Get ready for a facepalm: 90% of credit card readers currently use the same password.
Scammers posing as out-of-work residents have bilked Washington state out of “hundreds of millions of dollars” in unemployment benefits, a top official said. The fraudsters submitted bogus. Disclaimer!-We are not (yet) security industry professionals or 1337 code-breaking hackers-We did not break Smart Card Security-But, we can show that even with introductory security knowledge, we were able to find vulnerability in a ‘secure’ system’s.
The passcode, set by default on credit card machines since 1990, is easily found with a quick Google searach and has been exposed for so long there's no sense in trying to hide it. It's either 166816 or Z66816, depending on the machine.
With that, an attacker can gain complete control of a store's credit card readers, potentially allowing them to hack into the machines and steal customers' payment data (think the Target(TGT) and Home Depot(HD)hacks all over again). No wonder big retailers keep losing your credit card data to hackers. Security is a joke.
This latest discovery comes from researchers at Trustwave, a cybersecurity firm.
Administrative access can be used to infect machines with malware that steals credit card data, explained Trustwave executive Charles Henderson. He detailed his findings at last week's RSA cybersecurity conference in San Francisco at a presentation called 'That Point of Sale is a PoS.'
The problem stems from a game of hot potato. Device makers sell machines to special distributors. These vendors sell them to retailers. But no one thinks it's their job to update the master code, Henderson told CNNMoney.
'No one is changing the password when they set this up for the first time; everybody thinks the security of their point-of-sale is someone else's responsibility,' Henderson said. 'We're making it pretty easy for criminals.'
Trustwave examined the credit card terminals at more than 120 retailers nationwide. That includes major clothing and electronics stores, as well as local retail chains. No specific retailers were named.
The vast majority of machines were made by Verifone(PAY). But the same issue is present for all major terminal makers, Trustwave said.
Esd Money Card Hack
A spokesman for Verifone said that a password alone isn't enough to infect machines with malware. The company said, until now, it 'has not witnessed any attacks on the security of its terminals based on default passwords.'
Just in case, though, Verifone said retailers are 'strongly advised to change the default password.' And nowadays, new Verifone devices come with a password that expires.
In any case, the fault lies with retailers and their special vendors. It's like home Wi-Fi. If you buy a home Wi-Fi router, it's up to you to change the default passcode. Retailers should be securing their own machines. And machine resellers should be helping them do it.
Trustwave, which helps protect retailers from hackers, said that keeping credit card machines safe is low on a store's list of priorities.
'Companies spend more money choosing the color of the point-of-sale than securing it,' Henderson said.
This problem reinforces the conclusion made in a recent Verizon cybersecurity report: that retailers get hacked because they're lazy.
The default password thing is a serious issue. Retail computer networks get exposed to computer viruses all the time. Consider one case Henderson investigated recently. A nasty keystroke-logging spy software ended up on the computer a store uses to process credit card transactions. It turns out employees had rigged it to play a pirated version of Guitar Hero, and accidentally downloaded the malware.
'It shows you the level of access that a lot of people have to the point-of-sale environment,' he said. 'Frankly, it's not as locked down as it should be.'
State unemployment officials said Thursday they have recovered $300 million in stolen money that was diverted by scammers from jobless workers in dire need of unemployment aid benefits.
Speaking during an online briefing about the agency's efforts to dispense aid to Washington's state's unemployed workers, Employment Security Department Commissioner Suzi LeVine said the agency expects to receive $50 million today as part of its recovery efforts.
'I have some very good news about what we've been able to recover,' she said, adding that the effort to reclaim the money involved a 'strong collaboration with federal law enforcement, our banks and financial institutions across the United States.'
About two weeks ago, the agency suspended unemployment benefits payments for up to two days because of a rise in the number of fraudulent claims for payment.
But some unemployed people said they are still waiting for benefits for a suspension that has stretched beyond two days.
'What about those (of us who) haven’t seen our money because of this?' said Jennifer Schallman, who is currently unemployed and waiting for her benefits. 'Two weeks ago, they stopped paying us. They said it would be two days (and) it has been 14 days.'
She and other unemployed residents have been caught up in the fraud, that included a scam where criminals, many of them out of state, used stolen information from Washington state residents and third-parties in order to file for unemployment benefits.
Criminals seeking to capitalize on a flood of legitimate unemployment claims are sneaking in fraudulent ones by using stolen personal identifying information.
Last week, state officials officials hinted at the scope of the damage done: hundreds of millions of dollars paid out in fake claims. Much of it apparently went to a West African fraud ring using identities stolen in prior data breaches, such as the massive 2017 Equifax breach.
Other states have been victims as well and they, along with federal authorities, are trying to claw back as much money as possible. States have also moved to block hundreds of millions more from being paid out, but Washington state's experience is nevertheless a cautionary tale.
'Our intel says Washington was the first state they went after, but we are seeing the number of states being attacked expand day by day,' said Patrick Peterson, chief executive of the California cyber security firm Agari, which has monitored the Nigerian fraud group, dubbed Scattered Canary.
On Thursday, LeVine said more than 807,000 people have received unemployment benefit that amounts to $4.7 billion.
ESD officials also said 55,000 applicants were 'bulk cleared' Wednesday night, meaning their requests had been snared by state filters but their requests for benefits have since been approved for payouts. Many of those applicants were asked to provide additional information to validate their applications.
'They haven't cleared mine yet,' said Susie Thompson, an unemployed tow truck driver in Snoqualmie who has requested unemployment benefits. 'I logged on this morning and it still says pending. I can't plan to pay my bills or anything like that.'
Stephen Crawford, who lost his job recently, is demanding answers.
Esd Money Card Hack 2020
'When are we going to get an official date of when we are going to get paid?'
Esd Money Card Hacked
The Associated Press contributed to this report.