9 Notorious Hackers Of 2013

(Click image for larger view and slideshow.)

Digital forensic investigators and information security researchers have positively identified the malware used in the recent attack against Target. The malicious code infected point-of-sale (POS) terminals at the retailer and then helped transfer the stolen data to an FTP server in Russia.

The attack against Target, which began in late November and continued until mid-December, resulted in the theft of 40 million credit and debit cards as well as personal information for as many as 70 million customers.

A joint federal-private report providing more details about the apparent hacking and malware campaign against Target has been distributed to firms in the retail and financial-services sectors. The report was jointly issued by the Department of Homeland Security (DHS), the Secret Service, the Financial Services Information Sharing and Analysis Center (FS-ISAC), and Dallas-based private cybersecurity firm iSight Partners.

The malware used in the attack, dubbed Kaptoxa ("Kar-toe-sha"), "has potentially infected a large number of retail information systems," according to a blog post from iSight Partners. "If you have a POS system in operation, you may be at risk."

[Shoplifters vs. hackers: which is the greater security risk to retailers? See Top 10 Retail CIO Priorities For 2014.]

A company spokeswoman declined to share a copy of the report that the firm helped prepare, saying it was available via DHS, although only on a need-to-know basis. Reached via email, the duty officer for the National Cybersecurity and Communications Integration Center, which is distributing the report, confirmed that it hasn't been publicly released, while noting that the effort was part of DHS's mission "to share actionable information gleaned from ongoing network defense efforts, cybercrime investigations, and national security efforts" with the private sector.

But according to some press accounts, the report says that "the [Target] intrusion operators displayed innovation and a high degree of skill," in part by taking relatively unsophisticated malware and using it to compromise so much data in such a short period of time. "What's really unique about this one is it's the first time we've seen the attack method at this scale," Tiffany Jones, a senior VP at iSight, told The Wall Street Journal. "It conceals all the data transfers. It makes it really hard to detect in the first place."

Suggestions that the Target data breach stemmed from a POS malware attack first surfaced on Jan. 2, 2014, when the US Computer Emergency Readiness Team (US-CERT) released an alert about memory-scraping malware infecting retailers. As examples of what to beware, it named the Dexter POS device memory-scraping malware, as well as a Dexter variant called Stardust that can eavesdrop on POS production system networks.

But the Dexter malware reportedly wasn't used in this attack against Target. Rather, the Kaptoxa malware is a variant of the BlackPOS malware, security blogger Brian Krebs first reported Wednesday. BlackPOS is purpose-built to retrieve data coded in the magnetic stripe of a swiped card while it still resides in the POS device memory, since data typically gets encrypted once it's saved.

Kaptoxa malware infected Target POS machines, security researchers say.

The malware reportedly includes some Russian-language tags, and was also used in a smaller series of apparent trial attacks last year, after which stolen data appeared on Eastern European cybercrime forums. Those facts have led some investigators to surmise that whoever attacked Target might be operating from either Russia or a former Soviet satellite.

After somehow hacking into Target and infecting POS terminals with Kaptoxa, Target's attackers then employed a two-stage attack. "First, the malware that infected Target's checkout counters (POS) extracted credit numbers and sensitive personal details," Aviv Raff, CTO of Israel-based cyber security technology company Seculert, said in a blog post. "Then, after staying undetected for six days, the malware started transmitting the stolen data to an external FTP server, using another infected machine within the Target network."

The malware transmitted batched information up to three times per day -- but only after checking the compromised system to see if the time was between 10:00 a.m. and 5:00 p.m. If so, the malware would create a temporary NetBIOS share and connect to another internal, compromised system, from which the FTP transfer then occurred, Wired reported.

On Dec. 2, and continuing for two weeks, the FTP server began receiving several transmissions per day of batched, stolen information. Also beginning on Dec. 2, the attackers "used a virtual private server (VPS) located in Russia to download the stolen data from the FTP," Raff said, with attackers ultimately amassing 11 GB of stolen data.

Unfortunately, those attack techniques don't appear to point to any specific cybercrime gang. "We haven't seen this specific VPS before," Raff said via email. "However, VPS are usually used by attacker as a proxy to hide their real IP address, so the attackers may have been using different VPS hosting over time."

While the stolen Target information no longer resided on the Russian server that Seculert found, a review of publicly accessible logs for the server show that only IP addresses from Target had connected to the FTP server. "So far there is no indication of any relationship to the Neiman Marcus attack," Raff said.

On a related note, Neiman Marcus CEO Karen Katz published a letter Thursday apologizing for that retailer's breach, and -- like Target -- offered affected customers one year of free credit monitoring. Unlike Target, however, Neiman Marcus has yet to disclose how many customers were affected by the data breach.

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter.

Next-gen intrusion-prevention systems have fuller visibility into applications and data. But do newer firewalls make IPS redundant? Also in the The IPS Makeover issue of Dark Reading Tech Digest: Find out what our 2013 Strategic Security Survey respondents have to say about IPS and firewalls. (Free registration required.)<