Attacks/Breaches
1/22/2014
01:43 PM

Target Breach: 5 Unanswered Security Questions

Investigators have yet to explain how Target was hacked, whether BlackPOS malware infected its payment servers, and whether the same gang also struck other retailers.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/24/2014 | 10:19:50 AM
Re: Why Bell Sports?
Timing. That's the primary suggestion they might be related, and it may be a stretch. Because yes, it wasn't a POS-data-focused hack.

But don't forget that Target also lost 70 million customers' names, email addresses, and other personal information. That didn't come from POS data streams, which suggests that hackers may have gained access to more than just the payment processing servers.

Then again, different gangs may have taken down each of the retailers mentioned in the story. Investigators have yet to say.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
1/24/2014 | 10:03:02 AM
Why Bell Sports?
What would make you think the Bell Sports hack might be related? I'd think the fact that those were web transactions would put it in a different category than POS transactions.
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:34:37 AM
Re: PIN numbers
If all card holders were as quick as you to setup email alerts and notifications then it would become a losing game right from the beginning for anyone to steal information. Unfortunately, I feel that the vast majority of the 40 million affected are not looking into security best practices. This creates a need for financial firms to increase their standards. 
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:29:53 AM
Re: What OS?
Knowinng specifics is important to all but what does running a Java VM mean?  Lot's of current scare tactics regarding Java security are unfounded if you aren't running applets in browsers with an unsupported or unpatched version of Java.  Hopefully the security folks don't preach a scorched earth policy in the direction of Java or Windows.  If the POS software, whatever it or the OS is, was running with unneccessary elevated privileges, Target already has three strikes.
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:20:35 AM
Re: PIN numbers
If the card isn't replaced, what makes the stolen data finite?  My card was part of the Target breach and it has not been replaced. I added an e-mail alert for charges of $10 or more (the lowest amount allowed by my bank).  The enhanced protection is if I catch the fraud and report it.  Then I'll get a new card.  Until that happen's, it's quite possible that criminals could blend small charges as long as they are not from overseas.  Those charges are more scrutunized by institutions.  (I once bought a cable for a few bucks from a Chinese on-line supplier.  My bank shut down my card thinking fraud.  When my dinner charge was rejected, it took a 20 minute phone call to get it resolved.  Of course it didn't help that the supplier had an unrecognizeable funky name and was located in Taiwan!)
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:20:25 AM
Re: Exploiting Payment Servers vs. POS Controllers
"30 out of 48 antivirus engines are detecting the malware". I wonder what restrictions are stopping 18 antivirus engines from adding detection definition for this particular malware. One reason that I can think of is that maybe virus definitions are not easy to share between antivirus firms -- copyright issue. Or maybe this threat is being viewed as low risk by some, because their customer base is from a different segment.   
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 6:12:57 AM
Re: What OS?
No, not an OS. But yes, before more details emerged, it could have been Windows underneath, or Linux runing the POS device. The terminals themselves could also have been running a Java VM, with Internet-connected Java apps runnning on these devices, opening up the possibility that they'd somehow been exploited. But that doesn't appear to be the case.
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:06:28 AM
What OS?
Java isn't an OS.  What OS is under Java?  If it's Windows...
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 4:55:59 AM
Re: Exploiting Payment Servers vs. POS Controllers

BlackPOS is Windows malware. But some POS terminals run Windows. Others, Java. So there was a question -- which hasn't yet been officially answered -- about whether attackers managed to infect POS terminals themselves, for example if they were Internet-connected and set to use a default password. Then a secondary hack of a system inside Target might have served as the command-and-control server (mothership), and routed stolen data via FTP to Russia. 

That's crucial information for other retailers looking to avoid a copycat hack against their systems. 

But based on what's known now, it looks like the payment system was hacked. From a time/effort standpoint, this makes a lot of sense. Launch a phishing attack (again, just a guess) that manages to sneak malware onto the Windows system that manages payment processing -- i.e. sends/receives data from all of those POS terminals in stores  -- and you have an elegant (from an attacker's perspective) way to siphon large amounts of card data. Add the twist of only sending this information out of the firewall to an attacker-controlled server during working hours, and you make related data exfiltration tougher to spot. 

Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 4:46:04 AM
Re: PIN numbers
PIN codes are encrypted, and there's a debate in the secrity community now about whether they can be cracked. (Or if it will be worth the effort.)

In terms of stealth moves -- hello "Office Space" -- in fact card data has a finite life, thanks to "card brands" either invalidating those numbers and issuing new cards (as some have done) or else using "enhanced fraud protection measures" (i.e. not paying for the cost of reissuing a card, and hoping to spot any fraudulent transactions -- more fun for cardholders). So there's an impetus for carders to move the goods quickly.

On that front, Brian Krebs said via Twitter yesterday: "Another set of 2 million cards stolen from Target ("Eagle Claw") goes on sale at Rescator sites (all part of batch stolen 11/27 - 12/15)."

Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?