Attacks/Breaches
11/7/2014
12:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Details Of Home Depot Attack Reminiscent Of Target's Breach

A massive payment card breach this year resulted when hackers gained access to its network using a third-party vendor's login, the retailer says, and 53 million email accounts were exposed.

Home Depot's statement Thursday that the criminals who stole payment card from its networks this year gained access using a third-party vendor's stolen credentials suggests the breach was very similar to the one at Target last year.

The stolen credentials alone did not provide access to the company's point of sale systems, Home Depot said in a press release. The retailer provided fresh details of its investigation of a breach that exposed data on 56 million credit and debit cards.

The hackers escalated their access privileges to work their way through Home Depot's network and deploy "unique, custom-built malware" on its self-checkout systems in the US and Canada, the home improvement company said.

In addition to the previously disclosed theft of credit and debit card data, Home Depot said the criminals accessed files containing 53 million email addresses belonging to Home Depot customers. Though the files did not contain passwords, payment card information, or any other sensitive personal information, the company is notifying affected customers.

From its description, the Home Depot breach seems eerily similar to the one reported by Target last year. In Target's case, the data theft happened when attackers gained access to its payment network using login credentials stolen from a vendor that provided heating ventilation and air conditioning services to the retailer.

Security vendors have repeatedly held up that breach as an example of the dangers companies face in allowing business partners, suppliers, and other third parties to access their networks. Many have cited the breach as a prime example of why companies need to have controls for ensuring that all third-party access is properly restricted and segmented.

Avivah Litan, an analyst at Gartner, says the fact that Home Depot allowed an almost identical breach to happen highlights the need for retailers to respond sooner to such issues.

"The hackers have a set script on how to hack a large retailer -- and they continue to follow it with some modifications," Litan said in an email interview. "The Home Depot and Target breaches used the same techniques every step of the way. It's too bad that the attacked organizations or potential victim organizations are not agile enough to build appropriate defenses in time."

The fact that the hackers went after both payment card data and email accounts shows that criminals have begun going directly after consumers, as well, she said.

[In the end, it may have been a foreshadowing of sorts: The team assigned to squeeze potentially sensitive information from Home Depot employees in cold calls during this year's Social Engineering Capture the Flag (SECTF) competition at DEF CON 22 won the famed contest. Read Home Depot, Other Retailers Get Social Engineered.]

Tom Bain, senior vice president at security CounterTack, says retailers have often tended to overlook the supply chain of partners, customers, and vendors connecting to their networks. Retailers need to get a better grasp on who is being granted access to their networks and why.

"There are just simply too many gaps along the entire supply chain," he said in an email. "For example, if suppliers are using handheld devices to process orders, the wireless connection is at risk because encryption isn't up to par or being used at all."

Richard Stiennon, chief research analyst at IT-Harvest, says breaches like the one at Home Depot also highlight the need for companies to get a better handle on privileged account management.

"Privileged accounts, of the type used by vendors of technology products to provide maintenance and support, are a rampant problem in the enterprise," Stiennon said in an email exchange.

Every organization should review the presence of those types of accounts and apply controls such as two-factor authentication, source IP or domain restrictions, and even restricted time windows for access to prevent incidents like the one at Home Depot.

"Of course the root cause of the spate of retailer breaches is point of sale terminals that are out of date, improperly configured, and inadequately protected," he said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
mighty_archemedes
50%
50%
mighty_archemedes,
User Rank: Apprentice
11/11/2014 | 7:54:29 PM
Re: Why are they keeping this info????
As I understand it (not that Home Depot has been especially forthcoming about it), the infected machines were POS because the malware acted much like a keylogger. After a card is swiped, the information is maintained long enough to interface with a bank, determine its validity, and make the transaction. The malware must have copied the data during that time (with a middleman approach) and sent it off to an external database, stockpiling credit card data before being harvested months later.


Generally I agree with you, there are all kinds of faults in retail cybersecurity, and Home Depot was particularly bad about it. It's hard to say how they're doing now, but recording someone's credit information is a violation of personal space and security. However, for this attack it seems to be irrelevant; the fault was elsewhere.
MichaelZ455
50%
50%
MichaelZ455,
User Rank: Apprentice
11/10/2014 | 5:34:42 PM
Why are they keeping this info????
This may be a really dumb question but nobody seems to be asking it. Why does {insert any company here} keep this information on file at all?  Shouldn't the consumer be the one who decides whether they are going to do business with a company in the future?  It is not like I leave my wallet at teh grocery store after I pay cash for my groceries, "just in case I will shop there again", but isn't that what we are doing?  To the best of my knowledge the credit transactions go like this:  

 

1.  Get total Sale

2.  Customer Swipes card

3. Approval code is retrieved from Credit card issuer

4. Customer puts card back in wallet and leaves.


Where in this process is it prudent to keep information on file?  The approval code is all the merchant needs.  I know this because I used to scratch off my credit card number when I saw it on the paper receipts which I handed back to the merchant.  More than once did I have conversations with merchants' managers and such but I was always vindicated and allowed to leave.  Florida had a law on the books a while back about this but now it is rare to see this haoppen so I know the credit card number is irrelevant after the transaction is completed.

 

Maybe they  (the merchants) should give us consumers a choice whether or not to keep this very personal information on file, eh?
Some Guy
50%
50%
Some Guy,
User Rank: Strategist
11/10/2014 | 11:56:44 AM
Target's Answer - New Card Readers
So I noticed that Target has replaced all their card readers at their POS registers (at least where I live; don't know if it was system-wide). It's hard to say if that makes it any more secure, or if they are just going for a PR stunt. Conversely, it will be a lot more expensive for Home Depot to replace all their self-service registers. And no substitute for getting up to date on best practices; e.g., whitelisting apps would have prevented the Target breach. No idea if either Target or Home Depot (or UPS) have deployed even that level of protection.
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
11/10/2014 | 3:08:10 AM
SECTF is the Model
Year after year SECTF is my favorite event for a couple reasons.  First, my life is buried in tech and once in a while it's nice to be reminded that human interaction is a powerful thing, and second, the results of these events are a reminder that the most dangerous threat to cyber security is often a social - not a tech - hack.

It's remarkably easy to walk up with all the right gear and a half-assed ID and get access to computers, and other secure items.  I once stopped for a soda at CVS geared up on my way to work and the manager mistook me for a tech they were expecting.  Were I malicious, I could have taken ownership that day.

Make no mistake: if social skills are not in your arsenal, you're in trouble, as a cyber criminal or white hatter alike.  Even tech professionals can be caught unawares.  Don't let it happen to you - bone up and be prepared; question everyone, doubly-analyze each email and key an ear out for odd phone calls your co-workers might be taking.  

And maybe watch a SECTF or two - incredibly educational.  
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.