Slashdot Mirror
TJX Breach Began With WEP Crack
An anonymous reader sends us to the Wall Street Journal for a detailed report on what is known to date about the TJX data breach. It seems that the loss of over 45 million credit card numbers and more than 450,000 SSNs, driver's license numbers, and military identifications began with someone using a "telescope-shaped" antenna at a wireless link at a Marshall's near St. Paul, Minnesota in July 2005. The link was encrypted using WEP, which had been known to be broken since 2001. The crackers who got into the TJX central databases are believed to be Romanians or Russians with ties to the Russian mobs. The eventual cost of the TXJ fiasco could exceed $1 billion — not including the numerous lawsuits filed against the retailer.
WEP is seriously flawed. What hasn't it been recalled and all router manufacturers forced to replace the hardware (or firmware)?
In most industries if you ship such a flawed product, the manufacturer has some liability. They are still selling them today too.
Of course shame on TJ Max and the whole handling of this fiasco. Not that I ever did previously, but I would never shop there.
So is it TJX or TXJ?
We're all going to die. i intend to deserve it.
TFA says "A person familiar with the firm's internal investigation says they may have grabbed as many as 200 million card numbers all told from four years' records."
Gets better, doesn't it?
The damage that such a recall would have in terms of liability, lost profit, and plain flat out admitting that they royally screwed the pooch is so enormous that, in the interest of promoting the free world, we simply can't allow it.
If you continue to press your treasonous assertions you can and will be sent to Gitmo for social reconditioning: do not mess with their profit margin.
the NPG electrode was replaced with carbon blac
So, as someone who had at least their CC number stolen thanks to these ass hats, when can we sue them and take a major chunk out of their ass? People in TJX should be jailed...
Pete/Petri "damn, my chainsaw is clogged with 1's and 0's again." --clyde
Fortunately, the mobsters only used a telescope shaped device to improve their range.
Imagine if they had known enough to make a satellite dish, of sorts...
After calming me down with some orange slices and some fetal spooning, E.T. revealed to me his singular purpose.
Which brings us to the question of why a major retailler is using wireless in the first place. I'm personally no more than an interested amatur, but I've read professionals running corperate networks who, if they have to include a wireless component at all, keep it completely seperate from the secure, WIRED, network. You get internet access, but no accessing the company databases from the wireless. Can anyone come up with a scenario where it would be ESSENTIAL for store operations to be able to send SSNs and drivers license #s over a wireless connection?
It's ironic really. Many thought it might be some insider job, a complicated back door, some flaw in an internet facing system - but no. The company was daft enough to put their internal data over a network that is explicitly designed to get around physical barriers to access, and no one, and I mean no one, seems to understand this.
A friend of mine has a reasonable but small IT business in the UK, and recently he started pushing the wireless expertise side - setting up wireless networks, explaining why they are a bigger risk than a wired network, securing them (and what do do if you are really paranoid) and trying to guarantee QoS more by setting it up correctly. Positioning your access points properly, doing wireless scanning to pick out any interference spots etc.
No one is interested, and I don't just mean small businesses, but some quite large companies who should know an awful lot better. It's not a UK thing either, because most people believe setting up a wireless network is about popping down to the local store, picking up a Netgear, switching it on and letting Windows attach you to the nearest wireless network it can find. Astonishing.
The only thing that shocks me is that this doesn't happen all the time, because many networks are just an open invitation. I mean OK, it's not that easy because you have to watch the network traffic and find out where the useful juicy bits of data are. That isn't completely straightforward, but once you are inside an average company's network it's doable because everything tends to act as if it is safe and fenced off.
.... will there be another story on slashdot today about another data leak?
WEP comprimised the communication of one retail store. Apparently enough information was stored in that one store to compromise a database with 4 years of records. So, an inside job at that level (assistant cashier probably had enough access to their wires) would be trivial. A better question... why would 4 years of CC number, etc. be accessible over the internet at all. Why not have that server offline, with updates posted occassionally via sneakernet? And hash the CC numbers. And otherwise, protect consumer information.
Your ad here. Ask me how!
Microsoft, who writes and SELLS such buggy, insecure software?
Next step will be a gross overreaction by the govt and Homeland Security, monitoring of convenience store purchase and the midnight roundups of the owners of pringles resulting in a one way trip to a Cuban internment camp
what possible valid reason TJX had for holding onto people's credit card info for up to 4 years?
IMNSHO once the credit transaction clears whatever grace period,
the credit card data should be destroyed immediately.
Except for those people who have credit card backed accounts with TJX,
there is no legal purpose TJX could have for the remaining data,
only fraudulent purposes.
Why do the credit card companies allow companies to retain this data?
Perhaps the credit card companies can't be trusted to manage their own service properly.
Time to demand a change in how credit cards work.
All you need is to have a device that reads the card,
registers the transaction with the card company and returns a reference number for accounting purposes.
For verbal transactions, use the same device but instead type the card number in to get the reference number out.
No need to retain the card number at all.
The cost of the device would be paid many times over by the amount of fraud it prevents.
The way it is today, it is too easy for companies to collect and keep data
that they shouldn't have any rights to.
"and our retarted government"
People in glass houses...
The thing is, only hardware credit cards with internal key generators are a plausible solution. I just yawn whenever a credit card breach is mentioned, because ANY store that accepts credit cards ANYWHERE could have a breach. It's a waste of time to say "X store should have been secure". There must be tens of thousands of places those numbers could be grabbed from. After all, just ONE store with WEP turned on (it wasn't totally unsecure in the minds of the managers of the store, they felt they had locked it) was enough to steal all these numbers.
Now the only problem with hardware cards is if someone steals the private key for your card from the bank. Only your bank needs this key, so it is far more plausible to secure.
The only way I can see to secure this key is the bank needs a BLACK BOX server. This would be a machine that stores the private keys, in a secure room. It would run an embedded operating system (VERY simple) and it would programmed to never give up the private keys, just confirm or deny access requests.
The keys would be stored on files in the machine's memory (probably FLASH drivers. Thirty gig off the shelf models, mirrored 4 times, would be fine), and the keys themselves would be encrypted by another key in the ROM of the machine. So, even administrators who back-up this system would not know what this key was, unless they desoldered the ROM on their own server.
Each server would be sold already containing enough randomly generated keys for as many cards as a bank could ever plausibly issue. A bank would be sold several of these servers, each with identical contents, for redundancy. Each would go in a secure location. At the plant where the cards were made, a key server with a different ROM would be the only one that would give up a key to a card that has NOT been issued, ONE TIME, in order to program a new card.
The basic idea is each server is as simple as it can be engineered to do it's job, with non-reprogrammable software and no updates EVER intended.
Well, we all know how brilliant data security experts are, and I really hope that sentence doesn't mean that they are simply throwing $5 million at them. You know what consultants are like - give them enough money and they will tell you everything you want to hear, even if the reality is a horror show.
The whole bloody point of this is that you don't get to that point in the first place. Stable door, horse bolted?
What the hell were they using this wireless network for?
So they were using an unsecured wireless network to enable hand-held equipment to function - and they used this to run their day-to-day business?! Christ. At first I thought this was just some wireless network someone had plugged into the network somewhere arbitrarily, not something they actually used in day-to-day operations.
I'm not 100% sure what system is used for credit card purchases in the US now, but this highlights why I like using cash a bit more with the advent of chip and pin. I would also never, ever use a debit card in one of these things. You transmit your card details, and the pin as well. Brilliant. Access to your bank account, and that hard earned pay that just went in today. I'm slightly confused though, because surely this communication with banks would all happen on another network?
So you take no responsibility for your own systems, and you have no internal expertise? Wonderful.
That's probably the only way, because some companies simply believe they don't have to take responsibility for IT, data, security and especially wireless security. It's something that is best swept under the carpet, and setting up a wireless network is as easy as spending a bit of money on a little access point you've seen at a local store, right? Why spend money doing it properly?
The entire credit industry is complicit in the design of the credit-card as an open invitation to replay attacks. Then this distract our attention from the fact that this horrendous credential is being compromised exactly in the manner the design dictates while telling us that it's *our* identities that are under fire. Let's get this straight: my indentity remains secure, it's only my credit-card credential is additionally compromised with every use.
The central problem here is the architecture of the human brain. We're programmed to function within status hierarchies. The banks have cleverly positioned themselves within the equation that credit equals status. This move serves to bypass normal human scepticism, so one time after another, in the all-too-predictable aftermath of one of the stupidest replay protocols ever devised, we sit around and debate the weaknesses of WEP, rather than point the finger where credit is due.
A lot of people are going to be criticizing the wireless link and arguing that they should have used a physical link for this kind of stuff. The fact is, at some point you're going to have to get secure data over an insecure network, whether it be the internet or a wireless link.
If you're building a wifi link, you really should be using VPN over your WPA (not WEP!) link. If this was a database backup between servers then the protocol they were using should have been secure (SCP). If it was a client accessing resources on a server, the protocol should have been secure (https, or other ssl link).
Horns are really just a broken halo.
And shareholder's data. Make a law that puts the money-grubbing CEO and other officer's data in the databases with the customer's data. Then sit back and see what kind of directives management gives to their IT departments to secure data, networks, and workstations. But put their personal data to the same risk as what they deem is sufficient for all the people they don't know or care about. Then see how responsible they get.
(the following is speculation. TJMaxx, don't sue me, I'm not claiming to know what really went on, or real details of your network. This is just my impression from reading the story)
Yes, WEP is insecure for real stuff. It's like the little latch on a high school display case. It's to keep honest people honest. It shouldn't be used in a commercial network as the only encryption.
But what the heck kind of network design allows IPs from local stores direct access to central databases? The big issue here isn't that a few dozen or hundreds of cards were snagged by being sent through WEP -- we don't know, maybe the company ran a tunnel across that WEP link for those transactions, and they didn't get anything locally. The big issue is that it looks like the company was storing historical data on transactions online, and in databases that apparently were accessible from that link. WEP was a weak entry point to the network. But where was the security inside the network?
It sounds like possibly either the designers of the overall network hadn't limited access sufficiently to just IPs/MACs from their account department, on a secure network, or the hackers managed to break through security layers in between, perhaps by knocking over a server that was straddling networks or something. If they designed in layers, with firewalls as gatekeepers between layers and IDS and IPS monitoring, I don't think they would have servers straddling, to start. IDS and IPS would also help them notice, for example, if someone spoofed an email from a store to an accounting department person, included a trojan, and attempted to gain access that way.
I'm saying this not so much just to point out what sound like potential design issues with this company's networks, but to get people thinking about their own networks, instead of blowing this off as a WEP issue. If you administer a small network, and haven't had training on how to set it up and maintain it securely, you ought to look into Cisco's SAFE blueprint at bare minimum. It's free and the lessons can be applied to almost any brand of networking gear out there. It basically builds the network up from modules, which are easy to figure out. If you're administering a large network, well, as someone with CCSP training, I'd suggest you hire someone who's been properly trained, obviously. Cisco's track or someone else's. At the very least, everyone should consider thinking in terms of layers, like an onion, and discreet modules residing in, but not crossing, those layers. You should be really wary of any packets from across any WAN link to your core systems, obviously, but you should also set up security policies so that you know which administrative departments have access to which internal networks, too. Ask yourself, if an attacker can get into my network, what can he or she do?
One last thing: network security can't just be set up and left. It has to be monitored and maintained, both to respond to immediate attacks, and to see when people are just poking around, doing reconnaissance.
Get off my launchpad!
pre-emptively changed my Visa card number a couple months before this became public. I found out that I was not affected by this break-in later, so I'm unsure whether or not it was in response to
The question in my mind is, given the basic vulnerability of a long-term CC number, why they don't move to something like SecureId token one-time passwords? If you can have a different six digit number every sixty seconds for five years on one device, surely the same (now public domain) algorithms could be embedded in a credit card. The infrastructure for real-time verification is already in place. With one stroke, the whole CC# theft business could be out of business, and the first mover CC company on this would have a huge marketing advantage: "No one can ever steal your Visa number again".
Anyone who loves or hates any language, platform, or manufacturer, doesn't know what they're talking about.
If you had read the article, you would have noted this passage:
Whether the cash registers transmitted this sensitive data over wifi is less relevant. The problem would have been much less severe if connections to the central database had been over https or ssh.Avantslash: low-bandwidth mobile slashdot.
That's because most of the people in the IT field are pretty clueless when it comes much beyond simple coding.
The idea of putting decent security in place? It goes one of two ways, either it's a pathetic WEP thing, or it's so ridiculous that people set up their own back doors to get around it.
And when it comes to budgeting? Nobody wants to pay, they'll have a meeting where they'll use a phrase like "...it's a risk we'll have to manage..." meaning that you're not supposed to mention it anymore.
Just to repeat... the "Experts" don't have a clue about any of this. Only the Russian Mob.
This is because as a group, we are the LEAST professional of the professional vocations. With our paper MCSE's to our lack of communication skills, our refusal in some cases to "dress for success" and sometimes questionable bathing habits. Everybody who has worked in IT knows someone personally who fits this description.
You are correct, we do need organizations to screen our professionals as much as any other field. The 'soft' skills are just as important as technical prowess to be a true professional. It always helps when people assume that instead of spending all of your free time memorizing Battlestar Gallactica scripts, that you might actually have time for a girlfriend.
We did this to ourselves.
I can tell you beyond a shadow of a doubt both the big card processors and many banks knew what was going on. But they were loathe to admit it because to do so would be to admit the gaping holes in bank security. It's all based on the demand draft principle. In essence, if I knew your account number I could write it on a napkin and the bank is pretty much honor bound to cash it. Same is true for credit and debit cards except in those cases, no tangible evidence is required since it's purely electronic.
This paragraph really got me:
They were so confident of being undetected that they left encrypted messages to each other on the company's network, to tell one another which files had already been copied and avoid duplicating work. The company says the hackers may even have lifted bank-card information as customers making purchases waited for their transactions to be approved. TJX transmitted that data to banks "without encryption," it acknowledged in an SEC filing. That violates credit-card company guidelines, experts say.
So in other words, the card processor didn't care that the incoming stream wasn't encrypted? Had to be First Data or whatever they call themselves now.
The art of medicine and law is hundreds of years old, while being in "IT" spans mere decades.
We happen to be considered the so-called "quacks" of our profession: you cannot see or certify the charlatans (eg. MSCE) from the real educated people in IT.
Wait a few more decades to see the organisations emerge, IF the profession of computer-guy is being seen as an occupation in itself at all!
We've been getting our balls busted by customers to become PCI compliant so they can maintain their status with the Credit Card industry... where the hell are they when this crap goes down? Four years running a weak wep protected network and nobody bothered to question them on it?
Even Wii uses WEP. What's up with that? Saving cost for Nintendo?
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Many credit card companies now allow you to generate temporary card numbers with user-set caps on spending, on their websites.
Get off my launchpad!
Also, isn't it funny that their cheap discount brand is the one they rode in through? Ironic huh? The discount store using discount wireless security! hahaha...
So if you are watching porn on your wireless network, does this mean the same porn will be travelling physically through your neighbours at the same time?...I wonder if that might disturb somebody
I am so lucky the old teeth filings people used to be able to pick the radio up on do not come with mpeg4/2 decoders.
It's a rather frightening notion that people think of WEP or WPA as their sole means of security. The underlying data were apparently unencrypted, which implies open protocols like telnet and http. WEP was intended to make wireless as "secure" as wired networking, which means not much. WEP shouldn't be used because it's completely compromised, but even WPA shouldn't be the sole level of security. WPA should be viewed as a means to thwart casual snooping of network traffic, but I'd still hope secure data layer protocols like ssh and https are being employed, not to mention encrypting data files that contain sensitive data.
I could post a credit card number here and you could use it to buy stuff from some clueless merchant. Oh wow, I would get charged for that. Theft! Theft! Theft!
Wrong. I get the bill, look at it and call the credit card company and say I did't make those charges. They get taken off the bill and the merchant loses. Today, no matter what the merchant loses. Not the card holder and not the credit card issuer.
So what's the big problem with some credit card numbers getting out? It's a hassle for someone, but it isn't a problem for me.
Folks this is the worst of the worst. TJX has a big AS/400 core setup (google it) and unencrypted transaction data.
AS/400 staff are unbelievable ignorant about anything IT related post 1995. Encryption is miles outside of the Green Screen/RPG/clear text world of the As/400. So it doesn't surprise me that the core systems have unencrypted credit card data. The typical AS/400 staff don't know any better or realize they did anything wrong. Remember it's still 1995 to them. Don't believe me? - ask an As/400 guy for a copy of the TCP/IP routes on the 400 or what simple TCP services are running.
I'm more surprised that someone on the network/compliance side didn't raise objections to unencrypted CC transactions. These guys should know better - they have worked with IT post 1995. Other than WEP protection they had clear transmissions of transaction data. Incredibly stupid.
Maybe there is more fallout to come from the IT side of TJX? memos, emails? Why didn't SOX audits pick this up?
Congratulations to AS/400 (iseries, system i, whatever it's called this year) - Welcome to the "i got owned" club.
Just a week ago, I bought a set of equipment from a well known 5-letter corp that shall remain nameless, that doesn't work. It has WEP and 3 modes of WPA and not one of those actually work. The only way I can get a connection between the USB adaptor and the home router is in plain text. That problem used to be common some years ago, but in 2007? Sigh...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Companies should use end-to-end encryption for data links and should not rely on the simple encryption built into WiFi devices anyway. It should not matter whether WEP is working or broken. The data stream should be encrypted all the way, not just over the air.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I have done CC processing coding and after the initial transmission, subsequence transactions will be performed using the returned reference number. This is at least true for Verisign/Paypal, and it is stated clearly in their documentation NOT (read NEVER) to store the full CC number locally. Doing so is just asking for trouble.
A while back I worked at a bank (actually a holding company that owned 23 banks). ATM transactions are heavily encrypted and to the best of my knowledge are fairly safe. What is less safe is having point of sale employees with momentary access to your card (depending on their memory). Anyway, I don't worry about the ATM link encryption. Others aspects bother me though. The entire process deserves review.
Retailers use wireless for things like the portable scanners they use for inventory functions. In the past I have noticed Walmart, Target, and KMart all using Symbol PDT 6800s. As to why they only use WEP, that's all the scanners support. Early models only supported 40-bit WEP. Later releases supported 128-bit WEP and Symbol's proprietary KeyGuard, which requires using (expensive) Symbol access points. Although the PDT6800s have been end-of-lifed, you aren't going to rush out and replace them with newer tech if they are getting the job done. Not at $3k a piece. And even with the replacement, MC9000s, you have to ask yourself why their Windows Mobile OS is running a web server.
Of course a network engineer would wonder why the cash register network wasn't a secure, separate network. But rarely are networks designed by network engineers. They simply grow out of necessity.
It is amazing what you can accomplish if you do not care who gets the credit. -- Harry Truman
One of the real question is: why IEEE standardised the WEP in the first place?
If they made such basic mistakes in security on one standard, what prevents them to do other identical mistakes.
Sure, it tough to devise 100% secure scheme, but there is a huge difference between coming with say MD5 which took years to be broken and WEP which was seen as broken as soon as it was studied by security experts..
Do you know if Bob's Stores (official Red Sox blah blah) was affected, too?
My experience as a consultant delivering the bad news like (and even specificially including): "WEP has been cracked, you need to replace all your wireless access points immediately because they don't support WPA" indicates otherwise. Managers are often given many goals which are difficult to balance. Short term budget constraints are typically the foremost issue for them. Replacing systems that "work just fine" because they are vulnerable to a security defect which they don't understand is seldom high on thier "to do" list.
If I had been providing security consulting to TJX, managers all the way up the chain to the CIO would have been told over and over and over that they must consider WEP networks to be insecure and replace them.
I don't know what happened at TJX, but your assumption doesn't match my experience with other managers in orther organizations. Most IT staff and managers really didn't take the WEP crack seriously for a long, long time. Many security people had to actually demonstate the WEP crack to their managers or clents before they would take it seriously.
The only part of this story that surprises me is that we haven't heard a couple dozen identical stories from other organizations. There is no possible way that TJX is the only company to fall victim to a WEP crack.
If you mod me down, I shall become more powerful than you could possibly imagine.
Interesting euphemism for a Pringles can.
.signature not found