Could Global Payments Breach Finally Kill KBA Questions?

Written by Evan Schuman
March 31st, 2012

When reports started surfacing Friday (March 30) that more than 10 million card numbers may have been compromised in a breach at processor Global Payments in early March, Gartner security analyst Avivah Litan published a delightful early detail: It seems that the cyberthieves gained access by taking over a New York taxi company’s administrative account “by answering the application’s knowledge-based authentication (KBA) questions correctly.”

We’ve been here before. Asking “security” questions based on easily discoverable or guessable answers is no longer a good idea for general consumer access, but for administrative access? You’re really protecting super-user privileges by asking for their favorite ice cream flavor? (A major telco used that protection and discovered vanilla is awfully popular. And one gang last year specialized in basic research, including “everything from Social Security number to oldest sibling’s nickname and city where the victim was married.”)

(Related Story: Visa Kicks Global Payments Off Its PCI Compliant List. Catch-22 Is In Full Force.)
Before we delve into the lack of security with KBA, let’s quickly review the preliminary Global Payments details. The first report came from Krebs On Security and pointed to Visa/MasterCard alerts “warning banks about specific cards that may have been compromised. The card associations stated that the breached credit-card processor was compromised between Jan. 21, 2012, and Feb. 25, 2012. The alerts also said that full Track 1 and Track 2 data was taken—meaning that the information could be used to counterfeit new cards.”

Krebs and Litan both reported that activity seemed to be focused on parking garages in the New York City metro area. (Litan added that cyberthieves initially seemed to be “a Central American gang.”) No initial info suggested that any major retailers were identified as a common point of purchase, which really makes this appear to be a pure Global Payments headache.

Global Payments issued its own statement Friday (March 30) that it had “identified and self-reported unauthorized access into a portion of its processing system.”

But a quote in that statement from CEO Paul Garcia, intended to be reassuring, was anything but. Quoth Garcia: “It is reassuring that our security processes detected an intrusion. It is crucial to understand that this incident does not involve our merchants or their relationships with their customers.”

Let’s take this one frightening sentence at a time. Although it’s nice Garcia is reassured that the company detected the intrusion after the fact—after potentially more than 10 million card numbers were grabbed—it’s safe to say that retailers would have been a heck of a lot more reassured had Global Payments prevented the intrusion instead. Or maybe stopped it after 8,000 or even 80,000 instances. Heck, even 800,000 or 8 million would have been an improvement.


2 Comments | Read Could Global Payments Breach Finally Kill KBA Questions?

  1. trooper Says:

    Integrating strong, managed security processes has always demanded more security-focused employees. Companies look at anything security-related as non value overhead. If they’re forced into a compliance mandate, such as PCI, it usually translates into a do-the-minimim approach, put on existing IT employees who are already over utilized doing production support (primary) work. Companies don’t consider risk -the probability, frequency and impact. Once a breech happens the response is usually in the form of an internal witch hunt and massive over-spending on a poorly planned, rushed solution to ad-hoc the gap. Companies will eventually recognize the difference between IT support and IT security, the need for both and the need to integrate both for successful implementation, management and monitoring of threat targets. As it stands now, any penny split between hiring overhead security staff and stock dividend will always go to the shareholders. It’s akin to eating yourself for breakfast.

  2. Justin Robinson Says:

    I think the death of KBA questions has been dying for quite sometime and unfortunately businesses and consumers are having to pay the price before companies take action. It’s amazing that social media and gaming companies around the globe have adopted technologies that allow their users to telesign into their account using the telephone while enterprises, financial institutions, etc sit around and let things like this happen…..


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.