Attacks/Breaches

Target Breach: HVAC Contractor Systems Investigated

Hackers may have used access credentials stolen from refrigeration and HVAC system contractor Fazio Mechanical Services to gain remote access to Target's network.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
johnson54
100%
0%
johnson54,
User Rank: Apprentice
10/29/2014 | 1:28:39 PM
Installation Contractor
A potential contractor must have the necessary credentials and experience to do the job perfectly. A good way to choose a contractor is to interview them. This will assure you of good customer service. So, think twice before you choose a siding installation contractor.
awinter015
50%
50%
awinter015,
User Rank: Apprentice
3/11/2014 | 10:26:01 AM
Anyone ever hear about VLANs?
The idea that a contractor was on a shared network with other systems is mind-boggling.  The technology to segement networks and limit access of users has been around for years.  Even in small environments we segment customers from one another, accounting systems from general systems, etc.  So if we can do it as a small IT Service provider - why cant the big guys do it?

 

 
mak63
50%
50%
mak63,
User Rank: Apprentice
2/9/2014 | 10:10:52 PM
Re: answers
I couldn't agree with Mr Gezelter and you more.

As someone on the informationweek staff recently told me: "live and learn" Too bad the customers will suffer the most for something that could've been avoided.
Michael Endler
100%
0%
Michael Endler,
User Rank: Apprentice
2/8/2014 | 5:01:22 PM
Re: answers
"As isolated as a driver in Los Angeles in the rush hour. Again, because we know about the breach, the answer is that the HVAC appliances were not iisolated as they should have been."


This seems like the big failing. Bob Gezelter alluded to it in his post too:

"There is simply no reason why the network access granted to an HVAC contractor for monitoring HVAC equipment should have included access to the production transactional data network. Being somewhat speculative, the POS terminals and supporting systems should have been in a separate network compartment, with an encrypted tunnel connecting the store-located systems to the transactional back end systems serving the corporation."


I can't see why the HVAC techs were connected to a network that included Target's customer data.
mak63
50%
50%
mak63,
User Rank: Apprentice
2/8/2014 | 12:28:31 AM
answers
Did Target secure Fazio's access to its network using two-factor authentication?

Probably I'm wrong for saying this, but if the credentials were stolen, what difference would have made how many level of authentication you had in place?

What level of network access did Target grant to Fazio?

There was a breach, so the answer is clear to me. Pretty much all what the hackers needed.

Were Target's HVAC appliances located on an isolated network segment that should have prevented attackers from accessing other network-connected systems?

As isolated as a driver in Los Angeles in the rush hour. Again, because we know about the breach, the answer is that the HVAC appliances were not iisolated as they should have been.

 
mak63
100%
0%
mak63,
User Rank: Apprentice
2/8/2014 | 12:09:09 AM
Re: The Internet of...
@Somedude8

If the antivirus fails to detect a malware in the microwave, we're doom, dooom and we'll also get sick for eating uncooked food. Luckyly the TV will know this and will recommend Alka-Seltzer or something like that.
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
2/7/2014 | 10:13:52 AM
Re: The Internet of...
How many hops from an HVAC system to a cash register? The Internet of Things is going to be a hoot.
Bob Gezelter
100%
0%
Bob Gezelter,
User Rank: Apprentice
2/7/2014 | 8:39:51 AM
Compartmented Networks are important; Access should require "Need to Know"
Sadly, the reported pathology is a represents a long-solved problem. Since the mid-1990's, it has been well-understood that protecting devices connected to a network requires more than a single level of protection. The access limitations to different groups of systems cannot be implemented by a single set of firewall rules. This was noted in my Security on the Internet chapter in the 1995 Computer Security Handbook, 3rd Edition (Hutt, Bosworth, and Hoyt; Wiley). My 2008 presentation on Compartmented Networks from the 11th New York State Cybersecurity Conference described how to implement and use such networks.

There is simply no reason why the network access granted to an HVAC contractor for monitoring HVAC equipment should have included access to the production transactional data network. Being somewhat speculative, the POS terminals and supporting systems should have been in a separate network compartment, with an encrypted tunnel connecting the store-located systems to the transactional back end systems serving the corporation.


Such a network topology greatly limits the ways in which a critical system can be compromised.


- Bob Gezelter, http://www.rlgsc.com; Contributing Editor, Computer Security Handbook (3rd, 4th, 4th, and 6th Editions)
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
2/6/2014 | 5:48:36 PM
Breach of outside consultant opened up Pacific NW National Labs
It was an outside, off-premises researcher whose computer workstation was compromised that gave hackers access to the Pacific Northwest National Labs in its July 2011 security breach. It's very hard for a good IT organization to know what all of its contractors are doing.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/6/2014 | 3:58:48 PM
Re: The Internet of...
This really demonstrates that the convergence of physical security with IT security has defintely arrived... Be warned!
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.