Nearly All U.S. Home Depot Stores Hit By Credit Card Theft • Hacker News Board

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#21

Post by [deleted] » Thu, Sep 04, 2014, 7:10 AM UTC

jacquesm wrote: post #11

nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

> Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards. Wouldn't purchasing them create just one more incentive? Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).

[deleted]

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#22

Post by diafygi » Thu, Sep 04, 2014, 7:11 AM UTC

jacquesm wrote: post #11

nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

> Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards. Wouldn't purchasing them create just one more incentive? Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).

> If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers.

Source: http://geer.tinho.net/geer.blackhat.6viii14.txt

Video: https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#23

Post by aianus » Thu, Sep 04, 2014, 7:15 AM UTC

jacquesm wrote: post #13

btbuilder wrote: post #6

Earlier quoted context omitted.

Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.

The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt. For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.

The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader.

Some other problems with chip-and-pin:

- You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader.

- You get international merchants who have no idea what's going on and make you sign two receipts in addition to entering your pin after trying and failing to swipe it twice.

- You have to type your pin in with your bare hands in -40C weather at the gas station.

- You have to tip waiters with them standing right there and judging you.

- It breaks square and the like

IMO it's an unnecessary mess for anything under ~$50.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#24

Post by stef25 » Thu, Sep 04, 2014, 7:16 AM UTC

aianus wrote: post #4

aioprisan wrote: post #2

This is supposed to be much bigger than the Target breach. If this doesn't give the move to the more secure EMV chip and pin method in the US, nothing will.

I wish they would deny merchant accounts to merchants too cheap/lazy to roll out contactless payments alongside chip and pin. There's nothing more stupid and frustrating than holding up the line doing chip and pin to buy a $5 meal at Subway.

Here in Europe everything's been chip & pin for longer than I can remember, lines are not held up. Takes seconds.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#25

Post by MichaelApproved » Thu, Sep 04, 2014, 7:16 AM UTC

nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge.

Now, these charges are clearly fraudulent. Without going into details, we can 100% detect the fraudulent transactions from real ones. I've suggested to Stripe that this could be a honey-pot setup to identify stolen cards but they've told me that there card processing doesn't have that type of infrastructure. Even if I know a credit card number has been compromised, there is no way to alert the card holder.

It's a shame really. It's not the fault of Stripe that we can't alert the card holder but it's important to know that there is no mechanism to protect card holders, even if you know their card has been compromised.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#26

Post by aianus » Thu, Sep 04, 2014, 7:16 AM UTC

__david__ wrote: post #18

aianus wrote: post #4

Earlier quoted context omitted.

I wish they would deny merchant accounts to merchants too cheap/lazy to roll out contactless payments alongside chip and pin. There's nothing more stupid and frustrating than holding up the line doing chip and pin to buy a $5 meal at Subway.

Where are you from? Around here (Southern California) every card reading machine defaults to debit transactions, where you have to enter your PIN anyway. At least when you do credit cards you don't have to sign them for small purchases any more (less than $50 at Home Depot, for instance). I really can't say I've ever felt frustrated waiting for the person ahead of me to pay (except for maybe old people hand writing c…

Toronto, Canada

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#27

Post by aianus » Thu, Sep 04, 2014, 7:17 AM UTC

jahewson wrote: post #20

btbuilder wrote: post #6

Earlier quoted context omitted.

Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.

That's the case for chip and pin too, low-cost transactions can be authorised with just a swipe.

In Canada, swipe doesn't work anywhere that has the chip-and-pin reader. No matter the amount, if you try swiping it says 'Use Chip'.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#28

Post by jacquesm » Thu, Sep 04, 2014, 7:27 AM UTC

aianus wrote: post #23

jacquesm wrote: post #13

Earlier quoted context omitted.

The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt. For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.

The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader. Some other problems with chip-and-pin: - You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader. - You get international merchants who have no idea what's goi…

I make several payments per day using chip&pin, according to my bank last month more than 300 pin transactions. That's 10 per day (travelling I do this a lot more than when I'm at home).

Online it's not a problem either (fairly easy integration here with a system called 'iDeal'), typing in your pin at -40C at the gas station is still a requirement with the current prices of gas and I'm not one bit bothered by 'waiters judging me', that's a self esteem issue, not a technical one.

As for international merchants who have no idea what is going on: I spend more time abroad than I do in my home country and chip-and-pin have made my life a lot easier than it ever was before in this respect.

Something like 7 countries in the last 3 weeks and I have yet to use my 'cash backup' or my 'credit card backup'.

Contactless is a nice technology but it is as far as I'm concerned a step backwards, I can see the advantages only for bars and festivals where the risk of contaminating your card with fluids is significant and purchases are very small (<$10).

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#29

Post by tonyedgecombe » Thu, Sep 04, 2014, 7:29 AM UTC

kubiiii wrote: post #17

aianus wrote: post #8

Earlier quoted context omitted.

Before Canada implemented Chip and PIN, you usually didn't have to sign the receipt for those kind of small purchases. It takes at least 10x longer now to do the insert, type PIN, remove than just a swipe.

Contactless payment is more and more widespread in france for purchases < € 20.

We are starting to see it in the UK as well, it is very fast.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#30

Post by [deleted] » Thu, Sep 04, 2014, 7:30 AM UTC

btbuilder wrote: post #6

arrrg wrote: post #5

Earlier quoted context omitted.

Does the US use some byzantine tech for chip and PIN? Entering the PIN is about as fast as signing the receipt, at least where I’m from. I doubt it’s much slower than paying cash. (I hand over my card. Card is inserted in reader. I enter my PIN and confirm. Transaction is confirmed after a couple seconds. That can’t be more than ten seconds or so.)

Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.

[deleted]