Breached Retailers Harden PoS, For Now

This time, it was the gourmet sandwich-maker with freakishly fast delivery standards that was late discovering that point-of-sale systems in more than 200 of its stores had been infiltrated with malware that swallowed its customer payment card information.

Jimmy John's, like other major US retailers before it such as Home Depot and Goodwill Industries, fell victim to cyber criminals, who literally followed the money and nabbed the necessary log-in credentials from their point-of-sale-system vendors that customers use to scan their debit and credit cards when they purchase their subs, home improvement project materials, or secondhand clothing. Like Home Depot and Goodwill -- and Target -- Jimmy John's said it has since cleaned up the malware and added encryption to its PoS systems so bad guys can't read the card data when it gets swiped at the register.

The underlying problem with the majority of payment cards issued in the US, of course, is the magnetic stripe on them that stores the sensitive customer and account number information that the crooks crave and have been so easily been able to grab when it hits the RAM of the devices. Calls for chip-and-PIN technology, where smart cards with embedded microchips authenticate the user's identity, have intensified in the US retail industry and consumer world, but the conversion will take time. So in the meantime, Jimmy John's and other retailers are adding encryption to lock down their POS systems, and some retailers are expediting the rollout of chip-and-PIN payment cards as well.

Home Depot, for instance, added Voltage Security encryption products to its POS system, and plans to provide chip-and-PIN payment technology in the US by the year's end. Chip-and-pin is already used in its stores in Canada. Target's REDcards will all be chip-and-PIN-based starting early next year.

"These attacks highlight the need for chip-and-PIN. If the attractiveness of POS malware comes from the fact that stolen card data is easily used to duplicate cards, chip-and-PIN is the answer," says Allie Brandenburger, a spokesperson for the Retail Industry Leaders Association (RILA), which boasts Target among its members.

Retailers are considering several best-practices for locking down payment card data, she says. End-to-end encryption is one, she says. "This makes it significantly more difficult for things like network sniffing tools to pick up the numbers in transit.  Additionally, encrypting data stored on the POS system is another thing to do," she says. "Tokenization is another good step because this makes the number stored in the system worthless." 

Steven Adair, founder and CEO of the IR firm Volexity LLC, says PoS systems obviously should not have Internet access, and any outbound movement should be on a whitelist. "Having them locked down and monitored as close as possible would probably be prudent as well. These machines should essentially be small fortresses. It should be very difficult to have software installed on them," Adair says.

According to one retail trade association representative, the wave of payment card breaches is its top priority. "Everybody wants to protect their brand and their customers," says the representative, who requested anonymity. Aside from encryption, retailers are finding they have to also change default passwords from POS System vendors. On the horizon is the tokenization of some sensitive data, as well as the next-generation chip & PIN cards.

"We're tasked with protecting 40-year-old technology" today, says the retail representative, referring to magnetic stripe-based cards.

Aviv Raff, CTO at Seculert, says it's taking retailers far too long to discover the POS malware. "In all the recent breaches, it's amazing to see how long attackers have been able to stay under the radar before being revealed," Raff says. "More and more enterprises need to shift their mindset and know they probably already have been compromised, and shift their budget from trying to prevent attacks to trying to detect something in their network. The retailers keep waiting for someone to knock on their door" and tell them they've been breached, he says.