Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Subscribe
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Subscribe
    Home Applications
    • Applications
    • Cybersecurity

    Cyber-Thieves Targeting Smaller Retailers

    Written by

    Evan Schuman
    Published October 2, 2006
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      As the established large e-commerce sites pour millions of dollars into security and enterprise-league hardened point-of-sale systems, cyber-crooks have been giving more attention to much smaller and less well-protected merchants.

      Those smaller merchants cant even necessarily protect themselves by opting to not have a Web site, as the thieves are grabbing credit card information as its transmitted over the Internet to POS servers.

      “In general, the smaller retailers, whether theyre operating e-commerce sites or physical stores, dont have the resources to think about security,” said Gartner Group retail security analyst Avivah Litan.

      Many of the POS programs used by smaller retailers “have vulnerabilities,” Litan said. “[Criminals] can log into these systems using programs like PCAnywhere, and, lo and behold, they can get the credit card and debit card data, and sometimes theres even magstripe data being stored. A small retailer doesnt have the time or the resources or the inclination to know about all this.”

      A recent Washington Post story highlighted the issue, but its been common knowledge in the law enforcement world for years that smaller retailers are very attractive targets.

      The goal of the thieves is typically not to use the data to create bogus credit cards as much as it is to collect a large number of numbers and authentication codes and to sell that collection of data to support fraudulent e-commerce purchases or to purchase stored-value cards and use those to make brick-and-mortar purchases.

      Gartners Litan said some global cyber-crooks have gotten fairly sophisticated in selecting their victims. “I was told by a forensics analyst that there are some thieves in Vietnam who have figured out which point-of-sale cash registers are vulnerable,” she said. “They go to the manufacturers Web site, find out who the big customers are, and they may even find out small customers. They then go attack those terminals. They may not even know how vulnerable they are. For example, they may not have an e-commerce site, but they may use a terminal program that the vendor maintains through an Internet protocol.”

      This trend has started to impact consumer e-commerce purchasing habits, as consumers tell surveys that they are much more comfortable buying from larger e-commerce because they feel safer doing so. The dream of every large retail marketing exec—who initially feared those startups undercutting their price—is being realized.

      Not that the feds arent doing as good a job as could be expected against cyber-crime, with a recent major Secret Service probe a good example of the kinds of techniques todays law enforcement agent is using.

      Much of the problem, though, resides with software vendors pushing POS options for smaller retailers. Greg Buzek, president of the IHL Consulting Group, estimates that there are some 2,000 POS vendors pushing products for the small-retail market, which is a dramatically larger number than that service the worlds largest retail chains POS needs.

      In Buzeks opinion, the biggest cause of the security weakness for smaller retailers “is bad software.”

      Another belief is that smaller retailers do not always rigidly abide by accepted security rules, such as the PCI rules forbidding the retention of key credit card information. Many retailers disobey that rule so that they can more easily handle product returns, where the customer will want the credit applied to the credit card that was used, he said.

      But many smaller retailers also dont fully understand what their POS software can and cannot do, which is what the cyber-thieves are counting on.

      Also at fault are security auditors and consultants who tell smaller sites—after an audit—that theyre safe when theyre not.

      Buzek and Litan discussed the small retailer security situation with analysts from Forrester, the Lakewest Group and the Retail Systems Alert Group recently during a Web audiocast.

      Retail Center Editor Evan Schuman can be reached at [email protected].

      Check out eWEEK.coms for the latest news, views and analysis on technologys impact on retail.

      Evan Schuman
      Evan Schuman
      Evan Schuman is the editor of CIOInsight.com's Retail industry center. He has covered retail technology issues since 1988 for Ziff-Davis, CMP Media, IDG, Penton, Lebhar-Friedman, VNU, BusinessWeek, Business 2.0 and United Press International, among others.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.