Among the changes are a centralized search box, new categories and comments that are much more easily accessible.Read more...
Malware has two countervailing trends, both likely to continue. The first is that there is a rapidly growing market for highly automated malware that uses basic building blocks and can be easily adapted to identify and exploit new vulnerabilities. This malware exploits unpatched servers, poorly defined firewall rules, the OWASP top 10, etc. It is really aimed at the mass market--SMEs and consumers. Then there is the high-end malware that employs the "personal touch"--customized to specific companies and often combined with social engineering to ensure it's installed in the right systems. This type of malware got TJX, Hannaford and now Heartland.Read more...
Early on Tuesday (Jan. 20), Heartland issued a statement saying that it had been "the victim of a security breach within its processing system in 2008." But it didn't take long for some of those initial details to fall apart.Read more...
When we recently heard of one such startup, an Atlanta company called Transaction Tree, whose products allow retailers to offer E-mailed receipts instead of receipts printed on paper, we wondered how that would work. Who hasn't been the victim of lost, sent-to-the-wrong-address or spam-bucket-swallowed E-mails? Read more...
It's the Great PCI divide: The Dids and The Never Dids. The problem with this divide is that the retailers who need PCI's guidelines the most are the ones most likely to be put off by the guidelines, seeing them as unreasonably demanding and expensive.Read more...
VDC is now slashing its RFID projections for this year by a billion dollars, with growth rates “no more than 9.2 percent over 2008 levels.”
The new figures, according to RFID Update, are attributed entirely to the economy. “There is still going to be growth. It is going to slow significantly, but there isn’t going to be a contraction,” said Drew Nathanson, VDC’s director of research operations.…
Once PCI is assigned (still, for the most part, to IT), most people in the company assume that it's "done." Read more...
The common refrain was not how new retail technology can boost revenue but how it can slow the ongoing bleeding. Despite the absence of any single regal retail rollout, the more than 100 products and services introduced at the show did tend to cluster in groups. And those groups—not coincidentally—reflected today's difficult economic climate.Read more...
But the crime fighter's statement only deepened the mystery around an incident that is expanding daily, in terms of both potential scope and the number of factual contradictions that permeate the case. Read more...
As mobile payments try to pick up steam in the United States—an economy that today can be described as remarkably steam-free—retailers are mixed about whether mobile payments are indeed viable. But one vendor is trying a new tactic: bypassing telecom carriers by directly using Bluetooth for transactions.
A nice piece in the American Banker details the ways that Bluetooth could be easier to deploy than near field communication (NFC). Much of the problem in the United States is financial and working out compensation plans that please telecom carriers, phone manufacturers, credit card companies and retailers. Getting even two of those groups to cooperate is difficult enough.…
A key suspect in the TJX data breach case has been sentenced to 30 years in prison, but it has nothing whatsoever to do with the TJX case.
Maksym Yastremskiy was charged in Turkey with breaking into Turkish bank accounts electronically. During the hearing where he was sentenced to 30 years, he said that a laptop computer found in his hotel room containing bank information belonged to a friend. “I am innocent. I didn’t do anything to break bank accounts. Somebody else did it, not me. I want to be released from the jail,” he told the judge, according to The Boston Globe.…
Security vendors are always fond of releasing the most extreme estimates of data breach costs, to justify an ROI argument for retailers paying them a lot of money. But retailers can contact consumers in very cost-effective ways and can often get communication help from others involved, such as the card brands and the processing bank.Read more...
About 37 percent of those largest retailers now accept at least one of the three largest alternative payment services. Only six of those retailers—Toys R Us, Sports Authority, Rite Aid, Petsmart, NHL and Dick's Sporting Goods—accept all three forms.Read more...
Sears and OfficeMax join TJX and McDonald's as having settled—or agreed to settle—their roles by agreeing to license the technology from Card Activation Technologies.Read more...
Microsoft will use the show to roll out its version of smartphone-readable 2-D barcodes. Redmond's approach with "Microsoft Tag" brings multiple colors into those barcodes, which allows them to be 50 percent smaller but still more easily and reliably read than today's 2-D barcodes, said Kevin Kerr, Microsoft's worldwide retail technology strategist. Other rollouts will include virtual makeup mirrors, virtual customized music creation and wireless debit devices.Read more...
But, GuestView Columnist David Taylor argues, there is another option that offers the potential to let someone else "do the dirty work" of PCI: Using payment gateways to mask non-compliant payment applications. Be forewarned: That's a very dangerous game. Read more...
Can an RFID chip be made uncloneable? No, but one Palo Alto vendor is arguing that it’s gotten quite close.
The vendor’s position, according to this well-done NetworkWorld story, is to “create multiple PKI-like key pairs based on integrated circuit impurities so that a given chip will always respond to a particular stimulus in a predictable way. And, because it’s the impurities in the silicon that cause this effect, it’s impossible to create a chip that will respond to a specific stimulus.” For one possible future of RFID, it’s worth a read.…
If you’re going to be at the NRF show in Manhattan next week, please drop by our Monday (Jan. 12) panel on security, featuring security execs from Reitmans, Beall’s and Big Lots, along with the former head of the U.S. Justice Department’s computer crime and StorefrontBacktalk’s own David Taylor. Evan Schuman will moderate.
The panel discussion, scheduled to start at 4:30 PM in Hall A, Room 1A, will open with a question about whether retailers, in this bad a recession, will need to rethink how to fund—and possibly whether to fund—PCI efforts. But the conversation will also cover non-IT security issues, such as crowd control, looking at very different Black Friday disasters involving Wal-Mart and Best Buy, plus loss prevention strategies.…
But questions quickly surfaced. For example, retailers have specific systems designed to catch multiple identical transactions from the same account. Why, then, didn't the Macy's system catch anything until some accounts were charged two and even three times? One Macy's manager familiar with the incident said it involved a Macy's payment processor and that the connection with the processor "was experiencing a slowdown that day due to traffic or systems issues. When that slowdown occurred, that's when the double charges occurred." Read more...
The thought that eBay's purchase of Bill Me Later would kill the Amazon deal is hardly new, with one party involved with the firms saying back in October that "the Amazon and Bill Me Later relationship is dying if not dead already." But the history of Amazon and Bill Me Later dates back a year, when Amazon announced in December 2007 that it would accept Bill Me Later as a payment option at some point in the future.Read more...
For years, Google has given its Google Checkout service to retailers for free, as long as they bought ads on Google. Alas, no more. Explained one Google manager: “Why have it as a loss leader if it’s doing OK? We saw very healthy results after we decided to charge for the service.”
The change of heart—covered quite well in this Investor’s Business Daily story—is part of an overall cost-cutting program at Google. “They are cutting back on things like their free cafeteria hours, subsidies of their on-site daycare, so trimming subsidies to their merchant partners is no doubt part of that belt tightening too,” Forrester Research Analyst Sucharita Mulpuru was quoted as saying.…
As retailers debate how much they truly want to embrace mobile payment efforts, the Mercator Advisory Group is reporting that the tide will soon become unavoidable.
Mercator is now forecasting that smartphone-based remote mobile payments will reach $389 million in 2009, $1.7 billion in 2011 and $8.6 billion in 2014.…
A handful of retailers—including 1-800-Flowers, Jos. A. Bank, Planet Hollywood and Overstock.com but excluding any of the top 100 brick-and-mortar chains—went along for the ride, pledging discounts to be beamed to T-Mobile customers using Chase Visa and debit cards.Read more...
Office Max topped IHL's list of consumer electronics retailers in terms of lost sales due to out-of-stocks, locked cases (with no help in sight) or staffer inability to find stuff supposedly in inventory. But Office Max certainly wasn't alone in the research company's hall of shame, with Office Depot and Circuit City keeping it company.Read more...
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
