Slashdot Log In
Largest Data Breach Disclosed During Inauguration
Posted by
kdawson
on Tue Jan 20, 2009 02:44 PM
from the debit-cards-at-risk dept.
from the debit-cards-at-risk dept.
rmogull writes "Brian Krebs over at the Washington Post just published a story that Heartland Payment Systems disclosed what may be the largest data breach in history. Today. During the inauguration. Heartland processes over 100 million transactions a month, mostly from small to medium-sized businesses, and doesn't know how many cards were compromised. The breach was discovered after tracing fraud in the system back to Heartland, and involved malicious software snooping their internal network. I've written some additional analysis on this and similar breaches. It's interesting that the biggest breaches now involve attacks installing malicious software to sniff data — including TJX, Hannaford, Cardsystems, and now Heartland Payment Systems." One bit of good news out of this massive breach is that, according to Heartland's CFO, "The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address." Heartland just put up a press release on the breach.
Related Stories
[+]
Visa Says No New Processor Breach After All 38 comments
Buzz has been building for the last week about what might be a new data breach at a credit-card processor. No, not Heartland, a different one. Now Computerworld is reporting that Visa claims there was no new breach. Whom to believe? "In actuality, Visa said in a statement issued today, alerts that it recently sent to banks and credit unions warning them about a compromise at a payment processor were related to the ongoing investigation of a previously known breach. However, Visa still didn't disclose the identity of the breached company, nor did it say why it is continuing to keep the name under wraps."
[+]
Three Indicted In Huge Identity/Data Breach 101 comments
ScentCone and other readers let us know about an indictment just unsealed in federal court for stealing 130 million credit cards and other data useful in identity theft, or just plain money theft. The breaches were at payment processor Heartland (accounting for the bulk of the 130M), Hannaford, 7-11, and two unnamed "national retailers." Interestingly, the focus of the indictment, Albert "Segvec" Gonzalez, is currently awaiting trial for masterminding the TJX break-in, which until Heartland counted as the largest credit-card theft ever. The indictment cites SQL injection attacks as the entry vector. Two unnamed Russia-based conspirators were also indicted. Securosis has analysis of the security implications of the breach ("These appear to be preventable attacks using common security controls. It's possible some advanced techniques were used, but I doubt it") and the attackers' methodology.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Suckers (Score:5, Funny)
Re: (Score:3, Funny)
Neither do I. Unless I'm posing as you.
Missing Address (Score:5, Insightful)
"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address," Baldwin said.
Because as we all know it is impossible to get someone's address by having only their full name and credit card number.
They are trying to down play a very serious incident by disclosing the breach on a day heavily focused on the inauguration. Then they have the nerve to say "don't worry they didn't get your address" as if to say someone smart enough to embed malicious software which gathers credit card numbers is not smart enough to find someone's address. Common!
Re:Missing Address (Score:5, Informative)
Let's also not overlook that while some stores/merchants may have a policy to ask for address when doing Cardless Transactions, the processing houses (at least the ones I've used) will more than happily process the transaction successfully without anything more than the card number and the expiration date.
Some processors will refuse to process transactions within the month that the card expires, but you simply add 4 years to the date and it'll go through just fine.
The Credit Card companies have pushed very hard and very long to make credit transactions more painless than cash. You have to drop some safeguards to do that though.
Parent
Re:Missing Address (Score:4, Funny)
Hmmm...B.H. Obama. Jeffery, get out the phone book. We need to determine where this guy lives.
Parent
It's a blog post! (Score:2)
The guy posted to his blog about it. On the same day as the inauguration.
Seriously, the tone of the summary is dumb as fuck. The press release is from today, as is the blog post. It's not even a fucking newspaper article.
Re: (Score:2)
Did he? I would RTFA, but I've given up trying to read white-on-black web pages. Seriously, whoever thought that dense white text on a black background is easily readable?
I'll agree that it is a little more readable on LCD monitors than it was on slightly old CRT monitors, but it still isn't easily readable.
what the bad guys didn't steal (Score:5, Informative)
"Actually quite difficult"? (Score:3, Informative)
The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address.
Because we all know that it's impossible to spoof the magnetic strip on the credit card.
This is why CC zero-liability is a good thing. (Score:2)
When stuff like this happens, it is not the consumers who end up paying, but Visa / MC - who end up putting pressure on these guys to get their act together.
Re:This is why CC zero-liability is a good thing. (Score:5, Informative)
Some clueless person says this every time there is a story on credit cards.
Visa/MC do not end up paying. Merchants on the receiving end of fraudulent transactions do. Visa/MC may even profit from it as the fees they charge merchants for chargebacks can be quite steep.
Parent
Re: (Score:2)
Re: (Score:3, Informative)
Save that Visa and Mastercard rules prohibit the merchant from validating the identity of the person using the credit card. For instance, a merchant is prohibited from requiring the customer to present ID (such as a driver's license) before they'll take the card. If a merchant refuses to take cards without identification, Visa/MC will terminate their merchant account.
Re: (Score:3, Informative)
who pays for security ? (Score:2)
It's the consumers who pay for it with higher charges to pay for things like the chip-and-pin upgrade. Similar to how the consumers pay for shop-lifting
solution to CC breeches .. (Score:5, Insightful)
Re: (Score:2)
Please mod parent up. I have mod points, but posted elsewhere. Having just gone through PCI compliance (which is frankly a joke), there needs to be a better system out there.
why were they even (Score:2)
Re:why were they even (Score:5, Informative)
Because they are the ones processing the transactions. We don't use heartland, but when take online orders through our website, we don't store the credit card information, our CC Processor does. The processors are the one that actually run the transactions, take money from the customers account, take a percentage, then deposit to the merchants account. And they have to keep records of all that.
In order for CC payment to work someone has to store that data somewhere.
Parent
Re: (Score:3, Informative)
I don't think they were necessarily storing it, from the press release. To me, it basically says a network sniffer picked up network traffic on the wire. That can happen whether you store the info or not.
Card not present transactions (Score:2, Informative)
This is BS. Anyone with a card terminal can key the number in, or the card could be cloned. I discovered that FIA categorizes keying the number into the terminal as a "card present" transaction, when I tried to dispute an unrecognized charge. They then use this as a reason that the charge was legitimate, even when the card was not in fact present.
First in a long line of discoveries to come (Score:5, Interesting)
Those who claim to be perfect but never admit mistakes usually are covering up for massive mistakes.
And the missing million emails we know of are just the observable symptom, as are the transactions in this health data breach.
The old truisms of data security still apply:
1. It's usually insiders that provided or passed on information used to get access.
2. Those who cover up problems only create even larger problems, due to the system of trust.
3. You can stop 99 percent of attacks with reasonable security measures, but a determined attacker willing to use human intelligence methods will almost always get through the other 1 percent - the trick is knowing what measures will dissuade the 99 percent and implement those, and use reporting to discover the other 1 percent instead of measures that will be defeated anyway.
Re:WTF??? (Score:5, Insightful)
I would say it may have quite a lot to do with it... it's either a pretty big coincidence, or they are trying to bury the news by releasing it when the networks actually have something else to report on.
What's your bet on?
Parent
Re:WTF??? (Score:5, Informative)
Same reason Clear Channel laid off 8% while this was going on. :-)
Parent
Re:WTF??? (Score:4, Funny)
Parent
Re: (Score:3, Informative)
Thats nothing a certain middle eastern country broke it's fragile ceasefire, the night of the US election, that was more than just a good time to leak the news. TBH im surprised that a UK official got in trouble for saying 9/11 was a good day to get rid of bad news, this shit has been going on for years.
Re:WTF??? (Score:5, Informative)
The implication is that they timed the announcement to occur when no one is paying attention.
Parent
Re:WTF??? (Score:5, Insightful)
"Legal reviews": "Holy crap, we're gonna get our butts sued off if this breach becomes a big news story! You have to delay this until we can start a war or something to distract the press!"
"Will the inauguration hype of the first African-American President of the United States work as a distraction?"
"Brilliant!"
Parent
Re:WTF??? (Score:5, Interesting)
The first instinct of Heartland is to save itself and the first instinct of the banks will be that it can rate jack its customers if the new activity has put them overlimit.
Only after leaking of the news is inevitable and can no longer be delayed will Heartland grudgingly try to sneak it out under the radar and then in a general, untargeted sense, not directly to the customers involved. Nothing will be done to avoid spreading the pain to a card holder or to a vendor.
I dare say most of the legal wrangling was in how to spin this as a justification to claim from TARP.
Parent
Re:WTF??? (Score:4, Interesting)
Parent
Re:WTF??? (Score:4, Interesting)
Parent
Re:WTF??? (Score:5, Insightful)
Today. During the inauguration. WTF??? What does the inauguration have to do with this?
Well, somebody who is inclined toward cynicism might conclude that the company deliberately chose to release this information when public attention would be diverted elsewhere.
Parent
Re: (Score:3, Interesting)
Ahh...now I get it. Still, there was that plane that landed in the Hudson a few days back, yesterday was MLK day, the Super Bowl will be in a couple of weeks. Not to mention that it would seem that it would be in their best interests to get the word out to minimize losses.
Re:WTF??? (Score:5, Interesting)
Not to mention that it would seem that it would be in their best interests to get the word out to minimize losses.
Oh, they've already got that covered:
In other words, "Yeah, technically it was a breach, but you know, not enough data got released for us to actually be provably liable. So if your CC gets raped, you know, it's not our fault. Really. Trust us. ;)"
In related news, now we know what happened to the Iraqi Information Minister: He changed his name and became President and CFO of a large credit card payment processing company.
Parent
Re:WTF??? (Score:4, Informative)
Parent
Re: (Score:2)
All of those other incidents (MLK day, super bowl, etc.) are in passing. They are temporary, at best. The inauguration is going to echo through the media for a loooong time to come. Even if someone publicly calls them out on this (more than just on /.) and there is an attempt to generate an uproar over this, in the end, the inauguration will far outweigh the breach when it comes to face-time in the news.
I'm the cynical type, and I reckon they succeeded at hiding this one in plain sight.
Re:WTF??? (Score:5, Interesting)
Well, somebody who is inclined toward reality
No need to thank me.
Also, FTFA:
Heartland called U.S. Secret Service and hired two breach forensics teams to investigate. But Baldwin said it wasn't until last week that investigators uncovered the source of the breach...
Meaning they knew about it long enough to hire some forensics teams, do the research, figure out where the breach came from, etc. and they finished all that up last week...and then decided to wait until NOON today to release the news to the public? Sorry, but that's plain bullshit, no cynicism involved. If they were interested in disclosure, they would've released the news sooner. At the very latest, they would've released it as soon as they found out how it happened (so they could say they had already closed the breach.)
Instead, they wait until noon (they're a New Jersey company) when the inauguration is happening? Why not sooner in the day? Why wait until what would arguably be lunch time usually? Who discloses breaches at lunch? Answer: nobody. On the other hand, who discloses breaches during a HUGE national (and arguably international) event? Answer: someone trying to hide something.
Again, I say inclined toward reality, not cynicism.
Parent
Re: (Score:3, Informative)
My own government is guilty of the very same [bbc.co.uk] - "a good day to bury bad news" as the infamous leaked e-mail went. As he said, rooted in reality.
Re: (Score:3, Insightful)
My comments were based on the article itself. What more do you expect? The article claims the disclosure occured during the inauguration. Regardless, waiting for inauguration day is "interesting" enough.
Also, just a little heads up: "nothing to do with reality" and "incorrect on the point of exact timing" are not synonymous. It will help lend credence to your position in the future if you learn the difference.
Re:WTF??? (Score:4, Funny)
"Researcher says Linux is better than Windows on Pedantic Asshole day."
There, is that better?
Parent
Re:WTF??? (Score:5, Funny)
Parent
Re: (Score:3)
If that was their plan, then that's a foolish one. It would have to be an EXTREMELY slow news day for this to get picked up on by the major news outlets, and even slower for most viewers to bother understanding it. And it's going to be picked up by people who are interested, like here, reguardless.
Burying it effectively would be waiting for something like the newest release of some major open source software, or waiting until China or Australia or other nation did something major about censorship.
Re: (Score:2)
Re:First CC (Score:5, Funny)
Then prove it - what is the security code on the back?
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Do you have any citations for that?
'A piece of malicious software [washingtonpost.com] planted on the company's payment processing network that recorded payment card data as it was being sent for processing to Heartland by thousands of the company's retail clients'
Re: (Score:2)
And this is somehow anything to do with the server? We're talking about a payment processor, who has to comply with PCI DSS. One thing that requires is that the server managing payment data be isolated from all the client PCs, and run appropriate security software etc. If anything, this is Heartland's fault (and their PCI assessors, of course). Nothing to do with Microsoft, who for the most part make good servers (even if everything else sucks).
Re: (Score:2)
Did you check the security certificate that is being used by that Microsoft site before posting? I'm sure you understand what role these certificates serve in relation to https connections.
Of course, the connection to their site might be being intercepted by aliens who are replacing a valid certificate with a bad one. Or maybe they're using an old skool coal fired server and forgot to shake down the clinkers.
I'll just use Occam's Razor here - and the simplest explanation is that that server is running Win
Re: (Score:2)
Actually, they can. It isn't invalid at all, it was merely issued by Microsoft's certification authority (which itself has a CA certificate issued by GTE CyberTrust). The problem is your browser (my Firefox 3 didn't even blink twice at it).