Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chipotle Reports Findings from Investigation of Payment Card Security Incident

chipotle.com

Post reply on HN
Print view View original

11–20 of 73 posts

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#11

Post by toomuchtodo »

heywire wrote: post #10
toomuchtodo wrote: post #8

Earlier quoted context omitted.

Would you suggest reporting a card lost to get a new number issued if it was used at one of these locations?

Definitely if you used a debit card, since it could take a couple days to get any fraudulent charges reversed. Probably less important if you used a credit card, since you'll not have to pay for those charges and they'll just send you a new card at that point. I guess it just depends on if you want to be inconvenienced now or later :) I personally used my credit card at one of the affected stores, and I do not plan o…

I have an Amex charge card with push notifications, so I'm going to let it ride. Thank you for the reply!

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#12

Post by heywire »

toomuchtodo wrote: post #11
heywire wrote: post #10

Earlier quoted context omitted.

Definitely if you used a debit card, since it could take a couple days to get any fraudulent charges reversed. Probably less important if you used a credit card, since you'll not have to pay for those charges and they'll just send you a new card at that point. I guess it just depends on if you want to be inconvenienced now or later :) I personally used my credit card at one of the affected stores, and I do not plan o…

I have an Amex charge card with push notifications, so I'm going to let it ride. Thank you for the reply!

Amex is probably the company I'd trust the most to handle the situation. I've never been let down by their customer service.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#13

Post by mmanfrin »

heywire wrote: post #5

Hopefully this pushes more and more restaurants towards using separate chip-reader (EMV) pinpad devices. I've noticed several area restaurants switching lately (Arby's, Wendy's), and I hope it continues. These devices use point-to-point encryption, meaning that even if the POS machine is comprimised, no sensitive card data can be stolen. The POS machine never sees raw card data.

Chipreaders are terribly slow, I don't understand how they could not develop a secure payment system without 10-second~ delay times. My local grocery store installed new chip readers and within a week had taped over time in favor of the more-expensive but quicker stripe processing.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#14

Post by icelancer »

Why is there no legal recourse here outside of spending my own time/resources to cancel cards and deal with all the BS that occurs with that whenever this happens? There should be financial repercussions, each affected individual should be awarded monetary compensation for their time.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#15

Post by heywire »

mark_element wrote: post #3
shoover wrote: post #2

What was that thing? It looks like all the stores in my area were hit.

Agreed. Looks like this a big deal™. Would love to know the method of spreading across all their point of sales, were they running on windows?

Domain credentials, an understanding of the IP or hostname scheme and a simple batch file could distribute something like this pretty easily, provided the proper controls aren't in place.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#16

Post by frikk »

My area was hit, and I did get hit with credit card fraud. I suspected a different vector (shady medical vendor and coincidental timing). The card that got hit was indeed used at Chipotle, but a week after the supposed "time range" indicated on the security site. Maybe the time range isn't absolute.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#17

Post by heywire »

mmanfrin wrote: post #13
heywire wrote: post #5

Hopefully this pushes more and more restaurants towards using separate chip-reader (EMV) pinpad devices. I've noticed several area restaurants switching lately (Arby's, Wendy's), and I hope it continues. These devices use point-to-point encryption, meaning that even if the POS machine is comprimised, no sensitive card data can be stolen. The POS machine never sees raw card data.

Chipreaders are terribly slow, I don't understand how they could not develop a secure payment system without 10-second~ delay times. My local grocery store installed new chip readers and within a week had taped over time in favor of the more-expensive but quicker stripe processing.

Unfortunately when you need the chip in the card to sign the transaction details before sending to the bank, validate the response from the bank, and all of the steps in between, it takes a lot of time. There is a ton of work going into making this process faster. Things like EMV Quick Chip and contactless EMV (tap and pay) are quicker, and should be coming to retailers in the US soon. Of course we also have the option of Apple/Android Pay, which is somewhere in the middle.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#18

Post by saidajigumi »

mmanfrin wrote: post #13
heywire wrote: post #5

Hopefully this pushes more and more restaurants towards using separate chip-reader (EMV) pinpad devices. I've noticed several area restaurants switching lately (Arby's, Wendy's), and I hope it continues. These devices use point-to-point encryption, meaning that even if the POS machine is comprimised, no sensitive card data can be stolen. The POS machine never sees raw card data.

Chipreaders are terribly slow, I don't understand how they could not develop a secure payment system without 10-second~ delay times. My local grocery store installed new chip readers and within a week had taped over time in favor of the more-expensive but quicker stripe processing.

Hilariously, using contactless EMV payment (i.e. Apple/Android Pay) with the same POS terminals is lightning fast.

But this gets filed as "infrastructure is hard". A related example: If you get a chance, try the IC card system used by the train and transit systems in Japan; they're delightful.[1] At peak rush-hour, commuters are darn near running through the (many) pay stations tapping through without breaking stride -- including display of remaining balance!

Yet, the relatively recent transit tap card system where I live is laughingly slow. At a much more modest walking pace, it's easy to pull away from the reader before it's confirmed the transaction. Seconds per commuter, for system that's considerably newer than the IC card system.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#19

Post by heywire »

saidajigumi wrote: post #18
mmanfrin wrote: post #13

Earlier quoted context omitted.

Chipreaders are terribly slow, I don't understand how they could not develop a secure payment system without 10-second~ delay times. My local grocery store installed new chip readers and within a week had taped over time in favor of the more-expensive but quicker stripe processing.

Hilariously, using contactless EMV payment (i.e. Apple/Android Pay) with the same POS terminals is lightning fast. But this gets filed as "infrastructure is hard". A related example: If you get a chance, try the IC card system used by the train and transit systems in Japan; they're delightful.[1] At peak rush-hour, commuters are darn near running through the (many) pay stations tapping through without breaking stride…

Something to keep in mind is that Apple/Android Pay support both MSD (magnetic stripe data) and EMV contactless modes, which can result in different timings. EMV contactless also drops significant portions of the EMV contact requirements. This is why banks generally won't let you get cash back, or make large purchases on contactless, there's a trade off.
Post reply on HN