Let's talk about remote access because this strikes me as the
biggest thing in point of sale where you're buying your
point-of-sale software from an ISO?
What is an ISO?
We don't have them in the EU.
What do ISOs stand for?
They're basically vendors or service providers that run the
point-of-sale software or the hardware.
So if I'm a merchant.
I run a store.
I go to an ISO, and they provide me with the point-of-sale software and the chip,
the card readers, and everything, yeah?
Right.
It can be a complex setup to accept all the cards and everything else,
and many merchants, they know their business.
They don't know about processing cards,
and so they'll hire a third party to come in and
handle that aspect of the business.
And it's this third party that then has remote access
into every single POS system of that merchant and all
their merchants because --- yeah?
Yeah.
Their job is to get those machines installed,
and they'll have various levels of service contracts of how involved they're
going to be with the merchant and maintaining security,
but oftentimes, they do have remote access into the merchant,
as well as the merchant will often have remote access themselves to
get in and run their business from the outside.
And that, what sort of software's, if I'm looking,
if somebody says to me, remote access, I'm a bit confused.
What names of packages would merchants recognize there?
Something as simple as the default Microsoft Remote Desktop.
We see breaches through that, but that's common.
All kinds of the web services, like LogMein, --- Right.
That's the one I was trying to think of, LogMein.
--- we see access through those, TeamViewer.
Those are some of the ones that are really,
really easy to set up,
and they can be safe if they're set up and configured correctly.
But attackers do love to hit those.
And I guess,
what they're trying to do is trying to get credentials so they're
using social engineering to get the credentials or are we still at
the days where the password is letmein?
Both, I'm afraid.
Really?
Yeah.
We still see it all.
We see weak passwords where access to an entire network of
POS terminals is protected with password,
123, and an attacker can get through that without breaking stride.
And so...