Point of Sale System Breach
Computer Sciences and Information Technology
Case Study 2: POS Attacks
Suppose you are a security director for a consulting firm that implements, secures, investigates, and supports point-of-sale (POS) for small and medium businesses (SMBs) in the retail industry.
Read the article titled, “If you shopped at these 16 stores in the last year, your data might have been stolen” located at https://www.businessinsider.com/data-breaches-2018-4. Choose 2 stores from the list and research the specific attack or breach. Since the site is full of ads, I’m including suggestions below to pick from. Since there is the requirement to pull from 2 other sources, just research the breach on some other site. Businessinsider is an horrible ad monger. Since I navigate with an ad blocker, I had to pay $1.00 just to get access to see the stuff.
Write a paper in which you:
1. Summarize the attacks, providing details on the effects of the breach.
2. Identify the common purpose of attacks on point-of-sale (POS) systems.
3. Assess why and how these POS systems have become a prime target for hacking groups.
4. Examine the forensics challenges that exist for investigations on POS systems.
5. Use at least two (2) quality resources in this assignment other than the article linked above. Note: Wikipedia and similar websites do not qualify as quality resources.
Your assignment must follow these formatting requirements:
• Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.
• Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date.
Suggestions:
Gamestop
Gamestop confirmed a data breach in April 2017. Customers who shopped online for a six-month period were vulnerable, from August 10, 2016 to February 9, 2017.
Point of Sale System Breach
With the advent of technology, cyber-attack is becoming more rampant. Every internet user is susceptible to an attack from individuals to multibillion companies. Many retail companies are suffering Point of sale (POS) system breaches as they revolutionize payment method. The Point of sale system is a central point of every business that hubs business inventory and manages customers and sales. For every transaction, a point of sale transaction is completed. Being a new technology, many businesses are adopting the technique, whereas others are adamant about changing (West, 2019). The POS system consists of both software and hardware, such as Barcode scanner, receipt printer, credit card reader, and monitor. The Point of sale system suffers a breach in consumer data, mobile data through malware and other POS attack and threats. According to statistics, 16% of related losses millions of revues to cyber-attack, more especially POS attacks annually.
These attacks occur when malicious malware is deployed to hit a point of sale device. These devices capture a lot of financial information that can be stored temporarily in their memory. The hackers attack these devices by connecting remotely to the to steal the data .so when a card is swiped at the card reader, the information from the debit or credit card is captures which are then transferred to the POS terminal for encryption before being sent to the server, which decrypts the information, in this period the information is to allow of payment execution in this process it exposes the information tot eh vulnerability of an attack. (West, 2019) Many retail stores have suffered a POS system attack and consequently lost millions in revenues and compensations. Herein are real-life examples of stores whose POS systems were compromised.
GameStop
GameStop is a chain of retail stores and online retailers with over 7000 branches within the United States and globally. In March 2017, GameStop confirmed the breach and notified its customers of the possibility of breach of the credit card information. The breach is thought to have occurred between August 2016 and February of 2017. The breach involved the GameStop retail stores, whereby the r point of sale system had been infected with malicious malware. Following the subsequent month’s unprecedented amounts of data was stolen from the site. The compromised data was inclusive of the credit card numbers, customers’ dress, and notably, the card verification value containing the security codes. Equilibrium security (2019).
The hackers stole the cards injecting malware into the company’s e-commerce site, compromise the CCV codes before encrypting. The breach is projected to have affected approximately 1.3 million debit and credit cards of users that had made online purchases between the duration of the breach. The breach was lead to legal implications where the plaintiffs accused the store of mot adequately securing they are informational during their online product purchases.
BestBuy
Another online retailer that suffered a POS system attack is Best Buy. It suffered a customer payment data breach in April 2018. The attack hit its third party company, [24]7.ai, whereby the customer payment details were compromised. To counter this attack, the company set up a website where customers made inquiries regarding the breach to Help customers in notifying any affected customers. Additionally, it offered credit monitoring services for its customers. (Talukder, 2019)
Retailers have the most susceptible targets of POS attacks since they are heavily dependent on the POS software and systems to conduct thousands of transactions. The main motive of these hackers commits fraud using the details from stolen payment cards. The POS offers enormous payload through thousands of transactions daily. Access to this information means inherent vulnerabilities of stealing the unsuspecting card owners of millions of dollars. (Fleyder, 2018)Additionally, retailers suffer these attacks due to inadequate security measures to counter the attacks; thus, the hackers exploit their point of sales weak security system. Moreover, many companies use weak network security that leaves payment applications exposed; thus, getting access to the system and stealing the credentials becomes an easy task for the hackers. In addition, third party vulnerability has led to the exposure of retailers to attacks. Like for the case of BestBuy, the attacks were launched on their third party service provider by directly impacted the company.
Challenges facing forensic investigators in dealing with POS breach
With the current rise in cyber-attacks, these perpetrators are rarely held accountable for the heinous actions. This is due to the multifaceted challenges the forensic investigators incur. Firstly, digital evidence is subject to manipulation, making it difficult to store and transfer. Thus digital issues are faced with unreliability (Talukder, 2019). Secondly, these attacks are launched sometimes in foreign countries, making it difficult to conduct the investigations due to the lack of harmonized laws whereby the laws of one jurisdiction are distinct from the next in matters of cybercrimes, thus making it difficult to hold perpetrators accountable. Especially when the laws of their jurisdiction protect them.
Thirdly is the perpetrators’ anonymity; most of these perpetrators conduct these acts without revealing their real identities, and in most cases, they are disguised under other people’s identities; this makes the investigations process even more technical. The use of anonymous networks and hided IP addresses makes it makes attribution very difficult. Additionally, attribution is more complex where remote access tools such as botnet are used to infect devices; thirdly, trace backing is time-consuming and costly, especially when dealing with a syndicate group. (Talukder, 2019)
To curb these attacks, retailers, franchisers and businesses should adhere to stringent measures to protect their business against POS attacks this possible by adopting security best practices such as using strong passwords to secure their devices. Additionally, regular updates of POS software applications to safeguard it from vulnerabilities of a possible breach. (West, 2019) since malware attacks mostly attack POS, installation of firewalls and antivirus will enhance immediate detection of malware attacks, notably adopting two-factor authentication process as a form of strengthening access security during the process of payment card data .lastly, one of the most secure solution is the adoption of Point to point encryption to safeguard information by converting it into an indecipherable form minimizing the invasion window.
Conclusion
In both the GameStop and BestBuy attacks, they were both involved in POS attacked that compromised their customer payment data. This nature of attacks re becoming mote rampant as more retailers and organizations are suffering these breaches. Point of sale system breaches is some of the most detrimental incidents that a business suffers. They usually result in identity threats, fraud and immense losses. However, these attacks continue to become rampant as the perpetrators continue to advance their tactics. Any organization needs to employ cybersecurity monitor measures to detect any anomalies immediately.
References
Fleyder, U., Kerner, R., Rabinovich, Z., Salinas, R., Ben-Porat, L., & Frank, D. (2018). U.S. Patent No. 9,912,692. Washington, DC: U.S. Patent and Trademark Office.
Talukder, M., Shahriar, S., & Haddad, H. (2019). Point-of-Sale Device Attacks and Mitigation Approaches for Cyber-Physical Systems. Cybersecurity and Privacy in Cyber-Physical Systems, 368-383.
West, E., Steirer, G., Tyni, H., Sotamaa, O., Affuso, E., Santo, A., … & Comella, L. (2019). Point of sale: Analyzing media retail. Rutgers University Press.
Equilibrium security (2019) https://equilibrium-security.co.uk/2019/08/21/pos-threats-for-retail/ (Retrieved, 28th July 2020)
