Slashdot Mirror
Largest Data Breach Disclosed During Inauguration
rmogull writes "Brian Krebs over at the Washington Post just published a story that Heartland Payment Systems disclosed what may be the largest data breach in history. Today. During the inauguration. Heartland processes over 100 million transactions a month, mostly from small to medium-sized businesses, and doesn't know how many cards were compromised. The breach was discovered after tracing fraud in the system back to Heartland, and involved malicious software snooping their internal network. I've written some additional analysis on this and similar breaches. It's interesting that the biggest breaches now involve attacks installing malicious software to sniff data — including TJX, Hannaford, Cardsystems, and now Heartland Payment Systems." One bit of good news out of this massive breach is that, according to Heartland's CFO, "The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address." Heartland just put up a press release on the breach.
WTF??? What does the inauguration have to do with this? I suggest we go back to all Slashdot stories and insert what happened on that day. Examples:
* Researcher says Linux is better than Windows on Friendship Day.
* Researcher says Linux is better than Windows on Fall Equinox.
* Researcher says Linux is better than Windows on Kwanzaa.
As soon as Barack Obama became President, the world started falling apart.
I warned this would happen but you were just too damn proud to listen.
Game over, man. Game over.
...to steal the Hope Diamond. http://www.southparkstudios.com/episodes/207897/
If that was their plan, then that's a foolish one. It would have to be an EXTREMELY slow news day for this to get picked up on by the major news outlets, and even slower for most viewers to bother understanding it. And it's going to be picked up by people who are interested, like here, reguardless.
Burying it effectively would be waiting for something like the newest release of some major open source software, or waiting until China or Australia or other nation did something major about censorship.
This is why I never go on the internet. It's just not safe.
Hey, that's mine!
Convert FLACs to a portable format with FlacSquisher
"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address," Baldwin said.
Because as we all know it is impossible to get someone's address by having only their full name and credit card number.
They are trying to down play a very serious incident by disclosing the breach on a day heavily focused on the inauguration. Then they have the nerve to say "don't worry they didn't get your address" as if to say someone smart enough to embed malicious software which gathers credit card numbers is not smart enough to find someone's address. Common!
/whisper/ Thanks for the candy!
The guy posted to his blog about it. On the same day as the inauguration.
Seriously, the tone of the summary is dumb as fuck. The press release is from today, as is the blog post. It's not even a fucking newspaper article.
Nearly every company that suffers a breach like this tries to assure people about what the bad guy's didn't manage to steal. Don't believe it. Even if it might be true at the strict technical level, it's still not relevant to the analysis of the severity of this issue. The bad guys already have databases full of names and addresses which they will cross reference against the data they stole.
If you mod me down, I shall become more powerful than you could possibly imagine.
The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address.
Because we all know that it's impossible to spoof the magnetic strip on the credit card.
Then prove it - what is the security code on the back?
#
#\ @ ? Colonize Mars
#
When stuff like this happens, it is not the consumers who end up paying, but Visa / MC - who end up putting pressure on these guys to get their act together.
And visiting that link brought up an "invalid security certificate" warning. Good old Microsoft - they can't even get their own servers set up right.
You do know that has nothing to do with the server itself right?
"When stuff like this happens, it is not the consumers who end up paying, but Visa / MC - who end up putting pressure on these guys to get their act together"
..
It's the consumers who pay for it with higher charges to pay for things like the chip-and-pin upgrade. Similar to how the consumers pay for shop-lifting
davecb5620@gmail.com
What's needed is a totally new kind of online financial transaction system. One that don't use card numbers. A dongle on the client connects to the server generates a one-time session key,and identifies itself to the server and displays a random Pin code, the customer then types it in to verify the transaction. The session is encrypted and the data sent can only be used for the one transaction, no repeat man-in-the-middle hacks ..
davecb5620@gmail.com
"You do know that has nothing to do with the server itself right?"
Do you have any citations for that?
'A piece of malicious software planted on the company's payment processing network that recorded payment card data as it was being sent for processing to Heartland by thousands of the company's retail clients'
davecb5620@gmail.com
storing this information ?
Nullius in verba
Did you check the security certificate that is being used by that Microsoft site before posting? I'm sure you understand what role these certificates serve in relation to https connections.
Of course, the connection to their site might be being intercepted by aliens who are replacing a valid certificate with a bad one. Or maybe they're using an old skool coal fired server and forgot to shake down the clinkers.
I'll just use Occam's Razor here - and the simplest explanation is that that server is running Windows and it wasn't configured correctly.
Actually, they can. It isn't invalid at all, it was merely issued by Microsoft's certification authority (which itself has a CA certificate issued by GTE CyberTrust). The problem is your browser (my Firefox 3 didn't even blink twice at it).
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
And this is somehow anything to do with the server? We're talking about a payment processor, who has to comply with PCI DSS. One thing that requires is that the server managing payment data be isolated from all the client PCs, and run appropriate security software etc. If anything, this is Heartland's fault (and their PCI assessors, of course). Nothing to do with Microsoft, who for the most part make good servers (even if everything else sucks).
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
This is BS. Anyone with a card terminal can key the number in, or the card could be cloned. I discovered that FIA categorizes keying the number into the terminal as a "card present" transaction, when I tried to dispute an unrecognized charge. They then use this as a reason that the charge was legitimate, even when the card was not in fact present.
Sent from my iPhone
Sure, if you want to be pedantic, but the rest of us include the software that the server is there to run and its config in server setup. Invalid security certs don't give me a warm fuzzy.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
How did this get marked troll? I mean it is relevant what software was used when a system is breached isn't it?
One bit of good news out of this massive breach is that, according to Heartland's CFO, "The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address." Heartland just put up a press release on the breach.
You could have donated to the Obama campaign using a credit card without a correct address. Google "obama AVS".
Actually, that's an example of Firefox3 screwing up in a situation where every other browser (even Firefox2) does a better job. It ought to allow me to see the page, without "adding a security exception" and risking accidentally leaving the 'permanent' box checked.
"Believe me!" -- Donald Trump
Damn straight. Just ask any malicious software author what their server platform of choice is.
3 things about computers: they're alive, they're self-aware, and they hate your guts.
That new meme is old news.
I've been saying that for weeks.
Disclaimer: The opinions and actions of the US Gov't are in no way representative of those held by this author or its ci
AVS is not necessary to process a transaction.
Anyone with a merchant account has the full ability to control their scrub by adjusting their AVS settings, from full matching, partial or none at all.
We have been going through these issues for years. These problems are not created by consumers, but by the companies that want to legitimately take their funds in return for goods, yet the consumers wind up having their share of problems from this.
At some point facial, iris, thumbprint readers (of pattern or blood vessels) or something is going to have to be implemented.
Given that most computers/cellphones have cameras now, when will it happen?
Actually, you're only smelling the unwashed masses as they exalt Obama.
Disclaimer: The opinions and actions of the US Gov't are in no way representative of those held by this author or its ci
Perspectives is an excellent add-on for Firefox 3 that checks pages with self-signed certs from several locations and then bypasses the terrible Firefox 3 warning page if everything checks out. This is pretty effective at negating man-in-the-middle attacks.
Said, "It's just like dice but it's got more sides And it tells me who lives and who dies"
Mass re-issuance of cards may not be the best response. In the TJX experience, the cost of re-issuing cards far exceeded the actual risk. Alternatives to re-issuance include tighter monitoring of and restrictions on affected card accounts. --Ben
Benjamin Wright, Dallas, Texas, benjaminwright.us
"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address."
Hah.
Addresses in card-not-present transactions can in fact be gotten, and if they use AVS then at the least the AVS data is readily available.
In other words, you're getting pwned even if it was card-not-present.
For those not in the know, most Internet transactions, phone orders, mail orders, and eBay/PayPal transcations are card-not-present. In fact, virtually all of the above.
The quote from Heartland was just weasel-talk.
deleting the extra space after periods so i can stay relevant, yeah.
Those who claim to be perfect but never admit mistakes usually are covering up for massive mistakes.
And the missing million emails we know of are just the observable symptom, as are the transactions in this health data breach.
The old truisms of data security still apply:
1. It's usually insiders that provided or passed on information used to get access.
2. Those who cover up problems only create even larger problems, due to the system of trust.
3. You can stop 99 percent of attacks with reasonable security measures, but a determined attacker willing to use human intelligence methods will almost always get through the other 1 percent - the trick is knowing what measures will dissuade the 99 percent and implement those, and use reporting to discover the other 1 percent instead of measures that will be defeated anyway.
-- Tigger warning: This post may contain tiggers! --
>> Users who install software on their workstations.
>> In a perfect world, software makers wouldn't write software that demands that it run with administrator privileges.
Both of the above statements seem to indicate that you're running MS Windows. If I were you I'd be thinking about how to change that.
Linux has a much stronger security model and generally does not require users to run apps as root.
Also, 99.999% of virusses are windows-only.
Also, most basic users aren't even going to be able to get their favorite windows apps running under Linux anyay.
Yes, I can dream of the day I could get users over to something else...
Sometimes people are just stuck until something better comes along. But I'll say this much: When Autodesk starts making CAD for MacOSX again, I'm pushing for change.
Thanks...I needed a new one to renew my 2600 sub.
My debut novel AMITY now available: http://jeremydbrooks.c
Well, considering the pummeling TJMaxx got for a smaller breach, they may be trying to keep their brand from becoming synonymous with some nefarious concept like 'security breach', 'stolen credit cards', etc
My debut novel AMITY now available: http://jeremydbrooks.c
Hi, you must be new here. Welcome to-
Fuck it.
My debut novel AMITY now available: http://jeremydbrooks.c
Why are we assuming 100 million transactions?
TFA says "100 million transactions per month". But they have no idea how long the malware was in place. It could have been a week; that's 25 million transactions. It could have been six months. Hell, the TJX breach happened over the course of several years (although they weren't stealing data continuously). It sound like it'll definitely be big, and it could be the biggest ever (TJX clocks in at around 45 million transactions stolen), but we don't have any idea how big.
Repton.
They say that only an experienced wizard can do the tengu shuffle.
Uh, Linux?
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Given how much it costs merchants when someone issues a chargeback (they loose the money they got paid for the goods, they likely loose the goods AND they have to pay fees to Visa/MC/etc), why aren't the merchants doing more to pick up on fraudulent transactions? And why aren't they doing more to apply pressure to Visa/MC/etc to change the rules (e.g. get rid of the rules that make it harder for them to do ID checks etc to pick up the fraud)
I have no clue how much money, say, Wal-Mart is out annually because of credit card fraud but they must be big enough to lobby Visa/MC for change. Or better yet, lobby the government to change the rules so that Visa/MC foot the bill for fraud instead of the merchants. Argue that since the merchants are prohibited by Visa/MC rules from taking these measures that would help prevent fraud, they shouldn't be liable for said fraud).
In any case, merchants on the receiving end of a chargeback are the losers when it comes to credit card fraud so it would be in their best interest to use their lobbying power to fight for a better deal (or can Visa/MC out-lobby even the might of Wal-Mart?)
I'm smarter, so I just won't let you know the order of the numbers ...
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address."
So... of the 300-million-plus transactions they KNOW have been exposed, NONE of them were card-not-present(CNP) transactions that included address verification data?
Address verification data might not be enough for identify theft -- but then it might -- but it SURE as hell is enough to forge more CNP transactions. Oh, and by the way, a lot of CNP transactions would ALSO include the CVV2 on the back of the card.
What are the odds that, out of 300 million transactions, SOME cards have been used in both card-present AND card-not-present situations? Simply match on card numbers, and poof! Magstripe *and* AVS *and* CVV2. That's the whole card security scheme, shot to hell. Pwned.
It's supposed to be completely automatic, but actually you have to press this button.
As icky as this might sound, the longer it takes before we crash the higher the population.
Crashing sooner involves fewer people suffering.
Again, no accountability for keeping personal info of people that trust your organization.
I tell you no don't keep records of my cc in your db. You say, we can and will....is there not a police for this sort of thing? Sounds to me like this should be another one of Obama's point of interest while in office.
Price Waterhouse Cooper and Carnegie-Mellonâ(TM)s CyLab have recent surveys that show the senior executive class to be, basically, clueless regarding IT risk and its tie to overall enterprise (business) risk. Data breaches and thefts are due to a lagging business culture â" and people arenâ(TM)t getting the training they need. For example: Microsoft patched for this virus 4 months ago. I like to pass along things that work, in hopes that good ideas make their way back to me, and as CIO, I look for ways to help my business and IT teams further their education. Check your local library: A book that is required reading is "I.T. WARS: Managing the Business-Technology Weave in the New Millennium." It also helps outside agencies understand your values and practices. The author, David Scott, has an interview that is a great exposure: http://businessforum.com/DScott_02.html - The book came to us as a tip from an intern who attended a course at University of Wisconsin, where the book is an MBA text. It has helped us to understand that, while various systems of security are important, no system can overcome laxity, ignorance, or deliberate intent to harm. Necessary is a sustained culture and awareness; an efficient prism through which every activity is viewed from a security perspective prior to action. In the realm of risk, unmanaged possibilities become probabilities â" read the book BEFORE you suffer a bad outcome â" or propagate one.