4 ms·

Delta: Data of ‘several hundred thousand’ customers exposed

10 points by kdazzle 9y ago

jimktrains2 9y ago
http://time.com/5230288/delta-sears-data-breach-credit-cards/ http://time.com/5230288/delta-sears-data-breach-credit-cards... "Hackers may have accessed names, addresses, credit card numbers, CVV numbers and expiration dates for “several hundred thousand” customers during that time, according to the airline." You're 100% not allowed to save CVVs. I really hope this is just bad reporting and not true. In fact, I think you're even supposed to scrub CVVs from call center recordings!
- dx034 9y ago
  I recently had to give my CVV to a call centre and they paused recording for that part. Probably more reliable than trying to scrub it afterwards.
- jimktrains2 9y ago
  Edit: It appears it might be an issue with 3rd party JS on their website, not being stored.
- craftyguy 9y ago
  Why are CVVs, a 3 digit number that would be trivial to brute force, the key to unlocking access to a user's credit? Why don't we start with that problem first?
  - mrguyorama 9y ago
    AFAIU, you cannot check whether a CVV is correct without pinging the company that manages the card, and attempting to ping them on average 500 times per card with different CVVs is not normal activity and should be blocked/shut down. This is CC fraud prevention 101
    - craftyguy 9y ago
      Ok, how about the fact that it's incredibly visible to begin with? It's being used like a PIN, a PIN that's literally printed right on the card. Who writes their debit card PIN on the back of their card?
      - dragonwriter 9y ago
        It supposed to be used as proof that you have physical control of the card, which is why it is on the card and not supposed to be stored. It's not used “like a PIN” as a second factor with the physical card as the first factor, it is used to make online and certain other uses of a card equivalent to card-present transactions with no substantive second factor.
guitarbill 9y ago
> The software company said it discovered and fixed the breach in October. Disgusting, how was this buried for 6 months? > The Atlanta-based airline said that it wasn’t sure whether customers’ information was actually compromised by malware that it believes was in software used by (24)7.ai, which provided the airline with online chat services for customers, for about two weeks. Your website, your liability. This is Delta's fault. By letting third-party Javascript execute on your webpage, that's basically a remote code execution right there. That's like giving an outside company root on your database, or domain controller. Maybe this will serve as a wake-up call for web devs, instead of piling more and more terrible JS onto a page.

10 points by kdazzle 9y ago

http://time.com/5230288/delta-sears-data-breach-credit-cards/ http://time.com/5230288/delta-sears-data-breach-credit-cards... "Hackers may have accessed names, addresses, credit card numbers, CVV numbers and expiration dates for “several hundred thousand” customers during that time, according to the airline." You're 100% not allowed to save CVVs. I really hope this is just bad reporting and not true. In fact, I think you're even supposed to scrub CVVs from call center recordings!

dx034 9y ago
I recently had to give my CVV to a call centre and they paused recording for that part. Probably more reliable than trying to scrub it afterwards.
jimktrains2 9y ago
Edit: It appears it might be an issue with 3rd party JS on their website, not being stored.
craftyguy 9y ago
Why are CVVs, a 3 digit number that would be trivial to brute force, the key to unlocking access to a user's credit? Why don't we start with that problem first?
- mrguyorama 9y ago
  AFAIU, you cannot check whether a CVV is correct without pinging the company that manages the card, and attempting to ping them on average 500 times per card with different CVVs is not normal activity and should be blocked/shut down. This is CC fraud prevention 101
  - craftyguy 9y ago
    Ok, how about the fact that it's incredibly visible to begin with? It's being used like a PIN, a PIN that's literally printed right on the card. Who writes their debit card PIN on the back of their card?
    - dragonwriter 9y ago
      It supposed to be used as proof that you have physical control of the card, which is why it is on the card and not supposed to be stored. It's not used “like a PIN” as a second factor with the physical card as the first factor, it is used to make online and certain other uses of a card equivalent to card-present transactions with no substantive second factor.

guitarbill 9y ago

> The software company said it discovered and fixed the breach in October. Disgusting, how was this buried for 6 months? > The Atlanta-based airline said that it wasn’t sure whether customers’ information was actually compromised by malware that it believes was in software used by (24)7.ai, which provided the airline with online chat services for customers, for about two weeks. Your website, your liability. This is Delta's fault. By letting third-party Javascript execute on your webpage, that's basically a remote code execution right there. That's like giving an outside company root on your database, or domain controller. Maybe this will serve as a wake-up call for web devs, instead of piling more and more terrible JS onto a page.