Slashdot Mirror
Top Five Causes of Data Compromise
Steve writes, "In a key step to help businesses better understand and protect themselves against the risks of fraud, Visa USA and the U.S. Chamber of Commerce announced the five leading causes of data breaches and offered specific prevention strategies. The report states that the most common cause of data compromise is a merchant's or a service provider's encoding of sensitive information on the card's magnetic stripe in violation of the PCI Data Security Standard. The other four are related to IT security, which can be improved simply by following common-sense guidelines." Here is the report on the U.S. Chamber of Commerce site (PDF).
Users! Users! Users!
Wait, five reasons? Add a 'Users! Users!' to the end of that.
"Use of Vendor Supplied Default Settings and Passwords - In many cases, merchants receive POS hardware or software from outside vendors who install them using default settings and passwords that are often widely known to hackers and easy to guess." Incredible.
1. Storage of Magnetic Stripe Data
2. Missing or Outdated Security patches
3. Use of Vendor Supplied Default Settings and Passwords
4. SQL Injection
5. Unncessary and Vulnerable Services on Server
Honestly, could my post be any more useful?
Maybe their data got compromised? D:
Whatever happened to the old saying that your credit card would more likely be ripped off by a waiter than someone off of the internet? Or are waiters taking hacking jobs these days?
https://youramazingbank.amalgamatedservices.com/7j 2jcd_30smdkdfor*usersget/gimmethefarkingsocialsand 4427snow.jsp??/
Nah. Couldn't be.
---- Teach Peace. It's Cheaper Than War.
Perhaps slightly OT, but the article is slashdotted and the header mentioned VISA and breaches.
I think one of the greatest mistakes the credit/debit card companies/banks (certainly here in the UK) made was the compulsary PIN entering (as opposed to a signature) at point-of-sale. Now all you need to do is stand behind me and see my PIN, or if you work at the store - have the security camera trained at the keypad then either lift my wallet or clone my card. All you need is that four digit number, and you've pretty much got my bank account.
My point is, companies make fundamental security errors, and will continue to do so.
1. Having your sensitive information recorded in any medium.
That's it.
Really, there's no such thing as perfect security. If you have any information that you want to keep secure and you tell it to even one other person, it will eventually be accessible to anyone who has enough interest in it.
Hell, if we don't rule out torture, you yourself aren't a reliable repository for your own sensitive information.
But you have to share certain information with others if you want to do business, don't you? Well, it seems to me that the only way to avoid all the mess and hassle is to either:
1. Develop a system of doing business where I don't have to be able to identify a person and keep track of that person and/or their assets (goodbye credit-based economy!)
OR
2. Make it so that even if the information used to idenitfy me is made public, it doesn't matter in the slightest.
The second choice means that the information a business uses to establish my identity has to be enough to authenticate me in some manner to that business, but is otherwise useless to identify my person (age, gender, race, etc.), my place of residence, my bank account, my credit rating, or anything else about me.
Hmm... I think it's possible, but not likely. The banks and corporations very much enjoy knowing all this about you, and it will be a mighty struggle indeed to wrest control of your "personal information" away from them.
Insisting on "correct" English is like saying that there is only one, definitive recipe for chili.
Or something :)
POS meant point-of-sale... guess I was mistaken.
Be who you are and say what you feel, because those who mind don't matter and those who matter don't mind. - Dr. Seuss
I miss one item in that list:
"PDF documents with readable text under the black rectangles."
I'm in the IT department for a large ISO and give the security lecture during new hire orientations. We have to follow PCI compliancy and are aware of the dangers on the Internet. Insider jobs are a threat, but not yet. Right now, most of the crime is organized out of European countries and the most they use outsiders for is as a mule. The list they gave along with social engineering is actually quite acurate. CardSystems, an ISO with some 119k merchants was compromised last year due to a SQL injection attack and the storing of track 2 data of failed transactions on their processing hosts in plain text. Part of PCI compliancy is to only store that data in a strongly encrypted form (They give examples) and it's common practice to only store it during standin (When the upstream processor is down) and after standin until all the transactions run through successfully. They really f*ed up! The debit card fraud that happened earlier this year is still under investigation, but rumors have it that the POS system that Sams Club and/or OfficeMax use to send all the transactions to their processor was compromised. Of course, we won't know the story until the feds either give up or find the criminals.
I work for a major merchant in the US. We take just a ton of credit cards, and have ongoing Visa PCI/CISP discussions.
For those who don't know, the magnetic track on a credit card actually has three tracks worth of data. Tracks 1 and 2 both have the account number; track 1 also has your name and perhaps some other stuff. I'm more familiar with track 2.
Track 2 has the card number, the expiration date, and something called "discretionary data." The discretionary data, so far as I can ascertain, is defined by the issuing bank or organization, and has no (publicly documented) inherent meaning - except "we'll cut your balls off if you store this for any period of time."
You can get away with storing the entire track worth of data if you're doing offline approvals, but once you get the approval, you had better ditch the discretionary stuff.
We do some fraud detection in the POS system with a SHA-1 hash of the card data. As you all (should) know, this is a non-reversible hash. We're so paranoid about the discretionary data that we only even calculate the hash of the card number and expiration date - we don't even include the discretionary data in our hash calculations!
The preferred solution is to not have a problem.