Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Target Breach: 5 Unanswered Security Questions
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Mathew
Mathew,
User Rank: Apprentice
1/24/2014 | 10:19:50 AM
Re: Why Bell Sports?
Timing. That's the primary suggestion they might be related, and it may be a stretch. Because yes, it wasn't a POS-data-focused hack.

But don't forget that Target also lost 70 million customers' names, email addresses, and other personal information. That didn't come from POS data streams, which suggests that hackers may have gained access to more than just the payment processing servers.

Then again, different gangs may have taken down each of the retailers mentioned in the story. Investigators have yet to say.
David F. Carr
David F. Carr,
User Rank: Strategist
1/24/2014 | 10:03:02 AM
Why Bell Sports?
What would make you think the Bell Sports hack might be related? I'd think the fact that those were web transactions would put it in a different category than POS transactions.
Brian.Dean
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:34:37 AM
Re: PIN numbers
If all card holders were as quick as you to setup email alerts and notifications then it would become a losing game right from the beginning for anyone to steal information. Unfortunately, I feel that the vast majority of the 40 million affected are not looking into security best practices. This creates a need for financial firms to increase their standards. 
rradina
rradina,
User Rank: Apprentice
1/23/2014 | 6:29:53 AM
Re: What OS?
Knowinng specifics is important to all but what does running a Java VM mean?  Lot's of current scare tactics regarding Java security are unfounded if you aren't running applets in browsers with an unsupported or unpatched version of Java.  Hopefully the security folks don't preach a scorched earth policy in the direction of Java or Windows.  If the POS software, whatever it or the OS is, was running with unneccessary elevated privileges, Target already has three strikes.
rradina
rradina,
User Rank: Apprentice
1/23/2014 | 6:20:35 AM
Re: PIN numbers
If the card isn't replaced, what makes the stolen data finite?  My card was part of the Target breach and it has not been replaced. I added an e-mail alert for charges of $10 or more (the lowest amount allowed by my bank).  The enhanced protection is if I catch the fraud and report it.  Then I'll get a new card.  Until that happen's, it's quite possible that criminals could blend small charges as long as they are not from overseas.  Those charges are more scrutunized by institutions.  (I once bought a cable for a few bucks from a Chinese on-line supplier.  My bank shut down my card thinking fraud.  When my dinner charge was rejected, it took a 20 minute phone call to get it resolved.  Of course it didn't help that the supplier had an unrecognizeable funky name and was located in Taiwan!)
Brian.Dean
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:20:25 AM
Re: Exploiting Payment Servers vs. POS Controllers
"30 out of 48 antivirus engines are detecting the malware". I wonder what restrictions are stopping 18 antivirus engines from adding detection definition for this particular malware. One reason that I can think of is that maybe virus definitions are not easy to share between antivirus firms -- copyright issue. Or maybe this threat is being viewed as low risk by some, because their customer base is from a different segment.   
Mathew
Mathew,
User Rank: Apprentice
1/23/2014 | 6:12:57 AM
Re: What OS?
No, not an OS. But yes, before more details emerged, it could have been Windows underneath, or Linux runing the POS device. The terminals themselves could also have been running a Java VM, with Internet-connected Java apps runnning on these devices, opening up the possibility that they'd somehow been exploited. But that doesn't appear to be the case.
rradina
rradina,
User Rank: Apprentice
1/23/2014 | 6:06:28 AM
What OS?
Java isn't an OS.  What OS is under Java?  If it's Windows...
Mathew
Mathew,
User Rank: Apprentice
1/23/2014 | 4:55:59 AM
Re: Exploiting Payment Servers vs. POS Controllers

BlackPOS is Windows malware. But some POS terminals run Windows. Others, Java. So there was a question -- which hasn't yet been officially answered -- about whether attackers managed to infect POS terminals themselves, for example if they were Internet-connected and set to use a default password. Then a secondary hack of a system inside Target might have served as the command-and-control server (mothership), and routed stolen data via FTP to Russia. 

That's crucial information for other retailers looking to avoid a copycat hack against their systems. 

But based on what's known now, it looks like the payment system was hacked. From a time/effort standpoint, this makes a lot of sense. Launch a phishing attack (again, just a guess) that manages to sneak malware onto the Windows system that manages payment processing -- i.e. sends/receives data from all of those POS terminals in stores  -- and you have an elegant (from an attacker's perspective) way to siphon large amounts of card data. Add the twist of only sending this information out of the firewall to an attacker-controlled server during working hours, and you make related data exfiltration tougher to spot. 

Mathew
Mathew,
User Rank: Apprentice
1/23/2014 | 4:46:04 AM
Re: PIN numbers
PIN codes are encrypted, and there's a debate in the secrity community now about whether they can be cracked. (Or if it will be worth the effort.)

In terms of stealth moves -- hello "Office Space" -- in fact card data has a finite life, thanks to "card brands" either invalidating those numbers and issuing new cards (as some have done) or else using "enhanced fraud protection measures" (i.e. not paying for the cost of reissuing a card, and hoping to spot any fraudulent transactions -- more fun for cardholders). So there's an impetus for carders to move the goods quickly.

On that front, Brian Krebs said via Twitter yesterday: "Another set of 2 million cards stolen from Target ("Eagle Claw") goes on sale at Rescator sites (all part of batch stolen 11/27 - 12/15)."

Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file