CiCi's Pizza May Have Been Hacked (krebsonsecurity.com) 34
An anonymous reader writes:Security expert Brian Krebs says more than half a dozen financial institutions contacted him, "all asking if I had any information about a possible credit card breach. Every one of these banking industry sources said the same thing: They'd detected a pattern of fraud on cards that all had one thing in common: They'd all been used in the last few months at various CiCi's Pizza locations... The data available so far suggests that hackers obtained access to card data at affected restaurants by posing as technical support specialists for the company's point-of-sale provider, and that multiple other retailers have been targeted by this same cybercrime gang."
The pizza chain referred Krebs to an outside firm managing their restaurants, who referred him to an outside PR firm, so he eventually just contacted the chain's point-of-sale provider, Datapoint. They confirmed that the Secret Service was investigating several different point-of-sale vendors in "one particular franchise... All of these attacks have been traced to social engineering/Team Viewer breaches because stores from several POS vendors let supposed techs in to conduct 'support'."
The pizza chain referred Krebs to an outside firm managing their restaurants, who referred him to an outside PR firm, so he eventually just contacted the chain's point-of-sale provider, Datapoint. They confirmed that the Secret Service was investigating several different point-of-sale vendors in "one particular franchise... All of these attacks have been traced to social engineering/Team Viewer breaches because stores from several POS vendors let supposed techs in to conduct 'support'."
Obvious headline is obvious (Score:5, Funny)
CiCi's lost CCs.
Cheap pizza, cheat IT... (Score:1)
Re: (Score:2)
Shudder...
Worst. Pizza. Ever.
Even my boys hate the place, with a hot, burning passion. Cardboard, topped with a few teaspoons of bland sauce, barely covered with cheese, next to such lovely items as stale breadsticks and mac and cheese... did I say cheese? More like cloudy water.
The only place I've eaten that was worse would be a couple of short lived places on Yonge Street in Toronto in the 90s (UFO Pizza and some non-descript chinese buffet)
Re: (Score:2)
Shudder...Worst. Pizza. Ever.
CiCi's is rivaled only by Chuck E. Cheese in terms of "non-edible items masquerading as pizza".
Re: (Score:2)
I'm probably the only person on Slashdot that remembers Bullwinkle's in Santa Clara, CA (they closed in 1996). They would remove the plastic wrapper off their frozen pizza right before your eyes and stick it in the oven to be heated. A thin piece of cardboard, thin veneer of ketchup, a few sprinkles of chalky mozarella and a couple slices of the thinnest pepperoni on Earth. The animatronic show preceded by a dancing water fountain was worth it though.
I've heard of CiCi (Score:5, Insightful)
But I hand't heard they made pizza. I just though there were a cardboard tile store.
NOOOOOOO! (Score:1)
I didn't say anything when various stores, banks and social media sites were getting hacked because I knew that networked computers came a price. But now YOU DO THIS TO PIZZA?! DAMN YOU! DAMN YOU ALL TO HELL!
Re: (Score:1)
Re: (Score:1)
Nice to know that CiCi's is willing to let the cops rifle through their business records weekly without a warrant.
I don't think it was the POS manufacturer (Score:4, Informative)
This is probably a case of a criminal calling CiCi's store 2348, getting a franchisee-trained manager on the phone, and telling her "Hi, I'm from ACME POS, your POS vendor. We are calling to install updates to make the chip readers you aren't using yet work later on... and we need access to the workstation in the back of the store. Can you please open a browser and go to www.getmein.com?...". I doubt the defacing of the POS vendor's website has squat to do with it.
Of course, the franchisee is running a consumer-grade router with no outbound filtering on it whatsoever... because they are in a low-margin business and they needed something cheap. The computer died in the back about 6 months ago, so they dropped in a replacement PC from Wal-Mart and promptly disabled UAC, etc.
The manager isn't knowledgeable enough to notice that the domain he is being asked to go to is wrong, the caller ID is wrong, etc. He or she needs to worry about the 73 kids in the restaurant who are dropping pizza on the floor that the new guy isn't cleaning fast enough, the 8 pizzas on the stuck upper belt in the oven, and the bathroom with the overflowing commode. Not to mention the health inspector waiting up front. Trough-style kid's restaurants are a nightmare.
I wish POS software could be handled completely as a service and reside in a VPC managed by the POS vendor. In reality though, the Internet is just not reliable enough for that in many (most) most places, and controlling POS peripherals from a cloud app is not really feasible.
Re: (Score:2)
Re: (Score:2)
This is why restaurant franchises hire managed services companies to handle all of this.
Re: (Score:2)
POS vendors should not be trying to service 10k+ deployments with a skeleton crew either. POS has for the most part been a pretty dirty business but has been made worse by economic conditions, pay scales falling and honest techs are in short supply under those circumstances, skilled techs are getting pretty rare. I've also noted a number of in-house jobs on restaurants on part of their employees as well. This whole thing is being produced by a failing economy, exactly why everyone should have the right t
we've sure been getting a lot of stories (Score:2)
about something that "might happen" or "might have happened" lately. Isn't there enough news about stuff that definitely did happen?
Re: (Score:2)
You're old enough to understand by now that /. is not the place to be if you want complete certainty. Maybe go browse the NTSB 'completely unambiguously solved cases' PDF stack if you want that. Oh, wait...
Rgds
Damon
Ugh. (Score:2)
I ate there once just to try it. Yech. If I had to choose between identity theft and eating there again, it would be a tough choice. Exactly how much would I have to eat?
How they were caught (Score:3)