12:50 PM
Connect Directly

New Details Of Home Depot Attack Reminiscent Of Target's Breach

A massive payment card breach this year resulted when hackers gained access to its network using a third-party vendor's login, the retailer says, and 53 million email accounts were exposed.

Home Depot's statement Thursday that the criminals who stole payment card from its networks this year gained access using a third-party vendor's stolen credentials suggests the breach was very similar to the one at Target last year.

The stolen credentials alone did not provide access to the company's point of sale systems, Home Depot said in a press release. The retailer provided fresh details of its investigation of a breach that exposed data on 56 million credit and debit cards.

The hackers escalated their access privileges to work their way through Home Depot's network and deploy "unique, custom-built malware" on its self-checkout systems in the US and Canada, the home improvement company said.

In addition to the previously disclosed theft of credit and debit card data, Home Depot said the criminals accessed files containing 53 million email addresses belonging to Home Depot customers. Though the files did not contain passwords, payment card information, or any other sensitive personal information, the company is notifying affected customers.

From its description, the Home Depot breach seems eerily similar to the one reported by Target last year. In Target's case, the data theft happened when attackers gained access to its payment network using login credentials stolen from a vendor that provided heating ventilation and air conditioning services to the retailer.

Security vendors have repeatedly held up that breach as an example of the dangers companies face in allowing business partners, suppliers, and other third parties to access their networks. Many have cited the breach as a prime example of why companies need to have controls for ensuring that all third-party access is properly restricted and segmented.

Avivah Litan, an analyst at Gartner, says the fact that Home Depot allowed an almost identical breach to happen highlights the need for retailers to respond sooner to such issues.

"The hackers have a set script on how to hack a large retailer -- and they continue to follow it with some modifications," Litan said in an email interview. "The Home Depot and Target breaches used the same techniques every step of the way. It's too bad that the attacked organizations or potential victim organizations are not agile enough to build appropriate defenses in time."

The fact that the hackers went after both payment card data and email accounts shows that criminals have begun going directly after consumers, as well, she said.

[In the end, it may have been a foreshadowing of sorts: The team assigned to squeeze potentially sensitive information from Home Depot employees in cold calls during this year's Social Engineering Capture the Flag (SECTF) competition at DEF CON 22 won the famed contest. Read Home Depot, Other Retailers Get Social Engineered.]

Tom Bain, senior vice president at security CounterTack, says retailers have often tended to overlook the supply chain of partners, customers, and vendors connecting to their networks. Retailers need to get a better grasp on who is being granted access to their networks and why.

"There are just simply too many gaps along the entire supply chain," he said in an email. "For example, if suppliers are using handheld devices to process orders, the wireless connection is at risk because encryption isn't up to par or being used at all."

Richard Stiennon, chief research analyst at IT-Harvest, says breaches like the one at Home Depot also highlight the need for companies to get a better handle on privileged account management.

"Privileged accounts, of the type used by vendors of technology products to provide maintenance and support, are a rampant problem in the enterprise," Stiennon said in an email exchange.

Every organization should review the presence of those types of accounts and apply controls such as two-factor authentication, source IP or domain restrictions, and even restricted time windows for access to prevent incidents like the one at Home Depot.

"Of course the root cause of the spate of retailer breaches is point of sale terminals that are out of date, improperly configured, and inadequately protected," he said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
11/11/2014 | 7:54:29 PM
Re: Why are they keeping this info????
As I understand it (not that Home Depot has been especially forthcoming about it), the infected machines were POS because the malware acted much like a keylogger. After a card is swiped, the information is maintained long enough to interface with a bank, determine its validity, and make the transaction. The malware must have copied the data during that time (with a middleman approach) and sent it off to an external database, stockpiling credit card data before being harvested months later.

Generally I agree with you, there are all kinds of faults in retail cybersecurity, and Home Depot was particularly bad about it. It's hard to say how they're doing now, but recording someone's credit information is a violation of personal space and security. However, for this attack it seems to be irrelevant; the fault was elsewhere.
User Rank: Apprentice
11/10/2014 | 5:34:42 PM
Why are they keeping this info????
This may be a really dumb question but nobody seems to be asking it. Why does {insert any company here} keep this information on file at all?  Shouldn't the consumer be the one who decides whether they are going to do business with a company in the future?  It is not like I leave my wallet at teh grocery store after I pay cash for my groceries, "just in case I will shop there again", but isn't that what we are doing?  To the best of my knowledge the credit transactions go like this:  


1.  Get total Sale

2.  Customer Swipes card

3. Approval code is retrieved from Credit card issuer

4. Customer puts card back in wallet and leaves.

Where in this process is it prudent to keep information on file?  The approval code is all the merchant needs.  I know this because I used to scratch off my credit card number when I saw it on the paper receipts which I handed back to the merchant.  More than once did I have conversations with merchants' managers and such but I was always vindicated and allowed to leave.  Florida had a law on the books a while back about this but now it is rare to see this haoppen so I know the credit card number is irrelevant after the transaction is completed.


Maybe they  (the merchants) should give us consumers a choice whether or not to keep this very personal information on file, eh?
Some Guy
Some Guy,
User Rank: Strategist
11/10/2014 | 11:56:44 AM
Target's Answer - New Card Readers
So I noticed that Target has replaced all their card readers at their POS registers (at least where I live; don't know if it was system-wide). It's hard to say if that makes it any more secure, or if they are just going for a PR stunt. Conversely, it will be a lot more expensive for Home Depot to replace all their self-service registers. And no substitute for getting up to date on best practices; e.g., whitelisting apps would have prevented the Target breach. No idea if either Target or Home Depot (or UPS) have deployed even that level of protection.
Christian Bryant
Christian Bryant,
User Rank: Ninja
11/10/2014 | 3:08:10 AM
SECTF is the Model
Year after year SECTF is my favorite event for a couple reasons.  First, my life is buried in tech and once in a while it's nice to be reminded that human interaction is a powerful thing, and second, the results of these events are a reminder that the most dangerous threat to cyber security is often a social - not a tech - hack.

It's remarkably easy to walk up with all the right gear and a half-assed ID and get access to computers, and other secure items.  I once stopped for a soda at CVS geared up on my way to work and the manager mistook me for a tech they were expecting.  Were I malicious, I could have taken ownership that day.

Make no mistake: if social skills are not in your arsenal, you're in trouble, as a cyber criminal or white hatter alike.  Even tech professionals can be caught unawares.  Don't let it happen to you - bone up and be prepared; question everyone, doubly-analyze each email and key an ear out for odd phone calls your co-workers might be taking.  

And maybe watch a SECTF or two - incredibly educational.  
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
More Than Half of Users Reuse Passwords
Curtis Franklin Jr., Senior Editor at Dark Reading,  5/24/2018
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-05-25
Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.
PUBLISHED: 2018-05-24
The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354.
PUBLISHED: 2018-05-24
IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361.
PUBLISHED: 2018-05-24
IBM WebSphere Application Server (WAS) 8.5 through on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-Force ID: 84362.
PUBLISHED: 2018-05-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...