Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

New Details Of Home Depot Attack Reminiscent Of Target's Breach
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
11/11/2014 | 7:54:29 PM
Re: Why are they keeping this info????
As I understand it (not that Home Depot has been especially forthcoming about it), the infected machines were POS because the malware acted much like a keylogger. After a card is swiped, the information is maintained long enough to interface with a bank, determine its validity, and make the transaction. The malware must have copied the data during that time (with a middleman approach) and sent it off to an external database, stockpiling credit card data before being harvested months later.

Generally I agree with you, there are all kinds of faults in retail cybersecurity, and Home Depot was particularly bad about it. It's hard to say how they're doing now, but recording someone's credit information is a violation of personal space and security. However, for this attack it seems to be irrelevant; the fault was elsewhere.
User Rank: Apprentice
11/10/2014 | 5:34:42 PM
Why are they keeping this info????
This may be a really dumb question but nobody seems to be asking it. Why does {insert any company here} keep this information on file at all?  Shouldn't the consumer be the one who decides whether they are going to do business with a company in the future?  It is not like I leave my wallet at teh grocery store after I pay cash for my groceries, "just in case I will shop there again", but isn't that what we are doing?  To the best of my knowledge the credit transactions go like this:  


1.  Get total Sale

2.  Customer Swipes card

3. Approval code is retrieved from Credit card issuer

4. Customer puts card back in wallet and leaves.

Where in this process is it prudent to keep information on file?  The approval code is all the merchant needs.  I know this because I used to scratch off my credit card number when I saw it on the paper receipts which I handed back to the merchant.  More than once did I have conversations with merchants' managers and such but I was always vindicated and allowed to leave.  Florida had a law on the books a while back about this but now it is rare to see this haoppen so I know the credit card number is irrelevant after the transaction is completed.


Maybe they  (the merchants) should give us consumers a choice whether or not to keep this very personal information on file, eh?
Some Guy
Some Guy,
User Rank: Moderator
11/10/2014 | 11:56:44 AM
Target's Answer - New Card Readers
So I noticed that Target has replaced all their card readers at their POS registers (at least where I live; don't know if it was system-wide). It's hard to say if that makes it any more secure, or if they are just going for a PR stunt. Conversely, it will be a lot more expensive for Home Depot to replace all their self-service registers. And no substitute for getting up to date on best practices; e.g., whitelisting apps would have prevented the Target breach. No idea if either Target or Home Depot (or UPS) have deployed even that level of protection.
User Rank: Ninja
11/10/2014 | 3:08:10 AM
SECTF is the Model
Year after year SECTF is my favorite event for a couple reasons.  First, my life is buried in tech and once in a while it's nice to be reminded that human interaction is a powerful thing, and second, the results of these events are a reminder that the most dangerous threat to cyber security is often a social - not a tech - hack.

It's remarkably easy to walk up with all the right gear and a half-assed ID and get access to computers, and other secure items.  I once stopped for a soda at CVS geared up on my way to work and the manager mistook me for a tech they were expecting.  Were I malicious, I could have taken ownership that day.

Make no mistake: if social skills are not in your arsenal, you're in trouble, as a cyber criminal or white hatter alike.  Even tech professionals can be caught unawares.  Don't let it happen to you - bone up and be prepared; question everyone, doubly-analyze each email and key an ear out for odd phone calls your co-workers might be taking.  

And maybe watch a SECTF or two - incredibly educational.  

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Enterprises Are Assessing Cybersecurity Risk in Today's Environment
The adoption of cloud services spurred by the COVID-19 pandemic has resulted in pressure on cyber-risk professionals to focus on vulnerabilities and new exposures that stem from pandemic-driven changes. Many cybersecurity pros expect fundamental, long-term changes to their organization's computing and data security due to the shift to more remote work and accelerated cloud adoption. Download this report from Dark Reading to learn more about their challenges and concerns.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-01-28
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count c...
PUBLISHED: 2022-01-28
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_ability are already executable by any logged-in users. An attacker can send an HTTP request to trigge...
PUBLISHED: 2022-01-28
A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of network requests can lead to arbitrary firmware update. An attacker can send a sequence of requests to trigger this vulnerability.
PUBLISHED: 2022-01-28
A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of HTTP requests can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
PUBLISHED: 2022-01-28
Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.