Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:05 PM
Connect Directly

Cybercrime Dipped During Holiday Shopping Season

The number of businesses breached dropped by half from years past, but attackers got more bang for their buck in terms of stolen records, a new IBM report reveals.

Black Friday through Cyber Monday traditionally has been the most vulnerable time for many businesses -- especially retailers -- for cyberattacks, but new data from IBM shows that attacks against all industries during that period in 2014 actually decreased 50% from the previous two years.

But that doesn't mean the bad guys took an extended holiday. From Nov. 24 through Dec. 5, IBM's Managed Security Services saw 3,043 cyberattack attempts per day against client organizations in various industries, versus an average of 4,200 during that period in 2013. IBM says there were 10 breaches reported during the 2014 holiday season, versus more than 20 last year.

How did retailers fare during their vulnerable holiday shopping season, when no new security tools or other IT projects go live and only the most critical security patches get installed? According to IBM, two retailers reported breaches during that period, versus three in 2013.

Just why cybercrime actually dropped during the retail industry's self-imposed technology "freeze" period -- holiday shopping season -- is unclear. "That's when [a company] really looks ripe for the picking, when they start freezing patches and security starts to take a back seat" to transactions and system availability, says John Kuhn, senior threat researcher for IBM Managed Security Services. "But historically, it didn't show attackers taking advantage of that… I can't really say why they are not taking advantage of that time period."

One possibility, according to IBM's report, is that attackers performed the bigger heists before that period in order to cash out more quickly, before banks catch on that payment cards have been dumped in the cyber underground. "Often, attackers infiltrate targeted systems and then spend months stealthily collecting data before any announcement is made or the organization becomes privy to the compromise."

Meanwhile, the number of retailers hit by data breaches in 2014 actually dropped by 50%. But cybercriminals were actually more efficient in their attacks against retailers, getting more bang for their buck, with 61 million of records compromised last year, down from nearly 73 million in 2013 -- a figure mainly attributed to Target's massive breach that year. When you take Target and the Home Depot -- the two largest attacks in terms of stolen records -- out of the equation, the number of stolen retail records in 2014 increased by more than 43% over 2013.

"Last year, we saw a lot of breaches of big high-profile names. This [past] year, we saw a decline in the number of breaches during the holiday period, but a rise in the volume of records" stolen, Chris Strand, senior director of compliance for Bit9 + Carbon Black, said of the IBM report. "The volume of records they're getting is increasing over the years."

And some retailers may not yet know they've been infiltrated with malware, whether it was planted during the holiday shopping season or afterward. "A lot of attacks during the holiday last year were uncovered later," Strand says. Plus, attackers could be hacking through different vectors now that their methods of attack, such as PoS malware, have been publicized broadly.

Arthur Tisi, a retail security expert and co-founder and CEO of The Praescripto Group LLC, says the bottom line is that the risk to retailers is still very real. "In aggregate, there were fewer instances [of attacks], but the instances are more dramatic."

Retailers are improving their security and awareness after the past year and a half of high-profile breaches, he says. "When you start having C-level executives losing jobs, you start to become more aware. But there's an extremely long tail here," and retailers remain at risk.

According to IBM: "Ironically, while the number of records reported has increased, the number of total breaches reported has decreased since 2012. The number is down over 50% currently in 2014 from its peak in 2012. This means that, while we have seen fewer breaches reported in the last two years, these breaches were significant and wide-reaching in terms of victims affected."

IBM also found that manufacturing was the most attacked industry during the holidays in 2012 and 2013. The retail and wholesale industries were the most targeted in 2014.

POS malware not No. 1
Malware written to attack point-of-sale (POS) systems emerged en masse last year, but POS malware was not the No. 1 attack vector in retail breaches, IBM found. Injection attacks -- command or SQL injection -- were the most common means of attack. Command injection was the attack vector in nearly 6,000 retail attack attempts. IBM said systems administrators are not performing data validation: "Shellcode characters should never be allowed to enter an organization's network via HTTP."

Strand says that injection attacks are indeed on the rise, and that will continue as attackers set their sights more on e-commerce retail, especially as POS vendors and retailers better lock down the POS systems. "Attacks will shift further to e-commerce, and threat numbers and attempts at e-commerce are going to rise." Command injection attacks can work against POS systems, but they also will be used to go after e-commerce sites.

Happy New Breach Year
IBM's Kuhn expects cybercriminals to continue hacking away at large retailers, but small ones will be even more at risk as the big guys shore up security. "It will be a little of both" getting hit this year. "The guys who do this to smaller retailers are going to continue what they're doing because it's effective… As more defenses come into play, they will have to be more crafty" against large retailers.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/9/2015 | 3:33:25 PM
Re: Suspect numbers
@boconnor, you are spot on that we don't know everything yet. IBM even noted (see below, from the article) that we don't know the whole picture yet: 

And some retailers may not yet know they've been infiltrated with malware, whether it was planted during the holiday shopping season or afterward. "A lot of attacks during the holiday last year were uncovered later," Strand says
[email protected],
User Rank: Apprentice
1/9/2015 | 3:28:52 PM
Suspect numbers
Nice article, but I have two problems with it.  First is, and no offense to IBM - a giant in the tech industry, but I do not see IBM as a company I rely on for IT security or IT security information.  Secondly I feel this article may have been written about 4 months too early.  I think no one in IT Security is confident the security incidents from the holidays have been fully reported yet, or will be for months.
User Rank: Ninja
1/6/2015 | 3:38:44 PM
Patching Pushed Back
That's interesting. It never even crossed my mind that that pushing back of patches due to the holiday season would be a security hole but not its glaringly obvious. But I do think that pushing back patches, though widely practiced, is unnecessary. Change management from planning to implementation in a test environment should drastically cut down on any delays the organization could incur. Not applying necessary patches in the idea that you are saving functionality is just negligent. Its poor planning.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/5/2015 | 4:48:03 PM
Re: Unexpected
I had to think twice when I saw manufacturing, too. My gut is maybe it's because they have skeletal staff during the holidays as well.
Sara Peters
Sara Peters,
User Rank: Author
1/5/2015 | 4:30:59 PM
Re: Unexpected
Thanks Kelly! Good to know. It's also weird to me that in 2013-14 manufacturing was hit hard during the holiday season. Shows what I know.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/5/2015 | 4:26:01 PM
Re: Unexpected
The retail sample for the holiday season was indeed relatively small, but the overall sample across industries was pretty substantial given IBM's client base. They also used data from the Privacy Clearinghouse on breaches that were reported. 
Sara Peters
Sara Peters,
User Rank: Author
1/5/2015 | 4:23:34 PM
Well this certainly seems to conflict with the common beliefs. I wonder if the sample size is big enough...
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I can't find the back door.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-25
The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of Medi...
PUBLISHED: 2021-01-25
ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the ...
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting