Evan Schuman's StorefrontBacktalk

Heartland had tried keeping those names confidential, an effort that was succeeding prior to the Wednesday, Feb. 4 issue of The Nilson Report. That newsletter also quoted from a MasterCard alert, which provided new details about what was taken and when. Read more...

PCI Guestview Columnist David Taylor opines that he has run into several different situations where retailers have rejected the use of security controls and reporting tools that would improve both their effective security and their awareness of threats. They turned down these technologies because buying them would have "made" the retailers non-compliant with PCI. Both the real and the perceived issues of this situation must be explained.Read more...

The financial blog quoted a well-placed security consultant, who apparently had direct knowledge of one of the Heartland probes, saying: "This was an 'I told you so' moment for me. I know exactly which part of the process got hit. It was the un-encrypted Point-to-Point connection, which occurs between the Host Security Module (HSM) and the Application Security Module (ASM). But that means that they had to have had a hole in their firewall to insert the sniffer into unallocated disk space."Read more...

But, GuestView PCI Columnist David Taylor argues, how long is a "point in time"? And is there any way to make that point in time last longer, so that a "state of compliance" can persist for months--or at least until the next "point-in-time" review?Read more...

Prior to the ACMA decision, formally published Jan. 15, 2009, RFID devices were limited to one measly watt in Australia. Boosting the power of RFID readers will allow retailers to use fewer of the devices and enable the units to process more simultaneous data.Read more...

This tactic is hardly new, as many chains—including Price Chopper and Wegmans—have been doing this for at least a year and several very large retailers are exploring it. But Costco is the largest retailer to have launched it on such a large scale.Read more...

"A significant portion of the sophistication of the attack was in the cloaking," Baldwin said. Payment security experts pretty much agreed that hiding files in unallocated disk space is a fairly well-known tactic. But it requires such a high level of access—as well as the skill to manipulate the operating system—that is also indicates a very sophisticated attack. One of those security experts—who works for a very large U.S. retail chain and asked to have her name withheld—speculated that the complex nature of the hiding place, coupled with the relatively careless leaving of temp files, could suggest a less-skilled cyberthief who simply obtained some very powerful tools.Read more...

"Why would you want to invest in technology, training, software and people when Wal-Mart can do it for you for 12 cents?" asked Louis Bianchin, senior RFID analyst and program manager at VDC Research. "The risk there is that they (Sam's Club) could have sent the wrong message to the supplier community. That is not the message the supplier community needs to get."Read more...

The adoption of contactless by a retailer of Carrefour's size "is one of the largest victories so far" and a "very positive win" for contactless technology, said Forrester Research Analyst Ed Kountz. "It's looking like we are going to see more deployments in Europe. It's also being done well in Turkey, of all places, and Asia really remains the number one market for contactless payments."Read more...

The government believes it has identified the cyber thief involved, has "pinpointed" that suspect's location and that it's outside of North America, the source said.Read more...

But within days of the Canadian Tire (CT) statement, Circuit City shut down its Web site entirely (months before closing its physical stores) and Sears added a drive-through for its buy-online-pick-up-in-store program. Is this the next growth phase for E-Commerce, or is it more of a "We can't afford anymore to subsidize this bits-and-byte annoying albatross"?Read more...

Among the changes are a centralized search box, new categories and comments that are much more easily accessible.Read more...

Malware has two countervailing trends, both likely to continue. The first is that there is a rapidly growing market for highly automated malware that uses basic building blocks and can be easily adapted to identify and exploit new vulnerabilities. This malware exploits unpatched servers, poorly defined firewall rules, the OWASP top 10, etc. It is really aimed at the mass market--SMEs and consumers. Then there is the high-end malware that employs the "personal touch"--customized to specific companies and often combined with social engineering to ensure it's installed in the right systems. This type of malware got TJX, Hannaford and now Heartland.Read more...

When we recently heard of one such startup, an Atlanta company called Transaction Tree, whose products allow retailers to offer E-mailed receipts instead of receipts printed on paper, we wondered how that would work. Who hasn't been the victim of lost, sent-to-the-wrong-address or spam-bucket-swallowed E-mails? Read more...

Dan Mullen, President of the Association for Automatic Identification and Mobility (AIM) said the proposals "could be pretty traumatic for businesses and consumers." Read more...

It's the Great PCI divide: The Dids and The Never Dids. The problem with this divide is that the retailers who need PCI's guidelines the most are the ones most likely to be put off by the guidelines, seeing them as unreasonably demanding and expensive.Read more...

VDC is now slashing its RFID projections for this year by a billion dollars, with growth rates “no more than 9.2 percent over 2008 levels.”

The new figures, according to RFID Update, are attributed entirely to the economy. “There is still going to be growth. It is going to slow significantly, but there isn’t going to be a contraction,” said Drew Nathanson, VDC’s director of research operations.…

The common refrain was not how new retail technology can boost revenue but how it can slow the ongoing bleeding. Despite the absence of any single regal retail rollout, the more than 100 products and services introduced at the show did tend to cluster in groups. And those groups—not coincidentally—reflected today's difficult economic climate.Read more...

But the crime fighter's statement only deepened the mystery around an incident that is expanding daily, in terms of both potential scope and the number of factual contradictions that permeate the case. Read more...

Security vendors are always fond of releasing the most extreme estimates of data breach costs, to justify an ROI argument for retailers paying them a lot of money. But retailers can contact consumers in very cost-effective ways and can often get communication help from others involved, such as the card brands and the processing bank.Read more...

Sears and OfficeMax join TJX and McDonald's as having settled—or agreed to settle—their roles by agreeing to license the technology from Card Activation Technologies.Read more...

Microsoft will use the show to roll out its version of smartphone-readable 2-D barcodes. Redmond's approach with "Microsoft Tag" brings multiple colors into those barcodes, which allows them to be 50 percent smaller but still more easily and reliably read than today's 2-D barcodes, said Kevin Kerr, Microsoft's worldwide retail technology strategist. Other rollouts will include virtual makeup mirrors, virtual customized music creation and wireless debit devices.Read more...

There will be 50 fewer companies exhibiting this year, bringing last year's 580 exhibitors down to 530 this year.

On the vendor side, the numbers are actually a lot worse as exhibitors will be bringing some 700 fewer employees to help out. "We will be feeling the effects of the economy," said NRF VP Susan Newman.Read more...