For The First Time, FTC Hits Hard Against Chain Breached Three Times

Written by Evan Schuman
June 28th, 2012

For almost as many years as it has existed, the Federal Trade Commission has complained about being toothless when it comes to punishing retailers and other businesses. But the FTC on Tuesday (June 26) said it has found its breaking point, when one hotel chain was breached three times—all leveraging the same unpatched security holes, more than a year apart—to the tune of some 619,000 payment cards and more than $10.6 million in fraud loss. This time—for the first time—the agency is going to trial.

The chain, Wyndham Hotels, is also accused of other supremely naughty security procedures, including storing full payment-card data in clear text, not having proper network segmentation and deploying classically bad password policies. “For example, to allow remote access to a hotel’s property management system, which was developed by software developer Micros Systems Inc., Defendants used ‘micros’ as both the user ID and the password,” said the FTC’s federal filing.

Lisa Schifferle, an attorney in the FTC’s division of privacy and identity protection, said the egregious nature of Wyndham’s actions—and particularly that it was breached and failed to fix the holes after 11 months, was breached again and again failed to fix the holes, and was then breached a third time some six months later—finally pushed the agency to take action.

“This is the first data security case that we’ll be litigating,” Schifferle said.

As a practical matter, it’s unclear how much litigating will happen, and settlements in such cases are common. But if the government opts to stand firm and to try and make an example of a chain the FTC says was recklessly handling payment-card data, it appears it picked an ideal case.

As is often with federal legal action, the core of the case is not the worst alleged behavior but the behavior closest to violating existing law. It’s not illegal in the U.S. to handle payment-card data recklessly. But misrepresentations in ads, that there is a statue for.

Hence, the feds are nailing Wyndham because of wording on its Web site. “Since 2008 Wyndham has claimed, on its Wyndham Hotels and Resorts subsidiary’s Web site that, ‘We recognize the importance of protecting the privacy of individual-specific (personally identifiable) information collected about guests, callers to our central reservation centers, visitors to our Web sites, and members participating in our Loyalty Program.'” If the FTC can prove that statement to be false, the agency has got Wyndham on fraud.

The cases involve data being siphoned off hotel servers and sent to what the government said was a domain registered in Russia. The attacks all focused on the chain’s Phoenix datacenter.

The government said one key factor was insufficient firewall protections. “As far as we know, there were no firewalls that protected the data,” Schifferle said.

The clear-text accusation was a bit murky, in the sense that the government said it was due to the chain’s software being “configured inappropriately, resulting in the storage of payment-card information in clear readable text.” Given different references in the filing, it’s not clear if Wyndham IT employees configured the software poorly or whether the cyberthieves accessed the software and made those changes—or both.

Other allegations include examples of even sloppier IT procedures:

  • One major system at the chain “was using an operating system that its vendor had stopped supporting, including providing security updates and patch distribution, more than three years prior to the intrusion. Defendants were aware the hotel was using this unsupported and insecure server, yet continued to allow it to connect to Hotels and Resorts’ computer network.”
  • “Well-known default user IDs and passwords were enabled on the servers, which were easily available to hackers through simple Internet searches.”
  • “Failed to follow proper incident response procedures, including failing to monitor Hotels and Resorts’ computer network for malware used in a previous intrusion; and failed to adequately restrict third-party vendors’ access to Hotels and Resorts’ network and the Wyndham-branded hotels’ property management systems, such as by restricting connections to specified IP addresses or granting temporary, limited access, as necessary.”
  • The filing described a brute force attack that caused 212 user accounts to be locked out due to excessive password guesses. The lockouts “are a well-known warning sign that a computer network is being attacked. Defendants did not have an adequate inventory of the Wyndham-branded hotels’ computers connected to its network, and, therefore, although they were able to determine that the account lockouts were coming from two computers on Hotels and Resorts’ network, they were unable to physically locate those computers. As a result, Defendants did not determine that the Hotels and Resorts’ network had been compromised until almost four months later.”
  • “The intruders’ brute force attack led to the compromise of an administrator account on the Hotels and Resorts’ network. Because Defendants did not appropriately limit access between and among the Wyndham-branded hotels’ property management systems, the Hotels and Resorts’ own corporate network, and the Internet—such as through the use of firewalls—once the intruders had access to the administrator account, they were able to gain unfettered access to the property management system servers of a number of hotels.”
  • “In May 2009, Defendants learned that several Wyndham-branded hotels had received complaints from consumers about fraudulent charges made to their payment-card accounts after using those cards to pay for stays at Wyndham-branded hotels. At that point, Defendants searched Hotels and Resorts’ network for the memory-scraping malware used in the previous attack, and found it on the property management system servers of more than 30 Wyndham-branded hotels. As a result of Defendants’ failure to monitor Hotels and Resorts’ network for the malware used in the previous attack, hackers had unauthorized access to the Hotels and Resorts’ network for approximately two months.”
  • This is the reference that suggests it was the attackers who made the system store files in clear text: “In addition to again using memory-scraping malware to access personal information, in this second breach, the intruders reconfigured software at the Wyndham-branded hotels to cause their property management systems to create clear-text files containing the payment-card account numbers of guests using their payment cards at the hotels.”

  • advertisement

    Comments are closed.


    StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

    Most Recent Comments

    Why Did Gonzales Hackers Like European Cards So Much Better?

    I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
    Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
    A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
    The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
    @David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

    Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.