Attacks/Breaches
12/21/2013
09:00 AM
0%
100%

Target Breach: 10 Facts

Experts advise consumers not to panic as suspicion falls on point-of-sale terminals used to scan credit cards.

Just in time for the holidays, Target confirmed Thursday that its systems were breached.

Thanks to the breach, one or more attackers successfully stole 40 million credit card numbers. Anyone who used a credit or debit card in any of Target's US stores between November 27 and December 15 may be a victim. Target.com users and customers at Target stores in Canada are not affected.

The Target attackers gained access not only to card numbers, but also card expiration dates, CVV codes, and cardholders' names. As a result, they could use the stolen information to make fraudulent purchases via phone or online as well as to create working counterfeit credit cards.

[For more on the Target breach, see Target Confirms Hackers Stole 40 Million Credit Cards.]

How did hackers likely steal the credit card data, and what should consumers who may have been affected by the breach do next?

Here's what we know about the breach, its likely repercussions for affected cardholders, and how they should respond:

1. Target declines to comment on data encryption questions.
How did hackers manage to steal 40 million cards? That's a pertinent question, since any retailer that stores credit card data, according to the Payment Card Industry Data Security Standard (PCI-DSS), is required to encrypt that data. Furthermore, if the data is properly encrypted in transit and at rest, it shouldn't be of any use to attackers.

"This is a breach that should've never happened," Forrester analyst John Kindervag said in an emailed statement. "The fact that three-digit CVV security codes were compromised shows they were being stored. Storing CVV codes has long been banned by the card brands and the PCI [Security Standards Council]."

Reached via email, a Target official declined to respond to questions about whether the retailer had stored the stolen card data in encrypted format, or whether it had been certified as PCI-compliant. "We continue to invest in our security practices to protect our guests' information including the retention of a leading third-party forensics firm to conduct a thorough investigation of this incident," Target spokeswoman Molly Snyder said via email. "We apologize for any inconvenience this has caused our guests."

Target has also declined to address how attackers got their hands on the data in the first place. "As this is an ongoing investigation, we don't have additional details to share on the questions you asked," said Snyder.

2. Malware, point-of-sale apps, and insiders suspected.
The fact that the Target data breach didn't touch its e-commerce operation, but rather its stores, suggests that attackers gained access to information that was gathered via point-of-sale (POS) terminals -- a fancy name for electronic cash registers.

Hord Tipton, executive director of (ISC)2, said in an emailed statement that attackers likely infected massive numbers of POS terminals with malware. "It's one thing to compromise or affect one machine, but to get all of them begs the question of how this was plotted out in the first place," Tipton said. "How were the hackers so efficient? From what I can tell, it looks like an insider threat -- someone on the inside probably helped."

Alternately, attackers may have been able to remotely tap into the POS terminals by exploiting vulnerabilities in their built-in Web servers, Bala Venkat, the chief marketing officer for Web application security vendor Cenzic, said in an emailed statement. "When searching for vulnerable targets, attackers are discovering that many retail merchants and point-of-sale terminals haven't implemented some of the basic security measures required by [PCI]," he said, which would include two-factor authentication on the terminals for anyone attempting to remotely connect to it.

The breach was likely compounded by Target failing to monitor its POS terminals for signs of attack. "This seems rather obvious from the information revealed already about this Target breach," Venkat said.

But Gartner analyst Avivah Litan said in a blog post that the breach was likely not due to malware or hacking, but a very low-tech -- and insider -- attack. "If we've learned anything from the Snowden/NSA and WikiLeaks/Bradley Manning affairs, it's that insiders can cause the most damage because some basic controls are not in place," she said. "I wouldn't be surprised if that's the case with the Target Breach -- i.e., that Target did a great job protecting their systems from external intruders but dropped the ball when it came to securing insider access."

3. Full investigation may take months.
Although a statement released by Target said that it "has identified and resolved the issue" exploited by the attackers, it may be many months before Target has a complete picture of how the breach occurred. "It will be interesting to see how the attackers got into the network and what technical countermeasures were in place, but that will take months to surface as the forensics in such a case are extremely time consuming," Qualys CTO Wolfgang Kandek said via email.

4. Stolen cards are already flooding black market.
Security experts said the timing of the breach corresponds with a recent surge of stolen credentials being offered for sale on underground cybercrime forums. "We started to detect that something was afoot on December 11th when [we] detected a massive increase – 10 - 20x -- in availability of high-value stolen cards on black-market sites," read a blog post from security vendor Easy Solutions. "Nearly every bank and [credit union] in the US seems to be affected."

Target has yet to say how it learned of the breach. But having a massive quantity of stolen credit cards flooding the market would have been a red flag for card issuers. One quick tipoff about the source of the breach would likely have been the large number of Target Redcard credit and debit card numbers.

5. PCI compliance failed to stop the breach.
Critics of the PCI standard -- created by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa -- have long suggested that businesses that technically comply with PCI may not have robust information security practices in place. Furthermore, critics have charged that enforcement of the industry-advanced standard lacks teeth, as evidenced by the PCI Council sometimes retroactively revoking certifications.

In 1997, for example, TJ Maxx parent company TJX was breached, resulting in the theft of 90 million credit card numbers. In the wake of the breach, investigators revealed that TJX wasn't in compliance with nine of the 12 PCI data security standards. The breach reportedly served as a wakeup call for retailers to get compliant with PCI.

"PCI is designed to push nearly all risks and costs onto merchants and their banks through a series of contracts," said Rich Mogull, CEO of Securosis, in a blog post earlier this year.

But has PCI resulted in major retailers taking information security seriously? Witness the spectacle earlier this year of Visa suing PCI-compliant sports clothing retailer Genesco for $13 million, after the retailer suffered a data breach. The council also retroactively revoked the retailer's PCI compliance. That maneuver, Mogull alleged, allowed the PCI Security Standards Council to continue saying that "no PCI compliant organization has ever been breached."

"This is a clear fallacy -- merchants pass their assessments, they get breached, and then PCI retroactively revokes their certifications," Mogull said. "Fines are then levied against the acquiring bank and passed on to the merchant."

Going forward, Target will reportedly have to hire one of the 10 firms in the United States that are certified to perform PCI investigations. That firm also can't be the same as the company that certified Target's PCI compliance.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/30/2013 | 3:05:42 AM
Re: Lets Try Some Facts.....
I agree you Joe, but do you think any term like flawless technology exists. Even Cv2 was developed as a strong measure towards security but this target breach cracked this security.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Strategist
12/27/2013 | 6:33:50 PM
Re: When?
Theoretically, depending upon the particular situation, disclosing a data breach before knowing how the breach occurred and if it has been fully fixed yet potentially invites more attacks.  It can be a balancing act between doing the right thing by your affected customers and preventing further harm to additional customers.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Strategist
12/27/2013 | 6:27:50 PM
Re: Lets Try Some Facts.....
@virsingh: Chip and Pin/EMV technology has more than its fair share of security problems, too.

Laughably (unless you're someone affected by it), a big part of the problem with EMV for consumers is that when there is a breach, it is difficult for consumers to convince the banks because of the commonly held fallacy that "EMV is secure."
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/27/2013 | 4:24:46 AM
Re: Lets Try Some Facts.....
I guess it's time to make Chip-Pin, OTP like security mandatory for users, i guess it may sound irritating but precaution better than cure.
samicksha
50%
50%
samicksha,
User Rank: Apprentice
12/27/2013 | 2:12:20 AM
Re: Lets Try Some Facts.....
I guess it's more than just Target Breach, i recently read that it was not only Target-issued credit cards who were affected, infact customers who used any credit or debit card could be affected.
rradina
50%
50%
rradina,
User Rank: Apprentice
12/24/2013 | 10:26:37 AM
Re: Lets Try Some Facts.....
I completely agree that Target may have done everything PCI demands and that they don't deserve speculation.  Personally, I think it's an inside job.  Someone had the garage door code, knew the occupants were on vacation and walked out with the family jewels.  That doesn't mean Target is off the hook but some trust is required for employees to do their job and as recent events prove, even the NSA is vulnerable to this attack vector.

FYI... Another site's article claimed the cvv code was not compromised.

The last retailer who employed me used a third party in ~1,000 stores to provide payment processing.  It was AES-encrypted and also sent HTTPS from pin pad swipe to the external processor who then connected to the various clearing banks/processors.  Only the truncated number was stored in the TLOG. The pin pads had a kill switch if they were opened and the third party actively tracked serial numbers, warned if an unauthorized device was present and refused to authorize payments from it.  (BTW a popular scam is for a "repair company" to call the local manager and pretend they were from "corporate" so they could schedule an appointment to replace one of the pin pads that was "reporting a problem".)

Unfortunately if communication was down even this system had potential weakness.  It could be configured to check a local bad card list and authorize up to a certain dollar amount with store and forward.  Although the track data it stored was encrypted, it was on the local POS lane which could then become a target.  However 40m card numbers would require compromising all POS lanes, everwhere and zapping redundant MPLS links to the third party to force store and forward mode.  That's an almost impossible target that only yields thousands of small, strongly encrypted files.  It's far easier to find something centralized and "inside the garage".
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
12/24/2013 | 9:42:29 AM
Re: Lets Try Some Facts.....
 Let's not forget that this is the busiest time of year for shopping so 40 million seems reasonable to me.

it was estimated that close to 100 million people would shop during the black Friday weekend alone. Everyone entitles to their opinion. I have read numerous articles about the data being stolen from the POS devices as customers swiped their cards. We don't know exactly how they did it and in all likelihood we won't know.
cjoshdoll
50%
50%
cjoshdoll,
User Rank: Apprentice
12/24/2013 | 9:28:06 AM
Re: Lets Try Some Facts.....
Agree, we don't know what happened.  I guess I am flustered with the "industry experts" throwing around as much blatant BS as they are - it's just adding to what I can the "hysteria news" angle.


I agree that there could be a tlog db, however it seems unlikely that you would store the entire track 2 data, including ccv1, for that purpose, even for target who is a data mining giant, that has admittedly tied credit transactions back to a user profile (See: How Target knew a teen girl was pregnant.)
 
Without debating the likelihood of a tlog DB with full card data, just the fact that the entire track 2 data was stolen, /seems/ to point to theft at swipe.  But again, you are correct, we just don't know, and I personally am afraid, we may never find out (publically.)


As someone who's job is to prevent this stuff, I have a number of concerns.  There should be a requirement to release the report generated by the forensic investigators, so that other businesses can protect against similar attacks.  I believe it should also be public to find out a company's PCI compliance status and who provided their ROC.  I have a sneaking suspicion that they got theirs from the firm that essentially charges 3 times as much, and is 3x more lenient in their audit (but let me be clear, that is MY ASSUMPTION, and even if true does NOT mean Target did something wrong to cause this.) 

 

Which leads to my real point - everyone is pointing the finger at Target, before we know anything.  There are just too many possibilities to be able to say Target is at fault here.  I'm not here to defend them, I have no stake in it, I'm just tired of reading all of the baseless accusations and reading the "experts" mostly incorrect opinions.  Unfortunately I can't just tune it out and not read the stories, because it impacts my daily job....

 
rradina
50%
50%
rradina,
User Rank: Apprentice
12/23/2013 | 11:38:20 PM
Re: Lets Try Some Facts.....
Don't you think 40 million is a lot of unique shoppers for such a short period?  There are ~320m people in the US.  ~74m are minors leaving ~250m adults.

That means 15% of the adult population used a card at Target within a few week period.  Some folks used multiple cards but not everyone has cards. Many economically challenged don't even have bank accounts.  Some folks still write checks or pay with cash. Target isn't everywhere and some folks don't shop there.

If it was a network tap, they would have a hard time pinning down exact dates. It seems more plausible someone copied files which made it easy to know exact dates and accounts.  As I said, it makes sense to keep recent transactions for dispute/clearing/reload purposes.  The entire DB doesnt have to be compromised. In fact the temporary log may have been an easier target (no pun intended) than the master database.  It also shoukd have been truncated data in the master DB. There is also no guarantee the on-line and in-store POS go to the same balancing cash flow system.

I have 12 years of IT experience in retailing alone and have been through PCI audits since they started.

 

 
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
12/23/2013 | 8:10:25 PM
Re: Lets Try Some Facts.....
 

I think that cjoshdoll makes alot of sense. The fact that they are alerting anyone who used a CC at target between 11/27 and 12/15 indicates to me that the numbers were not stored but stolen at the time of the transaction. The time period makes perfect sense to back that reasoning up. If this was database data that was stolen don't you think it would impact many more people?
Page 1 / 3   >   >>
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7178
Published: 2014-11-28
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

CVE-2014-7850
Published: 2014-11-28
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.

CVE-2014-8423
Published: 2014-11-28
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.

CVE-2014-8424
Published: 2014-11-28
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.

CVE-2014-8425
Published: 2014-11-28
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?