Could Global Payments Breach Finally Kill KBA Questions?Written by Evan Schuman
When reports started surfacing Friday (March 30) that more than 10 million card numbers may have been compromised in a breach at processor Global Payments in early March, Gartner security analyst Avivah Litan published a delightful early detail: It seems that the cyberthieves gained access by taking over a New York taxi company’s administrative account “by answering the application’s knowledge-based authentication (KBA) questions correctly.”
We’ve been here before. Asking “security” questions based on easily discoverable or guessable answers is no longer a good idea for general consumer access, but for administrative access? You’re really protecting super-user privileges by asking for their favorite ice cream flavor? (A major telco used that protection and discovered vanilla is awfully popular. And one gang last year specialized in basic research, including “everything from Social Security number to oldest sibling’s nickname and city where the victim was married.”)
(Related Story: Visa Kicks Global Payments Off Its PCI Compliant List. Catch-22 Is In Full Force.)
Before we delve into the lack of security with KBA, let’s quickly review the preliminary Global Payments details. The first report came from Krebs On Security and pointed to Visa/MasterCard alerts “warning banks about specific cards that may have been compromised. The card associations stated that the breached credit-card processor was compromised between Jan. 21, 2012, and Feb. 25, 2012. The alerts also said that full Track 1 and Track 2 data was taken—meaning that the information could be used to counterfeit new cards.”
Krebs and Litan both reported that activity seemed to be focused on parking garages in the New York City metro area. (Litan added that cyberthieves initially seemed to be “a Central American gang.”) No initial info suggested that any major retailers were identified as a common point of purchase, which really makes this appear to be a pure Global Payments headache.
Global Payments issued its own statement Friday (March 30) that it had “identified and self-reported unauthorized access into a portion of its processing system.”
But a quote in that statement from CEO Paul Garcia, intended to be reassuring, was anything but. Quoth Garcia: “It is reassuring that our security processes detected an intrusion. It is crucial to understand that this incident does not involve our merchants or their relationships with their customers.”
Let’s take this one frightening sentence at a time. Although it’s nice Garcia is reassured that the company detected the intrusion after the fact—after potentially more than 10 million card numbers were grabbed—it’s safe to say that retailers would have been a heck of a lot more reassured had Global Payments prevented the intrusion instead. Or maybe stopped it after 8,000 or even 80,000 instances. Heck, even 800,000 or 8 million would have been an improvement.