Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Target Breach: 10 Facts
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
rradina
rradina,
 User Rank: Apprentice
12/23/2013 | 6:48:16 PM
Re: Lets Try Some Facts.....
Why does the time period imply theft at time of purchase?  If I was designing a POS/cash management system that required time to clear transactions, balance accounts and reverse returns, I'd keep recent transactions for some time period and then purge them. There is also the data warehouse side of things. Sometimes mapping and cleansing routines are updated resulting in numbers that don't balance. Often data gets reloaded to correct such issues.  It's plausible that this could have been an inside job where someone copied a temporal 30-day tlog database to a thumb drive and walked out the door.

Of course all of these activities rarely require the full account info.  Generally PCI requires truncation to store transactions but Target may have demonstrated a mitigating factor by encrypting all transactions.  Thats why its probably an inside job... someone with access to the necessary decryption information.

Another article I read said the cvv codes were not stolen which meant the stolen accounts are not useful for most on-line purchases.

IMO ... regrdless of this article's title, we don't really know what happened yet.
cjoshdoll
cjoshdoll,
 User Rank: Apprentice
12/23/2013 | 3:40:05 PM
Lets Try Some Facts.....
First:

"..."The fact that three-digit CVV security codes were compromised shows they were being stored..."

I'm not sure why data storage is even mentioned in the story, much less the encryption piece.  The fact that the breech is limited to a 3-4 week window of time would clearly indicate that the card data was stolen at the time of purchase, NOT stolen from a database. Thus, lodging the claim that Target was doing a "no-no" by storing ccv data, is just slander, IMO.  If this data was stolen from a database, where Target was saving CC data that they should not be saving, then A) there wouldn't be such a short window of time (you don't compromise a window of records in a database, it's all or nothing) and B) its highly likely that target.com's CC data would have been compromised too.

 

Secondly, the throwing the encryption for data in transit subject in with the encryption for data at rest issue is poor timing.  PCI requirements for encryption are different for data at rest and data in motion, and CC data is NOT required to be encrypted, according to the PCI DSS, unless it is traveling over a public network (the internet) or over wireless networks.  In fact, most banks / acquirers can't even support end-to-end encryption for CC transactions.  There are a very limited number of acquirers that can support E2E encryption, and most of those are new niche businesses that are providing a new model for transaction encryption.

 

While it's easy for these "experts" to sit back and say how everything should be encrypted and secured tight as can be, its careless to make accusations that Target wasn't doing everything that they could to prevent this.  We are talking about a system for credit processing that pre-dates the internet, and the everything is connected world.  Businesses are trying to play catchup to secure these systems while leveraging new technology to make their supply chain more efficient and reduce costs with tech.

 

I have NO ties to Target, and I am not here to defend them.  I am however the lead Security Architect for a mid-size, national retailer, in charge of PCI compliance and CC transaction security, so I have personal experience living up to the PCI DSS, and trying to balance business requirements with customer protection.  I have no issue burning them at the stake if they are to blame, but let's get the FACTS before we indict Target.  There are PLENTY of scenarios where Target could have been doing EVERYTHING right, and still have this happen.

 

My $0.02
MelvinGaines
MelvinGaines,
 User Rank: Apprentice
12/23/2013 | 12:37:56 PM
Re: When?
I think we may need to consider that this was an exceptional breach that likely occurred internally. I think it is entirely plausible that the information was not leaked immediately so as to not tip off whoever was causing the internal breach to take place. I don't ever recall the Secret Service being involved with previous credit card breaches (to my knowledge).  In my mind, whether the public knew about it within 4 days or 7 days doesn't really matter that much if you look at the overall number of 40 million. Only a small fraction of that number will be affected.
SaneIT
SaneIT,
 User Rank: Apprentice
12/23/2013 | 7:50:30 AM
Re: Kudos? Target was outed by a journalist
This is one of the things that bothers me most.  Target didn't come out and notify customers to protect them, they kept quiet as long as they could and it sounds like the "fix" for this is a knee-jerk reaction by the banks who issued the cards.  If the tren of punishing customers after a data breech continues we're going to see a lot more people protecting themselves by avoiding companies who have had data losses in the past.
samicksha
samicksha,
 User Rank: Apprentice
12/23/2013 | 2:41:36 AM
Re: Kudos? Target was outed by a journalist
I am not shocked and neither surprised but yes, was it so easy for hackers to attack, i mean 40 million accounts is not a small number. We have been discussing and claiming about more rigid and bulletproof security but still hacker manages to find good loop holes. I am not sure but i read CVV number was also stolen which ideally should be available only with user physically on the card.
Chris1001
Chris1001,
 User Rank: Apprentice
12/23/2013 | 1:47:47 AM
Kudos? Target was outed by a journalist
The breach was reported to the public by Journalist Brian Krebs.  Target was outed.  They did not "come clean" of their own accord.
Banker666
Banker666,
 User Rank: Apprentice
12/22/2013 | 9:37:02 PM
Millions of dollars
I work at a bank that does card processing and I for one can say PCI is a joke in my opinion.   After being audited they made us move all of the card processing off onto it's own seperate mainframe systems.  They were totally clueless about how a mainframe works and how it processes.  As a result our company spent millions of dollars to meet their compliance.   In my opinion the vast majority of breeches occur on the retail side.   For example I walk into a store and use my card and the clerk doesn't ask for any ID from me.   How about making these retailers make their employees go thru a fingerprint and background check like we had to where I work at.  I wonder if Target was using offshore IT services.  Duh let me guess.   The discussion where I work has been how many cards are we going to have to re-issue because of this and not to mention all of the account forwarding processing we'll likely have to do.  The bigger issue is that who ever pulled this off won't be jailed, much less captured and brought to justice and they likely know it too.    If I pulled off something like this in the U.S. I'd be put into prison.   I know one thing for sure we'll be re-evaluating offshore access and their use.  Maybe even put them all out the door.   Gawd I could not imagine our reputation ruined because of a major breech like this.          
PaulS681
PaulS681,
 User Rank: Apprentice
12/22/2013 | 12:04:05 PM
Re: When?
I aree you have to be 100% positive but if they were on the 15th then why didn't we hear about it? I think if target came out and said why they waited it might help a little. Although this is the least of Targets problems as class action lawsuits are popping up all over the place due to the fact they were breached.
Brian.Dean
Brian.Dean,
 User Rank: Apprentice
12/22/2013 | 6:28:54 AM
Transitions are Important
Banking has come a long way since pre internet times but as people continue to use electronic forms to make payments the need to increase the security standard increases while at the same time complexity needs to be kept to a minimum.

Almost all developing countries have a banking sector but not all of its population are banked, the reason for this are many, and one reason is that the population view banks as being too complex, another is a view that banks are not as secure as they should be. 40 million is a large number, before never forms of payment become discredited, I think it is vital to add security and limit complexity before it starts to affect the number of transitions carried out. 
Brian.Dean
Brian.Dean,
 User Rank: Apprentice
12/22/2013 | 5:41:35 AM
Re: When?
I hear you and understand that the need to quickly disclose any kind of data breach is a matter of extreme importance for the protection of customers likewise, it is also important to confirm and be 100% sure that a data breach has taken place before releasing an alert, because false positives would not only cause unnecessary panic for the customer but it will also undermine the legitimacy of future alerts.
<<   <   Page 2 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Creating an Effective Incident Response Plan
Security teams are realizing their organizations will experience a cyber incident at some point. An effective incident response plan that takes into account their specific requirements and has been tested is critical. This issue of Tech Insights also includes: -a look at the newly signed cyber-incident law, -how organizations can apply behavioral psychology to incident response, -and an overview of the Open Cybersecurity Schema Framework.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-4144
PUBLISHED: 2022-11-29
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use th...
CVE-2022-4172
PUBLISHED: 2022-11-29
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest...
CVE-2022-46150
PUBLISHED: 2022-11-29
Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to topics that they have access to. This is...
CVE-2022-21126
PUBLISHED: 2022-11-29
The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.
CVE-2022-25848
PUBLISHED: 2022-11-29
This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory.