DIYbanter

DIYbanter (https://www.diybanter.com/)
-   Home Repair (https://www.diybanter.com/home-repair/)
-   -   OT Target Hacked (https://www.diybanter.com/home-repair/365512-ot-target-hacked.html)

[email protected] December 24th 13 12:23 AM

OT Target Hacked
 
On Sun, 22 Dec 2013 21:13:25 -0500, Ed Pawlowski wrote:

On 12/22/2013 11:15 AM, Ralph Mowery wrote:
"Dean Hoffman" " wrote in message
news:l97174$lp6
Some of the gas stations require one to type in the zip code of the
card's owner. I noticed it first in Missouri.


That has been going on for sometime in North Carolina at some stations.


I've seen it for at least five years in the SE. It's almost
ubiquitous, now.

Not sure what good it does, but a time or two that I hit the wrong numbers,
I had to try again.


Adds a layer of security. If you stole my card and don't know where I
live, the charge will be refused.


Yep. It's very low on the inconvenience scale and it does provide
*some* security.

[email protected] December 24th 13 12:29 AM

OT Target Hacked
 
On Mon, 23 Dec 2013 01:56:57 -0500, Wes Groleau
wrote:

On 12-21-2013, 16:44, Ralph Mowery wrote:
My son had his debit card number hacked from Target. Wiped out about $ 600
from his account. I am not sure but thought I told him not to have a debit
card, but have a credit card. While I think he will get his money back, it
is going to take a couple of weeks. I loaned him some money so Christmas
would not be spoiled for him.

If he had a credit account, they could just take off the charge or send it
back to the store. Not so with a stupid debit card.


My debit card says "Visa" on it. One of the conditions for using the
name, I'm told is that the legitimate user is not liable for ANY fraud.
(USA law allows them to stick you with the first fifty bucks.


That is correct, as long as you do NOT use the PIN. If you use the
pin, it's cleared thought the bank's networks, not VISA, so VISA
doesn't insure it. Your bank may have the same policy (or may not)
but if it's not a VISA transaction, the rules *are* different.

But my credit union goes even better. When I got cheated, I filled out
a form and got the money back in a couple of days.


Yes, that's usually the case with CUs. The same happened to me when
Horror Fright got hacked a couple of months ago. In my case, the
perps didn't get the PIN, though I used it at HF, so the transaction
was guaranteed by VISA. My CU just handled the paperwork (and go me a
new card).

Spent about $ 50,000 to send him to school where he took business courses.
He is a senor annalist for softwear for a company and still let this hapen
to him.


I know a guy one semester away from a Computer Science degree who wanted
to turn off the firewall so he could play some game.


Amazing! I wouldn't even do that at home.

[email protected] December 24th 13 12:32 AM

OT Target Hacked
 
On Mon, 23 Dec 2013 09:17:06 -0800, SMS
wrote:

On 12/19/2013 6:07 PM, Dean Hoffman wrote:

The discounter Target had their site hacked. Something like forty
million debit and credit accounts could be affected.
Article he http://tinyurl.com/mgv8pwe


What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.

http://www.politico.com/story/2013/12/hacked-why-target-became-a-target-101447.html

The banks and retailers will not act in the best interest of consumers
on their own. Legislation is necessary.


Wrong. As long as the CC companies are paying for the fraud, *THEY*
are the ones who can decide when it's worth it to tighten security. As
a consumer, you are *NOT* on the hook. Legislation is *NOT* necessary
at all.


Wes Groleau[_2_] December 24th 13 02:59 AM

OT Target Hacked
 
On 12-23-2013 19:29, wrote:
On Mon, 23 Dec 2013 01:56:57 -0500, Wes Groleau
wrote:
I know a guy one semester away from a Computer Science degree who wanted
to turn off the firewall so he could play some game.


Amazing! I wouldn't even do that at home.


It was at home. :-) Fortunately, _I_ control the firewall here.

--
Wes Groleau

He that complies against his will is of the same opinion still.
€” Samuel Butler, 1612-1680


Wes Groleau[_2_] December 24th 13 03:02 AM

OT Target Hacked
 
On 12-23-2013 12:17, SMS wrote:
What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.


I have seen those readers in the states.

It is harder to make an RFID than to re-record a mag strip.

But the people who pulled off the Target crack probably have the
resources to do it. When RFID gets common enough, you can bet they will.

--
Wes Groleau

€śIt is incumbent on every generation to pay its own debts as it
goes. A principle which if acted on would save one-half the wars of the
world.€ť
€” Thomas Jefferson


Daring Dufas TeaBillie on welfare December 24th 13 04:05 AM

OT Target Hacked
 
THE CC COMPANIES DON'T PAY ****. IT IS PASSED ON TO CONSUMERS IN RATE HIKES.

THE RETAILERS GET PAID AND THE CC CHARGES THE CARD HOLDRS.

[email protected] December 24th 13 04:10 AM

OT Target Hacked
 
On Mon, 23 Dec 2013 21:59:50 -0500, Wes Groleau
wrote:

On 12-23-2013 19:29, wrote:
On Mon, 23 Dec 2013 01:56:57 -0500, Wes Groleau
wrote:
I know a guy one semester away from a Computer Science degree who wanted
to turn off the firewall so he could play some game.


Amazing! I wouldn't even do that at home.


It was at home. :-) Fortunately, _I_ control the firewall here.


Oh, I thought you were talking about him doing at he place of
employment. At home, I can almost understand it. People to all sorts
of dangerous things with their own stuff. I don't have a real problem
with it.


[email protected] December 24th 13 05:00 PM

OT Target Hacked
 
On Mon, 23 Dec 2013 20:05:20 -0800 (PST), Daring Dufas TeaBillie on
welfare wrote:

THE CC COMPANIES DON'T PAY ****. IT IS PASSED ON TO CONSUMERS IN RATE HIKES.


Nonsense. If fraud were dropped to zero, the rates the CC companies
charged would not change a penny. They're charging what the market
will bear. Fraud comes out of PROFIT.

THE RETAILERS GET PAID AND THE CC CHARGES THE CARD HOLDRS.


Not always. In the case of the TJ MAXX hack, they were on the line
for something like a quarter billion. In this case it could be *WAY*
North of that.

bud-- December 25th 13 02:36 PM

OT Target Hacked
 
On 12/23/2013 9:02 PM, Wes Groleau wrote:
On 12-23-2013 12:17, SMS wrote:
What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.


I have seen those readers in the states.

It is harder to make an RFID than to re-record a mag strip.

But the people who pulled off the Target crack probably have the
resources to do it. When RFID gets common enough, you can bet they will.


News article said RFID will be standard in the US in about the next 2
years. It uses a randomized security (?like garage door opener rolling
code). Europe does not have the fraud rates we have here.

Target originally reported the theft included PIN numbers. Now they say
PIN numbers were not included.


Stormin Mormon[_10_] December 25th 13 02:44 PM

OT Target Hacked
 
On 12/25/2013 9:36 AM, bud-- wrote:

News article said RFID will be standard in the US in about the next 2
years. It uses a randomized security (?like garage door opener rolling
code). Europe does not have the fraud rates we have here.


Problem with RFID, is that it has two or three
foot range. Easy enough for crook to walk through
a crowd with a RFID scanner, and read the cards
in peoples pockets, wallets, purses.

Already been done....

--
..
Christopher A. Young
Learn about Jesus
www.lds.org
..

Kurt Ullman December 25th 13 03:18 PM

OT Target Hacked
 
In article om,
bud-- wrote:

On 1

Target originally reported the theft included PIN numbers. Now they say
PIN numbers were not included.


If you carefully parse out the original release they said no UNENCRYPTED
PINs were stolen. Later reports suggest they got a file of encrypted
PINs. Now how long it takes to break the encryption is another concern
altogether.
--
€śStatistics are like bikinis. What they reveal is suggestive,
but what they conceal is vital.€ť
€” Aaron Levenstein

The Daring Dufas[_8_] December 25th 13 05:41 PM

OT Target Hacked
 
On 12/25/2013 8:44 AM, Stormin Mormon wrote:
On 12/25/2013 9:36 AM, bud-- wrote:

News article said RFID will be standard in the US in about the next
2 years. It uses a randomized security (?like garage door opener
rolling code). Europe does not have the fraud rates we have here.


Problem with RFID, is that it has two or three foot range. Easy
enough for crook to walk through a crowd with a RFID scanner, and
read the cards in peoples pockets, wallets, purses.

Already been done....


Not if you have an RFID shielded wallet or purse. ^_^

http://www.magellans.com/small-bags-...-rfid-blocking

http://preview.tinyurl.com/l8pwyq3

TDD

[email protected] December 26th 13 04:18 PM

OT Target Hacked
 
On Wed, 25 Dec 2013 10:18:36 -0500, Kurt Ullman
wrote:

In article om,
bud-- wrote:

On 1

Target originally reported the theft included PIN numbers. Now they say
PIN numbers were not included.


If you carefully parse out the original release they said no UNENCRYPTED
PINs were stolen. Later reports suggest they got a file of encrypted
PINs. Now how long it takes to break the encryption is another concern
altogether.


At least when I was in the crypto hardware business (I'm fairly
certain nothing has changed - inertia) PINs were protected by
triple-DES (112-bit symmetrical-crypto keys). While cracking them
today isn't impossible, it's not likely either.

Tomsic[_3_] December 26th 13 08:15 PM

OT Target Hacked
 

wrote in message
...
On Wed, 25 Dec 2013 10:18:36 -0500, Kurt Ullman
wrote:

In article om,
bud-- wrote:

On 1

Target originally reported the theft included PIN numbers. Now they say
PIN numbers were not included.


If you carefully parse out the original release they said no UNENCRYPTED
PINs were stolen. Later reports suggest they got a file of encrypted
PINs. Now how long it takes to break the encryption is another concern
altogether.


At least when I was in the crypto hardware business (I'm fairly
certain nothing has changed - inertia) PINs were protected by
triple-DES (112-bit symmetrical-crypto keys). While cracking them
today isn't impossible, it's not likely either.


Ah, someone who knows something about PINs, etc. Someone told me recently
to put a space or two in a site password -- makes it harder to crack, they
said. OK, so anything can be cracked; but do spaces in passwords make it
harder for such things as on-line bank account access and other secure
sites?

Tomsic



Ed Pawlowski December 26th 13 10:19 PM

OT Target Hacked
 
On 12/26/2013 3:15 PM, Tomsic wrote:




Ah, someone who knows something about PINs, etc. Someone told me recently
to put a space or two in a site password -- makes it harder to crack, they
said. OK, so anything can be cracked; but do spaces in passwords make it
harder for such things as on-line bank account access and other secure
sites?

Tomsic


Most passwords won't work with a space Using characters (&%$#,) helps,
as does longer passwoeds


[email protected] December 27th 13 12:11 AM

OT Target Hacked
 
On Thu, 26 Dec 2013 15:15:02 -0500, "Tomsic" wrote:


wrote in message
.. .
On Wed, 25 Dec 2013 10:18:36 -0500, Kurt Ullman
wrote:

In article om,
bud-- wrote:

On 1

Target originally reported the theft included PIN numbers. Now they say
PIN numbers were not included.

If you carefully parse out the original release they said no UNENCRYPTED
PINs were stolen. Later reports suggest they got a file of encrypted
PINs. Now how long it takes to break the encryption is another concern
altogether.


At least when I was in the crypto hardware business (I'm fairly
certain nothing has changed - inertia) PINs were protected by
triple-DES (112-bit symmetrical-crypto keys). While cracking them
today isn't impossible, it's not likely either.


Ah, someone who knows something about PINs, etc. Someone told me recently
to put a space or two in a site password -- makes it harder to crack, they
said. OK, so anything can be cracked; but do spaces in passwords make it
harder for such things as on-line bank account access and other secure
sites?


It depends on how you go about attacking the keys. From the key
perspective, it doesn't matter at all. However, attacking the
pass-phrase (which the keys come from) it matters only in that people
might not expect spaces so not search that space. In truth, it's far
easier to attack the pass-phrase than the key itself because people
are so predictable and use such short pass-phrases.

The Daring Dufas[_8_] December 27th 13 11:31 AM

OT Target Hacked
 
On 12/26/2013 6:11 PM, wrote:
On Thu, 26 Dec 2013 15:15:02 -0500, "Tomsic" wrote:


wrote in message
...
On Wed, 25 Dec 2013 10:18:36 -0500, Kurt Ullman
wrote:

In article
om, bud--
wrote:

On 1

Target originally reported the theft included PIN numbers.
Now they say PIN numbers were not included.

If you carefully parse out the original release they said no
UNENCRYPTED PINs were stolen. Later reports suggest they got a
file of encrypted PINs. Now how long it takes to break the
encryption is another concern altogether.

At least when I was in the crypto hardware business (I'm fairly
certain nothing has changed - inertia) PINs were protected by
triple-DES (112-bit symmetrical-crypto keys). While cracking
them today isn't impossible, it's not likely either.


Ah, someone who knows something about PINs, etc. Someone told me
recently to put a space or two in a site password -- makes it
harder to crack, they said. OK, so anything can be cracked; but do
spaces in passwords make it harder for such things as on-line bank
account access and other secure sites?


It depends on how you go about attacking the keys. From the key
perspective, it doesn't matter at all. However, attacking the
pass-phrase (which the keys come from) it matters only in that
people might not expect spaces so not search that space. In truth,
it's far easier to attack the pass-phrase than the key itself because
people are so predictable and use such short pass-phrases.

I often use horrible perverse limericks or fracture rhymes like, "Mary
had a little lamb who's fleece was black as coal and everywhere that
Mary went, the lamb would shout, Hey Yo!" I use all the punctuations
and spaces. "Peter Pecker picked a peck of pickled peters." "She shells
she shells by the she shore." Use your imagination to come up with
something funny that you can remember. ^_^

TDD

G. Morgan[_10_] December 27th 13 03:29 PM

OT Target Hacked
 
SMS wrote:

On 12/19/2013 6:07 PM, Dean Hoffman wrote:

The discounter Target had their site hacked. Something like forty
million debit and credit accounts could be affected.
Article he http://tinyurl.com/mgv8pwe


What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.

http://www.politico.com/story/2013/12/hacked-why-target-became-a-target-101447.html

The banks and retailers will not act in the best interest of consumers
on their own. Legislation is necessary.


Why more legislation? Any card with a Visa or Mastercard logo is
protected from fraud by the bank. It may be inconvenient while waiting
on a new card, but the loss goes to the bank and whoever mishandled the
data. The US government does not need to intrude with more regulations.
If the issuer is happy to take the hit, they are the ones that need to
wise-up. Target didn't even have a reason to store the card info, to me
they are solely responsible and I'm sure the banks will sue Target for
all the refunds, time & labor, new cards, and other expenses related to
making things right with their customers.

Heck, they should have named the store 'TARGET' with a giant bulls eye
for a logo. They almost dared someone to try! ;-)



--

They who can give up essential liberty to obtain a little temporary safety,
deserve neither liberty nor safety. - Ben Franklin

[email protected] December 27th 13 05:24 PM

OT Target Hacked
 
On Fri, 27 Dec 2013 09:29:57 -0600, G. Morgan
wrote:

SMS wrote:

On 12/19/2013 6:07 PM, Dean Hoffman wrote:

The discounter Target had their site hacked. Something like forty
million debit and credit accounts could be affected.
Article he http://tinyurl.com/mgv8pwe


What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.

http://www.politico.com/story/2013/12/hacked-why-target-became-a-target-101447.html

The banks and retailers will not act in the best interest of consumers
on their own. Legislation is necessary.


Why more legislation? Any card with a Visa or Mastercard logo is
protected from fraud by the bank. It may be inconvenient while waiting
on a new card, but the loss goes to the bank and whoever mishandled the
data. The US government does not need to intrude with more regulations.
If the issuer is happy to take the hit, they are the ones that need to
wise-up. Target didn't even have a reason to store the card info, to me
they are solely responsible and I'm sure the banks will sue Target for
all the refunds, time & labor, new cards, and other expenses related to
making things right with their customers.


Agreed, with a couple of points of clarification. VISA and MasterCard
only guarantee the transaction if it goes through their clearing house
(as a credit transaction). If it's a debit transaction, the rules are
different and it's up to your bank.

AIUI, the data was lifted in transit through Target's clearing house.
They certainly did have the need for the data as it passed through.
This (apparently) wasn't a case where Target stored data they weren't
supposed to. However, they will still be on the hook for mishandling
the data. It was a hack to their system (my bet is that it was an
inside job).

Heck, they should have named the store 'TARGET' with a giant bulls eye
for a logo. They almost dared someone to try! ;-)


;-)

G. Morgan[_10_] December 27th 13 06:21 PM

OT Target Hacked
 
wrote:

AIUI, the data was lifted in transit through Target's clearing house.
They certainly did have the need for the data as it passed through.
This (apparently) wasn't a case where Target stored data they weren't
supposed to. However, they will still be on the hook for mishandling
the data. It was a hack to their system (my bet is that it was an
inside job).


I have not researched the details, but are you saying a MitM attack was
used? That's 40 million transactions being listened to. Someone must
have access to the last hop of the router as the sales were being done in
real time or at the end of the day when they send all the bulk data.

If PIN codes were captured, then it must have been in real time. And why
does the merchant need the 3 digit verifier if the card is swiped?

--

They who can give up essential liberty to obtain a little temporary safety,
deserve neither liberty nor safety. - Ben Franklin

[email protected] December 27th 13 06:37 PM

OT Target Hacked
 
On Fri, 27 Dec 2013 12:21:09 -0600, G. Morgan
wrote:

wrote:

AIUI, the data was lifted in transit through Target's clearing house.
They certainly did have the need for the data as it passed through.
This (apparently) wasn't a case where Target stored data they weren't
supposed to. However, they will still be on the hook for mishandling
the data. It was a hack to their system (my bet is that it was an
inside job).


I have not researched the details, but are you saying a MitM attack was
used? That's 40 million transactions being listened to. Someone must
have access to the last hop of the router as the sales were being done in
real time or at the end of the day when they send all the bulk data.


AIUI, it wasn't a MitM attack, rather malware that listened to the
conversations and batched up the information and sent it to the perps.
Though they haven't said (to my knowledge), but it seems that it had
to have been an inside job.


If PIN codes were captured, then it must have been in real time. And why
does the merchant need the 3 digit verifier if the card is swiped?


The merchant uses it to show he was "in possession" of the card (lower
transaction fees, AIUI). The only information that's really needed is
on the mag stripe, though. The perps can do enough damage just
counterfeiting the cards.

G. Morgan[_10_] December 27th 13 07:03 PM

OT Target Hacked
 
wrote:

I have not researched the details, but are you saying a MitM attack was
used? That's 40 million transactions being listened to. Someone must
have access to the last hop of the router as the sales were being done in
real time or at the end of the day when they send all the bulk data.


AIUI, it wasn't a MitM attack, rather malware that listened to the
conversations and batched up the information and sent it to the perps.
Though they haven't said (to my knowledge), but it seems that it had
to have been an inside job.


I'll be reading more about it as details come out.

If PIN codes were captured, then it must have been in real time. And why
does the merchant need the 3 digit verifier if the card is swiped?


The merchant uses it to show he was "in possession" of the card (lower
transaction fees, AIUI). The only information that's really needed is
on the mag stripe, though. The perps can do enough damage just
counterfeiting the cards.


That's the purpose of the "swipe" rather than typing in numbers. Do you
know if the 3 digit code is stored on the stripe?

I wonder how hard it would be to reverse engineer the algorithm used to
create the 3 digit code?





--

They who can give up essential liberty to obtain a little temporary safety,
deserve neither liberty nor safety. - Ben Franklin

[email protected] December 27th 13 07:37 PM

OT Target Hacked
 
On Fri, 27 Dec 2013 13:03:34 -0600, G. Morgan
wrote:

wrote:

I have not researched the details, but are you saying a MitM attack was
used? That's 40 million transactions being listened to. Someone must
have access to the last hop of the router as the sales were being done in
real time or at the end of the day when they send all the bulk data.


AIUI, it wasn't a MitM attack, rather malware that listened to the
conversations and batched up the information and sent it to the perps.
Though they haven't said (to my knowledge), but it seems that it had
to have been an inside job.


I'll be reading more about it as details come out.


Sure, the details are pretty sketchy and often contradictory but
that's what passes for the "news" these days.

If PIN codes were captured, then it must have been in real time. And why
does the merchant need the 3 digit verifier if the card is swiped?


The merchant uses it to show he was "in possession" of the card (lower
transaction fees, AIUI). The only information that's really needed is
on the mag stripe, though. The perps can do enough damage just
counterfeiting the cards.


That's the purpose of the "swipe" rather than typing in numbers. Do you
know if the 3 digit code is stored on the stripe?


I'm not sure. It would seem that they would want a different code on
the "swipe" to differentiate in-person and online transactions, but I
don't know for sure.

I wonder how hard it would be to reverse engineer the algorithm used to
create the 3 digit code?


I don't believe there is anything there to "reverse". AFAIK, it's a
random code assigned by the bank. Sometimes the user is allowed to
change it but that's really a XOR hash in front of the bank-assigned
number, just as your PIN is (though this detail isn't important in
this case). PINs are handled and stored cryptographically and, other
than the keypad at the terminal, never used "in the clear". They're
always encrypted.

Oren[_2_] December 27th 13 07:45 PM

OT Target Hacked
 
On Fri, 27 Dec 2013 13:03:34 -0600, G. Morgan
wrote:

That's the purpose of the "swipe" rather than typing in numbers. Do you
know if the 3 digit code is stored on the stripe?


Some early reports addressed this question. From my take, it depends
on the card issuer? Some use 3 digit, some 4 digit security codes,
some store the PIN on the strip and some don't. It may have the
security code embedded on the strip, too.

SMS December 27th 13 11:27 PM

OT Target Hacked
 
On 12/27/2013 7:29 AM, G. Morgan wrote:
SMS wrote:

On 12/19/2013 6:07 PM, Dean Hoffman wrote:

The discounter Target had their site hacked. Something like forty
million debit and credit accounts could be affected.
Article he http://tinyurl.com/mgv8pwe


What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.

http://www.politico.com/story/2013/12/hacked-why-target-became-a-target-101447.html

The banks and retailers will not act in the best interest of consumers
on their own. Legislation is necessary.


Why more legislation? Any card with a Visa or Mastercard logo is
protected from fraud by the bank. It may be inconvenient while waiting
on a new card, but the loss goes to the bank and whoever mishandled the
data.


It's not just the inconvenience of waiting for a new card. First, anyone
foolish enough to use a debit card has the funds removed from their
checking account and then has to wait for them to be restored. Second,
it's a real PITA to have to fix every automatic payment account every
time your card is compromised.

bob haller December 28th 13 12:21 AM

OT Target Hacked
 


Adds a layer of security. If you stole my card and don't know where I

live, the charge will be refused.


the stolen numbers come with the zip code of the card owner.........

my debit card got canceled, bank is sending me a new card. then must change all the auto card withdrwaws like my ez pass.....

read this mess might cost target over 2 billion in fines for running a not secure system 90 bucks per card adds up......


The Daring Dufas[_8_] December 28th 13 03:31 AM

OT Target Hacked
 
On 12/27/2013 11:24 AM, wrote:
On Fri, 27 Dec 2013 09:29:57 -0600, G. Morgan
wrote:

SMS wrote:

On 12/19/2013 6:07 PM, Dean Hoffman wrote:

The discounter Target had their site hacked. Something like forty
million debit and credit accounts could be affected.
Article he
http://tinyurl.com/mgv8pwe

What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.

http://www.politico.com/story/2013/12/hacked-why-target-became-a-target-101447.html

The banks and retailers will not act in the best interest of consumers
on their own. Legislation is necessary.


Why more legislation? Any card with a Visa or Mastercard logo is
protected from fraud by the bank. It may be inconvenient while waiting
on a new card, but the loss goes to the bank and whoever mishandled the
data. The US government does not need to intrude with more regulations.
If the issuer is happy to take the hit, they are the ones that need to
wise-up. Target didn't even have a reason to store the card info, to me
they are solely responsible and I'm sure the banks will sue Target for
all the refunds, time & labor, new cards, and other expenses related to
making things right with their customers.


Agreed, with a couple of points of clarification. VISA and MasterCard
only guarantee the transaction if it goes through their clearing house
(as a credit transaction). If it's a debit transaction, the rules are
different and it's up to your bank.

AIUI, the data was lifted in transit through Target's clearing house.
They certainly did have the need for the data as it passed through.
This (apparently) wasn't a case where Target stored data they weren't
supposed to. However, they will still be on the hook for mishandling
the data. It was a hack to their system (my bet is that it was an
inside job).

Heck, they should have named the store 'TARGET' with a giant bulls eye
for a logo. They almost dared someone to try! ;-)


;-)


A few years ago me and my roommate were installing new Cisco high
security wireless access points in Marshalls & T.J.Maxx stores because
someone got into their systems through the old wireless AP's for the
wireless bar code scanners used for inventory control. I could pick up
the signal from the parking lot and that's where miscreants accessed
the network. We were installing the high security AP's in a number of
different retail stores and pharmacies. We've never done any work in
Target stores so I don't know what they're using, in fact, I've never
been inside a Target store. ^_^

TDD

G. Morgan[_10_] December 28th 13 07:01 PM

OT Target Hacked
 
sms wrote:

On 12/27/2013 7:29 AM, G. Morgan wrote:
SMS wrote:

On 12/19/2013 6:07 PM, Dean Hoffman wrote:

The discounter Target had their site hacked. Something like forty
million debit and credit accounts could be affected.
Article he http://tinyurl.com/mgv8pwe

What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.

http://www.politico.com/story/2013/12/hacked-why-target-became-a-target-101447.html

The banks and retailers will not act in the best interest of consumers
on their own. Legislation is necessary.


Why more legislation? Any card with a Visa or Mastercard logo is
protected from fraud by the bank. It may be inconvenient while waiting
on a new card, but the loss goes to the bank and whoever mishandled the
data.


It's not just the inconvenience of waiting for a new card. First, anyone
foolish enough to use a debit card has the funds removed from their
checking account and then has to wait for them to be restored. Second,
it's a real PITA to have to fix every automatic payment account every
time your card is compromised.


That's true. I limit the automatic payments to insurance and a storage
unit I rent.

--

They who can give up essential liberty to obtain a little temporary safety,
deserve neither liberty nor safety. - Ben Franklin

DerbyDad03 December 29th 13 12:12 AM

OT Target Hacked
 
sms wrote:
On 12/27/2013 7:29 AM, G. Morgan wrote:
SMS wrote:

On 12/19/2013 6:07 PM, Dean Hoffman wrote:

The discounter Target had their site hacked. Something like forty
million debit and credit accounts could be affected.
Article he http://tinyurl.com/mgv8pwe

What's needed is legislation to force credit and debit card issuers in
the United States to adopt the technology used in the rest of the world,
chips embedded in the card. A few credit card issuers in the U.S. will
provide these cards upon request but they're only for use in countries
where the merchants (and automated machines) have the readers.

http://www.politico.com/story/2013/12/hacked-why-target-became-a-target-101447.html

The banks and retailers will not act in the best interest of consumers
on their own. Legislation is necessary.


Why more legislation? Any card with a Visa or Mastercard logo is
protected from fraud by the bank. It may be inconvenient while waiting
on a new card, but the loss goes to the bank and whoever mishandled the
data.


It's not just the inconvenience of waiting for a new card. First, anyone
foolish enough to use a debit card has the funds removed from their
checking account and then has to wait for them to be restored. Second,
it's a real PITA to have to fix every automatic payment account every
time your card is compromised.


I have never had to "fix" an automatic payment for a compromised debit
card, because I've never had a debit card compromised. Expiration date,
yes, but the same thing happens with credit cards, so that's a wash. In
fact, it's all a wash since compromised credit cards need to be "fixed"
also.

Other than the time to restore funds, credit cards and debits have the same
compromised and expiration dates issues.

Kurt Ullman December 29th 13 12:46 PM

OT Target Hacked
 
In article
,
DerbyDad03 wrote:

Other than the time to restore funds, credit cards and debits have the same
compromised and expiration dates issues.


Well, the debit cards also screw up your checking account and can lead
to overdrafts, etc. If I have a screwed up credit card it doesn't
directly (or indirectly for that matter) mess up my every day banking
whilst it gets sorted out.
--
€śStatistics are like bikinis. What they reveal is suggestive,
but what they conceal is vital.€ť
€” Aaron Levenstein

Ed Pawlowski December 29th 13 06:30 PM

OT Target Hacked
 
On Sun, 29 Dec 2013 07:46:44 -0500, Kurt Ullman
wrote:

In article
,
DerbyDad03 wrote:

Other than the time to restore funds, credit cards and debits have the same
compromised and expiration dates issues.


Well, the debit cards also screw up your checking account and can lead
to overdrafts, etc. If I have a screwed up credit card it doesn't
directly (or indirectly for that matter) mess up my every day banking
whilst it gets sorted out.



Your bank should be offering for you to opt out of overdraft coverage.
The charge would be refused rather than pay it and sock you for about
$30 for a screw up.

Kurt Ullman December 29th 13 09:48 PM

OT Target Hacked
 
In article ,
Ed Pawlowski wrote:

On Sun, 29 Dec 2013 07:46:44 -0500, Kurt Ullman
wrote:

In article
,
DerbyDad03 wrote:

Other than the time to restore funds, credit cards and debits have the same
compromised and expiration dates issues.


Well, the debit cards also screw up your checking account and can lead
to overdrafts, etc. If I have a screwed up credit card it doesn't
directly (or indirectly for that matter) mess up my every day banking
whilst it gets sorted out.



Your bank should be offering for you to opt out of overdraft coverage.
The charge would be refused rather than pay it and sock you for about
$30 for a screw up.


But the money would still be out of the main account so you wouldn't be
able to pay electical bills, groceries, etc., until it got sorted out.
With a credit card, it doesn't matter since you have at the very least
30 days or so to sort things otu and you'd still be able to buy stuff
using your checking or savings accounts.
--
"Statistics are like bikinis. What they reveal is suggestive,
but what they conceal is vital."
-- Aaron Levenstein

[email protected] December 29th 13 10:19 PM

OT Target Hacked
 
On Sun, 29 Dec 2013 16:48:09 -0500, Kurt Ullman
wrote:

In article ,
Ed Pawlowski wrote:

On Sun, 29 Dec 2013 07:46:44 -0500, Kurt Ullman
wrote:

In article
,
DerbyDad03 wrote:

Other than the time to restore funds, credit cards and debits have the same
compromised and expiration dates issues.

Well, the debit cards also screw up your checking account and can lead
to overdrafts, etc. If I have a screwed up credit card it doesn't
directly (or indirectly for that matter) mess up my every day banking
whilst it gets sorted out.



Your bank should be offering for you to opt out of overdraft coverage.
The charge would be refused rather than pay it and sock you for about
$30 for a screw up.


But the money would still be out of the main account so you wouldn't be
able to pay electical bills, groceries, etc., until it got sorted out.
With a credit card, it doesn't matter since you have at the very least
30 days or so to sort things otu and you'd still be able to buy stuff
using your checking or savings accounts.


That's really the only difference between a CC and debit card (unless
the PIN is compromised). If you're in the habit of running your
checking account to zero, this is only one of the many problems that
you're setting yourself up for (and it's reversible).

Kurt Ullman December 30th 13 12:21 PM

OT Target Hacked
 
In article ,
wrote:

That's really the only difference between a CC and debit card (unless
the PIN is compromised). If you're in the habit of running your
checking account to zero, this is only one of the many problems that
you're setting yourself up for (and it's reversible).

But even if you aren;t one who keeps it near zero, someone gets the PIN
and loots the account, then you have no cash (essentially) to pay
anything until the fix is made.
--
"Statistics are like bikinis. What they reveal is suggestive,
but what they conceal is vital."
-- Aaron Levenstein

Ed Pawlowski December 30th 13 04:47 PM

OT Target Hacked
 
On 12/30/2013 7:21 AM, Kurt Ullman wrote:
In article ,
wrote:

That's really the only difference between a CC and debit card (unless
the PIN is compromised). If you're in the habit of running your
checking account to zero, this is only one of the many problems that
you're setting yourself up for (and it's reversible).

But even if you aren't one who keeps it near zero, someone gets the PIN
and loots the account, then you have no cash (essentially) to pay
anything until the fix is made.


True, but the damage cannot go below $0 if they don't pay overdrafts and
it can be sorted out in about 24 hours at a good bank. Not a perfect
scenario, but not doomsday either.

On line transactions, I do use a CC rather than a DC for the reason you
mention.


[email protected] December 30th 13 05:58 PM

OT Target Hacked
 
On Mon, 30 Dec 2013 11:47:49 -0500, Ed Pawlowski wrote:

On 12/30/2013 7:21 AM, Kurt Ullman wrote:
In article ,
wrote:

That's really the only difference between a CC and debit card (unless
the PIN is compromised). If you're in the habit of running your
checking account to zero, this is only one of the many problems that
you're setting yourself up for (and it's reversible).

But even if you aren't one who keeps it near zero, someone gets the PIN
and loots the account, then you have no cash (essentially) to pay
anything until the fix is made.


True, but the damage cannot go below $0 if they don't pay overdrafts and
it can be sorted out in about 24 hours at a good bank. Not a perfect
scenario, but not doomsday either.


I can be much less than this. When it happened to me, the charges
were reversed while my wife was on the phone with them. Technically,
she shouldn't have been able to do it but...

On line transactions, I do use a CC rather than a DC for the reason you
mention.


Ditto. I never let the DC, or its number,leave my hands. I don't
give it to waitresses at restaurants, for instance.

Kurt Ullman December 30th 13 06:21 PM

OT Target Hacked
 
In article ,
wrote:

On line transactions, I do use a CC rather than a DC for the reason you
mention.


Ditto. I never let the DC, or its number,leave my hands. I don't
give it to waitresses at restaurants, for instance.


I only use the DC at ATMs and then only at banks and then only after I
take the place to insert the card, give it a good shake to make sure it
isn't a skimmer. Not that I am paranaoid or anything....(grin)
--
"Statistics are like bikinis. What they reveal is suggestive,
but what they conceal is vital."
-- Aaron Levenstein

DerbyDad03 December 31st 13 12:33 AM

OT Target Hacked
 
Kurt Ullman wrote:
In article ,
wrote:

That's really the only difference between a CC and debit card (unless
the PIN is compromised). If you're in the habit of running your
checking account to zero, this is only one of the many problems that
you're setting yourself up for (and it's reversible).

But even if you aren;t one who keeps it near zero, someone gets the PIN
and loots the account, then you have no cash (essentially) to pay
anything until the fix is made.


That assumes that the DC account is the only account with available cash.
It's not that way in my case.

Kurt Ullman December 31st 13 12:49 PM

OT Target Hacked
 
In article
,
DerbyDad03 wrote:

Kurt Ullman wrote:
In article ,
wrote:

That's really the only difference between a CC and debit card (unless
the PIN is compromised). If you're in the habit of running your
checking account to zero, this is only one of the many problems that
you're setting yourself up for (and it's reversible).

But even if you aren;t one who keeps it near zero, someone gets the PIN
and loots the account, then you have no cash (essentially) to pay
anything until the fix is made.


That assumes that the DC account is the only account with available cash.
It's not that way in my case.


Don't DCs have to be tied to checking accounts?
--
€śStatistics are like bikinis. What they reveal is suggestive,
but what they conceal is vital.€ť
€” Aaron Levenstein

DerbyDad03 December 31st 13 02:42 PM

OT Target Hacked
 
Kurt Ullman wrote:
In article
,
DerbyDad03 wrote:

Kurt Ullman wrote:
In article ,
wrote:

That's really the only difference between a CC and debit card (unless
the PIN is compromised). If you're in the habit of running your
checking account to zero, this is only one of the many problems that
you're setting yourself up for (and it's reversible).
But even if you aren;t one who keeps it near zero, someone gets the PIN
and loots the account, then you have no cash (essentially) to pay
anything until the fix is made.


That assumes that the DC account is the only account with available cash.
It's not that way in my case.


Don't DCs have to be tied to checking accounts?


I believe so, at least mine is.

However, my checking account isn't the only account that has cash in it. I
can transfer cash from my savings account to my checking account or
withdraw it outright. I was responding to your claim that "you have no cash
to pay anything until the fix is made".


All times are GMT +1. The time now is 03:51 PM.

Powered by vBulletin® Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004 - 2014 DIYbanter