4 ms·

Swiper skimming might be an issue as well, but didn't some of the largest breaches include stored credit card data? Washington Post says credit and debit card i

by vcarl 11y ago

Swiper skimming might be an issue as well, but didn't some of the largest breaches include stored credit card data? Washington Post says credit and debit card information was included in the Target breach. https://www.washingtonpost.com/business/economy/target-says-70-million-customers-were-hit-by-dec-data-breach-more-than-first-reported/2014/01/10/0ada1026-79fe-11e3-8963-b4b654bcc9b2_story.html https://www.washingtonpost.com/business/economy/target-says-...

Someone1234 11y ago
I said nothing about swiper skimming. What I said was: > What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow). Which is accurate: > The apparent credit and debit card breach uncovered last week at Home Depot was aided in part by a new variant of the malicious software program that stole card account data from cash registers at Target last December, according to sources close to the investigation. So malware was intercepting the raw CC information inside the card terminal on its way to the payment processor upstream. This allowed them to remotely infect every single Target store in the country, and steal information without setting foot there. http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/ http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-ma...
- vcarl 11y ago
  Ah, the distinction being that it wasn't stolen in a single bulk breach or via a device placed between the card and the scanner. Fair enough.
  - jlgaddis 11y ago
    Yep, lots of these point-of-sale machines are (still!) running XP Embedded which is, AIUI, pretty heavily targeted. Apparently -- but not surprisingly -- they aren't updated all that much so they're pretty susceptible to being compromised.

by vcarl 11y ago

Someone1234 11y ago

I said nothing about swiper skimming. What I said was: > What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow). Which is accurate: > The apparent credit and debit card breach uncovered last week at Home Depot was aided in part by a new variant of the malicious software program that stole card account data from cash registers at Target last December, according to sources close to the investigation. So malware was intercepting the raw CC information inside the card terminal on its way to the payment processor upstream. This allowed them to remotely infect every single Target store in the country, and steal information without setting foot there. http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/ http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-ma...

vcarl 11y ago
Ah, the distinction being that it wasn't stolen in a single bulk breach or via a device placed between the card and the scanner. Fair enough.
- jlgaddis 11y ago
  Yep, lots of these point-of-sale machines are (still!) running XP Embedded which is, AIUI, pretty heavily targeted. Apparently -- but not surprisingly -- they aren't updated all that much so they're pretty susceptible to being compromised.