Another massive data breach, affecting 4.2 Million

[no1_vern]

No matter how much you protect your info, anyone you deal with has to protect it also. In this case a supermarket chain allowed malware to get onto almost all of its servers. The breach compromised 4.2 million accounts.

Unauthorized software that was secretly installed on servers in Hannaford Bros. Co.'s supermarkets across the Northeast and in Florida enabled the massive data breach that compromised up to 4.2 million credit and debit cards, the company said Friday.
The Scarborough, Maine-based grocer confirmed a report in The Boston Globe that it told Massachusetts regulators this week about the link between the breach and the illicit programs, known as "malware."

The company doesn't know how the malware - short for malicious software - got onto nearly all its 271 stores' servers, Hannaford spokeswoman Carol Eleazer said.

At least 1,800 cases of fraud have been linked to the data breach, with unauthorized charges showing up as far afield as Mexico, Italy and Bulgaria.

The breach has prompted concern in the industry because it appeared to be the first large-scale theft of credit and debit card numbers while the information was in transit.

The usual mode of attack targets data sitting in databases, as in the record-setting theft of information from Massachusetts-based TJX Cos. involving least 45 million cards.

"Virtually everything is possible," Eleazer said. "There are still many, many aspects that we don't totally understand."

The company has said that the breach, which occurred between Dec. 7 and March 10, allowed credit and debit card numbers to be stolen as shoppers swiped their cards at checkout line machines and the information was transmitted to banks for approval.

[Keymaker]

There are many methods to acquire credit card numbers...

The POS (Point of Service) could be hijacked. With the right hardware, an employee and one or more accomplices, every card swiped can be captured. However, there may be a more sophistication here.

I Personally think it's the shty software.

It's like advanced phishing...

[SeanC]

To get a large group of numbers, that's the easiest way. Break into the database.

Now-a-days, you get chips put into POS terminals to skim Track 2 (the data on the magnetic stripe of your card) with only the swipe in the terminal and record the PIN number entered.

So it can be done right in front of the customer and they'd never know.

But pulling it in transit shouldn't be possible since all they should get would be encrypted data strings. In Canada, the minimum encryption is using a 16 or 32 character key called a DES key. Since DES has been cracked, there's a forced move to 3DES (Triple DES) which means there are 3 separate 16 or 32 character keys used to encrypt. The data is encrypted by the first key, then that result is encrypted by the second, then that result is encrypted by the third.

With current computer technology, it would take several thousand years to crack 3DES.

So either their terminals were using DES or it was stolen by an organization that has the tech to crack DES.

[Keymaker]

It was at the software level....

It's their "shty software" which allowed the breach.

Were the numbers in plain text when acquired? That is the question...

[SeanC]

Oh okay. Then it's the FI's fault. The store data should be encrypted, even on their servers. The only place it gets unencrypted temporarily is at the FI (bank) data centre.

If, somehow, the store's servers had unencrypted data, then it's their fault and they should be sued and put out of business. In Canada anyway, a store cannot store unencrypted financial data on any server they have. Banks can but they have massive data security, physical security, network security and auditing measures they have to follow to be able to do business in Canada at all.

[EXreaction]

Security is such a problem these days...

Which is why I plan to create a company focused on security in a few years after I get some schooling.

Companies really need to start giving a damned about their customers data, and need to be held accountable in the case of their security being breached.

I've just been having some trouble with my stupid bank's online stuff. Apparently they only allow passwords to be up to 8 characters long, and who knows if the passwords are even hashed or the data is encrypted.

[osprey4]

Ayup, been to Hannafud many'a time.

Possibly for the last time.

[SeanC]

Originally Posted by EXreaction

I've just been having some trouble with my stupid bank's online stuff. Apparently they only allow passwords to be up to 8 characters long, and who knows if the passwords are even hashed or the data is encrypted.

The data had better be encrypted. The banks make little processors like my company follow every little rule to the letter so they had better not be hypocrites about it.

At a minimum, you card number should be masked (ie: only last 4 numbers are clear, the rest is just asterisks like this "************1234" or something similar. Your PIN is only supposed to be stored as an encrypted hash.