Evan Schuman's StorefrontBacktalk

A San Mateo, Ca., consumer was browsing Amazon.com and he saw a CD-ROM from the Discovery Channel called Cells. It only supported Mac and Win98 so it’s price was a mere $5 million more than $2.9 billion. Yes, this piece of educational software was selling for almost $3 billion, plus $3.99 for shipping. (Geez, how much does Amazon require now for Free Super Saver Shipping?) Just for the fun of it, the consumer—Brian Klug—purchased it. Not only did Amazon’s system process the item at the $3 billion charge, but it sent a clean confirmation note. Even the credit card’s limit didn’t trigger any “this doesn’t seem right” alarms. The screen captures of the purchase have been widely posted.

Posted price glitches can happen, even to as sophisticated a site as Amazon. But the fact that it went through a credit card process—the card wasn’t charged until the product arrived, but it was verified—and an E-mail confirmation suggests that this glitch is a bigger concern than it might appear.…

In tracking PCI issues within various major chains, we have seen that the differences in perception can be staggering. In an attempt to get a handle on where most companies stand, we’re putting out a small survey on usage and challenges.

As a thank you for retailers involved in PCI completing the survey, we are offering them a free autographed copy of Hacking Exposed: Network Security Secrets, which Amazon has labeled a best-seller.

[SURVEYS 2]

The denial of a preliminary injunction ruling wasn't entirely a surprise, as reports of Heartland's apparently contradictory statements had already surfaced. But when U.S. District Court Judge Mary Cooper issued a ruling in the case on December 23 that dismissed so many of Heartland's claims against VeriFone, that was a bit startling.Read more...

In what’s being described as a delayed Y2K programming issue, the move to 2010 has apparently shut down some 30 million cash and credit cards since New Year’s Day, according to data available Tuesday (Jan. 5) from the country’s three largest banking associations, according to this Wall Street Journal story. The problem was tied to a chip in the smarts that wasn’t able to properly process the year 2010.

Interestingly enough, U.S. retailers were, for the most part, spared this problem for their domestic stores because smart cards are still a minority of the cards in use. See? Being backward can have its advantages. It reminds me of a conversation I had at a restaurant tradeshow in mid-December 1999, where I was seated with the CIOs of several huge restaurant chains. When asked if they feared the weeks-awayY2K moment, all said they didn’t. “Yeah,” I agreed. “Most upgrades have cleaned up the issue.” No, you don’t understand, the CIOs said. “We’re not worried because most of our stores are still using DOS.”…

John Verdeschi, the senior business leader for fraud management at MasterCard Worldwide, said he had heard "no complaints" about the timing from retailers. "We didn't hear that as a specific issue," he said, adding that the PCI SCC's new training program was the only reason for the deadline change. Another element of the December 13 change is a little less cut-and-dry. Until about three to four months ago—Verdeschi described it as "August or September"—MasterCard had posted on its site a description of the rules for which PCI level (1, 2, 3 or 4) it would consider retailers. MasterCard described parity with any "competing payment brand," wording that it had used since 2005. But in "August or September," Verdeschi said, that wording was removed.Read more...

"Target was one of the companies affected by an intrusion that occurred two years ago. However, the exposure—both in time and number of accounts—was extremely limited," said Target spokesperson Amy Reilly. "A previously planned security enhancement was already under way at the time the criminal activity against Target occurred and we believe that, at most, only a tiny fraction of guest credit and debit card data used at our stores may have been involved."Read more...

The chain has thus far avoided some of the read-rate accuracy problems that have plagued other trials (A&P last month swore off scanning directly from cell phone screens due to concerns about inaccuracies), pointing to an approach that determines the make, model and carrier of a phone before trying to scan. It then adjusts the scan parameters to be the most effective for that particular device. But 7-Eleven is also running smack into the delicate ethics issues around mobile marketing, where chains need to collect phone numbers and E-mail addresses to begin. In this case, for example, many of the consumers being targeted are children, officially as young as 16 and potentially as young as 14. Those youngsters are mixed with a target group of young adults, as old as 24.Read more...

The first MasterCard change made this month was pushing the Dec. 31, 2010, deadline back six months, to June 30, 2011. But MasterCard has also made two other key PCI changes. It has redefined what Level a retailer is (Level 1, 2, 3 or 4) to, for the first time, mirror whatever level Visa has determined. The last of the changes is to allow Level 1 and Level 2 retailers to perform their own assessments—using the retailer's own salaried audit staff—as long as those audit staffers have passed PCI-approved training courses. "A bunch of Level 3 and Level 4 merchants just became Level 2s," said one QSA. "With this reciprocity gotcha, MasterCard giveth and MasterCard taketh away."Read more...

The chain, which has stores in 48 states in the U.S., lost its data connectivity on December 10 when the service provider made a modification that went awry. "It was an inadvertent switch to dynamic IP from fixed IP," said CIO Ray Hamilton. "That shouldn’t happen, and it took us a couple of days to resolve."Read more...

Weak security at RockYou.com, a social networking application development site, allowed unauthorized access to more than 32 million user log-in credentials stored in an unencrypted database, according to the site’s chief technology officer. The SQL injection flaw allowed access to those credentials, and because “the user names and passwords are by default the same as the user’s Webmail account—such as Hotmail, Yahoo or Gmail—this is a major lapse in security,” said Amichai Shulman, the chief technology officer at Imperva, a data security vendor that detected the problem and alerted RockYou officials, but not before the data theft had happened.

RockYou publicly acknowledged the breach Wednesday (Dec. 15), warning users to change their log-in credentials for other “online destinations” if they are the same as those used for RockYou.com. In a Venturebeat.com story on the incident, RockYou CTO Jia Shen said the problem involved RockYou’s legacy widget applications, a part of the site now closed, and he admitted the passwords had been retained unencrypted. Gartner Security Analyst Avivah Litan said retailers should view the case as a warning about the potential pitfalls of the single ID movement. “This just proves the theory that if you use an aggregator and have single sign-on to multiple sites, all it takes is a break-in to compromise your access to everything else,” Litan said. “Everybody should take a pause on these single-user schemes.”…

It boggles his mind that millions of dollars are spent each year to “secure” database lookup (authorization) and database write (settlement) transactions. Tokenization and encryption should have been required years ago. Although not all techies agree that this approach is best, I think we all agree that it is much better than nothing. But too many companies--my firm included--are going to have to spend too much money to implement such daydream adventures, so we keep living with a broken system. Unfortunately, this broken system has left franchisors with no “good” options.Read more...

Consider this example: A merchant shows its QSA its Web application firewall (WAF) and asks the QSA to mark it compliant with PCI Requirement 6.6. But the QSA probes deeper, and he finds that the WAF is in “learning” mode, which means it is letting everything through. Indeed, the WAF has been in learning mode since it was installed after the last assessment a year ago, meaning it is pretty useless from a security point of view and definitely not meeting the intent of the requirement.Read more...

The government was asking a federal judge for more time to investigate before a sentencing hearing, said the memo from Assistant U.S. Attorneys Stephen P. Heymann and Donald L. Cabell. "The government has been given no prior notice of either of these assertions, the defendant's intended reliance on expert testimony to support them or that the defendant was undergoing a psychological forensic examination." Read more...

Unlike earlier retail data breach lawsuits—typically with consumers or banks as plaintiffs—this was a shareholder action and merely needed to prove that Heartland execs mislead the public about their security status. U.S. District Court Judge Anne E. Thompson, sitting in New Jersey, concluded Heartland execs had not. She listened to recordings of an analyst call to conclude that, in full context, the processor's security claims were technically true.Read more...

From a non-IT perspective, the move would certainly discourage consumers from accepting—or even pursuing—instant credit, which has been a wonderful thing for merchants. It's unlikely that shoppers will be thrilled when asked by gum-chewing, teenage POS jockeys to whip out paystubs or a copy of last year's 1040s. Consider an analogy: The police chief who lives next door has a town ordinance passed requiring you to store in your basement a ton of heroin and cocaine that the police department has just seized. Read more...

Gonzalez agreed to plead guilty to his role in attacks on Heartland, Hannaford and 7-Eleven in a document signed at 10:14 AM New York time on Dec. 2.Read more...

It’s been almost two years since Sears become the first U.S. retailer to embrace 2D barcodes, a move that launched a tidal wave of, well, pretty much nothing. This week, Google said it was trying to breathe life into these barcodes by mailing 200,000 2D barcode stickers to small businesses throughout the country. Such a move could allow these mom-and-pops to offer in-depth marketing information to anyone at the click of a smartphone.

The Google initiative, first reported by Techcrunch, is proactive and therefore feels much more powerful than Microsoft’s efforts to market its “Tag” code idea. And Google is sweetening the potential adoption-rate odds by giving away 40,000 Quickmark 2D barcode reader apps for the iPhone. Just like contactless, which is also suffering from a heart-pounding string of apathy, 2D needs three things to happen in parallel if it is to succeed: A huge number of places that are showcasing 2D barcodes; a very strong percentage of consumers carrying phones that can easily read 2D barcodes; and plenty of publicized incentives to get those consumers to use the 2D barcodes from those retailers. The phones are well on their way, and Google’s initiative seems like a good faith effort to jumpstart the other two points.…

Still, the Shopper app, published by ReachEverywhere, suffers a variety of odd restrictions, such as limiting the recall data to two food-oriented agencies—the U.S. Food and Drug Administration (FDA) and the U.S.. Department of Agriculture (USDA)—while excluding recall-friendly agencies that would impact far more products, such as the U.S. Consumer Product Safety Commission (CPSC). It also only flags recall problems when the purchase is being made. So a customer who buys a product that gets recalled an hour after the purchase is completed will, by design, not be notified. Read more...

The four-month-long trial that began in November is significantly limited in scope, involving only BlackBerry devices. And it doesn't even involve BlackBerries with payment chips installed. Instead, the effort involves NFC payment chip stickers attached to the backs of the smartphones.Read more...

Today’s smartphones certainly promise more convenience and functionality. But for IT, these devices promise new nightmares about protecting the data they store. It’s not merely contact data, but files, slides, traffic history, E-mail records, chat transcripts and almost anything else that can be done on a desktop and synched to a smartphone. Then there’s the Grand Poobah of data protection night terrors: Geolocation.

Geolocation is the phone’s capability to tell any app on that phone—or anyone at all, really—the exact location of the phone virtually every minute it has power. Such data is relatively small in size and yet—tied into various other data points (especially time and date)—could be monstrously helpful to some while being stunningly destructive to others. But fear not, IT execs are thinking, there’s no way such data could ever get out to unauthorized places, right? Sprint this month proved otherwise, as we discuss in this week’s Guest Column on McAfee’s Security Blog.…

What many franchisees have not discovered, pens Franchisee Columnist Todd Michaud, is that the advanced integration between POS, inventory systems and video surveillance systems can be used to catch these types of activities and dramatically improve the top and bottom line. If you really want to be depressed, go to Google and type the words: “working at BRAND_NAME steal” or “how to steal from BRAND_NAME” or other variations of the same. What you find may be surprising. Many people have actually posted how-to guides for the best way to steal from a certain brand as an employee.Read more...

Most companies issue their employee road warriors with corporate travel cards. Companies also issue purchasing or procurement cards that their staff use to buy everything from office supplies to store fixtures. Most of these cards are American Express, MasterCard or Visa branded. Companies store the PANs in databases that are accessible to travelers and others who use the data for expense reporting and tracking. In my experience, the PANs get printed on hardcopy reports. The question for IT execs is, do you need to include these cards in your (merchant) PCI scope? The surprise answer is that it depends on where you store the cardholder data and, interestingly, on which brand of card you choose.Read more...

Buying items on Tesco.com, the E-Commerce site of the $84 billion, U.K.-based supermarket chain, is a bit like being a virtual marionette operator. When a Web shopper places an order, Tesco employees actually grab shopping carts and pluck items from shelves as they stroll up and down aisles in Tesco stores. Most of those online order fulfillment missions are currently conducted in busy, public Tesco markets also occupied by meandering shoppers. But Tesco is so pleased with its use of customer-free “dot-com store” installations–facilities nearly identical to its regular markets, except that are for use only by Tesco.com order-fillers–the chain plans to erect a large network of them, according to the Daily Telegraph of London.

It said Tesco now has two so-called “dark stores” up and running, one in Surrey and another in Kent, and plans to open a third, next year, in Middlesex. Laura Wade-Gery, Tesco.com CEO was reported as saying the company intends to open one new online order fulfillment store yearly “for the foreseeable future” and expects the employee-only structures will be handling 15 percent of online order fulfillment by 2014. Tesco currently processes 475,000 online orders weekly and operates a 2,000-van fleet for home deliveries, said the Telegraph.…

The case involves four Louisiana restaurant groups—doing business as Crawfish Town USA, Don's Seafood and Steakhouse, Picante’s Mexican Restaurant, Mel’s Diner Part II and Sammy’s Grill—suing their POS vendor, Radiant Systems (which owns the Aloha POS systems used by these chains), along with systems integrator Computer World (not to be confused with the publication Computerworld). But when you drill into the details of the lawsuit, it gets more interesting. One of the key accusations against Computer World is that it used vendor default passwords for systems with many of these restaurants, for easier remote administration. The lawsuit correctly points out that PCI bans retailers from using such vendor default passwords. But that's the key. It's the retailers that are not permitted to use these defaults. Was integrator Computer World, in this scenario, acting as an agent of the POS manufacturer—as a reseller—or as an agent of the retailer--as an integrator?Read more...