The Wawa credit card data breach is one of the worst retail failures of data security in recent history. 

Last week we reported on the consumer side of the Wawa credit card data breach that, as far as we can tell, affected every single swiped payment card between March and December 2019. In a nutshell, Wawa discovered a security breach back on December 10th, 2019 involving all of their POS systems, fast-forward to January 28th2020 and Wawa released a statement acknowledging that the recently stolen card holder data was featured on “Joker’s Stash”, a sprawling virtual hub of stolen card data that has served as the distribution point for accounts compromised in many of the retail card breaches. 

 This week, we will take a quick dive into some of the likely causes of the credit card data breach, baseline security controls that should have been in place, and some of the ways that GoVanguard recommends to help prevent security incidents like this from happening to your organization. 

Jokers Stash

Wawa Credit Card Data For Sale on “Joker's Stash”

 

So What Happened?

The root cause behind most data breaches perpetrated by external malicious actors (including this one) is typically poor implementation of administrative, technical and physical security controls. In the case of Wawa, malware was installed on multiple POS (point of sale) terminals – which is a common asset for malicious actors to target. 

The concerning part of the security incident, as told from Wawa’s own narrative, is that the malware was able to laterally move across multiple Wawa stores and all the way to central POS payment processing servers This means that it is likely that Wawa had no or poor network segregation in place which violates a core requirement of PCI-DSS: the standards which apply to all organizations that process card holder data (credit card and debit card transactions). It seems that Wawa did not have basic security and network segregation mechanisms in place like robust access control lists (ACLs) because physical stores should not be able to directly communicate between one another. Basic security controls like ACLs help prevent the lateral movement of malicious actors between information systems and contain the malicious actor to a specific location or system domain. 

Furthermore, the fact that the security breach went undetected for over nine months suggests that Wawa did not have any NIDS (network intrusion detection software) systemin place or it was not being monitored by staff – another PCI-DSS requirement for an organization like Wawa 

Lastly, Wawa unable to specify which stores were affected and which stores were not affected by the security breach. Wawa’s inconclusive response suggests that they had very little logs to analyze and pinpoint the exact lateral movement path of the malicious actor behind the security breachThis means there was probably no centralized logging facilities or SIEM (security information event management) in place – another PCI-DSS requirement for an organization like Wawa. 

Malicious Actor Attack Process

What Happens Next?  

The reputational and financial damage that this security breach will cause Wawa in the mid-long term is inestimable but Classaction.org says that the retailer is “swamped” with litigation; noting at least 11 major, federal lawsuits at this current moment.  

On January 29, 2019, Inspire Federal Credit Union added themselves to the list of plaintiffs. An unnamed, but official spokesman for Inspire Federal Credit Union stated 

“Furthermore, time will tell whether plaintiff is subject to an imminent threat of future harm because Wawa’s response to the data breach is so inadequate that it is doubtful that it has cured the deficiencies in its data security measures sufficiently to prevent a subsequent data breach.” 

Concisely put, it iapparent that Wawa had an immature information security program with deficiencies across many security controls including network segregation, malware detection, intrusion detection and centralized systems logging. All of these deficient security controls could have been enumerated and analyzed easily with a cybersecurity risk assessment, information security program gap assessment or network penetration test.  

 

What Can My Company Do To Avoid a Similar Breach?

The Wawa security breach demonstrates worst-case scenario for a retailer that depends on the trustworthiness of their brand, especially given the failure of so many basic security principles. 

GoVanguard is a cybersecurity provider on the forefront of an ever-changing, complex security landscape. We provide both snapshot-based and continuous security testing services including risk assessments and web/network penetration tests. 

Reach out to us today and see how easy it is take control of your security and keep your brand’s reputation secure. 

Many retail data breaches leak partial customer data, partial credit card numbers or other bits of information that malicious actors can scrape and use as part of broader attacks. But the Wawa data breach is different. Every single customer that used their physical credit or debit card at a Wawa store since the spring of 2019 has had their card number stolen by malware on Wawa's point-of-sale servers, and the info is already for sale on the darkweb!

GoVanguard Recommendations to Protect Yourself:

1.      For those affected, we highly recommend replacing your credit or debit card. If you choose not to do so, we recommend watching your payment transaction statements closely.

2.      Wawa is required to provide free Identity Protection Services to those who are affected. If you do not already have ID Theft and Credit Monitoring (like LifeLock), navigate to https://www.experianidworks.com/credit and sign up with the activation code 4H2H3T9H6.

3.      We recommend consumers switch to making in-store purchases with a digital wallet or mobile payment app like Apple Pay, Google Pay or  Samsung Pay. With these apps, the merchant does not receive the details of your credit, debit card or checking account. They only receive a unique, one-time code for that specific purchase. Even if the merchant’s point-of-sale system is hacked, you will not have to worry about your card number being stolen.

4.      For online retail purchases we recommend using Privacy.com (it’s free! They make money from interchange fees paid by merchants) that can generate merchant-specific card numbers and “burner” card numbers for online purchases so that you never have to use your real card number!

Next week, we will go over the details of the specific malware attack and how a systematic approach to monitoring and penetration testing would likely have mitigated the attack entirely. We will also discuss why a rigorous security protocol is crucial in all retail point-of-sale environments.

See you next week!

The US Department of Defense issued multiple warnings for all US Military personnel this month; banning the viral Chinese social media app TikTok! Due to various threats of data leakage, Chinese Communist Party censorship and the potential for exploits, the DoD has demanded that all government-issued smartphones have the application removed immediately, and monitor their personal phones and their family members' devices for unusual and unsolicited texts, calls, direct messages and emails. Air Force Lt. Col. Uriah Orland stated, Any such messages should be deleted immediately.

 

 So why the sudden uproar?  

 

If you have tweens, teens or young adults in your household, you probably have the alleged Chinese surveillance app sitting within your walls and connecting to your Wi-Fi! TikTok is the 3rd most downloaded app of 2019, and it is chugging away at dethroning the social media titans of yesteryear even while the US “Committee on Foreign Investment” investigates censorship of TikTok’ed content critical of China’s Communist Party. But even as President Trump bans tech from Huawei and other Chinese firms from entering the US, jubilation abounds as American kids share videos – primarily lip-syncing pop music hits or creating short sketch comedy – over the Chinese powerhouse of social media! 

  

But this is not a scathing political piece of propaganda in the campaign to ensure that Americans suddenly resume “buying American.” Nor is it an analysis of the DoD’s reactions to the threat. Rather, this is a warning about a new and clever chain of exploits centered around Tiktok which targets a host of private user data! The initial exploit is devious because of its near perfect use of social engineering to trick a user into authenticating their app from a spoofed SMS. From there, the list of compromised data is long and insidious:    

   

With use of open redirection, and cross-site scripting (XSS), a malicious actor can:    

  

  • Delete any video from a victim’s TikTok profile.  
      
  • Upload unauthorized videos to the victim’s TikTok profile.  
      
  • Make the victim’s private, “hidden” videos public.  
      
  • Reveal personal information, such as private addresses and emails.  
      

The attack uses an insecure SMS system that TikTok offers through its website which asks users to send a message with the official link to download the popular app. An attacker can then send an SMS message to the victim’s phone number with the appearance of being sent on behalf of TikTok. The download URL will have been modified to direct to a malicious page that executes code on the targeted device with the already installed TikTok app.   

  

When this attack was unknown and unpatched in the wild, the exploit would execute JavaScript code as soon as they clicked the link sent by the TikTok server over SMS. This attack is called a “cross-site request forgery attack,” which aims to trick authenticated users into executing an unwanted action.   

   

GoVanguard CTO, Shane Scottcommented, “The beauty of the attack is that the authentication wasn’t unsolicited. The user requested the text message, and they followed directions correctly to authenticate the app. Why would they ever assume they had been attacked? This would even trick a lot of seen savvy people until they had a reason to assume there was something wrong.”   

   

In November 2019, this massive chain of vulnerabilities was responsibly disclosed to ByteDance, the company who maintains and distributes TikTok, who then released a patched version of its mobile app to protect its users from this string of attacks. If you are not running the latest version of TikTok available on official app stores for Android and iOS, we advise that you update your app as soon as possible.  

  

Or, if you are a 33-year-old professional, like myself, you can follow my lead and delete TikTok altogether.  

  

I didn’t “get it” anyways!