POS Hackers Sentenced for Multi-Million Dollar Payment Card Data Theft

Two Romanian nationals have plead guilty for participating in an international, multimillion-dollar scheme to remotely hack into and steal payment card data from hundreds of U.S. merchants’ computers, including a great number of Subway restaurants. Federal prosecutors noted that the conspiracies involved more than 146,000 compromised cards and more than $10 million in losses.

Iulian Dolan and Cezar Butu agreed to serve seven year and 21 month prison sentences respectively. Dolan, 28, of Craiova, Romania, pleaded guilty to one count of conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud, while Butu, 27, of Ploiesti, Romania, pleaded guilty to one count of conspiracy to commit access device fraud. A third co-conspirator, Adrian-Tiberiu Oprea, is currently awaiting trial in New Hampshire. The defendants admitted in their guilty pleas, that during a period roughly from in or about 2009-2011, they participated in Romanian-based conspiracies, to hack into hundreds of U.S.-based computers to steal credit, debit and payment account numbers and associated data. They then used the stolen payment card data to make unauthorized charges on, and/or transfers of funds from, those accounts (or alternatively to transfer the stolen payment card data to other co-conspirators who would do the same).       

The official judgment is a warning signal to all operators concerning POS security and describes how the hackers carried out the scheme. According to the official judgement, Dolan admitted that he, along with Oprea, remotely hacked into U.S. merchants’ point of sale (POS) where customers’ payment card data was electronically stored.

“Specifically, Dolan first remotely scanned the internet to identify U.S.-based vulnerable POS systems with certain remote desktop software applications (RDAs) installed on them. Using these RDAs, Dolan logged onto the targeted POS systems over the internet. These were typically password-protected, so Dolan would attempt to crack the passwords, where necessary, to gain administrative access. He would then remotely install software programs called ‘keystroke loggers’ (or ‘sniffers’) onto the POS systems. These programs would record, and then store, all of the data that was keyed into or swiped through the merchants’ POS systems, including customers’ payment card data.”

               

The co-conspirators hacked into several hundred U.S. merchants’ POS systems. It was reported that Dolan stole payment card data belonging to approximately 6,000 cardholders and was aware that Oprea was engaged in similar conduct. Dolan would periodically remotely hack back into the compromised merchants’ POS system to retrieve the card data that he would transfer to electronic “dump sites,” where the data would then be used to make unauthorized chargers and transfers or sold to other conspirators.

“The Subway case is a clear indication that privileged and administrative accounts are increasingly targeted and used by criminals to steal sensitive information,” says Adam Bosnian, vice president of products, strategy and sales at Cyber-Ark Software www.cyber-ark.com.  “In this case, the attackers were able to simply do an Internet search for remote desktop applications that were used by the restaurants, and through simple password cracking techniques, they were able to gain administrative access to the systems.  This enabled them to easily steal sensitive financial information from unsuspecting customers.”

Bosnian contends that often sensitive accounts are protected by passwords that are too simple or default passwords that are rarely changed. This case is a warning to operators utilizing POS systems to shore up their security by taking steps to make their accounts more difficult to breach and therefore less attractive to hackers.

“These privileged and administrative accounts act as a gateway to any organization’s most sensitive information, which is why they’ve emerged as the primary target for attackers,” Bosnian continues, “The reality is that anyone with an Internet connection can search for, identify and target  remote applications that businesses rely on – the problem facing the industry is that there is not sufficient security and protection around the entry points to these applications. Once inside, attackers have free reign on the network. If you examine the list of the recent, high-profile data breaches that have plagued organizations, including Global Payments, the U.S. Chamber of Commerce, the Utah healthcare breach, etc…, the common denominator is that the attackers focused on gaining access to the privileged or administrative accounts.” 

- Thanks to HT

Using Point-of-Sale Data to Improve Profitability

Not long ago I made a trip over to the local Radio Shack to purchase an electronic plug for my cassette recorder. As I paid for my item the retail clerk asked me for my name, address, telephone number, birth date, and even my email address (something every retailer should be asking for today!). Although I felt a twinge of discomfort giving out my personal information, I went ahead and gave it to him and went on my way.

Driving home I reflected on Radio Shack’s checkout process and was reminded of the power of information gathering at the point of sale. I had just given Radio Shack three ways to contact me, not to mention, information on what I had purchased. In the hands of a skilled marketer, this information is powerful.

Database Marketing
The recent economic slowdown has brought increased competition to small businesses. And with that, retailers across North America have described their sales as "flat." Small businesses should be looking for low cost, high impact marketing activities to drive prospects to their business. One of the most effective and cost-efficient ways to add profits to the bottom line is the use of database marketing, which uses information collected at the point-of-sale.

Using personal data, purchasing data, and contact information from a customer database, a retailer can make offers to customers for complimentary products and services and engage in loyalty marketing activities. Database marketing has four key elements, (1) gathering customer data, (2) building a customer database, (3) creating targeted offers for specific customer groups, and (4) tracking results to improve responses.

Step 1: Gather customer data. The easiest way to begin this process is to develop a simple form for customers and salespeople to fill out every time a customer purchases a product or service. Include personal information such as names of spouses, children, profession, and birthdays, as well as, product information such as manufacturer, make, and model.

Step 2: Build a database to store your customer information. Start simple using off-the-shelf software such as Microsoft Access. Later on you can begin to modify the database to either include different types of information or to print special reports.

Step 3: Start sending offers and personal messages to your customers. Don’t wait until you have a large mailing list. Begin sending notes to customers right away thanking them for their purchase, to celebrate birthdays, share holiday messages, and inviting them to come in and take advantage of special offers.

There is an old saying that goes, “Business goes where business is invited, and stays where it is appreciated.” A personalized invitation to drop by the store to take advantage of a specific incentive is sometimes all that is needed to keep your customers coming back into the store. Instituting a program of personal, hand-signed notes that coincide with birthdays or special events addressed to the customer's significant other that offer gift ideas, can have surprising results.

Step 4: Track the results of your database marketing efforts. By knowing who you sent offers to and who responded will help you identify your best customers, allow you to more effectively allocate your marketing dollars, and help you tweak your marketing pieces to get higher response rates.

What Information Do I Collect?
It’s important to determine in advance the type of information to collect. To do this, make a list of common special offers you might be presenting to your customer. For instance, if you sold a product in the health industry and many of your customers have lower back problems you could joint venture with other businesses to develop special promotions on products that help to relieve lower back pain. To capture the fact that your customer experiences lower back pain, simply place a check box on your form that says, “Do you experience lower back pain?”

If your customer has small children, consider presenting follow-up offers for products targeted for small children. Imagine being a consumer and receiving a letter from your business with an enclosed birthday card for little Joey who just turned eight years old and a discount offer for a basketball hoop or other relevant products. You think to yourself, “What a great gift. Joey would love that!” This is the power of database marketing.

Collecting Accurate and Consistent Information
Database marketing all starts at the point of sale. Without accurate, complete, and consistent data this type of pinpoint target marketing can’t be done. To ensure that your information is accurate and consistent, help your customers fill out the data collection form and review each information form for completeness.

You might experience a hesitancy from your customer to give out all their personal information, similar to how I felt at Radio Shack. However, after explaining that the information will only be used to send out special offers during important events, is completely confidential, and will not be shared with anybody else, you’ll find that most of your customers won’t have any problem giving out their personal information.

Cost Effective Loyal Customers
Marketing to your current customers is one of the most effective and cost-efficient strategies you can do to reduce your marketing costs, enhance your customer / retailer relationships, and produce long-term loyal customers who, over a period of months or years, become your biggest source of referrals.

Thanks to David Frey, Marketing Best Practices Inc.

Don't Count Button Presses

When designing a Point of Sale system, it's easy to count the number of times the user must touch the screen to accomplish a particular goal. For instance, the process of tendering an order with a credit card requires the user to interact with the computer (e.g., through touching) a countable number of times.

Working to reduce the number of button presses is certainly a worthy goal. The problem comes when designers or well-meaning company representatives use that count as a measure of speed. And things go from bad to worse when button press counts—and the desire to minimize them—becomes one of the primary drivers of the design.

When designers start letting button press counts drive the design, it invariably results in a host of undesirable side effects, many of which actually slow things down. Here are a few side effects I've observed::

• Too many buttons on the screen, making it harder to learn and harder to find what you're looking for.
• Buttons and other controls that are too small (and too close together), making the user have to slow down to avoid touching a nearby button.
• An inflexible design that requires shifting of on-screen elements when company offerings change.

It's critical to remember that speed of service is driven by many, many factors. I did some keypress analysis for one fast-food company and discovered that the number of screen touches accounted for less than 10% of the variance in order times. That means that over 90% of what made an order faster or slower came from factors other than the number of keypresses. It's attention to these factors that will do the most to increase speed of service.

Thanks www.posdesigns.com