Krebs On Security: Data Breach At Oracle’s MICROS Point-of-Sale Division

Data Breach At Oracle’s MICROS Point-of-Sale Division
Brian Krebs, August 8, 2016

A Russian organized cybercrime group known for hacking into banks and retailers appears to have breached hundreds of computer systems at software giant Oracle Corp., KrebsOnSecurity has learned. More alarmingly, the attackers have compromised a customer support portal for companies using Oracle’s MICROS point-of-sale credit card payment systems.
...
MICROS is among the top three point-of-sale vendors globally. Oracle’s MICROS division sells point-of-sale systems used at more than 330,000 cash registers worldwide.
...
Oracle’s own statement seems to suggest the company is concerned that compromised credentials for customer accounts at the MICROS support portal could be used to remotely administer — and, more importantly, to upload card-stealing malware to — some customer point-of-sale systems. The term “on-premise” refers to POS devices that are physically connected to cash registers at MICROS customer stores.

Avivah Litan, a fraud analyst at Gartner Inc., says ... "I’d say there’s a big chance that the hackers in this case found a way to get remote access" to MICROS customers' on-premises point-of-sale devices.
...

This is really ugly. If criminals have managed to use the manufacturer's maintenance access to remotely install card-skimming software into point of sale terminals worldwide, then nothing is safe.

All the more reason to use a merchant's chip reader or Apple Pay wherever possible. These technologies work with device-specific account numbers, one-time pads and encryption to make it difficult (if not impossible) for a captured transaction to be used to create a fake card or initiate new transactions. (I am aware that there are many more virtual-card technologies in use but I don't know enough about them to have an opinion about their security.)

Be sure to read the fine print

Today, while reading my morning comics, I saw an ad for a prepaid debit card with art from the comic strip on the face. I thought, "oh how cute" and that maybe it might be good in a few years when my daughter goes to college, in lieu of traveler's cheques or cash for spending.

Then I clicked on the link to see what the fees are. And OMG, was I blown away by the incredible rip-off this cute card turns out to be:

Fee	Amount
Monthly Maintenance Fee	$5.95 (Waived if you direct deposit $800 every month)
Domestic ATM Cash Withdrawal Fee	$3.00 (per transaction)
International ATM Cash Withdrawal Fee	$3.00 (per transaction)
Over-the-Counter Withdrawal Fee Domestic and International	$3.00 (per transaction)
Balance Inquiry PIN & ATM transactions, Domestic and International ATM	$1.00 (per transaction)
Card Account Closure Fee	$7.00 (Charged if a check is issued for funds on your Card Account and Card Account is closed)
Paper Copy of Statement Fee	$2.00 (per monthly paper statement requested)
CSR Express Delivery Fee	$20.00 (per card; when Card is expedited and reissued or replaced for any reason.)
Foreign Transaction Fee	2.95% (per transaction)
Replacement Card We do our best to protect you. If your card is lost or stolen, contact Customer Support and we'll immediately replace your card and ensure your funds are secure.	$7.50

So, in exchange for holding your money (without paying any interest, of course, you are expected to pay them $6 every month, plus $3 per transaction if you want to get any of your cash back and $1 every time you try to find out how much money is actually in the account. And should your card be lost or stolen, then they're going to charge you $7.50 to replace the card, plus $20 if you don't want to wait a few weeks to receive it.

In contrast, the debit card I have from my bank (an ordinary no-fee checking account) has none of these fees. They will propagate the Cirrus network's ATM fee if you use some other bank's ATM, but that's it.

So can someone tell my why anybody other than a complete sucker would ever want this card?

CVS, Rite-Aid, WalMart and others are all on crack

USA Today: CVS follows Rite-Aid, shuts off Apple Pay

Last Thursday drug store chain Rite Aid Inc. (RAD) reportedly stopped accepting payments made through the just launched Apple Pay system from Apple (AAPL). On Saturday, CVS Health (CVS) was reported to have followed suit at its CVS pharmacy stores.

The issue appears to be a conflict between Apple Pay and a mobile payment system called CurrentC that is being developed by a retailer-owned mobile technology outfit called Merchant Customer Exchange (MCX).

I'm sure you've heard about the above news already. For more information on this, TechCrunch wrote a great article all about CurrentC, how it works and why it even exists.

Bloomberg: Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target Blew It

According to a detailed report by Bloomberg, December's credit-card heist from Target was detected by their outsourced security firm well in advance of any real damage. Target's security people were alerted and had plenty of time to purge the malware and lock out the hackers, but they sat on their hands and did nothing. They took no action until after the news broke and government investigators got involved.

Lots of people in high places in Target should lose their jobs for this. It's one thing to be the victim of crime. It's quite another to pay big bucks for an outsourced security system and then deliberately ignore them when they tell you there's a massive attack in progress.