Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

The TJX card fraud - how the hackers did it

  • 05-05-2007 03:37PM
    #1
    probe
    Closed Accounts Posts: 2,055 ✭✭✭


    The Wall St Journal has the background story on how hackers downloaded cardholder details for at least 45.7 million credit and debit cards (and maybe up to 200 million – if they accessed a full database of four years of card transactions from Marshall’s discount store [division of TJX]).

    How they did it:

    They cracked the WEP security key used on the WiFi LAN at one Marshall’s branch (which takes about 2 minutes*), and once inside the network they monitored the traffic until they grabbed user ID’s and passwords for the parent companies data warehouse in Framington, MA – which was accessible over the net. This enabled them to download customer card transaction / identity details and bingo!

    “TJX's breach-related bill could surpass $1 billion over five years -- including costs for consultants, security upgrades, attorney fees, and added marketing to reassure customers, but not lawsuit liabilities -- estimates Forrester Research, a market and technology research firm in Cambridge, Mass. The security upgrade alone could cost $100 million, says Jon Olstik, a senior analyst for Enterprise Strategy Group, a Milford, Mass., consulting firm, based on his conversations with industry experts and people familiar with the work being done”. (WSJ)

    This is so preventable.

    (a) Retailers have no business storing customers’ payment card numbers – they should be using transaction reference numbers to provide an audit trail to deal with chargebacks and queries from banks. There is absolutely no excuse whatsoever for storing these data for four years or more in a retailers’ database. Using the EMV system the card number should go encrypted end to end from the customers’ card chip to the bank payments system – giving the retailer no opportunity to steal the cardholder details – as happens in France.

    (b) The staff at French retail chains – eg FNAC – have to use multi-factor authentication to get into the company IT system - even for simple tasks such as "do we have that DVD player in black" in stock. This would prevent people who break into networks from sniffing a usable login ID – because with multifactor authentication the ID changes every minute. Steve Gibson has just done a netcast on multifactor authentication – you can listen to it here:

    http://www.podtrac.com/pts/redirect.mp3/aolradio.podcast.aol.com/sn/SN-090.mp3

    Multifactor authentication also prevents keyboard loggers (found in many internet cafes and hotel “free” internet business centres) from thieving user credentials.

    An increasing number of retailers in Ireland are thieving card numbers from customers’ EMV cards by first skimming the magnetic stripe of the card and then putting it into the chip reader. While EU law makes them financially responsible for fraudulent transactions carried out at their own establishment – there is nothing to stop them printing out customer card details and putting them in a skip outside back every night if they want to. Retailers should be made legally liable for any consequential loss arising from customers’ card numbers escaping into the wild due to their security breaches. This would quickly put a stop to retailer data theft - they wouldn't want to know your card number - and the practice of squirreling away of cardholder data for marketing and other purposes.

    .probe

    http://online.wsj.com/article/SB117824446226991797.html

    * http://db.tidbits.com/article/8942


Comments

  • #2
    robindch
    Moderators, Society & Culture Moderators Posts: 24,461 Mod ✭✭✭✭robindch


    probe wrote:
    Using the EMV system the card number should go encrypted end to end from the customers’ card chip to the bank payments system...
    False. EMV data is only occasionally encrypted (and only occasionally MAC'd). EMV security resides principally in the unique keys derived for each PAN/PSN and the unique ARQC calculations which accompany each full EMV transaction. The ARQC calculation can be verified only with security hardware living on the card issuer's premises. Magstripe and fallback transactions, as permitted by many international ATM and POS devices, are not secure and are vulnerable to the theft of magstripe (track-two) data.

    TJX was compromised because they did not adhere to the payment industry's PCI Data Security Standards. The DSS document is short and worth reading -- it can be downloaded from here.
    probe wrote:
    EU law makes them financially responsible for fraudulent transactions carried out at their own establishment [...] Retailers should be made legally liable for any consequential loss arising from customers’ card numbers escaping into the wild due to their security breaches.
    EU law cannot and does not assign responsibility for fraud -- that's between the retailer and the merchant's acquiring bank. Since January 2005 in the UK and Ireland, merchants are responsible for losses caused by data compromise on their premises (see here). That's why TJX is in the hole for hundreds of millions, including -- I see missing from the above -- possibly the reissue of every one of the compromised cards and recompense for any fraudulent transactions that took place.

    .


Advertisement