Slashdot Mirror
Largest Data Breach Disclosed During Inauguration
rmogull writes "Brian Krebs over at the Washington Post just published a story that Heartland Payment Systems disclosed what may be the largest data breach in history. Today. During the inauguration. Heartland processes over 100 million transactions a month, mostly from small to medium-sized businesses, and doesn't know how many cards were compromised. The breach was discovered after tracing fraud in the system back to Heartland, and involved malicious software snooping their internal network. I've written some additional analysis on this and similar breaches. It's interesting that the biggest breaches now involve attacks installing malicious software to sniff data — including TJX, Hannaford, Cardsystems, and now Heartland Payment Systems." One bit of good news out of this massive breach is that, according to Heartland's CFO, "The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address." Heartland just put up a press release on the breach.
WTF??? What does the inauguration have to do with this? I suggest we go back to all Slashdot stories and insert what happened on that day. Examples:
* Researcher says Linux is better than Windows on Friendship Day.
* Researcher says Linux is better than Windows on Fall Equinox.
* Researcher says Linux is better than Windows on Kwanzaa.
As soon as Barack Obama became President, the world started falling apart.
I warned this would happen but you were just too damn proud to listen.
Game over, man. Game over.
...to steal the Hope Diamond. http://www.southparkstudios.com/episodes/207897/
If that was their plan, then that's a foolish one. It would have to be an EXTREMELY slow news day for this to get picked up on by the major news outlets, and even slower for most viewers to bother understanding it. And it's going to be picked up by people who are interested, like here, reguardless.
Burying it effectively would be waiting for something like the newest release of some major open source software, or waiting until China or Australia or other nation did something major about censorship.
This is why I never go on the internet. It's just not safe.
Hey, that's mine!
Convert FLACs to a portable format with FlacSquisher
Obama will fix it.
"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address," Baldwin said.
Because as we all know it is impossible to get someone's address by having only their full name and credit card number.
They are trying to down play a very serious incident by disclosing the breach on a day heavily focused on the inauguration. Then they have the nerve to say "don't worry they didn't get your address" as if to say someone smart enough to embed malicious software which gathers credit card numbers is not smart enough to find someone's address. Common!
/whisper/ Thanks for the candy!
The guy posted to his blog about it. On the same day as the inauguration.
Seriously, the tone of the summary is dumb as fuck. The press release is from today, as is the blog post. It's not even a fucking newspaper article.
Nearly every company that suffers a breach like this tries to assure people about what the bad guy's didn't manage to steal. Don't believe it. Even if it might be true at the strict technical level, it's still not relevant to the analysis of the severity of this issue. The bad guys already have databases full of names and addresses which they will cross reference against the data they stole.
If you mod me down, I shall become more powerful than you could possibly imagine.
The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address.
Because we all know that it's impossible to spoof the magnetic strip on the credit card.
Thanks, I needed a name and adress....
Partner profile
davecb5620@gmail.com
Then prove it - what is the security code on the back?
#
#\ @ ? Colonize Mars
#
Nice troll! Wow.
I'll bite, since it was a really good troll you posted.
To answer your question, the best magician does his dirty tricks when everyone's attention is fixed on a good distraction. What better way to hammer into a site and steal all kinds of info when everyone is staring at a TV?
I would be actually somewhat surprised if this was the only major crime committed today.
The dangers of knowledge trigger emotional distress in human beings.
When stuff like this happens, it is not the consumers who end up paying, but Visa / MC - who end up putting pressure on these guys to get their act together.
"When stuff like this happens, it is not the consumers who end up paying, but Visa / MC - who end up putting pressure on these guys to get their act together"
..
It's the consumers who pay for it with higher charges to pay for things like the chip-and-pin upgrade. Similar to how the consumers pay for shop-lifting
davecb5620@gmail.com
Yeah, that was my take on it-- that "inauguration" headline has nothing to do with the actual story, and the data breach has nothing whatsoever to do with the inauguration. The inauguration is just there because, hey, all the news stories today have to mention it. It's, like, a rule or something.
I don't think it's a rule that slashdot article summaries have to mention the inauguration even if it's not relevant to the story, though. Can't somebody here look at who wrote the summary and moderate them -1 irrelevant?
http://www.geoffreylandis.com
What's needed is a totally new kind of online financial transaction system. One that don't use card numbers. A dongle on the client connects to the server generates a one-time session key,and identifies itself to the server and displays a random Pin code, the customer then types it in to verify the transaction. The session is encrypted and the data sent can only be used for the one transaction, no repeat man-in-the-middle hacks ..
davecb5620@gmail.com
storing this information ?
Nullius in verba
This is BS. Anyone with a card terminal can key the number in, or the card could be cloned. I discovered that FIA categorizes keying the number into the terminal as a "card present" transaction, when I tried to dispute an unrecognized charge. They then use this as a reason that the charge was legitimate, even when the card was not in fact present.
Sent from my iPhone
One bit of good news out of this massive breach is that, according to Heartland's CFO, "The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address." Heartland just put up a press release on the breach.
You could have donated to the Obama campaign using a credit card without a correct address. Google "obama AVS".
AVS is not necessary to process a transaction.
Anyone with a merchant account has the full ability to control their scrub by adjusting their AVS settings, from full matching, partial or none at all.
We have been going through these issues for years. These problems are not created by consumers, but by the companies that want to legitimately take their funds in return for goods, yet the consumers wind up having their share of problems from this.
At some point facial, iris, thumbprint readers (of pattern or blood vessels) or something is going to have to be implemented.
Given that most computers/cellphones have cameras now, when will it happen?
Mass re-issuance of cards may not be the best response. In the TJX experience, the cost of re-issuing cards far exceeded the actual risk. Alternatives to re-issuance include tighter monitoring of and restrictions on affected card accounts. --Ben
Benjamin Wright, Dallas, Texas, benjaminwright.us
"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address."
Hah.
Addresses in card-not-present transactions can in fact be gotten, and if they use AVS then at the least the AVS data is readily available.
In other words, you're getting pwned even if it was card-not-present.
For those not in the know, most Internet transactions, phone orders, mail orders, and eBay/PayPal transcations are card-not-present. In fact, virtually all of the above.
The quote from Heartland was just weasel-talk.
deleting the extra space after periods so i can stay relevant, yeah.
Those who claim to be perfect but never admit mistakes usually are covering up for massive mistakes.
And the missing million emails we know of are just the observable symptom, as are the transactions in this health data breach.
The old truisms of data security still apply:
1. It's usually insiders that provided or passed on information used to get access.
2. Those who cover up problems only create even larger problems, due to the system of trust.
3. You can stop 99 percent of attacks with reasonable security measures, but a determined attacker willing to use human intelligence methods will almost always get through the other 1 percent - the trick is knowing what measures will dissuade the 99 percent and implement those, and use reporting to discover the other 1 percent instead of measures that will be defeated anyway.
-- Tigger warning: This post may contain tiggers! --
>> Users who install software on their workstations.
>> In a perfect world, software makers wouldn't write software that demands that it run with administrator privileges.
Both of the above statements seem to indicate that you're running MS Windows. If I were you I'd be thinking about how to change that.
Linux has a much stronger security model and generally does not require users to run apps as root.
Also, 99.999% of virusses are windows-only.
Also, most basic users aren't even going to be able to get their favorite windows apps running under Linux anyay.
Yes, I can dream of the day I could get users over to something else...
Sometimes people are just stuck until something better comes along. But I'll say this much: When Autodesk starts making CAD for MacOSX again, I'm pushing for change.
Thanks...I needed a new one to renew my 2600 sub.
My debut novel AMITY now available: http://jeremydbrooks.c
Well, considering the pummeling TJMaxx got for a smaller breach, they may be trying to keep their brand from becoming synonymous with some nefarious concept like 'security breach', 'stolen credit cards', etc
My debut novel AMITY now available: http://jeremydbrooks.c
OK, this means that many people will now have to cancel their credit card and get a new number. Wow. Maybe 10 minutes of time lost.
Will these people be charged anything? No. Will there be any monetary loss at all to these people? No.
Whom does this hurt the most? Merchants that deliver services over the web without any physical shipment and without adequate verification of the card before delivering to the thief. Anything that involves a physical shipment is likely to be stopped long before it makes it out the door.
But of course this will be talked about as "identity theft" and that it will cost people lots of time and money. Sadly, the FBI now records all credit card fraud as "identity theft" which just makes people like Todd Davis rich.
Why are we assuming 100 million transactions?
TFA says "100 million transactions per month". But they have no idea how long the malware was in place. It could have been a week; that's 25 million transactions. It could have been six months. Hell, the TJX breach happened over the course of several years (although they weren't stealing data continuously). It sound like it'll definitely be big, and it could be the biggest ever (TJX clocks in at around 45 million transactions stolen), but we don't have any idea how big.
Repton.
They say that only an experienced wizard can do the tengu shuffle.
Given how much it costs merchants when someone issues a chargeback (they loose the money they got paid for the goods, they likely loose the goods AND they have to pay fees to Visa/MC/etc), why aren't the merchants doing more to pick up on fraudulent transactions? And why aren't they doing more to apply pressure to Visa/MC/etc to change the rules (e.g. get rid of the rules that make it harder for them to do ID checks etc to pick up the fraud)
I have no clue how much money, say, Wal-Mart is out annually because of credit card fraud but they must be big enough to lobby Visa/MC for change. Or better yet, lobby the government to change the rules so that Visa/MC foot the bill for fraud instead of the merchants. Argue that since the merchants are prohibited by Visa/MC rules from taking these measures that would help prevent fraud, they shouldn't be liable for said fraud).
In any case, merchants on the receiving end of a chargeback are the losers when it comes to credit card fraud so it would be in their best interest to use their lobbying power to fight for a better deal (or can Visa/MC out-lobby even the might of Wal-Mart?)
I'm smarter, so I just won't let you know the order of the numbers ...
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address."
So... of the 300-million-plus transactions they KNOW have been exposed, NONE of them were card-not-present(CNP) transactions that included address verification data?
Address verification data might not be enough for identify theft -- but then it might -- but it SURE as hell is enough to forge more CNP transactions. Oh, and by the way, a lot of CNP transactions would ALSO include the CVV2 on the back of the card.
What are the odds that, out of 300 million transactions, SOME cards have been used in both card-present AND card-not-present situations? Simply match on card numbers, and poof! Magstripe *and* AVS *and* CVV2. That's the whole card security scheme, shot to hell. Pwned.
It's supposed to be completely automatic, but actually you have to press this button.
As icky as this might sound, the longer it takes before we crash the higher the population.
Crashing sooner involves fewer people suffering.
Again, no accountability for keeping personal info of people that trust your organization.
I tell you no don't keep records of my cc in your db. You say, we can and will....is there not a police for this sort of thing? Sounds to me like this should be another one of Obama's point of interest while in office.
Price Waterhouse Cooper and Carnegie-Mellonâ(TM)s CyLab have recent surveys that show the senior executive class to be, basically, clueless regarding IT risk and its tie to overall enterprise (business) risk. Data breaches and thefts are due to a lagging business culture â" and people arenâ(TM)t getting the training they need. For example: Microsoft patched for this virus 4 months ago. I like to pass along things that work, in hopes that good ideas make their way back to me, and as CIO, I look for ways to help my business and IT teams further their education. Check your local library: A book that is required reading is "I.T. WARS: Managing the Business-Technology Weave in the New Millennium." It also helps outside agencies understand your values and practices. The author, David Scott, has an interview that is a great exposure: http://businessforum.com/DScott_02.html - The book came to us as a tip from an intern who attended a course at University of Wisconsin, where the book is an MBA text. It has helped us to understand that, while various systems of security are important, no system can overcome laxity, ignorance, or deliberate intent to harm. Necessary is a sustained culture and awareness; an efficient prism through which every activity is viewed from a security perspective prior to action. In the realm of risk, unmanaged possibilities become probabilities â" read the book BEFORE you suffer a bad outcome â" or propagate one.