[ISN] Technical details remain light in supermarket data breach

From: InfoSec News (alerts@private)
Date: Wed Mar 19 2008 - 22:13:06 PST


http://www.news.com/8301-10789_3-9898417-57.html

By Robert Vamos
Defense in Depth
March 19, 2008

Details remain sketchy regarding Monday's announcement of 4.2 million 
credit card and debit cards exposed at a Maine-based supermarket chain. 
However, public comments made by Ronald Hodge, CEO of Hannaford 
Supermarkets, suggest that even with recent improvements in payment card 
transaction security, there may be holes.

The standards organization, PCI Security Standards International, was 
founded by American Express, Discover Financial Services, JCB, 
MasterCard Worldwide, and Visa International. In October 2007, they 
implemented the PCI Data Security Standard (PCI DSS), which includes, 
among other things, network specifications. Dr. Neal Krawetz of Hacker 
Factor Solutions said that PCI DSS allows for the storage of card 
numbers and expiration dates on a branch server. And that's what may be 
been compromised in this case.

Krawetz said, generally, that the traffic between the cash register and 
the credit card companies is secure. The transaction often takes place 
at the cash register with the customer standing by. After the customer 
leaves the information is broadcast to a branch server.

If criminals were to target a single cash register, they would not 
achieve the volume credited to this latest data breach; to steal 4.2 
million accounts would require to a larger repository. In retail stores, 
especially in large chains, branch servers are used to collect data from 
individual cash registers and may store the data locally, regionally, or 
nationally.

That's why branch servers are becoming the targets of sophisticated 
attacks. Last summer, Krawetz released a paper (click for PDF) outlining 
that the communication between the cash register and the branch server 
is not secure. Sometimes the data from cash register to branch server is 
transmitted wirelessly over unencrypted networks, although there is not 
enough information here to suggest that is what happened at Hannaford.

Krawetz cautioned that at this point many important details regarding 
Hannaford are lacking. "The size of the compromise sure sounds like it 
could be a branch or regional server." Hodge, in his public letter to 
Hannaford customers, acknowledged that the intrusion affected the 
Hannaford stores, Sweetbay stores in Florida, and certain independently 
owned retail locations in the Northeast that carry Hannaford products.

If branch servers are to blame, recent security standards would appear 
to be lacking. The Washington Post's Brian Krebs quoted a CyberTrust 
executive, Bryan Satrin, who echoed that concern, saying that "these 
organizations can be (compliant with the credit card industry security 
standards) and still have customer data stolen."

Last March, TJX announced that 45.7 million accounts were compromised 
over a two-year period in a data breach of customer records at T.J. Maxx 
and Marshalls retail chains.


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn 



This archive was generated by hypermail 2.1.3 : Wed Mar 19 2008 - 22:21:45 PST