Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Be Careful Beating Up Target
Threaded  |  Newest First  |  Oldest First
speshul
100%
0%
speshul,
User Rank: Strategist
4/1/2014 | 9:52:31 AM
Seriously?
So we're supposed to take it easy on Target because other companies are just as bad? That's the most insane thing I've ever heard. So because other companies are just as bad at protecting our sensitive personal information, we should be nice?

 

We should be crucifying every last one of them. I can guarantee that all of these companies have I.T. teams that warn them about these problems, but the companies choose to ignore them due to budget or other reasons. Just like Target had been warned by it's team.

 

But yet, we are supposed to go easy on them. Because clearly Target's credit was screwed over right? Their negligence for their customers' information in some way hurt them financially right?! WRONG. The customers were the ones who lost in this, all because of corporate greed.

 

CRUCIFY THEM ALL!
marcelbrown
100%
0%
marcelbrown,
User Rank: Apprentice
4/1/2014 | 11:43:41 AM
It's Windows, Stupid!
Target was better prepared than most of the industry, yet they still couldn't shake the one simple, inherent weakness that most of the industry still chooses to ignore - Microsoft Windows.

Until companies get serious about moving away from Windows, they aren't really serious about security. You can't be serious about protecting your company and your customers if you build your information technology infrastructure on top of a foundation that is full of security holes.

Sure, let's not blame Target because they seemed to do almost everything right - except the choice of their core technology.
speshul
100%
0%
speshul,
User Rank: Strategist
4/2/2014 | 4:50:13 PM
Re: It's Windows, Stupid!
I think the problem would be prevelant in any mainstream operating system used globally for companies and most households. If MAC OSX was the number 1 used operating system at companies and in homes, then we would be saying the same things about them.
JamesR010
50%
50%
JamesR010,
User Rank: Strategist
4/7/2014 | 10:39:21 AM
Re: It's Windows, Stupid!
Agreed. Most of these PoS systems (PoS - lol) run WinXP in admin mode, are not patched properly, and may not even have AV locally. However, most of the fault is still on Target's C executives for dropping the ball on security.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/8/2014 | 11:44:32 AM
Re: It's Windows, Stupid!
We don't actually know if Target's POS systems were not updated or had malware protection. We do know that they were PCI sertified immediately prior to the breach, so I'd like to think that their ASV or whomever certified them checked those particular items and deemed them current. What bothers me greatly is the misalignment of their security reporting infrastructure. They had security reporting to IT, which presents a conflict of interest that potentially negates the separation of duties. It wouldn't surprise me if this was behind the security team's decision to act upon the initial malware notification in the way they did. Unfortunately, we will probably never know if it did or not.

 
JamesR010
50%
50%
JamesR010,
User Rank: Strategist
4/8/2014 | 3:41:20 PM
Re: It's Windows, Stupid!
@GonzSTL : They were "certified" by Trustwave, and being "in compliance" does NOT equal being secure. Trustwave doesn't have a good track record of certifying compliance (see Heartland Payment Systems fiasco of a few years ago, IIRC). The stuff I posted I picked up from several sources, including Krebs, and a personal experience I had at Sears in January of this year. An employee rebooted (powercycled really) a kiosk right in front of me that was running WinXP as administrator and it displayed the name of the script it was going to run for the kiosk. Crazy stuff.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/9/2014 | 8:33:08 AM
Re: It's Windows, Stupid!
@JamesR010: I am well aware of the compliance vs secure scenario, as well as the Heartland situation. I also have seen firsthand how kiosks, ATMs, etc. run imbedded XP in admin mode. I have seen horrible security practices; stuff that just makes me cringe and wonder what they were thinking. It's all crazy, I agree - too many systems running wrong configurations makes for a target rich environment, to coin a phrase. At the same time, it is a bit premature to simply disregard the certification by Trustwave simply because of their previous record. As you mentioned, compliance does not equate to security, and since we know that IS the case, can we really disparage Trustwave? We just don't know all the details right now. In the end, it boils down to secure practices rigidly enforced, driven by a well informed upper management team. Really, it is up to us to educate our organization regarding the risks and how to best mitigate them because is isn't whether or not a system will be breached, but rather when it will be breached. We just like to postome that unfortunate incident indefinitely if at all possible.
Duane T
100%
0%
Duane T,
User Rank: Apprentice
4/1/2014 | 12:13:32 PM
False premise of manual processes
Target was certified via PCI DSS in September, so some might believe that they were doing what was necessary to secure their data. Unfortunately, Compliance ≠ Security, and malware detection is like a red flashing light and siren. If you do nothing about it, all you can say is that you were warned.

That's why it's about time that these companies all invested in automated incident response systems that lock down a detected threat. What's odd in this situation is that FireEye has an entire "mitigation" partner page for this on their website, and Target did not use any of them. Think about it - if they used automated detection tools, why not use automated incident response tools that reduce manual tasks and eliminate human error? This doesn't have to be that complicated.

Wait, in a few seconds I found NetCitadel, Bradford Networks, and ForeScout as mitigation options.
AccessServices
100%
0%
AccessServices,
User Rank: Apprentice
4/2/2014 | 7:51:03 AM
Why Target and What to Do

i donot know anyone that works for target corporate; however,i've talked with people that know alot about how target manages security andthey have all said that target was much better than most.  whenever you bring budgets into the securitymix, you get intot his discussion about not being the "low hanging fruit".  

someone broughtup a great point in a private discussion about why target and not say...walmart. target has higherend customers so their credit limits will be higher and thus the cards will be worth more onthe blackmarket. this infection was a oneshot opportunity andthe badguys knew it.  they did a good job with their roi and target did a bad job with their risk assessmenttarget thought that there were not the low fruit; however, because their cards were worth more they were in a different category than they thought.

concerning thelogging/monitoring/eventcorrelation aka siem. there is a siem that would have correlated these events and prioritized for the security team. it also would have noticedthat 11 gofdata were being ftped from as erver that normally does not send data to the internet(baselining).  on top of that,i t could have a smart response to automatically block or with approval anything suspicious. it is also in gartner's magic quadrant. 



jeffjones
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
4/2/2014 | 9:06:07 AM
"low hanging fruit".
"Whenever you bring budgets into the security mix, you get into this discussion about not being the "low hanging fruit." 

That is such a short-sighted point view! Perhaps if Target had a dedicated CISO in it's corporate hierarchy, the outcome would have been very different. (See: Target Begins Security & Compliance Makeover)
eaglei52
50%
50%
eaglei52,
User Rank: Apprentice
4/2/2014 | 1:05:19 PM
Defense in Depth...
With failure to wall-off its payment systems from the rest of its corporate network, through which hackers were able to gain access to payment details, Target effectively lost access control to it's systems. They may not have even deleted dormant passwords. Alot of other faults can be forgiven somewhat, such as the payment system software faults claimed. But not knowing who has access to your systems and verifying their currency is tough to forgive. Too, the inability to determine that an internal server had connected to upload the data to the hackers is another serious fault. So, no with these two glaring problems, don't give Target too much slack.
Jaludi
100%
0%
Jaludi,
User Rank: Apprentice
4/2/2014 | 3:02:32 PM
Being wrong with other company doesn't exonerate anyone
While Target and many others performed only 95% of their due diligence, that still doesn't exonerate them or anyone else that's still vulnerable.

Automated event detection, correlation and the elimination of irrelevant alerts should be part of the process. Without that, the other 95% is of minimal consequence. Ignoring those steps because almost everyone else does is what gets them in trouble.

Shared responsibility should go to all the vendors who don't insist these extra steps be taken.

 

 

 
LucasZa
50%
50%
LucasZa,
User Rank: Moderator
4/8/2014 | 12:49:26 PM
Target was a victim
Blame the victim? When banks get robbed, do we blame their security? This would only happen if there was gross negligence such as leaving cash out unsupervised.

I know firsthand that the hacking groups breaching larger organizations including the one that hit Target are highly capable, funded, determined, and well-practiced. Once they gained initial access into Target, they no doubt had to proceed with privilege escalation, lateral movement, and even find places to pivot between network segments in order to access the card data environment (CDE). They're also adept at compromising other environments such as Linux and AIX and will even plant backdoors on those systems.

In a day and age when alerts come in at a great magnitude, who can blame them for overlooking one with the generic name "malware.binary" as they're having to pick and choose which ones to spend valuable time investigating. What this really highlights is the need for automation, including the incorporation of robust intelligence and contextual detail. The industry as a whole is actively pursuing these capabilities. Defenses will improve as security teams are better equipped with such capabilities.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25514
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php.
CVE-2020-25515
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books.
CVE-2020-14022
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Star...
CVE-2020-14023
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS.
CVE-2020-14024
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuratio...