{"id":6903,"date":"2014-01-29T06:14:08","date_gmt":"2014-01-29T14:14:08","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=6903"},"modified":"2019-04-20T16:24:36","modified_gmt":"2019-04-20T16:24:36","slug":"magstrip-mayhem-target-corps-achilles-heel","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=6903","title":{"rendered":"Magstrip Mayhem – Target Corp's achilles' heel"},"content":{"rendered":"

\t\t\t\t\u00a0symbol.\nThe United States commerce and payment card standard lags far behind in the implementation of this security feature.\u00a0 The United States point of sale terminals are mostly reliant on magnetic strip card reader technology (aka MagStrip.)\u00a0 Magstrip data\u00a0is easily duplicated (stolen) with a $50 reader-writer available from many online 3rd parties.\nAccording to iSight Partners Inc and the US Department of Homeland Security, 70 million credit card numbers were stolen at Target stores\u00a0from Point of Sale cashier magstrip readers\u00a0via the Kaptoxa malware virus which ran from 10am to 5pm on Target Corp’ s own server.\nKaptoxa is the non Cyrillic spelling of the Russian word for potato.\u00a0 Kaptoxa virus has been\u00a0identified and defeated\u00a0by antivirus vendors since 2012.\u00a0 The virus\u00a0can be bought online from the black market for around $1000 USD.\u00a0 Its author has been identified as Sergey Tarasov who is a 17 year old from St Petersburg, Russia.\u00a0 Tarasov wrote the malware but was not involved in the Target Corp exploitation.\nCorporations in the United States are notorious for snubbing security in exchange for higher risks and lower up front expenditures.\u00a0 A move to adopt\u00a0payment card embeded chip technology to avoid such an easily identified threat is not unreasonable but is certainly political.\u00a0\u00a0The National Institute of Standards and Technology (NIST)\u00a0makes\u00a0claims and protestations that interopability of smart cards is difficult.\u00a0 Perhaps the truth lies closer to the United States payment card industry’s insistence of dominating American standards with government participation.\u00a0 For more info and reading see NIST’s presentations<\/a>.\n\n