Someone just lost 324k payment records, complete with CVVs
1–10 of 13 posts
Re: Someone just lost 324k payment records, complete with CVVs
#2"Let's talk about that CVV for a moment. ... PCI DSS is very clear about how the CVV (or CVV2 as it is these days) should be stored ... It shouldn't be stored and that's what makes this breach such a big issue. Violation of PCI DSS guidelines can lead to pretty serious fines and even loss of merchant facilities; the card providers take this very seriously.
It checked out - this is the CVV."
Re: Someone just lost 324k payment records, complete with CVVs
#3"Let's talk about that CVV for a moment. ... PCI DSS is very clear about how the CVV (or CVV2 as it is these days) should be stored ... It shouldn't be stored and that's what makes this breach such a big issue. Violation of PCI DSS guidelines can lead to pretty serious fines and even loss of merchant facilities; the card providers take this very seriously. It checked out - this is the CVV."
I learned this the first time I was implementing a system. They gave me the guidelines and I was like, good deal, no CVV. Pretty easy but how many developers actually ever see real requirements?
Re: Someone just lost 324k payment records, complete with CVVs
#4"Let's talk about that CVV for a moment. ... PCI DSS is very clear about how the CVV (or CVV2 as it is these days) should be stored ... It shouldn't be stored and that's what makes this breach such a big issue. Violation of PCI DSS guidelines can lead to pretty serious fines and even loss of merchant facilities; the card providers take this very seriously. It checked out - this is the CVV."
I learned this the first time I was implementing a system. They gave me the guidelines and I was like, good deal, no CVV. Pretty easy but how many developers actually ever see real requirements?
That's because you have a brain. You wouldn't believe some of the stuff I've seen people try to use.
So much copypasta, often with just enough changed to be hacked into a customer's system.
Re: Someone just lost 324k payment records, complete with CVVs
#5The author doesn't explicitly mention it, but the CVVs were saved as a part of debug logging. That mistake should serve as a warning to others implementing PCI DSS systems.
Re: Someone just lost 324k payment records, complete with CVVs
#6The author doesn't explicitly mention it, but the CVVs were saved as a part of debug logging. That mistake should serve as a warning to others implementing PCI DSS systems.
Debugging or not, you must never store the CVV per guidelines. Send it out, done.
Re: Someone just lost 324k payment records, complete with CVVs
#7"Let's talk about that CVV for a moment. ... PCI DSS is very clear about how the CVV (or CVV2 as it is these days) should be stored ... It shouldn't be stored and that's what makes this breach such a big issue. Violation of PCI DSS guidelines can lead to pretty serious fines and even loss of merchant facilities; the card providers take this very seriously. It checked out - this is the CVV."
While we're on the subject, how do Amazon get a pass for not making the user re-enter the CVV for every transaction?
Re: Someone just lost 324k payment records, complete with CVVs
#8"Let's talk about that CVV for a moment. ... PCI DSS is very clear about how the CVV (or CVV2 as it is these days) should be stored ... It shouldn't be stored and that's what makes this breach such a big issue. Violation of PCI DSS guidelines can lead to pretty serious fines and even loss of merchant facilities; the card providers take this very seriously. It checked out - this is the CVV."
While we're on the subject, how do Amazon get a pass for not making the user re-enter the CVV for every transaction?
When you're amazon, you can negotiate anything. They're probably the single biggest online credit card merchant.
Re: Someone just lost 324k payment records, complete with CVVs
#9"Let's talk about that CVV for a moment. ... PCI DSS is very clear about how the CVV (or CVV2 as it is these days) should be stored ... It shouldn't be stored and that's what makes this breach such a big issue. Violation of PCI DSS guidelines can lead to pretty serious fines and even loss of merchant facilities; the card providers take this very seriously. It checked out - this is the CVV."
While we're on the subject, how do Amazon get a pass for not making the user re-enter the CVV for every transaction?
AFAIK the CVV is not required to perform a transaction. It's just that you take the hit in case a fraud occurs when you don't check the CVV.
Re: Someone just lost 324k payment records, complete with CVVs
#10Oh man this Troy guy is the hero we need, fighting the good fight.