Card Breaches at Car Washes

http://krebsonsecurity.com/2014/06/card-wash-card-breaches-at-car-washes/

by Garbage • 12 years ago

56 43 12 years ago

krebsonsecurity.com

nwh• 12 years ago

Prolexic hosts this site which has for some reason kills connections from my entire IP address range (residential DSL).

Wonder what one of my IPv4 neighbors did to piss them off.

cbhl2• 12 years ago

I've copied the plaintext here for you.

http://pastebin.com/d4vFzJDC

cbhl2• 12 years ago

Considering how expensive point-of-sale systems are, I'm not surprised that these systems are running old, vulnerable software. Heck, there are still ATMs running OS/2 Warp in the United States; the only reason people don't hack those is because it's so obscure.

My father still uses a small pre-computer cash register to this day; I've had no luck convincing him to buy a new computerized one so he can accept credit cards.

XERQ• 12 years ago

I'm surprised these PoS systems aren't managed with automatic updates, since the merchant service providers (along with the banks) are usually the ones losing money if they get hit with chargebacks.

dfox3• 12 years ago

In europe typical deployment solves this problem (EMV is quite orthogonal to this) by the fact that card data does not touch the PoS system itself. In fact any other approach is not feasible as PoS systems themselves are invariably horrible mess of accumulated kludges and backward compatibility restrictions. And there are quite powerful economic incentives to keep this state of things. Security-wise this is one of the few situations where semi-air-gapped network makes sense (for the PoS part, with card terminals having their separate network).

aestra4• 12 years ago

I've had no luck convincing him to buy a new computerized one so he can accept credit cards

You can still accept credit cards without a new register. It's just a different machine. They don't have to be integrated.

Almost every single doctor's office accepts credit card and exactly NONE of them have a register.

The way it works is you charge the card on a separate machine, type in the total, have them sign and put the slip somewhere and press "paid with credit" on the register if it is computerized or if it isn't then just ignore the register for that transaction.

hyperion20102• 12 years ago

One of the most striking things to me is this sentence: "Trustwave and other companies that get hired to investigate breaches involving card data is that far too many point-of-sale breaches start when the thieves abuse some kind of remote access tool installed on the point-of-sale device itself."

We have an incredibly secure and successful piece of remote access software (ssh) that is used on billions of computers and yet that sentence exists. It seems that sometimes it's not just an engineering problem.

kijin• 12 years ago

SSH is no better than some random Windows-based remote admin tool if the same default password is used.

hyperion20102• 12 years ago

Ah yes of course, and the portion that I quoted didn't include this tidbit which I guess is what I was actually thinking about: “What the investigators we’ve worked with so far have been able to gather is that [the thieves] were exploiting not the pcAnywhere credentials, but a flaw in old versions of pcAnywhere,”

Then again old versions of SSH are probably equally vulnerable.

It would seem that there is no substitute for having a real root who has responsibility for the system, though perhaps the comment from nuxi7 is a simple way to engineer around part of the problem. Sane defaults or in this case an explicit lack of defaults could be useful.

wglb• 12 years ago

Well, it is better, since SSH doesn't come with a default password, and you can disable the use of passwords in SSHD.

x0x02• 12 years ago

I get the low level carders (or whatever you call them -- the folks buying card data and attempting to steal goods with it). If you're stealing $500 worth of gift cards at a time, it's not like you have many life alternatives.

But somewhere there's a series of folks that (1) engineered a symantec breach; (2) someone else either knew #1 or figured out how to get their hands on source; (3) security audited said source; (4) scanned the internet to find vulnerable servers; (5) pulled cards off those servers, and (6) sold them. It seems like there's more than enough technical knowhow here that these folks should be able to get software or security jobs, no? It doesn't seem like the card thieves make so much money that the reward / federal pound-me-in-the-ass prison ratio skews far enough.

And the more I read krebs, the more I think I should get a $2k limit credit card and use it for all purchases that aren't on amazon.

cstejerean• 12 years ago

That assumes that the people doing all of this are located somewhere where better paying legitimate jobs are easy to come by. They usually aren't.

x0x02• 12 years ago

even if they don't, they seem like they have enough technical chops that said jobs would find them...

aburan28• 12 years ago

they probably don't have a degree and unfortunately in most places across the east coast, a 4 yr degree is a prerequisite

aptwebapps• 12 years ago

"(3) security audited said source;"

You mean found the default credentials? That doesn't take much.

hga4• 12 years ago

"And the more I read krebs, the more I think I should get a $2k limit credit card and use it for all purchases that aren't on amazon."

Let me repeat my advocacy of the virtues of cash for face to face transactions. I normally carry a bit over $400 in my wallet, and almost always use cash for everything up to, say, $800, and around or above that, a check if I can.

Also rewards the retailer with the 2-3% or so in processing charges they'd otherwise have to pay.

vcherubini• 12 years ago

I generally agree, but if the retailer is large enough they almost certainly pay a percentage of their cash payments to a Brinks-like company to securely handle the transfer of the money.

eropple• 12 years ago

Cash means having to carry cash, count change, reorganize bills, so on and so forth. Checks mean having to write checks and earning the everlasting (and justified) emnity of everyone behind you in line because you're wasting their time.

Credit cards mean a swipe (debit cards add a PIN, oh noes) and indemnity against the fraud that occasionally blows up.

Cash loses. Checks lose hard.

aestra4• 12 years ago

How do you know they don't already work in computer security? People are greedy.

nuxi7• 12 years ago

"Chaves said the store owners told him the devices had remote access via Symantec’s pcAnywhere enabled, access that was granted to anyone knew the same set of default credentials."

Maybe its because The Cuckoo's Egg is what got me into this field, but I cringe everytime I hear this. Its 25 years later and we are still getting breaches based upon using default credentials.

This isn't even a hard problem to solve, you have three options: 1. Do not have a default password and prompt the user for one during setup. 2. Do not have the same default on every device, create it automagically from a serial number or something. 3. Have the system be unusable for the intended purpose until the default password is changed.

graylights• 12 years ago

A lot of these default passwords on non-consumer devices aren't user admin accounts but tech support accounts. So #1 and #3 don't work, because the user doesn't get the password.

But there is also a 4th option, the user somehow enables the support account.

burial• 12 years ago

“The clerk told me they would come into the store in pairs, using multiple credit cards until one of them was finally approved, at which point they’d buy $500 each in prepaid gift cards,”

"We have two Family Dollar stores in Everett and a bunch in the surrounding area, and these guys would come in three to four times a week at each location, laundering money from stolen cards"

You would have thought they would report them.

ljf2• 12 years ago

You might think, but a few years ago, but when credit was crazy cheap in the UK and they were just throwing credit cards at people, I had friends who would go through this process each time they were picking up a bar tab. The credit card company won't let you go over your limit and don't forget just a few years ago there was no easy way to check your limit other than waiting for the bill or calling the company.

I wouldn't be surprised if many people in the service industries still see this type of multi card roulette daily.

I can imagine if the clerk did report his concerns, he'd likely be told they were good customers so why rock the boat....

kalleboo• 12 years ago

I can imagine if the clerk did report his concerns, he'd likely be told they were good customers so why rock the boat....

Isn't the merchant liable for the chargebacks? Or in this case, who was footing the bill for this fraud?

aestra4• 12 years ago

I wouldn't be surprised if many people in the service industries still see this type of multi card roulette daily.

Worked as a cashier about 10ish years ago. Never once saw multi card roulette.

Of course once in a while some people would say "20 on this card and 10 in cash." Never seen it with more than one card though. I almost never saw people get declined, I think it happened like 5 times total. It would be highly suspicious to me, especially coming from the same person!

philoktet• 12 years ago

Yeah, but this was a "dollar store", which in the US typically exist to serve low-income areas. Unfortunately, "snitches get stitches" is a pretty common attitude in these areas. Source: years living in said areas.

josephlord• 12 years ago

Credit card numbers aren't particularly secret (if you think of all the retail staff online, on the phone and offline) that have access to them. The thing that manages fraud and keeps the value of card numbers down is the difficulty in converting card numbers to cash or goods safely and anonymously.

I'm slightly surprised that the gift cards scheme works as I don't see why there couldn't be a revocation list for gift cards circulated amongst stores that is added to when a chargeback occurs. Even if it doesn't it still exposes the criminal when buying the gift card.

dfox3• 12 years ago

Security of credit card industry is built not on hard computer security principles but on auditing and ability to point fingers. This breaks with enough levels of indirection and gift cards add such additional level of indirection.

Also gift cards have secondary (and probably more important) use for thieves. Giftcard is legitimately looking magstripe card that in many cases gets processed in same way as card payment, so you can just write stolen magstripe data onto giftcard and get something that does not raise suspicion (store clerk is not going to verify that card number matches or event that payment method matches).

Nursie2• 12 years ago

Given how easy it is to buy stolen cards, encode them onto gift cards and then use those cards to buy goods in big-box stores that can be easily resold for cash, Lavey said he wonders why old-fashioned bank robberies are still a problem.

EMV.

I know it's far from perfect, but it raises the bar considerably. You can't just clone EMV cards that way. The USA really ought to try to catch up with the rest of the world on this front.

Card Breaches at Car Washes

Related Stories