Forgot your password?
typodupeerror
Security Crime

Target Confirms Point-of-Sale Malware Was Used In Attack 250

Posted by samzenpus
from the weapon-of-choice dept.
wiredmikey writes "According to Target Chairman and CEO Gregg Steinhafel, point-of-sale (POS) malware was used in the recent attack that compromised millions of credit and debit card account numbers of customers across the country. Steinfhafel told CNBC's Becky Quick in an interview that malware was used in attacks that compromised the company's point of sale registers. According to a report from Reuters, Target and Neiman Marcus may not be alone, as other popular U.S. retailers may have been breached during the busy the holiday shopping season. According sources who spoke to Reuters, attackers used RAM scraper, or Memory parser malware to steal sensitive data from Target and other retail victims. Visa issued alerts about attacks utilizing these types of malware in April 2013 and again in August 2013. Memory parser malware targets payment card data being processed 'in the clear' (unencrypted) in a system's random access memory (RAM). 'The malware is configured to hook into a payment application binary responsible for processing payment transactions and extracts the systems memory for full track data,' Visa explained in a security advisory."
This discussion has been archived. No new comments can be posted.

Target Confirms Point-of-Sale Malware Was Used In Attack

Comments Filter:
  • by ackthpt (218170) on Monday January 13, 2014 @03:16PM (#45942669) Homepage Journal

    There's any number of ways their POS system could have been done securely, but somewhere a decision must have been made on costs, in regard to paring them down, which resulted in something about as secure as an intranet of unprotected Windows XP computers exposed to the internet. No isolated network, no encryption, dependence upon commodity *cough* Windows *cough* operating system, etc.

    I'm sure it all looked great, until this happened, then they get 200% more wise.

    Seems everywhere I go these cheap systems are in place and the malware may already be chugging along for years without detection.

    • by Stormy Dragon (800799) on Monday January 13, 2014 @03:20PM (#45942713) Homepage

      Really, the card companies ought to be black boxing the readers, so that the POS system never has access to unencrypted transaction information to begin with. They really only need to know if the transaction was approved.

      They already do this for small retailers (those little card reader/tape dispenser thingies sitting next to the register). They need to start forcing a similar system on the big retailers.

      • by lgw (121541)

        ATM number keyboards are special: they never let a PIN into the RAM of the ATM, only a slated hash of the PIN. (Most of them are also horribly flawed in that they also have a "normal" mode, allowing a hacked ATM to display a UI to harvest PINs in that mode. Sigh.)

        Use this same technique for card readers: the magstripe reader doesn't ever put the raw bits on the wire, only a salted hash of those bits, so that's all that's available to a RAM scraper.

        • Re: (Score:2, Interesting)

          by Anonymous Coward

          ATM keypads don't generate hashes of your pin. They hold a cryptographic key that is dervied form another key from the network and then use the resulting key to encrypt your pin entry, but you are correct. Those keys and your pin number are held in memory on the pin pad.

        • Re: (Score:3, Informative)

          by Spillman (711713)
          the card number couldnt be hashed because the merchant's EFt processor routes the transaction to the cardholder's bank by using the BIN number which is the first 6 (usually) digits of the card nymber. the rest of the track 2 data could not be hashed either since it is used to calculate your pin by your bank.

          You might be interested in reading:

          ISO 8583 [wikipedia.org]

          and also, How pin checking generally works [wikipedia.org]
      • by aviators99 (895782) on Monday January 13, 2014 @03:32PM (#45942883) Homepage

        In 2015, EMV becomes required in the US. Those retailers who don't black box their card readers will be 100% liable for fraud at their point-of-sale (including stolen cards).

        • by afidel (530433)

          Wow, smartcards are finally going to become standard, I had one for 2004 to 2009 and the chip was only used twice because there were essentially zero POS readers that supported the chips and the home reader for online banking required IE for an ActiveX control which I felt probably made it less secure than entering my password with an alternative browser.

        • by girlintraining (1395911) on Monday January 13, 2014 @05:29PM (#45944399)

          In 2015, EMV becomes required in the US. Those retailers who don't black box their card readers will be 100% liable for fraud at their point-of-sale (including stolen cards).

          Retailers are 100% liable today. And that's the problem!

          EMV offers no additional protection whatsoever in a card present scenario unless the customer is required to enter a PIN. Which as you know.. convenience blah blah, speed blah, reasons. And nobody will. Even "einstein" level smart chips are useless without a PIN. What EMV was designed to do is reverse the precident that banks are responsible for bearing the costs of fraud unless the customer can be proven to have been negligent. All EMV is, is an attempt by the industry to dial things back to the way they were pre-2009 -- which was where they could claim the systems were perfect and infallible, therefore all liability is with the customer. It took an act of Congress, also known as the FSA, to override the courts and provide relief to the customers.It's taken a lot of work on the down-low getting key positions in the Senate filled by sympathetic Republicans, but behold! EMV: Now the courts and congress can be fully aligned in their desire to screw over the customer. It's motto might as well be Enter your PIN: Assume full liability.

          Also... I don't know what you think "black box" means, but merely separating the card swiper from the cashier's hands is not "black box" in IT; and that's all EMV does. In IT, black box means that the entire interface is subsumed into an external device, not networked, and not user-programmable, and it provides a pass/fail signal or similar. Retail will never, ever, go for this. Your name and zip code is embedded in the card; that's valuable marketing data. They're not going to reduce transactions to what would essentially be anonymous... this is just common sense.

          So I'm going to have to slap on the cliche "Citation Needed" onto your assertion. EMV has but one purpose -- to deprive consumers of any recourse to fraud in a card-present scenario, and to reduce liability to the banks in a CNP scenario as well. Fraud is a multi-billion dollar industry, and businesses like fixed costs. Everything about card transactions is a fixed cost to the bank, except for fraud. Make the customer responsible, and now everything is nice and orderly.

      • by Anonymous Coward on Monday January 13, 2014 @03:34PM (#45942947)

        I'm very surprised that Target thinks that every register in every store was infected. Just getting them all running the same malware is a major feat. And how did this POS malware get ahold of the 70 million "guest" records that weren't on the POS devices?

        • by sunderland56 (621843) on Monday January 13, 2014 @04:43PM (#45943779)

          This.

          For the attack to happen the way Target says, there must be two MAJOR flaws in their network:

            - the POS machines must be accepting software updates from the network - to allow the attackers to download their firmware;

            - the POS machines must be able to connect to an arbitrary server not on the Target network - to allow the POS machines to transmit the collected data.

          There is no valid reason for either of these. Need to update firmware? Have the IT guy at each store do it manually. And, install a decent firewall so that random machines inside your store can't talk to the outside world. (This will both prevent security breaches, *and* stop the employees in the photo department from surfing the web when they're supposed to be working).

          • by jader3rd (2222716) on Monday January 13, 2014 @06:24PM (#45944949)

            Need to update firmware? Have the IT guy at each store do it manually.

            Wait, what? That's exactly the opposite of how a large shop runs their operations. You create an image that you want applied to all machines that match a certain profile, and then let the machines do the updates at a preconfigured time.

          • Indeed. But if you read the case study linked from here [slashdot.org], you'll see that a major Target initiative over the past decade has been centralizing all of their internal systems, from inventory to pharmacy to in-store security to point-of-sale, into a single physical server per store running Microsoft Server 2008 and Hyper-V virtualization. Furthermore, the virtualization, OSes (some are AIX) and applications are all maintained and updated centrally, not by anyone physically in each store. (Target employs local c

      • Re: (Score:2, Interesting)

        by udachny (2454394)

        I build and support retail management systems, supply chain management, CRM, ERP for retailers, for suppliers, for shipping, logistics and such. The simplest way to use a bank terminal is NOT to connect it to a POS in the first place. But this means lack of integration and possible errors by a POS operator, if for example they have to indicate in the POS system whether the it was a cash or a card transaction, etc. We provide our own Linux based solutions for all parts of the business management, includin

        • by omnichad (1198475)

          I think the problem is that the card terminals the banks issue aren't that great from a UI standpoint, and big businesses want to design that hardware, too. Target actually has a great UI as far as button sizes and ease of use. They should rethink integrating them at that level, but it's much harder to make their own black box. I think they'll have to look into that now.

      • by DickBreath (207180) on Monday January 13, 2014 @04:43PM (#45943787) Homepage
        > the card companies ought to be black boxing the readers, so that the POS system never has access to unencrypted transaction information

        You're on the right track. Keep going! Don't stop yet.

        How about black boxing the cards?!!!

        AKA, Smart Cards. The card itself has a complete computer running Java just like the SIM card in your GSM phone. The computer on the smart card is black boxed. That computer has a private certificate. When transactions are signed by the processor in the card itself, the certificate chain can be verified that the certificate within the smart card is genuine and signed the transaction. Attempting to learn the secret data within the smart card destroys the data, or at least is extremely expensive -- and would only compromise that card making the attack not economically attractive.
    • by Penguinisto (415985) on Monday January 13, 2014 @03:20PM (#45942725) Journal

      Seriously? Unless they radically alter how these things are built and networked, all it would take is one disgruntled cashier (or one willing to accept a percent of the take) + one register that isn't quite visible from the cameras + one appropriately-loaded USB stick (or similar device).

    • by i.r.id10t (595143) on Monday January 13, 2014 @03:28PM (#45942831)

      I'm sure it all looked great, until this happened, then they get 200% more wise.

      Experience is learning from mistakes you make

      Wisdom is learning from the mistakes other people make

      • by Fnord666 (889225)

        Experience is learning from mistakes you make

        I thought experience was something that you get right after you need it.

    • Not to mention that most of the popular POS systems run on XP, and still will for long after Microsoft has abandon it.
      • by afidel (530433)

        Support for XP embedded runs longer than XP, and other than smalltime operations POS systems should be running XPe, though it's still only supported through January 30, 2017. PCI DSS will force the replacement of any XPe systems with Windows Embedded POSReady 2009 which is supported through 2024 or Windows Embedded POSReady 7 which is supported through 2026.

    • by roc97007 (608802)

      Windows XP? If only. I haven't seen a Target POS machine reboot, but the ones I've seen in other stores display the Windows 98 splash screen.

    • by MobyDisk (75490)

      There isn't much we can do until there is end-to-end encryption in the purchasing process. The POS device should never even know your pin or credit card number.

    • by Anonymous Coward on Monday January 13, 2014 @03:51PM (#45943197)

      I worked on POS systems back in the late 90s - so, keep in mind my knowledge is not recent - no really, retailers move at a snails pace when it comes to technology.

      First, this was an inside job. POS systems are too stupid to connect to the Internet.

      Second, back in my day, the register was a very dumb PC (DOS with an extender and later moved to Windows - yeah, I know). Network security NEVER entered the picture because it is a closed system: POS->Store server->Local/Main office over leased lines or VPN on the internet. The servers were slow shit. All they need to do is record sales data.

      In other words, IF the POS servers were in fact connected to the Internet so that crackers could get it, then someone really really really screwed up because there was absolutely no reasons to do so. Too slow.

      And if these servers WERE connected to the Internet, all the crackers would see is unencrypted transaction data: CC #s, exp dates, amounts, what was bought, names, and all the other data collected by the POS computer. Yeah, wide open - because it was thought that no one outside the store would ever see it.

      Retailing, in general, is a VERY competitive business with razor thin margins. Go to your finance website of choice and compare Walmart's,Target's,Sear's or whoever's operating margins with any other industry's company - Pharma is my favoriate comparison: try Bristol Meyers Sqibb (BMY). So, they take THE cheapest way out every time.

      • by mythosaz (572040) on Monday January 13, 2014 @04:18PM (#45943535)

        It's much, much more likely that hackers penetrated the network by other means, and then, once inside the network, compromised the POS systems -- which could then report back to the intermediary system, which could report out (or be repeatedly accessed from outside).

        It's unlikely that the POS systems themselves reached out to the internet. That would have been noticed far, far too easily.

        • by RabidReindeer (2625839) on Monday January 13, 2014 @04:45PM (#45943823)

          It's much, much more likely that hackers penetrated the network by other means, and then, once inside the network, compromised the POS systems -- which could then report back to the intermediary system, which could report out (or be repeatedly accessed from outside).

          It's unlikely that the POS systems themselves reached out to the internet. That would have been noticed far, far too easily.

          I'm not so sure. I happen to know of a certain well-known vendor of POS systems that is A) sloppy about a lot of things. B) pushing more and more of people's business onto their servers in their cloud. If their customer is also getting Lower Prices Everyday on their IT, so much the easier.

          And I do suspect the Cloud. Because infecting store-local systems in enough physical locations to capture 70 million or more accounts would be very labor-intensive. It's far easier to infect the Mothership and let it corrupt the local systems.

      • by mjwx (966435)

        I worked on POS systems back in the late 90s - so, keep in mind my knowledge is not recent - no really, retailers move at a snails pace when it comes to technology.

        First, this was an inside job. POS systems are too stupid to connect to the Internet.

        I think your info's a little out of date. Most stores run embedded Windows XP on their Point Of Sale equipment (Althouth the other meaning of POS is perfectly suitable here). It's trivial to connect them to the internet. But all you really have to do is connect t

    • by y86 (111726) on Monday January 13, 2014 @04:00PM (#45943325)

      I'm sure it all looked great, until this happened, then they get 200% more wise.

      Seems everywhere I go these cheap systems are in place and the malware may already be chugging along for years without detection.

      I worked for a MAJOR retailer that was involved with a credit card crisis. The only reason the registers didn't get raped was the fact they ran linux. The actual POS servers ran Windows 2000 so that is what got cracked. Management was working hard to get away from these solid state linux computers for the "cost savings" in administration of the Windows platform. I can tell you that a multipurpose platform is not appropriate for a specialized task.

      • I worked for a MAJOR retailer that was involved with a credit card crisis. The only reason the registers didn't get raped was the fact they ran linux. The actual POS servers ran Windows 2000 so that is what got cracked.

        I know this is Slashdot, but that's a bit ridiculous, isn't it? Linux exploits are not exactly impossible to come by, and someone only need acquire one of these devices to start looking for them. The reason the registers didn't get hacked was because the information that they wanted was on the POS system. If there are millions of dollars that can be taken, and someone wants to take them, they're going to find a way whether it's Linux/Windows/Whatever else, so long at the POS network isn't secured.

        Or are you

    • by jeffmeden (135043)

      DOOM is one of the most ported pieces of software in history, so it's only natural...

      http://www.techdigest.tv/2013/10/10_gadgets_that.html [techdigest.tv]

    • it gets worse. (Score:3, Interesting)

      by Anonymous Coward

      First, target has NOT wiped and re-installed. As such, there are Trojans waiting to come alive and look for other malware to install.
      but it gets better. Everybody is missing the fact that all of the companies having this malware offshore their IT. What is happening is that Indians are paid $8-10k, and are then offered 100-200k to release the malware. Of course they do it. They are set up for life and do not hurt their peers.

      this will continue as long as American companies are dumb enough to offshore.

  • by cold fjord (826450) on Monday January 13, 2014 @03:16PM (#45942673)

    Somebody should be by soon to defend the l33t crackers involved in this. Can't wait to read it....

    "We did you a service, now you know." Of course they won't give up anything they managed to steal.

    Brace yourself for new laws.

  • Inside job? (Score:5, Interesting)

    by BringsApples (3418089) on Monday January 13, 2014 @03:26PM (#45942799)
    All quotes from TFA:

    "Smaller breaches on at least three other well-known U.S. retailers took place and were conducted using similar techniques as the one on Target," Reuters reported, citing sources familiar with the attacks. "Those breaches have yet to come to light...

    What the hell, why not? I had to cancel one of my family debit cards because of Target, do I now have to cancel my other one from an unnamed store?

    After gaining access to a merchant’s network, attackers can install memory-parsing malware on register systems or backend processing servers to extract magnetic-stripe data as it moves through the through the payment process.

    How are they gaining access to Target's network? Maybe it's from the ever-famous wireless network that's in all Target stores, and is prone to attacks, based purely on it's password policy (changes automatically once a month - or doesn't at all - I hear)

    “The malware is configured to hook into a payment application binary responsible for processing payment transactions and extracts the systems memory for full track data,” Visa explained in a security advisory.

    Again, how did they not only get into the system, but how'd they know the executable binary that was running? I mean, this isn't something that was done in one day, it had to be a collective goal for more than one person.

    Visa first warned about these types of attacks targeting grocery merchants, but said merchant segment is vulnerable. According to Visa, these types memory parser malware attacks have been found only targeting Windows-based operating systems.

    This one is my favorite. Why any retailer is running Windows on a POS PC is beyond anyone that knows how computers work. It should be illegal.

    In March 2013, new malware was found targeting point-of-sale (POS) systems and ATMs and was behind the theft of payment card information from several US banks. Called "Dump Memory Grabber", the malware scans the memory of point-of-sale systems and ATMs looking for credit card data.

    And how the shit does one gain access to an ATM's RAM?

    All in all, I feel that this must have been an inside job of some kind. Not just a Target employee, but a Target employee(s) and someone who has access to ATMs inner-workings.

    • Re:Inside job? (Score:5, Insightful)

      by houstonbofh (602064) on Monday January 13, 2014 @03:34PM (#45942943)

      This one is my favorite. Why any retailer is running Windows on a POS PC is beyond anyone that knows how computers work. It should be illegal.

      GEtting PCI compliance certification is not cheap, and you need it if you want integrated payment. So far, not a lot of open source POS systems are lining up to pay for certification...

      • by rmstar (114746)

        GEtting PCI compliance certification is not cheap, and you need it if you want integrated payment. So far, not a lot of open source POS systems are lining up to pay for certification...

        Oh I get it. You run a POS software on a POS operating system on a POS hardware? And that's why the system stinks!!

      • by tgd (2822)

        This one is my favorite. Why any retailer is running Windows on a POS PC is beyond anyone that knows how computers work. It should be illegal.

        GEtting PCI compliance certification is not cheap, and you need it if you want integrated payment. So far, not a lot of open source POS systems are lining up to pay for certification...

        Once you've crossed the "root" security boundary, its just as easy to access the raw memory in Linux as it is in Windows.

        And its not hard to elevate to those rights on either platform. Vulnerabilities exist on everything.

      • by Anonymous Coward

        Getting PCI compliance certification is not cheap, and you need it if you want integrated payment. So far, not a lot of open source POS systems are lining up to pay for certification...

        False! It's dirt cheap, just a couple hundred dollars. You filled out an application, paid a fee, and got an enhanced port scan. How exactly does your shiny new(annually renewed) PCI DSS compliance accreditation protect ANYTHING? PCI compliance testing does nothing beyond proving that you at least installed a consumer grade router/firewall between your card reader, card data storage, and the internet. Litterally nothing between your card data and the internet beyond a 10 year old $50 Linksys router.

        But, God

        • by houstonbofh (602064) on Monday January 13, 2014 @05:26PM (#45944371)

          False! It's dirt cheap, just a couple hundred dollars. You filled out an application, paid a fee, and got an enhanced port scan.

          That is PCI compliance for a network, not an application. If you have an application that allows credit card swipes, and goes to a clearing house, it needs to be certified as well, and that ain't cheap.

          How exactly does your shiny new(annually renewed) PCI DSS compliance accreditation protect ANYTHING? PCI compliance testing does nothing beyond proving that you at least installed a consumer grade router/firewall between your card reader, card data storage, and the internet.

          It also shows that you exercised due diligence in securing your network, and prevents you from being sued for gross negligence. You don't need real security if you can show that you had some and therefore can't be sued.

    • Visa first warned about these types of attacks targeting grocery merchants, but said merchant segment is vulnerable. According to Visa, these types memory parser malware attacks have been found only targeting Windows-based operating systems.

      This one is my favorite. Why any retailer is running Windows on a POS PC is beyond anyone that knows how computers work. It should be illegal.

      Um...everyone uses Windows on POS PCs. Usually a customized WinXP embedded install. Windows devs are cheap, and a lot of the POS app work is outsourced to places it seems are more comfortable with windows.

      Retailers aren't tech companies. There is usually a small group of IT people who are part POS engineers, part vendor management. Most retailers rely on vendors or other companies to provide them with complete systems and support/installation services.

    • by Reibisch (1261448)

      This one is my favorite. Why any retailer is running Windows on a POS PC is beyond anyone that knows how computers work. It should be illegal.

      So you're saying that you're a security by obscurity advocate then.

      Not running on an embedded Windows installation might seem like a safe bet, but as TFA mentions, this vector had to do with processing the payments in the clear -- simply running another OS doesn't necessarily give you that for free.

    • by omnichad (1198475)

      but how'd they know the executable binary that was running?

      It was scanning the RAM. They didn't need to know what binary. They were likely just looking for credit card data using the luhn algorithm against ALL of the RAM for any string of 15 or 16 digits. With a hit, they can widen the net and grab all of track 1 and track 2 data. RAM is very fast.

      To gain access to the RAM, you only need a privilege escalation exploit.

      • You sound like you know a good bit more about this than I. If you don't mind my asking, do you feel that something of this magnitude was an inside job?
  • For Retailers and Credit card providers both, it appears their ability to understand the validity of robust security testing and practices revolves around cost. Not having to pay any perceived penalty due to a data breach means these corporate types can assign a relatively low risk to data breaches. Low risk usually means low test efforts as well. And this is what we as consumers appear to be satisfied with. I'm more of the opinion that if you have a data breach, it should cost you as a company X dollar

    • by omnichad (1198475)

      and start X somewhere above 5 figures. Each person would get that payout. How serious then would corporations take data security?

      What businesses would be left? $10,000 x 70,000,000 puts Target out of business. And overall, I'd rather see them survive than Wal-Mart.

  • by roc97007 (608802) on Monday January 13, 2014 @03:32PM (#45942903) Journal

    > [...] that malware was used in attacks that compromised the company's point of sale registers.

    See?? There is still a market for Windows 98 programmers!

  • PCI-DSS was created to hold merchants to some kind of security standards. There are huge fines if your payment processing system isn't compliant.

    Details aren't really that clear, but do we know if Target was in violation of the requirements? Or is this a case of PCI-DSS compliance not guaranteeing security? From what I remember of PCI-DSS, it was a good start but not comprehensive. It seemed more focused on preventing someone from swapping out a legitimate credit card processing device with a compromise
  • Assuming these POS POS machines suck when it comes to security ... why not

    - Install them on their own VLAN in stores
    - Deny the VLAN internet access

    Simple n'est–ce pas?

    • by paulzeye (736282)
      Needs to be a little more complex. Any easy way around your measure would be to have a compromised jump box somewhere else on Target's network. POS machines send data to jump box, jump box uploads it to internet. Access to the POS VLAN needs to be tightly controlled- but then you need to pull logs of some of them, put patches and updates on them, authenticate users, after a while your VLAN has lots of holes in it.
    • by m6ack (922653)

      ... why not

      - Install them on their own VLAN in stores - Deny the VLAN internet access

      An insider (private "security" or janitor) could yet attach an infection device to the private network (which is a likely infection vector in any case). The only "simple" solution leveraging XP that I can envision is one where each and every POS is physically isolated from the network via a very locked down BSD or Linux machine (Pi's?).

    • by citizenr (871508)

      you forgot:

      3:???
      4:profit

      where 3 is http://en.wikipedia.org/wiki/VLAN_hopping [wikipedia.org]

  • by jeffb (2.718) (1189693) on Monday January 13, 2014 @03:54PM (#45943237)

    I must be having some rendering issue in my browser. No matter how many articles I read mentioning "Target Chairman and CEO Gregg Steinhafel", I can never make out the word "outgoing" in front of the title. Not even "embattled". It must be a browser problem. I can imagine some weird bug that would cause such words to be rendered as hidden text; I can't imagine a world where a CEO would emerge unscathed from a screw-up of this magnitude. Right?

    • by i.r.id10t (595143)

      Well, the blink tag has be deprecated for a while...

    • by game kid (805301)

      Don't worry, Steinhafel is already making speeches about his victimization and firing scapegoa^W^W^W^W^W^W^W^WShowing Leadership and Getting To The Bottom Of This.

      You know, like that Christie guy [nbcnews.com].

    • by omnichad (1198475)

      CEO doesn't work in IT. No reason to believe he was presented with enough details to even take the blame. Besides, this security failure attacks what was once standard practice. Attacks are getting more sophisticated.

      Firing everyone who is even remotely involved is just going to delay the company's recovery.

  • by m00sh (2538182) on Monday January 13, 2014 @04:04PM (#45943369)

    I got an e-mail from Target offering me free credit monitoring.

    Yeah, they leaked my name, address, credit card number etc and now they want me to sign up for credit monitoring with them. Just input your social security number and answer a few questions ...

    We have been hearing about how Target figures out if you're pregnant before your family does. They have been doing all sorts of data mining on people.

    I suspect what is leaked is just not the name, address and credit card info on their subscribers. What if they have a profile on each of their customers that is also leaked? What if they compiled all sorts of data about their customers from various sources, like relationships, employment field, estimated incomes and other bits of info from the credit history? What if all that was leaked?

    • I got an e-mail from Target offering me free credit monitoring.

      Yeah, they leaked my name, address, credit card number etc and now they want me to sign up for credit monitoring with them. Just input your social security number and answer a few questions ...

      Surely, they aren't offering to sign you up with their roll-your-own credit-monitoring system, right? (Because I wouldn't go for that either.) Last time I had a credit card possibly compromised, the retailer at fault gave me a free one year subscription to Equifax's credit monitoring service. I got a coupon code from the retailer, but all the interaction was with the credit bureau.

      (For the sake of closure on that anecdote, nothing weird happened over the following year.)

      • by m00sh (2538182)

        Surely, they aren't offering to sign you up with their roll-your-own credit-monitoring system, right? (Because I wouldn't go for that either.) Last time I had a credit card possibly compromised, the retailer at fault gave me a free one year subscription to Equifax's credit monitoring service. I got a coupon code from the retailer, but all the interaction was with the credit bureau.

        (For the sake of closure on that anecdote, nothing weird happened over the following year.)

        Yes, it is through Equifax they say.

        The website is here. https://creditmonitoring.target.com/ [target.com]

  • by kriston (7886) on Monday January 13, 2014 @04:08PM (#45943423) Homepage Journal

    Why are they not using thin clients like VMware, Citrix, with PCoIP? I recently visited a Bob's furniture store and all their POS terminals were thin clients using either RDP, Citrix, or bus virtualization protocols like PCoIP. Same with the terminals at all the centers at another firm.

    With the current generation thin clients, particularly the nifty PCoIP ones, local performance is very attainable even though it isn't really needed for POS terminals. VMware has offered PCoIP since 2008 and Amazon has just released their implementation.

    I think Target deserves what they got for having POS terminals that are allowed to be locally modified in any way.

    • Re: (Score:2, Interesting)

      by Charliemopps (1157495)

      I'm curious, if you find security so important, why the hell do you have a link in your sig that directs people to pictures of your entire family? As much as I'm sure we're all thrilled to see your daughters piano recital I can't imagine I'd ever put pics of my kids on the net like that. I guess that's up to you but the slashdot crowd is not who I'd want having every intimate detail of my home life. I'm pretty sure your link would let me steal your identity a lot quicker than any data they got from target.

      • by kriston (7886)

        It just goes to show you how much you think you know about security, which is quite a tiny bit.

  • POS (Score:4, Insightful)

    by ThatsNotPudding (1045640) on Monday January 13, 2014 @04:14PM (#45943497)
    They were quite psychic when selecting this particular acronym.

Real Users find the one combination of bizarre input values that shuts down the system for days.

Working...