Robert Siciliano, a Boston computer security expert, discusses the Justice Department's largest data theft case in U.S. history: over 40 million credit and debit card numbers stolen from TJX, Barnes & Noble, Sports Authority, and other major retailers. The thieves used war driving and card-skimming technology to encode stolen data onto blank magnetic-strip cards.
Chapters
Well, 11 people have been charged in what the government is now calling the largest data theft case in U.S. history. More than 40 million credit and debit card numbers were stolen from 9 major retailers. Names like TJX, Barnes Noble, and Sports Authority. Ron Sanders explains how it all went down.
The case is important enough to the U.S. Justice Department that the Attorney General and the Director of the Secret Service joined the U.S. Attorney here to announce the indictments against 11 defendants.
They used sophisticated computer hacking techniques, uh, that would allow them to breach security systems and then install computer programs that gathered enormous quantities of personal financial data, uh, which they then allegedly either sold to others or used themselves.
The retailers victimized include TJX Companies headquartered in Framingham, Natick-based BJ's Wholesale Club, OfficeMax, Boston Market, Barnes Noble, Sports Authority, Forever 21, and DSW. The companies were hacked by a tactic called war driving, derived from the term war dialing used in the film WarGames.
War driving is simply driving around in a car with a laptop computer looking for accessible wireless computer networks.
The Justice Department says after hacking into the networks, the hackers used sniffer programs to find card numbers and passwords. They would send the numbers to servers in the U.S. and Eastern Europe and sell stolen numbers online. The stolen numbers were cashed out by encoding them on magnetic strips of blank cards to steal money from ATMs.
As we see in today's indictment, a cybercriminal in Eastern Europe or Asia can inflict just as much damage with a few strokes of the keyboard as someone residing in Boston or Miami.
Ron Sanders, TV38 News.
And of course, the announcement of such a widespread breach has shoppers thinking twice about where they swipe their cards. We caught up with a few at stores affected by the problem.
Doesn't make me feel any safer, but it makes me feel like it's going to change in the future because they're going to have to upgrade this technology. They're going to have to do what they do in the financial services industries and things like that.
I tend to try to use cash in most situations.
Don't use the credit card?
No.
Afraid your numbers might be stolen?
Exactly.
This is only the latest case of computer hackers ripping off consumers, and it can even happen in your home. Jim Smith joins us now. Jim, you sat down with an expert and he has some tips and warnings we all should hear.
Absolutely, Kate, and believe me, if it can happen in a store, it can happen in your very own home. And if you don't take some action now to protect your home computer, you could be a victim. Tonight we have some inside tips.
There's a lot of stuff going on in the— on the wild, wild web.
Meet Robert Siciliano, one of Boston's top computer security experts. He says protecting your home PC is absolutely crucial. If you don't, you can lose your identity and everything you own. Let's start with the modems. If it's wireless, that's a red flag.
One of the weakest links in all computer security is your wireless connection to the internet. If you surf over the internet with a wireless router in your home or your office, please make sure that it is properly encrypted so that nobody can simply just log on to your internet connection and even tap into your computer.
Make sure you have a firewall on your computer, and don't forget to use a spyware removal program every couple of weeks.
Spyware monitors the websites you visit, the usernames and passwords you type in. Spyware is designed to spy on you, and it is able to log every single thing you do on your computer.
And let's say you go on a site like eBay and pay for something with a credit card. Is that site really secure? The answer can be found in the address bar at the top of your computer screen.
So where it says HTTP, there should be an S at the end of that, meaning it is a secured page.
And as far as using your debit card at stores, Siciliano says there's no way you can be totally protected nowadays. The best advice: check your statement very closely every month. So, Kate, we have to do some work as well, so hopefully common sense can prevail.
It's also discouraging.
Scary.
It's scary.
Yep.
Can computers at stores also get hacked?
Absolutely. In fact, as we found in the TJX scandal, it all began when a store in Minnesota had an unsecured wireless connection at the store itself, and that's how hackers got into store employee accounts and how this entire scam happened. So that's how it all started.
Just when we got comfortable shopping online and using our computers with our credit cards, now we have to worry about this.
You can still do it, you just have to be real careful. Okay.
