Slashdot Mirror
Home Depot Confirms Breach of Its Payment Systems
itwbennett writes: Home Depot confirmed Monday that its payment systems had been breached, potentially affecting any customers who shopped at its stores in the U.S. and Canada since April. There's no evidence yet that debit card PINs had been compromised, the company said, though it is still figuring out the scope and scale of the attacks. Home Depot is offering a free year of identity protection services for anyone who used a payment card in one of their stores since the beginning of April.
In other words, almost everyone.
Yet another major computer security breach at a big retailer, compromising the payment details of uncountable customers.
It seems to me that the core problem is that companies won't hire actual experienced hackers as security consultants; for some reason, the idea terrifies them. Instead, they hire bozos that possess some worthless "security" certificate (like CompTIA).
Or even worse, they'll hire a hacker that was dumb enough to get caught and go to jail for his actions. For some reason, that gives them credibility.
Those of us who managed to spend their teenage years hacking everything in sight, and not getting caught — the ones with real expertise — get nothing.
And so these breaches continue.
Oh, and BTW, this is why I pay cash.
"Once we've identified and embraced our sickness, we'll have strength...and that's when we get dangerous." - John Waters
You for got to mention How L33t you are, Anonymous I iz
I agree, however the major issue here is that there are not enough hackers to go around. So unfortunately security will always be a mess I suppose.
Remember when cash registers used to be glorified calculators? Now they are cheap PCs running poorly configured operating systems. You have tons of attack vectors open from USB ports to unneeded services. That and credit card companies are too fucking cheap to switch to chip and pin. The only reason the rest of world switched was because the companies were forced to. Not in the good old USA.
Only the State obtains its revenue by coercion. - Murray Rothbard
Even chips are bullshit. Why aren't CCs issuing one time tokens per a transaction - this rendering subsequent transactions useless? (Or tying the token to a retailer for subscriptions / etc)
I understand where you're coming from. As you may know, I've been doing infosec for a long time, and I know the difference between "compliant" and "secure". I'm rather surprised you chose CompTIA Security+ as your example of a bad security certification. The new one especially is quite comprehensive, in my view. Not that a single certification can ensure that a candidate is ready to perform any and all jobs related to security, but I'd say that if even 10% of the people designing and maintaining these systems had enough knowledge to pass Security+, we'd be in a lot better shape.
come on, editors, really? We know what the PIN acronym means. We know it's, by definition, a number.
Slashdot has the biggest pedants, but many are some of the brightest minds in the world. THE WORLD.
Give us some editing love, please, and don't allow phrases like "PIN number".
Funny how this is posted to /. in the wake of the "Architecting the Cloud" book review. There were some comments made about AWS and how it is so wonderfully PCI compliant and I just left a comment that was probably a bit derogatory against the entire concept of PCI compliance, but what can I say, after going through that process with my own stuff I am absolutely not anywhere near confident about PCI compliance meaning anything at all whatsoever. You can be tripple PCI compliant with some sugar on top and you will still have security problems that will get you cracked.
You can't handle the truth.
.
Film at 11.
and go get a new credit card number.
In the processing of waiting for a new card. Even if I'm not liable, I don't want my bank footing the bill for criminal purchases made by someone.
Just use cash instead of plastic. Go to your bank, get real money, QED. Cashiers are shocked when I use a fifty or hundred dollar bill to pay for a purchase.
Why do people get all worked up over stupidity like this? Home Depot blew it, but at the end of the day, the credit card company and Home Depot are the ones who are on the hook for any fraudulent charges, not the consumer.
The problem is not that they don't know how to fix the problem, or know how to get someone who could. The problem is that they don't give a shit. That requires a different solution.
Comment removed based on user account deletion
Home Depot deployed new card readers at all their stores (of the ones I saw at least) almost overnight shortly after the target breach. I had guessed it was in response to the breach to beef up security...
But it looks like it was the new ones that were compromised... (or else it was coincidental).
It seems to me that the core problem is that companies won't hire actual experienced hackers
Most likely the problem was the exact opposite: They did hire a black hat, and this was an inside job.
No need to hire black hats. On this present economy and the mentality of the get the cheaper you can, they are probably paying students or some "Windows" experts to take care of their systems. This smells more of incompetence than of an inside job.
Are they what people enter into an ATM machine these days?
I guess they will be calling them PINNs and ATMMs in short order...
The CEO's bonus must be docked, the CIO must be fired, all the top executives who were in the decision chain of the security decisions must have their bonus forfeited, pay docked and a few of them should be fired too, Unless we see a strong reaction that hits the top management hard, they are not serious. When the things were going was good they had no compunctions in attributing it all to their own super brilliance and their actions and decisions. Thus they justified awarding themselves compensation two orders of magnitude more than rest of the corporations.
They must also take the blame as seriously and pay for it in terms of cash and career prospects.
They should, but they won't.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
My experience with Home Depot has been extremely low quality products. Your experience my differ, but I stopped shopping there long ago and now only shop at local, family-owned shops.
If you start using cash for big-ticket items, like TVs and cars, businesses (at least, around here) are required by law to report these transactions to the cops and the tax authorities.
You are better off using a check. It may still get reported, but it won't smell as bad.
It seems to me that the core problem is that companies won't hire actual experienced hackers
Most likely the problem was the exact opposite: They did hire a black hat, and this was an inside job.
No. If history is any indicator, and it usually is, this is just another case of system admin ass-hattery. In other words, bad practices; giving LAN access to the HVAC contractor, allowing remote desktop access by the POS system contractor, etc. All things we've seen before in other high-profile breaches.
I've shopped at our local Home Depot, but here in Canada everything's been chip-and-PIN for quite some time. So... am I at risk? It's not clear from the news media whether or not the chip-and-PIN system has protected me from this breach.
I'm in Canada, and we've been using chip cards for a few years now. I just called my bank 45 minutes ago after noticing a fraudulent charge on my credit card from August 30th. Since I bought a bunch of stuff at Home Depot in May/June, I'm assuming they managed to clone my card from the stolen data. The charge was only $4.56, at a gas station halfway across the country, so I would guess that someone was testing the clone to see if it was a valid card number (maybe testing one number from a batch of 100s or 1000s, to see if the numbers were legit.)
Just so we're clear, I'm not saying the fraudulent purchase itself was made using the chip. I only ever use chip + pin when making purchases, but I suppose a cloned card could use NFC (eg: PayWay) for a purchase that small, or even just the magstripe, neither of which requires them to have compromised my pin. My point is that I thought I was being safe using chip + pin, but still got hit regardless. Fortunately, banks seem to be good about this sort of thing, and my new card is on its way.
A recursive sig
Can impart wisdom and truth
Call proc signature()
I like how the ID sign up page has a nice little form for US based people, but for Canadians we have to phone Equifax. My word, how wonderfully up to date, nothing like providing a form for people outside of the US.
If I'm already receiving monitoring from another database breach, is there a way to enqueue this monitoring so it goes in effect after that year lapses? Signs of bad systems...
These companies get cheap and higher less capable IT workers for less money and this is the result. Home Depot, this liability will cost you far more than paying for better talent in the first place.
Oh, and BTW, this is why I pay cash.
So your local cops can confiscate it?
for now on use the new APPLE PAY from your new APPLE watch and have no worries.
Availableat your APPLE store very soon.
Banks like when this happens.they can send you more correspondence.To them that means more money.
Think about it.
Otherwise they would have fixed it already.
APPLE PAY coming out later today has a solution. Look in to it.
It will also work with the new APPLE WATCH.
This will be the new way to pay securely.
> I am sure all of them could pass it if they studied for it. That is why all certifications are uselessuselessb
With enough study, you can pass the exams to be a medical doctor. That is why exams to certify that medical doctors know what they are doing are useless. Unless of course you want someone who knows about the subject at hand. I kind of want a doctor, and a security professional, who have studied their fields. Sorry you couldn't pass.
> With enough studying, almost anyone can pass it without understanding the material, just regurgitating facts.
I suppose it MIGHT be possible to do that, but that would be the hard way. Understanding the material is a lot easier than memorizing every possible question and answer.
Target offered a free year of credit monitoring after last year's breach and now this. As long as one major retailer makes the same mistake every year we'll all have free credit monitoring for life!