Hotel franshice operator hacked

[thewayne]

They operate hotels under the Hilton, Marriott, Sheraton, and Westin brands in certain cities, they don't own all of these chains. Apparently in the case of Marriott, the franchisee must use Marriott's property management system for core operations, and they say that their system is intact, so the breach may have been in other operations on the property like restaurants, guest shops, etc. The company, White Lodging, apparently was compromised from late March through the end of 2013. They operate in Austin, Chicago, Denver, Los Angeles, Louiseville, and Tampa. Currently Marriott is the one reported as compromised, the other chains didn't respond to requests for comment before Krebs posted.

A comment on this article talked about a book about the Gonzalez gang, who perpetrated the TJ Maxx et al thefts, also hacked in to a manufacturer of point of sale equipment called Micros and stole software and employee IDs, which could explain how the Target POS terminals were hacked to scrape the credit card information before it was encrypted.

http://krebsonsecurity.com/2014/01/hotel-franchise-firm-white-lodging-investigates-breach/

We were discussing the recent hacks at the observatory and talked about going to a cash payment system for local commerce last night. One of Russet's co-workers talked about living in, I think, Chile for a couple of years and basically most businesses there operate strictly on a cash basis, so she got in to the habit and continued doing it once she got home. Russet's problem is that she doesn't like accumulating change from purchases, which is understandable. I have a large tin that holds probably about $300 worth of coinage, it's probably about half full. We're looking at going to Europe next year, and one thing that I've been thinking about is money. With the exception of England/Scotland, we'll be in Belgium, Holland, and probably a couple of other places where I think it's pretty much exclusively Euros. So I guess it'll be traveller's cheques, convert to cash, and hope for the best.

Comments

[silveradept]

Wow. Once you start having people giving or having their employee identification compromised, cash really does start looking like a good option.

[thewayne.livejournal.com]

I emailed Brian Krebs last night and asked the following: "We're going to be switching to paying more with cash, which still leaves us vulnerable to ATMs getting skimmed, but I was wondering: if you use a debit card but cancel the PIN and use it as a credit card, does that offer any protection? The thieves couldn't use it as easily online, and it might be more difficult to use in a store." His reply: "You could certainly do that, but why not just use a credit card then? You have more liability with a debit card, whether or not you use it as one."

Which sadly doesn't address whether or not the card information, when skimmed, is valuable and useable by the thieves.

[silveradept]

The data would be useable by thieves - a short social engineering would reset the PIN and your account gets cleaned out. The credit card fraud liability is better to deal with in this case.

[thewayne.livejournal.com]

I'm not sure how easy it would be to change the PIN. They don't have the account number, only the card number, and it's been my experience that you normally have to go in to a branch so that the card can be swiped, I've never understood if the PIN is an encrypted part of the magnetic strip or what.

[silveradept]

That is different from what I have thought. Still, if it can be used as credit, it still becomes useful for that, at least.