]

Banks and financial institutions need to start using public-key encryption to authenticate a user rather than a card number and expiry date. Many visa/master cards already come as smart cards these days and it should be easy to upgrade them to operate as a JavaCard for example. Couple this with a USB card reader issued by the bank. A website can then ask for a signed payment (to be signed in a chip inside the card) valid for a short time period and only usable once in the transaction only. You verify it by looking at the reader, or a display on the card itself and reading the name of the store you're making the payment for, and press a button on the card or on the reader to grant/deny it. In this way, no external software outside the card is involved with granting money which can be tampered with. The signature takes place in the card. No credit card numbers stored. Payment made. Everyone's happy.

Re:The card number / expiry-date system is stupid

[Ph33r th3 g(O)at]

The use of a copiable token is stupid, as you point out. Visa and MasterCard agreed on a protocol called "Secure Electronic Transaction" that does indeed use PK cryptography, in 1996. Apparently they decided it was cheaper to let their customers bear the cost and hassle of dealing with the fraud in the existing system.

Re:The card number / expiry-date system is stupid

[jacobito]

Apparently they decided it was cheaper to let their customers bear the cost and hassle of dealing with the fraud in the existing system.

I'm not sure if that was why SET failed. I worked for a company that sold a complete suite of SET software, and the main problem with SET, as far as I could tell, was that SET was too complex and too expensive for merchants to implement -- no merchant wanted to spend the money needed to completely train their staff and retool their web sites to support SET, especially when encrypting the channel with SSL was seen as good enough (though the latter, of course, does nothing to protect cardholder data).

Re:The card number / expiry-date system is stupid

[cait56]

Agreed. There are numerous known techniques that credit card companies could use that would prevent this type of theft and fraud.

Corporations manage to exchange lots of data without it being routinely stolen: internal cost analysis, detailed product analysis, planned bids on oil rights, plans on how much they will pay for another company, real estate investment plans, trade secrets on how their products are built.

The very simple solution to making businesses treat personal data as valuable is to make it valuable. Establish a minimum amount as liquidated damages for leaking someone's credit card (probably on the order of replacing the account and a nuisance fee) and personal data like social security number and birthdate (much higher).

I believe we could trust the free market solution to work out an efficient solution promptly. Once the company that lost the data paid for the costs.

Re:The card number / expiry-date system is stupid

[AdamInParadise]

Well, not really stupid, just outdated.

The system you're describing is called Finread.

Finread is more secure than previous solutions because its smart card reader is "smart". It has a pinpad, a screen, a Hardware Security Module and a smart card reader. It is designed to work with EMV smart cards (a public-key scheme). You put your card in the reader, the screen displays the amount and the recipient, you type your secret pin on the pinpad and voila, payment's made.

Since the reader "smart", the remote payment processing system can bypasses your spyware-infested Windows machine to communicate directly with the card through a small, dedicated piece of hardware that is much easier to secure than an computer. Keyloggers and spyware are inefficient because your computer does not process any sensible piece of information. It's like opening an bi-authenticated SSL channel between your card and the Visa or MasterCard processing systems.

Finread is far from perfect, but much better the current situation. The only drawback of Finread is that it is so good that when it will be cracked, banks will probably manage to claim that everything's fine for a long time.

Now, of course, for lost tapes, we still need something else.

Re:The card number / expiry-date system is stupid

[thogard]

I worked for SETCO. The reason SET died was that no one built a system that didn't have either provable problems or worked just like systems that did have provable security problems. The system was too complex for most companies to implement properly.

Re:The card number / expiry-date system is stupid

[alienw]

That's a stupid idea. The current system is actually surprisingly decent. You can't possibly lose money from someone stealing a credit card. Either you call the company and disable it or you perform a chargeback. Not to mention most merchants won't ship to anywhere other than your billing address without verification from you, which pretty much makes obtaining merchandise in a fraudulent manner next to impossible.

Your scheme would require hundreds of dollars in hardware in order to buy stuff, and you would have to drag around a card reader with you everywhere (I often make online purchases from random places). I'd say a system like that would pretty much kill off e-commerce. Also, maybe you have smartcards in Europe, but I've yet to see a single smartcard-based credit card here in the US. Virtually all credit cards here are regular magstripes.

Re:The card number / expiry-date system is stupid

[Waffle Iron]

I often make online purchases from random places

That's rather stupid. Who knows what kind of trojans and/or keyboard loggers might be installed on those random machines?

Re:The card number / expiry-date system is stupid

[accessdeniednsp]

Citibank already has one of these. I can't use it because the card reader does not work on anything but Microsoft-flavored systems. Not even the MUSCLE card project has support for it (and it has been asked).

The card reader I have is the USB flavor, too.

I'm sure the other 80% of the people can use it, but I can make a good guess that very few of those 80% actually DO use it.

You can lead that horse to water as hard and fast as you'd like...

Re:The card number / expiry-date system is stupid

[mukund]

Not to mention most merchants won't ship to anywhere other than your billing address without verification from you, which pretty much makes obtaining merchandise in a fraudulent manner next to impossible.

Goods aren't the only things purchased with credit cards. Many Internet services such as iTunes or dating websites have nothing to ship. Think of Amazon gift certificates.

Your scheme would require hundreds of dollars in hardware in order to buy stuff, and you would have to drag around a card reader with you everywhere (I often make online purchases from random places). I'd say a system like that would pretty much kill off e-commerce. Also, maybe you have smartcards in Europe, but I've yet to see a single smartcard-based credit card here in the US. Virtually all credit cards here are regular magstripes.

Perhaps you have not understood how this would be implemented and used. Let me explain. You already use a card reader when paying for a lot of goods and services. When you go to a restaurant and pay with your card, they put it in a card reader. The same way, a computer can also read data from cards by having a device attached. Now, coming to the topic of lugging that device everywhere you go---you do not have to. By the time such a system takes off (and trust me, eventually we will use some sort of system which resembles the one I've described as nothing else is secure enough), many desktops will have a card reader attached, for various purposes such as authentication of your identity instead of a username/password. The transaction(vendor, price, transaction ID) will be displayed on the *card* and you can pretty much buy items using any reader as the signing operations take place inside your card which you carry around, just like you carry your current credit card around.

How much more would all this cost? Not much more than the amount of insurance which these financial institutions end up paying due to frauds caused by using an insecure system. A card reader currently costs US $25, which a bank can afford to provide to a customer for better security.

The burden of using a system should not be upto a vendor or a customer (e.g., shipping to the cardholder address only). It makes it incredibly inconvenient. The other day I ordered a DVD drive and wanted it shipped to my office address and the stockist just wouldn't. How can I send a gift to a person in another country? The current system is not right, and there'll be something which'll fix it.

The current system is incredibly stupid, because it doesn't verify a person. It merely identifies a person's card with a card number, and this identity can be adopted by anyone masquerading as that person.

Re:The card number / expiry-date system is stupid

[snorklewacker]

SET failed because the CC companies MC don't want to pay a dime of the costs of upgrading the 20 hojillion mechanical zip-zap machines out there, and they want to support them til the year 3000, and there will never be a law compelling them to upgrade them.

That's why.

Re:The card number / expiry-date system is stupid

[alienw]

I honestly don't care. You can't do anything with a credit card that can't be resolved with a call to the CC company. Most merchants don't have very good security anyway; I bet most of the smaller online shops store credit card info in a mysql database without any kind of security.

Re:The card number / expiry-date system is stupid

[alienw]

I had a CC number stolen, and it was used to purchase software online, which was DOWNLOADED, not shipped, bypassing the mismatched shipping/billing address theory.

Call your credit card company. Say the charge was unauthorized. Get the charge reversed. Problem solved.

There are systems out there that prevent this problem much more easily. For instance, Citibank can generate single-use credit card numbers that expire in one month and are locked to a merchant. Much less hassle than dragging around card readers with you, and you still have the ability to order over the phone, for one.

Re:The card number / expiry-date system is stupid

[alienw]

Goods aren't the only things purchased with credit cards. Many Internet services such as iTunes or dating websites have nothing to ship. Think of Amazon gift certificates.

That's why credit cards have fraud protection. You call them up and reverse the charge. ...many desktops will have a card reader attached...

They were saying that back in 1994. Hasn't happened yet.

A card reader currently costs US $25, which a bank can afford to provide to a customer for better security.

Banks exist to make money. They make money by having the customer use credit cards. This would discourage the use of credit cards, and you would no longer be able to order stuff over the phone or by mail or fax (which is still a significant percentage of orders). Not to mention that a truly secure card reader would cost a lot more than $25. $150 would be much more realistic. To be even somewhat secure, it would need to at least have a display and its own network connection, which adds quite a bit to the cost.

The burden of using a system should not be upto a vendor or a customer

Customers generally don't need to ship stuff to 20 different addresses, and it's not difficult to call your bank and have them add another authorized address. Most places will still ship to an alternate address, they will just call you first to confirm. Having to use special card reader hardware would be much more of a hassle.

The current system is incredibly stupid, because it doesn't verify a person. It merely identifies a person's card with a card number, and this identity can be adopted by anyone masquerading as that person.

Your system has exactly the same problem. There is no foolproof way to identify a person remotely. Plus, your system is now susceptible to spyware: put some software on the customer's machine to hijack the card reader and you can do what you want with the credit card. If anything, it's LESS secure.

Re:The card number / expiry-date system is stupid

[pclminion]

Why would credit card companies ever want to change? They PROFIT from fraud. They issue a charge-back to the merchant, along with its associated merchant fee, and they get to pocket the original commission as well.

So why should they care about minimizing fraud?

Re:The card number / expiry-date system is stupid

[mukund]

Not to mention that a truly secure card reader would cost a lot more than $25. $150 would be much more realistic. To be even somewhat secure, it would need to at least have a display and its own network connection, which adds quite a bit to the cost.

No a `fully secure' card reader costs $25 today and expect prices to keep falling as demand goes up. To be somwhat secure? You still don't seem to get the idea of the signing operation of a transaction done on a card. I suggest you read up on how a JavaCard works.

Customers generally don't need to ship stuff to 20 different addresses, and it's not difficult to call your bank and have them add another authorized address. Most places will still ship to an alternate address, they will just call you first to confirm. Having to use special card reader hardware would be much more of a hassle.

No customers don't have to ship items to 20 addresses, but I'm not about to to register all my acquaintances' addresses to the credit card, just because I want to send them gifts directly.

Your system has exactly the same problem. There is no foolproof way to identify a person remotely. Plus, your system is now susceptible to spyware: put some software on the customer's machine to hijack the card reader and you can do what you want with the credit card. If anything, it's LESS secure.

I believe you're just trying to knock me here, rather than actually first read up and understand how the system works. Read up on how a Java Card works. I'll explain once more for your benefit. The cryptographic signing operation takes place on the card. Your private key is stored on the card and there is no way you can extract the key from the card. You can only present a transaction to the card and have it signed, and retrieve the signed transaction. The signature is only valid for one transaction, done by a particular vendor only, because the signed data contains the transaction ID, the price which it's paying. The signature-request which is supplied to the card contains the price the person would pay for, the vendor details and the transaction ID. This is displayed *on the card* before a customer makes a payment by choosing an option *on the card*. These cards will not be significantly more expensive to manufacture in quantity. Remember card sized calculators? That was back in 1980.

No the system does not have the same problem, nor is it susceptible to spyware. You can hijack a card reader, but you can't hijack the card itself which needs to do the signing after reading the users' input *on the card* which is only powered by the card reader, which also provides the reader interface for communicating with the PC. The card reader is otherwise stupid. No other software on the PC has the private key to do this signing. Even if you were to tap the wire communication, you still cannot fool the system. If you do not follow this, I suggest you read up on even user land items like PGP Corporation's introduction to cryptography which should be reasonable for a newbie to follow. Read on digital signatures and how they are not susceptible to man/monkey in the middle attacks (when the card's public key is known and trusted by the bank), which is exactly what you're claiming by hijacking the card reader.

Re:The card number / expiry-date system is stupid

[phorm]

Couple this with a USB card reader issued by the bank.

Which would probably only work with windows, and cost a "rental" fee or whatever to have. Thanks but no thanks, how about just having companies implement better security to protect my personal/financial information...

Re:The card number / expiry-date system is stupid

[jacobito]

Okay, I worked for Globeset, so if you worked for SETCO, you know that SETCO certified Globeset's SET software suite with its SET Mark, which is supposed to signify interoperability and compliance with the SET standard.

Re:The card number / expiry-date system is stupid

[thogard]

All the SET mark says is that it works in the common case (i.e. the test case), not that the oddball cases which showed up once more and more products got certified. Common problems include holes that allowed merchant fraud as well as MIM attacks in some of the banking back end systems. The crypto wasn't done right either in most cases but that was never part of the certification process.

Re:The card number / expiry-date system is stupid

[jacobito]

Ah... I see now. Thanks for the clarification.

Not just mastercard -- VISA, etc.

[Anonymous Coward]

The summary fails to mention that it isn't only Mastercard that is affected (e.g., look at the Washington Post article). VISA is affected as well, as are others. Apparently the breach was detected by the company handling the cards (CardSystems Solutions, Inc.) on May 22, but was only announced by Mastercard now, though they had been notifying banks in the interim. VISA spokespeople claim that they did not announce it sooner because there was an ongoing FBI investigation.

Re: Not just mastercard -- VISA, etc.

[Black Parrot]

> Apparently the breach was detected by the company handling the cards (CardSystems Solutions, Inc.) on May 22

One source I read said it was detected by the credit card companies when they noticed an upturn in the number of fraudulent transactions being reported to them by banks, and only then traced back to the clearinghouse.

> VISA spokespeople claim that they did not announce it sooner because there was an ongoing FBI investigation.

Yeah, supposedly there was an agreement to silence (for good reasons or bad), and the other participants are surprised (and probably outraged) that M/C broke the news.

And while the "FBI investigating" story is at least a semi-plausible reason for silence, I suspect the real motivation was "OMFG, let's stall as long as we can and hope Jesus comes back before word gets out". As mentioned in other threads, there are estimates that it will cost a billion dollars to replace all those cards.

Also, IIRC, in the past these exposures have always turned out to be much larger than first reported.

Re: Not just mastercard -- VISA, etc.

[cosmic_0x526179]

And while the "FBI investigating" story is at least a semi-plausible reason for silence, I suspect the real motivation was "OMFG, let's stall as long as we can and hope Jesus comes back before word gets out".

My guess would be that the FBI wanted to string along a bunch of these transactions and try to catch some of the folks using the stolen numbers. Might have worked too, only time will tell.

Also the various card security departments needed to get their shit together about what to do next. I wonder what percentage of all the cards in existance this is ... 5% ... 10% ?

Slashdot is sloooooow

[Gorath99]

Jeez, even the mainstream newschannels have been reporting this since at least 9am local time (6 hours ago) and creditcards are hardly even used over here.

Seriously, news like this is important and should be spread as quickly as possible. It's a sad day when major international tech-related sites of slashdot's size take this long to report these things.

Re:Slashdot is sloooooow

[mattyrobinson69]

/. is for the discussion, if you want up to date news read the news sites. its the same with people who use slashdot for security holes in software, go read a security site.

Re:Slashdot is sloooooow

[Sethra]

In point of fact the actual theft of the data occured over a month ago. The public is only being notified now.

So what's a few hours here and there when the event is already so old?

Re:Slashdot is sloooooow

[Gorath99]

/. is for the discussion

Why? The slogan is "News for Nerds," not "Discussion by Nerds." I would posit that the latter doesn't qualify as "Stuff that matters," either.

Re:Slashdot is sloooooow

[Tim Browse]

I can't tell if you're kidding. You don't really read slashdot to keep informed of things that are actually important, do you? :-)

Now I know why Taco added this to the poll results page:

"If you're using these numbers to do anything important, you're insane."

Re:Slashdot is sloooooow

[Tim Browse]

Slashdot: Come for the discussion, stay for the flames...

Re:Slashdot is sloooooow

[Gorath99]

True, true. It's just that for a site that claims to report news, slashdot increasingly rarely actually has something new to say.

Re:CardSystems is a MS .NET shop

[kirun]

Best wait until Monday, when the new opening for Head of Information Security will be posted.

This just proves that...

[Debiant]

laws should passed to protect not only what information can be stored but by also how.
And that outsourcing adds complexity and more weak points that can fail.

A stupid question:

how anyone can possibly get so much information by hacking somewhere?

Being semi-pro it person, i'd think downloading so much information at once would easy to spot and made impossible too(and who needs at once so much info anyway?)
Or did they get so much information by getting it all one by one?

Re: This just proves that...

[Black Parrot]

> how anyone can possibly get so much information by hacking somewhere?

The company is (was?) a clearinghouse for handling charges by the four major credit-card companies, and someone had a program listening in on the transactions for some unknown amount of time.

Re: This just proves that...

[Debiant]

I looked more closey now the links given, and by CNN link it was a script in a database that seeked certain kind of information.

What it doesn't state is that how that information was then relayed forward.

Re:This just proves that...

[mustangsal66]

I work in the IT Security and Auditing field. The 'bad guys' just need a little information in order to hide their outbound data. Think about how much traffic processing 40 million+ cards would be. Find the protocol they use, be it direct sql access, https, etc... Then send your data in little bits using the same protocol. You'd be amazed how many IDS / IPS are misconfigured and would miss something like that. There's also just plain old lazy / over worked admins that don't review logs until something bad happens.

If they flow a constant 30Mb in and out the average admin isn't going to notice an additional 500k/sec, probably not even an additional 1.5Mb /sec.

It's a sad to say, but security is always thought of last.

Re: This just proves that...

[scottv67]

a script in a database that seeked certain kind of information.

Seeked? Geez, did you make it past the fourth grade?

Re:This just proves that...

[Leroy_Brown242]

Yes, because more laws are always the answer.

Let's slashdot the economy!

[Black Parrot]

To ensure that no one places any fraudulent charges on our credit cards, let's all run out to our favorite toy stores and run up our cards to their limits.

Re:Let's slashdot the economy!

[jcuervo]

Way ahead of you. :P

Re:Let's slashdot the economy!

[Leroy_Brown242]

DOUBLEPLUS good solution. We can drive the ecconomy while we're at it!

Be sure to spend local too!

What about debit cards?

[mgkimsal2]

From what I recall, debit card transactions don't give you the same protection as credit card transactions, even though they're both 'mastercard' or 'visa' branded and have identical looking numbers.

Re:What about debit cards?

[Algan]

Yes, that is true from a legal point of view (AFAIK). However, most banks - in US at least - will provide the same type of protection. The downside is, in some instances, you don't get the money back until the dispute is resolved in your favor, which can take a couple of months. With a CC, you simply don't pay that portion of the bill. That is why I use my Debit/ATM card only for cash withdrawals at ATMs. I'm also seriously thinking of giving it up and getting an ATM only card.

Re:What about debit cards?

[TykeClone]

Debit cards are governed by Reg E, not by Visa or Mastercard. You have low liabilities on the fraudulent debit card transactions (like any other electronic transactions) on your deposit account if you report the transactions to the bank in a timely manner!

Credit cards are governed by the rules that Visa and Mastercard make - and have a little bit less liability resting on the cardholder.

The big difference (and the thing that kind of sucks) is that if you have a fraudulent debit card transaction - it's money out of your account until the bank can refund it (and they have the right to do an investigation first).

My Card?

[valjean78]

Is there a form somewhere that I can enter my credit card information to check if my cc number has been comprimised? :p

Re:My Card?

[Anonymous Coward]

Yes you can check it out at

http://www.please.steal.my.credit.card.nu/

Re:My Card?

[datadriven]

What, didn't you get the email from paypal to verify your account?

Re:My Card?

[arose]

I'm setting one up right now... :-P

Re:My Card?

[hugesmile]

Is there a form somewhere that I can enter my credit card information to check if my cc number has been comprimised?

Sure, if you post your name, card number, and expiration date to slashdot, an automatic check will be run, and the results will be displayed.

If you receive the message "Comment Submitted. There will be a delay before the comment becomes part of the static page.", then this means you have been comprimised (sic). It's a perfectly fool-proof system, I primise.

Re: My Card?

[Black Parrot]

> Is there a form somewhere that I can enter my credit card information to check if my cc number has been comprimised? :p

I see that you :p'd it, but one of my first thoughts was that someone could probably set up a phishing page for "enter your card number, name, and social security number (for verification purposes only, of course), and our database will tell you whether your card number was harvested".

Re:My Card?

[imsabbel]

Yeah.
They should post a huge list on their websites with all numbers that arent compromised. Just so you can be sure...

Re:My Card?

[merlin_jim]

Is there a form somewhere that I can enter my credit card information to check if my cc number has been comprimised?

Sure is! Just go to www.giveawaymyccnumber.com

This is simply the price of outsourcing.

[0xdeaddead]

See in the banking industry we run these "penetration scans" all the time, that are TOTALY WORTHLESS. I cannot emphasize this enough, that running the weakest setup possbile will pass their "tests" with flying colours. The people doing these tests (Some certified security specialists!) Think that firewalls are magical devices that know how to stop the pesky hackers. Bottom line is that people are involved, they are out of their element, and simply placeholders. Management in general needs to get out of this "placerholder" mentality when it comes to jobs, and just fire people that are not doing their jobs.

Ok enough ranting, but trust me, in the late 90s banks were trying to outsource as many things as possible from customer service, to invoicing, bills, credit collections, applications and so on. As you can see when the "Credit card company" becomes nothing more than a brand, and a board of execs, everything is out of their control, not to mention every peice of the old credit empire is open for attack.....

If anything the question is why did it take so long to find them?!

Re:This is simply the price of outsourcing.

[PunkPig]

Banks outsourcing in the late 90's? It is still going strong today.

Oh well i'm sure that they all have iron clad SLAs with their outsourcing partners.....and when the outsourcing partner goes bankrupt as a result of royaly screwing up.....Oh well. I guess it is just time to bring in some more consultants to find a new and better vendor (or break down the process even further for more vendors). Good times....good times

Re:This is simply the price of outsourcing.

[timeOday]

See in the banking industry we run these "penetration scans" all the time, that are TOTALY WORTHLESS.

What!? I thought they paid Robert Redford good money for high-end penetration testing employing exotic technical and social engineering attacks with a crack team including minorities and handicapped individuals.

Re:This is simply the price of outsourcing.

[dracocat]

Actually, this particular processor runs enough volume that they fall into a level 1 gateway category for CISP and PCI compliance with Visa and Mastercard.

A level 1 gateway actually requires volumes of procedures in place as well as an on-sight security audit by a certified party of their physical security, network security, and business rules.

The security requirements call specifically for intrusion detection systems, intrusion protection systems, washing of cardholder data before it is written in any kind of logs, and of course encrypting the credit card number before it is stored in the database.

The audit takes weeks and costs thousands of dollars. They must continue to do the vulnerability scan quarterly and then re-do the onsight audit once a year.

According to the news article they were out of compliance, meaning they had not yet done their audit.

Additionally any third party they outsource too must also be CISP/PCI compliant which would mean they would have to go through the exact same in depth on-sight audit of their security systems.

The problem here is that Visa and M/C allowed a processor as big as this one to remain out of compliance. A copy of the audit is sent to Visa and M/C so they both knew they were not yet in compliance.

What you will see after this story is a very large increase in Visa and Mastercard in following up on their processors to insure they have completed their audits.

Re:This is simply the price of outsourcing.

[snorklewacker]

> What you will see after this story is a very large increase in Visa and Mastercard in following up on their processors to insure they have completed their audits.

Hmm, if these audits are required, perhaps the ideal solution is something like SOX for CISP/PCI. Make the CEO's personally sign off on their audit compliance yearly, and if it's false, they go to jail.

Personal responsibility is after all a good thing, no?

Re:This is simply the price of outsourcing.

[Cally]

See in the banking industry we run these "penetration scans" all the time, that are TOTALY WORTHLESS. I cannot emphasize this enough, that running the weakest setup possbile will pass their "tests" with flying colours. The people doing these tests (Some certified security specialists!) Think that firewalls are magical devices that know how to stop the pesky hackers. Bottom line is that people are involved, they are out of their element, and simply placeholders. Management in general needs to get out of this "placerholder" mentality when it comes to jobs, and just fire people that are not doing their jobs.

Nice rant :) but... the problem is that there just aren't enough people with security clue to go around. Fire the people who think firewalls are magic boxes that keep the hackers out, and you'll end up with people who think Zone Alarm on a dual-NIC XP machine is a firewall...

What took so long?

[DAldredge]

Why did it take /. so long to cover this story? I mean the political sites had this story 12 hours ago.

What has happened to /.?

Re:What took so long?

[LiquidCoooled]

This is slashdot. All news comes from submissions.

If you saw it on a site a while ago, why didn't you submit it?

This is the first I have personally heard about this latest breach of security, but if I had spotted it somewhere else, I would have submitted it.

Re:What took so long?

[WhatAmIDoingHere]

People have to submit the stories for /. to post them. Why didn't you submit it when you saw it 12 hours ago?

Re:What took so long?

[rastakid]

People have to submit the stories for /. to post them. Why didn't you submit it when you saw it 12 hours ago?

Maybe he did. The fact is that it takes *way too long* before a submission gets accepted or rejected by the editors. Probably too much in the queue and too little time on the editor's hands. I'm glad they try to catch up a little lately by just hitting the 'Accept submission' button before looking if the article is a dup and so on...

Re:What took so long?

[WhatAmIDoingHere]

All the articles I've submitted (Only one accepted) had been rejected or accepted within 2 minutes of hitting the submit button.

cascade effect....

[ecalkin]

i look at about 5 news sites (drudge, abcnews, newsmax, cnn, foxnews).

this was an interesting event as i saw this first about a day/day-and-a-half ago on one site. sometimes a news item will maybe hit 2 or three of these sites. one by one, this became a major news item on all five.

this is starting to capture peoples attention.

eric

Re:Slashdot is sloooooow--the way it works

[WebHostingGuy]

That's because a lot of the times articles on these are submitted to the slashdot editors but they reject them for one reason or another (too much other news, editor doesn't think it is interesting, etc.) I know I submitted this yesterday but my submission was rejected, but now someone else resubmitted another day and it was accepted. It's just the way the system works.

Re: CardSystems is a MS .NET shop

[Black Parrot]

> Check out their careers page.

I wonder how many of those open positions have opened up since May 22.

If I worked there I'd certainly be looking for a lifeboat.

You mean cracker?

[torstenvl]

Or was it Eric S. Raymond who illegally stole the credit card information?

The press may co-opt our sub-cultural language for their own gross-oversimplification purposes. That doesn't mean Slashdot has to follow suit.

Definition from the Jargon File:
hacker n. [originally, someone who makes furniture with an axe]

1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary.
2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming.
3. A person capable of appreciating hack value.
4. A person who is good at programming quickly.
5. An expert at a particular program, or one who frequently does work using it or on it; as in "a Unix hacker". (Definitions 1 through 5 are correlated, and people who fit them congregate.)
6. An expert or enthusiast of any kind. One might be an astronomy hacker, for example.
7. One who enjoys the intellectual challenge of creatively overcoming or circumventing limitations.
8. [deprecated] A malicious meddler who tries to discover sensitive information by poking around. Hence "password hacker", "network hacker". The correct term for this sense is cracker.

Re:You mean cracker?

[timmyf2371]

Per Dictionary.com:

hacker Audio pronunciation of "hacker" ( P ) Pronunciation Key (hkr)
n. Informal

1. One who is proficient at using or programming a computer; a computer buff.
2. One who uses programming skills to gain illegal access to a computer network or file.
3. One who enthusiastically pursues a game or sport: a weekend tennis hacker.

In the evolving English language, words can have two different meanings. I encourage you to read the second definition as listed above and stop your wishful thinking that English is going to somehow become a dead and non-evolving language like some other European languages.

Re:You mean cracker?

[torstenvl]

Problem: you base your argument on the assumption that 'English' takes precedent over 'Nerdish' on a nerd site.

Re:You mean cracker?

[diebels]

http://dictionary.reference.com/search?q=cracker

cracker Audio pronunciation of "cracker" ( P ) Pronunciation Key (krkr)
n.

1. A thin crisp wafer or biscuit, usually made of unsweetened dough.
2. One that cracks, especially:
1. A firecracker.
2. A small cardboard cylinder covered with decorative paper that holds candy or a party favor and pops when a paper strip is pulled at one or both ends and torn.
3. The apparatus used in the cracking of petroleum.
4. One who makes unauthorized use of a computer, especially to tamper with data or programs.
3. Offensive.
1. Used as a disparaging term for a poor white person of the rural, especially southeast United States.
2. Used as a disparaging term for a white person.

__Important difference__:
Cracker == person doing destructive computer activities only.
Hacker == person gaining non destructive(although illegal in parts of the world) access to a computer network of file.

By using cracker here you avoid wrongly confusing and assosiating the word hacker with illegal or destructive activities.

Re:You mean cracker?

[rastakid]

And your problem is that you're a pathetic whiner. Get over this little cracker/hacker thingy and grow up. Are you really upset by the fact that all the big media use the H word for a criminal?!

Could someone be so kind to...

[MTO_B.]

Could someone be so kind to check if my credit card number was exposed?
My cc number is 5122-5655-1459-0444.
Reverse code: 444

If it was exposed I want to cancel it so the hacker cant use it.

Thanks. ;-)

Re:Could someone be so kind to...

[kabbor]

Sorry. In order to check this we need your, um, Full Name (Please enter it exacty as it appears on your card

Re:Could someone be so kind to...

[jcuervo]

[4] cuervo@digits ~/src/c/visa $ visa 5122-5655-1459-0444
invalid

Doubt they got very far with it.

(Yes, I know it's a Mastercard. My visa.c just does mod10 on whatever you give it.)

Re:Could someone be so kind to...

[MTO_B.]

lol, obvioussly it's a made up number.

Re:Could someone be so kind to...

[jcuervo]

Of course it is. But these numbers aren't hard to fake. Hell, I wrote Javascript that'd pass mod10. :-)

[4] cuervo@digits ~/src/c/visa $ ./visa -n 10 5
5014 - 8453 - 7107 - 5137
5249 - 7640 - 6224 - 7185
5114 - 0179 - 0850 - 7714
5990 - 2362 - 1872 - 4715
5495 - 0878 - 2406 - 4206
5523 - 4215 - 8820 - 4169
5560 - 4304 - 8991 - 1552
5249 - 7640 - 6224 - 7185
5227 - 6409 - 4931 - 8827
5606 - 0339 - 8464 - 4805

visa: Caught SIGINT.
Generated 10 [passing] cards in 0 seconds

Re: No socialist regulation is needed

[Black Parrot]

> Why would crackers want to hack the IRS?

Probably a gold mine for identity theft resources.

Also, lots of people give their bank account's routing number for automagic deposit of their refund. Maybe there's a way to forge that kind of transaction and clean out people's bank accounts?

Weakest link

[hellfire]

It's not surprising someone other than MasterCard actually had a list of card numbers stolen. I have customers all the time tell me how they don't like what they feel are draconian measures to protect the credit card numbers people have in their own systems. What they fail to understand is that Visa and Mastercard require us to do this, and the protections we have are customer service.

But they still complain, because their customers and they themselves don't ever notice. Hell at one point I was told by a demanding customer to remove the protections because he said "I'll risk it." I was tempted to show him how insecure he was by remotely accessing his system, getting his list of customer phone numbers, and telling all his customers that he was careless with credit card numbers and their numbers could have easily been stolen from his system.

People are pretty careless about credit card security. It's usually in the name of convenience and visible customer service. Credit card security is invisible service. Being able to purchase something conveniently flies right in the face of having security which just might prevent you from selling something to someone, so some people don't care, as long as they are selling. Owners care once they find out that they'll be issued chargebacks, but individual salesreps will write down every credit card number on a piece of paper if it means making money for them personally.

Visa and Mastercard have the right idea, and in the press release I like how they said that they gave cardsystems a "limited amount of time" to basically get their act together so this doesn't happen again. Education and enforcement of regulations... nice to see an organization, especially one that is a corporation, actually give a damn.

Re:No socialist regulation is needed

[anthony_dipierro]

Sounds great. Let's make it as hard to buy something from a store as it is to file a tax return. As a paid tax preparer, my profits would go through the roof.

Reset the Debt

[jvmatthe]

Remember how a notable movie (based on a notable novel) a few years ago had, as part of its plot, a plan to reset the credit card debt of the world? With the rate of security breaches we've seen, I have to wonder if the system won't lead to such a problem on its own, not through someone wanting to reset the debt but rather from a massive case of distributed fraud as the result of these kinds of security breaches.

I mean, what do you do when something like 40 million transactions could be legit ... or could be bogus? There's no human way to know what's real and what's not if you have to check every one of them. I'm sure they have computerized methods, but I'd imagine that there is still a level of distributed low-level (i.e. not buying boats and plasma TVs) fraud that would disrupt the system in some critical way.

Comment removed

[account_deleted]

Comment removed based on user account deletion

The only way

[BCW2]

To end this kind of thing is to make the companies handling records financialy responsible for any problems. Triple the amount in damages to each misused account. They won't do anything until it affect the P&L severely. It's the only thing big corporations understand.

Re:The only way

[hwstar]

"They" would never allow that to pass in Congress.

Re:The only way

[shanen]

Won't work unless there is some perimeter of "privacy defense". I think we need to change the law around to say that our personal data, including such things as credit card information, belong to us, and theft of such information is the same as any other kind of theft and should be prosecuted directly. That should also include retention of personal information after the transaction is completed. The information should be stored on *MY* hardware, and if you need to see it again, you tell me why, ask for my permission, and I'll think about it. Anyone who tries to use my personal information would already be committing a crime in the attempt, and the crime would be obvious since the information was not coming from *MY* machine, which is the only legitimate place to store it.

(Minor technical note, but of course they would add checksums to my personal information when they returned it to me for storage.)

Ever hear of "Personal Responsibility"?

[bigtallmofo]

Credit, like electricity, is provided to people to use as a tool. One can use that tool responsibly. For instance:

1. Don't buy things you can't afford
2. Don't stick your finger in a light socket

Or one can use such tools irresponsibly and think that consequences don't apply to them.

I wonder which type of person you are?

Re:Ever hear of "Personal Responsibility"?

[King_TJ]

The problem is, unlike electricity, credit is often dangled as a carrot in front of people who shouldn't have it in the first place. The basic concept of credit lines and credit cards are fine. But credit card companies are making an awful lot of money by trying to make people overspend and bury themselves in debt.

There's no other logical explanation for giving someone a higher credit score for carrying a balance on their card month to month than they give someone who pays off their balance in full every month. The truth is, they don't WANT people to be very responsible with their cards! That's why they give them out like candy to college students, who statistically are among the LEAST likely to be bringing in a good income. Their BEST customers are folks who run their card balance way up, and then struggle to try to pay it down over the years. The fees and interest charges ensure they basically CAN'T ever get it paid off - so by the time they give up and file for bankruptcy, the CC company has already profited from the original money lent out. Then, they stand to potentially get even MORE out of those people in bankruptcy. (Might be able to reposess some of the purchased property for resale, or milk a little more cash from them in a Chapter 13 debt repayment plan.) Give it a year or two, and they'll be right back, offering that SAME PERSON another card and a second chance to screw up all over again!

I'm not sure of their present status, but for a long time, Mastercard was listed as a *non profit organization*! I knew people who used to work for them who got huge "bonuses" at the end of the year, simply because MC had to find a way to dump their surplus earnings in order to hang onto that status. Before you preach about "personal responsibility" to Mastercard holders, perhaps you should preach about businesses falsely pretending to be charities in order to scam big tax breaks?

Re:No socialist regulation is needed

[Travoltus]

Not to mention the name, address and SSN itself (which, AFAIK, are on every tax return, by nature) being practically the keys to the whole kingdom...

hacker?

[SQLz]

Unlike many of the past high profile cases this one involves a hacker rather than lost packages.

Wouldn't that be a 'cracker' not a hacker?

they're welcome to my cc number...

[advocate_one]

they'll have fun trying to use it... there's zero credit left at the moment... if they like, they could always put some back on it first...

Re:they're welcome to my cc number...

[merlin_jim]

they'll have fun trying to use it... there's zero credit left at the moment... if they like, they could always put some back on it first...

Actually, that's fairly common... let's say I get your card and it's got a five grand limit on it but only a grand is left...

I can take my thousand bucks and run OR I can pay off four grand, call the credit company, and get "my" limit increased (FYI on a full payoff most companies will gladly increase your limit)... then instead of a grand I've got six grand (assuming they double the limit) to go with...

I know a friend this happened to. VISA sent him a form with checkboxes for each transaction, to indicate which ones fradulent transactions.

The checkbox next to the payoff was not chcked when he sent it back.

Ahhh! But you forget...

[bigtallmofo]

Don't forget the super-duper-high-security last three digits on the back of the card!

I'm sure it's no problem at all that many online vendors ask for those last three digits and then store them alongside your credit card number and expiration date. Security problem solved. Done, and done.

Good thing I have online banking!

[MtViewGuy]

That way, I can closely monitor all my bank's account activity to make sure somebody isn't trying to hack into my accounts to steal my money. That was how I was able to find out somebody did an inside job identity theft of my checking account and they stomped out that fraud (and got the "perp" pretty quickly).

However, before you do online banking, I would recommend you have both antivirus and firewall programs active and run anti-spyware programs at least once a day to keep out keystroke loggers.

Re:Good thing I have online banking!

[earthbound kid]

However, before you do online banking, I would recommend you have both antivirus and firewall programs active and run anti-spyware programs at least once a day to keep out keystroke loggers.

Or you could use an OS that's secure enough that you don't have to worry about software installed with your permission.

Seriously, if you're too cheap to buy a Mac Mini, you can at least burn a Linux Live CD. Using that, every time you reset your computer all unauthorized software is removed, 100% guaranteed.

Re:Good thing I have online banking!

[eskayp]

Yes, it's convenient and allows tracking our accounts better...
BUT...
If our financial institutions insist on running something as insecure as Windows and also insist that our residential interface uses Windows, then security of our accounts is NOT one of their primary concerns.
I have repeatedly emailed corporations that insist on customer Windows usage to inform them of the risks and limitations they impose on their customers.
Some improve, some do not.
I avoid doing business with the latter.

Re:Good thing I have online banking!

[Koiu Lpoi]

Will using the OnScreen keyboard get around keystroke loggers, or are they lower level than that?

Re:Good thing I have online banking!

[WhatAmIDoingHere]

It really depends. There's hardware loggers and software ones. Some record all keyboard imputs, some take screenshots often. Most people who use the OSK type slow enough with it that it wouldn't be too quick to capture with a series of screenshots.

Re:Good thing I have online banking!

[earthbound kid]

I got modded troll on my reply to the grandparent post, but for real-- burn a Linux Live CD. You put it into your CD tray, reset and then BOOM, you've got web access with guaranteed 100% no key loggers. And you can use your keyboard and everything whee! And, as a super bonus, you can erase all those pesky files that Windows won't let you erase because they're "in use" by the spyware that installed them. And when you get sick of Linux, just eject the CD, press reset and you can go back to life as normal. And it only costs you as much as one blank CD. It's an easy solution to the spyware problem.

Re:Good thing I have online banking!

[Stormalong]

This just gave me a neat idea. It would be cool if the banks offered RSS feeds for your accounts. That would be an easy way to keep an eye on your account activity in something close to real time without having to constantly log into your account.

cardsystems.com/careers.html

[St. Arbirix]

It's worth mentioning that they're hiring people with VMS and WindowsNT experience. Small wonder the malicious code got in there.

Re:cardsystems.com/careers.html

[WhatAmIDoingHere]

A full-time janitor, part-time hacker just out of school and working at any job he can get stumbles upon an unlocked computer. He's unauthorized to use the machine and the network it's on. Not saying that's what happened, but an inside job CAN be an unauthorized individual.

If the IRS was breached, would they say?

[G4from128k]

Oh wait, exactly how many IRS breaches have we had so far?

I doubt the IRS would be forthcoming if their was a breach (although there are the occasional articles about corrupt IRS employees). In fact, a breach would probably be classified and not be allowed to be published. In contrast, a card processing company knows that it exposes itself to greater liability if it fails to alert its partners (card issuers/banks) of a problem.

Bizarrest claim yet!

[thesp]

from Mastercard's Newsroom | Global Press Releases "Upon receiving notice from MasterCard, banks are able to take the appropriate steps to protect their cardholders from potential fraud. No highly sensitive information, such as social security numbers or dates of birth or the like, are stored on MasterCard cards. "
No idea how Mastercard could think that account details aren't classed as highly sensitive information - perhaps this is the reason for the lax security!

There are some numbers hackers can't steal.

[game kid]

there are some numbers hackers can't steal

for everything else there's MasterCard

(Accepted all over, even if it's not yours.)

Re:Also proves that..

[Curtman]

Even on Slashdot hackers get a bad name. Hackers are people who love to play with technology, not cause carnage and destruction. This guy is a "criminal".

Hmmm...

[flawedgeek]

Torrent, anyone?

ABN-AMRO uses such a system

[nietsch]

My bank over here in holland uses a similar system to authenticate it's online banking. You have your card (with a chip on it) you know your PIN (very weak password IMHO) and you get a standalon reader that you have to put your card in, punch in your pin and a 8 digit number generated by them. It generates a 6 digit code that you have to enter in the webpage.
It has no connection to your computer, so no inpompabilities for mac/linux users and no chances of spyware/keyloggers making off with valuable passwords. You indentify with wath you know and what you have. The processor only has to know the public part of the keypair (the private one is on your card, probably 'encrypted' with your pin). If such a processor is breached, they will not get any info on the card.

Re:Also proves that..

[LiquidCoooled]

Yes and gay people walk around happy all day (actually, they might, but the usage of the word has changed)

Deal with it.

imagine a similar disaster

[e**(i pi)-1]

Now imagine a headline in 10 years: "120 Million biometric data stolen" It seems that the technical challenges to keep data secure has sunk in already. This credit card data breach could support these concerns.

They probably will end up paying for something

[rdunnell]

Or at least receiving a fine from each of the credit card companies that were breached - the various agreements companies sign do include fines (that could apply to either party) for various performance and compliance failures. Also, I suppose the banks could sue if they felt so inclined, which would probably end up in some sort of settlement.

Dunno if there are potential government fines or not.

Re:Also proves that..

[Curtman]

Yes and gay people walk around happy all day

That would be a good analogy if only there was a culture of straight gay people that was upset about being associated with homosexuals.

Microsoft security problem?

[Anonymous Coward]

Looks like they're a Microsoft .NET house: http://www.cardsystems.com/careers/DevDotNet_0501. pdf

Re:Microsoft security problem?

[anubi]

Thanks for the link, AC.

Reading that employment ad highly reinforces my attitude on typical businessmen, who look "beyond reality" into ever and ever increasing "productivity" through management pressure to do everything faster.

I noted how the ad stressed meeting deadlines - not doing things right.

I don't reply to ads like that.

I know its a clueless PHB on the other side who has taken all sorts of management courses on "the management of human performance", and often has no idea we actually need time to reflect on what we are doing.

Ads like that do not appeal at all to people like me. I am the type that has a 4.0 GPA, yet won't take but 10 units or so, because I insist on taking my time and doing it right. Some may call me a laggard. Others may call me an artist. I am not rich, but I sleep well. I even used to work in aerospace until it became executized. I did not like being forced to overlook the details, as experience has long shown me that overlooking the small stuff will always come back to bite you. Its the old "for want of a nail, the shoe was lost" thing...and it still holds true. Design errors are by far the most expensive error a company can make - and wise ones avoid design errors at all costs.

You think I will ever forget that one little bit of loose foam has damn near killed our space program?

Its long been my observation that a shopkeeper and a mountain climber may have completely different criteria for evaluating the value of a rope.

I consider myself a mountain climber.

I also know the shopkeeper's interest involves trying to sell me the rope with the most markup.

A mountain climber knows that its best to stay clear of certain shops. Although they may be well executized, their rope is no good.

It's simply time for a new law

[hrieke]

That if a company loses personal information, then that company is libal for $1000 fine per person affected, plus any additional fees, fines, moneys to pay to correct the problem(s).

Small businesses will pay...

[dereference]

...but not why you may think. One word: Insurance.

As any small business owner will attest, it is incredibly difficult to obtain reasonable business insurance, especially professional liability, and even more so when they don't understand the technology behind your business itself. The reason is that the insurance industry is running scared about terrorism, the great "unknown" world of IT, and our generally vindictive litigious society.

None of these factors are in their actuarial tables, so they presume you're going to cost them millions of dollars. They don't care whether they understand or not; they're simply not willing to take the risk.

Now, how do you suppose the insurance company will treat your small business, if it happens to accept credit cards for payment? Not good.

Do you suppose they'll care how paranoid you are about data security? Will they care how many levels of protection you afford the data of your customers?

The answer is a resounding "no" to all. They don't have the technical acumen to judge what is and what is not appropriate (honestly, too few people who call themselves "security experts" do). And they don't care. They simply raise the rates to astronomical levels, with a big "screw you" attitude, because they're somewhat ironically not at all in the business of taking risks.

Re:Slashdot is sloooooow--the way it works

[timeOday]

Sometimes I think slashdot saves the jucier stories for busier times of the day/week. It's no fun to join a discussion that fissled out 4 hours ago. The news sites don't have this problem.

Credit card exposure.

[jskline]

Hmm... Apparently we all must have pissed off the hackers and now they're targeting the big fish. Apparently those of us in IT and the programmers writing browsers, firewalls, and other tools, might have sufficiently locked down the typical users system to prevent this sort of thing.
Now since the only two choices are direct social engineering of the end-users out of their data, or go after the warehouses that contain what they want, I wonder if this kind of thing is now expected to only escallate in a really big way.They should now go after a congressional law change that makes this kind of major hacking a death-penalty punishable offense... Hmmm...
Just thinking...

Re:Slashdot is sloooooow--the way it works

[vought]

Sometimes I think slashdot saves the jucier stories for busier times of the day/week. It's no fun to join a discussion that fissled out 4 hours ago. The news sites don't have this problem.

Timing, unfortunately, has become a major component of the news release cycle. Here's how news timing works:

1. If a pretty white woman goes missing, (or is dying) it's instant news all the time on the U.S. cable news channels. The news channels will instantly increase the cost of advertising on a sliding scale based on how white, how pretty, and how rich the missing woman is.

2. If Amnesty International's accusations about torture and desecration of religious objects at U.S. "held without charges" camps are borne out by internal government documents, then the news is broken at 7:30 p.m. on a Friday night, briefly discussed on Sunday while everyone is at church, and forgotten by Monday morning.

3. If a popular Democratic president gets a blowjob, it's all blowjobs, all the time on every news network.

4. If there is reasonably clear evidence that a Republican president trumped up intelligence to get us involved in a $300 Billion war, it'll never be seen in print or heard on TV.

Now you know how the U.S. "liberal" news media cycle works.

Exercise: Using what you've learned, what can you tell us about the MasterCard breach story? Do you think MasterCard released the news on a Friday night for any particular reason?

Link to Check Your Card

[FreeUser]

Is there a form somewhere that I can enter my credit card information to check if my cc number has been comprimised?

Yes, just click here, enter your credit card number, PIN, and mother's maiden name (or other passphrase), CVI# if applicable, and they will confirm that your card has fallen into the hands of identity theives.

Good luck.

Re:Also proves that..

[LordEd]

By now, most slashdot hackers should be aware of the differences between the media use of 'hacker' and the proper use of hacker. Just like being desensitized to violence on TV.

Re:CardSystems is a MS .NET shop

[silconous]

The head of security is also the help desk and unix system admin Tucson is a small town and I live here

Re:Also proves that..

[Nutria]

Yes and gay people walk around happy all day

That would be a good analogy if only there was a culture of straight gay people that was upset about being associated with homosexuals.

The issue is that the word "gay" was hijacked by a group of people who don't want to be called (are ashamed of????) what they are: homosexual.

Homosexual isn't an evil word. Why try to obfuscate what you really are?

Banks, slowest to adopt...

[WareW01f]

I was in the public sector for a while. People always would look at me for poo-pooing direct deposit. Little did they know that the bank involved had them running the data over on a weekly basis on a floppy disk. The program to generate that disk was the biggest chunk of crap I've seen in my software days (from my coding and all the 2 bit shareware I've seen) Scary stuff.

Now I'm in a bigger corp, that not only demands that you are direct deposit, but is not trying to get you to give up the paper copy they send you to tell you they paid you. (No thank you) That and now the crapware exists as what we are supposed to do our expence reporting to AMEX. My wife (stillin the public sector) already has to go online and print hers regularly if she wants to keep it. (Ask yourself if you trust your company to not lose that data.) This is *not* tin foil hat stuff folks. I can't wait until some outsourced online paycheck viewing software gets hacked and people are in the same boat.

People outside the sectors have to realize. We want this stuff. But not with the mentality that this industry treats things. Things are very lax, and the players in the field seem to be mostly "consultants" that don't really know what they are doing but are good at making the higher ups feel better. This needs to be opened up. The data formats need to be transparent and there needs to be some competition. If your system can't stand someone knowing how it works and still be secure, it wasn't "secure" begin with.

So where is the site that's tracking all of this crap anyway. Step up with a link for some Karma points. Let's see ratings, by company on who has it togather (or no yet hacked at least) Then people can start ditching groups that don't protect their info. (Or at least give someone new a chance to lose it)

Re:Also proves that..

[Breakfast Pants]

Who said anything about an issue? He was fleshing out an analogy not asking for a random tangent of quasi-related history.

Exploiting Mastercards Errors?

[NightWulf]

What would happen if even a small percentage of those people, figured, "Hey lemme get some free stuff outta this." They all started maxxing out their credit cards and when the bill came said, "No sir, my cards been in my wallet the whole time."

The credit card company knows that card number likely was comprimised, but thinkg you may be the one who charged the goods, they have no way to prove it though. Imagine if even 4 million people did that.

Re:Missing the real story here

[gorbachev]

It wouldn't have really mattered, if the trojan the perp planted on the servers worked as it was described. It was said to "listen" to credit card transactions, in which case it would've been able to swipe the numbers regardless of whether the data was retained by CardSystems or not.

Anyway, for this sort of violation of rules, I think MasterCard (and other credit card companies) should terminate their contract with CardSystems. They won't, of course.

Washington post

[SQLz]

I like how the Post titles it:

"40 Million Credit Card Numbers Are Hacked"

Someone needs to go over there with a clue bat and replace "hacked" with something more accurate like "compromised", or like Slashdot, "exposed", of if they want to try to use the correct lingo "cracked".

Nothing will change until...

[WindBourne]

somebody sues these companies. The company who was cracked was running MS. If a civil law suit is started against the company AND against the CIO for running an insecure OS (and most likely an insecure set-up), then we would see changes.

Be very afraid....

[mpapet]

There is -no- incentive for any company in payments processing to do anything else but make a profit.

Dilbert PHB's are in charge of your data. This despite Visa/Mastercard rules.
These PHB's they put their full faith and credit in:
- A Windows Server infrastructure. The rest is just weird hobby OS stuff.
- Has never heard of PGP, PKI, PKCS. That's just bad-guy stuff.
- Believe that email is secure. I need a password to get my mail right?
- Hire IT folks that agree with them. "There's no budget for anything else." says the PHB.

Visa/Mastercard is a federation of the largest banks in the country. Do you think they are going to let their cash-cow get burdened by additional costs and regulations?

What about -their- (visa/mc banks) merchant services organization? (firstdata.com) How much theft have they had? It's likely you will never know. You'll find out about theft from their small-time competitor in AZ, but firstdata? Not likely.

Apparently Canada also

[GoofyBoy]

http://sympaticomsn.ctv.ca/servlet/ArticleNews/sto ry/CTVNews/1119107850615_136?hub=topstories

Speaking as a Merchant...

[Anonymous Coward]

a one-store retailer.

There seem to be any number of companies out there who want my card acceptance processing. (I get cold-called once or twice a month.) A lot of them seem to be resellers for the big national processors. They *ALL* compete on price. I've never had one of them even mention security procedures.

And actually, as far as I am concerned, the security of my processor is not my problem. As long as my terminal software isn't an arcane mess, I don't get any bogus approvals, my legitimate transactions get transmitted to the card companies on deadline, and the cash winds up in my bank account when it's supposed to, then I'm satisfied.

IMO the security issue belongs to the card companies. They're the ones that wind up paying the cost of fraud, and if they don't like the way a processor does its security, then they should not allow it to handle their cards.

(And as a practical matter, I've usually gone with the processor recommended by my bank. At worst, it only costs a bit more, while at best it gives me another hammer (my banker) should there be a dispute. And it means I don't have to deal with issues for which I have neither the time nor the expertise.)

CardSystems is running IIS5 on Windows 2000

[SysKoll]

According to the article, the leak was caused by a Trojan.

Last time I checked, Trojans were found mostly 1. in jeans pockets on a Saturday night, 2. on Windows machines.

And sure enough, Netcraft tells us that the horny hypothesis can safely be discarded. It's Windows all right:

Site <a href="http://www.cardsystems.com/">http://www.card systems.com/</a>
Domain cardsystems.com
IP address 63.83.95.71
Country US
Date first seen April 1997
Domain Registry networksolutions.com
Organisation CardSystems Solutions, Inc., 6390 East Broadway, Tucson, 85710, United States
Last reboot 82 days ago

Now, I realize that this doesn't mean necessarily that the CC numbers are kept on a Windows machine, but this is apparently an MS shop, so that's not surprising.

Re:CardSystems is running IIS5 on Windows 2000

[/dev/trash]

Whre in the info you posted does it say Windows????

Re: Resume for a former CardSystems security exper

[symbolic]

April 2001 - March 2005 Security Administrator, CardSystems, Inc.

- Responsible for maintaining all aspects of security
- Limited recent security breach to a mere 40 million cardholder accounts, out of a possible 200 million- an 80% reduction,
- Worked closely with team members to monitor and ensure transaction integrity- we successfully prevented 99% of the methods known to pose substantial risk.
- Provided off-site backup services for our clients, preventing catastrophic loss due to irrecoverable system malfunction.

Mastercard Rocks!

[dourk]

They made this issue public, so our banks can be notified, so we (the consumers) can know.

Obviously they've noticed that the public isn't so thrilled when we find out about a breach that happened years before we were told.

Visa wasn't going to tell us anytime soon. God knows how long the investigation would take until they released the info to us.

Scary but Real

[BlogCruiser]

It is scary but not surprising that so much information can be hacked. The reality is that 24/7 security monitoring and research by companies and corporations will be needed forever to try and maintain security of personal information such as this. Also, there is the fact that it will still not be 100 percent secure.

However, my thoughts are that most individuals, businesses, companies, corporations and governments do not want to add this type of resource because of the tremendous cost involved. Many individual and small businesses may not be able to afford it.

Most would rather hire the person or group that says we will guarantee the security of your information data for this much. Which presentation do you think would sell in a board meeting? Here are two made up and abbreviated information briefs or sale pitches to some boards in a corporation to clarify some of my thoughts here:

"It will take many new measures, constant research, consistent new education and many resources to bring the security of this data to the safest possible levels. It will never be 100 percent secure but by maintaining this vigilance we can have some assurance of protected data."

Or

"We have some of the brilliant minds constantly researching security applications and procedures that will virtually monitor and protect your systems from any threats or breaches. The resources are implemented with user friendly GUI systems. Most of the work such as maintenance and updates will be done by the software, algorithms and bots that will assist in keeping the cost's lower but the security extremely high."

Well enough of my 2 cents for now...

Re:Also proves that..

[raehl]

Hackers are people who love to play with technology, not cause carnage and destruction. This guy is a "criminal".

Hackers are people who love to play with technology, who *MAY* also like to cause carnage and destruction.

White or black, a hack is a hack.

Re:Also proves that..

[Koiu Lpoi]

So, let's call ourselves something else. We can think of a new name. Let the word 'hacker' go ahead and be a reference to criminal activity.

Study your history

[abb3w]

The press may co-opt our sub-cultural language for their own gross-oversimplification purposes.

The distinction between hacker and cracker was not made in computer geek culture (EG: Usenet) prior to the first mainstream media exposure circa 1983 (on CBS IIR?). The computer community didn't distinguish between "hacking" as (in)elegant writing of code and "hacking" as systems penetration and perversion; it was all part of the continuum. Anyone who practiced SP&P was at the time considered a "hacker", although not all hackers were in SP&P. This lack of foresight led to the mainstream use of "hacker" to describe anyone in SP&P, which has continued to the present even though while "script kiddies" practice a (crude) form of SP&P, most are not even larval "hackers" of the classic meaning.

Attempts to close the barn door after the horse has left, however, are futile-- and in this case, have been for decades. You will not get the mushroom cloud back into it's happy little plutionium sphere; live with it.

Only a matter of time

[Leto2]

Only a matter of time until each American has had their credit card info compromised at least once. Once everyone's identity is by default stolen, we might be able to make a case to use something other than your retirement account number as the key that gives someone access to your whole life, the universe and everything.

Re:Also proves that..

[kosmicki]

I know! Tweaker! Oh wait... Hmmmm...

Credit info stored with Mastercard?

[ilyaa1]

Slightly off-topic, perhaps, but I'm very curious:

I thought that the credit info was stored in the bank where you get your card from, and in the few credit reporting agencies in the country of credit?.. So, does it mean that your credit history does follow you around the world after all?..

"CardSystems web site runs on the Windows 2000..."

[MolBiolDoc]

From news.netcraft.com, whatever that is....http://news.netcraft.com/archives/2005/06/18 /lax_security_cited_in_massive_credit_card_data_th eft.html/

That's pure luck for me

[atlep]

With 40M cards exposed, what's the probability that my card will be exploited?

Re:Also proves that..

[jZnat]

White or black, a hack is a hack.

I thought it was bad everytime somebody brought up the politically correct way of referring to "cybercriminals" and whatnot, but now you're bring race into this? Touche

Not death

[Luke-Jr]

Death penalty is only appropriate when it is impossible to protect society from a criminal. This is never the case with any form of cracking-- simply don't give them access to a computer and they cannot repeat their crime.
A lifelong prison sentence would be the most that would be a legit punishment.

Re:Not death

[jskline]

I know... I know... I was only pontificating... :-) The fact is that "Life" in prison is really only 30 years, and usually less than this for good behavior. Then they get out and do it again... and again... :-)

Cheers;

Re:Dangers of keeping it safe

[Curtman]

I could imagine a dark situation which is already kind of here where enormous databases of personal info and customer billing information can never be challenged or queried by joe public in the interests of 'keeping it safe'.

I don't think Joe Public has any right to query that information unless it's his own either. But short of police investigations I can't imagine many types of data that JP shouldn't have a right to query about his own data.

We already have a law like this in Canada. I'm curious why it doesn't apply to Equifax though. It seems to me that negligence should be treated in the same way as just giving it out to anyone that asks for it.

From the Fact Sheet:

The purpose of the Personal Information Protection and Electronic Documents Act is to provide Canadians with a right of privacy with respect to their personal information that is collected, used or disclosed by an organization in the private sector in an era in which technology increasingly facilitates the collection and free flow of information.

I knew it sounded too good to be true.

Re:Also proves that..

[Curtman]

Hackers are people who love to play with technology, who *MAY* also like to cause carnage and destruction.

That applies to any group of people. A better example of this than the gay/homosexual analogy, is the misconception that to be a faithful Moslem neccessarily means that you are anti American, or a terrorist or whatever. Again, some are... But there are a great many Christian and Jewish terrorists out there too. Same as there are many hackers who are not terrorists.

Anyone who takes hacking or religion too seriously (I.E. uses it to harm others) is probably suffering from some kind of delusion.

Zero Liability does not equal Zero problems...

[Whyte]

How much is your time worth to you?

This would be a problem for me but...

[phyruxus]

my card is maxed out.

MUAHAhAHAHAHAHAhahahaahAHAHAHAHAHAhAH!!!

(b wahahahah)

Re:No socialist regulation is needed

[Zarf]

If everything was easy many of us wouldn't have jobs. Programmers for instance wouldn't have any work at all. If buying things online becomes hard enough then a whole cottage industry could spring up around online-shopping and US government regulations bringing much needed jobs to America.

Imagine online-shopping as easy to use as IRS Tax Forms and online-stores as fast to use as the DMV.

Re:Ahhh! But you forget...

[RickPartin]

Some times just for fun I'll use type in a random 3 digit security code when ordering online (with my own card of course). My order usually goes through without a hitch. Try it some time. It seems pretty useless to me.

Hold on a minute - isn't this backwards?

[Walt]

From MasterCard's press release http://www.mastercardinternational.com/cgi-bin/new sroom.cgi?id=1038:

CardSystems has already taken steps to improve the security of its system. However, MasterCard is giving it a limited amount of time to demonstrate compliance with MasterCard security requirements.

Shouldn't MasterCard have had CardSystems "demonstrate compliance" before sending them even one credit card number? Or is this a usage of "requirements" with which I am unfamiliar?

This is why I never use MasterCard.

[FiloEleven]

I have never, nor will I ever sign up for MasterCard.

To be honest, though, I had no way of knowing this would happen. One would think that I could back this up with things like bad service, or higher average interest, etc.

The real reason I don't use MasterCard is because on every single one of them there is a Venn diagram in hideous colors looking back me. If second grade were taught in a bowling alley, the MasterCard symbol is what would be on the wall as a guide to comparing and contrasting.

The era of no responsibilty

[count_schemula]

If you are 1 minute late with a payment - $39 fee If you are late paying a credit card, your other credit cards can jack the rate to the max - universal default Got a problem with e-bay or pay-pal? Good luck getting a hold of anyone. Got a problem with equifax? Good luck with that one. Took me a year to get a car that my ex-wife refinanced off my credit report. They said I had not paid the loan in a year. That's true, because I NO LONGER EVEN HAD THE LOAN! These are huge companies that would never think twice about making your life more expensive and more hellish, but if you have a legitimate problem, it's almost impossible to get to these faceless companies. Absolutely they should be forced to replace ALL cards in question EVERY time this happens. They are making so much money off of so many people and yet, they don't get the slightest punishment when they screw up.

Re:"CardSystems web site runs on the Windows 2000.

[/dev/trash]

Well yeah. But none of what you posted said it ran windows.

Re:Missing the real story here

[cosmic_0x526179]

Anyway, for this sort of violation of rules, I think MasterCard (and other credit card companies) should terminate their contract with CardSystems. They won't, of course.

No they won't, because of all the little fry that send transactions through this processor. Questions I want answered...

How long was the 'trojan' capturing the data ? How on earth did MC/Visa/FBI decide when it first started monitoring the CC numbers ? They must have a start date, otherwise how did they come up with the 40m number ?

The general phrase here is that it was a 'hacker'... but was it ? Was it some organized crime outfit in eastern europe, russia or perhaps north korea ?

My guess is that the FBI knows alot more about the whole story that is being talked about. This episode should be a textbook study on security failure.

Agreed.

[rnturn]

I heard about this on the local Chicago news last night (06/17). It was one of the first stories reported. Heck they were doing promos for the 10PM news all evening long that mentioned the breach. For it to take the lead over the daily reporting of Chicago city government corruption was quite surprising. I jumped onto the normal sites where I would have expected to get more information about this incident (including /.) and found no mention of this story. Anywhere. There were, though, stories about telepresence and terraforming to be found here. So I guess this story should have had a science fiction component to get onto /. earlier. If only Theo de Raadt had ranted about it...

on the reasons of not giving shit about it

[zanderredux]

let's begin by defining "financial losses"

If you mean the amount involved in the fraudulent transaction, then it might be true.

but credit card companies might face legal action as well, with amounts that exceeds many times the cost of the actual transaction so that in the long run they can lose, too.

START RANT

in the short term, however, managers and directors of those companies do not usually worry because this impact rarely shows up in the end of the current fiscal year (legal action takes time to happen and eventual losses were already forwarded to the merchants, remember). that people can still meet their profit forecasts and wall street analysts (the ones who looks at balances and think they understand the inner workings of an individual company) get happy and excited about these execs.

what do they do in the following fiscal year, you might ask. well, some of them who are luck or well-connected enough can actually go to work in some other corporation, leaving the mess to the newcomer.

that's why, imho, they do not really care at all.

in the other hand, making them fully accountable would just increase those executive's compensation by a lot, since they would face the risk of going to jail or something like it due to something they never really knew (management tends to hide those kinds of stuff from the next higher hierarchical level and so on), but i fail to see if they can be actually held responsible to these security problems without blaming someone else (attorneys can be very persuasive in court sometimes). anyway, as a result, they would get paid a lot more to take that risk and the cost of credit would increase. security, however, would stay laughable as it is today.

upon public indignation, the government steps in and recognizes this fact and implements some stupid, ineffective piece of legislation to appease stockholders, requiring a lot of static, law-mandated checks in an ever-changing environment (security) and the cycle never ends.

as said before, costs to the consumer only go up and up, because corporations might contract insurance against those unknown risks (its way easier to do a financial settlement with an insurance co than carrying a fully-fledged change management program in a large-size corp) and because legislation usually requires yet another layer of auditors who are contracted just to make sure that the company is in compliance with something hackers circumvented long ago.

END RANT

there's a more polished treatment of this kind of reasoning under the name "agency theory", so this is not entirely based on paranoia, but if you think all this is just too stark and cynical, i am not ashamed to agree with you.

and damn, that was a long rant.

Re:"CardSystems web site runs on the Windows 2000.

[SysKoll]

Ooops, sorry, cut-and-paste missed a line. Here, look for yourself: http://toolbar.netcraft.com/site_report?url=http:/ /www.cardsystems.com

The real point is not the breakin

[ArtStone]

Read on down to the end of MasterCard's press relesase.

The U.S. Government is currently considering legislation to expand the Gramm-Leach-Bliley law requiring better security procedures for personal financial information. Currently MasterCard is subject to this law - third party processors are not. I would not be at all surprised if no real accounts have actually been compromised, but then I like tin foil hats.

In fact, Master Card is already backtracking:
http://www.accessnorthga.com/news/ap_newfullstory. asp?ID=61946

Now the number of cards considered "at risk" is only 68,000 - and the spokesperson for Master card says "It wasn't a large amount of fraud, just an abnormal pattern that triggered our system. ... We have tracking systems in place to find the common point of interaction."

Of course, no person who isn't a criminal could oppose "protecting" your personal information better, could they? Especially if it helps protect the children...

Another version

[Mondor]

First of all, the modern credit cards, i.e. smart cards, allow you to use PKI if you are using chip reader. There are certificates of Visa, of your bank and reader manufacturer's. However, the same card has a magnetic stripe, which only holds credit card number, expiration date and some other value like possible limits.

What is important, is that you can not eliminate legacy authentication method, i.e. number and expiration date, just because you will have no possibility then to authorize offline transactions. If you will not allow offline transactions, then it will paralyze commerce on some places like cruise ships, mountains, gas stations etc. Communications are expensive these days, and new technologies like GSM card readers are expensive as well. Millions of such readers required, and even they have their own flaws, like the stupid PKI implementation and WiFi/GSM bugs.

And more. Why your proposed system is stupid. Just because it depends not from VISA or MasterCard, but from specific bank, and there is a bunch of banks even in Paraguay, and I can only imagine how many of them operates in New York. So imagine a small shop, a half of it is occupied by super-secure card readers.

However, what you described is a simplified version of current smart card PKI infrastructure. The point is - it should not be used alone, although it is more secure.

But if to think more on this subject, I think that in the future, don't know how near, all your bank cards, no matter of system, VISA or Amex, will be on one card, one chip, the same as in your mobile phone. In fact, it will be on your mobile phone chip. It is possible, and the only difficulty here is who will own this card - mobile operator, or bank, or you...

Re:The data center runs on UNIX

[msbsod]

"ONLY front end"? These idiots at CardSystems Solutions put insecure Microsoft software at the front end and expect that this concept is secure. My grandmother could have told them that every component has the be secure, in particular the front end, not just the back end. When will they learn? When will they pay the price? http://uptime.netcraft.com/up/graph?site=www.cards ystems.com