Attacks/Breaches
1/22/2014
01:43 PM
Connect Directly
RSS
E-Mail

Target Breach: 5 Unanswered Security Questions

Investigators have yet to explain how Target was hacked, whether BlackPOS malware infected its payment servers, and whether the same gang also struck other retailers.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/24/2014 | 10:19:50 AM
Re: Why Bell Sports?
Timing. That's the primary suggestion they might be related, and it may be a stretch. Because yes, it wasn't a POS-data-focused hack.

But don't forget that Target also lost 70 million customers' names, email addresses, and other personal information. That didn't come from POS data streams, which suggests that hackers may have gained access to more than just the payment processing servers.

Then again, different gangs may have taken down each of the retailers mentioned in the story. Investigators have yet to say.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
1/24/2014 | 10:03:02 AM
Why Bell Sports?
What would make you think the Bell Sports hack might be related? I'd think the fact that those were web transactions would put it in a different category than POS transactions.
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:34:37 AM
Re: PIN numbers
If all card holders were as quick as you to setup email alerts and notifications then it would become a losing game right from the beginning for anyone to steal information. Unfortunately, I feel that the vast majority of the 40 million affected are not looking into security best practices. This creates a need for financial firms to increase their standards. 
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:29:53 AM
Re: What OS?
Knowinng specifics is important to all but what does running a Java VM mean?  Lot's of current scare tactics regarding Java security are unfounded if you aren't running applets in browsers with an unsupported or unpatched version of Java.  Hopefully the security folks don't preach a scorched earth policy in the direction of Java or Windows.  If the POS software, whatever it or the OS is, was running with unneccessary elevated privileges, Target already has three strikes.
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:20:35 AM
Re: PIN numbers
If the card isn't replaced, what makes the stolen data finite?  My card was part of the Target breach and it has not been replaced. I added an e-mail alert for charges of $10 or more (the lowest amount allowed by my bank).  The enhanced protection is if I catch the fraud and report it.  Then I'll get a new card.  Until that happen's, it's quite possible that criminals could blend small charges as long as they are not from overseas.  Those charges are more scrutunized by institutions.  (I once bought a cable for a few bucks from a Chinese on-line supplier.  My bank shut down my card thinking fraud.  When my dinner charge was rejected, it took a 20 minute phone call to get it resolved.  Of course it didn't help that the supplier had an unrecognizeable funky name and was located in Taiwan!)
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:20:25 AM
Re: Exploiting Payment Servers vs. POS Controllers
"30 out of 48 antivirus engines are detecting the malware". I wonder what restrictions are stopping 18 antivirus engines from adding detection definition for this particular malware. One reason that I can think of is that maybe virus definitions are not easy to share between antivirus firms -- copyright issue. Or maybe this threat is being viewed as low risk by some, because their customer base is from a different segment.   
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 6:12:57 AM
Re: What OS?
No, not an OS. But yes, before more details emerged, it could have been Windows underneath, or Linux runing the POS device. The terminals themselves could also have been running a Java VM, with Internet-connected Java apps runnning on these devices, opening up the possibility that they'd somehow been exploited. But that doesn't appear to be the case.
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:06:28 AM
What OS?
Java isn't an OS.  What OS is under Java?  If it's Windows...
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 4:55:59 AM
Re: Exploiting Payment Servers vs. POS Controllers

BlackPOS is Windows malware. But some POS terminals run Windows. Others, Java. So there was a question -- which hasn't yet been officially answered -- about whether attackers managed to infect POS terminals themselves, for example if they were Internet-connected and set to use a default password. Then a secondary hack of a system inside Target might have served as the command-and-control server (mothership), and routed stolen data via FTP to Russia. 

That's crucial information for other retailers looking to avoid a copycat hack against their systems. 

But based on what's known now, it looks like the payment system was hacked. From a time/effort standpoint, this makes a lot of sense. Launch a phishing attack (again, just a guess) that manages to sneak malware onto the Windows system that manages payment processing -- i.e. sends/receives data from all of those POS terminals in stores  -- and you have an elegant (from an attacker's perspective) way to siphon large amounts of card data. Add the twist of only sending this information out of the firewall to an attacker-controlled server during working hours, and you make related data exfiltration tougher to spot. 

Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 4:46:04 AM
Re: PIN numbers
PIN codes are encrypted, and there's a debate in the secrity community now about whether they can be cracked. (Or if it will be worth the effort.)

In terms of stealth moves -- hello "Office Space" -- in fact card data has a finite life, thanks to "card brands" either invalidating those numbers and issuing new cards (as some have done) or else using "enhanced fraud protection measures" (i.e. not paying for the cost of reissuing a card, and hoping to spot any fraudulent transactions -- more fun for cardholders). So there's an impetus for carders to move the goods quickly.

On that front, Brian Krebs said via Twitter yesterday: "Another set of 2 million cards stolen from Target ("Eagle Claw") goes on sale at Rescator sites (all part of batch stolen 11/27 - 12/15)."

Page 1 / 2   >   >>
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2021
Published: 2014-10-24
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.4.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CVE-2014-3604
Published: 2014-10-24
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2014-6230
Published: 2014-10-24
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.

CVE-2014-6251
Published: 2014-10-24
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then triggering the overflow with a mining.notify request.

CVE-2014-7180
Published: 2014-10-24
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.