Data Breach , Fraud

Investigators Identify Two POS Malware Attack Waves Jeremy Kirk (jeremy_kirk) • July 8, 2016    

Fast-food chain Wendy's says a cyberattack that stole payment card details affected 1,025 U.S. restaurants owned by franchisees, a far higher figure than first estimated.

See Also: How to Mitigate Credential Theft by Securing Active Directory

In May, Wendy's said fewer than 300 restaurants had been affected by the breach, which saw malware installed on point-of-sale systems. But on June 9, it said additional variants of the malware had been discovered, indicating a deeper breach.

Wendy's has created an online tool where patrons can check if a restaurant they visited was affected by the attacks, with search fields for the state and city.

A search showed customer payment details in some locales were at risk as late as June 10. But the systems are now clean.

"Working with our cybersecurity investigators, the malware has been disabled where it was found," says Bob Bertini, Wendy's senior director of corporate communications, via email.

Two Waves of Attacks

The company appears to have fought a long battle against the hackers since late January when card issuers began noticing fraud patterns linked to payment cards used at restaurants (see 'Where's the Breach?').

"We had two waves of attacks, both starting in the fall," Bertini says.

The first wave of malware was disabled in March, and the second wave - discovered in May - was cleaned up last month, Bertini says.

The finding of a second wave of malware shows how hard it can be for breached entities to figure out the extent of a compromise, says Avivah Litan, a financial fraud expert and analyst at the consultancy Gartner.

"This comes as no surprise because Wendy's is not in business to audit its systems beyond what PCI requires, and stealthy criminals don't leave many traces of their activities," Litan says. "This lack of effective auditing and monitoring is also why the breach went on so long unnoticed."

The data exposed included Track 1 and Track 2 data, which contains an account holder's name, the primary account number, expiration date, service and verification codes.

In May, Wendy's said the malware infected one type of POS system, which it did not identify. The attacks did not affect restaurants that use NCR Aloha POS, which is installed at locales directly owned by the company and in the majority of franchises. Wendy's has about 5,500 franchises in North America.

Compromise via Third-Party Credentials?

The cybercriminals are believed to have used access credentials from other service providers that had access to Wendy's systems in order to deploy malware on franchisees' POS systems, writes Wendy's CEO and President Tom Penegor in a statement.

That has been a common technique employed by cyberattackers. Rather than directly targeting an organization, hackers often find weaknesses in the networks of suppliers that have access to their clients' networks.

Target's attackers, for instance, gained access to the retailer through a contactor called Fazio Mechanical Services, which installs refrigeration systems for grocery stores (see Target Vendor Acknowledges Breach).

The contractor maintained a data link with Target for billing and project management purposes. Target suffered a loss of 40 million payment cards and 70 million other records, setting off a years-long chain of lawsuits and legal grief (see Target, Visa Reach Breach Settlement).

The type of malware typically installed on a POS system by an attacker is known as a RAM scraper. The malware collects unencrypted payment cards details from a computer's memory immediately after a card is swiped. The unencrypted payment card information sits only briefly in memory, but for enough time to be collected by the malware.

The seemingly nonstop spate of payment card breaches in recent years has prompted many U.S. retailers to speed their transition to accommodate EMV cards, which have a microchip that cryptographically signs transactions. But EMV doesn't provide a defense against RAM-scraping attacks, according to a white paper from Trend Micro.

Instead, EMV makes captured card data harder to use. If criminals try to clone a payment card by copying stolen payment data, the network should recognize that the card doesn't have the microchip and deny the transaction. But the stolen data could still be used for card-not-present transactions, and regions where payment cards have microchips have typically seen that type of fraud rise.

Nonetheless, due in part to a strong push by the card brands and a liability shift that took effect last October, many U.S. retailers are moving to EMV.

Wendy's Faces Lawsuits

Wendy's breach has already attracted lawsuits. In February, First Choice Federal Credit Union filed a class-action lawsuit in a Pennsylvania federal court alleging that the breach was the "inevitable result of Wendy's pervasive and inadequate approach to data security." The suit seeks compensation for breach-related expenses (see Suit Against Wendy's Cites Lack of EMV).

Ironically, Wendy's has been engaged in a four-year push to upgrade its POS systems, but some franchisees have resisted. In December 2014, Wendy's filed a lawsuit against DavCo., one of its largest franchisees, in part for not moving fast enough to install the NCR Aloha POS system.

DavCo. countered "that the new POS system has been fraught with serious technical and operational problems, and that Wendy's has acknowledged such problems," according to the First Choice Federal Credit Union complaint. DavCo. further alleged that at one point that Wendy's indefinitely suspended most installations of Aloha.

POS Malware Reportedly Harvested More Than 50,000 Cards Mathew J. Schwartz (euroinfosec) • July 11, 2016     Omni Rancho Las Palmas Resort & Spa in California

Omni Hotels & Resorts warns customers that hackers infiltrated its networks and for six months used point-of-sale malware to siphon off payment card data.

See Also: Vulnerability Management with Analytics and Intelligence

In a July 8 notice posted on its website, the Dallas-based luxury hotel chain said that it first learned of the data breach on May 30; it doesn't say how. Related malware infections began at some properties on Dec. 23, 2015, and lasted up to June 14, the hotel says.

Omni runs 46 properties in the United States, plus two each in Canada and Mexico. Its data breach notification does not detail how many of those properties were hacked or how many customers had their payment card details compromised by attackers.

"The malware was designed to collect certain payment card information, including cardholder name, credit/debit card number, security code and expiration date," Omni says in its breach notification. "Upon learning of the intrusion, we promptly engaged leading IT investigation and security firms approved by the major credit card companies to determine the facts and contain the intrusion. The issue has been resolved, and we have taken steps to further strengthen our systems. We have contacted law enforcement and are cooperating with its investigation."

Omni Hotels couldn't be immediately reached for comment on which cybersecurity firms it hired or how many customers may have been affected.

But Andrei Barysevich, director of Eastern European research and analysis for Flashpoint - a company that specializes in cybercrime intelligence - tells The Wall Street Journal that related fraud was first spotted in February after a hacker called JokerStash began selling more than 50,000 payment cards stolen from Omni Hotels on underground forums.

Barysevich said Flashpoint has been helping payment card issuers and payment processors investigate the Omni breach. JokerStash regularly works with other hackers, who continue to refine their POS malware, he added. "They have a very sophisticated operation going on," he told the newspaper.

Investigators: Only Payment Cards Compromised

Based on the investigation to date, Omni says the hack attack only appeared to lead to POS malware infections and apparently did not touch any other systems housing customers' personally identifiable information or payment card data. "Accordingly, if you did not physically present your payment card at a point-of-sale system at one of the affected Omni locations, we do not believe your payment card was affected," the notification reads. "Additionally, there is no evidence that other customer information, such as contact information, Social Security numbers or PINs, were affected by this issue."

The company's breach announcement arrives less than two weeks after Omni Hotels announced that it had hired Ken Barnes, an IT executive with extensive experience in the hospitality industry, to serve as its CIO.

Omni didn't immediately respond to a request for comment about whether it previously employed a CIO, and if so, if the departure of that individual was tied to the data breach.

Identity Theft Cleanup Service Offered

Omni Hotels says that potentially affected customers can receive prepaid identity theft cleanup assistance until July 8, 2017, from AllClear ID. That service says it helps identity theft victims clean up any mess that results from their personal details and payment card data having been stolen and used to commit fraud.

As with most data breaches, however, it's largely up to consumers to spot any related fraud and attempt to recover fraudulent charges. While U.S. consumer protection law stipulates that credit-card-holders have a maximum liability of $50 per card - though many issuers waive even that fee - no such protections exist for debit cards.

In addition, breached businesses such as Omni Hotels do not compensate customers for time spent attempting to clean up any related mess.

POS Malware Epidemic Continues

Security experts say that most POS malware infections could be prevented if hotels and retail chains segmented their networks, audited POS devices before deploying them, changed devices' default account names and passwords, and employed monitoring and anti-malware tools (see Why POS Malware Still Works).

Nevertheless, related infections continue. In the past 12 months, for example, a number of hotels have reported POS malware infections - often affecting their check-in systems, as well as restaurants and bars. Victims have included Hilton, Hyatt and Starwood Hotels and Resorts, as well as Trump Hotels, which potentially fell victim to two separate breaches.

Organizations need to strike a balance in permitting their staff to use so-called "shadow IT" that can help them be more productive while still exerting enough control over the technology to ensure that sensitive data is protected, says security expert Mac McMillan.

The controversy over Hillary Clinton's use of private servers for both her personal and sensitive government email while she served as secretary of the U.S. Department of State spotlights some important issues involving staff attempting to utilize unsanctioned "shadow IT" tools to perform their jobs, which is a common practice, McMillan says in an interview with Information Security Media Group.

"In the estimates I've seen ... 20 percent to 35 percent of the applications that organizations find in their environments is shadow IT, or applications that users have enabled for one business purpose or another," says McMillan, CEO of the security consulting firm CynergisTek and a former U.S. Department of Defense data security specialist.

"In most cases, they're not using it to get around something or to 'beat' something ... The most often given reason they turn to an application that's part of the shadow IT world is that they're literally trying to get their job done, and trying to find a better, more effective, more efficient way of doing it," he says.

Organizations in all sectors should expect that staff members will turn to shadow IT, so they need to address the risks involved.

"You need to strike a balance between giving your staff flexibility to be innovative and to use different tools that may make them more productive ... more efficient, and may produce a better product, while at the same time providing [the organization] with a level of control so that you don't go sideways in terms of a compliance requirement ... [safeguarding] financial information or protecting patient information," he says.

Critical Steps

Organizations need to communicate to their staff their policies regarding the use of "shadow IT" such as software-as-a-service, infrastructure-as-a-service, cloud storage and personal mobile devices connecting to their networks, he stresses.

To help address security, McMillan says, organizations should, for example, consider establishing "a secure way for people to access these different SaaS tools in an environment where it doesn't put the rest of the network at risk. Perhaps you create a part of your network that allows [users] to log into that."

Other mitigating controls, he says, include restricting the functionality of some applications that could put data at risk, forcing encryption before files can be stored and deploying data loss prevention tools.

"Most of these [shadow] apps are not the problem," he says. "If there are ways the user could acquire these applications in a safe manner, have them set up properly and use them in a smart fashion, then they're just like any other app."

In the interview, McMillan also discusses:

Common types of "shadow IT" found in healthcare entities and other organizations; When shadow IT is used with malicious intent; The use of shadow IT in other government agencies beyond the Department of State.

McMillan is co-founder and CEO of CynergisTek Inc. an Austin, Texas-based consultancy specializing in information security and regulatory compliance in healthcare, financial services and other industries. He has more than 30 years of security and risk management experience, including 20 years at the Department of Defense, most recently at the Defense Threat Reduction Agency. He is also chair of the Healthcare Information and Management Systems Society's privacy and security task force.

A bitter battle flares up in the fiercely competitive endpoint protection products market, and uncovering the real impact over Hillary Clinton's email server. These items highlight this edition of the ISMG Security Report.

You'll hear (click on player beneath image to listen):

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Be sure to check out our July 1 and July 5 reports, which respectively analyze the hacker who calls himself "The Dark Overlord," who has been stealing healthcare databases and then attempting to ransom them back to victim organizations in exchange for bitcoins, and the latest victim of hackers making fraudulent SWIFT transfers. The next ISMG Security Report will be posted Tuesday, July 12.

Theme music for the ISMG Security Report by Ithaca Audio under Creative Commons license.

Encryption , Technology

Quantum Computing Will Shred Current Crypto Systems, Experts Warn Jeremy Kirk (jeremy_kirk) • July 11, 2016    

Quantum computing will pose a grave threat to the encryption algorithms now protecting everything from online banking and e-commerce to email and instant messaging. That's because today's algorithms are largely geared toward making the calculation of the decryption keys for scrambled messages so computationally intensive that the task is effectively impossible. Quantum computers, however, will likely one day make such calculations much more efficient, thus threatening the security of any bit of information that has ever been encrypted.

See Also: The Inconvenient Truth About API Security

While quantum computers are in their infancy, Google has taken a first step toward adapting to the post-quantum cryptography world by launching a two-year experiment that incorporates into its Chrome browser a modified version of a key exchange algorithm called Ring Learning with Errors (Ring-LWE) that's been implemented for OpenSSL. Google's approach is based on a scheme known as "New Hope" that researchers note is designed to provide "post-quantum security for TLS."

OpenSSL is the general purpose cryptography library that provides an open source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, which are used to secure internet communications.

In theory, this new approach will be resistant to key calculation by quantum computers that haven't even been built yet. The tests will be carried out over the next couple of years for a small fraction of connections between Google's domains and people using its Canary version of Chrome, which the company uses to test new features. Users can see if it's in use if they see phrase "CEPQ1_ECDSA" in Chrome's security panel.

This is a Test

Security experts say that knowledge about quantum-computing-related crypto risks isn't new, but note that there's been a recent surge in enthusiasm for solving the problem. "Although people such as me have been talking about the threat to public key cryptography from quantum computers for years, and the alternatives that could be used, it seems that when Google announced that they were experimenting with a post-quantum crypto scheme in Chrome, it caught people's imagination," says Alan Woodward, a computer science professor at the University of Surrey who also serves as a cybersecurity consultant for the EU's law enforcement intelligence agency, known as Europol, in a blog post. "Perhaps this marks the beginning of post-quantum crypto entering the mainstream?"

Interesting that Google plumping for New Hope crypto as their post quantum scheme https://t.co/6yrEvf2wcV

Google, meanwhile, cautions that its Chrome test qualifies as bleeding-edge experimentation and says that it may not prove to be secure. Because of that, Google will continue to employ the widely used elliptic curve cryptography key-exchange algorithm in Chrome. "The post-quantum algorithm might turn out to be breakable even with today's computers, in which case the elliptic-curve algorithm will still provide the best security that today's technology can offer," writes Matt Braithwaite, a Google software engineer. "Alternatively, if the post-quantum algorithm turns out to be secure then it'll protect the connection even against a future, quantum computer."

Seeking Future-Proof HTTPS Security

Most web services are secured using "https," which means the service is using a digital certificate that enables SSL or its successor, TLS. Those certificates use either RSA or ECC keys. ECC keys are shorter but provide the same strength as their equivalent but longer RSA keys, reducing overhead. Although efforts have been underway to increase the length of keys used to secure SSL/TLS transactions, encryption experts predict that such upgrades won't be secure forever.

As noted, current public key cryptography schemes are designed to make it computationally impractical to calculate the decryption keys. The RSA algorithm, for example, creates a public key that is the product of two very large prime numbers. Factoring an RSA public key would, in theory, be much faster using quantum computers. Conventional computers use binary values consisting of a 0 or a 1. Quantum computers use quantum bits - qubits - which are units that can be either a 0 or a 1 at the same time depending on when the state is measured, allowing for much faster parallel calculations.

Quantum Computing is Coming, NSA Warns

The era of quantum computing isn't quite here yet, but there are commercial offerings from companies such as D-Wave. The worry is that once technologists master qubits, trouble will quickly ensue. Those worries were fueled in part by the National Security Agency, which warned in August 2015 that today's algorithms won't hold up against quantum computing.

"Unfortunately, the growth of elliptic curve use has bumped up against the fact of continued progress in the research on quantum computing, which has made it clear that elliptic curve cryptography is not the long-term solution many once hoped it would be," according to the NSA's Information Assurance Directorate. "Thus, we have been obligated to update our strategy."

The agency is investigating various post-quantum crypto strategies, and it notes in a related CNSA Suite and Quantum Computing FAQ released in January that it could take two decades for a new alternative to be deployed across national security systems.

Historical Data at Risk

Once quantum computers can be practically applied to cryptographic systems, any encrypted content ever created - from yesterday, back to the birth of the commercial web in the early 1990s - could be at risk of being cracked. "This means that even encrypted information sitting in a database for 25 years, for example, will be subject to discovery by those with access to quantum computing platforms," according to a "Quantum-Safe Cryptography and Security" white paper published in 2014 by the European Telecommunications Standards Institute. "Without quantum-safe encryption, everything that has been transmitted, or will ever be transmitted, over a network is vulnerable to eavesdropping and public disclosure."

Many security experts suspect that intelligence agencies such the NSA and Britain's GCHQ have been collecting enormous volumes of encrypted Web traffic, waiting for the day when decrypting it becomes feasible. That's why Google's experiment is important. If it proves to be effective, it means that communications could be safer from quantum computing advances - at least for a while.

Surrey University's Woodward, meanwhile, recommends that anyone who has a hand in crypto systems come up to speed on both New Hope as well as Google's implementation. "All of this detail is freely available - although often spread around on the web - and I would encourage those involved in public key cryptography to start to look at it as it is coming to an infrastructure near you in the very near future."

Executive Editor Mathew J. Schwartz also contributed to this report.

Anti-Malware , Forensics , Fraud

SWIFT to Banks: Who You Gonna Call? Hackbusters Team Will Battle Bank Hackers, SWIFT Promises Mathew J. Schwartz (euroinfosec) • July 11, 2016    

After banks get hacked, what's the best way to get them to come clean and share information about their attackers' tools and techniques, to help other financial firms avoid becoming the next victim? Start by making the hacked bank an offer of expert assistance that they can't afford to refuse.

See Also: From Authentication to Advanced Attack Vectors: Top Trends in Cybercrime in Q1 2016

At least, that seems to be part of the impetus behind interbank messaging network SWIFT creating an internal digital forensics and customer security intelligence team, as well as contracting with cybersecurity specialists BAE Systems and Fox-IT to assist. SWIFT says the group will help hacked banks investigate intrusions and fraudulent SWIFT transfers as well as share attack-related intelligence - anonymously - with other banks (see SWIFT Deduction: Assume You've Been Hacked).

The bank-owned, Brussels-based SWIFT cooperative, formally known as the Society for Worldwide Interbank Financial Telecommunication, announced the launch of the new team on July 11 as part of a customer security program unveiled by CEO Gottfried Leibbrandt in May. The program was a reaction to persistent security criticism leveled at SWIFT in the wake of the $81 million heist from Bangladesh Bank earlier this year - in which attackers used fraudulent SWIFT messages to drain funds from the bank's Federal Reserve of New York account - and several other, similar incidents involving other banks.

SWIFT says its new forensics and customer security intelligence team will gather and feed anonymized intelligence to SWIFT-using banks to help them spot and block attacks. The team will also offer assistance to any banks conducting internal investigations on attacks that appear to be related to SWIFT's products or services, in part, by conducting in-depth digital forensic investigations, backed by the two cybersecurity firms that have extensive experience in offering post-breach incident response services to hacked organizations.

The choice of BAE Systems is notable because that firm published pioneering research into the malware that was used against Bangladesh Bank. In May, digital forensic investigators at BAE Systems reported that the malware matched code used against Vietnam's TPBank in late 2015 (see 5 SWIFT Cyber Heist Investigations). Part of the malware's communication channel also matched attack infrastructure that hadn't been used - or seen - since the 2014 attack against Sony Pictures Entertainment, leading some security experts to conclude that the government of North Korea may be behind some recent SWIFT-related fraud incidents.

A SWIFT spokeswoman wasn't immediately able to confirm if SWIFT's help to its customers will come for free.

Promise: Better Intelligence

SWIFT has promised to share anonymized attack-related intelligence not just with its 11,000 bank customers, but also with relevant oversight bodies, information sharing and analysis centers as well as other digital forensic investigation firms (see Federal Reserve Watchdog Probes Banks' Cybersecurity).

To share attack intelligence, however, SWIFT first needs more hacked banks to come clean. To date, at least six banks that have confirmed or suspected SWIFT-related hack attacks have come forward, although anecdotal reports say that a dozen or more related investigations may now be ongoing. Yet some of these hack attacks have only been revealed months after the incident. That was the case for Ecuador's Banco del Austro, which lost $12.2 million after hackers accessed the bank's systems and issued fraudulent SWIFT messages. The attack occurred in January 2015 but only came to light after BDA filed a lawsuit against San Francisco-based Wells Fargo in January, accusing the bank of failing to spot the fraud or to return the full amount that was stolen. Wells Fargo, meanwhile, has fired back, saying it honored valid requests that it had received via the SWIFT messaging system (see Improving Fraud Prevention After SWIFT-Related Heists).

SWIFT has previously said that customers are responsible for securing their own IT environment and are required to report any SWIFT-related breaches to the cooperative (see Banks With Bad Cybersecurity Could Face SWIFT Justice).

But as the BDA hack demonstrates - SWIFT said it only learned of the attack in May, after Reuters first reported on the related lawsuit - not all financial services firms have been complying with those supposed requirements.

Will More Banks Come Clean?

Meanwhile, SWIFT has been continuing to urge targeted banks to come forward.

"Customer intelligence, including intelligence related to attacks that have ultimately failed, is crucial to helping us continue protecting our community. Information we have already received from impacted banks has allowed us to identify new malware and to publish related [indicators of compromise], which are helping to protect the wider community," says SWIFT CTO Craig Young in a statement. "We therefore continue to remind customers that they are obliged to inform SWIFT of such incidents as soon as possible, and to proactively share all relevant information with us so we can assist all SWIFT users."

Now SWIFT is sweetening that request with the offer of incident response assistance and information sharing. But will that be enough to entice more banks to share?