Evan Schuman's StorefrontBacktalk

What made this case interesting is that the suspects are accused of having tried a new twist to credit card fraud. Typically, fraudsters take stolen credit card numbers and create bogus documents by stamping out the cards from plastic. In this case, the suspects didn't have to create bogus credit cards at all. It also meant that they weren't required to show any identification when using the gift cards.Read more...

The statement said the "attacker methodology" was to identify sites that seem vulnerable to SQL injection and that the attackers "appear to target MSSQL only." (How nice. The cyber thieves run Microsoft-only shops. Redmond would be proud.)Read more...

But GuestView PCI Columnist David Taylor says that the rules can be different for "targets" and "non-targets." And he clues us in on what those differences are.Read more...

The researchers found that 57 percent of the retailers they categorize as "laggards" in terms of adopting price localization cited their technology infrastructures as being a "gating factor" preventing them from delivering differentiated pricing. Forty-seven percent of the companies RSR labels "winners," those with average sales growth of three percent, told RSR that technology was impeding their localized pricing desires. "It's the entire technology infrastructure, particularly the integration bus," said RSR Managing Partner Paula Rosenblum.Read more...

Some 13.3 percent of respondents say 18 to 24 months, and only 6.7 percent assume it will take "more than 24 months." The respondents who "do not know" account for the remaining 18.3 percent. Those are some very sobering numbers. Do IT managers truly believe these goals, or have they convinced themselves to believe? Or were they forced to say what they really need to get their CFOs' spending authorization and now need to be consistent?Read more...

Regardless of what Best Buy ends up doing, in today's rock-bottom economy, with its mergers and bankruptcies, the retail concept of data ownership is getting quite a workout. For example, CompUSA closed its doors but has now reemerged in a very different form in Florida. And there's no telling where the petabytes (exabytes?) of customer information now controlled by Circuit City will wind up. From a privacy perspective, there are even scarier possibilities than someone's music or computer purchases falling into the wrong hands.Read more...

The number of financial institutions hit by the data breach at Heartland Payment Systems is now 440 and still rapidly climbing, according to a Thursday (Feb. 12) report from Bank Info Security. Bermuda, Canada and Guam banks were added to the list Wednesday, the story said.

That story also pointed to a wonderful Web poll (so it’s constantly updated) being done at the Independent Community Bankers of America site. Such polls are notoriously suspect, because there’s no way to verify the accuracy of answers or even if the respondents are who they say they are. With that caveat, the polls on Tuesday (Feb. 10) night showed that 83 percent of banks said they had been affected by the Heartland breach, compared with 4 percent who said they hadn’t and 12 percent who said they “don’t know yet.” Even more interesting is that the numbers overwhelmingly pointed to debit—as opposed to credit—card issues. That 83 percent figure broke down to 60 percent saying debit cards were impacted, only 2 percent saying credit cards were impacted and 21 percent saying both credit and debit cards were impacted.…

Earlier this month, CSPI published an "Open Letter to Food Retailers" in which it praises retailers such as Costco and Wegman's that mined their loyalty card data to find out, and make phone calls to, customers who bought recalled peanut-based products. Read more...

Some of these increases were substantial: The "value" of a CompTIA security certification increased 46.7 percent during the period and Cisco Certified Design Associates were worth 40 percent more, according the "2009 IT Skills and Certifications Pay Index" released by the Foote Partners research group. "Clearly, an urgent demand for talent in these areas is eclipsing broad, knee-jerk reactions to reducing budgets and cutting people, projects and purchases that have been characteristic of IT management decision behaviors in past recessions," the report says. "Those times were often marked by lack of careful forethought about the future consequences of budget decisions."Read more...

Peter Alguacil, an analyst at site monitoring company Pingdom, noted even large, global enterprises sometimes fail to renew their sites' SSL certificates. When they do, visitors are often presented with notices from their Web browsers telling them the sites are not verifiably secure for online transactions. Those customers take their credit cards and go elsewhere, Alguacil said.Read more...

The change in heart, driven by new CEO Ron Marshall, will almost immediately force Border's E-Commerce team to halt additional investments. Although the move certainly reflects a new top management strategy that does not see E-Commerce making much money for the company anytime soon—a regrettably realistic assessment—it also is part of a pragmatic strategy of pouring every possible resource into the brick-and-mortars while simultaneously implementing chain-wide—and very deep--budget cuts.Read more...

These systems illustrate the advances being made in face recognition for retail applications as the technology evolves from the realm of discussion to the reality of the store, sidewalk and mall corridor. For retailers, the goal is targeting advertising to those consumers most likely to be engaged. But the effort is running headlong into some sticky ethical questions involving personal privacy. What will happen if face-recognition-powered digital signs and kiosks are able to learn the identities of shoppers merely by scanning their faces and matching those images against known consumer images? Read more...

Kasbe, who spent more than 10 years in a retail practice at IBM before becoming the CIO at Reliance, is replacing former Sears CIO Karen Austin, who has been named to the newly created position of president of home electronics at Sears. Read more...

Heartland had tried keeping those names confidential, an effort that was succeeding prior to the Wednesday, Feb. 4 issue of The Nilson Report. That newsletter also quoted from a MasterCard alert, which provided new details about what was taken and when. Read more...

Amazon.com is quite familiar with federal investigations, but the world’s largest E-tailer is not used to being the target. In a January 30 SEC 10-K filing, Amazon’s government filing casually mentioned: “In January 2009, we learned that the United States Postal Service, including the Postal Service Office of Inspector General, is investigating our compliance with Postal Service rules, and we are cooperating.”

Not quite sure who Amazon is cooperating with, but it’s certainly not us, as both Amazon and Postal Service officials refused to comment on the probe. Although there are quite a few specific mail no-nos that might spark such a probe—such as distribution of child pornography or narcotics or other illegal items—postal inspectors are a great catch-all federal law enforcement tool. Can’t prove that a thief stole something? Charge him with mail fraud for shipping it to someone else. Or, the investigation could even be enforcement of a very old still-on-the-books law that—believe it or not—makes it a federal violation to use someone other than the U.S. Post Office when there is no business need for something to move through an alternative carrier, such as FedEx or DHL. …

PCI Guestview Columnist David Taylor opines that he has run into several different situations where retailers have rejected the use of security controls and reporting tools that would improve both their effective security and their awareness of threats. They turned down these technologies because buying them would have "made" the retailers non-compliant with PCI. Both the real and the perceived issues of this situation must be explained.Read more...

In a new report, the Pew Internet and American Life Project says said 38 percent of teens reported they bought something online in 2008. A similar study conducted by Pew in 2005 found that 41 percent of teens were involved in online shopping. Is it a trend? Will it carry forward to when the youngsters grow up?Read more...

Sitemorse reviews and ranks sites on several parameters, including function, accessibility for the disabled, code quality and performance of each site's first 125 pages. It ranked amazon.co.uk 104 out of the 109 sites tested, giving it a measly 1.26 points out of a possible 10 and finding that the site required "urgent attention" because its shortcomings posed a "significant business risk" in function, accessibility and code quality. Read more...

Demonstrating again the downside of consumer product reviews on E-commerce sites, it was reported by The New York Times that some flowery comments on Amazon.com about the Carbonite online backup service were penned not by a happy customer but by an ethically-challenged Carbonite marketing guy. The revelation came shortly after news that a bold Belkin employee was actually paying people to write phony positive Amazon.com reviews about Belkin networking equipment.

Amazon says it has systems that aim to prevent this manipulation. We’re not suggesting that Amazon is at fault here and we should point out that the world’s largest E-tailer is going to attract the most fraud attempts. That said, there are ways that Amazon could make it more difficult to game their system, at the cost of making honest comments taking more time to post. There’s also the labor cost of verifying that the posts are legitimate.…

The financial blog quoted a well-placed security consultant, who apparently had direct knowledge of one of the Heartland probes, saying: "This was an 'I told you so' moment for me. I know exactly which part of the process got hit. It was the un-encrypted Point-to-Point connection, which occurs between the Host Security Module (HSM) and the Application Security Module (ASM). But that means that they had to have had a hole in their firewall to insert the sniffer into unallocated disk space."Read more...

Wal-Mart? Yep, the number of Americans who watched the events on Wal-Mart TV was almost half as many who saw it on MSNBC and almost a third of those who watched Fox. Those numbers nicely illustrated the massive reach that in-store retailers are finding with video, especially POS-situated videos for captive consumer audiences. And online is even stronger.Read more...

But, GuestView PCI Columnist David Taylor argues, how long is a "point in time"? And is there any way to make that point in time last longer, so that a "state of compliance" can persist for months--or at least until the next "point-in-time" review?Read more...

Prior to the ACMA decision, formally published Jan. 15, 2009, RFID devices were limited to one measly watt in Australia. Boosting the power of RFID readers will allow retailers to use fewer of the devices and enable the units to process more simultaneous data.Read more...

This tactic is hardly new, as many chains—including Price Chopper and Wegmans—have been doing this for at least a year and several very large retailers are exploring it. But Costco is the largest retailer to have launched it on such a large scale.Read more...

"A significant portion of the sophistication of the attack was in the cloaking," Baldwin said. Payment security experts pretty much agreed that hiding files in unallocated disk space is a fairly well-known tactic. But it requires such a high level of access—as well as the skill to manipulate the operating system—that is also indicates a very sophisticated attack. One of those security experts—who works for a very large U.S. retail chain and asked to have her name withheld—speculated that the complex nature of the hiding place, coupled with the relatively careless leaving of temp files, could suggest a less-skilled cyberthief who simply obtained some very powerful tools.Read more...