Krebs On Security: Data Breach At Oracle’s MICROS Point-of-Sale Division

Data Breach At Oracle’s MICROS Point-of-Sale Division
Brian Krebs, August 8, 2016

A Russian organized cybercrime group known for hacking into banks and retailers appears to have breached hundreds of computer systems at software giant Oracle Corp., KrebsOnSecurity has learned. More alarmingly, the attackers have compromised a customer support portal for companies using Oracle’s MICROS point-of-sale credit card payment systems.
...
MICROS is among the top three point-of-sale vendors globally. Oracle’s MICROS division sells point-of-sale systems used at more than 330,000 cash registers worldwide.
...
Oracle’s own statement seems to suggest the company is concerned that compromised credentials for customer accounts at the MICROS support portal could be used to remotely administer — and, more importantly, to upload card-stealing malware to — some customer point-of-sale systems. The term “on-premise” refers to POS devices that are physically connected to cash registers at MICROS customer stores.

Avivah Litan, a fraud analyst at Gartner Inc., says ... "I’d say there’s a big chance that the hackers in this case found a way to get remote access" to MICROS customers' on-premises point-of-sale devices.
...

This is really ugly. If criminals have managed to use the manufacturer's maintenance access to remotely install card-skimming software into point of sale terminals worldwide, then nothing is safe.

All the more reason to use a merchant's chip reader or Apple Pay wherever possible. These technologies work with device-specific account numbers, one-time pads and encryption to make it difficult (if not impossible) for a captured transaction to be used to create a fake card or initiate new transactions. (I am aware that there are many more virtual-card technologies in use but I don't know enough about them to have an opinion about their security.)

Bloomberg: Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target Blew It

According to a detailed report by Bloomberg, December's credit-card heist from Target was detected by their outsourced security firm well in advance of any real damage. Target's security people were alerted and had plenty of time to purge the malware and lock out the hackers, but they sat on their hands and did nothing. They took no action until after the news broke and government investigators got involved.

Lots of people in high places in Target should lose their jobs for this. It's one thing to be the victim of crime. It's quite another to pay big bucks for an outsourced security system and then deliberately ignore them when they tell you there's a massive attack in progress.