Remember CompUSA

by silic0nsilence  (2600@silic0nsilence.com)

I've been waiting a long time to write this article.

In case you didn't know, CompUSA closed 126 of its 220 stores in May 2007.  I was one of the unlucky employees.  Was I surprised?  Hell, no.  The company had been doing horribly for years.

We just couldn't compete with Best Buy, Dell, and Walmart - not to mention our legendarily horrible customer service.

When the news of the store closings was released, instead of jumping ship like many people, I stayed.  Not just for the great liquidation deals or the mediocre severance package, but because those CompUSA employees were my family.  And they were just as pissed as I was.

We had every right to be.  We walked into work one day and were told we were losing our jobs.  The next day, we went into liquidation.  But, honestly, it was the most fun I had in the 21 years I have been on this planet.

So, here's the exploit.

There are little computers all over CompUSA stores that customers walk by all the time but which they shouldn't have access to.  Unfortunately, employees use them so often that they rarely log out of them.  These machines are called IMS terminals.

We used them to check prices of products, look at the cost if we wanted to buy something, run the sales numbers, and so on.

While fooling around one day, I figured out that you could easily get details of every single sale that went through the system - including credit card sales, complete with the full card number, person's name, and expiration date.  The thing that really got me was that anyone had access to this information if the computer was logged on!

Here's the procedure for looking up this information.  Note that I say to press enter several times in some of the steps below.  This provides a blank field to the input requested.  If a field is not needed, the system uses default values.

First, go to a terminal in the store.

Turn on the Caps Lock if it is not already on.  If the terminal is not logged in, enter OPSM### for a username, where ### is the number of the store.

This information can be found on a receipt; buy a pack of gum!

OPSM stands for Operations Manager.

The password will be the same as the username.  If you would rather not find the store number, use djenkins as the username and password.  It is a universal login of a fictitious person.

Then, type AO, which stands for "Assembly Order" and press Enter twice.  Next, type OE, then press Enter.

If you see an error, press F8 to reset the terminal and go back to the beginning of the procedure.

Next, type 16 (Credit Card Authorization) and press Enter.

Type 1 (Authorization Report), and then press Enter three times.

You will be prompted for a date.  Enter the current date in MMDDYY format.

Press Enter twice.

Then, type Y, followed by D to display the authorization report or P to print it.

Pressing P does not output the report on the screen, but imagine the workers' faces when they go to their printer and see a list of credit card transactions!

The list will then display or print, with cash transactions first.  This doesn't provide you with any information of course, so press Enter until the page shows what you want.  If you did everything right, you hit the jackpot.

The data will be in the following format: sale ticket number, credit card or check numbers, payment type (MC for Mastercard, VI for Visa, etc.), expiration date, charged date, card security code, register number, some other crap, and the amount of the transaction.

Remember, use this for knowledge only; don't get yourself in trouble.

Shouts: Baby Girl, All laid-off CompUSA Employees