Posted on 06/21/2005 8:59:47 PM PDT by HAL9000
More details emerged on Monday about the cyber break-in at a payment processing company that exposed more than 40 million credit card accounts to fraud.The data security breach, possibly the largest to date, happened because intruders were able to exploit software security vulnerabilities to install a rogue program on the network of CardSystems Solutions, a MasterCard International spokeswoman said. The program captured credit card data, she said.
The malicious code was discovered after a probe into the security of CardSystems' network. That investigation, by security experts from Cybertrust, was triggered by a MasterCard inquiry into atypical reports of fraud by several banks. The trail led to CardSystems, said the spokeswoman.
The probe also found that the Atlanta-based payment processor did not meet MasterCard's security regulations. CardSystems held onto records that it should have discarded, and it stored transaction data in unencrypted form, she said.
MasterCard declined to disclose more information on the breach, citing an ongoing investigation by the FBI. CardSystems did not respond to email messages and phone calls seeking comment. A Cybertrust representative declined to comment on the case.
Online discussion boards, meanwhile, are abuzz about which vulnerable software CardSystems may have been running. The data processor's website runs on Microsoft's Windows 2000 operating system and IIS Server 5.0, which has fuelled speculation that its other set-ups may also be Microsoft-based.
CardSystems said in a statement on Friday that it had identified a "potential security incident" on Sunday, 22 May, and called in the FBI the next day. Visa and MasterCard were also contacted, the company said. MasterCard went public with the CardSystems' breach on Friday after it had identified all the affected accounts, the spokeswoman said.
More than 40 million credit card accounts were exposed by the breach. About 22 million of those are Visa cards and 13.9 million are MasterCard, the companies have said. The remaining accounts were linked to other brands, including American Express and Discover.
While millions of accounts were potentially accessed by the attackers, the investigation into the theft has found that records covering about 200,000 cards were transferred outside the CardSystems network, the spokeswoman said. Of those records, 68,000 are for MasterCards, she said.
The thieves got access to names, account numbers and verification codes that could be used to commit fraud. However, the information did not include social security numbers, addresses or dates of birth, which would be needed for identity theft.
CardSystems is one of many companies that process electronic payments. The company handles more than $15bn in card transactions annually for more than 105,000 small and medium-sized businesses, according to its website.
All the major credit card companies protect their customers against unauthorised transactions on their accounts. Fraudulent transactions are typically reversed. Cardholders should monitor their accounts online and contact the credit card company or card-issuing bank when fraud is suspected, experts said.
MBNA, one of the largest US credit card issuers, said it has received information from CardSystems about exposed customer accounts. The company won't contact the individuals affected but is keeping a close eye on the compromised accounts, said an MBNA spokesman. In a case of fraud, an account would be closed and a new card issued, he said.
American Express is still deciding whether to contact its customers. A company spokeswoman said accounts were exposed but she did not disclose how many. In a case of fraud, she said, American Express would bear the financial burden, assuming the merchant has followed all standard card acceptance procedures.
MBNA would also not disclose how many of its customer accounts were compromised.
The CardSystems breach follows several high-profile data loss incidents that potentially exposed American consumers to identity theft, including the loss two weeks ago of CitiFinancial tapes containing unencrypted information on 3.9 million customers.
In past months, data leaks have been reported by Bank of America and Wachovia, data brokers ChoicePoint and LexisNexis, and the University of California at Berkeley and Stanford University.
Two recent surveys have highlighted growing worries about data protection. Last Wednesday, the Cyber Security Industry Alliance reported that 97 per cent of the American voters it polled said identity theft was a problem that needs addressing, and 64 per cent wanted the government to do more to protect computer security.
In addition, a study commissioned by Adobe Systems and RSA Security found that eight out of 10 "senior-level professionals" in Washington, DC, thought that lawmakers weren't doing enough to keep consumer data safe.
FYI - More wonderful publicity for Microsoft.
Lame.
Blaming your firewall and/or policy failures on *any* OS infrastructure is just plain lame.
It's probably more like blaming Ford for someone driving an Expedition into someone's house, or blaming Colt for some gangsta getting capped.
In all fairness though, every OS is vulnerable to attack. Their have been attacks and breaches on mainframes, macs, Linux, OS2, etc...
What the h*ll are politicians supposed to do about flawed software? Are they personally now supposed to fix the security holes in Microsoft software?
(Why does everything that's broken need a new law in order for it to be fixed??)
I am thinking it is time to sell my MS shares...
The credit card companies are very explicit about what data you can hold onto, and what data you cannot retain. I do not keep a record of my customer's CC info (I do recurring billing) on ANY machine that is EVER connected to the Internet. Period.
This ought to be flat-out illegal. Victims, or potential victims of fraud should be notified.
Just the latest in a string of security f**kups. Bank of America, Wachovia, LexisNexis, and more.
The problem isn't Microsoft, though their swiss cheese software contributes. No one takes security very seriously, except of course when they're the victim of a lapse, in which case they always get enraged and blame everyone except themselves.
Meanwhile, it pays to be paranoid. Very paranoid.
All we need is John McCain lecturing us on the need to download the latest M/S Service Pack! :-)
Microsoft software is a tool. In the proper hands (someone very Microsoft savvy), IT CAN BE SECURED.
That's the truth. I know first-hand that many, MANY large corporate companies will slash security spending first when it comes to IT budget crunch time.
Ironically most of these same companies have no problem shelling out big bucks for 2 flat screen monitors per employee.
Hmm, blame the firewall. How about the operators?
"(Why does everything that's broken need a new law in order for it to be fixed??)"
Because we've become a nation of pu**y*.
Due to the nature of the information available at CardSystems, the OS is irrelevant. The data being sought was highly treasured by the criminals, and they would have tried to find a way in no matter what OS was being run.
You're right. You can always insure yourself against the (relatively) inexpensive fraud. But an employee complaint for an ergonomic violation? HA!
Microsoft operating systems are defective products. They should not be used in environments that require high security.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.