Hannaford took responsibility Monday afternoon, shortly after executives notified Maine Attorney General Steven Rowe of the leak.
The company was required to inform the Attorney General's Office under a recently enacted state law meant to warn consumers of potential fraud.
Geee, would they have come forward otherwise?
I'm still not shopping at Shaws. I can't stand that supermarket, and our Hanni's is larger and better stocked than any other local store aside from Whole Paycheck.
I find this bit interesting:
Carol Eleazer, a Hannaford spokeswoman, said thieves accessed card numbers and expiration dates as they were being transmitted for authorization in checkout lines.
I doubt it's a wifi exposure issue, as the card readers use wiring. If it affected so many stores (aka all of them) then it's not a secretly installed packet sniffing hardware at a single location.
That means most likely that a) all their credit card/debit card authorizations go through a single central point, some sort of authorization software package, most likely running on one or more servers at a single location (maybe in Scarborough) and b) that there was a single sniffing software package installed on that network. The good news is (sorta) is that this was probably not a database breach. That would indicate shoddy security practices indeed: both a remote exploit and poor database security. I wonder if this was a version of a man-in-the-middle exploit, with the exploit intercepting the authorization requests, passing it on to the real validating software and then returning the real response from the central system back, or if it was a simple packet sniffer.
What baffles me is that either way, this exploit had to either a) send the data back out onto the internet to a single remote site or to a zombie-exploit network (and re-broadcast to a moving central server) or b) someone was working on the inside to download the sniffed results to a storage medium of some sort and walk it out. Both indicate some serious security issues.
Either way, I'm pissed.
Edited: So it looks like it took them at least a week after they found they had a problem to fix it? Doesn't sound like a packet sniffer to me. They could just nuke that once they were aware of it. Not unless it was the most clever, distributed, self replicating son of a bitch ever. Maybe. Sounding more like some sort of clever man-in-the-middle attack.
Printer-friendly format
Email this thread to a friend
Bookmark this thread
(1000+ posts)
Send PM |
Profile |
Ignore
