Evan Schuman's StorefrontBacktalk

Sometimes satire gets so close to reality that it’s unsettling. ‘Tis the case with a piece that The Onion ran Tuesday (March 2) about Google’s data mining and privacy efforts. The article described Google’s efforts to assure consumers that it protects their privacy. But as Google attempts to make its case, more confidential data slips out.

According to the satirical piece, “While admitting that security measures need to improve, Google officials also claimed that everyone makes mistakes, be it storing confidential data indefinitely or, say, ‘having a few too many drinks on the evening of Jan. 23, driving home in a haze, striking a pedestrian on the corner of Mercer and Cavendish, speeding off, and then desperately searching online for hit and run laws, right, Karen?'” Well worth a read.…

Think video store, convenience chain, 24-hour restaurant and gas station. Hacking away out of boredom is a very different profile from someone looking to harm the chain or even steal something to sell later.Read more...

"Currently, 42 mission-oriented applications run on a 1980s IBM mainframe with a 68 percent performance reliability rating. Networks, data systems, applications and IT security do not meet current operational requirements," said an Oct. 16, 2009, Secret Service contracting memo. "The IT systems lack appropriate bandwidth to run multiple applications to effectively support USSS (U.S. Secret Service) offices and operational missions around the world."Read more...

But one group of cyberthieves in Utah—as yet uncaught—has hit about 200 gas stations in that state with a toothy tweak: Bluetooth-y, to be precise. By arming their skimmer with a Bluetooth transmitter, the stolen card data was beamed out indiscriminately to anyone nearby—make that very nearby—who happened to choose to listen for it. When such a device is found by law enforcement, it reveals nothing to point to the thieves' location—past or present—and nothing to even indicate how long it's been there. The devices in the Utah case had no local storage whatsoever, police said; they simply grabbed the data and instantly beamed it away.Read more...

Amazon has steadfastly pushed back against state tax efforts, primarily by canceling affiliate relationships in states that try to hit up its affiliates for sales taxes. The states feel they can take this approach because, although Amazon might have no physical presence or storefronts, the same isn't true for affiliates.Read more...

"The product now doesn't disappear from your mind after it’s sold. It actually just begins a different lifecycle," said Larissa Hall, the Best Buy general manager in charge of the consumer end of Best Buy's new venture. "Why let eBay have all the fun? You don’t throw away a car when you're done with it. Even a broken DVD player is worth something."Read more...

Such a system obviously can’t be unleashed on the Internet. Consumers will not tolerate a system that is difficult to use. For chains, the challenges often come from tracking data in one way while marketing/selling it in another. Add to that the complexity of each franchisee having unique, local store marketing offers and the responsibility for its own pricing, and what seems very simple can quickly become very complex.Read more...

What is the business case for using an Internal Audit instead of a QSA? Could the training—whether for a Level 1 or a Level 2 merchant—be used to build on or supplement a QSA? That is, will the Merchant QSA training be most useful to merchants as a valuable accessory rather than an entirely new PCI wardrobe?Read more...

The settlement against five-year-old ControlScan said that "contrary to the statements" ControlScan made to retailers, the company "in many instances conducted little or no verification of the privacy and/or security protections for consumer information provided by companies displaying its Business Background Reviewed, Registered Member, Privacy Protected and Privacy Reviewed seals. Instead, in many instances, ControlScan provided the Registered Member seal to a company that failed to qualify for the Verified Secure seal because an electronic scan of its Web site identified an actual or potential severe vulnerability on the Web site and permitted the company to display the seal indefinitely while taking no action to assess whether the company was working to resolve any vulnerability identified by the Web site scan."Read more...

This problem is likely going to get much worse as the efficiencies of cloud computing tempt companies to place the contents of server after server on the cloud for faster and easier access. Easier access is certainly right, but for whom? But cloud computing is not the only new target for security holes. Mobile computing and especially M-Commerce have an even greater potential for issues. Beyond the inherent breach possibilities with anything wireless, retailers are going to feel the need to push more functionality onto these consumer devices.Read more...

My thanks to Bruce Schneier’s wonderful security blog for finding this link, which is actually an unusually funny video of Hitler complaining about cloud computing security problems, pointing out that the Nazi’s provider had been certified PCI compliant.

Although the whole video is quite funny, you really should stay for the last line. I don’t laugh out loud much, but this surprise ending got me. …

This month, an electronic message started appearing on automatic deposit machines telling investors that the machines were being "decommissioned" early this year. Some store associates added that the timing would be more like May or early summer. At first, this seemed an ordinarily unusual move, as few chains that have made the investment in self-service machines (Fidelity started rolling them out 10 years ago) bother to yank them out. But then Fidelity tried to explain the move, and what seemed merely unusual became positively surreal.Read more...

For the mysterious data breach crime folder, the U.S. Secret Service is investigating a series of payment card thefts—originating at an Alabama Dairy Queen—that has only been impacting debit cards. The Hanceville, Ga., police department’s Capt. Jimmy Rodgers is quoted in a local newspaper saying: “At that location, somebody has apparently tapped into the Internet server and hacked into the debit card system, and they’re printing out the customers’ debit card numbers and using them all over California and Georgia.”

This is a disturbing trend, as retailers see debit card approaches as a way to try and reduce interchange costs. It’s even more frightening when we factor in that debit cards are more likely to suffer a processing glitch—as Best Buy and Macy’s discovered last year–than credit cards and that consumers impacted by a debit card data breach are far more exposed than they would have been had they used a credit card.…

Thirty minutes of research about a person or a company can have such a big impact on the sales process that it baffles me why so few providers take the time to do it. It seems to me that “hustle” has become the exception rather than the rule in sales.Read more...

During an onsite assessment, QSAs confirm that merchants have met PCI Requirement 11.2 by examining the passing vulnerability scans for each of the last four quarters. The problem is, what if the merchant has missed a scan? If this happens, is the merchant noncompliant until it can get four quarters of passing scans? Ouch.Read more...

Target, for example, has decided that its in-house payment cards are a priority, so it's trialing a program in Kansas City that—in part—offers customers who use the card "5 percent off on every item, every transaction, everyday," Target CFO Doug Scovanner told analysts in a Tuesday (Feb. 23) conference call discussing the chain’s earnings.Read more...

In its latest financial report, Heartland Payment Systems reported that it dropped $129 million on data breach costs last year (an incident that briefly placed Heartland on Visa’s Bad Breach Boy list). The company added that it still has a reserve of $100 million for additional expenses.

As a processor, Heartland’s pain is certainly much more severe than what would be inflicted on a retailer involved in a similarly large breach. But $229 million is starting to look like real money. Think of that $100 million in the bank as sort of mad money, in the sense that it’s needed because everyone Heartland has done business with seems to be driven stark raving mad. It’s less hush money than “please don’t hurt me” money.…

Additional rules, typical for any security shop, include prohibiting passwords that are in the dictionary and certainly ones that are easily guessable. And yet, the password for the PCI DSS document seems to violate the four password rules contained in its words (that's about as quintessentially ironic as anything could get), in addition to the dictionary and guessable rules. It's—wait for it.

Read more...

When a security problem is discovered, timely response is important. So is making sure that the patch is going to fix the problem while also–hopefully—not introducing any new issues. That process takes time, and that’s OK. But someone at the Open Source Vulnerability Database took the time to see which vendor waited the longest to fix a glitch once it was discovered. No surprise: Microsoft took top honors, with an awe-inspiring 2,027 days. Yes, that’s more than 5.5 years.

Microsoft’s entry was its Microsoft Windows SMB NTLM Authentication Credential Replay Remote Code Execution. Apple was the next major name on the list, at 390 days, for its Mac SLP v2 Service Agent (slpd) Registration Request Overflow. Others who made the dishonorable list including Novell, Sun, HP and Computer Associates. The full list is absolutely worth reviewing. …

Reports from South Korea have grocers selling huge numbers of one specific line of sausages because they can be used to activate the touchscreen on an iPhone. The need for any kind of stylus for the iPhone is because the screen cannot recognize gloved fingers; the glove blocks the finger’s electrical impulses. But not just any sausage will, apparently, do. Only sausages from CJ Corp. are packaged with electrostatically charged plastic.

Let’s skip over the question of why sausages would be packed with electrostatically charged plastic. Is the Monty Python/Daily Show-caliber ludicrousness of Koreans bundled up in a cold subway car checking their E-mail with cylindrical breakfast meat enough to prompt all touchscreen manufacturers to insist that some kind of cold-weather stylus (preferably not edible) be integrated into the unit’s casing? Come to think of it, at what temperature (if any) would the touchscreen stop functioning? For doctors trying to Tweet their surgical thoughts, can the touchscreen see through rubber gloves?…

When news of the spying laptops from Lower Merion, PA, first surfaced, my initial reaction was fury. No, not at the laptop spying itself (when the Supreme Court sanctioned strip-searching students for over-the-counter medication, I gave up on school privacy). My fury: They’re giving free MacBook Pros to thousands of high school students while my kid’s school is laying off teachers.

But what’s a lot more interesting—especially given the federal, state and county law enforcement probes—is the district’s reliance on the contract that students must sign when they are issued the laptop. If that small-print defense is upheld, retailers will have a field day. Imagine laptops that will report back to the mother ship about every online purchase made, which rival’s sites are being visited and the disposable cash of that consumer (hello online tax returns and personal finance programs). With the Webcam activated, you can now see what the customer is wearing and with what accessories and even listen to what he/she is saying about it. If that case doesn’t come down hard against the school district, they will have at least completed part of their education duty: they will have taught a lot of people some new ways of making money.…

Before he offered the unsolicited advice for Amazon, Lampert penned an unusual claim: that Sears and its 20th Century catalogue business is essentially the father of E-Commerce. It's a bit of a stretch, but he makes a legitimate point.

"Sears has a long legacy in serving customers beyond physical stores. In many respects, The Sears Catalog was the 20th Century model for selling products through the mail," Lampert said, with the suggestion being that selling-through-the-mail is essentially what E-Commerce is. "To be successful, Sears had to earn the trust of its customers who purchased products sight unseen and who had to feel confident that they would receive what they purchased and, if they were not satisfied, they would be able to get their money back."Read more...

Of all the threats that make security executives sweat at night—including terrorism, profit-hungry cyberthieves, careless employees and the so-called disgruntled workers—the most dangerous and the least feared is simple capitalism. Put even more directly, the companies with the greatest ability to impact security generally have the least financial incentives to do so.

The most obvious example of this is payment card procedures. Retailers have begged the banks and card brands for years to take over card security. Given a choice between Myron’s House Of Gravel (one location) and Chase Manhattan, which do you think is better positioned to secure payment card information? But the banks and the brands have the power to refuse, we write in this week’s security column on McAfee’s blog, so it’s the merchants who have to house and protect the data.…

We're asking the question because a lot of major retailers today seem to be designing their Web apps based on the assumption that consumers are also using their desktops and that their mobile devices are simply a very temporary point of convenience. But is that how many consumers view mobile devices? What if we zero in on Gen-Y members, who seem to have an effortless natural affinity for these radiation-emitting thumb-typing mini-boxes?Read more...

If the projections of ABI Research come true, not only will global consumers spend roughly $119 billion annually through their mobile phones but that revenue will account for about 8 percent of all E-Commerce activity. Much of this activity will come from outside the U.S., though, according to ABI Senior Analyst Mark Beccue, who points out that U.S. M-Commerce hit about $1.2 billion last year while Japan alone reached more than $10 billion in 2009. European M-Commerce activity is also projected to blow away the U.S. by the end of this year.

“Mobile online shopping is reaching critical mass,” Beccue said. “In the United States, mobile online shopping rose from $396 million in 2008 to $1.2 billion in 2009. While definitions of ‘mass market adoption’ vary, a more than fivefold increase in one year indicates significant consumer interest.” …