Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:05 PM
Connect Directly

Cybercrime Dipped During Holiday Shopping Season

The number of businesses breached dropped by half from years past, but attackers got more bang for their buck in terms of stolen records, a new IBM report reveals.

Black Friday through Cyber Monday traditionally has been the most vulnerable time for many businesses -- especially retailers -- for cyberattacks, but new data from IBM shows that attacks against all industries during that period in 2014 actually decreased 50% from the previous two years.

But that doesn't mean the bad guys took an extended holiday. From Nov. 24 through Dec. 5, IBM's Managed Security Services saw 3,043 cyberattack attempts per day against client organizations in various industries, versus an average of 4,200 during that period in 2013. IBM says there were 10 breaches reported during the 2014 holiday season, versus more than 20 last year.

How did retailers fare during their vulnerable holiday shopping season, when no new security tools or other IT projects go live and only the most critical security patches get installed? According to IBM, two retailers reported breaches during that period, versus three in 2013.

Just why cybercrime actually dropped during the retail industry's self-imposed technology "freeze" period -- holiday shopping season -- is unclear. "That's when [a company] really looks ripe for the picking, when they start freezing patches and security starts to take a back seat" to transactions and system availability, says John Kuhn, senior threat researcher for IBM Managed Security Services. "But historically, it didn't show attackers taking advantage of that… I can't really say why they are not taking advantage of that time period."

One possibility, according to IBM's report, is that attackers performed the bigger heists before that period in order to cash out more quickly, before banks catch on that payment cards have been dumped in the cyber underground. "Often, attackers infiltrate targeted systems and then spend months stealthily collecting data before any announcement is made or the organization becomes privy to the compromise."

Meanwhile, the number of retailers hit by data breaches in 2014 actually dropped by 50%. But cybercriminals were actually more efficient in their attacks against retailers, getting more bang for their buck, with 61 million of records compromised last year, down from nearly 73 million in 2013 -- a figure mainly attributed to Target's massive breach that year. When you take Target and the Home Depot -- the two largest attacks in terms of stolen records -- out of the equation, the number of stolen retail records in 2014 increased by more than 43% over 2013.

"Last year, we saw a lot of breaches of big high-profile names. This [past] year, we saw a decline in the number of breaches during the holiday period, but a rise in the volume of records" stolen, Chris Strand, senior director of compliance for Bit9 + Carbon Black, said of the IBM report. "The volume of records they're getting is increasing over the years."

And some retailers may not yet know they've been infiltrated with malware, whether it was planted during the holiday shopping season or afterward. "A lot of attacks during the holiday last year were uncovered later," Strand says. Plus, attackers could be hacking through different vectors now that their methods of attack, such as PoS malware, have been publicized broadly.

Arthur Tisi, a retail security expert and co-founder and CEO of The Praescripto Group LLC, says the bottom line is that the risk to retailers is still very real. "In aggregate, there were fewer instances [of attacks], but the instances are more dramatic."

Retailers are improving their security and awareness after the past year and a half of high-profile breaches, he says. "When you start having C-level executives losing jobs, you start to become more aware. But there's an extremely long tail here," and retailers remain at risk.

According to IBM: "Ironically, while the number of records reported has increased, the number of total breaches reported has decreased since 2012. The number is down over 50% currently in 2014 from its peak in 2012. This means that, while we have seen fewer breaches reported in the last two years, these breaches were significant and wide-reaching in terms of victims affected."

IBM also found that manufacturing was the most attacked industry during the holidays in 2012 and 2013. The retail and wholesale industries were the most targeted in 2014.

POS malware not No. 1
Malware written to attack point-of-sale (POS) systems emerged en masse last year, but POS malware was not the No. 1 attack vector in retail breaches, IBM found. Injection attacks -- command or SQL injection -- were the most common means of attack. Command injection was the attack vector in nearly 6,000 retail attack attempts. IBM said systems administrators are not performing data validation: "Shellcode characters should never be allowed to enter an organization's network via HTTP."

Strand says that injection attacks are indeed on the rise, and that will continue as attackers set their sights more on e-commerce retail, especially as POS vendors and retailers better lock down the POS systems. "Attacks will shift further to e-commerce, and threat numbers and attempts at e-commerce are going to rise." Command injection attacks can work against POS systems, but they also will be used to go after e-commerce sites.

Happy New Breach Year
IBM's Kuhn expects cybercriminals to continue hacking away at large retailers, but small ones will be even more at risk as the big guys shore up security. "It will be a little of both" getting hit this year. "The guys who do this to smaller retailers are going to continue what they're doing because it's effective… As more defenses come into play, they will have to be more crafty" against large retailers.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Sara Peters
Sara Peters,
User Rank: Author
1/5/2015 | 4:23:34 PM
Well this certainly seems to conflict with the common beliefs. I wonder if the sample size is big enough...
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/5/2015 | 4:26:01 PM
Re: Unexpected
The retail sample for the holiday season was indeed relatively small, but the overall sample across industries was pretty substantial given IBM's client base. They also used data from the Privacy Clearinghouse on breaches that were reported. 
Sara Peters
Sara Peters,
User Rank: Author
1/5/2015 | 4:30:59 PM
Re: Unexpected
Thanks Kelly! Good to know. It's also weird to me that in 2013-14 manufacturing was hit hard during the holiday season. Shows what I know.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/5/2015 | 4:48:03 PM
Re: Unexpected
I had to think twice when I saw manufacturing, too. My gut is maybe it's because they have skeletal staff during the holidays as well.
User Rank: Ninja
1/6/2015 | 3:38:44 PM
Patching Pushed Back
That's interesting. It never even crossed my mind that that pushing back of patches due to the holiday season would be a security hole but not its glaringly obvious. But I do think that pushing back patches, though widely practiced, is unnecessary. Change management from planning to implementation in a test environment should drastically cut down on any delays the organization could incur. Not applying necessary patches in the idea that you are saving functionality is just negligent. Its poor planning.
[email protected],
User Rank: Apprentice
1/9/2015 | 3:28:52 PM
Suspect numbers
Nice article, but I have two problems with it.  First is, and no offense to IBM - a giant in the tech industry, but I do not see IBM as a company I rely on for IT security or IT security information.  Secondly I feel this article may have been written about 4 months too early.  I think no one in IT Security is confident the security incidents from the holidays have been fully reported yet, or will be for months.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
1/9/2015 | 3:33:25 PM
Re: Suspect numbers
@boconnor, you are spot on that we don't know everything yet. IBM even noted (see below, from the article) that we don't know the whole picture yet: 

And some retailers may not yet know they've been infiltrated with malware, whether it was planted during the holiday shopping season or afterward. "A lot of attacks during the holiday last year were uncovered later," Strand says
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.