While everyone is still reacting to the wide-spread ransomware attacks that happened earlier this year, it's become clear that hackers are becoming bolder and far more motivated to shake money out of businesses in any way they can. Malware is getting nastier and the most prominent hacks have graduated from annoying and destructive pranks to outright theft. Though we've only recently found out about the epidemic, in the last year there has been an astounding wave of cyber attacks targeting hotels and, specifically, their payment processing information.

With ransomware, we got used to the idea that hackers will use the same few tactics over and over again to see who will fall for them but the hotel attacks are different. Hackers are using a wide variety of tactics all to achieve the same goal: lists of credit card numbers along with expiration dates, authorization codes, and the names and addresses of guests. Conveniently, hotels tend to process and keep all the information they need and many have outdated or under-maintained IT security systems and practices.

Hospitality and Retail Beware

In truth, hotels are only the most prominent of the victims targeted by a year of intensive hacking attempts. Any business that processes payments, from eCommerce to brick-and-mortar retail are at risk from these invasive skimming and extraction programs. If your business handles credit cards and especially if you're known for keeping customer records, then your network and even your physical payment processing and point of sale devices are at risk from attack. Naturally, the more cards you tend to process in a given day, the more tempting a target you will be for hackers who plan to hide malware in your network or plant a skimming device.

The Layers of Attack

Because hackers have multiple ways to target your credit card data, it's important to understand every layer that needs to be protected from attacks. First, there are the standard malware attacks targeted through phishing, opportunism, and known vulnerabilities. These will hide in your business network looking for or collecting client data and sending it back in packets covertly. Then there are wifi attacks in which the hacker takes control and invades through your guest wifi, sometimes by physically accessing your network devices whenever they can. As a third avenue of attack, hackers have occasionally managed to place an undetected scanning bug onto a PIN entry device to catch credit card numbers the moment they are read.

Malware Scanning and Theft

Most IT security professionals and people who stay apprised on these subjects are familiar with the standard malware invasion through phishing links, malicious websites, and worms. These tactics are still in action this time they're set to looking for unencrypted databases of client data or a point of sale computer to infest and begin skimming from. The thing about standard malware is that it's on your network and therefore has to use your resources and send messages out to the hacker in order to serve its purpose. Modern hotel hacking software is incredibly complex, downloading itself in stages and sometimes even opening distracting cover documents to hide its activities. While this may be very sneaky against humans, network monitoring will be able to clearly see the unusual activity and then later detect the unauthorized communication with the remote hacker.

Wifi Malware Invasion

Wifi attacks are easy to defend against in a closed office building but if you offer guest wifi, it's much harder to watch out for unauthorized people within the broadcast zones. Wifi invasion is notable among malware because it requires someone to get into your broadcast area, however, once they've gotten inside, it's possible for them to upload malware directly onto your network. The good news is after this unique invasion, the malware has the same behavior as malware that installs itself via phishing or a secret download. Once it's on your system, the malware will look for opportunities to skim or retrieve stored payment card information and then transmit it back to the writer and network monitoring will be able to catch this illicit use of resources and outbound packets.

Hidden Card Skimming Device

One rare attack method is tiny skimming devices installed in the machines that scan cards often called PIN entry devices. While you would think this an obvious tactic, hackers have gotten quite creative about distracting employees and effectively hiding their little skimming bugs. The first level of defense against skimming devices is to physically check the machines but there's always a chance that a check is missed, that employees wouldn't recognize a bug if they saw one, or that the bug has been hidden inside the case somehow. When this happens, the only way to detect the skimmer and stop it from stealing client card data is to detect it's activity with network monitoring. Monitoring can keep an eye on network communications and can even detect a tiny power usage increase as the device vampires off the scanner.

PCI-Compliance and Network Monitoring

The best defense against malware, hackers, and the creative tactics they pursue is to keep your firewalls, virus scanners, and network security up to date. Modern software and point of sale device manufacturers are using all the most recent data on hackers to harden their systems against malware and similar data breaching invasions. While many companies make do with whatever technology they already have at hand, if you want to ensure that your system is as defensible as possible, there's a new protocol known as PCI-DSS (payment card industry - data security standards) that can help you get upgraded and modern. Any gaps left after a complete infrastructure upgrade may only be identifiable with network monitoring.

Is Your Business Safe from Credit Card Hackers?

If your website, shop, hotel, or restaurant processes credit cards (and who doesn't?), then your network is worth enough to hackers to target and invade. These scoundrels aren't just playing pranks anymore, they're out for real money and don't care how many businesses and individuals they have to hurt to get it. Credit card scams may be the beginning but hackers are also collecting names, addresses, phone numbers, and any other stored personal information. It's only a matter of time before identity theft and other forms of fraud result from the hotels and retail brands that have already been hacked. Instead of getting caught up in the waves of scandal, PR disasters, and desperate scrambles to recover data and make amends to clients, you have every reason to reinforce your network security system now.

Simply as a responsible business owner, it's your job to harden your network, guest wifi, and point of sale devices before they can be compromised. You might even want to consider a full scan and clear just in case there's already malware lurking on your system. With up to date equipment and software, a properly configured firewall, and network monitoring, you should be able to give your clients absolute assurance that everything possible is being done to protect their credit card numbers and their personal information from the recent wave of invasive hacking. Whether you're a five star hotel or even just a popular local convenience store, it's worth your while to keep your payment processing infrastructure safe.