Evan Schuman's StorefrontBacktalk

The number of financial institutions hit by the data breach at Heartland Payment Systems is now 440 and still rapidly climbing, according to a Thursday (Feb. 12) report from Bank Info Security. Bermuda, Canada and Guam banks were added to the list Wednesday, the story said.

That story also pointed to a wonderful Web poll (so it’s constantly updated) being done at the Independent Community Bankers of America site. Such polls are notoriously suspect, because there’s no way to verify the accuracy of answers or even if the respondents are who they say they are. With that caveat, the polls on Tuesday (Feb. 10) night showed that 83 percent of banks said they had been affected by the Heartland breach, compared with 4 percent who said they hadn’t and 12 percent who said they “don’t know yet.” Even more interesting is that the numbers overwhelmingly pointed to debit—as opposed to credit—card issues. That 83 percent figure broke down to 60 percent saying debit cards were impacted, only 2 percent saying credit cards were impacted and 21 percent saying both credit and debit cards were impacted.…

Earlier this month, CSPI published an "Open Letter to Food Retailers" in which it praises retailers such as Costco and Wegman's that mined their loyalty card data to find out, and make phone calls to, customers who bought recalled peanut-based products. Read more...

Some of these increases were substantial: The "value" of a CompTIA security certification increased 46.7 percent during the period and Cisco Certified Design Associates were worth 40 percent more, according the "2009 IT Skills and Certifications Pay Index" released by the Foote Partners research group. "Clearly, an urgent demand for talent in these areas is eclipsing broad, knee-jerk reactions to reducing budgets and cutting people, projects and purchases that have been characteristic of IT management decision behaviors in past recessions," the report says. "Those times were often marked by lack of careful forethought about the future consequences of budget decisions."Read more...

Peter Alguacil, an analyst at site monitoring company Pingdom, noted even large, global enterprises sometimes fail to renew their sites' SSL certificates. When they do, visitors are often presented with notices from their Web browsers telling them the sites are not verifiably secure for online transactions. Those customers take their credit cards and go elsewhere, Alguacil said.Read more...

Heartland had tried keeping those names confidential, an effort that was succeeding prior to the Wednesday, Feb. 4 issue of The Nilson Report. That newsletter also quoted from a MasterCard alert, which provided new details about what was taken and when. Read more...

Amazon.com is quite familiar with federal investigations, but the world’s largest E-tailer is not used to being the target. In a January 30 SEC 10-K filing, Amazon’s government filing casually mentioned: “In January 2009, we learned that the United States Postal Service, including the Postal Service Office of Inspector General, is investigating our compliance with Postal Service rules, and we are cooperating.”

Not quite sure who Amazon is cooperating with, but it’s certainly not us, as both Amazon and Postal Service officials refused to comment on the probe. Although there are quite a few specific mail no-nos that might spark such a probe—such as distribution of child pornography or narcotics or other illegal items—postal inspectors are a great catch-all federal law enforcement tool. Can’t prove that a thief stole something? Charge him with mail fraud for shipping it to someone else. Or, the investigation could even be enforcement of a very old still-on-the-books law that—believe it or not—makes it a federal violation to use someone other than the U.S. Post Office when there is no business need for something to move through an alternative carrier, such as FedEx or DHL. …

PCI Guestview Columnist David Taylor opines that he has run into several different situations where retailers have rejected the use of security controls and reporting tools that would improve both their effective security and their awareness of threats. They turned down these technologies because buying them would have "made" the retailers non-compliant with PCI. Both the real and the perceived issues of this situation must be explained.Read more...

Demonstrating again the downside of consumer product reviews on E-commerce sites, it was reported by The New York Times that some flowery comments on Amazon.com about the Carbonite online backup service were penned not by a happy customer but by an ethically-challenged Carbonite marketing guy. The revelation came shortly after news that a bold Belkin employee was actually paying people to write phony positive Amazon.com reviews about Belkin networking equipment.

Amazon says it has systems that aim to prevent this manipulation. We’re not suggesting that Amazon is at fault here and we should point out that the world’s largest E-tailer is going to attract the most fraud attempts. That said, there are ways that Amazon could make it more difficult to game their system, at the cost of making honest comments taking more time to post. There’s also the labor cost of verifying that the posts are legitimate.…

The financial blog quoted a well-placed security consultant, who apparently had direct knowledge of one of the Heartland probes, saying: "This was an 'I told you so' moment for me. I know exactly which part of the process got hit. It was the un-encrypted Point-to-Point connection, which occurs between the Host Security Module (HSM) and the Application Security Module (ASM). But that means that they had to have had a hole in their firewall to insert the sniffer into unallocated disk space."Read more...

But, GuestView PCI Columnist David Taylor argues, how long is a "point in time"? And is there any way to make that point in time last longer, so that a "state of compliance" can persist for months--or at least until the next "point-in-time" review?Read more...

This tactic is hardly new, as many chains—including Price Chopper and Wegmans—have been doing this for at least a year and several very large retailers are exploring it. But Costco is the largest retailer to have launched it on such a large scale.Read more...

"A significant portion of the sophistication of the attack was in the cloaking," Baldwin said. Payment security experts pretty much agreed that hiding files in unallocated disk space is a fairly well-known tactic. But it requires such a high level of access—as well as the skill to manipulate the operating system—that is also indicates a very sophisticated attack. One of those security experts—who works for a very large U.S. retail chain and asked to have her name withheld—speculated that the complex nature of the hiding place, coupled with the relatively careless leaving of temp files, could suggest a less-skilled cyberthief who simply obtained some very powerful tools.Read more...

"Why would you want to invest in technology, training, software and people when Wal-Mart can do it for you for 12 cents?" asked Louis Bianchin, senior RFID analyst and program manager at VDC Research. "The risk there is that they (Sam's Club) could have sent the wrong message to the supplier community. That is not the message the supplier community needs to get."Read more...

The adoption of contactless by a retailer of Carrefour's size "is one of the largest victories so far" and a "very positive win" for contactless technology, said Forrester Research Analyst Ed Kountz. "It's looking like we are going to see more deployments in Europe. It's also being done well in Turkey, of all places, and Asia really remains the number one market for contactless payments."Read more...

The government believes it has identified the cyber thief involved, has "pinpointed" that suspect's location and that it's outside of North America, the source said.Read more...

Among the changes are a centralized search box, new categories and comments that are much more easily accessible.Read more...

Malware has two countervailing trends, both likely to continue. The first is that there is a rapidly growing market for highly automated malware that uses basic building blocks and can be easily adapted to identify and exploit new vulnerabilities. This malware exploits unpatched servers, poorly defined firewall rules, the OWASP top 10, etc. It is really aimed at the mass market--SMEs and consumers. Then there is the high-end malware that employs the "personal touch"--customized to specific companies and often combined with social engineering to ensure it's installed in the right systems. This type of malware got TJX, Hannaford and now Heartland.Read more...

Early on Tuesday (Jan. 20), Heartland issued a statement saying that it had been "the victim of a security breach within its processing system in 2008." But it didn't take long for some of those initial details to fall apart.Read more...

When we recently heard of one such startup, an Atlanta company called Transaction Tree, whose products allow retailers to offer E-mailed receipts instead of receipts printed on paper, we wondered how that would work. Who hasn't been the victim of lost, sent-to-the-wrong-address or spam-bucket-swallowed E-mails? Read more...

Dan Mullen, President of the Association for Automatic Identification and Mobility (AIM) said the proposals "could be pretty traumatic for businesses and consumers." Read more...

It's the Great PCI divide: The Dids and The Never Dids. The problem with this divide is that the retailers who need PCI's guidelines the most are the ones most likely to be put off by the guidelines, seeing them as unreasonably demanding and expensive.Read more...

VDC is now slashing its RFID projections for this year by a billion dollars, with growth rates “no more than 9.2 percent over 2008 levels.”

The new figures, according to RFID Update, are attributed entirely to the economy. “There is still going to be growth. It is going to slow significantly, but there isn’t going to be a contraction,” said Drew Nathanson, VDC’s director of research operations.…

Once PCI is assigned (still, for the most part, to IT), most people in the company assume that it's "done." Read more...

The common refrain was not how new retail technology can boost revenue but how it can slow the ongoing bleeding. Despite the absence of any single regal retail rollout, the more than 100 products and services introduced at the show did tend to cluster in groups. And those groups—not coincidentally—reflected today's difficult economic climate.Read more...