Individuals who have wined and dined at theme restaurants such as the Bubba Gump Shrimp Company and the Rainforest Cafe at least once since 2016 may want to review their credit and debit card statements. According to a notice posted by restaurant giant Landry’s shortly after New Year’s Day, hackers were able to inject malware into an internal system that operates separately from the point-of-sale (POS) network, but which nonetheless involved payment cards.
Before discussing details about this security incident, it should be noted that Landry’s POS system was not breached. In fact, the restaurant chain operates a system that not only encrypts data but also blocks all scripts it does not recognize which means that unrecognized malware would have no effect. There was another card-reader system affected, but not one used for payments. With this in mind, the scope of the incident is sharply reduced because the credit and debit cards that may have been intercepted were not supposed to be swiped in the targeted system anyway.
When you sit at table or at the bar of the Rainforest Cafe or Del Frisco’s Grill, you probably have noticed that servers interact with more than one card reader. There is the POS for payments, which is encrypted, but there is also an order-entry system that restaurant staff members access by means of swiping cards that often hang from lanyards around their necks for easy access. In some cases, servers carry a wireless tablet with from table to table; this portable card reader can be used to swipe Landry’s Select Club cards, a nice customer loyalty and rewards program.
Between payment cards, access cards, and customer loyalty cards, it would not be unusual to expect that busy Landry’s servers would, from time to time, get these cards mixed up, which is what happened in this case. Some debit and credit cards were inadvertently swiped to place an order from the table or from the bar to the kitchen; perhaps a MasterCard was swiped instead of a Landry’s Select Club card, thus depriving some customers of points that could have been redeemed for a frozen margarita or a free side order of Cajun shrimp.
Even though Landry’s operates more than 600 restaurants, only 60 locations were affected, and individual cases are limited because most servers employed by this chain are retained based on their ability to carry out their duties with precision. This does not mean that hackers are giving up on attacking point-of-sale systems; if anything, malware targeting card readers terminals is becoming more sophisticated. The intent to breach Landry’s was certainly there, but it did not work as hackers had hoped for.
This specific group typically uses the most basic hacking tools combined with the software already present on their victims’ systems. Two-factor authentication is incredibly difficulty to bypass since it uses unique forms of identification. Fox-IT has stated that APT20 found a way, currently unknown, to compromise the 2FA for virtual private networks possibly via vulnerabilities in the the corporate and government enterprise application platform known as JBoss. Essentially, they found a way to bypass the credentials necessary to access their victim’s VPN accounts and the computer systems attached to those networks. APT20 then focused their efforts on locating and hacking additional linked systems that held the credentials necessary for them to find and retrieve additional private data. The attack was designed to help them find higher and higher levels of authentication to access higher and higher levels of information. For example, they targeted password managers/vaults and then used the passwords they found to continue their data search and retrieval. Once they were finished, they did everything possible to delete all footprints of their actions to prevent detection.
The owners and employees of restaurants are in the business of customer service. Their priority is creating the best dining experience possible for their clientele. They can’t be bogged down with complicated point of sale technology that slows the process and frustrates the end user. If they do experience technical challenges, they need support pronto in a 24-hour
There are three types of payment gateways for e-commerce online payments: redirects, checkout on-site with payment off-site, and on-site payments. Redirects take the consumer off of the merchant’s site and send them to a whole new site to complete a transaction. While this may be disorienting for a consumer, this method is also very easy to setup.
According to a news report by the London Evening Standard,
Beyond
