Kmart Says Its Payment System Was Hacked 101
wiredmikey writes Kmart is the latest large U.S. retailer to experience a breach of its payment systems, joining a fast growing club dealing successful hack attacks. The company said that on Thursday, Oct. 9, its IT team detected that its payment data systems had been breached, and that debit and credit card numbers appear to have been compromised. A company spokesperson told SecurityWeek that they are not able to provide a figure on the number of customers impacted. The spokesperson said that based on the forensic investigation to date, no personal information, no debit card PIN numbers, no email addresses and no social security numbers were obtained by the attackers.
social security? wtf (Score:5, Insightful)
why would Kmart even have your social security number?
Re:social security? wtf (Score:5, Informative)
why would Kmart even have your social security number?
Uh... Employees?
Re: (Score:1)
Kmart credit cards?
Re: (Score:1)
Re: (Score:1)
FTFA "The spokesperson said that based on the forensic investigation to date, no personal information, no debit card PIN numbers, no email addresses and no social security numbers were obtained by the attackers."
Must be trure, if a spokesperson said it was.
Re: social security? wtf (Score:1)
Re: (Score:2)
Most stores these days have their own store credit cards. To apply for them you give them your SS#.
Re: (Score:3)
why would Kmart even have your social security number?
Because they ask for it to look up your Sears credit card if you don't have it with you. Yes it is stupid
Re: social security? wtf (Score:2)
If you even go in to buy a candy bar they will ask you to apply for a credit card at the register. Even if you are eleven years old (happened to my daughter last week). Then they give you seven feet of receipt material with coupons, surveys, and a copy of the Magna Carta.
They are so going out of business. I would be short on the stock.
Re: (Score:2)
That's pretty much what I was thinking. I thought they had all closed a few years ago.
So this affects... (Score:5, Funny)
Re: (Score:1)
So this affects nobody.
Not quite. I have elderly relatives that live in a rural area that, for some reason, only has a K-Mart. No Target, no Wal-Mart, and very little by way of decent local shopping. The closest Wal-Mart is almost an hour's drive away, and Target is closer to two, so if you live there and want something that isn't groceries, you basically have no choice but to go to K-Mart. (As you might expect, it's a piss-poor example of a store, because there's absolutely no reason to care. It's not like the shoppers have
Re: (Score:2)
Re: (Score:1)
Blue Screen Special
Re: (Score:2)
Re: (Score:2)
"ATTENTION K-MART HACKERS!
We have a special deal for you under the flashing blue screen. Credit card numbers, all you can stuff in a ZIP file. The blue screen will only be there for the next month or so, so hurry on over and check out the checkouts."
It would be quicker (Score:5, Funny)
almost said my company, would be a Target (Score:5, Funny)
I almost mentioned the name of my company as the one that hasn't been hacked. We take security very seriously. No Microsoft products are allowed on the premises, employees are armed, etc.
Then I realized posting that could make us a Target.
Re: (Score:2)
I almost mentioned the name of my company as the one that hasn't been hacked. We take security very seriously. No Microsoft products are allowed on the premises, employees are armed, etc.
Then I realized posting that could make us a Target.
Well played, sir. Well played.
Officials estimates losses (Score:5, Funny)
Also at krebsonsecuritycom (Score:5, Informative)
hacking-envy (Score:3)
Does K-Mart use the same stuff as Sears? (Score:5, Interesting)
Sears, last time I checked was a definite IBM AIX shop with the point of sale terminals being a tad more than IBM 3151 VTs, except with a credit scanner and cash drawer. Is K-Mart on a different system, or do both Sears and K-Mart use the same POS these days?
Malware on Windows is one thing... nailing AIX systems actually would be an accomplishment.
Re: (Score:2)
Kmart has newer registers but the screen where you swipe credit cards looks like OS/2 or Win 3.1 judging by the hourglass displayed.
Re: (Score:3, Interesting)
Based on what the article says about what happened - that it was actual POS malware - I still am not able to figure out a methodology that would enable such an attack to work.
Let's say someone manages to put malware on a POS device. Ok. But now how would that malware be able to communicate any information to the thieves? I cannot imagine that the POS device is just sitting on the 'net without a strict firewall in front of it allowing it access to one - and only one - address: that of the company that pro
Re: (Score:2)
While it's possible (unlikely in these days of PCI) that a POS register could have a direct route to the internet, it's also likely that the registers weren't the only machines in their system that were hacked. It is probable that the criminals found a little-used server in K-Mart's HQ systems, compromised it, and set up what's called a "dump site." The registers are then configured to exfiltrate their data to this internal HQ server, perhaps by periodic FTP, and the hackers had the HQ server send batches
Re: (Score:1)
I was thinking that the only possibilities for the theft to happen would have to be either a) there's an administrative access to the POS systems which was breached, kind of similar to what you are saying; or b) there's some manipulation of the physical infrastructre at (a) store(s) in addition to POS malware. For example some malicious host could be inserted in the pathway of communication of the POS systems. My guess is that that isn't too likely.
More likely is something like a), or what you suggest. T
Re: (Score:2, Informative)
It would be an accomplishment. Mainframe OSes, AIX, and Solaris have an impeccable record for security these days (before 2000, different story, as Sun was often bashed... but with MS as the absolute focus for the bad guys with OS X and Linux trailing), hacking an AIX box is a lot more difficult than Windows.
1: AIX has trustchk. If the executable isn't signed, it doesn't run. Linux doesn't have this functionality, and has to be done in userland. Even modified libraries won't load. Of course, this func
My shopping is becoming limited (Score:1, Insightful)
As an IT security guy, I really find all these cracks disheartening. I guess the IT staff at these places don't really understand that security is a process, not a product. You cannot throw up a router with some ACLs and firewall or two and expect to be secure. Neither can you not make constant audits of your backend payment systems and expect security.
I've already stopped shopping at Target permanently because of their debacle. I stopped shopping at Walmart this week due to their cancelling health benefits
Re: (Score:3)
Can't you pay with regular, non-computerized cash?
Re: (Score:2)
Re: (Score:1)
I wouldn't blame the IT staff. A lot of places have PHBs that feel that security has no ROI, so give token (at best) funding to security.
As it stands now, most companies will not suffer much even with a critical breach. PCI-DSS3 is only for the little guys, and HIPAA, SOX, FERPA, and other regs are lightly enforced if that. The people who suffer are end users, and that doesn't really matter.
Even with a good security staff in place, there is also the fact that you can't win a war with just defense. Ultim
Re: (Score:1)
And, don't forget that the IT staff often have to allow a big, gaping hole in the firewall to allow the vendor(s) to update your POS software per contract.
Re:My shopping is becoming limited (Score:4, Insightful)
Very true. I'm reminded of one vendor that as part of the contract got their own direct connect to company LANs in order to directly service/support their software. I always worried that all it took was some compromise on the vendor's side, and it was a big gaping hole that could be easily nailed. The vendor was pretty much protected (part of the software contract), so if they got hacked, it was pretty much game over.
I did stick in a firewall though. The vendor had unfettered access to their machines... but no unrelated boxes, and their machines were also sectioned off. However, it was like putting a bandaid on a bullet wound, because of all the things their software touched.
Point of sale systems are not rocket science. We had better quality of code when game companies made Playstation 1 CDs (as they could not be updated, so what was released was it.) It might just be time to return to that finished quality of code... but still have an update mechanism. An update mechanism that requires not just signed firmware, but someone physically pressing a button (so the software can't be remotely updated.)
Re: (Score:2)
It's a Pin, Chip! (Score:2)
Re: (Score:3)
How does that chip help when you are shopping online?
You insert it into a device attached to the USB on your computer. The chip is queried and authenticated in real time as you make your purchase. I have a bank account in China, and that is how it works there to do online transactions.
Re: (Score:2)
Woud such a chip device ever be allowed to have Linux drivers, considering how hard everything is getting hacked today, even without their existance?
I don't know how Chip/PIN was actually implemented, but if the makers had half a brain there would be no reason not to make the drivers/protocols/etc completely open. There is no reason that the system should have to rely on the security of the POS terminal - the crypto happens on the smartcard and all the terminal should do is relay stuff between the bank and the card. In fact, I don't get why they don't just put the keypad on the card itself, making the PIN harder to steal, as well as the credential on
Re: (Score:2)
I don't get why they don't just put the keypad on the card itself
In the near future, they will, because "the card" will be your cellphone.
Re: (Score:2)
I don't get why they don't just put the keypad on the card itself
In the near future, they will, because "the card" will be your cellphone.
The problem with this is that it is actually not easy to ensure that the path between the TPM and the phone touchscreen isn't compromised. You can secure the credentials in the TPM, but the PIN is harder to secure when it is entered on a device intended for general-purpose computing.
Should retailers store credit card details? (Score:2)
Beyond transactions, I wonder whether retailers should even be storing credit card information? Surely debating this problem to the credit card companies would be better? The only thing combines should be keep is maybe some sort of public key value for the credit card, which can only be unlocked with a user provide value. The private key would be in the hands of the credit card company to access your account.
I am thinking on the fly here, but the main gist is the less credit card details stored by non-cred
Re: (Score:3)
Re: (Score:2)
I guess you missed the part where it's the payment systems that are being compromised in recent hacks. The way our credit/debit system works, the retailer must have your account information for as long as it takes to process the transaction. When it's the terminal where you swipe your card that's compromised and passing a copy of your data to thieves, what can you (the consumer) do?
I wrote up a description of a payment system which never gives account information to retailers a while back but can't find i
Re: (Score:2)
Pharmacy (Score:1)
Cash is king (Score:2)
Re: (Score:2)
This is terrible (Score:3)
That's 10 more people who have had their personal information compromised.
Protect yourself from crackers the easy way (Score:3)
Keep a sub-$1 balance in your bank account. :P
Re: (Score:2)
Not when you don't have overdraft protection.
Shady practices. (Score:1)
Last I knew - K-Mart's parent corporation Sears, rolled all their "Sears" cards over to Citibank. When I started getting suprize charges from "Sears Home Health" and called the number on the back of the "Sears" card to complain/dispute the charges - they told me "This is Citibank - if you have a dispute - dispute it with the company who charged it". I was like "this is a Sears card - I got a charge from Sears - I am calling Sears". Turns out - sometime magically three different companies - none of whom want
Doubtful forensics and common sense (Score:2)
HACK ATTACK (Score:2)
Am I the only onw who thinks "Hack Attack" would be an awesome band name !?
K-mart sucks (Score:1)
Another day another major data breach... (Score:1)
How do you hack a crank calculator (Score:3)
KMart is well known for having barely any IT infrastructure, and what they DO have doesn't work well. They are literally one step removed from only hand-crack adding machines.
How DO you hack that?
Yes this is a serious question. One of the key differences between Walmart and KMart was how each company approached IT back in the 80s when this stuff became affordable and powerful. Walmart embraced data and wrapped their whole process around it and still uses it quasi-magical ways to glean trends, predict sales, do reorders, and find efficiencies. They extract value from data just like they squeeze their suppliers.
KMart, on the other hand, looked at computers and laughed and went on laughing for years, not noticing as Walmart out flanked them and eventually drove them into the ground head first. KMart is barely alive now, because they spent decades not having any idea what was even in the stores or what was selling. They didn't know, didn't care, had no way to handle the data even if they had it, and generally treated IT like nothing more than office internet connections to surf Yahoo.
Baseline Magazine, I believe it was, did a stellar piece on Walmart vs. Kmart and how each handled IT as of about 10 years ago. KMart is not painted on a good light. It's actually amazing an organization as incompetent as KMart is even still in business. .They have never gotten it and still don't.
Walmart had them beat years before it happened, because Walmart knew all the data. They won the war in the server room. KMart never had a chance and didn't even fight back.
K-Mart Hacked (Score:1)