Hackers stole credit card information from customers who shopped at Target or Neiman Marcus, during the 2013 shopping season that stretches from black Friday through Christmas. Target was the first company to inform the public that their credit card systems have been hacked. Neiman Marcus informed the public of their own security breach caused by the same hackers that attached Target shortly after Target went public with the security breach. The system that the hackers attached was the point of sale (PoS) system that reads credit card information from customers when checking out.
The method used to steal 70 million Target customers credit card information was RAM scraping malware, which allows an attacker to steal information from memory of a PoS device. (Kerner, 2014) Since most PoS devices site in an internal network it was unclear how the hackers installed the RAM scraping malware on the devices. During the investigation Target reveals that hackers stole credentials from one of their vendors to access the PoS system where the RAM scraping malware was installed. (Davies, 2014) Target has not revealed who the vendor was and has not provided additional information pertaining to the security breach. Throughout this investigation Target has been willing to give the general public information which is not the case with Neiman Marcus.
Neiman Marcus is a retailer that sells high end clothing, was also a victim of the PoS Ram scraping malware has not provided much information around there security breach. (Kerner, 2014) There statement to the public was simply that they were affected by the malware but didn’t provide any more information around how there system was accessed or how many people are affected. PoS systems do have security risks that have obviously been neglected but due to the Target and Neiman Marcus hack the risks have been brought front and center.
Cisco stated that there is a flaw in the way point of sale terminal encrypts data. (Burt, 2014) They first save the credit card information to memory then encrypt the data before it is sent out over the network. (Burt, 2014) Jeffrey Burt (2014) goes on to say that PoS devices can continue to be used but need to have hardware encryption on the PoS devices. This approach will not prevent hackers from installing malware on the PoS devices but will ensure that all the data is encrypted at every point in the process of a credit card transaction. The PoS RAM scraping malware attack is not the first attack on magnetic cards. There have been many reported attacks in the past where wireless readers are attached to ATM card slots along with other instances where card information is stolen.
The next step in preventing credit card theft is to use Europay, MasterCard, Visa (EMV) cards. EMV cards use a chip to provide information to the retailers instead of a magnetic strip. EMV cards are harder to copy in comparison to the magnetic strips used on cards used in the...