Barnes & Noble Probes PIN Keypad Hack

Criminals hacked one PIN keypad in each of 63 stores and have already used the stolen data to commit fraud. Was it an inside job?

11 Security Sights Seen Only At Black Hat (click image for larger view and for slideshow)
Barnes & Noble Wednesday confirmed that point-of-sale systems in 63 of its stores had been physically hacked as part of what it described as a sophisticated criminal effort to steal credit and debit card information from our customers who have swiped their cards through PIN pads when they made purchases at certain retail stores.
That information was disclosed to customers Wednesday via a
data breach notification
, as well as a related press release, both of which were distributed via the website of the California Attorney General.
According to Barnes & Noble, the hacked PIN pads--only one of which was hacked in each of the stores--were capable of capable of capturing information such as name, card account number, and PIN, but only for in-person purchases in which a card was swiped. The company said that its online customer database hadnt been breached. Still, stolen information from the hacked PIN pads has reportedly already been used by fraudsters.
[ Read
Many Identity Theft Protection Services Promise The Impossible
. ]
Barnes & Noble said that it detected the PIN pad tampering during maintenance and inspection of the devices, and said it immediately discontinued the use of all PIN pads across its nearly 700 U.S. stores, disconnected and sent them to an offsite location for inspection, and informed federal authorities, who are now investigating the tampering. Barnes & Noble has now completed physical inspections of every PIN pad for tampering, but hasnt returned them to stores, owing to ongoing concerns over tampering and data theft.
The PIN pads were removed from stores on September 14, and the transactions are being made now through the register, said Barnes & Noble spokeswoman Mary Ellen Keating via phone. She declined to comment on whether the bookseller might resume using PIN pads at a future date.
A senior Barnes & Noble official told
The New York Times
, which first
reported
the story of the data breach Wednesday, that the company did inform credit card companies about the data breach. But the Barnes & Noble didnt immediately
disclose the breach to its customers
. The company official said that the U.S. Attorneys Office for the Southern District of New York said the bookseller didnt need to alert customers to the PIN pad fraud until Dec. 24, 2012, so as to not interfere with related investigations.
The
list of affected stores
includes locations in nine states: California, Connecticut, Florida, Illinois, New Jersey, New York, Massachusetts, Pennsylvania, and Rhode Island.
In its Wednesday data breach notification to customers, Barnes & Noble said that as a precaution, customers and employees who have swiped their cards at any of the Barnes & Noble stores with affected PIN pads should immediately contact their bank to change the PIN number for their debit card, if one was used. The bookseller also recommended that both credit and debit card users review their account statements for unauthorized charges, and notify their banks if any were found. But it didnt detail--or perhaps simply doesnt yet know--when its PIN terminals were first hacked. Barnes & Noble also recommended that potentially affected consumers
beware identity theft
, and watch for accounts that might have been opened in their name, but without their knowledge. But in its statement, the company made no mention of providing identity theft monitoring or protection services to affected consumers.
How difficult would it be to tamper with PIN pads at 63 different stores, across nine states? This is no small undertaking, Edward Schwartz, the chief security officer at RSA, told the
Times
. An attack of this type involves many different phases of reconnaissance and multiple levels of exploitation. In addition, the attacks are notable for the
geographic distance
between affected stores.
The complexity involved in the attacks has led some security observers to conclude that it must have been an inside job. In an emailed statement, Gunter Ollmann, VP of research for computer security firm Damballa, said that with only one PIN card reader having been hacked per store, it didnt smell of a supply chain problem, meaning it was unlikely that a batch of card readers were compromised at the manufacturers or distribution center. In addition, most PIN pad attacks require attackers to return to the terminal to retrieve intercepted data, sometimes repeatedly.
One possibility is that the Barnes & Noble attackers installed card skimmers in the PIN pads. Although the
Payment Card Industry Data Security Standard
(PCI DSS) requires all stored credit card data to be encrypted--and states exempt businesses from having to notify customers of data breaches, if the information was encrypted--PIN-pad skimmers literally tap into the available data before it even has a chance to be stored, by capturing it at the moment that a card gets swiped.
Last year, attackers used skimming technology to compromise data from 90 PIN pad terminals--across 20 states--at arts and crafts outlets owned by Michaels Stores. Rather than literally forcing open the PIN pads in-store and inserting a skimming chip, however, security experts suspect that attackers might have performed a social-engineering attack, and while a cashier was distracted,
physically swapped the existing PIN pads
for a lookalike version that already had a skimmer installed.
Unfortunately, attacks against PIN card terminals continue to grow more sophisticated. At the Black Hat information security conference earlier this year, for example, researchers demonstrated a
proof-of-concept PIN pad attack
against terminals available in Europe, in which they used a Trojan credit card to infect the terminal with malware, which began recording all available card information, including debit card PIN codes. When an attacker returned and reinserted their card in the terminal, the malware copied all of the stolen, stored data back onto the card, then deleted itself to hide all signs of the attack.
A security information and event management system serves as a repository for all the security alerts and logging systems from a firms devices. But this can be overkill for a company that is understaffed or has overestimated its security information needs. In our report,
Does SIEM Make Sense For Your Company?
, we discuss 10 questions to ask yourself in determining whether SIEM makes sense for you--and how to pick the right system if it does. (Free registration required.)

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Barnes & Noble Probes PIN Keypad Hack