6 ms·

Credit card data of 40 million shoppers stolen from Target stores

42 points by ibsathish 13y ago

yeukhon 13y ago
Probably another SQLInjection which installs malware on the network; most of them just happened that way.
sigsergv 13y ago
How they obtain security code (cvv, am I right) from swiping card data? It's not stored on magnetic tape.
- yeukhon 13y ago
  Most of them require you to enter the CVV code. A lot of online stores will ask you to provide that code as well.
  - sigsergv 13y ago
    Do “swipe” terminals require CVV? Also there mentioned: “The data breach did not affect online purchases, the company said.”
    - yeukhon 13y ago
      Oh I took that part for granted. Sorry. I don't know how it is implemented, and this source is not a scholar paper, but worth looking. http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-demystifying-credit-card-data-12/ http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-... > Swipe transaction are perhaps easiest to describe. The data encoded on the magnetic stripe is static, formatted according to ISO7813 in three tracks, with the third one typically unused. One of the fields in this track layout is the Card Validation Code (CVC) or CVC1. which serves as a cryptographic integrity check on the track contents. I think that makes sense from someone who doesn't understand how the security of credit card works. But if online purchase requires one to give up the cvv code, then verifying a physical card would also require one to be able to read that code.
      - sigsergv 13y ago
        Back side of the card contains CVV2 code, I'm pretty sure that it's not recorded on magnetic tape. Probably, in the original article should be mentioned that difference.
        jon-wood 13y ago
        The CVV2 is intentionally not stored on the card to make shopping online or over the phone with a skimmed card more difficult. If Target has the CVV2 included in this data dump they're in for a whole world of hurt from the credit card companies since storing that number for any longer than it takes to verify a transaction is utterly forbidden.
        unclebucknasty 13y ago
        I was thinking the same: why would they store the CVV2 data? Makes me wonder if they were keying it for verification and the fraudsters were somehow intercepting the traffic in real-time.
        pionar 13y ago
        They would not be storing the CVV2, as they would not collect that at POS (and if someone does ask you for that when you swipe your card, be very suspicious). It's the CVV1 that they've stored, which is still utterly forbidden by the PCI standards.
- ftwinnovations 13y ago
  The scary part is that they were storing the cvv code at all, which is a glaring violation of PCI compliance. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...
deleted 13y ago
[deleted]
coin 13y ago
Another reason not to use debit cards. With credit cards it's the bank's money, not yours that is gone.
- deleted 13y ago
  [deleted]
AmVess 13y ago
From the article: "Q: How did the breach occur? A: Target isn't saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming." The article starts out by stating, "The stolen data includes customer names, credit and debit card numbers, card expiration dates and the three-digit security codes located on the backs of cards." I guess, then, that the 'millions' spent budget didn't include basic compliance measures. Next time, Target might as well take out an ad in the NYT with all this info, though....It'd be less effective than what's already happened to them. Idgits.
- tehwebguy 13y ago
  From Target's notification email: > Is the CVV code the same as the three digit code on the back of my card? > No, the CVV code is not the same as the security code on the back of your card. As of now we have no indication that the three digit code on the back of the card has been impacted. I am under the impression that: 1. CVV is exactly the same as the security code 2. Merchants are never allowed to store this code
  - phantom784 13y ago
    There are two CVV codes, CVV1 and CVV2. CVV1 is on the magstripe but not printed on the card. CVV2 is printed on the card but not on the magstripe (it's the three digit code printed on the back). It sounds like Target was storing the CVV1 code (which they shouldn't have been), but there's no way they could have the CVV2 code, since the POS computer never sees it. This means that the stolen data could be used to make a cloned card for physical purchases, but couldn't be used for an online purchase (unless the online store doesn't ask for the CVV2). See http://en.wikipedia.org/wiki/Card_Verification_Value http://en.wikipedia.org/wiki/Card_Verification_Value
    - mirkules 13y ago
      If the POS terminals were compromised, attackers could have retrieved CCV1 numbers at the point of reading the card. In other words, it's still possible Target complied with the PCI requirement of not storing CCV numbers. But since nobody knows how the attack happened, it's all just speculation.
coin 13y ago
-1 for Yahoo disabling pinchzoom on mobile devices. Why do they do this?
ColinWright 13y ago
I've seen it suggested that the breach occurred through malware installed in the POS (that's point-of-sale, not piece-of-shellgrit) devices: http://www.businessinsider.com/target-credit-card-hackers-2013-12 http://www.businessinsider.com/target-credit-card-hackers-20... On HN the main discussion is here: https://news.ycombinator.com/item?id=6934248 https://news.ycombinator.com/item?id=6934248 (cbc.ca) (66 comments and counting) Another discussion: https://news.ycombinator.com/item?id=6930258 https://news.ycombinator.com/item?id=6930258 (krebsonsecurity.com) (8 comments) Other submissions: https://news.ycombinator.com/item?id=6935413 https://news.ycombinator.com/item?id=6935413 (boingboing.net) https://news.ycombinator.com/item?id=6935142 https://news.ycombinator.com/item?id=6935142 (cnn.com) https://news.ycombinator.com/item?id=6934595 https://news.ycombinator.com/item?id=6934595 (target.com) https://news.ycombinator.com/item?id=6934535 https://news.ycombinator.com/item?id=6934535 (securityweek.com) https://news.ycombinator.com/item?id=6934216 https://news.ycombinator.com/item?id=6934216 (wsj.com) https://news.ycombinator.com/item?id=6934038 https://news.ycombinator.com/item?id=6934038 (rt.com) https://news.ycombinator.com/item?id=6933163 https://news.ycombinator.com/item?id=6933163 (chicagotribune.com) https://news.ycombinator.com/item?id=6932782 https://news.ycombinator.com/item?id=6932782 (usatoday.com) https://news.ycombinator.com/item?id=6932186 https://news.ycombinator.com/item?id=6932186 (arstechnica.com) https://news.ycombinator.com/item?id=6932141 https://news.ycombinator.com/item?id=6932141 (theverge.com)
unclebucknasty 13y ago
It bugs me when these guys just offer the advice to go back and check your statement for suspicious activity. When 40 million cards are stolen, it's not as if the thief/thieves are going on a personal buying spree. They obviously intend to sell the cards on the black market. So, their advice to not replace cards is irresponsible and literally helps the thieves to comfirm to potential buyers that the cards are likely still good. And, of course, once your card is exposed you're always at risk of future fraud. Are we all just supposed to be paranoid now (moreso than usual, that is)?

42 points by ibsathish 13y ago

yeukhon 13y ago

Probably another SQLInjection which installs malware on the network; most of them just happened that way.

sigsergv 13y ago

How they obtain security code (cvv, am I right) from swiping card data? It's not stored on magnetic tape.

yeukhon 13y ago
Most of them require you to enter the CVV code. A lot of online stores will ask you to provide that code as well.
- sigsergv 13y ago
  Do “swipe” terminals require CVV? Also there mentioned: “The data breach did not affect online purchases, the company said.”
  - yeukhon 13y ago
    Oh I took that part for granted. Sorry. I don't know how it is implemented, and this source is not a scholar paper, but worth looking. http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-demystifying-credit-card-data-12/ http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-... > Swipe transaction are perhaps easiest to describe. The data encoded on the magnetic stripe is static, formatted according to ISO7813 in three tracks, with the third one typically unused. One of the fields in this track layout is the Card Validation Code (CVC) or CVC1. which serves as a cryptographic integrity check on the track contents. I think that makes sense from someone who doesn't understand how the security of credit card works. But if online purchase requires one to give up the cvv code, then verifying a physical card would also require one to be able to read that code.
    - sigsergv 13y ago
      Back side of the card contains CVV2 code, I'm pretty sure that it's not recorded on magnetic tape. Probably, in the original article should be mentioned that difference.
      - jon-wood 13y ago
        The CVV2 is intentionally not stored on the card to make shopping online or over the phone with a skimmed card more difficult. If Target has the CVV2 included in this data dump they're in for a whole world of hurt from the credit card companies since storing that number for any longer than it takes to verify a transaction is utterly forbidden.
        unclebucknasty 13y ago
        I was thinking the same: why would they store the CVV2 data? Makes me wonder if they were keying it for verification and the fraudsters were somehow intercepting the traffic in real-time.
        pionar 13y ago
        They would not be storing the CVV2, as they would not collect that at POS (and if someone does ask you for that when you swipe your card, be very suspicious). It's the CVV1 that they've stored, which is still utterly forbidden by the PCI standards.
ftwinnovations 13y ago
The scary part is that they were storing the cvv code at all, which is a glaring violation of PCI compliance. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...

deleted 13y ago

[deleted]

coin 13y ago

Another reason not to use debit cards. With credit cards it's the bank's money, not yours that is gone.

deleted 13y ago
[deleted]

AmVess 13y ago

From the article: "Q: How did the breach occur? A: Target isn't saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming." The article starts out by stating, "The stolen data includes customer names, credit and debit card numbers, card expiration dates and the three-digit security codes located on the backs of cards." I guess, then, that the 'millions' spent budget didn't include basic compliance measures. Next time, Target might as well take out an ad in the NYT with all this info, though....It'd be less effective than what's already happened to them. Idgits.

tehwebguy 13y ago
From Target's notification email: > Is the CVV code the same as the three digit code on the back of my card? > No, the CVV code is not the same as the security code on the back of your card. As of now we have no indication that the three digit code on the back of the card has been impacted. I am under the impression that: 1. CVV is exactly the same as the security code 2. Merchants are never allowed to store this code
- phantom784 13y ago
  There are two CVV codes, CVV1 and CVV2. CVV1 is on the magstripe but not printed on the card. CVV2 is printed on the card but not on the magstripe (it's the three digit code printed on the back). It sounds like Target was storing the CVV1 code (which they shouldn't have been), but there's no way they could have the CVV2 code, since the POS computer never sees it. This means that the stolen data could be used to make a cloned card for physical purchases, but couldn't be used for an online purchase (unless the online store doesn't ask for the CVV2). See http://en.wikipedia.org/wiki/Card_Verification_Value http://en.wikipedia.org/wiki/Card_Verification_Value
  - mirkules 13y ago
    If the POS terminals were compromised, attackers could have retrieved CCV1 numbers at the point of reading the card. In other words, it's still possible Target complied with the PCI requirement of not storing CCV numbers. But since nobody knows how the attack happened, it's all just speculation.

coin 13y ago

-1 for Yahoo disabling pinchzoom on mobile devices. Why do they do this?

ColinWright 13y ago

I've seen it suggested that the breach occurred through malware installed in the POS (that's point-of-sale, not piece-of-shellgrit) devices: http://www.businessinsider.com/target-credit-card-hackers-2013-12 http://www.businessinsider.com/target-credit-card-hackers-20... On HN the main discussion is here: https://news.ycombinator.com/item?id=6934248 https://news.ycombinator.com/item?id=6934248 (cbc.ca) (66 comments and counting) Another discussion: https://news.ycombinator.com/item?id=6930258 https://news.ycombinator.com/item?id=6930258 (krebsonsecurity.com) (8 comments) Other submissions: https://news.ycombinator.com/item?id=6935413 https://news.ycombinator.com/item?id=6935413 (boingboing.net) https://news.ycombinator.com/item?id=6935142 https://news.ycombinator.com/item?id=6935142 (cnn.com) https://news.ycombinator.com/item?id=6934595 https://news.ycombinator.com/item?id=6934595 (target.com) https://news.ycombinator.com/item?id=6934535 https://news.ycombinator.com/item?id=6934535 (securityweek.com) https://news.ycombinator.com/item?id=6934216 https://news.ycombinator.com/item?id=6934216 (wsj.com) https://news.ycombinator.com/item?id=6934038 https://news.ycombinator.com/item?id=6934038 (rt.com) https://news.ycombinator.com/item?id=6933163 https://news.ycombinator.com/item?id=6933163 (chicagotribune.com) https://news.ycombinator.com/item?id=6932782 https://news.ycombinator.com/item?id=6932782 (usatoday.com) https://news.ycombinator.com/item?id=6932186 https://news.ycombinator.com/item?id=6932186 (arstechnica.com) https://news.ycombinator.com/item?id=6932141 https://news.ycombinator.com/item?id=6932141 (theverge.com)

unclebucknasty 13y ago

It bugs me when these guys just offer the advice to go back and check your statement for suspicious activity. When 40 million cards are stolen, it's not as if the thief/thieves are going on a personal buying spree. They obviously intend to sell the cards on the black market. So, their advice to not replace cards is irresponsible and literally helps the thieves to comfirm to potential buyers that the cards are likely still good. And, of course, once your card is exposed you're always at risk of future fraud. Are we all just supposed to be paranoid now (moreso than usual, that is)?