BlackPOS: Anyone buying that hundreds of POS Devices Had Malware on them?

[TheBlackAdder]

I'm having a tough time buying that hundreds or all of a store's POS devices were infected with Memory scraping software that had the ability to open outside connections to a remote site and send client data to them.

It would be one thing if it were credit card information, but the revelation that other personal client data, that is not part of a transaction, also was obtained by the miscreants shows a security breach of the company's back-end systems.

I'm leaning towards a breech of Cloud-Based Storage systems, where all of that data would be stored.


===


Think about the scope of security breech, the vast amount of customers affected, while a full-range of their personal information was in each record, such as e-mail addresses, etc. This is not stuff that is transmitted from a POS device. POS equipment keep the data transmitted to a minimum, just what is needed to complete a transaction.

And to assume that whole companies were compromised, not just certain regions, or stores, but a whole chain for one to two months.

But the odd thing is that, this data was supposedly captured by this software, and those closed network POS devices somehow had the capability of opening an outside internet connection is dumbfounding. And this breech supposedly has hit 6 stores now.


Something just doesn't sound right with these events.

[global1]

1. I Had The Same Thought.....

I don't think I ever gave Target my e-mail address - but lately I've been receiving e-mails from Target about the breach.

My question is - where did they get that from. I don't have a Target Credit Card. It would be my Visa, MasterCard or Discover Card that I use. I would assume those companies have my e-mail address. Would Target get my e-mail address from those companies in order to contact me?

[tech3149]

3. Same here

It's been probably a decade since I was in a Target and the purchase was cash but I still got the email and I've had a few changes in ISP's since then.

[wandy]

4. Good question. I can't remember the last time I walked into a Target..........

I'm not even sure I remember where the local store is, much less having done business with them on line.
None the less I'm getting E-Mail from them.

I guess any time you do anything online or for that matter simply have the ability to be online you are known to the world in general.

Tanj! There ain't no justis. Or privacy for that matter.

[LAGC]

5. Be careful.

Many of those e-mails aren't really from Target, but rather phishing attempts from hackers trying to get you to click on links and what not. Just like how these low-life scammers come out of the wood-work every time there is a crisis, trying to take advantage of people when they are most vulnerable and unsuspecting.

Do not respond to them, do not click on "unsubscribe", don't do anything but immediately delete them from your Inbox.

Things are very often not what they appear these days...

[gvstn]

6. I think target is just sending out blanket emails.

I only got one on an old netzero account that I haven't really used in 10 years. The emails aren't personalized. I think they are just sending them to everybody@netzero or whatever email carrier you have. I didn't get one at verizon or yahoo.

That said Target does link credit cards with your purchase history. I get store coupons based on past purchases when I use my credit card (non-Target card). ie. I go in for a candy bar but they print out a coupon for my cat's brand of food. That information is coming from my credit card and Targets computer somewhere but not necessarily the POS system itself. Target is linking their computer to the POS to retain the credit card information and my purchase information so they can target their coupons to my buying preferences. This is the information that was compromised. The hacker knows what kind of cat food I buy and my credit card number and probably address.

[gollygee]

10. I haven't gotten any email from Target

and I used my credit card there during that time period. I am getting email from my bank about it.

[Jesus Malverde]

2. Isn't the point that pin's were intercepted at the device...

It's a pretty amazing attack and that the details are still sketchy.

[TheBlackAdder]

9. PINs are only part of it... seemingly full customer contact info was compromised as well.

These are things that are not part of a POS transaction.

[laundry_queen]

7. It's probably both

POS malware and cloud storage breaks.

Where have they said they suspect the breach is coming from? China. who makes the physical systems? China. Which country is known for its corporate espionage (and are suspected of spying on a company here in Canada to the point that company went bankrupt and they actually found bugs in the old building when the gov't bought it)? China.

Now, here's my tinfoil theory. Put the on. The Chinese gov't enjoys being able to have all this information. I wouldn't doubt if all pieces of electronics made in China have a similar malware. However, they don't want everyone to know about it. These recent breaches, imo, are from some kind of rogue element within the Chinese gov't. Either trying to bring them down, or using the gov't spying methods to enrich themselves. /end tinfoil

[jazzimov]

8. Yes. And "the Cloud" is NOT the medium where these would be stored.

Think about it - if products are scanned and downloaded to each POS and each POS reports sales, how difficult would it be to download malware? And many times these are downloaded from the corporate office. That means you only have to infect ONE PC and then let it infect the rest.

There is a difference between closed networks and "The Cloud".

[Orrex]

11. I totally read that as "Piece of Shit Devices"

So I thought you were talking about iPhones.