Nov. 25, 2007
Hi-Tech Heist
How Hi-Tech Thieves Stole Millions Of Customer Financial Records
-
Play CBS Video Video Hi-Tech Heist Consumers often feel safer using their credit cards in stores than online, where hackers are notorious for stealing personal information. But is it really safer? Lesley Stahl reports.
-
(CBS)
-
Interactive ID Theft See how you may be vulnerable, learn about new scams and get tips to protect your good name.
"Was TJX aware that they were using a system that was pretty much useless? Did they know that?" Stahl asks Jennifer Stoddart.
"If you're running a huge wireless network, it's your business to know about encryption standards. So they should have known that," she says.
TJX did know, but in a letter told 60 Minutes - in their defense, that they believe "our security was comparable to many major retailers."
Yet internal company documents suggest they were warned it was risky to use outdated encryption. In 2005, a TJX vice president sent his bosses this email: "We are still vulnerable with WEP as our security key. It must be a risk we are willing to take for the sake of saving money."
By then, the hackers had already broken in, and once in, raided not only the two Miami stores, but over 2,400 TJX stores in the U.S., England, and Canada, walking away with close to 100 million credit card numbers.
"Because all the stores are networked to a central server. And so by getting in at any part of the network, they could then make their way virtually to the central server and siphon off the information for a year and a half undisturbed," Stoddart says.
On top of the credit card numbers, the hackers got hundreds of thousands of drivers' licenses and Social Security numbers, and military IDs -- personal records about their customers kept for years after the purchases were made.
"And what's the justification for holding onto the information for so long? Is it just that it's too expensive to cull it out?" Stahl asks.
"It costs money to dispose securely of personal information so it was just easier to keep it," Stoddart says. "I think it's that kind of a -- perhaps unwise business decision.
Credit card numbers stolen from TJX keep popping up around the globe. Security Camera images from stores in Florida were used to convict a ring of thieves who made fake cards from TJX numbers and bought over a million dollars' worth of merchandise.
And if you’re wondering how the thieves got the stolen card numbers, here’s how: illegal online auction sites, where millions of stolen card numbers are bought and sold.
Shawn Henry, the FBI's top cyber-crime agent, showed 60 Minutes how a thief auctions off a stolen credit card.
"A person can buy this credit card, and they bid on it like it's eBay? eBay for bad guys?" Stahl asks.
"They actually would enter into a negotiation with the individual," Henry explains.
60 Minutes and Stahl were allowed to watch while an FBI undercover agent entered into just such a negotiation.
"What you see here is somebody who's actually offered to sell credit card numbers," Henry explained. "In this particular case, what we have is an undercover agent who is engaged in a conversation with somebody who’s selling four full identities. For $100 for four full identities."
"I'll take four verifiables by Visa for 25 dollars," the undercover agent types in his computer, placing his bid.
Henry says the seller could be anywhere in the world.
The chances of ever finding these crooks are remote, but the FBI tries to establish a relationship. So, after some Internet banter, the agent jokes: "I'll smile when I get Visas;” he deposits money into the seller’s online bank account asking, "You do take e-gold, right?" Answer: "Yes." Now they wait for the deal to go down.
A little later, an e-mail with four people's personal information landed in the in-box.
What popped up were complete files on four Americans, one of them "Pam," along with her address, her Social Security, credit card and ATM pin numbers. Even the answer to that security question "What's your mother's maiden name?" was there.
If you consider all this kind of theft, the cost to the American economy is huge.
"There are some estimates that estimate it in multiple billions of dollars per year of loss," Henry explains.
Leading to a multi-billion dollar blame game between the retail industry and the credit card companies.
"Is there growing tension between the two sides now?" Stahl asks Dave Hogan, who handles computer technology at the National Retail Federation.
"Lesley, absolutely, there's growing tension between the two sides," he replies.
Hogan says credit card companies should change how they do business. "If we could just force Visa and MasterCard to not require retailers to store credit card data, this issue would disappear overnight," he argues.
Hogan says card companies force retailers to store customer data in case there are charge disputes. He thinks the card companies should hold the data, not the stores.
"Honestly, we can eliminate this problem within a few days," Hogan says.
"If it's that easy, why hasn't it been done?" Stahl asks.
"I'm not too sure how vested the credit companies are as far as securing customers' data," Hogan says.
"And you’re saying that the credit card companies are the one’s who are not security conscious?" Stahl asks.
"In my humble opinion, no," Hogan replies.
He accuses the card companies of using this issue as a way to make money. Visa, for example, has started fining large chains that do not have up-to-date security $25,000 a month.
"If you do the math on it, this could be a windfall of $200 million annually for the credit card companies as far as a revenue stream," Hogan says.
Visa chose not to respond. However, along with other credit card companies, it has issued strict guidelines to retailers on how to protect customer data. But most stores just don’t comply.
"The retail industry is not doing enough to prevent these breaches," says Mark Rasch, the former head of the cyber-crime unit at the Justice Department and currently a managing director at FTI, a business consulting firm.
Rasch says this is a war the hackers are winning. Consider the worthless encryption code WEP.
"I had heard that there are retailers who installed WEP even after it was known it didn't work. Now, is that true?" Stahl asks.
"There are retailers who've installed it after. There are some installing it today," Rasch says.
He says stores keep making the same mistakes TJX made, like using passwords any hacker can figure out.
Like what?
"Oh, like 'password,'" Rasch says.
"The password is 'password' and everybody … knows it," Stahl remarks. "I don’t know why anybody who looks into would ever use a credit card, ever."
"Because it’s a lot more convenient than walking around with piles of cash in your pocket," Rasch explains.
This is the season for big-time shopping, for consumers and for the criminals who are going after the data, among them the TJX hackers, who are still at large.
"Retailers need to adopt the next appropriate technology, and the next one, and the next one, and the one after that, because they want people to keep buying from them," Rasch says.
"So it's just an ongoing, escalating expense. That's all it is," Stahl remarks.
"This is an arms race," Rasch replies.
TJX told 60 Minutes they no longer store unneeded data, and that now all of their stores in the United States use the upgraded encryption code. Since TJX disclosed the theft, many other chains have also closed their security gaps, though most stores are still vulnerable.
Produced By Shachar Bar-On
© MMVII, CBS Interactive Inc. All Rights Reserved.
Recent Segments
Scroll Left Scroll Right
- 1
- 2
- 3
- next
See all 55 CommentsActually, that is no longer true. Online, particularly online auctions (like ebay) there are fake sellers who use fake 3rd party checkouts and clearing houses. The criminals are sooo savvy now that they can pretend to sell an item, direct people to a fake checkout and then to a fake paypal site replete with fake secure emblems. the new "secure" sight is really secure, but can be accessed by the person who set it up. What they are trying to capture are passwords to the auction, passwords to paypal and from there, access to accounts and credit card and bank data.
Spammers and others have taken "phishing" to a whole new level and paypal is constantly having to warn users to be on the look out for bogus paypal sites or emails. the good news is, if a person is familiar with paypal they can spot the fake due to spelling errors or the logos not being quite right. The bad news is--both ebay and the criminals are constantly changing format so there is no way to tell when a site is truly bogus and the criminals are getting better....
Dave Hogan (from the Natl Retail Fed) was a riot, don''t you think? Seriously, he gave so much bogus information, it was laughable. He opined that card companies are not serious about security. Pule-e-e-eze. What a joke ....spoken like a true lobbyist for the retailers It doesn''t take much research on Google to see the folly of his statement. His accusation that card companies use fines to increase revenues is simply not a credible statement (pule-e-e-e-ze again) to even the casual observer. Fines, like traffic fines, like all fines, are tools to change behavior that needs changing. Who wrote that line for him to parrot on the air anyway? (Ya just gotta shake your head...) I will admit though that Hogan was effective in conveying the point that the security problem "ain''t my fault". Point that ol'' finger of yours, Big Dave, and blame everyone else. That''s really effective in solving the problem, ol'' buddy. (Not a single productive thing came out of his mouth.) I could go on and on.
The issues of security are very serious and the solution will not be easily or quickly accomplished. They are complex and, yes, can be expensive to implement. But, it is absolutely critical that it be taken to heart. There are a number of productive efforts that are in place that should be embraced and adopted by those entities entrusted with protecting their customers personal information. It''s past time to get on board and quit playing the blame game.
The email from the TJX vice president, I would venture to guess again, is probably not an uncommon sentiment in that or similar environments. The fact that TJX says their security was comparable to other retailers was likely accurate. Not very reassuring to the consumer who entrusts his or her personal data to the care of the merchant. Who is suppose to be responsible for safeguarding the consumers'' personal information? Not too hard to figure out.
BUT I was troubled by the fact Chris Harms, the forensic investigator, was using his computer WHILE DRIVING. That sets a very bad example and was unnecessary. His eyes constantly went back and forth from the screen to the street. It sets a bad example especially in this day of cell phone and text usage!
She made a big point of showing Best Buy and Home Depot, and mentioning Staples. Have THEY closed their security gaps? Who are the other chains? And what does "most stores" mean?
This is sloppy reporting.
She made a big point of showing Best Buy and Home Depot, and mentioning Staples. Have THEY closed their security gaps? Who are the other chains? And what does "most stores" mean?
This is sloppy reporting.
She made a big point of showing Best Buy and Home Depot, and mentioning Staples. Have THEY closed their security gaps? Who are the other chains? And what does "most stores" mean?
This is sloppy reporting.
In effect, the technology permits individuals to simply turn asset like a credit card, bank account or personal credit off and on within seconds. Moreover, the entire process can be voice verified. Fully deployed, the technology would drive fraud artists up the wall.
Hurray to 60 Minutes for joining a long procession of other news and business organizations that couldn''t recognize sea change technology if it ran over them.
The real story on ID theft is that so much money is made because of identity theft and ID fraud that solving the problem or nearly solving it would shut down about 4 billion in annual sales for ID theft "snake-oil" remedies now sold to the American consumer.
In effect, the technology permits individuals to simply turn asset like a credit card, bank account or personal credit off and on within seconds. Moreover, the entire process can be voice verified. Fully deployed, the technology would drive fraud artists up the wall.
Hurray to 60 Minutes for joining a long procession of other news and business organizations that couldn''t recognize sea change technology if it ran over them.
The real story on ID theft is that so much money is made because of identity theft and ID fraud that solving the problem or nearly solving it would shut down about 4 billion in annual sales for ID theft "snake-oil" remedies now sold to the American consumer.
- 1
- 2
- 3
- next
See all 55 Comments