Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Target Breach: 5 Unanswered Security Questions
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
rradina
rradina,
User Rank: Apprentice
1/22/2014 | 4:23:17 PM
Exploiting Payment Servers vs. POS Controllers
"Exploited payment servers not POS systems, not store controllers running Windows..."

Isn't BlackPOS Windows malware?  At least I thought it was.  Perhaps I'm mistaken.  If it is Windows malware, what difference does it make that they didn't compromise POS systems or store controllers running Windows?  Either way they still compromised Windows.

I guess it's probably worse if they compromised payment servers since by design, they should be even more critically protected than an individual POS as they are a much higher value target.
Shane M. O'Neill
Shane M. O'Neill,
User Rank: Apprentice
1/22/2014 | 6:30:04 PM
PIN numbers
I'm curious about PIN numbers for debit cards. Target said PIN numbers were taken in the breach, but that the numbers were encrypted. And that claim has not backfired as far as I know.

Do we know if encrypted PIN numbers can be accessed when BlackPOS malware is running on the POS device and/or the payment servers? I guess if stolen PIN numbers were being exploited we would know by now.
rradina
rradina,
User Rank: Apprentice
1/22/2014 | 8:47:46 PM
Re: PIN numbers
Based soley on how the RAM scraping works, stealing the PIN codes is certainly possible if they were transmitted from the pin pad to an infected system.  I too read they were encrypted but I don't know if that was fact or damage control to prevent panic.

I don't know if we would know by now.   The criminals could be waiting for a future opportunity.  Right now this is highly publicized.  If I had millions of valid cards, I'd would think using them in an "Office Space" manner (Superman 2, Richard Pryor stealing fractional pennies) would be lucrative and potentially repeatable for a long duration.  Better to stay below the radar by adding a $5.13 charge from Starbuks (pun intended) to millions of accounts...
Mathew
Mathew,
User Rank: Apprentice
1/23/2014 | 4:46:04 AM
Re: PIN numbers
PIN codes are encrypted, and there's a debate in the secrity community now about whether they can be cracked. (Or if it will be worth the effort.)

In terms of stealth moves -- hello "Office Space" -- in fact card data has a finite life, thanks to "card brands" either invalidating those numbers and issuing new cards (as some have done) or else using "enhanced fraud protection measures" (i.e. not paying for the cost of reissuing a card, and hoping to spot any fraudulent transactions -- more fun for cardholders). So there's an impetus for carders to move the goods quickly.

On that front, Brian Krebs said via Twitter yesterday: "Another set of 2 million cards stolen from Target ("Eagle Claw") goes on sale at Rescator sites (all part of batch stolen 11/27 - 12/15)."

Mathew
Mathew,
User Rank: Apprentice
1/23/2014 | 4:55:59 AM
Re: Exploiting Payment Servers vs. POS Controllers

BlackPOS is Windows malware. But some POS terminals run Windows. Others, Java. So there was a question -- which hasn't yet been officially answered -- about whether attackers managed to infect POS terminals themselves, for example if they were Internet-connected and set to use a default password. Then a secondary hack of a system inside Target might have served as the command-and-control server (mothership), and routed stolen data via FTP to Russia. 

That's crucial information for other retailers looking to avoid a copycat hack against their systems. 

But based on what's known now, it looks like the payment system was hacked. From a time/effort standpoint, this makes a lot of sense. Launch a phishing attack (again, just a guess) that manages to sneak malware onto the Windows system that manages payment processing -- i.e. sends/receives data from all of those POS terminals in stores  -- and you have an elegant (from an attacker's perspective) way to siphon large amounts of card data. Add the twist of only sending this information out of the firewall to an attacker-controlled server during working hours, and you make related data exfiltration tougher to spot. 

rradina
rradina,
User Rank: Apprentice
1/23/2014 | 6:06:28 AM
What OS?
Java isn't an OS.  What OS is under Java?  If it's Windows...
Mathew
Mathew,
User Rank: Apprentice
1/23/2014 | 6:12:57 AM
Re: What OS?
No, not an OS. But yes, before more details emerged, it could have been Windows underneath, or Linux runing the POS device. The terminals themselves could also have been running a Java VM, with Internet-connected Java apps runnning on these devices, opening up the possibility that they'd somehow been exploited. But that doesn't appear to be the case.
Brian.Dean
Brian.Dean,
User Rank: Apprentice
1/23/2014 | 6:20:25 AM
Re: Exploiting Payment Servers vs. POS Controllers
"30 out of 48 antivirus engines are detecting the malware". I wonder what restrictions are stopping 18 antivirus engines from adding detection definition for this particular malware. One reason that I can think of is that maybe virus definitions are not easy to share between antivirus firms -- copyright issue. Or maybe this threat is being viewed as low risk by some, because their customer base is from a different segment.   
rradina
rradina,
User Rank: Apprentice
1/23/2014 | 6:20:35 AM
Re: PIN numbers
If the card isn't replaced, what makes the stolen data finite?  My card was part of the Target breach and it has not been replaced. I added an e-mail alert for charges of $10 or more (the lowest amount allowed by my bank).  The enhanced protection is if I catch the fraud and report it.  Then I'll get a new card.  Until that happen's, it's quite possible that criminals could blend small charges as long as they are not from overseas.  Those charges are more scrutunized by institutions.  (I once bought a cable for a few bucks from a Chinese on-line supplier.  My bank shut down my card thinking fraud.  When my dinner charge was rejected, it took a 20 minute phone call to get it resolved.  Of course it didn't help that the supplier had an unrecognizeable funky name and was located in Taiwan!)
rradina
rradina,
User Rank: Apprentice
1/23/2014 | 6:29:53 AM
Re: What OS?
Knowinng specifics is important to all but what does running a Java VM mean?  Lot's of current scare tactics regarding Java security are unfounded if you aren't running applets in browsers with an unsupported or unpatched version of Java.  Hopefully the security folks don't preach a scorched earth policy in the direction of Java or Windows.  If the POS software, whatever it or the OS is, was running with unneccessary elevated privileges, Target already has three strikes.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file