Attacks/Breaches

Target Malware Origin Details Emerge

Kaptoxa POS malware cited as culprit behind sophisticated, two-stage operation that moved 11 GB of stolen Target data via FTP to a hijacked server in Russia.

Kaptoxa malware infected Target POS machines, security researchers say.
Kaptoxa malware infected Target POS machines, security researchers say.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
missmuffin
50%
50%
missmuffin,
User Rank: Apprentice
2/12/2014 | 12:27:16 PM
Re: Via FTP to Russia
Preach it, brother!  You are right on (...err...) target!
WillyWonka
100%
0%
WillyWonka,
User Rank: Apprentice
1/20/2014 | 12:50:35 PM
How was Target breached?
"After somehow hacking into Target and infecting POS terminals with Kaptoxa..." - this is a very important piece of the puzzle. Does anyone know details on how the hackers breached the perimeter to get the malware onto the POS systems?

 

Thx
moarsauce123
50%
50%
moarsauce123,
User Rank: Apprentice
1/19/2014 | 8:35:43 AM
Via FTP to Russia
At what point did Target IT think that allowing any data to go outside its own network is ever needed except for very few gateways to payment processors? And at what point did Target IT think that transferring anything via FTP from secured networks is ever a good idea or needed? Was there ever a review of what data came from where and went to where on a regular (means daily) basis?

At the point the ports were opened (if they were closed to begin with) and at latest when the transfer started all alarms should have rung at the top brass IT offices. It is easy to blame the handful of criminals who surely are culprits, but the grossly negligent indifference of Target IT is as bad. Does anyone investigate those fools?

It is sad when the local store security is better than the network security at corporate. Stealing millions of CC numbers is apparently easier than shoplifting a pack of gum.
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice one
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1235
Published: 2015-04-19
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.

CVE-2015-1236
Published: 2015-04-19
The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a cr...

CVE-2015-1237
Published: 2015-04-19
Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages ...

CVE-2015-1238
Published: 2015-04-19
Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

CVE-2015-1240
Published: 2015-04-19
gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.