Dave & Buster’s Data Breach Indictment: Apps Crash For The Bad Guys, Too
Written by Evan SchumanMay 16th, 2008
It was April 2007 when a pair of cyberthieves from the Ukraine and Estonia set out to try and grab payment card data from the 49-store Dave & Buster's restaurant chain. But according to a federal indictment and a U.S. Secret Service affidavit unsealed May 12, 2008, the pair quickly discovered that software can be an equal-opportunity crasher.
"As a result of a defect in the software program for the packet sniffer, the packet sniffer automatically deactivated whenever the compromised (Dave & Buster's) POS servers rebooted in the normal course of the operation of the servers," the indictment said. "Therefore, in order for the packet sniffers to capture data from the compromised D&B POS servers on an ongoing basis, the defendants had to regularly reactivate the packet sniffers." This group might even have had a hand in the TJX incident.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
3 Comments | Read Dave & Buster’s Data Breach Indictment: Apps Crash For The Bad Guys, Too
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
May 16th, 2008 at 9:37 am
Finally! As Paul Harvey said, now for the rest of the story, which is yet to unfold, taking years, is what happens to these cyber criminals. Swift and meaningful punishment is necessary to send a message to those considering a life of cyber crime.
May 16th, 2008 at 9:56 am
Editor’s Note: That’s a nice sentiment, but I cynically doubt it would do any good. It’s like increasing the penalties for illegal narcotic distribution. There is SO much money to be made with these schemes–and the chances of being caught are so slight–that these punishments won’t do much good.
The deterrence of any punishment only exists if the one you’re trying to deter has any reasonable belief they’ll get caught and convicted.
These cyber thieves are generally confident, cocky and quite careful. Reality aside, they are likely to BELIEVE they’ll never get caught. Therefore, no punishment will likely any impact.
I hope I’m wrong, though.
May 17th, 2008 at 8:39 pm
Most people think that I’m strange, but as an InfoSec Professional, I have done away with my Credit Cards, and have gone back to a completely cash life. Purchasing goods online, or using a card in store clearly isn’t safe, and the retailers, credit card companies, and the banks really don’t care.
I get to see the PCI scans, and the amount of money that the PCI efforts cost companies, yet, we still have issues with simple security.
Organizations don’t really want to apply the correct methods of securing their systems, because they don’t have the talent, or the time to put the proper tracking, access controls, and testing into practice. Of course, if they did, they wouldn’t be making that extra $00.03 per transaction, costing them millions in the long run.
It’s cheaper to pay the fines, let the current practices “protect” them, making everyone feel safe.
It is a case where “Ignorance is Bliss!” is truly the status quo.
“In God we Trust, all others pay cash.” It’s one way to prevent credit card theft, identity theft, and loss of our hard earned money.
Try it, it’s freedom.