Home Depot breach bigger than Target at 56M cards | Hacker News Reader

Home Depot breach bigger than Target at 56M cards

reuters.com

67 pointsanigbrowl52 comments

Part of me wonders if security will ever be something people actually care about, and value.

Home depot had a huge, huge security breach. Their stock price? Up 12 points from last year.

I'm not sure what it would take for people to really value a major security breach. The tech guy inside me is screaming, "why wouldn't you care about this?", but the regular guy inside me thinks, "who cares? the banks will handle any stolen credit card info."

I don't really know much about this sort of thing. I assume that to the retailer that gets pwned, they get a few weeks or months of bad press then pass the cost of that breach on to future customers.

The "regular guy" in me thinks, "Meh, I'll probably ending up paying 5 cents more for light bulbs because of this. Oh well."

I feel bad for the sysadmin/security guys at these companies, probably screaming for budget and not getting it. What do you think they're doing now? Helping some high paid IR consultant restore logs from backups. Good times!

Deleted comment

Why are you assuming that this only applies to Home Depot issued credit cards? I am not getting that sense from the article.

Nowhere near half of all households have a Home Depot card. There were 56M "payment cards" compromised. That would be Visa, Mastercard, and whatever other cards they accept. "Payment card" sounds awkward to me, but with so many people using debit cards, they can't say "56M credit cards."

Well, we should find out as NFC and biometric authenticated payments (Apple Pay and TouchID) are about to hit the mainstream US consumer market in a big way. I'll certainly think twice about shopping at any big box retailer (ie the bigger targets, no pun intended) that doesn't let me pay that way.

That's the whole point of the liability shift. It will matter a lot more when the store is wholly liable, instead of this conditional liability depending on "indications of shortcomings in their security".

(In a year or so, stores that don't use EMV assume liability for fraud)

Indeed. When large breaches happen after that date, the liability will fall upon whichever party had the poorer security, and you'll see a lot more class action lawsuits.

It's mainly up due to a good earnings report in August, and good guidance going forward.

If the breach doesn't hurt earnings, why should the stock price move?

That's the OP's point. If folks cared about security you would expect a backlash from customers because of the breach directly impacting earnings.

For Target, the selling didn't come until after Target announced it was going to impact their earnings.

Could someone please explain to me why Home Depot and Target would even have the information of 56M cards?

Is this a result of not using chip and PIN, relying on offline transaction processing or some weird subscription plan?

I understand that there would be a cost involved in implementing chip and PIN across the entire US and it may not solve the issue if they insist on having the card on file. Online credit card processing has been pretty much standard for the last ten years here in Denmark. Terminals are connecting to the credit card processor, either via an ISDN/ADSL/phone/GSM connection, everything is encryptet and the store never has anything expect the cardmask.

So why do companies like Target have the card information of their customers?

From this link: http://krebsonsecurity.com/2014/09/in-home-depot-breach-inve...

"The malicious software that unknown thieves used to steal credit and debit card numbers in the data breach at Home Depot this year was installed mainly on payment systems in the self-checkout lanes at retail stores, according to sources close to the investigation."

So it's not that Home Depot (i'm not sure this applies to Target) had the credit card info stolen from their servers. It's more that it was skimmed from their self-checkout machines, though by software though rather than hardware.

Assuming that Home Depot is correct and skimming is involved and also assume that the 56M cards is correct. That just seems to unlikely, even with malware pushed to the POS systems, that 56M cards could be stolen.

I mean there's "only" 350M people in the US. One in seven would have to have used a card at Home Depot (I know, people have multiple cards). Still seems unlikely to have 56M card skimmed in any reasonable timeframe.

Skimming would imply that someone physically altered the self-checkout lanes to capture credit cards in the same way an ATM skimmer works. Since this was installed malware, it would mean access to Home Depot's network. I wouldn't be surprised to learn that credit card data was stored in plaintext somewhere in their system.

I will say, one time a few years back I needed to get a receipt from a purchase more than 60 days old. I called the local store, and she said "just give me your credit card number and I can lookup your transactions". With just my card number she was able to see every transaction I made with that card (and find my purchase I needed the receipt for). So (at least 3-4 years ago) it was being stored somewhere searchable by people in the back office.

Or at least a hash generated from it was stored.

But why would they store them and why would they have access to the card number?

The credit card processing is normally completely separate from the rest of the POS. The credit card "machine" communicates directly with the credit card processing company and just informs the POS that the transaction was completed.

You would need to break into the encrypted data sent from the credit card terminal to the processing company to get the card number.

Maybe I'm just completely ignorant about how this stuff works.

Target and Home Depot are doing something that they don't need to be doing to process payments, unless skimming is involved.

If skimming is involved: start moving to chip cards and drop the magnetic strip.

The sad thing is we will probably never learn the exact problem and that means we the industry will never learn from their stupidity.

If they would have followed Payment Application Data Security Standard as many others do, they wouldn't have had this problem.

PADSS is a CYA tool, little else.

You can't checklist your way to good security.

Well, it's not only that. Technically it's helping a lot. Because often there is dedicated hardware with it's own certified software which deals with all card data. So the POS PC doesn't get anything else than the transaction identifier and confirmation of the payment. Therefore, what ever malware is running on the PC, can't access the card data at all. Without this arrangement, I'm sure we would have seen a lot more of credit card data thefts. Especially from smaller stores which do not care about security at all. You can ask your local non-chain random el cheapo Pizza Kebab about their IT department and security standards they're utilizing. ;) Actually I've been planning this for a while, it would be fun. Even stores which rent videos, should have documentation (by law) about how their customer register data is stored, protected and used etc. I'm quite sure there are many stores which do not have that.

Any idea why the market punished Target stock so thoroughly but doesn't seem to care about Home Depot?

Target stock was fine until they put out this press release that updated guidance lower due to reduced sales after the announcement: http://investors.target.com/phoenix.zhtml?c=65828&p=irol-new...

So, I assume Apple Pay will solve some of these kinds of problems? Otherwise, what's the point?

>Otherwise, what's the point?

Convenience.

Credit cards are based on a broken "pull money without permission" model.

The only way to get good security is to start with a system that doesn't suck; specifically, one that involves "pushing" money to an account rather than "pulling" it from an account.

Bitcoin got this right. So did the various non-CC services like Paypal and Venmo.

It will, because Apple Pay uses a EMV-based protocol (also known as chip-and-PIN) over NFC. The actual card secrets that can be used to authorise payments never leave the iPhone's secure element.

Additionally, because you authorise the exact amount on the iPhone, hacking the terminal to have it charge a higher amount than shown on its display is impossible.

My understanding is that any info retained by Home Depot or another retailer after you use Apple Pay could not be re-used elsewhere.

As someone who has to cancel his cards once or twice a year due to unauthorized purchases, this sounds great! (I could go back to cash, hmmm......)

> Otherwise, what's the point?

Funneling more cash to Apple?

And where exactly does Apple make money from their NFC payments?

By siphoning a small portion of the swipe fee. (Estimated at 0.15% of transaction value).

From the bank's cut apparently although I hadn't seen the amount before.

After having my card cancelled from the Target theft, and now this, I'm done with Home Depot.

I kinda feel like having to replace a lost/stolen card number is just part of the cost of doing business by credit card.

Well, the cost is getting too high for me. BofA has replaced my debit card at least four times in the past three years, necessitating I update all of the online billing stuff I use. This is a hassle, not to mention BofA's new ATM software being so glitchy it beggars suspicion about how much twine and gum is operating behind the scenes.

Yeah but I don't want to support a company that has millions of credit cards stolen from malware.

As consumers, we really don't have many ways to make an impact, so I can understand why you would be so exacting. With that being said, a particularly skilled engineer could find his or her way into just about any closed system. Check out CVE Details[1] to get an idea of how many security exploits are reported for software that surely you use daily.

For most companies, the mess that Home Depot is facing never occurs. Not because they were so successful at anticipating security holes, but because they were never targeted by a successful attacker.

Details have not been released (and may never be fully released) regarding the attack; but this is just food for thought.

[1] http://www.cvedetails.com/

Pay cash at retail establishments. Use paypal at as many online stores as possible. Use prepaid debit cards elsewhere, don't keep much money on them normally, drain them and switch to another card every month.

> Pay cash at retail establishments.

Your cash can be stolen, lost, misplaced. No recourse. If you lose a credit card, you just call and get a new one mailed to you.

> Use paypal at as many online stores as possible.

I can't believe someone just recommended using PayPal on HN.

> Use prepaid debit cards elsewhere, don't keep much money on them normally, drain them and switch to another card every month.

Don't use debit cards to pay for things. Ever. Credit cards give you substantial consumer protections that you don't get from debit cards.

Bottom line: use credit cards everywhere you can. Find the best rewards program for you and rack up points. Check your account activity once a week. Report anything you don't recognize. If you're part of the social class to which credit cards are actually available, it's quite foolish not to use them.

> Don't use debit cards to pay for things. Ever. Credit cards give you substantial consumer protections that you don't get from debit cards.

A: This is simply not true any more. Most banks offer essentially the same level of protection for debit cards as for credit cards, the only issue with debit cards is that potentially you could have a period of time while still missing funds, but I've never seen that be an issue with any reputable bank within the last several years.

B: You must have missed the part where I talked about using "prepaid debit cards". If you are extremely paranoid you can only add money to them just prior to use, leaving them with a low balance most of the time.

C: The problem isn't just fraud and potentially having a period of time without funds available to you that should otherwise be there, it's also the enormous hassle of replacing a card (and updating everywhere you use that as a payment instrument such as amazon, your bills, etc.) That problem isn't improved at all by using a credit card vs a debit card.

>As consumers, we really don't have many ways to make an impact

Use bitcoin whenever feasible?

I never lose money when my credit card number is stolen

assuming they followed all relevant security procedures and protocols, what do you propose they do in the future to not lose customers like you?

protecting yourself against custom malware like the type the article says infected home depot is not easy for tech companies, let alone non tech businesses.

I guess there's two theories why the alternative stores to Target and Home Depot were not hacked: A) Skill B) Luck

I'm a cynic so I'm going with B.

(Actually, I may go with "C" which is "there are probably breaches that we just haven't heard of yet")

Home Depot? I'm good. Tell me when Amazon gets breached.

What's your robot butler thing? That sounds interesting.

I could never decide if I preferred Home Depot or Lowes. This makes the decision easy for me.

You think this means Lowes is any less likely to be breached? Today it's you, tomorrow it's me.

They've kept things cleaner and have more people to answer questions in my experience.

Which one is "they" to you?

Home Depot.

This stuff goes on while my picture is taken at least three times if I want to buy a nut at that rediculios store.

By the way, HD does not necessarily have the lowest price anymore--shop around.

Oh yea, your employees hate your company more than your customers do. If there's shortage--It's probally Internal?

Hay Chantel--a manager asked if I wanted to have you written up. I figured working there was punishment enough.(bad customer service experience--really bad.)

Reply on news.ycombinator.com