Slashdot Mirror
UPS: We've Been Hacked
paysonwelch writes The United Parcel Service announced that customers' credit and debit card information at 51 franchises in 24 states may have been compromised. There are 4,470 franchised center locations throughout the U.S., according to UPS. The malware began to infiltrate the system as early as January 20, but the majority of the attacks began after March 26. UPS says the threat was eliminated as of August 11 and that customers can shop safely at all locations.
I made sure my password is at least 8 digits, alpha-numeric with at least one unique character!
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
Congratulations, you're on LOLCamera!
Everyone gets hacked these days. eBay gets hacked every week!
Support my political activism on Patreon.
Well, I am glad they waited until the issue was resolved before letting their customers know they were at risk. I would have hated for UPS's bottom line to be hurt by letting us know as soon as they realized there was a breach. After all, the company bottom line is more important than my security.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Don't tell me there's separate servers for UPS Canada and that data is never shared across both servers...
Get free satoshi (Bitcoin) and Dogecoins
I am not surprised at all. Windows XP support ended long ago but still extensively used in the US government?
But guess what; we still take ourselves as the epitome of what/how technology should look like.
Here is a list of the following companies that where not hacked this week:
Thank you for watching the 10 O'clock news and have a great weekend.
Security theatre is not limited to the wholly distasteful airport search.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Eight months. That is why I stick to USPS. Slow, but safe.
The malware began to infiltrate the system as early as January 20, but the majority of the attacks began after March 26. UPS says the threat was eliminated as of August 11 and that customers can shop safely at all locations.
What? So the malware had half a year to rumble around?
They say they're now secure. Anybody who knows anything about security knows you're never "secure." You're more secure than you were before, but 100% security is impossible.
True, but UPS MI passes parcels to USPS for last mile delivery.
It's those wiley cyberbogeymen, not us! Honest! Not our fault we left the doors open. CYBERBOGEYMEN!
UPS wanted to save money by outsourcing IT. Well this is what happens when you outsource IT. I hope the banks are starting to pay attention. This is a major security concern. when foreign nationals administer the systems with our financial data. Foreign nationals from India, China, Russia, South Korea .. well you get the picture. If daddy needs a new kidney and they can't afford it they will sell accounts to generate revenue.
We are in for a world of hurt.
I've seen some shitty franchise(e) setups that would be pretty vulnerable to malware (think small locations with 1 or 2 computers and no IT staff). However, as far as I know, their integrated PoS applications never see credit card numbers; everything happens on the payment terminal. Who in their right mind would want to (try to) secure 4471 locations well enough to store credit card info and what use case do they have for franchisees needing to store that info?
It looks like a Nigerian prince had millions of dollars that needed to be delivered on 4/29. With the coalesced dates and independent locations it's got to be phishing emails with a 1% success rate, right?
From the FAQ:
"What information was exposed?
Customer information may have been exposed as a result of this malware intrusion. The customer information that may have been exposed includes customers’ names, postal addresses, email addresses and payment card information." ...further down...
"Will The UPS Store contact me if my credit card was involved?
No, The UPS Store does not have sufficient customer information to contact potentially affected customers directly."
Everytime a see a stroy like this I wonder what it will take before the world finally moves away from credit/debit-card billing on line.
In the Netherlands we already have a system (iDEAL) which allows you to transfer money from your bank to an online shop/service safetly (it's basically a protocol and redirect to your bank, meaning nothing *can* be stored on servers of said store). It's *far* from perfect but it's a whole deal safer then storing card-data, and at least someone is taking initiative. Sure, it may be a slight pain to have to use 2-factor-authentication for every small purchases but at least that can be aliviated by using a store-side credit system.
Perhaps we should move to a ipv6 like system, bank numbers as 64 bit integers, the first time you make a purchase somewhere they will generate a special adress, for you for that specific store, from which the money can be taken. Then if someone gets hacked, all numbers in that block can be invalidated and rolled back to a specific date. (This may cause some financial harm to the hacked institute, but that might get them to focus on security a bit more).
I hate UPS. Their nearest pickup/dropoff location to me is 35 miles away. For any special delivery instructions, you have to pay a membership fee + a charge for each package you want delivered per instructions. Fedex pickup/dropoff locations, on the other hand, are ubiquitous and there's one just 1 mile from my house.
While UPS customers may be worried, those are the people that send stuff by UPS. Just because you receive stuff by UPS doesn't make you vul;nerable.
UPS hasn'r got my ccard info...
I got a new UPS the other day, but I figur if I just use it to power my system, and not plug in the network cable or USB cable,my PC won't be compromised.
.
What brands are affected anyway? The new one I got was Xfinity, it was pretty cheap $80 for 1400VA
HA! I will point out your problem. You went mainstream. Years ago, I realized that all the hacking tools go that route too. So, all my passwords are only 2 characters......and only binary numbers. Hack That!
Never play chicken with a passive aggressive.
"May have" been exposed to Malware intrusion?
I've now come to realize that it is the norm to cancel and request new credit cards/debit cards every 3 quarter just in case my card number has been compromised by one of these hacks.
Maybe if the whole country did the same, banks would finally switch to a more secure card.
I worked for them about 20 years ago in customer service. My workstation was a PC running a terminal connected to an AS/400. I had to press ESC to do certain things. If I pressed ESC twice I went to the AS/400's menu where I could send broadcast messages and reset terminals.
They had to send someone from UPS in New Jersey as they refused to believe someone could access their holy system from a simple customer service terminal.
The rest of the stupidity I saw at that company fit with that experience.
Mostly random stuff.
If they told everybody "your info was hacked" while they hadn't cleaned it up yet, a bunch of folks would have logged on and changed their passwords, immediately exposing the NEW ones. You clean up first, then you engage the PR folks.
why the heck are we still storing credit card information anyway? We've found a way to handle logins and passwords without the need to store my credentials, can't we implement a similar system (e.g. oauth2) for credit cards - where even if you're hacked, all they get is an authorization token that only works for that site and can be instantly cancelled by both the site or the user?
Fuck you in the ass mostly, it seems.
No doubt all your dat has been stolen many times and still no security, standards, measures. Just proves my thesis that we are all doomed.
well I for one, am glad for big data, the cloud and internet of things. can't wait for whats next... perhaps a bigger cloudier internet
.. For those who didn't click-thru and read:
"An assessment by The UPS Store and the IT security firm revealed the presence of this malware on computer systems at 51 locations in 24 states (about 1%) of 4,470 franchised center locations throughout the United States." .. so it's not super wide-spread. Only 1% of their locations? I think it would be interesting to pick ANY national retail operation and see if malware could be found on LESS than 1% of their systems.
It also only impacts particular The UPS Store locations:
"Does this impact UPS corporate or other The UPS Store center locations?
No. Each The UPS Store location is individually-owned and runs an independent private network. The malware was isolated to those locations."
Not cool? Definitely.
The super wide-spread impact of the Target breach? No.
Disclaimer: I am a local customer of The UPS Store, but the location I frequent was not impacted.
Don Head
UNIX/Linux Administrator
each store is a independent computer node and not all are interconnected. That indicates to me that it almost has to be an insider/employee/contractor travelling from store to store implementing the malware ? It seems unlikely that a hacker group could/would have the organization to get around to that many states/stores.
errr....umm...*whooosh* *whoosh* Is this thing on ?
The sad thing is EMV chipped cards won't even fix this or the target breach. Malware can still get the card info even if you authenticate the card. Someday in a few years when most in person transactions are EMV enabled, the card-present fraud ( fake card used in person ) will drop significantly, but unless the credit card companies allow you to deny all card-not-present and non-EMV transactions it won't fully work. I want one card that I use for EMV only that has no other capability and another that I use only online that I can monitor. On a side note does anyone know why they say that if we actually used Chip & PIN instead of Chip & Signature the CC companies would consider that a cash advance? I find it seriously annoying that we get chips with no PIN and I just don't get it? Why should the authentication mechanism change the transaction type?
Sharing such rarely changing authentication data is at the heart of the issue as you point out. It seems like a trade-off of convenience and security with some background fraud cost. However, the issue is always convenience for who and fraud for who? In this case, banks have succeeded in mostly privatizing gains from transactions costs from credit card transaction fees while socializing the cost of identity theft to the general public (who have to change their accounts, deal with years of worries, try to straighten out fraudulent charges at riskof not being able to get a job or buy a house, etc.). This is an example of capitalism at its finest from one point of view -- privatizing gains while socializing costs and risks. That is when we need government (as the will of the People) to step in and force banks to internalize the cost of identity theft rather than pass it on indirectly. Ultimately, that might have to be done by big fines for breaches or taxes on unsecured transactions. And if banks had to do that, they would probably rapidly deploy something better because it would be cheaper than raising costs to customers and losing business to other banks that did implement better systems.
Perhaps the only worse thing is when businesses in the USA are allowed to use essentially unchangeable info about a person like date of birth or social security number to authenticate them. Other countries seem to handle this better by having an additional private PIN as part of a SSN. Some also include using the post office as part of the authentication process (like to present your ID at the post-office to approve some transaction or initiate some communications link). I'm surprised the US post office (which handles US passports now) does not get involved with authentication in general, as it seems like a surefire money-maker in the digital age, and the US post office already has procedures in place from passports to verify identity.
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
It seems like authentication is important to modern society. I think the only real solution is a government-issued ID, capable of challenge-response. Even a PIN for the ID is useless if every company expects you to hand it over to them.