Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Target Ignored Data Breach Alarms
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 3 / 3
Somedude8
Somedude8,
 User Rank: Apprentice
3/14/2014 | 1:01:57 PM
Re: Target Security team is inexperienced and or incompetent.
I am not so sure that IP filtering would have helped at with the infiltration, since the penetration vector was through a contractor, unless that HVAC contractor was in the blacklist, in which case they wouldn't have been able to do their jobs. IP filtering would of course not help with exfilatration.

This development really highlights the growing difficulty of filtering the signal from the noise in an age of exponentially expanding volume of data. Its like many of us are falling in to the same trap that amateur website owners often do: If everything is in all caps, people will read everything because all caps means its important right? I would not be at all surprised if the same people that evaluated the alarm mentioned in the article were also monitoring alarms from countless workstations and who knows what else. Doesn't surprise me at all that this got lost in the shuflle. But it still terrifies me!

This also underscores the near uselessness of the PCI spec. It is not a something to use to avoid a breach, its something to use to reduce the chance of a lawsuit. "Hey! We were PCI compliant! Its not our fault!"
JoeS149
JoeS149,
 User Rank: Apprentice
3/14/2014 | 12:35:59 PM
Target Security team is inexperienced and or incompetent.
A competent IT and security individual  would have been in code red attempting to stop the attack. The fact the target "security team" did not recognize the threat shows a lack of technical understanding and/or experieence.

It has been a number of years  since I have done system security however a simple  thing to do is filter out all IP addresses outside of the needed range. Certain  countries(i.e. China, Russia) have been threats for years and years. The Target "security team" didn't understand this?


On the positive side, maybe now the non-tech world which is using technology to make money will spend more money on better security.
DarrenM555
DarrenM555,
 User Rank: Apprentice
3/14/2014 | 12:20:45 PM
They ignored it?
Between this and the "thigh gap" fiasco, it's a wonder they keep any customers. I don't shop there very often but I'll certainly think twice about giving them any of my hard-earned money in the future.
<<   <   Page 3 / 3


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-33128
PUBLISHED: 2022-06-25
RG-EG series gateway EG350 EG_RGOS 11.1(6) was discovered to contain a SQL injection vulnerability via the function get_alarmAction at /alarm_pi/alarmService.php.
CVE-2021-40894
PUBLISHED: 2022-06-24
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called.
CVE-2022-32997
PUBLISHED: 2022-06-24
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-32998
PUBLISHED: 2022-06-24
The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-32999
PUBLISHED: 2022-06-24
The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.