Card Breaches at Car Washes

Considering how expensive point-of-sale systems are, I'm not surprised that these systems are running old, vulnerable software. Heck, there are still ATMs running OS/2 Warp in the United States; the only reason people don't hack those is because it's so obscure.

My father still uses a small pre-computer cash register to this day; I've had no luck convincing him to buy a new computerized one so he can accept credit cards.

One of the most striking things to me is this sentence: "Trustwave and other companies that get hired to investigate breaches involving card data is that far too many point-of-sale breaches start when the thieves abuse some kind of remote access tool installed on the point-of-sale device itself."

We have an incredibly secure and successful piece of remote access software (ssh) that is used on billions of computers and yet that sentence exists. It seems that sometimes it's not just an engineering problem.

I get the low level carders (or whatever you call them -- the folks buying card data and attempting to steal goods with it). If you're stealing $500 worth of gift cards at a time, it's not like you have many life alternatives.

But somewhere there's a series of folks that (1) engineered a symantec breach; (2) someone else either knew #1 or figured out how to get their hands on source; (3) security audited said source; (4) scanned the internet to find vulnerable servers; (5) pulled cards off those servers, and (6) sold them. It seems like there's more than enough technical knowhow here that these folks should be able to get software or security jobs, no? It doesn't seem like the card thieves make so much money that the reward / federal pound-me-in-the-ass prison ratio skews far enough.

And the more I read krebs, the more I think I should get a $2k limit credit card and use it for all purchases that aren't on amazon.

SSH is no better than some random Windows-based remote admin tool if the same default password is used.