Slashdot Mirror
CiCi's Pizza May Have Been Hacked (krebsonsecurity.com)
An anonymous reader writes:Security expert Brian Krebs says more than half a dozen financial institutions contacted him, "all asking if I had any information about a possible credit card breach. Every one of these banking industry sources said the same thing: They'd detected a pattern of fraud on cards that all had one thing in common: They'd all been used in the last few months at various CiCi's Pizza locations... The data available so far suggests that hackers obtained access to card data at affected restaurants by posing as technical support specialists for the company's point-of-sale provider, and that multiple other retailers have been targeted by this same cybercrime gang."
The pizza chain referred Krebs to an outside firm managing their restaurants, who referred him to an outside PR firm, so he eventually just contacted the chain's point-of-sale provider, Datapoint. They confirmed that the Secret Service was investigating several different point-of-sale vendors in "one particular franchise... All of these attacks have been traced to social engineering/Team Viewer breaches because stores from several POS vendors let supposed techs in to conduct 'support'."
The pizza chain referred Krebs to an outside firm managing their restaurants, who referred him to an outside PR firm, so he eventually just contacted the chain's point-of-sale provider, Datapoint. They confirmed that the Secret Service was investigating several different point-of-sale vendors in "one particular franchise... All of these attacks have been traced to social engineering/Team Viewer breaches because stores from several POS vendors let supposed techs in to conduct 'support'."
CiCi's lost CCs.
Not surprising. Not good pizza either.
But I hand't heard they made pizza. I just though there were a cardboard tile store.
I am Slashdot. Are you Slashdot as well?
I didn't say anything when various stores, banks and social media sites were getting hacked because I knew that networked computers came a price. But now YOU DO THIS TO PIZZA?! DAMN YOU! DAMN YOU ALL TO HELL!
Anons need not reply. Questions end with a question mark.
The American Italian Anti-Defamation League issues the following statement, "You'll shutup about this if you know what's good for ya."
deserve what they get.
All of these attacks have been traced to social engineering/Team Viewer breaches because stores from several POS vendors let supposed techs in to conduct 'support'.
I can understand someone's 82-year-old grandmother being victimized by this scam, but there's no excuse for employees of a software vendor to be falling for this shit. The POS manufacturers need to get named and shamed here.
about something that "might happen" or "might have happened" lately. Isn't there enough news about stuff that definitely did happen?
Sheesh, evil *and* a jerk. -- Jade
https://en.wikipedia.org/wiki/...
I am a senior developer at a POS software company, but not the one related to this story. My take from TFA is that the criminals impersonated support folks from the POS vendor, but didn't actually compromise the vendor's network. The PCI DSS has all sorts of requirements for merchants to follow that would have prevented this. For example, the merchants should not let computers in their cardholder data environment have unfettered access to the Internet, all remote access to the CDE must be multi-factor authenticated, and vendor accounts have to be enabled on an as-needed-only basis.
This is probably a case of a criminal calling CiCi's store 2348, getting a franchisee-trained manager on the phone, and telling her "Hi, I'm from ACME POS, your POS vendor. We are calling to install updates to make the chip readers you aren't using yet work later on... and we need access to the workstation in the back of the store. Can you please open a browser and go to www.getmein.com?...". I doubt the defacing of the POS vendor's website has squat to do with it.
Of course, the franchisee is running a consumer-grade router with no outbound filtering on it whatsoever... because they are in a low-margin business and they needed something cheap. The computer died in the back about 6 months ago, so they dropped in a replacement PC from Wal-Mart and promptly disabled UAC, etc.
The manager isn't knowledgeable enough to notice that the domain he is being asked to go to is wrong, the caller ID is wrong, etc. He or she needs to worry about the 73 kids in the restaurant who are dropping pizza on the floor that the new guy isn't cleaning fast enough, the 8 pizzas on the stuck upper belt in the oven, and the bathroom with the overflowing commode. Not to mention the health inspector waiting up front. Trough-style kid's restaurants are a nightmare.
I wish POS software could be handled completely as a service and reside in a VPC managed by the POS vendor. In reality though, the Internet is just not reliable enough for that in many (most) most places, and controlling POS peripherals from a cloud app is not really feasible.
Anything that Cici's doesn't want anyone to find, should just be put in a directory called "cici's pizza recipes".
No, it's just krebs being f'n useless... as usual.
Anyone been to a Blaze pizza. Went to one in Williamsburg, Va and it was awesome for fast casual pizza. I wish they were as common as CiCi's pizza.
Fuck mushroom, fuck pepperoni, fuck crust, fuck sauce, fuck cheese, and FUCK YOU!!!!!
I thought they only accepted cash and checks. Do they accept cards?
I ate there once just to try it. Yech. If I had to choose between identity theft and eating there again, it would be a tough choice. Exactly how much would I have to eat?
It's cheap and it tastes even cheaper.
The hack was detected because the hackers altered the recipes stored on the computer. Customers and employees were shocked when actual pizzas started coming out of the oven, that's when management determined someone had hacked the system.