Cyber-Thieves Targeting Smaller Retailers

Those smaller merchants can't even necessarily protect themselves by opting to not have a Web site, as the thieves are grabbing credit card information as it's transmitted over the Internet to POS servers.

"In general, the smaller retailers, whether they're operating e-commerce sites or physical stores, don't have the resources to think about security," said Gartner Group retail security analyst Avivah Litan.

Many of the POS programs used by smaller retailers "have vulnerabilities," Litan said. "[Criminals] can log into these systems using programs like PCAnywhere, and, lo and behold, they can get the credit card and debit card data, and sometimes there's even magstripe data being stored. A small retailer doesn't have the time or the resources or the inclination to know about all this."

A recent Washington Post story highlighted the issue, but it's been common knowledge in the law enforcement world for years that smaller retailers are very attractive targets.

The goal of the thieves is typically not to use the data to create bogus credit cards as much as it is to collect a large number of numbers and authentication codes and to sell that collection of data to support fraudulent e-commerce purchases or to purchase stored-value cards and use those to make brick-and-mortar purchases.

Gartner's Litan said some global cyber-crooks have gotten fairly sophisticated in selecting their victims. "I was told by a forensics analyst that there are some thieves in Vietnam who have figured out which point-of-sale cash registers are vulnerable," she said. "They go to the manufacturer's Web site, find out who the big customers are, and they may even find out small customers. They then go attack those terminals. They may not even know how vulnerable they are. For example, they may not have an e-commerce site, but they may use a terminal program that the vendor maintains through an Internet protocol."

This trend has started to impact consumer e-commerce purchasing habits, as consumers tell surveys that they are much more comfortable buying from larger e-commerce because they feel safer doing so. The dream of every large retail marketing exec—who initially feared those startups undercutting their price—is being realized.

Not that the feds aren't doing as good a job as could be expected against cyber-crime, with a recent major Secret Service probe a good example of the kinds of techniques today's law enforcement agent is using.

Much of the problem, though, resides with software vendors pushing POS options for smaller retailers. Greg Buzek, president of the IHL Consulting Group, estimates that there are some 2,000 POS vendors pushing products for the small-retail market, which is a dramatically larger number than that service the world's largest retail chains' POS needs.

In Buzek's opinion, the biggest cause of the security weakness for smaller retailers "is bad software."

Another belief is that smaller retailers do not always rigidly abide by accepted security rules, such as the PCI rules forbidding the retention of key credit card information. Many retailers disobey that rule so that they can more easily handle product returns, where the customer will want the credit applied to the credit card that was used, he said.

But many smaller retailers also don't fully understand what their POS software can and cannot do, which is what the cyber-thieves are counting on.

Also at fault are security auditors and consultants who tell smaller sites—after an audit—that they're safe when they're not.

Buzek and Litan discussed the small retailer security situation with analysts from Forrester, the Lakewest Group and the Retail Systems Alert Group recently during a Web audiocast.

Retail Center Editor Evan Schuman can be reached at Evan_Schuman@ziffdavis.com.

Check out eWEEK.com's for the latest news, views and analysis on technology's impact on retail.

comments dic