Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:05 PM
Connect Directly

Cybercrime Dipped During Holiday Shopping Season

The number of businesses breached dropped by half from years past, but attackers got more bang for their buck in terms of stolen records, a new IBM report reveals.

Black Friday through Cyber Monday traditionally has been the most vulnerable time for many businesses -- especially retailers -- for cyberattacks, but new data from IBM shows that attacks against all industries during that period in 2014 actually decreased 50% from the previous two years.

But that doesn't mean the bad guys took an extended holiday. From Nov. 24 through Dec. 5, IBM's Managed Security Services saw 3,043 cyberattack attempts per day against client organizations in various industries, versus an average of 4,200 during that period in 2013. IBM says there were 10 breaches reported during the 2014 holiday season, versus more than 20 last year.

How did retailers fare during their vulnerable holiday shopping season, when no new security tools or other IT projects go live and only the most critical security patches get installed? According to IBM, two retailers reported breaches during that period, versus three in 2013.

Just why cybercrime actually dropped during the retail industry's self-imposed technology "freeze" period -- holiday shopping season -- is unclear. "That's when [a company] really looks ripe for the picking, when they start freezing patches and security starts to take a back seat" to transactions and system availability, says John Kuhn, senior threat researcher for IBM Managed Security Services. "But historically, it didn't show attackers taking advantage of that… I can't really say why they are not taking advantage of that time period."

One possibility, according to IBM's report, is that attackers performed the bigger heists before that period in order to cash out more quickly, before banks catch on that payment cards have been dumped in the cyber underground. "Often, attackers infiltrate targeted systems and then spend months stealthily collecting data before any announcement is made or the organization becomes privy to the compromise."

Meanwhile, the number of retailers hit by data breaches in 2014 actually dropped by 50%. But cybercriminals were actually more efficient in their attacks against retailers, getting more bang for their buck, with 61 million of records compromised last year, down from nearly 73 million in 2013 -- a figure mainly attributed to Target's massive breach that year. When you take Target and the Home Depot -- the two largest attacks in terms of stolen records -- out of the equation, the number of stolen retail records in 2014 increased by more than 43% over 2013.

"Last year, we saw a lot of breaches of big high-profile names. This [past] year, we saw a decline in the number of breaches during the holiday period, but a rise in the volume of records" stolen, Chris Strand, senior director of compliance for Bit9 + Carbon Black, said of the IBM report. "The volume of records they're getting is increasing over the years."

And some retailers may not yet know they've been infiltrated with malware, whether it was planted during the holiday shopping season or afterward. "A lot of attacks during the holiday last year were uncovered later," Strand says. Plus, attackers could be hacking through different vectors now that their methods of attack, such as PoS malware, have been publicized broadly.

Arthur Tisi, a retail security expert and co-founder and CEO of The Praescripto Group LLC, says the bottom line is that the risk to retailers is still very real. "In aggregate, there were fewer instances [of attacks], but the instances are more dramatic."

Retailers are improving their security and awareness after the past year and a half of high-profile breaches, he says. "When you start having C-level executives losing jobs, you start to become more aware. But there's an extremely long tail here," and retailers remain at risk.

According to IBM: "Ironically, while the number of records reported has increased, the number of total breaches reported has decreased since 2012. The number is down over 50% currently in 2014 from its peak in 2012. This means that, while we have seen fewer breaches reported in the last two years, these breaches were significant and wide-reaching in terms of victims affected."

IBM also found that manufacturing was the most attacked industry during the holidays in 2012 and 2013. The retail and wholesale industries were the most targeted in 2014.

POS malware not No. 1
Malware written to attack point-of-sale (POS) systems emerged en masse last year, but POS malware was not the No. 1 attack vector in retail breaches, IBM found. Injection attacks -- command or SQL injection -- were the most common means of attack. Command injection was the attack vector in nearly 6,000 retail attack attempts. IBM said systems administrators are not performing data validation: "Shellcode characters should never be allowed to enter an organization's network via HTTP."

Strand says that injection attacks are indeed on the rise, and that will continue as attackers set their sights more on e-commerce retail, especially as POS vendors and retailers better lock down the POS systems. "Attacks will shift further to e-commerce, and threat numbers and attempts at e-commerce are going to rise." Command injection attacks can work against POS systems, but they also will be used to go after e-commerce sites.

Happy New Breach Year
IBM's Kuhn expects cybercriminals to continue hacking away at large retailers, but small ones will be even more at risk as the big guys shore up security. "It will be a little of both" getting hit this year. "The guys who do this to smaller retailers are going to continue what they're doing because it's effective… As more defenses come into play, they will have to be more crafty" against large retailers.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/9/2015 | 3:33:25 PM
Re: Suspect numbers
@boconnor, you are spot on that we don't know everything yet. IBM even noted (see below, from the article) that we don't know the whole picture yet: 

And some retailers may not yet know they've been infiltrated with malware, whether it was planted during the holiday shopping season or afterward. "A lot of attacks during the holiday last year were uncovered later," Strand says
[email protected],
User Rank: Apprentice
1/9/2015 | 3:28:52 PM
Suspect numbers
Nice article, but I have two problems with it.  First is, and no offense to IBM - a giant in the tech industry, but I do not see IBM as a company I rely on for IT security or IT security information.  Secondly I feel this article may have been written about 4 months too early.  I think no one in IT Security is confident the security incidents from the holidays have been fully reported yet, or will be for months.
User Rank: Ninja
1/6/2015 | 3:38:44 PM
Patching Pushed Back
That's interesting. It never even crossed my mind that that pushing back of patches due to the holiday season would be a security hole but not its glaringly obvious. But I do think that pushing back patches, though widely practiced, is unnecessary. Change management from planning to implementation in a test environment should drastically cut down on any delays the organization could incur. Not applying necessary patches in the idea that you are saving functionality is just negligent. Its poor planning.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/5/2015 | 4:48:03 PM
Re: Unexpected
I had to think twice when I saw manufacturing, too. My gut is maybe it's because they have skeletal staff during the holidays as well.
Sara Peters
Sara Peters,
User Rank: Author
1/5/2015 | 4:30:59 PM
Re: Unexpected
Thanks Kelly! Good to know. It's also weird to me that in 2013-14 manufacturing was hit hard during the holiday season. Shows what I know.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/5/2015 | 4:26:01 PM
Re: Unexpected
The retail sample for the holiday season was indeed relatively small, but the overall sample across industries was pretty substantial given IBM's client base. They also used data from the Privacy Clearinghouse on breaches that were reported. 
Sara Peters
Sara Peters,
User Rank: Author
1/5/2015 | 4:23:34 PM
Well this certainly seems to conflict with the common beliefs. I wonder if the sample size is big enough...
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-26
This affects all versions of package pathval.
PUBLISHED: 2020-10-26
An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
PUBLISHED: 2020-10-23
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.