3 ms·

I wouldn't worry much about POS systems, they have a very small attack surface, given their limited exposure to the Internet.

by cwyers 13y ago

ceejayoz 13y ago
Target found that "very small attack surface" isn't the same as "secure".
- pixl97 13y ago
  From what I've read on Krebs site, I don't think Target understands what 'very small attack surface means'.
- cwyers 13y ago
  Target was hacked because they were flagrantly ignoring basic security procedures, like "making your POS systems available on the same network you use for everything else." [1] Blaming the Target break-in on the OS security is like having unprotected sex in the back of a Buick, and blaming GM for the STD you contracted because it would've happened if the car hadn't had such a roomy backseat. [1] http://www.computerworld.com/s/article/9246074/Target_breach_happened_because_of_a_basic_network_segmentation_error http://www.computerworld.com/s/article/9246074/Target_breach...
jdonnici 13y ago
In "Kingpin" by Kevin Poulsen [1], one of the key players made a lot of money by hacking into POS systems at "mom & pop" locations (restaurants, dry cleaners, etc). Their surface area was "just enough" - they're online in order to run credit cards and early versions of the POS software kept the card details in local files. Once he was into their system, he had access to thousands of cards... when the cards were used fraudulently, it was very difficult to know how it'd been stolen because it was via lots of small breaches that never made the news. Appropriately for this post... the POS software vendors eventually rushed to be compliant with new security standards (PCI?) and not store those details locally. But the store owners were reluctant to upgrade because the new software versions had an upgrade fee or, even when the upgrade was free, they'd have to pay thousands to their local consultant to actually perform the upgrade. [1] - http://amzn.com/0307588696 http://amzn.com/0307588696 ... Twitter-sized review: Pretty good book and it read like a technology novel at times. Will definitely get you re-thinking where/when your cards are used.

I wouldn't worry much about POS systems, they have a very small attack surface, given their limited exposure to the Internet.

by cwyers 13y ago

I wouldn't worry much about POS systems, they have a very small attack surface, given their limited exposure to the Internet.

ceejayoz 13y ago

Target found that "very small attack surface" isn't the same as "secure".

pixl97 13y ago
From what I've read on Krebs site, I don't think Target understands what 'very small attack surface means'.
cwyers 13y ago
Target was hacked because they were flagrantly ignoring basic security procedures, like "making your POS systems available on the same network you use for everything else." [1] Blaming the Target break-in on the OS security is like having unprotected sex in the back of a Buick, and blaming GM for the STD you contracted because it would've happened if the car hadn't had such a roomy backseat. [1] http://www.computerworld.com/s/article/9246074/Target_breach_happened_because_of_a_basic_network_segmentation_error http://www.computerworld.com/s/article/9246074/Target_breach...

jdonnici 13y ago

In "Kingpin" by Kevin Poulsen [1], one of the key players made a lot of money by hacking into POS systems at "mom & pop" locations (restaurants, dry cleaners, etc). Their surface area was "just enough" - they're online in order to run credit cards and early versions of the POS software kept the card details in local files. Once he was into their system, he had access to thousands of cards... when the cards were used fraudulently, it was very difficult to know how it'd been stolen because it was via lots of small breaches that never made the news. Appropriately for this post... the POS software vendors eventually rushed to be compliant with new security standards (PCI?) and not store those details locally. But the store owners were reluctant to upgrade because the new software versions had an upgrade fee or, even when the upgrade was free, they'd have to pay thousands to their local consultant to actually perform the upgrade. [1] - http://amzn.com/0307588696 http://amzn.com/0307588696 ... Twitter-sized review: Pretty good book and it read like a technology novel at times. Will definitely get you re-thinking where/when your cards are used.