Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Target Breach: 10 Facts
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/30/2013 | 3:05:42 AM
Re: Lets Try Some Facts.....
I agree you Joe, but do you think any term like flawless technology exists. Even Cv2 was developed as a strong measure towards security but this target breach cracked this security.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/27/2013 | 6:33:50 PM
Re: When?
Theoretically, depending upon the particular situation, disclosing a data breach before knowing how the breach occurred and if it has been fully fixed yet potentially invites more attacks.  It can be a balancing act between doing the right thing by your affected customers and preventing further harm to additional customers.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/27/2013 | 6:27:50 PM
Re: Lets Try Some Facts.....
@virsingh: Chip and Pin/EMV technology has more than its fair share of security problems, too.

Laughably (unless you're someone affected by it), a big part of the problem with EMV for consumers is that when there is a breach, it is difficult for consumers to convince the banks because of the commonly held fallacy that "EMV is secure."
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/27/2013 | 4:24:46 AM
Re: Lets Try Some Facts.....
I guess it's time to make Chip-Pin, OTP like security mandatory for users, i guess it may sound irritating but precaution better than cure.
samicksha
50%
50%
samicksha,
User Rank: Apprentice
12/27/2013 | 2:12:20 AM
Re: Lets Try Some Facts.....
I guess it's more than just Target Breach, i recently read that it was not only Target-issued credit cards who were affected, infact customers who used any credit or debit card could be affected.
rradina
50%
50%
rradina,
User Rank: Apprentice
12/24/2013 | 10:26:37 AM
Re: Lets Try Some Facts.....
I completely agree that Target may have done everything PCI demands and that they don't deserve speculation.  Personally, I think it's an inside job.  Someone had the garage door code, knew the occupants were on vacation and walked out with the family jewels.  That doesn't mean Target is off the hook but some trust is required for employees to do their job and as recent events prove, even the NSA is vulnerable to this attack vector.

FYI... Another site's article claimed the cvv code was not compromised.

The last retailer who employed me used a third party in ~1,000 stores to provide payment processing.  It was AES-encrypted and also sent HTTPS from pin pad swipe to the external processor who then connected to the various clearing banks/processors.  Only the truncated number was stored in the TLOG. The pin pads had a kill switch if they were opened and the third party actively tracked serial numbers, warned if an unauthorized device was present and refused to authorize payments from it.  (BTW a popular scam is for a "repair company" to call the local manager and pretend they were from "corporate" so they could schedule an appointment to replace one of the pin pads that was "reporting a problem".)

Unfortunately if communication was down even this system had potential weakness.  It could be configured to check a local bad card list and authorize up to a certain dollar amount with store and forward.  Although the track data it stored was encrypted, it was on the local POS lane which could then become a target.  However 40m card numbers would require compromising all POS lanes, everwhere and zapping redundant MPLS links to the third party to force store and forward mode.  That's an almost impossible target that only yields thousands of small, strongly encrypted files.  It's far easier to find something centralized and "inside the garage".
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
12/24/2013 | 9:42:29 AM
Re: Lets Try Some Facts.....
 Let's not forget that this is the busiest time of year for shopping so 40 million seems reasonable to me.

it was estimated that close to 100 million people would shop during the black Friday weekend alone. Everyone entitles to their opinion. I have read numerous articles about the data being stolen from the POS devices as customers swiped their cards. We don't know exactly how they did it and in all likelihood we won't know.
cjoshdoll
50%
50%
cjoshdoll,
User Rank: Apprentice
12/24/2013 | 9:28:06 AM
Re: Lets Try Some Facts.....
Agree, we don't know what happened.  I guess I am flustered with the "industry experts" throwing around as much blatant BS as they are - it's just adding to what I can the "hysteria news" angle.


I agree that there could be a tlog db, however it seems unlikely that you would store the entire track 2 data, including ccv1, for that purpose, even for target who is a data mining giant, that has admittedly tied credit transactions back to a user profile (See: How Target knew a teen girl was pregnant.)
 
Without debating the likelihood of a tlog DB with full card data, just the fact that the entire track 2 data was stolen, /seems/ to point to theft at swipe.  But again, you are correct, we just don't know, and I personally am afraid, we may never find out (publically.)


As someone who's job is to prevent this stuff, I have a number of concerns.  There should be a requirement to release the report generated by the forensic investigators, so that other businesses can protect against similar attacks.  I believe it should also be public to find out a company's PCI compliance status and who provided their ROC.  I have a sneaking suspicion that they got theirs from the firm that essentially charges 3 times as much, and is 3x more lenient in their audit (but let me be clear, that is MY ASSUMPTION, and even if true does NOT mean Target did something wrong to cause this.) 

 

Which leads to my real point - everyone is pointing the finger at Target, before we know anything.  There are just too many possibilities to be able to say Target is at fault here.  I'm not here to defend them, I have no stake in it, I'm just tired of reading all of the baseless accusations and reading the "experts" mostly incorrect opinions.  Unfortunately I can't just tune it out and not read the stories, because it impacts my daily job....

 
rradina
50%
50%
rradina,
User Rank: Apprentice
12/23/2013 | 11:38:20 PM
Re: Lets Try Some Facts.....
Don't you think 40 million is a lot of unique shoppers for such a short period?  There are ~320m people in the US.  ~74m are minors leaving ~250m adults.

That means 15% of the adult population used a card at Target within a few week period.  Some folks used multiple cards but not everyone has cards. Many economically challenged don't even have bank accounts.  Some folks still write checks or pay with cash. Target isn't everywhere and some folks don't shop there.

If it was a network tap, they would have a hard time pinning down exact dates. It seems more plausible someone copied files which made it easy to know exact dates and accounts.  As I said, it makes sense to keep recent transactions for dispute/clearing/reload purposes.  The entire DB doesnt have to be compromised. In fact the temporary log may have been an easier target (no pun intended) than the master database.  It also shoukd have been truncated data in the master DB. There is also no guarantee the on-line and in-store POS go to the same balancing cash flow system.

I have 12 years of IT experience in retailing alone and have been through PCI audits since they started.

 

 
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
12/23/2013 | 8:10:25 PM
Re: Lets Try Some Facts.....
 

I think that cjoshdoll makes alot of sense. The fact that they are alerting anyone who used a CC at target between 11/27 and 12/15 indicates to me that the numbers were not stored but stolen at the time of the transaction. The time period makes perfect sense to back that reasoning up. If this was database data that was stolen don't you think it would impact many more people?
Page 1 / 3   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5421
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-8225
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
CVE-2020-8237
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
CVE-2020-8245
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
CVE-2020-8246
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...