Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

9/25/2014
07:20 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Breached Retailers Harden PoS, For Now

Yet another point-of-sale (POS) breach at a major retail chain, and the victim adds encryption.

This time, it was the gourmet sandwich-maker with freakishly fast delivery standards that was late discovering that point-of-sale systems in more than 200 of its stores had been infiltrated with malware that swallowed its customer payment card information.

Jimmy John's, like other major US retailers before it such as Home Depot and Goodwill Industries, fell victim to cyber criminals, who literally followed the money and nabbed the necessary log-in credentials from their point-of-sale-system vendors that customers use to scan their debit and credit cards when they purchase their subs, home improvement project materials, or secondhand clothing. Like Home Depot and Goodwill -- and Target -- Jimmy John's said it has since cleaned up the malware and added encryption to its PoS systems so bad guys can't read the card data when it gets swiped at the register.

The underlying problem with the majority of payment cards issued in the US, of course, is the magnetic stripe on them that stores the sensitive customer and account number information that the crooks crave and have been so easily been able to grab when it hits the RAM of the devices. Calls for chip-and-PIN technology, where smart cards with embedded microchips authenticate the user's identity, have intensified in the US retail industry and consumer world, but the conversion will take time. So in the meantime, Jimmy John's and other retailers are adding encryption to lock down their POS systems, and some retailers are expediting the rollout of chip-and-PIN payment cards as well.

Home Depot, for instance, added Voltage Security encryption products to its POS system, and plans to provide chip-and-PIN payment technology in the US by the year's end. Chip-and-pin is already used in its stores in Canada. Target's REDcards will all be chip-and-PIN-based starting early next year.

"These attacks highlight the need for chip-and-PIN. If the attractiveness of POS malware comes from the fact that stolen card data is easily used to duplicate cards, chip-and-PIN is the answer," says Allie Brandenburger, a spokesperson for the Retail Industry Leaders Association (RILA), which boasts Target among its members.

Retailers are considering several best-practices for locking down payment card data, she says. End-to-end encryption is one, she says. "This makes it significantly more difficult for things like network sniffing tools to pick up the numbers in transit.  Additionally, encrypting data stored on the POS system is another thing to do," she says. "Tokenization is another good step because this makes the number stored in the system worthless." 

Steven Adair, founder and CEO of the IR firm Volexity LLC, says PoS systems obviously should not have Internet access, and any outbound movement should be on a whitelist. "Having them locked down and monitored as close as possible would probably be prudent as well. These machines should essentially be small fortresses. It should be very difficult to have software installed on them," Adair says.

According to one retail trade association representative, the wave of payment card breaches is its top priority. "Everybody wants to protect their brand and their customers," says the representative, who requested anonymity. Aside from encryption, retailers are finding they have to also change default passwords from POS System vendors. On the horizon is the tokenization of some sensitive data, as well as the next-generation chip & PIN cards.

"We're tasked with protecting 40-year-old technology" today, says the retail representative, referring to magnetic stripe-based cards.

Aviv Raff, CTO at Seculert, says it's taking retailers far too long to discover the POS malware. "In all the recent breaches, it's amazing to see how long attackers have been able to stay under the radar before being revealed," Raff says. "More and more enterprises need to shift their mindset and know they probably already have been compromised, and shift their budget from trying to prevent attacks to trying to detect something in their network. The retailers keep waiting for someone to knock on their door" and tell them they've been breached, he says.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
9/29/2014 | 8:13:49 AM
Re: Please people - EMV is not a silver bullet
AAPL is taking this 1 step further in the right direction with Apple Pay: the phone does not transmit the customer's accont number to the merchant.    EMV still does, although it also requires a 1-time use authorization code,-- which -- theoretically -- you need the original card to generate.

you can't steal what isn't there -- and thus Apple's aporoach is and even better step

the underlying problem remains though

we keep attacking encryption and passwords when the actual problem is AUTHENTICATION particularly of softwtwware updates.

by this time we all know: if your phone is hacked -- the hacker will likely have access to your payments mechanism -- if you have one on a "smart" phone

sometimes i wonder just how "smart" these gadgets are...
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
9/26/2014 | 1:56:17 PM
Re: Please people - EMV is not a silver bullet
We here in Canada are huge proponents of Chip and PIN technology, mostly because in the grand scheme of things we are pretty much a heavy electronic currency-based country. But to see that many retailers do not use encryption on their POS is so mind baffling to me.  The problem is that while so many organizations are still scratching their heads around PCI, they forget that one of the biggest baby steps to start with is to encrypt their sensitive information, primarily card information.  I think the industry could do more to really push retailers to comply and educate them on the importance of encryption, especially at the POS level.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/26/2014 | 12:48:17 PM
Re: Please people - EMV is not a silver bullet
Good points, @hhendrickson274. EMV is definitely not a silver bullet. But the data does show that it's much better than our existing payment card technology at least at the point of sale. 
hhendrickson274
50%
50%
hhendrickson274,
User Rank: Strategist
9/26/2014 | 12:45:03 PM
Please people - EMV is not a silver bullet
I take serious excetion to the comment in the story about EMV (chip-n-pin) making stolen card data worthless.  EMV doesn't work on the Internet, so all Internet transactions will still be "card not present" transactions.  So the number and CVV will still be very valuable for Internet based fraud.  That and EMV implementation have already proven to be far from secure.  Don't get me wrong, I'm all for EMV adoption in the US, but as long as the press and the analyst pundits keep telling everying that EMV will solve all the ills of POS (in)security, they are doing a major disservice to us all, especially those in retail that are trying hard to secure their environments from compromise.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/26/2014 | 11:15:56 AM
Re: PoS-Negative Reinforcement
Good question, Ryan. They are definitely not going to get anywhere by "waiting for someone to knock on their door" and tell them they've been breached," as Seculert's Aviv Raff noted in the story.

 

 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/26/2014 | 9:35:00 AM
Re: PoS-Negative Reinforcement
Very true. Are there methods by which smaller organizations can effectively discover there network health at low cost? Maybe a baseline analyzer for the PoS systems.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/26/2014 | 9:16:14 AM
Re: PoS-Negative Reinforcement
I am sure there are plenty more breached retailers in the pipeline who we will be hearing from. But what's more scary are the smaller ones who have no clue and may never find out.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/26/2014 | 8:53:07 AM
PoS-Negative Reinforcement
Its good to hear that retailers are starting to take these breaches seriously. It is unfortunate that most are the result of negative reinforcement. If these breaches had not happened would many of these companies be pushing for stricter security standards? If the stove never burns you why not touch it?

A positive from this is that retailers that have not been breached are starting to increase their security measures and more organizations need to follow suit. Like the saying goes, a smart person learns from his or her own mistakes but a brilliant one learns from others.
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
AWS CISO Talks Risk Reduction, Development, Recruitment
Kelly Sheridan, Staff Editor, Dark Reading,  6/25/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1619
PUBLISHED: 2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper session ...
CVE-2019-1620
PUBLISHED: 2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in affected DCNM software. An attacker could ex...
CVE-2019-1621
PUBLISHED: 2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settings on affected DCNM software. An attacker...
CVE-2019-1622
PUBLISHED: 2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM software...
CVE-2019-10133
PUBLISHED: 2019-06-26
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.