Evan Schuman's StorefrontBacktalk

Wait, recycling bins? Yes, 100 very high-class recycling bins outfitted with large, Internet-connected digital screens that show advertising (the financial district's government—yes, it has its own government—gets 5 percent of the airtime to display public announcements). But recently Renew added a new feature to a dozen of the bins: the ability to capture any passing smartphone's unique MAC address if it has Wi-Fi turned on. (Which, these being financial-district yuppies, is pretty much a given.) You can see the possibilities—but not necessarily all the possibilities that Renew sees.Read more...

Harbor Freight itself isn't saying much except that it hired Mandiant to investigate and that the malware has been found and blocked. But card issuers and card brands are now sending out advisories about possibly compromised card numbers on nearly a daily basis, according to BankInfoSecurity, which has been tracking the breach. And it's only in the past two weeks that fraudulent transactions linked to the breach have begun to increase significantly—suggesting that the card numbers are just now beginning to be sold to cashers.Read more...

While this is good news for merchants and bad news for banks—or will be, once the new lower-fee rules are in place—how much the good news is worth depends on how much a debit card transaction costs, writes Legal Columnist Mark Rasch. And just as important is who gets to decide what a "cost" is.Read more...

This should be a really good idea, and maybe even a good product for some chains if it's implemented right (we haven't seen details yet). But let's imagine it is: The PINpad belongs to the service provider. Card data is encrypted and transferred via the service provider's network, not the merchant's. A token is kicked back to the store POS with the card approval, so the merchant can track customers and meet branded-cart transaction detail requirements. No card data ever comes near the merchant's systems. What could possibly be wrong with this plan?Read more...

That kind of rogue IT activity isn't new, and IT departments in and outside of retail have been dealing with it for decades. What's different is the scale. "Hardware" used to mean a leased minicomputer sitting in a closet, running some specialized application cheaper than what IT would charge. Now CMOs are spending enough to create their own miniature IT shops, and the first the real IT shop will hear about it is after a catastrophe so bad that marketing can no longer hide it—which, with an in-department IT budget that big, can be one heck of an IT catastrophe.Read more...

Remember that SAP exec who last year was arrested for slapping fake barcodes on products within a Target—and his defense was that he was simply testing his company’s systems? Seems he cut a plea deal this month with county prosecutors in California, agreeing to plead guilty to one burglary count. The plea deal recommends to the judge a sentence of one month in jail, five months of home detention and three years of probation.

If he was really just testing SAP systems as his lawyer argued in court, this suggested sentence and conviction might be unwarranted. But Thomas Langenbach, VP at the SAP Integration & Certification Center (ICC) at SAP Labs at the time of his arrest (LinkedIn still has him at SAP in that role), was said by police to have then sold the merchandise on eBay. If true, that rather strongly undermines the pure research defense. East Inflatable Rentals…

But this means that when the technology fails, it is the consumer who must suffer the consequences, writes Legal Columnist Mark Rasch—when ordinarily the risk of loss would have remained with the merchant. And he has more than a few day-to-day examples to make the point.Read more...

If that sounds a bit familiar, it may be because Schumer was saying back in November 2011 that he was going to call the FTC because two shopping malls were tracking customers by way of their phones. It only took him 20 months to get around to it. And in light of the fact that the FTC has been warning retailers for almost a year not to engage in surreptitious tracking—and is getting increasingly aggressive in its efforts—Schumer seems like he's a wee bit behind the curve. He also doesn't seem to have thought through his proposed send-an-opt-out-message solution. But we're sure he'll get around to explaining all that—in another 20 months or so.Read more...

Then it was more like 10 percent of all phones. Now it turns out that, in the U.S. at least, SIMs that use 56-bit DES encryption—the security weakness that the attack depends on—haven't been sold for "at least seven years" by T-Mobile, "nearly a decade" by AT&T, and never by Verizon or Sprint. That means there's still a potential risk to any customer with a decade-old phone, but there's probably not enough of them to make them worthwhile targets for thieves. That makes Nohl's talk at Black Hat this week in Las Vegas interesting, but largely academic—which is exactly the way we prefer our cyberthreats.Read more...

But a sharp-eyed Washington Post reporter noticed an oddity in the indictment that has less to do with cops and robbers than with mag-stripe and chip-and-PIN: Stolen European card numbers were sold for $50 each, while U.S. numbers fetched a mere $10.Read more...

According to a class-action lawsuit that was moved from state to federal court last week, when a Pennsylvania customer uses a two-for-one coupon, Walmart charges sales tax on both items, but it's only supposed to charge for one. Because Walmart gets to keep 1 percent of the sales tax it collects as a collection fee, the chain is being accused of unjust enrichment from every coupon sale it has made since June 2007.Read more...

He had just wrapped up onsite PA-DSS validations with his PA-QSA this month and a question came up about PA-DSS Requirement 4.2.7, which aligns with DSS Requirement 10.2, which is all about user access. Ames' QSA tells him that PA-DSS Requirement 4.2.7 is now always in scope, regardless of whether or not there is a user database within the application. Both of these options would cause application vendors to take on more liability. He searched the PA-DSS for a security requirement that aligns with PCI DSS 11.5 – File Integrity Monitoring – and there is none. Ames is certain that most application vendors would not take responsibility for file integrity monitoring at merchant sites. He can't understand why the SSC is forcing that upon application vendors when they don’t even have that requirement written into the PA-DSS.Read more...

Everything went fine except that she apparently did a one-character typo in the e-mail address. I didn't discover this until a half-hour later when no confirmation note ever arrived. Using the order confirmation that she gave me, Customer Service was able to identify the order and spot the e-mail typo. Great! Except that Best Buy's fraud procedure locks them out from changing the e-mail address. Wait a second. Best Buy now knows that the address is wrong and further knows that my sensitive order information is going out to someone else (assuming that typo-ed address belongs to a real person). Not only can't they fix it, but they tell me that additional mails will go out to that incorrect e-mail address no matter what. Oops!Read more...

Late last year, the chain decided to move its data center from an in-house facility to a purpose-built data center campus in another part of the United States. The goal was to gain additional raised floor space, energy efficiency and to avoid significant natural disaster risks with the location of the existing data center. In the QSA's review of the new data center, it was seen as a model of energy efficiency and modern design of data centers. So far, so good. But when the QSA returned for the annual PCI assessment, a review of the core switch and the layer 3 ACLs (Access Control Lists) revealed that all of the switch’s ACLs have been disabled—commented out—for both data centers. The formerly segmented network was totally flat with no segmentation.Read more...

In a handful of jurisdictions, the mere possession of such devices is illegal. What the vendor, San Diego-based Indyme, is pushing is a silent system that alerts LP that a foiled bag (calling it a "booster bag" is so clichéd) or magnet has entered the store and it flags the shopper and allows the shopper to be tracked, hopefully discretely. It also triggers security cameras to follow the shopper.Read more...

MasterCard lawyer Thomas Sharpe argued to the Luxembourg-based court that "the effect of the commission’s decision is to require MasterCard issuers to continue to provide valuable services to merchants such as guaranteeing payment to them without being able to recover any revenues from those merchants for those services," according to a Bloomberg reporter who attended the hearing. But in an interview right after the hearing, another MasterCard lawyer, associate general counsel Carl Munson, said, “If we win this case, we would be free to set any fees we want." (No need to call your physician, Mr. Retailer. That involuntary shudder is quite normal.)Read more...

Motorola doesn't have any real use for YouTube passwords, of course. But the fact that it's collecting them anyway suggests that whoever designed the software is really unclear on the security problems in slurping up data by default. Ironically, the one kind of data security that retailers are most concerned about, PCI, isn't strictly an issue if a customer uses a Droid X2 for mobile commerce, since the data leak is out of PCI scope—it's on the customer side. But a chain's employees might be sending their passwords to critical systems using a Motorola phone too, potentially exposing all the chain's systems to attack.Read more...

Over the past decade, Council officials, retail IT people and QSAs have begun to question the quarterly requirement, but the fear was that retailers would simply not do it, as they could never cost-justify it, particularly for Level 4 retailers. The council has always had a strong pragmatic nature, weighing the effectiveness of guidelines against what they could realistically hope for retailers to do.Read more...

The question, then, is whether it has to start in-store. What if this hypothetical chain pushes some attractive incentives to get lots of customers and prospects to download its free mobile app? And buried in the terms and conditions is the right for the app to monitor images? The next selfie or Snapchat that the shopper sends is captured and the facial data points are noted. Here's where it gets even freakier. Once the mobile app has identified the face of the shopper—and has linked it to whatever mobile shopper that customer has done—it can tell the in-store camera databases what to look for. When that shopper walks in, it can connect the mobile activity with any observed in-store activity.Read more...

Slingshot, the third-largest ISP in New Zealand with about 10 percent of the market, last week rolled out its Global Mode service, which lets users block Internet geolocation. That's used by many digital content providers to prevent movies and e-books from being viewed in regions where they haven't officially been licensed.Read more...

In what has become a trend in this area of law, the federal Magistrate ruled that, when it came to bank fraud, the merchant was essentially on its own, writes Legal Columnist Mark Rasch. The answer was for the merchant to have better security, not for the bank to have better alerting procedures. The case involves the interplay between fraud, risk, loss, law and technology. Unfortunately, in this case, fraud wins.Read more...

Personally, I've never met someone who was as personable, intelligent and just plain nice as Walt. He will be missed far more than any words can convey.Read more...

It works like this: A cyberthief phones the target claiming to be from a bank and saying there's been suspicious activity on the target's card. If the target doesn't trust the caller, the thief encourages the target to phone the bank using a number the target trusts. The target hangs up—but the thief doesn't. When the target picks up the phone again to dial, the thief plays a recording of a dial tone. The target dials, but it's the thief who fields the call. From that point, it's all Social Engineering 101.Read more...

As a practical matter, though, very few consumers would bother (or even know) to ask such a question. They hear their bank say that their card is being re-issued due to something fraud-like. If a survey asks whether they have personally experienced fraud, they're almost certainly going to say yes. For retailers, this is a very key problem.Read more...

High heels present some interesting LP challenges. Not only are they easily slipped on and off without the need for a monitored dressing room, but they need to be tried on in the store, which can make typical security tags counterproductive. At the NRF Loss Prevention Conference show in San Diego on Wednesday (June 12), Tyco Retail rolled out a new EAS approach.

Tyco’s heel-friendly approach? The tag connects to the back of the heel, with an adjustable knob for different shoe styles. In theory, this shouldn’t damage the product. Tyco argues that although many shoes “have buckles, eyelets, etc, that allow retailers to easily attach” an EAS tag, a “wide variety of women’s pumps and men’s loafers don’t have a convenient place to hook an EAS tag.” As long as the thief doesn’t have a high magnetic detacher, Tyco suggests it should be difficult to remove the tag. Then again, this is a thief, after all. Hopefully she doesn’t simply steal the store’s—or some other store’s—detacher.…