B&N reports card data breach in retail stores

[PainMike]

Thought to put a little heads-up though 'Barnes & Noble website, Nook e-reader and Nook mobile apps were not affected', so hopefully this is kinda

http://www.reuters.com/article/2012/...89N05L20121024

[mycurlylocks]

Great info, thanks. I had to check the list. Thankfully, I'm safe.

[Ekaros]

Interesting attack vector... Still your system is just safe as it's weakeast link...

In the first place there should be able to replace this stuff...

[Pomtroll]

Thanks for the info. Thankfully we are not in one of the states.

[elemenoP]

This happened at a little falafel joint near me, where an employee was skimming CC numbers (obviously the scale of that endeavor was a lot smaller!). He's in jail now. When people get freaked out about using their CC online, I wonder if those same people give it a second thought when they hand their CC over to a store clerk or waiter. I wonder if there are statistics about which is safer.

eP

[elcreative]

Originally Posted by Ekaros

Interesting attack vector... Still your system is just safe as it's weakeast link...

In the first place there should be able to replace this stuff...

Quite a common attack vector... been used at filling stations and supermarket chains in the UK... serious weak point - the guys who deal with the readers from manufacture to in-use servicing...

[taustin]

Originally Posted by elemenoP

This happened at a little falafel joint near me, where an employee was skimming CC numbers (obviously the scale of that endeavor was a lot smaller!). He's in jail now. When people get freaked out about using their CC online, I wonder if those same people give it a second thought when they hand their CC over to a store clerk or waiter. I wonder if there are statistics about which is safer.

eP

Last I heard (and it's probably shifted somewhat since then, it's been several years), you were about 5 times as likely to have your card number stolen at a brick & mortar retailer, and the average theft was about 10 times as much.

The most likely place is a restaraunt, where employees are very poorly paid, often treated like crap by both customers and employers, and everybody has to have access to the machine that stores everything.

One friend of mind initially freaked out at the idea of the pads that electronically capture your signature. Thing is, with paper signatures, every cashier has access. With the electonic systems, there's maybe one or two people in the entire company that have access, and they are executives with little incentive to steal.

Speculation is that this is organized crime, and that's certainly possible. But I'd be a little surprised if it turned out there weren't some kind of inside man at either B&N or their vendor for the point of sale equipment. It's hard to image a random outsider swapping out cash register parts at over 60 locations an nobody noticing.

[QuantumIguana]

We really have to get out of the stone age. There are a lot more secure means of payment that could be used. Smart cards that where there is mutual authentication between the card and the system on the other end before any transaction took place. With that, just knowing your card number wouldn't allow someone to rip you off.

[Ekaros]

Originally Posted by elcreative

Quite a common attack vector... been used at filling stations and supermarket chains in the UK... serious weak point - the guys who deal with the readers from manufacture to in-use servicing...

Ah I understood from some other article that they replaced whole device, but this is simple indeed...

[taustin]

Originally Posted by QuantumIguana

We really have to get out of the stone age. There are a lot more secure means of payment that could be used. Smart cards that where there is mutual authentication between the card and the system on the other end before any transaction took place. With that, just knowing your card number wouldn't allow someone to rip you off.

Smart cards are better, but there isn't a system out there that hasn't been cracked under real world conditions.

Current standards in the US are going away, though. There's a new system (using smart cards) that will be essentially mandatory within the next few years that will involve everything being encrypted on the card, so that the merchant never has access to all the information needed for the transaction. The will eliminate one major point of failure (and would have prevented this breach), but instead the criminals will concentrate on breaking in to bank computers (where they can steal millions of cards' worth of info at once) and malware for smart phones (which will be able to serve as smart cards under the new system) to steal them one at a time in an automated system.

[haydnfan]

Thanks for the headsup. I'm glad that the local BN here is not on the list.

[QuantumIguana]

The perfect shouldn't be the enemy of the good. What we have now is just broken, and there are much better alternatives than the stone age stuff in common use.