That is a plausible explanation. It would almost have to be an in$ide job for that to happen. Not necessarily inside Target, but inside the software provider at least.
Yep, there could certainly be an inside element.
Same here. But it will take the crooks a while to work through maybe millions of cards.
There are two CVV numbers, CVV1 and CVV2. CVV1 is used to verify that the card is in the hands of a merchant and is recorded on the card's magnetic stripe. CVV1 is "security by obscurity" - it's not printed on the card so it's supposed to be difficult for scammers to figure out what it is. But of course it's part of the information exchanged in a POS transaction, and magstripe readers are now a dime a dozen anyway - so as a security measure it's basically obsolete.
Good point. I assume they got CVV1 but it's unlikely they got the CVV2.
Yes, that would be a heckuva large parking-lot conspiracy. I love a conspiracy theory, but the larger they get the less plausible they are. :-D
Then I wonder if it could be as simple as spear-phishing an IT employee; perhaps at Target, or perhaps the POS software provider...in that case, we can expect to hear about breaches at other companies using the same POS terminals as Target...ouch.More likely they introduced rouge code into the software that was distributed to all of the point-of-sale terminals. Pretty elegant getting Target to perform all of those software installations for them, I have to say
Maybe a bit of both; fix the specific flaw found at Target and warn others, but not overhaul security practices firmly enough to upset business as usual?
Retail is all about finding a recipe/formula that works and replicating it over and over again.
Yep, I think you probably nailed it.
Interesting article on the apparent fencing of the stolen cards which also makes the same point about CVV2 data not being harvested:
Whilst it certainly isn't foolproof - many European countries have been using 'EMV' (in the UK it's called 'chip and PIN') for very nearly a decade already.
That's a very interesting Wikipedia article. The information about Point-of-Sale equipment that had been electronically altered during or just after manufacture in China and then used to steal millions of dollars in Europe shows that chip-and-Pin is still vulnerable to POS terminal attacks, which is the kind of attack that was apparently used in the Target case.
Seems like a Russian hacker operating a website registered in Laos. At this point you are supposed to say:
That's why VISA is switching over to chip-and-PIN, and using retailer liability as the stick to force them to buy the new POS equipment. It looks like the US is going to be at the very tail end of this conversion. I've been using a chip-and-PIN card here in Canada for a couple of years now.
