Attacks/Breaches
12/21/2013
09:00 AM
Connect Directly
RSS
E-Mail
0%
100%

Target Breach: 10 Facts

Experts advise consumers not to panic as suspicion falls on point-of-sale terminals used to scan credit cards.

Just in time for the holidays, Target confirmed Thursday that its systems were breached.

Thanks to the breach, one or more attackers successfully stole 40 million credit card numbers. Anyone who used a credit or debit card in any of Target's US stores between November 27 and December 15 may be a victim. Target.com users and customers at Target stores in Canada are not affected.

The Target attackers gained access not only to card numbers, but also card expiration dates, CVV codes, and cardholders' names. As a result, they could use the stolen information to make fraudulent purchases via phone or online as well as to create working counterfeit credit cards.

[For more on the Target breach, see Target Confirms Hackers Stole 40 Million Credit Cards.]

How did hackers likely steal the credit card data, and what should consumers who may have been affected by the breach do next?

Here's what we know about the breach, its likely repercussions for affected cardholders, and how they should respond:

1. Target declines to comment on data encryption questions.
How did hackers manage to steal 40 million cards? That's a pertinent question, since any retailer that stores credit card data, according to the Payment Card Industry Data Security Standard (PCI-DSS), is required to encrypt that data. Furthermore, if the data is properly encrypted in transit and at rest, it shouldn't be of any use to attackers.

"This is a breach that should've never happened," Forrester analyst John Kindervag said in an emailed statement. "The fact that three-digit CVV security codes were compromised shows they were being stored. Storing CVV codes has long been banned by the card brands and the PCI [Security Standards Council]."

Reached via email, a Target official declined to respond to questions about whether the retailer had stored the stolen card data in encrypted format, or whether it had been certified as PCI-compliant. "We continue to invest in our security practices to protect our guests' information including the retention of a leading third-party forensics firm to conduct a thorough investigation of this incident," Target spokeswoman Molly Snyder said via email. "We apologize for any inconvenience this has caused our guests."

Target has also declined to address how attackers got their hands on the data in the first place. "As this is an ongoing investigation, we don't have additional details to share on the questions you asked," said Snyder.

2. Malware, point-of-sale apps, and insiders suspected.
The fact that the Target data breach didn't touch its e-commerce operation, but rather its stores, suggests that attackers gained access to information that was gathered via point-of-sale (POS) terminals -- a fancy name for electronic cash registers.

Hord Tipton, executive director of (ISC)2, said in an emailed statement that attackers likely infected massive numbers of POS terminals with malware. "It's one thing to compromise or affect one machine, but to get all of them begs the question of how this was plotted out in the first place," Tipton said. "How were the hackers so efficient? From what I can tell, it looks like an insider threat -- someone on the inside probably helped."

Alternately, attackers may have been able to remotely tap into the POS terminals by exploiting vulnerabilities in their built-in Web servers, Bala Venkat, the chief marketing officer for Web application security vendor Cenzic, said in an emailed statement. "When searching for vulnerable targets, attackers are discovering that many retail merchants and point-of-sale terminals haven't implemented some of the basic security measures required by [PCI]," he said, which would include two-factor authentication on the terminals for anyone attempting to remotely connect to it.

The breach was likely compounded by Target failing to monitor its POS terminals for signs of attack. "This seems rather obvious from the information revealed already about this Target breach," Venkat said.

But Gartner analyst Avivah Litan said in a blog post that the breach was likely not due to malware or hacking, but a very low-tech -- and insider -- attack. "If we've learned anything from the Snowden/NSA and WikiLeaks/Bradley Manning affairs, it's that insiders can cause the most damage because some basic controls are not in place," she said. "I wouldn't be surprised if that's the case with the Target Breach -- i.e., that Target did a great job protecting their systems from external intruders but dropped the ball when it came to securing insider access."

3. Full investigation may take months.
Although a statement released by Target said that it "has identified and resolved the issue" exploited by the attackers, it may be many months before Target has a complete picture of how the breach occurred. "It will be interesting to see how the attackers got into the network and what technical countermeasures were in place, but that will take months to surface as the forensics in such a case are extremely time consuming," Qualys CTO Wolfgang Kandek said via email.

4. Stolen cards are already flooding black market.
Security experts said the timing of the breach corresponds with a recent surge of stolen credentials being offered for sale on underground cybercrime forums. "We started to detect that something was afoot on December 11th when [we] detected a massive increase – 10 - 20x -- in availability of high-value stolen cards on black-market sites," read a blog post from security vendor Easy Solutions. "Nearly every bank and [credit union] in the US seems to be affected."

Target has yet to say how it learned of the breach. But having a massive quantity of stolen credit cards flooding the market would have been a red flag for card issuers. One quick tipoff about the source of the breach would likely have been the large number of Target Redcard credit and debit card numbers.

5. PCI compliance failed to stop the breach.
Critics of the PCI standard -- created by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa -- have long suggested that businesses that technically comply with PCI may not have robust information security practices in place. Furthermore, critics have charged that enforcement of the industry-advanced standard lacks teeth, as evidenced by the PCI Council sometimes retroactively revoking certifications.

In 1997, for example, TJ Maxx parent company TJX was breached, resulting in the theft of 90 million credit card numbers. In the wake of the breach, investigators revealed that TJX wasn't in compliance with nine of the 12 PCI data security standards. The breach reportedly served as a wakeup call for retailers to get compliant with PCI.

"PCI is designed to push nearly all risks and costs onto merchants and their banks through a series of contracts," said Rich Mogull, CEO of Securosis, in a blog post earlier this year.

But has PCI resulted in major retailers taking information security seriously? Witness the spectacle earlier this year of Visa suing PCI-compliant sports clothing retailer Genesco for $13 million, after the retailer suffered a data breach. The council also retroactively revoked the retailer's PCI compliance. That maneuver, Mogull alleged, allowed the PCI Security Standards Council to continue saying that "no PCI compliant organization has ever been breached."

"This is a clear fallacy -- merchants pass their assessments, they get breached, and then PCI retroactively revokes their certifications," Mogull said. "Fines are then levied against the acquiring bank and passed on to the merchant."

Going forward, Target will reportedly have to hire one of the 10 firms in the United States that are certified to perform PCI investigations. That firm also can't be the same as the company that certified Target's PCI compliance.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
PaulS681
0%
100%
PaulS681,
User Rank: Apprentice
12/21/2013 | 5:18:56 PM
When?
 

I think one of the big questions here is when target found out about this. These breaches should be made public asap in my opinion. You can go back and find out about who is responsible after but letting your customers know asap is critical.
CC_Insider
100%
0%
CC_Insider,
User Rank: Apprentice
12/21/2013 | 6:47:15 PM
Re: When?
Another article out there says Target discovered this only on the 15th.  Considering that this would be a truly "oh shit" moment, the disclosure was timely.  There's no undue delay here.  The first concern for when something happens like this is shutting off and stopping the bleeding, to keep it from continuing.  So for a couple of days to go by is not a problem.
PaulS681
0%
100%
PaulS681,
User Rank: Apprentice
12/21/2013 | 10:04:21 PM
Re: When?
I disagree... You find out about it and stop the attack and notify the public. A few days doesnt sound like much but I dont see a reason why they can't notify when they find out.
Brian.Dean
100%
0%
Brian.Dean,
User Rank: Apprentice
12/22/2013 | 5:41:35 AM
Re: When?
I hear you and understand that the need to quickly disclose any kind of data breach is a matter of extreme importance for the protection of customers likewise, it is also important to confirm and be 100% sure that a data breach has taken place before releasing an alert, because false positives would not only cause unnecessary panic for the customer but it will also undermine the legitimacy of future alerts.
PaulS681
0%
100%
PaulS681,
User Rank: Apprentice
12/22/2013 | 12:04:05 PM
Re: When?
I aree you have to be 100% positive but if they were on the 15th then why didn't we hear about it? I think if target came out and said why they waited it might help a little. Although this is the least of Targets problems as class action lawsuits are popping up all over the place due to the fact they were breached.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Apprentice
12/27/2013 | 6:33:50 PM
Re: When?
Theoretically, depending upon the particular situation, disclosing a data breach before knowing how the breach occurred and if it has been fully fixed yet potentially invites more attacks.  It can be a balancing act between doing the right thing by your affected customers and preventing further harm to additional customers.
MelvinGaines
100%
0%
MelvinGaines,
User Rank: Apprentice
12/23/2013 | 12:37:56 PM
Re: When?
I think we may need to consider that this was an exceptional breach that likely occurred internally. I think it is entirely plausible that the information was not leaked immediately so as to not tip off whoever was causing the internal breach to take place. I don't ever recall the Secret Service being involved with previous credit card breaches (to my knowledge).  In my mind, whether the public knew about it within 4 days or 7 days doesn't really matter that much if you look at the overall number of 40 million. Only a small fraction of that number will be affected.
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Apprentice
12/22/2013 | 6:28:54 AM
Transitions are Important
Banking has come a long way since pre internet times but as people continue to use electronic forms to make payments the need to increase the security standard increases while at the same time complexity needs to be kept to a minimum.

Almost all developing countries have a banking sector but not all of its population are banked, the reason for this are many, and one reason is that the population view banks as being too complex, another is a view that banks are not as secure as they should be. 40 million is a large number, before never forms of payment become discredited, I think it is vital to add security and limit complexity before it starts to affect the number of transitions carried out. 
Banker666
100%
0%
Banker666,
User Rank: Apprentice
12/22/2013 | 9:37:02 PM
Millions of dollars
I work at a bank that does card processing and I for one can say PCI is a joke in my opinion.   After being audited they made us move all of the card processing off onto it's own seperate mainframe systems.  They were totally clueless about how a mainframe works and how it processes.  As a result our company spent millions of dollars to meet their compliance.   In my opinion the vast majority of breeches occur on the retail side.   For example I walk into a store and use my card and the clerk doesn't ask for any ID from me.   How about making these retailers make their employees go thru a fingerprint and background check like we had to where I work at.  I wonder if Target was using offshore IT services.  Duh let me guess.   The discussion where I work has been how many cards are we going to have to re-issue because of this and not to mention all of the account forwarding processing we'll likely have to do.  The bigger issue is that who ever pulled this off won't be jailed, much less captured and brought to justice and they likely know it too.    If I pulled off something like this in the U.S. I'd be put into prison.   I know one thing for sure we'll be re-evaluating offshore access and their use.  Maybe even put them all out the door.   Gawd I could not imagine our reputation ruined because of a major breech like this.          
Chris1001
50%
50%
Chris1001,
User Rank: Apprentice
12/23/2013 | 1:47:47 AM
Kudos? Target was outed by a journalist
The breach was reported to the public by Journalist Brian Krebs.  Target was outed.  They did not "come clean" of their own accord.
samicksha
0%
100%
samicksha,
User Rank: Apprentice
12/23/2013 | 2:41:36 AM
Re: Kudos? Target was outed by a journalist
I am not shocked and neither surprised but yes, was it so easy for hackers to attack, i mean 40 million accounts is not a small number. We have been discussing and claiming about more rigid and bulletproof security but still hacker manages to find good loop holes. I am not sure but i read CVV number was also stolen which ideally should be available only with user physically on the card.
SaneIT
50%
50%
SaneIT,
User Rank: Apprentice
12/23/2013 | 7:50:30 AM
Re: Kudos? Target was outed by a journalist
This is one of the things that bothers me most.  Target didn't come out and notify customers to protect them, they kept quiet as long as they could and it sounds like the "fix" for this is a knee-jerk reaction by the banks who issued the cards.  If the tren of punishing customers after a data breech continues we're going to see a lot more people protecting themselves by avoiding companies who have had data losses in the past.
cjoshdoll
100%
0%
cjoshdoll,
User Rank: Apprentice
12/23/2013 | 3:40:05 PM
Lets Try Some Facts.....
First:

"..."The fact that three-digit CVV security codes were compromised shows they were being stored..."

I'm not sure why data storage is even mentioned in the story, much less the encryption piece.  The fact that the breech is limited to a 3-4 week window of time would clearly indicate that the card data was stolen at the time of purchase, NOT stolen from a database. Thus, lodging the claim that Target was doing a "no-no" by storing ccv data, is just slander, IMO.  If this data was stolen from a database, where Target was saving CC data that they should not be saving, then A) there wouldn't be such a short window of time (you don't compromise a window of records in a database, it's all or nothing) and B) its highly likely that target.com's CC data would have been compromised too.

 

Secondly, the throwing the encryption for data in transit subject in with the encryption for data at rest issue is poor timing.  PCI requirements for encryption are different for data at rest and data in motion, and CC data is NOT required to be encrypted, according to the PCI DSS, unless it is traveling over a public network (the internet) or over wireless networks.  In fact, most banks / acquirers can't even support end-to-end encryption for CC transactions.  There are a very limited number of acquirers that can support E2E encryption, and most of those are new niche businesses that are providing a new model for transaction encryption.

 

While it's easy for these "experts" to sit back and say how everything should be encrypted and secured tight as can be, its careless to make accusations that Target wasn't doing everything that they could to prevent this.  We are talking about a system for credit processing that pre-dates the internet, and the everything is connected world.  Businesses are trying to play catchup to secure these systems while leveraging new technology to make their supply chain more efficient and reduce costs with tech.

 

I have NO ties to Target, and I am not here to defend them.  I am however the lead Security Architect for a mid-size, national retailer, in charge of PCI compliance and CC transaction security, so I have personal experience living up to the PCI DSS, and trying to balance business requirements with customer protection.  I have no issue burning them at the stake if they are to blame, but let's get the FACTS before we indict Target.  There are PLENTY of scenarios where Target could have been doing EVERYTHING right, and still have this happen.

 

My $0.02
rradina
50%
50%
rradina,
User Rank: Apprentice
12/23/2013 | 6:48:16 PM
Re: Lets Try Some Facts.....
Why does the time period imply theft at time of purchase?  If I was designing a POS/cash management system that required time to clear transactions, balance accounts and reverse returns, I'd keep recent transactions for some time period and then purge them. There is also the data warehouse side of things. Sometimes mapping and cleansing routines are updated resulting in numbers that don't balance. Often data gets reloaded to correct such issues.  It's plausible that this could have been an inside job where someone copied a temporal 30-day tlog database to a thumb drive and walked out the door.

Of course all of these activities rarely require the full account info.  Generally PCI requires truncation to store transactions but Target may have demonstrated a mitigating factor by encrypting all transactions.  Thats why its probably an inside job... someone with access to the necessary decryption information.

Another article I read said the cvv codes were not stolen which meant the stolen accounts are not useful for most on-line purchases.

IMO ... regrdless of this article's title, we don't really know what happened yet.
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
12/23/2013 | 8:10:25 PM
Re: Lets Try Some Facts.....
 

I think that cjoshdoll makes alot of sense. The fact that they are alerting anyone who used a CC at target between 11/27 and 12/15 indicates to me that the numbers were not stored but stolen at the time of the transaction. The time period makes perfect sense to back that reasoning up. If this was database data that was stolen don't you think it would impact many more people?
rradina
50%
50%
rradina,
User Rank: Apprentice
12/23/2013 | 11:38:20 PM
Re: Lets Try Some Facts.....
Don't you think 40 million is a lot of unique shoppers for such a short period?  There are ~320m people in the US.  ~74m are minors leaving ~250m adults.

That means 15% of the adult population used a card at Target within a few week period.  Some folks used multiple cards but not everyone has cards. Many economically challenged don't even have bank accounts.  Some folks still write checks or pay with cash. Target isn't everywhere and some folks don't shop there.

If it was a network tap, they would have a hard time pinning down exact dates. It seems more plausible someone copied files which made it easy to know exact dates and accounts.  As I said, it makes sense to keep recent transactions for dispute/clearing/reload purposes.  The entire DB doesnt have to be compromised. In fact the temporary log may have been an easier target (no pun intended) than the master database.  It also shoukd have been truncated data in the master DB. There is also no guarantee the on-line and in-store POS go to the same balancing cash flow system.

I have 12 years of IT experience in retailing alone and have been through PCI audits since they started.

 

 
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
12/24/2013 | 9:42:29 AM
Re: Lets Try Some Facts.....
 Let's not forget that this is the busiest time of year for shopping so 40 million seems reasonable to me.

it was estimated that close to 100 million people would shop during the black Friday weekend alone. Everyone entitles to their opinion. I have read numerous articles about the data being stolen from the POS devices as customers swiped their cards. We don't know exactly how they did it and in all likelihood we won't know.
cjoshdoll
50%
50%
cjoshdoll,
User Rank: Apprentice
12/24/2013 | 9:28:06 AM
Re: Lets Try Some Facts.....
Agree, we don't know what happened.  I guess I am flustered with the "industry experts" throwing around as much blatant BS as they are - it's just adding to what I can the "hysteria news" angle.


I agree that there could be a tlog db, however it seems unlikely that you would store the entire track 2 data, including ccv1, for that purpose, even for target who is a data mining giant, that has admittedly tied credit transactions back to a user profile (See: How Target knew a teen girl was pregnant.)
 
Without debating the likelihood of a tlog DB with full card data, just the fact that the entire track 2 data was stolen, /seems/ to point to theft at swipe.  But again, you are correct, we just don't know, and I personally am afraid, we may never find out (publically.)


As someone who's job is to prevent this stuff, I have a number of concerns.  There should be a requirement to release the report generated by the forensic investigators, so that other businesses can protect against similar attacks.  I believe it should also be public to find out a company's PCI compliance status and who provided their ROC.  I have a sneaking suspicion that they got theirs from the firm that essentially charges 3 times as much, and is 3x more lenient in their audit (but let me be clear, that is MY ASSUMPTION, and even if true does NOT mean Target did something wrong to cause this.) 

 

Which leads to my real point - everyone is pointing the finger at Target, before we know anything.  There are just too many possibilities to be able to say Target is at fault here.  I'm not here to defend them, I have no stake in it, I'm just tired of reading all of the baseless accusations and reading the "experts" mostly incorrect opinions.  Unfortunately I can't just tune it out and not read the stories, because it impacts my daily job....

 
rradina
50%
50%
rradina,
User Rank: Apprentice
12/24/2013 | 10:26:37 AM
Re: Lets Try Some Facts.....
I completely agree that Target may have done everything PCI demands and that they don't deserve speculation.  Personally, I think it's an inside job.  Someone had the garage door code, knew the occupants were on vacation and walked out with the family jewels.  That doesn't mean Target is off the hook but some trust is required for employees to do their job and as recent events prove, even the NSA is vulnerable to this attack vector.

FYI... Another site's article claimed the cvv code was not compromised.

The last retailer who employed me used a third party in ~1,000 stores to provide payment processing.  It was AES-encrypted and also sent HTTPS from pin pad swipe to the external processor who then connected to the various clearing banks/processors.  Only the truncated number was stored in the TLOG. The pin pads had a kill switch if they were opened and the third party actively tracked serial numbers, warned if an unauthorized device was present and refused to authorize payments from it.  (BTW a popular scam is for a "repair company" to call the local manager and pretend they were from "corporate" so they could schedule an appointment to replace one of the pin pads that was "reporting a problem".)

Unfortunately if communication was down even this system had potential weakness.  It could be configured to check a local bad card list and authorize up to a certain dollar amount with store and forward.  Although the track data it stored was encrypted, it was on the local POS lane which could then become a target.  However 40m card numbers would require compromising all POS lanes, everwhere and zapping redundant MPLS links to the third party to force store and forward mode.  That's an almost impossible target that only yields thousands of small, strongly encrypted files.  It's far easier to find something centralized and "inside the garage".
samicksha
50%
50%
samicksha,
User Rank: Apprentice
12/27/2013 | 2:12:20 AM
Re: Lets Try Some Facts.....
I guess it's more than just Target Breach, i recently read that it was not only Target-issued credit cards who were affected, infact customers who used any credit or debit card could be affected.
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/27/2013 | 4:24:46 AM
Re: Lets Try Some Facts.....
I guess it's time to make Chip-Pin, OTP like security mandatory for users, i guess it may sound irritating but precaution better than cure.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Apprentice
12/27/2013 | 6:27:50 PM
Re: Lets Try Some Facts.....
@virsingh: Chip and Pin/EMV technology has more than its fair share of security problems, too.

Laughably (unless you're someone affected by it), a big part of the problem with EMV for consumers is that when there is a breach, it is difficult for consumers to convince the banks because of the commonly held fallacy that "EMV is secure."
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/30/2013 | 3:05:42 AM
Re: Lets Try Some Facts.....
I agree you Joe, but do you think any term like flawless technology exists. Even Cv2 was developed as a strong measure towards security but this target breach cracked this security.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio