Blog - Slava Gomzin

Author of books Crypto Basics, Bitcoin for Nonmathematicians, Hacking Point of Sale

7 reasons why we’re going to see more card data breaches at our favorite retail stores (my article just published by Venture Beat)

8/20/2014

Venture Beat just published my review of the situation with payment card security, which basically answers the question: are we going to see more card data breaches?

Supervalu and Albertsons are the latest retail chains to get hit by credit card breaches, but they won’t be the last. Here's why.

Supervalu-Albertsons card data breach

8/19/2014

In addition to Alberson's stores breach, there are more Supervalu stores under different brand affected by the breach. The two breaches are connected as apparently the Albertson's stores use the same POS/payment software or/and payment gateway services provided by Supervalu:

Some stores owned and operated by Albertson’s LLC and New Albertson’s, Inc. suffered a related criminal intrusion.SUPERVALU provides information technology services to these Albertson’s LLC and New Albertson’s, Inc. stores pursuant to transition services agreements, and we have been working together to respond to the intrusion into their stores.

Affected Supervalu stores:

SUPERVALU believes that the payment cards from which such cardholder data may have been stolen were used during the period ofJune 22 (at the earliest) through July 17 (at the latest), 2014, at the 180 SUPERVALU stores and stand-alone liquor stores listed at www.supervalu.com under the Consumer Security Advisory section, operated under the Cub Foods, Farm Fresh, Hornbacher’s, Shop ’n Save and Shoppers Food & Pharmacy banners.

Affected Alberson's stores:

Albertsons stores in the following areas may have had an unauthorized access to credit and debit card payment data:
California, Idaho, Montana, North Dakota, Nevada, Oregon, Southern Utah, Washington and Wyoming.

For more information about the intrusion affecting Albertson’s LLC and New Albertson’s, Inc. stores, please visit albertsons.com, acmemarkets.com, jewelosco.com, or shaws.com.

I have written an article with the analysis of all recent breaches and prediction regarding further breaches. It will be published soon in one of the magazines or/and in my blog. Stay tuned.

Albertsons card data breach

8/17/2014

Just another grim story in the row of card data breaches... We will see more and more breaches like this until the industry realizes that the current payment card technologies - EMV is no exception - are insecure by design, it is nearly impossible to patch them, and they should be replaced by something else!

Hacking Point of Sale talk at Black Hat

8/7/2014

This is visual representation of my Hacking Point of Sale talk at Tripwire booth at Black Hat USA 2014. Thanks Tripwire for this opportunity to present and sign the book!

Retailers shot up by PoS scraping brute force cannon (interview in The Register)

8/1/2014

I gave a brief interview to The Register about the role of PCI in recent retail card data breaches.

Hacking Point of Sale book signings at Black Hat USA 2014 and DEF CON 22

7/30/2014

I'll be doing two one-hour book signings at Black Hat USA 2014 and DEF CON 22 conferences in Las Vegas:

Black Hat USA 2014:
August 6, 2014, 5:30 pm
Mandalay Bay Conference Center, Tripwire booth 141
(I'll be doing a short presentation before the book signing)

DEF CON 22:
August 8, 2014, 11:00 am
Rio Hotel & Casino, No Starch Press community table in Vendor Area

Payment card industry fraud investigative unit?

7/29/2014

Can someone shed light on this ghostly "payment card industry fraud investigative unit"? I stumbled upon this name in Brian Krebs blog's post about potential card data in Goodwill Industries. But googling this name did not return any distinct reference. Isn't such a unit, if it really exists, supposed to have some kind of communication portal for public relations, like IC3, for example?

Point of Sale Vulnerability Rank Calculator

7/27/2014

Point of Sale Vulnerability Rank Calculator from Wiley Publishers

This is the POS Vulnerability Rank Calculator from my book - Hacking Point of Sale - which is located in Appendix A. Thanks Wiley for creating this presentation and making it available for everyone. Using this questionnaire, which consists of 20 questions, anyone can conduct a very brief security risk assessment of their point of sale system. The result of the assessment is a numeric score - "POS Vulnerability Rank" - in a range from 0 to 20, where 0 means the perfect system and 20 stands for the most unprotected POS environment. The rank can be interpreted according to the "Decoding the Results" table.
Give it a try and and let me know about the results!

Card data breach in Wendy's restaurant

7/26/2014

Nothing changes as there is no need to change the mechanism that works. The same familiar scenario:

An initial investigation revealed that someone, most likely outside the United States, remotely installed malware on the Big Rapids restaurant's server sometime during the past month.

Hacker heaven: 63% of businesses store unencrypted PAN data

7/21/2014

According to this study, more than 63% of businesses do not encrypt the account numbers of payment cards. Isn't it a true hacker heaven?

During its 2014 study, PANscan scanned 145,144 gigs of data on 2,590 computers and found:
* A total of 87,206,203 unencrypted payment cards
* 63.86% of businesses store unencrypted PAN data
* 7.37% of businesses store full magnetic stripe data, including PIN, CVV, service code, expiration date, cardholder * name, and PAN.