Miel Cybersecurity Engineering and Architecture: August 2016

Cici's Pizza Breach-Smells Like an Issue

The pizza is one of the more iconic foods in this culture. Consumers have positive thoughts with regard to indulging in the meal. What is not welcomed is the occasional issue with the credit card system. This unfortunately occurred with the Ci Ci’s recent breach. There were over 130 locations affected (Bisson, 2016; Pleasant, 2016; Kan, 2016; Copeland, 2016). Specifically there were problems noted with the POS system at these locations. The investigation started in March 2016 (Northrup, 2016). The noise regarding this issue was from several locations (Bisson, 2016) and curiously enough six financial institutions (NAFCU, 2016; Dissent, 2016).

The locations had found the POS systems appeared to be malfunctioning. This acted as the respective site’s red flag that something was not quite right. From the financial intermediary sources, they noticed the increase in fraud in their selected client accounts (NAFCU, 2016). As the numbers of feared cases began to increase, the affected parties researched the issue and contacted Ci Ci’s. The issue revolved around malware that had been placed on the affected systems. A third party was contracted to review the sites and remediated the issues. The sites affected were widespread. These were located in Alabama, Arkansas, Florida, Georgia, Kentucky, Louisiana, Maryland, Missouri, Mississippi, North Carolina, Ohio, Oklahoma, South Carolina, Tennessee, Virginia, and Wisconsin (Northrup, 2016).

This is not a new phenomenon. Other recent targets of this nefarious activity were Wendy’s, Dairy Queen, Buffalo Wild Wings, Taco Time, and Wingstop. These all together also were across different sized restaurants (national chains and local) and type of food.

Attack

This was noted as a problem in early March 2016 when the POS systems were not working well (Krebs, 2016). After it became readily apparent that there was an issue, more of an investigation ensued. There was indeed a breach of the POS system (Secureworld, 2016). The remainder of the sites was analyzed for the presence of malware by 403 Labs (Krebs, 2016). The vendor determined the breach was initiated in 2015 and the malware was active through the discovery date.

To gain unauthorized access, a group posed as technical support for Ci Ci’s POS provider, Datapoint (Able, 2016; Guard, 2016). After using the usual social engineering tactics, the attackers gained access and downloaded the malware (Krebs, 2016). Once the malware was on the system, the program was able to capture the credit card data per consumer. This data for the victim’s credit cards was then bundled together and sold to others. The purchasers would then place the data on credit card blanks, embossed these with the correct consumer information, and these were used to purchase higher end products.

Summary

There continues to be one focus of attack-the user. This continues to be a weak link. The attackers could have taken an abundance of time to perform a full hack of the system (enumeration, google hack, review potential system vulnerabilities, etc.). This may have taken much more time that what was necessary with this simple social engineering attack against a handful number of employees with access the attackers needed. The tactic to best defend against an attack much like this is simply training, more training, and a healthy dose of thoughtfulness.

References

Abel, R. (2016, June 9). Update: Possible POS breach at cici’s pizza. Retrieved from http://www.scmagazine.com/cicis-pizza-may-have-experienced-pos-breach-through-third-party/article/501245/

Bisson, D. (2016, July 20). Cici’s pizza suffers payment card breach at 130+ locations. Retrieved form http://www.tripwire.com/state-of-security/latest-security-news/cicis-pizza-suffers-payment-card-breach-at-130-locations/

Copeland, M. (2016, July 22). Credit card security breached at local cici’s restaurants. Retrieved from http://www.wacotrib.com/news/business/credit-card-security-breached-at-local-cicis-restaurants/article_c5729531-b48e-5c60-9c56-4db2c58a6575.html

Dissent. (2016, June 4). Banks: Credit card breach at cici’s pizza. Retrieved from https://www.databreaches.net/banks-credit-card-breach-at-Cici-s-pizza/

Guard, B. (2016, June). Suspected data breach at cicis pizza exposes customer payment cards. Retrieved from http://blog.billguard.com/2016/06/apparent-data-breach-cicis-pizza-exposes-customer-payment-cards/

Kan, M. (2016, July 20). Hackers have targeted 130 restaurants at cicis pizza chain. Retrieved from http://www.pcworld.com/article/3098167/hackers-have-targeted-130-restaurants-at-cicis-pizza-chain.html

Kreb, B. (2016, July 19). Cici’s pizza: Card breach at 130+ locations. Retrieved from https://krebsonsecurity.com/2016/07/cicis-pizza-card-breach-at-130-locations/

NAFCU. (2016). Cici’s pizza hit by data breach. Retrieved from https://www.nafcu.org/News/2016_News/June/Krebs_Cici_s_Pizza_hit_by_data_breach/

Northrup, L. (2016, July 20). Eat at cici’s pizza in the last year? Watch your credit card statements. Retrieved from https://consumerist.com/2016/07/20/eat-at-cicis-pizza-in-the-last-year-watch-your=credit-card-statements

Pleasant, R. (2016, July 20). Cici’s pizza data breach serves a slice of credit card theft. Retrieved from http://siliconangle.com/blog/2016/07/20/cicis-pizza-serves-a-slice-of-credit-card-theft/

Secureworld. (2016, July 21). Cici’s pizza suffers data breach: 17 states affected. Retrieved from http://www.secureworld.expo.com/cicis-pizza-suffers-data-breach-17-states-affected-0?utm_source=Copy+of+SW+Post+July+21%2C+2016&utm_compaign=SW+Post#3a+July+7%2C+2016&medium=em

Breach Response

Years ago, a business could plan to secure their enterprises. The IT department would harden the system and in most cases there would be a reasonable assurance the enterprises was relatively safe. Things have changed as technology has improved. This improvement has come at a price. The speed of advancement has not been the easiest environment to apply security in. This lack of applied security has promoted several issues. This has been noted in many breaches. This has clearly only grown in importance as the breaches the breaches are more common and the businesses provide more data to steal.

In the case of a breach, the first act is that the alleged breach must be verified to have occurred. If one did occur, the business needs to analyze what was affected. Not all breaches are reportable. If there happens to be data involved of a consumer confidential nature, there would need to be a notification. The trigger point would be the data having social security numbers, driver’s license numbers, financial account numbers, passwords, and other personally identifying information.

The business also may be required to notify the affected parties with in a specific amount of time. This period varies on the state and federal level, depending on the subject matter and jurisdiction. Many states instead of putting a number of this period, simply state this have to be done with a few “reasonable” time period. This generally is accepted as 45 days. If there is HIPAA information involved, there may be a timeline in place for the notification.

Once the timeline is in place and divided on, the notice itself has to be written. This is also dependent on the jurisdiction. Certain states have requirements that have to be met. For instance, Rhode Island has for its notification law six items to be met. There may be a template or form letter to be used.

These events are not going to slow down in occurrence or magnitude. As the attackers have operationalized this as a business, it has proven itself to be a revenue producer, and popular as an attack tool.

Miel, LLC Infosec Managed Services & Consulting

810-701-5511

charlesparkerii@gmail.com

http://mielinfosec.blogspot.com

It is not about winning or losing, but reorienting yourself to the real problem-managing the risk across the enterprise.

Predictive Analytics Applicable to Info Sec

Info Sec is an uphill battle daily. The entity with limited resources of staffing, time, and expenses has the duty and responsibility to secure and protect the enterprise and its data. The entity has only a limited number of staff members present, space to have them, and costs associated with having the staff members employed. This limited number of staff members equates to lesser hours being available during the week to work on it. The entity lastly does not have an open checkbook to purchase off of the top shelf security applications, hardware, and scanning tools. All of these can get very costly very quickly. The attackers, on the other hand, on a collective measure have people coding malware, scanning, and actively seeking vulnerabilities. This occurs across the globe. The business, being potentially attacked form anywhere, at any time, by a large number of people and their bots. The CISO of a targeted organization has many sleepless nights.

One tool that is exceptionally helpful with this is predictive analytics. Previously the businesses would use anti-virus (AV) and log management to analyze a mass amount of data hoping to note this. The predictive analytics has been able to add to the set of tools to assist with the function to provide a greater depth of security.

One way this is applied is to analyze the probability of an attack occurring. The data set for this involves several factors, including data on the malware being seen for the industry and in general, other data breaches, methods used with these, phishing, and other data. This data coupled with the additional facets of the attackers provide a sign to be used to compare against for the files, traffic appearing in the network, emails and other attack vectors that may be present, helps to provide a better algorithm.

In implementing this, the items and network areas to review are much smaller and manageable.