-
Sponsored by:10/25/07
Travis Kircher is a new contributor to ATM Marketplace. To submit a comment about this article, please e-mail the editor.
It�s the data-breach scandal that won�t die � the 2005-2006 TJX data breach that compromised the security of some 45 million debit and credit cards. Details about what is widely regarded as the largest data breach of its kind on record continue to emerge.
Over an 18-month period, which began in July 2005 and ended in December 2006, stolen card numbers have been traced back to customers of TJX Companies, the name behind retail giants such as T.J. Maxx, Marshalls and HomeGoods.
| |||||
| | |||||
 | SPECIAL REPORT...Order Now! Customer Perspectives on Self-Service Technology We surveyed more than 500 consumers to learn how they really feel about kiosks, self-checkout and other types of self-service. Find out what works, what doesn't, and what makes the difference between a device that helps your business and one that just gathers dust. Regular Price: US$249 | ||||
| | |||||
Industry experts believe card data was compromised after it was fraudulently obtained during the transmission of data to card issuers. The cause: a vulnerable and badly secured wireless network, they say, in addition to stored card data at the point of sale � a flub that has prompted MasterCard and Visa to tighten the reins on compliance with the Payment Card Industry Data Security Standard. (Read more about PCI compliance.)
Perpetrators were able to download card information and decrypt it with TJX�s decryption key, which they also allegedly illegally obtained. In addition to the debit and credit card numbers, the hackers pulled driver�s license information � including names, addresses and Social Security numbers � from several of the customer accounts.
In response to the breach, TJX has agreed to settle with the affected customers who filed a suit against the company. TJX has offered those consumers the option of cash or vouchers that could be used at TJX stores.
That deal is awaiting approval from the judge presiding over the case.
Quests for justice aside, the TJX breach has put a spotlight on the need to secure wireless networks. And as more financial transactions are handled over wireless networks, experts are taking a closer look at what happens after transactions vanish into the ether. (Read also, Unwired: Wireless ATM connectivity continues to grow.)
| How much influence do consumers have? A lot, say industry experts Rob Evans, the director of industry marketing at NCR Corp., says cases like the TJX breach are unfortunate, because they chip away at consumer confidence in electronic transactions. �I think the macro effect � to the extent that it happens repeatedly and goes on unabated � is that it does create a little bit of disease in the market,� Evans said. �The more often that gets reported � and those stories get told with increasing frequency, one on the tail of the other � I think you�ll see a more detrimental effect on consumer confidence. And I think we�ll find that irrespective of how slick, how well, how convenient, how safe we build consumer electronic delivery, we�ll find that there is less likelihood on the part of the consumer to use it.� Other experts say those types of incidents have little effect on consumers themselves, but they do put pressure on deployers, retailers, financial institutions and financial-services providers to rethink their security measures. �Consumer confidence in the integrity of ATMs is strong. What happened with T.J. Maxx probably won�t affect people when they go to use an ATM. It might in some other venue,� said Doug Sholes, senior director of marketing and product development at Triton Systems. �But an ATM could be connected using a leased line. It could be connected using a TCP/IP network connection. It could be wireless. It could be dialup. I don�t think we�ve ever had an instance where someone said they wouldn�t have it any one way.� Consumer Power What can consumers do to ensure that the businesses they�re frequenting are transmitting along a secure wireless network? Many experts say their hands are tied, as retail establishments typically don�t spotlight the technical details of their data-encryption methods. Digging up that information can be a challenge, which could be a good thing for the industry. |
A bigger picture
Which are more secure: wire-line or wireless transactions? Experts seem split on the issue.
Wired infrastructures, such as landlines and lease lines, contain transactions, some say, making them more secure. When accessing card data through a system breach, a hacker would only have access to information they can gather after physically tapping the lines. In wireless transactions, hackers need only use a special wireless device to intercept the cellular or Wi-Fi transmission.
But making those kinds of generalizations about the security of either transmission method is risky, says Mark Elson, director of product management and architecture for Phoenix Interactive Design Inc.
�I guess both can be compromised if the right security mitigation plan is put in place,� he said. �There are different ways to infiltrate the system. It�s difficult to say which one is more or less secure because some of them are drawing upon the same technology.�
The security key, analysts say, is not the method of data transport, but rather the way the transported data is encrypted.
�Whether they were doing it over a land-line or not, the fact was that they had PIN detail that was generally available to anyone who wanted to look at it and knew how to look at it,� said Rob Evans, the director of industry marketing for NCR Corp.
The �basic guidelines� Evans refers to are compiled in the PCI Data Security Standard, which the major card companies collaboratively designed in December 2004.
The ATM connection
PCI DSS requires that any entity that handles card transactions pass an audit conducted by the card companies to ensure that wireless networks are secure, that all transmissions are encrypted and that card data is not stored on the system. The standard also suggests that networks and systems regularly be tested for security holes.
�Wireless communications have to use an encryption method of a virtual private network, a security sockets layer or one of the other approved PCI technologies,� said Chuck Hayes, a product manager for Long Beach, Miss.-based ATM manufacturer Triton Systems.
Mark Gamon of Australia�s Symstream Technologies Pty. Ltd., which produces a product that converts landline ATMs to cellular ATMs, says his company sends financial-transaction data symbolically and layers its coded transmissions with Triple-DES encryption.
The use of the symbol with a layered-coding approach typically takes at least two hours to hack, Gamon says. And because each transmission uses a different code, fraudsters are never able to use the same transmission key twice. Even if they could get around the coding issue, because each transmission only takes two seconds to move from point A to point B, fraudsters just can�t break the encryption fast enough.
Sponsored by:
Features
Sponsored by:
News
Blogs
- Software Deployment Trends: Evaluating the Saas Option for ePayments Testing Solutions
- EMV Card Fraud: Can Your Fraud Detection System Identify Suspect Chip Card Transactions?
- EMV Implementation for Issuers: 7 Decisons You Must Make Before Issuing Your First Chip Card
- EMV Implementation for Acquirers: 10 Questions to Answer When Formulating Your EMV Device Budget and Timeline
- It's Not About the Clicks: Understanding the Other 90% of ePayments Testing Activity
Sponsored by:
