3 ms·

My wife shopped at Target twice, both times outside of the period given for the breach. I think we are still going to get the cards replaced just to err on the

My wife shopped at Target twice, both times outside of the period given for the breach. I think we are still going to get the cards replaced just to err on the side of prudence. I find myself wondering how this might affect Target. I almost never shop there myself. My wife, on the other hand, might have shopped there once a month or once every couple of months. Yesterday she told me she is not going back. Ever. There have to be other people on the same boat. It'll be interesting if they ever release information on how exactly the breach was orchestrated. My biggest question is about all of that data moving about Target's distributed system without any encryption whatsoever. At least that's what it sounds like. The data capture had to be done at some central point in their infrastructure in order to affect some 1,800 stores. Again, all of that data from 1,800 stores got to a central repository of some sort completely unprotected? Why isn't that information stored and limited to the within the walls of each store? It'd sure limit the exposure, well, a factor of 2,000. Anything leaving the walls of a store needs to be encrypted. Perhaps someone with more experience in brick-and-mortar payment infrastructures of this kind can comment on this?

Duhck 13y ago
At the very least, I believe they are responsible for paying the credit card companies to replace the stolen cards. I can't find my source on this, but I do remember a few times that a retailer was held fiscally responsible for new card distribution.
r00fus 13y ago
People will go back. They may make promises, but then find justifications to soften their resolve. It happens every day. Target is just too large to really be impacted in the long run - however it's going to have a nice impact on their current holiday season.
toast0 13y ago
My guess is that they run all the stores through a centralized payment system. Encrypted in transit or not, the payment system needs the details in plain text to send to the payment processor. At or near the payment processing is where the information was likely copied. The information can't only stay within the store, because purchases from one Target may be returned at any Target, and they may look up receipts by credit card used. At Target's scale, it makes more sense to do a centralized lookup (or local + centralized), rather than a query to every store.
meowface 13y ago
It's likely (mandatory, even) that all of that information travelled encrypted while being processed. The likely scenario in this case is that Target uses a central hub for credit card processing, so there is probably at least one server that briefly looks at all of that credit card info. And if an attacker is able to install malware on one or more of those servers, they'll be able to silently record all of the card data as it comes in; even if it's completely encrypted to and from the server, the server itself will need to at least briefly have an unencrypted version of it in memory. Basically, scenarios like this generally only happen in a deeply intrusive breach.

Duhck 13y ago

At the very least, I believe they are responsible for paying the credit card companies to replace the stolen cards. I can't find my source on this, but I do remember a few times that a retailer was held fiscally responsible for new card distribution.

r00fus 13y ago

People will go back. They may make promises, but then find justifications to soften their resolve. It happens every day. Target is just too large to really be impacted in the long run - however it's going to have a nice impact on their current holiday season.

toast0 13y ago

My guess is that they run all the stores through a centralized payment system. Encrypted in transit or not, the payment system needs the details in plain text to send to the payment processor. At or near the payment processing is where the information was likely copied. The information can't only stay within the store, because purchases from one Target may be returned at any Target, and they may look up receipts by credit card used. At Target's scale, it makes more sense to do a centralized lookup (or local + centralized), rather than a query to every store.

meowface 13y ago

It's likely (mandatory, even) that all of that information travelled encrypted while being processed. The likely scenario in this case is that Target uses a central hub for credit card processing, so there is probably at least one server that briefly looks at all of that credit card info. And if an attacker is able to install malware on one or more of those servers, they'll be able to silently record all of the card data as it comes in; even if it's completely encrypted to and from the server, the server itself will need to at least briefly have an unencrypted version of it in memory. Basically, scenarios like this generally only happen in a deeply intrusive breach.