Nov. 25, 2007
Hi-Tech Heist
How Hi-Tech Thieves Stole Millions Of Customer Financial Records
-
Play CBS Video
Video
Hi-Tech Heist
Consumers often feel safer using their credit cards in stores than online, where hackers are notorious for stealing personal information. But is it really safer? Lesley Stahl reports.
-
Photo
(CBS)
-
Interactive
ID Theft
See how you may be vulnerable, learn about new scams and get tips to protect your good name.
That's because it's easier for dot-coms to protect the data. And most stores in America underestimate how vulnerable they are.
As correspondent Lesley Stahl reports, it's becoming a big problem. The retail industry got a wake-up call earlier this year, when TJX, the parent company of T.J. Maxx and Marshalls, disclosed it had suffered the worst high-tech heist in shopping history. Hackers raided the company's computer system, taking off with tens of millions of records. And what we have learned is: TJX could have prevented it.
"They collected too much personal information. They kept it too long. And finally, they didn't keep it according to appropriate security standards," says Canadian Privacy Commissioner Jennifer Stoddart, who led the investigation of the TJX theft for the Canadian government and the Province of Alberta, and released her findings before investigations in the U.S. are finished. TJX operates chains in both countries.
Asked if there's an actual place where the crime took place, Stoddart tells Stahl, "Yes, it seems that the intrusion happened at two Marshalls stores in the Miami area."
"Did the crime happen inside the stores or outside the store?" Stahl asks.
"This was a case of penetrating the network from without the stores because it is…a wireless network. You can then capture the wireless transmissions if they're not sufficiently encrypted," Stoddart says.
When you swipe your credit card, your data is often transmitted through a wireless router either to a bank for approval or to the store's main computer. But the signal carrying your information bleeds easily through the walls.
Stahl got her first lesson in something called "war driving" from Kris Harms, a computer forensic investigator for Mandiant, a computer security company, who showed her how hackers, outside in a van, can grab the stores' wireless data.
"So you and I are in this parking lot, and we park in front of one of these big stores. We can just pluck it, is what you're saying, right through the wall," Stahl remarked.
"Absolutely," Harms replied.
All you need, he says, is a regular computer; the software he got for free. Within moments, Stahl and Harms started getting results.
"Right now, we're right in front of Best Buy," Stahl remarked.
"Right so, Best Buy has a wireless network," Harms explained.
The computer identified which stores have wireless signals. Some stores hide their identities, others don't. Besides Best Buy, Staples popped up, and Home Depot -- with its signature color -- wasn't hard to identify either.
"It doesn't say Home Depot, but it says 'Orange,'" Stahl noted.
Those three stores told 60 Minutes the wireless signals Harms and Stahl detected do not link to their customer data-banks. But sometimes similar signals do lead hackers to computer systems where the data is held. Harms told 60 Minutes that stores should have security to prevent that.
"When wireless first became a technology for people to use, they realized that they needed a way to protect that data that's flying around in this cloud. So they designed WEP," Harms explains.
WEP was encryption code developed in 1999, just as big chains started going wireless. But within a couple of years, hackers had cracked WEP, rendering it obsolete. If you go on YouTube today, you can learn how to disable it in minutes.
Now, there's much better encryption code called WPA. In fact, credit card companies urge retailers to upgrade to WPA. But that's expensive, so many stores resist it even though hackers can tell who hasn't upgraded.
"It’s saying WEP or WPA. That’s telling you if they have good encryption devices," Stahl remarked, looking at Harms’ computer.
"That’s right," Harms replied.
"It's actually telling you that right on your computer?" Stahl asked.
"Absolutely," Harms said.
"That’s amazing," Stahl said. "So are you able, with what you have right here in the car with us, to crack WEP right now?"
"Executing the attack is as simple as clicking a button and making it happen," Harms said. "You have pierced the first wall of what, hopefully is many."
Produced By Shachar Bar-On
© MMVII, CBS Interactive Inc. All Rights Reserved.
Recent Segments
Scroll Left
Scroll Right
- 1
- 2
- next
See all 55 Commentshttp://dheera.net/projects/blur.php
ACTUALLY...the real reason people use credit cards is because they don''t have any money. Most of the population is in debt. They have no choice but to use the credit cards. Bankrupcy is up 8.7% this year....go figure!
You story missed the point completly. The culprit is the card companies who increasingly encourage there card holders to swipe the card. The card companies are the folks making money on card usage not the retailers. The retailers are required to accept the card if they want to sell to customers.Like I said there isn''t a retailer out there who wouldn''t love to throw master and visa out the door.Last month my card expense was near $1000.00 for accepting cards. Maybe master and visa should take some of these profits and secure their customers numbers.
In closing ...you are correct about the problem but absolutly missed the boat completly as to who is at fault. Very dissapointing on your very sloppy coverage. You have to follow the profits.....credit card usage is an expense to the retailer.....only the card company profits from it''s use so they are responsible for keeping the cards usage safe.
As for your software, that is certainly an interesting solution. My question is, how does it scale, can your software be deployed to 1000 stores that process several hundred thousand to nearly a million transactions per day? Also, how do you handle off-line situations where you can''t contact the bank electronically but still need to take the credit card and transact business. I checked your reference clients on the sites, but didn''t see any recognizable names from a major retailer standpoint.
I would also be curious to see if you support unreceipted returns with a swipe of a customer''s credit card, as well as, how you handle returns to the customer''s original credit card that was used for purchase.
Feel free to post responses here or publish something on your website (or if it is there already and I didn''t see it, post a link), I will check back in the coming days as I am interested in your product as a potential solution.
As for the 60-minutes story, I felt it was of little value. I love how they end the story with the statement of fear and unsupportable comment "most stores are still vulnerable." Seems a bit irresponsible.
Please stop wearing those earrings! I see them almost every week. They look like they are plastic and have a black round circle above a colored emerald shaped object which is usually blue or green corrosponding to your attire. I am a loyal viewer but I just cannot stand those hideous things. They make my skin crawl. I thoroughly enjoy your reporting. You do a fabulous job. It is difficult to give your work its full attention with those things hanging from your ears. Thank you!
This should be looked at the same way the war on drugs should be looked at. Don''t make the rules for everybody because of a few bad apples. Make it easier to dispute the charges, and take back ones life from stupid geek stuff like identity theft and the like. It is not a consumer obligation to protect ones identity. It is a markets obligation. They offer the convenience. They should be held accountable to its discrepancies.
-- No more meddling in other country''s political affairs
-- No more aggressive military actions overseas
-- No more torture prisons
-- No more pseudo-wars like the "War on Drugs"
-- No more IRS and unconstitutional income taxes
-- No more Federal Reserve (the group of private banks which owns our government)
-- No more erosion of Social Security to pay for militarization
-- No more U.N. (one world government) participation
-- No more NAFTA, CAFTA, WTO or GATT (globalist trade cartels)
-- No more North American Union (loss of U.S. sovereignty)
-- No more federal gun control laws
-- No more illegal aliens pouring-in over our country''s borders
-- No more illegal aliens allowed to roam freely in our streets
-- No more national ID cards (Real ID Act)
-- No more government invasion of your privacy
-- No more federal Laws which force you to take unwanted injections
-- No more federal Laws which are not authorized by The Constitution
-- No more federal erosion of State sovereignty
-- No more unlimited federal government
They don''t call him "Dr. No" for no reason. The Doctor is in! Find-out what CBS hides from you, and join us in this 21st Century political revolution at ronpaul2008.com
"Those who expect to reap the blessing of freedom must undergo the fatigue of supporting it."
- Thomas Paine
"Ron Paul doesn''t represent your Father''s school of political thought. He represents your Founding Fathers."
- Me
The results of a nationwide telephone poll, announced by Zogby on November 19th, reveals that Americans want to vote for a candidate who protects liberty; who wants to shrink government; and who wants to immediately withdraw our troops from Iraq - positions of Congressman Ron Paul. As part of a blind-bio, spread poll, likely voters (from all parties) were provided with descriptions of four different Republican candidates and asked to choose who they would vote for based on each one''s resume and political platform. 33% of pollees chose Ron Paul, 19% chose Rudy Giuliani, 15% chose Mitt Romney and 13% chose Fred Thompson. The results clearly illustrate that the country is crying out for Ron Paul, which is why mainstream media has launched a public relations offensive to marginalize his accomplishments and suppress the Congressman''s name recognition. In a seperate question, over 49% of pollees said they would be more likely to vote for a candidate who would begin an immediate withdrawal from Iraq. In fact, Ron Paul won in every demographic of this poll including, but not limited to, religious voters, NASCAR fans, military families, African-Americans, etc..
Zogby''s Director of Communications Fritz Wenzel said on November 20 that Paul is the strongest of the GOP candidates to run against Clinton. "Among the larger universe of voters," which includes all parties, "yes, Paul would be a much stronger candidate than any of the other three [Romney, Giuliani, Thompson]," Wenzel said. Zogby recently announced that Paul was their winner in a nationwide blind-bio poll which included voters from all parties. "He is anti-war and the majority of Democrats are anti-war, he has some other ideas and policies and stances on issues more attractive to Democrats, particularly conservative Democrats," said Wenzel. "Even among Independents, he is far and away a more attractive candidate," he added. Paul is the only GOP candidate who is not threatening war with Iran, whereas Clinton vowed to keep that option "on the table." Paul also voted against the war in Iraq, which Clinton has supported. Because Democrats outnumber Republicans, none of the other GOP candidates can win against Clinton, because they simply won''t be able to reach across party lines and attract enough Democratic and Independent voters to beat Clinton. Only Paul can do that. "He''s right on schedule," Wenzel said. "He''s making all the right moves, going in the right direction...at a time when other candidates are not moving." Wenzel based his analysis on recent polls that show Paul could win in New Hampshire and that his support nationwide is intensifying.
Republican presidential candidate Ron Paul is gaining momentum in New Hampshire and Iowa, according to two seperate polls released November 20 by the CNN/WMUR and Boston Globe/University of New Hampshire. The Texas congressman has garnered an estimated 8% in New Hampshire, surpassing former GOP front-runner Fred Thompson, and is tied with John McCain both in New Hampshire and Iowa. These poll numbers were released over by the Boston Globe in association with the University of New Hampshire Survey Center, and the Marist College Institute for Public Opinion, both confirmed Congressman Paul%u2019s support to be higher than Thompson%u2019s as well. "The polls confirm what we already know: Congressman Paul is catching on in the early primary states," said Paul campaign spokesman Jesse Benton. "His unifying message of freedom, peace, and prosperity is resonating strongly with voters in Iowa and New Hampshire, and we%u2019re rapidly gaining support nationwide." The New York Times poll was conducted November 2-12. On November 5, the Ron Paul campaign brought in a record-breaking $4.2 million in grass root donations online, and an additional $1 million to end the week. His campaign has raised over $9 million dollars so far in this quarter.
Everytime I hear Democrats say "I hate the Republican Party. Look at what Bush has done.," I can''t help but think about all of Bush''s Democratic enablers in the Congress like Clinton, Obama, Pelosi, et. al. who made all of his dastardly deeds possible. They handed him every bit of legislation with which he has used to make himself the dictator that he now is on a silver platter. The Democrats in Congress don''t even seem to express any interest in investigating Bush for the crimes he and Cheney have surely committed against our country even though a vast majority of Americans think they should. What cowards! In fact, Obama and Clinton even voted in favor of legislation which actually allows Bush to pre-pardon himself and his administration for crimes dating all the way back to 9/11. What''s up with that? Look. Do yourself and your country a favor. Focus on the candidate, and the ideas and positions he or she represents, and then study the candidate''s track record of performance with respect to those positions. That''s all that really matters in the end. Elections are not a contest of two teams. Ultimately, It''s the politician who will either serve your interests or betray them while in office--not their party. Finally, Democrats, I ask you this: Would you have voted for Steven Douglas (a Democrat), who was ardently pro-slavery, against Abraham Lincoln (a Republican) simply because Douglas was a Democrat? I think most of you would.
Like Ron Paul, I believe the biggest threat to your privacy is the government. We must drastically limit the ability of government to collect and store data regarding a citizens'' personal matters. We must stop the move toward a national ID card system (e.g., The Real ID Act). Under this new Law, states are currently issuing new driver''s licenses embedded with standard identifier data (RFID chips). Although, many states are refusing to comply. A national ID with new tracking technologies means we''re heading into an Orwellian world of no privacy. Ron Paul was one of the few members of Congess who voted against the Real ID Act. Also, under current medical privacy protection rules, which Ron Paul also opposed, insurance companies and other entities have access to your personal medical information. Finally, there''s the so-called Patriot Act, which Congressman, Ron Paul also voted against. As originally proposed, it expanded the federal government''s ability to use wiretaps without judicial oversight; allowed nationwide search warrants non-specific to any given location, nor subject to any local judicial oversight; made it far easier for the government to monitor private Internet usage; authorized sneak and peek warrants enabling federal authorities to search a person''s home, office, or personal property without that person''s knowledge; and required libraries to turn over records of books read by patrons. Ron Paul sponsored a Bill to overturn the Patriot Act.
Consider the Patriot Act. The Law is 342 pages long, or 57,000 words, making it a bit longer than Dostoevsky''s "Notes from Underground" or, if you''re partial to pigs, about twice the size of Orwell''s "Animal Farm." The Patriot Act is the reigning champion of our government''s recent un-American activities. When it was first paraded before Congress and the Senate following the 9/11 attacks, few Members, other than Congressman, Ron Paul dared to vote against it. Most in Congress simply gave it their rubber-stamp of approval, without ever reading it. Why bother? It was, after all, named the "USA Patriot Act." It must be a good thing. Right? Now in effect, the Law wrecks a generation''s worth of constitutional protections against government snooping, legalizing police-state tactics in searches and seizures, criminalizing certain forms of speech and political activity, and opening the way for the mistreatment of foreigners in government custody and wholesale expulsions and imprisonment. It is a repugnant, unnecessary Law that goes against the very principles its name wrongly implies. Yet, it remains unchecked and unbalanced by public opinion, Lawmakers or the Courts. So, yes, we''re a nation of Laws. But the Laws aren''t much to speak of when they''re designed to hoodwink the public to win its docility. Neither is public responsibility much to speak of these days when its docility is secured with nothing more than a ploy-riddled play on the word "patriot."
My fellow Americans need to open their eyes to the fact that our Republic, along with The Constitution upon which it was founded, is being flushed-down the toilet by our nations'' bought and paid for politicians and media. While the Oligarchs warn and incite fear in the sheeple about the prospect of terrorism, they at the same time leave our borders wide open, and then conduct illegal wars overseas that do nothing but incite the terrorism which their Orwellian Laws like the Patriot Act and the John Warner Defense Authorization Act pretend to protect us from. Wake up America! It''s not about protecting you from terrorism, or Global Warming, or any of that other fear-mongering garbage the sold-out, mainstream media feeds you 24/7. It''s about feeding the bankers and the military industrial complex, and facilitating the global elite''s ability to ratchet-down control over the American people, placing us into a total control grid where they can surveille, track and control everywhere we go and everything we do. It''s the groundwork for tyranny. It''s the New World Order plan of Bush, Clinton, Edwards, McCain, Giuliani, et.al., being executed quite beautifully. You''re a frog in a pot: In order to cook a frog, you don''t throw him into a pot of boiling water. If you do, he''ll resist and jump-out. What you do instead is, you turn the heat-up REAL SLOW, and by the time the water is boiling, he won''t be able to jump out anymore, because it''s too late--he''s already doomed.
America is tipping way too far back in her easy chair. Something BIG is about to happen, and I predict this upcoming 2008 Presidential Election will be extremely pivotal. I''m not going to name any candidates. You probably already know who my favorite one is. But let me make my point absolutely clear: If you think times are boring, think again. If you think the future is predictable, think again. My advice to everyone who reads this is to be thoughtful. Trust only that wisdom which is your own. 90% of mainstream media in this country is controlled by fewer than 20 different organizations. Unfortunately, they, like the sold-out political ****** who pretend tp serve us in Washington, were bought and paid for by the military-industrial-pharmacutical complex decades ago. Therefore, mainsteam media will paint pictures they want to paint, and people will open their minds to pictures they want to see. So, be skeptical. Be wise. Research issues and talking points on your own, and share what you learn with those you love. The future of your family tree may lay in the balance.
For Spammers only !
Post or Read Serious Comments - Go over to ABC News
Chronic ...Habitual...and Harassing - Spam
Brought to you by :
The Professional Qualities and Work Ethics of the
CBS News Management Team
Forever diligent in the Work Morals and Work Ethics of
Creating Chronic - Habitual and Endless Spam
Produced By : zuggerjack - bigpecker4 - Prophet
1) aka-GreatProphet ......2) aka-PeaceProphet
3) aka-MegaProphet ......4) aka-KJVProphet
5) aka-NextProphet.........6) aka-TrueProphet
7) aka-LAProphet............8) aka-NHProphet
9) aka-GoodProphet.......10) aka-EarlyProphet
11) aka-SageProphet.......12aka-TruthProphet
13) aka-FairProphet
CBS Professional News Management Team - Spam
Throughout Each Day - Each Night - Every Day -
All Week long within most of the topics on
The CBS News Comments (Harassing Spam)
Stop Complaining - Go over to - ABC News (Comments) - Post There ! !
Leave this Low-Life - CBS News Management and Prophet
To wallow alone in the Muck they created Together
Both are deserving and Worthy of each Other ! !
Lastdance
GreatProphet
TruthProphet
Could be seven-pesos on meds?
Posted by jerryomara at 05:53 AM : Nov 26, 2007
You used to be able to write RP direct at his site but they have removed the link, too many people complaining. RP is just one more politician like the rest with his supporters just like the rest.
I have a great idea. Why don''t we just use CASH! Take your cash, your driver''s license and go! Highly unlikely, but should someone steal your cash, isn''t it better to lose a couple hundred dollars in lieu of your identity?
In effect, the technology permits individuals to simply turn asset like a credit card, bank account or personal credit off and on within seconds. Moreover, the entire process can be voice verified. Fully deployed, the technology would drive fraud artists up the wall.
Hurray to 60 Minutes for joining a long procession of other news and business organizations that couldn''t recognize sea change technology if it ran over them.
The real story on ID theft is that so much money is made because of identity theft and ID fraud that solving the problem or nearly solving it would shut down about 4 billion in annual sales for ID theft "snake-oil" remedies now sold to the American consumer.
In effect, the technology permits individuals to simply turn asset like a credit card, bank account or personal credit off and on within seconds. Moreover, the entire process can be voice verified. Fully deployed, the technology would drive fraud artists up the wall.
Hurray to 60 Minutes for joining a long procession of other news and business organizations that couldn''t recognize sea change technology if it ran over them.
The real story on ID theft is that so much money is made because of identity theft and ID fraud that solving the problem or nearly solving it would shut down about 4 billion in annual sales for ID theft "snake-oil" remedies now sold to the American consumer.
She made a big point of showing Best Buy and Home Depot, and mentioning Staples. Have THEY closed their security gaps? Who are the other chains? And what does "most stores" mean?
This is sloppy reporting.
She made a big point of showing Best Buy and Home Depot, and mentioning Staples. Have THEY closed their security gaps? Who are the other chains? And what does "most stores" mean?
This is sloppy reporting.
She made a big point of showing Best Buy and Home Depot, and mentioning Staples. Have THEY closed their security gaps? Who are the other chains? And what does "most stores" mean?
This is sloppy reporting.
BUT I was troubled by the fact Chris Harms, the forensic investigator, was using his computer WHILE DRIVING. That sets a very bad example and was unnecessary. His eyes constantly went back and forth from the screen to the street. It sets a bad example especially in this day of cell phone and text usage!
The email from the TJX vice president, I would venture to guess again, is probably not an uncommon sentiment in that or similar environments. The fact that TJX says their security was comparable to other retailers was likely accurate. Not very reassuring to the consumer who entrusts his or her personal data to the care of the merchant. Who is suppose to be responsible for safeguarding the consumers'' personal information? Not too hard to figure out.
Dave Hogan (from the Natl Retail Fed) was a riot, don''t you think? Seriously, he gave so much bogus information, it was laughable. He opined that card companies are not serious about security. Pule-e-e-eze. What a joke ....spoken like a true lobbyist for the retailers It doesn''t take much research on Google to see the folly of his statement. His accusation that card companies use fines to increase revenues is simply not a credible statement (pule-e-e-e-ze again) to even the casual observer. Fines, like traffic fines, like all fines, are tools to change behavior that needs changing. Who wrote that line for him to parrot on the air anyway? (Ya just gotta shake your head...) I will admit though that Hogan was effective in conveying the point that the security problem "ain''t my fault". Point that ol'' finger of yours, Big Dave, and blame everyone else. That''s really effective in solving the problem, ol'' buddy. (Not a single productive thing came out of his mouth.) I could go on and on.
The issues of security are very serious and the solution will not be easily or quickly accomplished. They are complex and, yes, can be expensive to implement. But, it is absolutely critical that it be taken to heart. There are a number of productive efforts that are in place that should be embraced and adopted by those entities entrusted with protecting their customers personal information. It''s past time to get on board and quit playing the blame game.
- 1
- 2
- next
See all 55 Comments