I'm going to talk about what I think of as a US problem,
which is point-of-sale attacks.
I call it a US problem because having worked in PCI in Europe,
we don't tend to have people stealing magnetic stripe data
because you can't really do that much with it.
And yet, we sit in Europe looking that US with enormous,
world-famous large-box retailers,
DIY stores that had some of the biggest point-of-sale
attacks with millions of cards taken in it.
And obviously I don't want you to talk about any case
you've been involved in yourself.
In Europe, as soon as we moved to chip,
that just went away because you can't clone a chip and
make a clone card and go shopping.
In the states, you can still clone a mag stripe card and go shopping,
which is why criminals attack it.
Criminals attack it because it's high-value data.
So, you've seen quite a few of these, I know.
We've talked previously.
When point-of-sale attacks happen,
is the criminal trying to breach into a payment switch somewhere
in the middle to get the track data or are they going for each
point of the sale system individually?
It depends on the type of attack.
We see both.
A lot of times, they'll come in,
and they'll want to either position their malware somewhere in that
flow where they can get it from all of the individual systems that
are going through that checkpoint.
If they can't do that, they'll put it on every single terminal if they have to.
That sounds to me like a lot of work, but it also sounds noisy.
I mean, surely the retailer,
I can understand the retailer not detecting while attack on a PC infrastructure,
but every single point of sales, somebody must notice.
You would think,
but the truth is we've seen malware running on individual point
of sales that has been there many months,
and it goes by undetected.
The attackers are good.
They know what they're doing.
They know where to put the malware so that it looks like another
system process so that it doesn't raise red flags.
And this is a logical attack.
They're not going to every single store and plugging a USB in, are they?
No, no.
This is usually they're coming in through a remote access point any
number of ways into the point-of-sale systems.
We've seen them come in through guest wireless networks
that didn't have adequate security.
I think what you just said was somebody had a guest network --- Yes.
We've actually seen that.
--- that was connected to their point-of-sale system.
Yeah.
Not directly.
It was a very sneaky attack.
The merchant wanted to offer wireless guest services to their clientele.
It's a good move.
People appreciate that.
However, with the way the router was configured,
the attacker was able to get an IP address in the guest network,
get on to the router, and because the router wasn't configured correctly,
they were able to use the router's IP address,
which was a privileged IP, to get back into the card data environment.
And we've seen, wireless was one of the biggest,
the first to have a big breach with card holder data at their fashion retailer.
Six years ago, yeah?
Yes.
I mean that's quite a common thing.
But, when I was doing an assessing job and an advising job,
it's like, this is like, you never do this.
You have two, you don't even risk it.
You have two wireless networks.
Yeah, and that's one of our recommendations.
If you're going to have guest wireless,
get it away from any and all privileged data.
In fact,
do a separate network and outsource it to the people who do guest networks.
So, this can be an attack against every single point of the sale.
It can.
That's astounds me.
What about infrastructure attacks?
What about attacks against anywhere in the payment flow?
Is that a thing as well?
Any point that the attackers could attack,
in theory, they're probably attacking in reality.
If they can get --- a prime example is getting a piece of
malware on a back of house server that is handling traffic for
all the individual POS terminals.
They love to do that because that's a whole lot less work,
and the chance of being detected is so much lower.
If you're running malware on a POS terminal,
it might bog down that machine and cause somebody to say,
hey, what's wrong with this machine.
And so if they can get it on a back of house server that has more resources,
it can go that much longer without being detected.
So both the common viable attacks.
Now you talked about the way in because I'm sitting here
looking incredulous that this happens,
but knowing full well from talking to my friends in
forensics and at the other card brands, that this is run-of-the-mill.