Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Target Breach: Phishing Attack Implicated
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
2/14/2014 | 9:56:03 AM
Random or targeted
When I saw the headline, I assumed the attackers had identified the HVAC company as a Target supplier and deliberately went after them with a spear-phishing attack. But if it was just a random chance (a fishing expedition?), these guys stumbled across a good one. That said, the attackers seemed really prepared to exploit the opportunity, so maybe they had retailers in mind from the outset.
rradina
50%
50%
rradina,
User Rank: Apprentice
2/14/2014 | 9:58:33 AM
My Theory
They captured credentials from Fazio when they logged into Target's network and subsequently when they logged into an in-store HVAC console.  The console was likely good ole Windows XP, not patched and no malware detection.  The credentials were probably also a "local admin" meaning they owned that console and could install anything they wanted on it and use it to determine how to compromise the router to allow POS VLAN access or, if the HVAC system was wireless, compromise an in-store Wireless network.  Once on that network, it probably wasn't hard to use a remote execution attack against Windows XP-based POS systems that might have also been missing critical patches making them vulnerable to remote attacks.
WKash
50%
50%
WKash,
User Rank: Apprentice
2/14/2014 | 5:53:39 PM
Thanks for updating
Thanks for continuing to follow this story and set the record straight about the HVAC contractor implicated in the Target breach.  In particular: For making it clear, based on what now seems to be known, that the hackers used an accounting system, not the HVAC system to break in and that the contractor likely was unwittingly caught in a very large phish net. As the number of companies granting network exchange privileges to one another continues to grow, so will the collateral damage as hackers continue to perfect their skills.

 
rradina
50%
50%
rradina,
User Rank: Apprentice
2/15/2014 | 11:09:12 AM
Re: Thanks for updating
"What's still not clear, however, is how attackers might have parlayed Fazio's access credentials for Target's electronic billing, contracts, or project management system into full-blown access to the retailer's IT network and payment processing systems."

From the statement above, how do we know it was the accounting system? The quote is a "theory" because it uses the terms "might have".  Am I missing another story?

Until someone comes clean with incredible detail, we're all throwing mud at the wall. Granted, the more that comes out the closer our mud gets but we're still just guessing.  We don't even know if the credentials stolen via Fazio were instrumental before or after an initial breach.  We may never know unless we catch the perpetrators and they spill the beans.
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
2/15/2014 | 4:42:28 PM
Who will be made responsible?
This will be interesting to see if the HVAC contractors are found to be liable in any way. I'm sure their security will be looked at closely.

 
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
2/15/2014 | 4:49:22 PM
Re: Random or targeted
 

I have to think this was not random. At least to the point that they knew they were going to get into more by hacking Fazio. They must have known they had contracts with Target and others. What else did they hack and maybe no one has discovered it yet?
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/18/2014 | 12:20:40 AM
WKash
50%
50%
WKash,
User Rank: Apprentice
2/18/2014 | 12:19:48 PM
Re: Thanks for updating
The point was, it does not appear that the hackers got to Target through the HVAC control systems, but rather...the contractor's access to Target's network was limited to business-related administrative purposes. As he was quoted here: "Our data connection with Target was exclusively for electronic billing, contract submission, and project management, and Target is the only customer for whom we manage these processes on a remote basis. No other [Fazio] customers have been affected by the breach."

How the hackers used that information to get to the credit card files is an important questions, still to be determined.

 
rradina
50%
50%
rradina,
User Rank: Apprentice
2/18/2014 | 2:53:19 PM
Re: Thanks for updating
I missed that.  However, that raises new concerns.  If by "data connection", they mean some kind of private link with Target so they can perform these duties, it's not difficult to envision lax firewall rules or an unpatched "Intranet" server that was vulnerable.  Hackers owned Fazio's PC(s) so they could attack any system Fazio was capable of reaching through that data link.  Billing and project management servers are probably "Intranet" servers. They could have easily been running a dated and unsupported version of Windows because the software suite was not compatible with later versions.  Once compromised, it was behind the firewall on a VLAN that probably had broad access to many corporate data center resources (backup servers, file servers, database servers, etc.).  From there they could have hacked any number of systems until they found one that could talk to the retail POS systems.
WKash
50%
50%
WKash,
User Rank: Apprentice
2/18/2014 | 4:09:10 PM
Re: Thanks for updating
rradina, you raise some interesting possibilities here.  I don't have enough information to comment on them, but one thing's for sure, it would be a great service to the community if forensics investigators shared what they learned and what steps companies should take, and should have taken.  True hackers will just find another way to exploit the IT ecosystem. But if companies do more to take a "neighborhood watch" approach, rather than minding their own "house's" security, hackers at least might look elswhere. 
Page 1 / 2   >   >>


News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32077
PUBLISHED: 2021-05-06
Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a brute-force attack on a (sometimes hidden) search field, because the last four SSN digits are part of the supported combination of search se...
CVE-2020-23263
PUBLISHED: 2021-05-06
Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.
CVE-2020-23264
PUBLISHED: 2021-05-06
Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.
CVE-2021-27941
PUBLISHED: 2021-05-06
Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2 on Android and through 4.9.1 on iOS) allows a physically proximate attacker to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the...
CVE-2021-29203
PUBLISHED: 2021-05-06
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gai...