Remote Access Account Breaches
Hackers recently broke into the payment systems that several northwestern U.S. restaurants and food service companies use via a remote access account that belongs to of their vendor.
This is one of many examples of why companies should be monitoring third-party access to their networks.
Information Systems and Supplies (ISS), a Vancouver, Wash.-based provider of Point of Sale systems used by bars and restaurants in the region, has warned its customers that hackers may have accessed their payment systems software using remote login credentials from a LogMein account that was used by the company to remotely support/manage their customer network.
Early indications are that the system was breached at least three times between February 28, 2014 and April 18, 2014. ISS indicated company president Thomas Potter indicated that an unknown person or groups illegally used one of his companies LogMeIn accounts to plant malware on PoS systems that belonged to ISS customers.
While all of the details of the breach have not been made clear, it is currently surmised that it may have been via a phishing attack. It was also indicated that ISS used a common password to access it’s LogMein account, which allowed hackers to easily guess it.
ISS has indicated that an unnamed security vendor and the U.S. Secret Service are investigating the scope and nature of the breach.
Last year the security firm Trustwave estimated that 63% of 450 data breaches studied by the security vendor were caused by security vulnerabilities that were introduced by a third party.
Small businesses and franchises within the food and beverage industry and the retailers were most often impacted by third-party security failures.
Some other common situations that can lead breaches are:
- Use of obvious passwords.
- Remote access from unsecured locations, or locations already infected with malware.
- Systems without current security patches installed, allowing easy infection by malware.
- Systems with no anti-virus or anti-malware software installed, or software that out of date or expired. Ironically, this could include such items as DVR’s for security systems.
- Remote users not properly logging off their remote connections, leaving an open unsecured access point.
What the above clearly indicate that their is a need to constantly review and improve upon security. Please contact the CCS Retail Systems Support Department to schedule a security review of your various systems.
– John