Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/20/2019
03:30 PM
50%
50%

POS Vendor Announces January Data Breach

More than 120 restaurants were affected by an incident that exposed customer credit card information.

North Country Business Products, a point-of-sale terminal and network provider based in Bemidji, Minnesota, has announced a "data security incident" that impacted more than 120 of its restaurant customers located across the Midwest and West regions last month.

The company said it learned of suspicious activity on Jan. 3 and, after an investigation, found that a third party had access to restaurant customer information between Jan. 3 and Jan. 24. The information disclosed included credit card holder names and numbers, expiration dates, and CVVs.

North Country says it has corrected the issue and is in the process of notifying customers. 

Read more here.

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/25/2019 | 3:21:04 PM
Re: 'POS" Equipment
A good many retail POS devices had an embedded version of Windows XP for years and as I supported systems as an independent consultant at that time,  always wondered about the tech difference for such an operating system.  I am doing back 10 years or so.  Stores like Dress Barn come to mind.  Second weakness are third party systems such as the UPS SHIPPING STATION.  I had no idea WHO manages that one in a corp environment. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/25/2019 | 10:54:07 AM
Re: 'POS" Equipment
Drum Roll please: WINDOWS NT I hear you. I prefer POS devices have their own OS so it does not have the vulnerabilities we see on the PC OSes. POS OS could be more specialized and FW level so harder to get in.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/25/2019 | 10:51:55 AM
Re: 'POS" Equipment
Our local Kroger just upgraded POS stations to Windows 7 - about time Agree. This is the problem. Already outdated OS.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/25/2019 | 10:50:24 AM
Re: 'POS" Equipment
Because they are meant to process transactions you would think that companies would be more apt to securing them. I agree. Unfortunately they do not. Main reason is the cost but also negligence I would say.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/25/2019 | 10:48:41 AM
Re: 'POS" Equipment
They are devices that typically run older software ontop of deprecated hardware. Agree. This is a common problem with POS devices, costly to replace them with newer versions.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/25/2019 | 10:43:17 AM
POS
POS devices are critical part of overall interconnected network, it should not be this easy to have a beeach, they have not learned anything from Target obviously.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/22/2019 | 12:48:06 PM
Re: 'POS" Equipment
Our local Kroger just upgraded POS stations to Windows 7 - about time.  When I saw the boot process running before the upgrade --- ready folks?????   Drum Roll please: WINDOWS NT
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
2/21/2019 | 2:47:21 PM
'POS" Equipment
Whenever I hear "POS" my first reaction is to think of the more crude acryonym instead of Point of Sale. But from a security perspective the former "POS" acronym is in many ways still appropriate for Point of Sale. They are devices that typically run older software ontop of deprecated hardware. They are very rarely/never patched and they keeped getting knocked over by cyber criminals. Because they are meant to process transactions you would think that companies would be more apt to securing them....unfortunately I have not seen a culture change around their implementations. 
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5527
PUBLISHED: 2020-03-30
When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource co...
CVE-2020-5551
PUBLISHED: 2020-03-30
Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute an arbitrary command. The affected DCUs are installed in Lexus (LC, LS, NX, RC, RC F), TOYOTA CAMRY, and TOYOTA SIENNA manufactured in the re...
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVE-2020-6095
PUBLISHED: 2020-03-27
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.