Slashdot Mirror
Hundreds of Hotels Affected by Data Breach at Hotel Booking Software Provider (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: The personal details and payment card data of guests from hundreds of hotels, if not more, have been stolen this month by an unknown attacker, Bleeping Computer has learned. The data was taken from FastBooking, a Paris-based company that sells hotel booking software to more than 4,000 hotels in 100 countries -- as it claims on its website.
In emails the company sent out to affected hotels today, FastBooking revealed the breach took place on June 14, when an attacker used a vulnerability in an application hosted on its server to install a malicious tool (malware). This tool allowed the intruder remote access to the server, which he used to exfiltrate data. The incident came to light when FastBooking employees discovered this malicious tool on its server.
In emails the company sent out to affected hotels today, FastBooking revealed the breach took place on June 14, when an attacker used a vulnerability in an application hosted on its server to install a malicious tool (malware). This tool allowed the intruder remote access to the server, which he used to exfiltrate data. The incident came to light when FastBooking employees discovered this malicious tool on its server.
Sadly, often, devs, sysops, and devops, and the security architects, will propose good, solid solutions.
But - they are expensive and difficult to maintain. All too often, expediency gets in the way. And with security, all it takes is one hole, one door left wide open.
So, business decisions are made. Security guys go get drunk, and executives launch new and exciting products.
And when it does eventually hit the fan, no amount of documentation will prevent some poor technical sap from taking the fall.
Combine the fact that keeping the bad guys out is seen as a zero sum game - the ultimate cost center - and the above described all-too-common culture, who in their right minds wants to go into the field? And now you want to penalize the devs?
I agree that there has to be accountability. But it needs to rest with the decision makers, not the poor saps who have to follow orders or tell their spouse unemployment isn't the end of the world.
Check your premises.
... is this even possible:
In some cases, but not all, the intruder also obtained payment card details were also stolen, such as the name printed on the payment card, the card's number, and its expiration date.
Seriously. How is it possible that this data is not stored on hosts on separate, fortified networks, with decryption keys available only on other locked down machines that exist only to generate bank settlements and/or transmit billing information to the hotel as needed?
There's not enough information to verify whether what happened was truly a function of the software itself. Allow me to illustrate...
A client at work and I got into a pretty bad argument at one point. They use a hosted Citrix app to book the things they book (don't want to say the name). The client's issue was that she had trouble copy/pasting credit card numbers into the PoS software, which "she used to be able to do". I told her I was not going to fix it, because she shouldn't be storing the credit card numbers in the Citrix app. "But then the clients need to read me their credit card numbers every time!" "Yes. That's the point."
"These people pay thousands of dollars monthly; I don't want to inconvenience them and potentially use these regular clients!"
"I am pretty sure that every single one of them would prefer to do that than to have their credit card numbers live in a system that is not even remotely PCI compliant, and for which your merchant account would likely drop you if they knew you were putting all of these card numbers at risk that way, preventing you from taking their credit card at all."
"But it's fine because it's in the 'notes' section. It's not labeled 'credit card number', so if the system were hacked, nobody would know to look for them."
"If you can get your payment processor to tell me it's okay to store credit card numbers that way, not only will I fix the issue, I won't bill you for the time. Do you want me to get them on the phone, or would you rather do it?"
"No, it's fine. I'll just write them down in an Excel spreadsheet."
"You cannot retain your client's credit card numbers in any form and retain your PCI compliance. Period. If your computer gets hacked and the hackers take that file, I guarantee you that the best case scenario is that you have lost every one of those clients, permanently, with the worst case involving multiple lawsuits. Moreover, the only reason you won't lose them beforehand is because I sincerely doubt they're giving it to you knowing that you have every intention of storing it in a very insecure manner. I know it's a pain, but the extra 30 seconds it will take them each order is preferable to every one of them than disputing credit card fraud. For the sake of your clients and the sake of your business, you *must* stop storing credit card numbers on your system, at all, period, full stop. Feel free to have the owner come out and discuss it with me, I will make the same case to him."
"...okay, fine."
The user was entering credit card numbers where they weren't supposed to, and the software wasn't smart enough to detect a credit card number in a generic 'notes' field. While it's entirely possible the booking software was poorly written, it's equally possible that it was being used in a way where the end users were intentionally making end runs around safety mechanisms.
Individual end users can generally be trained. In aggregate, they will take convenience over security 10 out of 10 times. If they don't, they're not end users, they're infosec.