Attacks/Breaches
12/21/2013
09:00 AM
Connect Directly
RSS
E-Mail
0%
100%

Target Breach: 10 Facts

Experts advise consumers not to panic as suspicion falls on point-of-sale terminals used to scan credit cards.

6. Consumers: don't panic.
What should consumers who may have been affected by the data breach do next? "React, don't panic," Eva Velasquez, president and CEO of the Identity Theft Resource Center, said via phone. "Because we know that this is causing a lot of anxiety." On the upside, Target said that only card information -- and not people's personal information -- appears to have been stolen by attackers. "So now is the time to monitor statements very carefully," she said. "If you find any other evidence of fraudulent activity, obviously contact your financial institution."

One measure of people's panic is that Target's Redcard website and phone lines have been largely inaccessible since the company confirmed the breach Thursday. "We are working hard to resolve this issue by adding team member support and system capacity as quickly as possible. We apologize for the inconvenience and appreciate our guests' patience," Target spokesman Eric Hausman told the Minneapolis/St. Paul Business Journal Friday morning. In the meantime, the retailer is attempting to triage the outages by fielding customers' questions via Twitter.

7. Visa: we're investigating.
The Identity Theft Resource Center's Velasquez said that anyone who discovers fraud shouldn't have trouble getting help. "This is so big that if fraud is discovered on your card, it's not like your financial institutions are not going to know about this issue," she said.

Officials at Visa, for example, said Thursday that they're aware of the breach and have already begun working to mitigate any fallout, in part by working to distribute stolen card numbers to all affected issuers. "When such incidents occur, Visa works with the breached entity to provide card issuers with the compromised accounts so they can take steps to protect consumers through fraud monitoring and, if needed, reissuing cards," Visa said in an emailed statement. "Because of advanced fraud-monitoring capabilities, the incidence of fraud involving compromised accounts is actually rare, and Visa fraud rates remain near historic lows."

8. Watch fraud-reporting time limits.
Despite those assurances, anyone who might be a victim of the Target breach should beware card issuers' fraud-reporting windows. Different organizations, for example, may place 30-, 60-, or 90-day limits on when they'll accept a fraud notice, following a cardholder receiving their statement. Others, such as American Express, have no time limit for reporting fraud.

9. Debit card holders: call your bank immediately.
Debit card users should be especially vigilant. Credit card users won't be out of pocket if they suffer fraud and contest the charges, but the opposite is true for debit card holders since fraudulent transactions may take their bank balance to zero.

Accordingly, Velasquez recommended that any debit card users who might have been Target breach victims immediately contact their card issuers and ask for advice. "Tell them you're a victim of the Target breach," she said. To help combat fraud, different institutions offer different options, such as putting passwords on accounts or changing PIN codes. "But alerting your specific financial institution is really the way to go, because they all have different rules," she said.

10. Kudos to Target for coming clean quickly.
When it comes to information security, Target may have blown it. But according to Velasquez, the retailer does deserve credit for coming clean about the breach so quickly. "Four days? That's lightning speed," she said. "I think they deserve at least a few points for taking the hit and alerting their consumers ahead of time, and not trying to push it off until after the Christmas sales."

Compare the speed of Target's notification, for example, to the recent breach at JP Morgan Chase, for which the financial institution didn't issue an alert for more than two months. Or take the breach of the Washington State court system, which was publicly revealed in May 2013 after being detected in February. But state officials don't actually known when the breach occurred, saying they'd narrowed the window only to sometime since September 2012 and before February 2013.

There's no such thing as perfection when it comes to software applications, but organizations should make every effort to ensure that their developers do everything in their power to get as close as possible. This Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, examines the challenges of finding and remediating bugs in applications that are growing in complexity and number, and recommends tools and best practices for weaving vulnerability management into the development process from the very beginning. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/30/2013 | 3:05:42 AM
Re: Lets Try Some Facts.....
I agree you Joe, but do you think any term like flawless technology exists. Even Cv2 was developed as a strong measure towards security but this target breach cracked this security.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Apprentice
12/27/2013 | 6:33:50 PM
Re: When?
Theoretically, depending upon the particular situation, disclosing a data breach before knowing how the breach occurred and if it has been fully fixed yet potentially invites more attacks.  It can be a balancing act between doing the right thing by your affected customers and preventing further harm to additional customers.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Apprentice
12/27/2013 | 6:27:50 PM
Re: Lets Try Some Facts.....
@virsingh: Chip and Pin/EMV technology has more than its fair share of security problems, too.

Laughably (unless you're someone affected by it), a big part of the problem with EMV for consumers is that when there is a breach, it is difficult for consumers to convince the banks because of the commonly held fallacy that "EMV is secure."
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/27/2013 | 4:24:46 AM
Re: Lets Try Some Facts.....
I guess it's time to make Chip-Pin, OTP like security mandatory for users, i guess it may sound irritating but precaution better than cure.
samicksha
50%
50%
samicksha,
User Rank: Apprentice
12/27/2013 | 2:12:20 AM
Re: Lets Try Some Facts.....
I guess it's more than just Target Breach, i recently read that it was not only Target-issued credit cards who were affected, infact customers who used any credit or debit card could be affected.
rradina
50%
50%
rradina,
User Rank: Apprentice
12/24/2013 | 10:26:37 AM
Re: Lets Try Some Facts.....
I completely agree that Target may have done everything PCI demands and that they don't deserve speculation.  Personally, I think it's an inside job.  Someone had the garage door code, knew the occupants were on vacation and walked out with the family jewels.  That doesn't mean Target is off the hook but some trust is required for employees to do their job and as recent events prove, even the NSA is vulnerable to this attack vector.

FYI... Another site's article claimed the cvv code was not compromised.

The last retailer who employed me used a third party in ~1,000 stores to provide payment processing.  It was AES-encrypted and also sent HTTPS from pin pad swipe to the external processor who then connected to the various clearing banks/processors.  Only the truncated number was stored in the TLOG. The pin pads had a kill switch if they were opened and the third party actively tracked serial numbers, warned if an unauthorized device was present and refused to authorize payments from it.  (BTW a popular scam is for a "repair company" to call the local manager and pretend they were from "corporate" so they could schedule an appointment to replace one of the pin pads that was "reporting a problem".)

Unfortunately if communication was down even this system had potential weakness.  It could be configured to check a local bad card list and authorize up to a certain dollar amount with store and forward.  Although the track data it stored was encrypted, it was on the local POS lane which could then become a target.  However 40m card numbers would require compromising all POS lanes, everwhere and zapping redundant MPLS links to the third party to force store and forward mode.  That's an almost impossible target that only yields thousands of small, strongly encrypted files.  It's far easier to find something centralized and "inside the garage".
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
12/24/2013 | 9:42:29 AM
Re: Lets Try Some Facts.....
 Let's not forget that this is the busiest time of year for shopping so 40 million seems reasonable to me.

it was estimated that close to 100 million people would shop during the black Friday weekend alone. Everyone entitles to their opinion. I have read numerous articles about the data being stolen from the POS devices as customers swiped their cards. We don't know exactly how they did it and in all likelihood we won't know.
cjoshdoll
50%
50%
cjoshdoll,
User Rank: Apprentice
12/24/2013 | 9:28:06 AM
Re: Lets Try Some Facts.....
Agree, we don't know what happened.  I guess I am flustered with the "industry experts" throwing around as much blatant BS as they are - it's just adding to what I can the "hysteria news" angle.


I agree that there could be a tlog db, however it seems unlikely that you would store the entire track 2 data, including ccv1, for that purpose, even for target who is a data mining giant, that has admittedly tied credit transactions back to a user profile (See: How Target knew a teen girl was pregnant.)
 
Without debating the likelihood of a tlog DB with full card data, just the fact that the entire track 2 data was stolen, /seems/ to point to theft at swipe.  But again, you are correct, we just don't know, and I personally am afraid, we may never find out (publically.)


As someone who's job is to prevent this stuff, I have a number of concerns.  There should be a requirement to release the report generated by the forensic investigators, so that other businesses can protect against similar attacks.  I believe it should also be public to find out a company's PCI compliance status and who provided their ROC.  I have a sneaking suspicion that they got theirs from the firm that essentially charges 3 times as much, and is 3x more lenient in their audit (but let me be clear, that is MY ASSUMPTION, and even if true does NOT mean Target did something wrong to cause this.) 

 

Which leads to my real point - everyone is pointing the finger at Target, before we know anything.  There are just too many possibilities to be able to say Target is at fault here.  I'm not here to defend them, I have no stake in it, I'm just tired of reading all of the baseless accusations and reading the "experts" mostly incorrect opinions.  Unfortunately I can't just tune it out and not read the stories, because it impacts my daily job....

 
rradina
50%
50%
rradina,
User Rank: Apprentice
12/23/2013 | 11:38:20 PM
Re: Lets Try Some Facts.....
Don't you think 40 million is a lot of unique shoppers for such a short period?  There are ~320m people in the US.  ~74m are minors leaving ~250m adults.

That means 15% of the adult population used a card at Target within a few week period.  Some folks used multiple cards but not everyone has cards. Many economically challenged don't even have bank accounts.  Some folks still write checks or pay with cash. Target isn't everywhere and some folks don't shop there.

If it was a network tap, they would have a hard time pinning down exact dates. It seems more plausible someone copied files which made it easy to know exact dates and accounts.  As I said, it makes sense to keep recent transactions for dispute/clearing/reload purposes.  The entire DB doesnt have to be compromised. In fact the temporary log may have been an easier target (no pun intended) than the master database.  It also shoukd have been truncated data in the master DB. There is also no guarantee the on-line and in-store POS go to the same balancing cash flow system.

I have 12 years of IT experience in retailing alone and have been through PCI audits since they started.

 

 
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
12/23/2013 | 8:10:25 PM
Re: Lets Try Some Facts.....
 

I think that cjoshdoll makes alot of sense. The fact that they are alerting anyone who used a CC at target between 11/27 and 12/15 indicates to me that the numbers were not stored but stolen at the time of the transaction. The time period makes perfect sense to back that reasoning up. If this was database data that was stolen don't you think it would impact many more people?
Page 1 / 3   >   >>
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

CVE-2014-0762
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows physically proximate attackers to cause a denial of service (infinite loop or process crash) via crafted input over a serial line.

CVE-2014-2380
Published: 2014-08-27
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file.

CVE-2014-2381
Published: 2014-08-27
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows local users to obtain sensitive information by reading a credential file.

CVE-2014-3344
Published: 2014-08-27
Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq31129, CSCuq3...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.