Michaels Stores' Checkout Terminals Hacked

A typical Michaels retail store

Another credit card security breach again. If you happened to shop at any of the Michaels local stores recently that are located at the following states, your credit transactions may have been compromised:

Illinois, Colorado, Delaware, Gerogia, Iowa, Massachussets, Maryland, North Carolina, New Hampshire, New Jersey, New Mexico, Nevada, New York, Ohio, Pennsylvania, Rhode Islands, Utah, and the State of Washington.

Few days ago, many Michaels' stores have found have been hacked on their PIN readers/Credit Card readers at checkout. The Texas-based arts and crafts supplier has determined that the hacked could have been perpetuated between February 8 through May 6 according to the latest law enforcement investigation. The hack was initiated from PIN pads that are attached to credit card readers where customers use to key in their personal identification numbers upon checkout.

These scam artists were able to steal credit card information including personal PINs. The first discovery of the breach was at a Michael stores in Salt Lake City and Midvale in Utah. As a result, the arts supplier has removed more than 7,200 PIN pads from all its US stores.

I got interested with the story not only because the company is a customer of RGIS LLC, but because I wanted to know how in the world one can hack PIN pads in a busy store at busy checkouts. What is their modus operandi? Was there any collusion between scammers and employees?

Honestly, the trick is quite simple, but with calculated risk. 

A VeriFone PIN pad and Credit Card reader combo.
Image courtesy of VeriFone.

FIRST, there was a careful planning. These criminals pose as legitimate customers of Michaels. At checkout, they then observe several things such as the models/make of Michaels PIN pads, standard cable connectors, etc. Since many Michaels art products sell in less than a dollar range, they can come back as many times as they want and master how the plan works, how many seconds would it take to deinstall and reinstall a new PIN reader, when is the best time to to do it, and how to do it clandestinely without much effort and detection.

SECOND, scheduled activity. Scammers come back in packs of two or three posing as customers not knowing each other. The first act as the customer/installer, the second as a legitimate buyer, the third as customer/distractor. While the second or third scammer busy distracting the unsuspecting cashier with questions related to their purchase, it will take no more than 10 seconds for the first buyer to unplug the old PIN reader and replace it with a reprogrammable RFID chip when the PIN pad is not in use.

THIRD, leave without a trace. After a successful installation, scammers leave the store. Since many newer PIN reader models have built-in RF chips (meaning, it can read your RF-enabled credit card), scammers can easily install PIN readers with a reprogrammed chip. But just outside the store, with the use of a laptop, high frequency RF proximity scanner, and a customized software, they were able to monitor/ skim credit card transactions complete with PIN numbers for the installed compromised PIN reader from a vehicle within dozens feet away from the store.

A typical PIN Reader with a bult-in RF
technology. Photo Courtesy of VeriFone.

The idea that these scammers pose as repairmen may not be suitable in this case because to be able to that you need to appear as repairmen which include having tools and equipment, with uniforms and all that, not mentioning the fact that they need to obtain a clearance from the Store manager FIRST before any repair can be initiated which is not a good idea. Because the lesser people detect your activity, the better your chances.

That is the basic idea of a detectionless PIN reader skimming. But you know it is illegal, right?

Poor Michaels. But how many times I've heard from credit card companies, from POS solutions providers and software vendors that their systems are secured, and reliable. But when things are happening on the contrary, you realized that they themselves need some serious reality check.

The arts supplier is closely monitoring fraudulent transactions with credit card companies while advising all their customers to take precautionary measures. So, if you live in the States I just mentioned, and need to buy your next quilting, embroidery, or arts projects for yourself or for your kids from your local Michaels store, I suggest that you use cash for payment transactions...for now.

For more information on RF-enabled smart cards, read my previous post on RF technology and The ABC of Hacking


Cheers!



You May Like These:

  

Smart Cards: The ABC of Hacking and 5 Tested Ways to Protect Your Cards: Part 3

RF-blocking leather passport and credit card wallets. Although a tinfoil or an aluminum foil can 
block radio wave frequency, and probably the most inexpensive way to protect your ePassports
contactless credit cards, or any smart cards, a leather-coated tinfoil may be a better and
more fashionable alternative. Image courtesy from IDStronghold

Last Updated: December 23,2010 10:20AM

Credit card fraud is billions of dollar business. In US alone,the Boston-based research firm Aite Group LLC has issued a report recently that it costs about $8.6 billion annually. Among these card fraud include in different forms such as cards not present, counterfeit cards, lost/stolen card fraud and first party fraud.

Trustwave company also released a study thru SpiderLabs, which shows that over 38% of credit card hacking-related crimes last year involved hotels than other industries. Other sectors that were cited in the study that were involved with credit card fraud include: the restaurants and bars industry, 13%; the retailing industry, 14.2%; and the financial service industry, 19%.

For this last installment series on contactless smart card, I would like to focus more on how smart cards can be counterfeited or hacked and practical yet effective ways to protect them. It is not a question whether credit cards in general can be hacked or not, but how and when. There are numerous ways, but I will just mention at least 6 for this post:

Corporate and financial database hack.
Compromising corporate secured system and stealing customers' database of sensitive information are harder tasks to perform compared to other forms of hacking, but once successful, it would be very devastating and could cost the company's entire business, customers lost of confidence, or even the entire credit card industry.

Just 3 years ago, at least 45.7 million credit and debit card users are at risk following a security breach with the TJ Maxx database. Another example of database hack was 2 years ago: The Best Western hotel chain has suffered one of the world's largest credit card hacks which compromised at least 8 million customers. Just last year, 7 Eleven chain of stores, Heartland, etc. suffered customer data theft from hackers who broke into the database's firewall and stole at least 130 million credit cards information. The company has paid 12 million to cards issuers already.

Just few days ago, 100,000 credit cards were compromised due to database breach.

Stolen or Lost Cards.
Every credit card transaction, online or offline, is assumed valid until it is proven otherwise. Although you may have zero liability for fraudulent purchases against your card, you are still liable for transactions if you do not report an incident promptly. If you do not report any stolen or lost card immediately to your card issuer, you are putting a greater risk for fraudulent purchases against your account.

CNP (Card Not Present) Transactions
These types of transactions are anything done thru online shopping, mail-orders, and phone orders. Merchants are not fully aware of the identity of the shopper. They simply rely on the information based on the card information being provided. Sure there are countermeasures and safeguards, but since online payment systems vary from merchant to merchant, credit fraud creates a lot of opportunities and has a lot of real estate to offer for hackers.

How does a merchant spot that the credit card an online buyer uses a legitimate or cloned when all the information the buyer have provided are true and accurate? Honestly, a merchant does not concern about it. But the real card holder may only determine it AFTER a fraudulent purchase has been done AND recognized that it was a counterfeit. It is even harder to spot a fraudulent transaction when the counterfeit user analyze and mimic the card holder's spending patterns and shopping behavior.

It is not hard to perform online purchases using a counterfeit credit information. Because such information needed to complete a transaction can be obtained easily from an RF reader, or from a Chip and PIN reader (if you happened to live in UK), or from a skimmed credit cards that card holders use for payment at bars and restaurants.

Peer-to-Peer network credit card theft.

Some of you may have used a peer-to-peer client software such as BitTorrent, LimeWire, etc., at some point. This is probably one of the easiest ways to steal credit cards numbers and information stored in computers connected to a P2P network or uses a file-sharing client software.

You do not have to google "credit card numbers free" to get results. Even if you do, chances are those numbers could either have been expired, recycled, or already have been blocked. Millions of users use P2P to share audio, video, and image files. But many do not realize that you may use this client to search and browse another peer's default folders directly accessing all files imaginable that are present including document files in that computer. And you would be surprised how easy to search others' files for credit card numbers and passwords.

Script Kiddies and Injection Attacks

This only applies when searching for URL vulnerabilities on websites which may yield a good chance to obtain credit card information including contactless cards. If you are familiar to programming using Perl, Python, C/C++, SQL, or Java etc. you can easily create your own "vulnerability scanner" application, or a hacking script. Better yet, you can search perl-based scripts from the internet like most script kiddies would do. Legacy systems are still being used by some merchants online and therefore easier to spot vulnerabilities.  Remember that 7/11 credit card heist I just mentioned? Hackers used SQL Injection to compromise database.

Electronic Pickpocketing

This is an RF reader model from Motorola XR400 series used
by Chris Paget in his RF hacking demo in New York.

Thieves do not need to snatch your bags or wallet to use your credit card, Online scammers do not need to phis you via counterfeit websites just to lure you to "update" your credit information and other personal data. Hackers do not need to infiltrate bank's secured web servers and compromise millions of credit card data and use them fraudulently. Anybody with the right scanning device, you can steal a contactless credit card in as easy as 1-2-3. 

This is electronic pickpocketing. With the help of a cheap card reader either concealed in your body, or in a small netbook bag., a software, a wireless device, that receives the captured data, AND a few minutes walk at a crowded downtown area (although you can do it with your own contactless credit card for experimental purposes), you can be an electronic snatcher in no time.

When the first generation of RF-based credit cards were introduced in 2006, the first hack was sponsored by RSA labs at University of Massachussets. The hack was documented and outlined with this paper.

One of the best case of an RF-enabled contactless cards was the Oyster's MiFare Classic hack. The Oyster is an RF technology and is compatible with ISO 14443A and ISO 14443B architectures at 13.56MHz frequency. The hack has prompted the Greater London Transportation authority to halt the system on January 2010 after it was hacked in December 2008. Later, it was upgraded to MiFAREDesfire last February this year. There is an excellent paper on how MiFare Classic was hacked.

But you may ask, "So what's the use of those 3DES, AES, RSA, SSL, and other encryption methodologies in the first place if a mere $8 RF credit card reader can easily scan and lay bare my credit information?"


Because these methodologies can only protect your credit card information at a certain degree when you make online and offline transactions and also to protect credit cards information stored in a secured database. They encrypt/decrypt data AND communications coming from your credit card to the merchant's electronic paying system and vice versa. They CAN protect data coming from your web browser to the merchant's web server and make sure the transaction is secured using an SSL certificates or similar security features.

But, they DO NOT protect your credit card from any RF-enabled scanning devices. In fact, almost ALL commercially available RF-enabled scanner in the market can be used to hack any contactless credit card. That is how open and unprotected the RF-enabled smart cards are!

So, If I were a quickie hacker, why should I spend my time and effort trying to force my way in into a secured database or electronic paying system (although I must admit that the result may be overwhelmingly rewarding), if I can do it in a crowded area in a city using a cheap RF-enabled credit card scanner with a higher success rate?

Chris Paget, Director of R&D will certainly agree with my assessment. He demonstrated how easy to steal information from an RF-enabled smart cards form his speech at a 2009 Shmoocon Convention:

Technology is neither good or bad. It can be used to benefit the majority or use it to cause harm. It always boils down to how responsible we are. I wish to continue more, but I thought that this article is beyond the usual length of an article. So, I hope my readers will forgive me if I will deal with the second part of this article, "5 Tested Ways to Protect Your Cards" on my incoming articles.

A word from the author: All information written here are for educational purposes only. No warranty is implied and written in AS IS basis. The author is a technology professional. He does not encourage anyone to perform hacks and breaches or perform illegal access to any system, device, or computer. The author shall not be responsible for any damage, incident, or any punitive act as a result, or arising from a direct or indirect use or abuse of the information herein. 

This link may help you:

• A Guide: How to Build a Low Cost Extended RFID Skimmer
• PDF Version (You need a PDF reader to open the file)

RFID: Better than Barcodes?

An RFID tag used for electronic toll collection

In the next 3 posts or so, I will focus my content to some interesting topics that fascinates me for the last 5 years. The RFID technology. So it is going to be a series of topics. RFID is a very broad subject to write about. But in this case, I will only deal some issues and understanding of the technology as it applies to retail inventory. So, the series shall be as follows:

• RFID: Better than Barcode?
• RFID: Inventory Jobs killer?
• RFID: Does RGIS ready for it?

This post shall be the first of the 3-part series.

What is RFID

Radio Frequency IDentification (RFID) is one of the newer wireless technologies that uses radio wave frequency as a mode of capturing or identifying data. They are smart tags and can be embedded into objects or products which sizes range from that of a credit card to smaller size like a dot. 

It has been around for many years but prior to 2000, RFID tags had been used in the US which include toll road passes, access ID cards, and animal identification. After 2000, its use has been expanded to include applications on smart Credit Cards, drug labellings, military equipment and logistics, the airline industry, automotive, public libraries, and the list goes on. Now, it is being applied in the supply chain. 

Portable RFID reader

Most RFID tags operate at either 13 MHZ or 900 MHz frequencies. To give you a better idea, think of these frequencies as the AM and FM bands from the radio in your car: one is a short-range frequency, and the other is high or ultra frequency. The 900 MHz (UHF) RFID tags operate well for reading multiple tags simultaneously and therefore suitable for inventory purposes. When using with the right RFID reader, the 900 MHz tags can be read from 10 feet away. While the 13MHz tags can only be read roughly within 3 feet distance. RFID tags are categorized as either passive, like the ones I just mentioned, or active (battery-operated which can be detected as far as 300 ft. away) depending on the application. 

Couple of years back, the use of RFID was confined to warehouse and distribution centers where pallets and cases were tagged for faster and efficient supply management. Now, the technology has found a new place at item-level identification. As we know, Walmart, Department of Defense, American Apparel, and thousands of other retailers have applied the technology either as a pilot program, a dry run, or full fledge retail application.

How does it work

In check outs, unlike barcode scanning, with RFID, multiple tags are captured or read simultaneously in one pass. To give you an idea, watch the IBM RFID commercial which captures the very essence of the technology:

Looks futuristic? Not really. The multiple light rays are for emphasis only. The actual capturing does not have. The idea is similar to capturing data using a barcode scanner, but the big difference is HOW data are being captured. Since RFID does NOT use the "line-of-sight" laser technology which the barcode scanning is built into, the RFID reader detects frequencies from smart tags embedded into clothings or products even if those tags are hidden.

For as long as those tags are within the specified range, say within 10-feet, RFID readers can capture multiples of tags almost in an instant with 99.9% accuracy. No 'scanning' is needed and most importantly, no 10-key is required. It reads multiples in one pass while barcode scanning is one barcode per reading. Imagine a 5-hour auto-scan apparel inventory can be done in less than an hour with fewer people using RFID.

To give you a better understanding, please view the following video on how data are captured in retail setup. The RFID application from this video is currently being used by American Apparel in collaboration with Avery and Motorola as solutions providers.

Video duration: Less than 5 minutes

Benefits of RFID in retail inventory

I am not going to compare which technology or standard is better than the other. At this point, I will simply focus more on the benefits of RFID in relation to retail inventory:

Faster inventory and greater accuracy
In barcode scan and 10-key, the term "fast and accurate" is oxymoron. With RFID, it changes that idea. Research shows that RFID-enabled scan is 8 times faster than the traditional barcode-enabled scan. In an actual demo, RFID-enabled scan gets around 8,000 per hour while barcode-enabled scan gets around 1000 per hour or less. RFID accuracy boasts 99.9% while barcode accuracy is less.

SKU checking is the normal way to revalidate missing SKUs or UPCs. But due to lack of material time, manpower, or inefficient computer system, inventory associates and store people simply scan similar item instead with comparable value. Imagine a 4-hour shoe store inventory using auto-scan, with RFID, the inventory will only last about 30 minutes! Retailers who base their statistics on total piece count typically underestimate the variance between POS-driven figures and their actual on-hand positions.  Instead they should be measuring accuracy at the SKU level.  RFID enable retailers to elevate this to 99 percent or better.

Better location visibility
RFID tells you if the electric fan being used by employees should be part of the sales floor  and not for the pantry, or is not in stock room where it should be found. In many cases this shortens the time spent searching for merchandise or eliminates trips to the stock room.

 More efficient receiving
Receiving can be automated, meaning pallets and boxes can be processed in minutes, allowing new shipments to become sellable sooner. RFID can also be used to identify or locate boxes with merchandise that needs to get rushed to the sales floor immediately.

Fewer items sold at markdown or move to clearance area
A surprising number of items never reach the selling floor until they have already hit their first markdown.  Not only is this a lost revenue opportunity, your labor must be devoted to locating and re-ticketing or relabeling of merchandise slated for markdown or clearance.

More efficient sales floor replenishment
With RFID, the sales floor can be quickly scanned and “pick lists” automatically generated, making it easier to keep stores properly stocked.

Shrink can be identified easily and can be addressed immediately.
Employees are sneaking out merchandise from the store? Or dishonest customer activities in fitting rooms and along the isles? In RFID, it lets you spot backward-moving merchandise because each single item gets assigned a unique serial number. Employee theft and shoplifting which considered as top causes of shrinkage can now be reduced significantly.

Retail application of RFID seemed very promising. This is not to say that it is flawless or without issue. There will be changes as the technology evolves into a more mature and agile system. I predict that given the right opportunity, proper implementation, and better standards, RFID will totally change the inventory management landscape in the next few years.

-------------------------------------------------------------------------------------------------------------


Amazon recommends:


   

Walmart revives RFID to life

The future has come

Imagine going to a Walmart store, filling up your cart and walking right out the door. You will no longer have to wait an associate rings up each item in your cart one at a time. Instead, a miniature yet smart electronic tags will communicate with an electronic reader that will detect every item in the cart and ring each up almost simultaneously. The reader will be connected to a WAN network that will send purchase information for your products. No more lines, no more waiting, no sweat. Instant shopping made easy. And that's RFID.

Yes, starting on August 1, Walmart Stores Inc, the world's largest retailer, for the 3rd attempt, is reviving its seven-year old smart tagging program that had been stalled several times in the past. This time, it will be placing removable smart identification tags called Radio Frequency IDentification (RFID) on men's clothing such as jeans, and undergarments to gain more control of its inventory and process. According to Walmart, tagging men's clothing with smart tags is just the beginning since the retailer is eventually expand it to other types of merchandise soon. Prior to this undertaking, Walmart and its suppliers have been using smart tags years before,  but only to track pallets or cases of merchandise in their warehouses, distribution centers, and docks.

Example of EPC RFID tag used by Wal-Mart

RFID a better choice over barcode scanning? 

What makes RFID tags a lot better and more efficient than the conventional barcoded scanning? In seconds, retail personnel will be able to determine which item sizes are missing, which items are on hand in the stock room and ordering process will proceed almost immediately. No need for individual scanning because RFID readers simply detect all items almost simultaneously in one pass at check out rendering the conventional barcode scanners essentially inefficient. Another cool thing about smart tags is it reduces the incidence of merchandise theft because RFID readers can also monitor where specific merchandise at: whether it is hidden inside a customer's bag or misplaced somewhere in the store. 

I think this extension of its original program really benefits the retail industry. When Walmart becomes successful in its implementation at this time, we shall expect a plethora of retailers implementing the same technology and methodology. But there will always be challenges ahead.

RFID and privacy concerns

Richard Stallman at WSIS 2005 presenting his RFID badge
 wrapped with aluminium foil as a way of protesting RFID
 privacy issues.

To understand more about the privacy issues being raised by private organizations, it is important to learn the basis how one's privacy can be affected. Understand that the technology behind RFID is essentially the same as any wireless-based devices that use radiowave technology such as your cellphones, which frequencies can be hacked using the right scanning device and not just by Walmart employees.

One more thing: The signal emits by these smart tags cannot be turned off. Even if removed by consumers. As Walmart anticipates, the tags remain active and, whether sitting in the garbage or in the closet, they can be scanned by anybody since signals are never turned off.  

Several privacy related organizations have expressed concern about the new program, especially because the tags will be used at the item-level, which in some minds might give someone the capability to track what specific consumers buy or even what items they have in their homes. This is invasion of privacy, said Katherine Albrecht, the director of a private organization called Consumers Against Supremarket Privacy Invasion and Numbering. She said that this initiative is the first piece of a very large and very frightening tracking system. Albrecht fears that retailers could scan personal information and use the data to some other means. Katherine Albrech, is the author of a popular book, Spychips: How Major Corporations and Government Plan to Track Your Every Purchase and Watch Your Every Move.

Analysis

In my knowledge, this will be the third attempt for Walmart to introduce the technology to its line of merchandise. The company had done some pilot program sometime in 2003 and it was called Electronic Product Code (EPC), an early version of RFID. Then in 2005, the roll out had started with top one hundred of its suppliers tagging cases and pallets particularly at its Texas distribution centers.

Shortly, the move had ultimately halted causing all of retailers to withdraw from the program due to latters' lack of compliance and Walmart's inability to search for the right value proposition and lack of push from the management itself. Then in 2009, Walmart had tried to revive the program. This time in a smaller scale using Sam's Club as the pilot store. Again, the program suddenly stalled due to suppliers' lack of RFID compliance.


Today, Walmart is facing another situation but of the same challenge: RFID implementation in item-level. No Sam's Club or other external pilot program will be involved this time. But it is going to be a test program right inside Walmart's men's clothing department. If it succeeded in its implementation and can resolve known and unknown issues that could arise in the application of the program, then the giant retailer has just taken the first little step towards convincing its critics. Walmart must demonstrate to its critics that RFID is not  just another commercial fairy tale which has failed the test of reality, but a non-fiction technological miracle that only the brave could go through the test and succeed.

Do you think WalMart will get this newest RFID program right this time?

-----------------------------------------------------------------------------------------------------------------
More recommended readings: