Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Target Breach: 5 Unanswered Security Questions
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/24/2014 | 10:19:50 AM
Re: Why Bell Sports?
Timing. That's the primary suggestion they might be related, and it may be a stretch. Because yes, it wasn't a POS-data-focused hack.

But don't forget that Target also lost 70 million customers' names, email addresses, and other personal information. That didn't come from POS data streams, which suggests that hackers may have gained access to more than just the payment processing servers.

Then again, different gangs may have taken down each of the retailers mentioned in the story. Investigators have yet to say.
David F. Carr
50%
50%
David F. Carr,
User Rank: Strategist
1/24/2014 | 10:03:02 AM
Why Bell Sports?
What would make you think the Bell Sports hack might be related? I'd think the fact that those were web transactions would put it in a different category than POS transactions.
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:34:37 AM
Re: PIN numbers
If all card holders were as quick as you to setup email alerts and notifications then it would become a losing game right from the beginning for anyone to steal information. Unfortunately, I feel that the vast majority of the 40 million affected are not looking into security best practices. This creates a need for financial firms to increase their standards. 
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:29:53 AM
Re: What OS?
Knowinng specifics is important to all but what does running a Java VM mean?  Lot's of current scare tactics regarding Java security are unfounded if you aren't running applets in browsers with an unsupported or unpatched version of Java.  Hopefully the security folks don't preach a scorched earth policy in the direction of Java or Windows.  If the POS software, whatever it or the OS is, was running with unneccessary elevated privileges, Target already has three strikes.
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:20:35 AM
Re: PIN numbers
If the card isn't replaced, what makes the stolen data finite?  My card was part of the Target breach and it has not been replaced. I added an e-mail alert for charges of $10 or more (the lowest amount allowed by my bank).  The enhanced protection is if I catch the fraud and report it.  Then I'll get a new card.  Until that happen's, it's quite possible that criminals could blend small charges as long as they are not from overseas.  Those charges are more scrutunized by institutions.  (I once bought a cable for a few bucks from a Chinese on-line supplier.  My bank shut down my card thinking fraud.  When my dinner charge was rejected, it took a 20 minute phone call to get it resolved.  Of course it didn't help that the supplier had an unrecognizeable funky name and was located in Taiwan!)
Brian.Dean
50%
50%
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:20:25 AM
Re: Exploiting Payment Servers vs. POS Controllers
"30 out of 48 antivirus engines are detecting the malware". I wonder what restrictions are stopping 18 antivirus engines from adding detection definition for this particular malware. One reason that I can think of is that maybe virus definitions are not easy to share between antivirus firms -- copyright issue. Or maybe this threat is being viewed as low risk by some, because their customer base is from a different segment.   
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 6:12:57 AM
Re: What OS?
No, not an OS. But yes, before more details emerged, it could have been Windows underneath, or Linux runing the POS device. The terminals themselves could also have been running a Java VM, with Internet-connected Java apps runnning on these devices, opening up the possibility that they'd somehow been exploited. But that doesn't appear to be the case.
rradina
50%
50%
rradina,
User Rank: Apprentice
1/23/2014 | 6:06:28 AM
What OS?
Java isn't an OS.  What OS is under Java?  If it's Windows...
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 4:55:59 AM
Re: Exploiting Payment Servers vs. POS Controllers

BlackPOS is Windows malware. But some POS terminals run Windows. Others, Java. So there was a question -- which hasn't yet been officially answered -- about whether attackers managed to infect POS terminals themselves, for example if they were Internet-connected and set to use a default password. Then a secondary hack of a system inside Target might have served as the command-and-control server (mothership), and routed stolen data via FTP to Russia. 

That's crucial information for other retailers looking to avoid a copycat hack against their systems. 

But based on what's known now, it looks like the payment system was hacked. From a time/effort standpoint, this makes a lot of sense. Launch a phishing attack (again, just a guess) that manages to sneak malware onto the Windows system that manages payment processing -- i.e. sends/receives data from all of those POS terminals in stores  -- and you have an elegant (from an attacker's perspective) way to siphon large amounts of card data. Add the twist of only sending this information out of the firewall to an attacker-controlled server during working hours, and you make related data exfiltration tougher to spot. 

Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/23/2014 | 4:46:04 AM
Re: PIN numbers
PIN codes are encrypted, and there's a debate in the secrity community now about whether they can be cracked. (Or if it will be worth the effort.)

In terms of stealth moves -- hello "Office Space" -- in fact card data has a finite life, thanks to "card brands" either invalidating those numbers and issuing new cards (as some have done) or else using "enhanced fraud protection measures" (i.e. not paying for the cost of reissuing a card, and hoping to spot any fraudulent transactions -- more fun for cardholders). So there's an impetus for carders to move the goods quickly.

On that front, Brian Krebs said via Twitter yesterday: "Another set of 2 million cards stolen from Target ("Eagle Claw") goes on sale at Rescator sites (all part of batch stolen 11/27 - 12/15)."

Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41150
PUBLISHED: 2021-10-19
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is c...
CVE-2021-31378
PUBLISHED: 2021-10-19
In broadband environments, including but not limited to Enhanced Subscriber Management, (CHAP, PPP, DHCP, etc.), on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be fo...
CVE-2021-31379
PUBLISHED: 2021-10-19
An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS allows an attacker to send certain malformed IPv4 or IPv6 packets to cause a Denial of Service (DoS) to the PFE on the device which is disabled as a result of the processing of these pac...
CVE-2021-31380
PUBLISHED: 2021-10-19
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows the attacker to obtain sensitive informati...
CVE-2021-31381
PUBLISHED: 2021-10-19
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity and availability of the system.