Slashdot Mirror
TJX Breach Began With WEP Crack
An anonymous reader sends us to the Wall Street Journal for a detailed report on what is known to date about the TJX data breach. It seems that the loss of over 45 million credit card numbers and more than 450,000 SSNs, driver's license numbers, and military identifications began with someone using a "telescope-shaped" antenna at a wireless link at a Marshall's near St. Paul, Minnesota in July 2005. The link was encrypted using WEP, which had been known to be broken since 2001. The crackers who got into the TJX central databases are believed to be Romanians or Russians with ties to the Russian mobs. The eventual cost of the TXJ fiasco could exceed $1 billion — not including the numerous lawsuits filed against the retailer.
TFA says "A person familiar with the firm's internal investigation says they may have grabbed as many as 200 million card numbers all told from four years' records."
Gets better, doesn't it?
The damage that such a recall would have in terms of liability, lost profit, and plain flat out admitting that they royally screwed the pooch is so enormous that, in the interest of promoting the free world, we simply can't allow it.
If you continue to press your treasonous assertions you can and will be sent to Gitmo for social reconditioning: do not mess with their profit margin.
the NPG electrode was replaced with carbon blac
WEP is 'good enough' for running your home network. It lets the neighbors now to keep out, like a lock on the door.
Like any lock, (including WPA, no?) you can beat it with enough hardware.
If you're that paranoid, you're running a wired network anyway, right?
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
At this point in time, WEP is more like the lock on your bathroom door. Fine to let people know that you don't want visitors, but not really designed to keep anyone out who wants to get in.
WPA is more like a front-door with a keylock and a deadbolt. Someone could break in, but they'd have to at least take a little more trouble than pulling a coin out of their pocket like you can do with "interior" locks.
If it's something you need to be secure, then yeah, you should be running encrypted traffic over a physically secure wired connection, not broadcasting everything to the neighborhood.
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
Which brings us to the question of why a major retailler is using wireless in the first place. I'm personally no more than an interested amatur, but I've read professionals running corperate networks who, if they have to include a wireless component at all, keep it completely seperate from the secure, WIRED, network. You get internet access, but no accessing the company databases from the wireless. Can anyone come up with a scenario where it would be ESSENTIAL for store operations to be able to send SSNs and drivers license #s over a wireless connection?
It's ironic really. Many thought it might be some insider job, a complicated back door, some flaw in an internet facing system - but no. The company was daft enough to put their internal data over a network that is explicitly designed to get around physical barriers to access, and no one, and I mean no one, seems to understand this.
A friend of mine has a reasonable but small IT business in the UK, and recently he started pushing the wireless expertise side - setting up wireless networks, explaining why they are a bigger risk than a wired network, securing them (and what do do if you are really paranoid) and trying to guarantee QoS more by setting it up correctly. Positioning your access points properly, doing wireless scanning to pick out any interference spots etc.
No one is interested, and I don't just mean small businesses, but some quite large companies who should know an awful lot better. It's not a UK thing either, because most people believe setting up a wireless network is about popping down to the local store, picking up a Netgear, switching it on and letting Windows attach you to the nearest wireless network it can find. Astonishing.
The only thing that shocks me is that this doesn't happen all the time, because many networks are just an open invitation. I mean OK, it's not that easy because you have to watch the network traffic and find out where the useful juicy bits of data are. That isn't completely straightforward, but once you are inside an average company's network it's doable because everything tends to act as if it is safe and fenced off.
WEP comprimised the communication of one retail store. Apparently enough information was stored in that one store to compromise a database with 4 years of records. So, an inside job at that level (assistant cashier probably had enough access to their wires) would be trivial. A better question... why would 4 years of CC number, etc. be accessible over the internet at all. Why not have that server offline, with updates posted occassionally via sneakernet? And hash the CC numbers. And otherwise, protect consumer information.
Your ad here. Ask me how!
If there are older devices that only support WEP, those can be moved to a separate router and firewalled/VLAN/etc.
I wonder how much money the 'Credit Monitoring' services make out with all these breeches?
It seems to me the only solution to this is to pass strong data ownership protections for consumers. Right now, the companies place very little value on the data (except for marketing/advertising purposes), but this needs to change somehow.
There needs to be some sort of data protection regulation, but there also needs to be some legislation that says that I'm not responsible for anything and everything that somebody impersonating me does, simply because I'm in no position to prevent those attempts. At the moment, individuals bear the brunt of the consequences when a credit card issuer gives a card to somebody committing fraud; that's insane, the issuer should be forced to face the consequences, because then they would quickly become much more careful about finding out who their customers are.
Nerd rage is the funniest rage.
(the following is speculation. TJMaxx, don't sue me, I'm not claiming to know what really went on, or real details of your network. This is just my impression from reading the story)
Yes, WEP is insecure for real stuff. It's like the little latch on a high school display case. It's to keep honest people honest. It shouldn't be used in a commercial network as the only encryption.
But what the heck kind of network design allows IPs from local stores direct access to central databases? The big issue here isn't that a few dozen or hundreds of cards were snagged by being sent through WEP -- we don't know, maybe the company ran a tunnel across that WEP link for those transactions, and they didn't get anything locally. The big issue is that it looks like the company was storing historical data on transactions online, and in databases that apparently were accessible from that link. WEP was a weak entry point to the network. But where was the security inside the network?
It sounds like possibly either the designers of the overall network hadn't limited access sufficiently to just IPs/MACs from their account department, on a secure network, or the hackers managed to break through security layers in between, perhaps by knocking over a server that was straddling networks or something. If they designed in layers, with firewalls as gatekeepers between layers and IDS and IPS monitoring, I don't think they would have servers straddling, to start. IDS and IPS would also help them notice, for example, if someone spoofed an email from a store to an accounting department person, included a trojan, and attempted to gain access that way.
I'm saying this not so much just to point out what sound like potential design issues with this company's networks, but to get people thinking about their own networks, instead of blowing this off as a WEP issue. If you administer a small network, and haven't had training on how to set it up and maintain it securely, you ought to look into Cisco's SAFE blueprint at bare minimum. It's free and the lessons can be applied to almost any brand of networking gear out there. It basically builds the network up from modules, which are easy to figure out. If you're administering a large network, well, as someone with CCSP training, I'd suggest you hire someone who's been properly trained, obviously. Cisco's track or someone else's. At the very least, everyone should consider thinking in terms of layers, like an onion, and discreet modules residing in, but not crossing, those layers. You should be really wary of any packets from across any WAN link to your core systems, obviously, but you should also set up security policies so that you know which administrative departments have access to which internal networks, too. Ask yourself, if an attacker can get into my network, what can he or she do?
One last thing: network security can't just be set up and left. It has to be monitored and maintained, both to respond to immediate attacks, and to see when people are just poking around, doing reconnaissance.
Get off my launchpad!
Sure, or maybe the "I have a business major and/or MBA!" Senior Execs who the IT managers undoubtedly report to, need to get a clue and allocate a real budget to their IT staff.
I bet replacing/upgrading/changing the hardware/software that was to blame across TJX's entire corporate infrastructure would have cost much less than the $1 billion dollars that dealing with the current situation could purportedly cost.
[Rant begins here]Now I'm not saying the IT management were blameless either. But the greater issue IMHO is that IT is treated with disdain. IT managers are often treated as something to be tolerated by businesses. This is a horrible backwards, outdated mindset. Unfortunately, IT professionals seem to be doing very little to change this.
At this point, IT is vital, vital to any $10M/year or higher in revenues (to pick an arbitrary number) business. But it is often treated as though it's some glorified janitorial service. Attention MBAs, IT is not there to clean up your screwed up PC and make sure your blackberry works. Sure, that's part of their bailiwick, but until corporate managers start realizing that their business live and die by their IT infrastructure (as the TJX debacle clearly demonstrates), these mistakes will happen over and over again.
The other side of the coin are the people who work in IT itself. I don't know if it's because we were the ones who were picked on in junior high, or what. But I do know that IT professionals are the most ill-treated group of highly-skilled professionals around. Why there isn't some sort of real guild/league/association of IT professionals eludes me. Look at doctors and lawyers. They have the AMA, and the bar (forgive me if my details here aren't exactly correct, but I think my point is clear), they have specialized degrees, and they don't take sh*t from anyone. Why because they know they have unique knowledge and they expect to be compensated accordingly. And when someone tries to muck up their good racket they have going, their professional organizations lobby groups kick into high gear and start shredding whoever it is that wants to take their candy.
On the other hand, when anyone even tries to mention the idea of some formalized "union-like" IT organization, all of the IT types start screaming bloody murder, and all this weird pseudo-libertarian, free market babble starts gurgling out from their pie holes. Attention IT professionals, this isn't about political philosophy. It's about fighting, scratching, "give me my piece of the pie you *sshole" capitalism. IT professionals need to wake up and take control of their situation. I assure you the big boys at the top of the heap love watching you scramble about at their beckon call while their billions of dollars are funneled through systems you keep running with wire and glue because you don't want to rock the boat by asking for a bigger, strike that, realistic budget.
I'm not sure what the right steps would be to start moving towards forming a professional IT organization with real power (as in you can't get jack done on your computers unless you use someone from our guild anymore than you can litigate or perform surgery with out a bar certified lawyer or board certified doctor), but until that happens, IT workers will be thralls and TJX's and TSA laptop debacles, and IBM outsourcing hoo-ha's etc. will happen based solely on the whims of people who think that Excel macros are software and phone cords are what connect computers on a LAN. And just to be clear, Microsoft, ITT Tech, COMP-TIA, CISCO certifications do not cut the mustard as they do not exist to help you in anyway. The benefit you gain is a sliver of what the organizations who dole them out make from your labor.[Rant ends here]
If you had read the article, you would have noted this passage:
Whether the cash registers transmitted this sensitive data over wifi is less relevant. The problem would have been much less severe if connections to the central database had been over https or ssh.Avantslash: low-bandwidth mobile slashdot.
This is because as a group, we are the LEAST professional of the professional vocations. With our paper MCSE's to our lack of communication skills, our refusal in some cases to "dress for success" and sometimes questionable bathing habits. Everybody who has worked in IT knows someone personally who fits this description.
You are correct, we do need organizations to screen our professionals as much as any other field. The 'soft' skills are just as important as technical prowess to be a true professional. It always helps when people assume that instead of spending all of your free time memorizing Battlestar Gallactica scripts, that you might actually have time for a girlfriend.
We did this to ourselves.
It's a rather frightening notion that people think of WEP or WPA as their sole means of security. The underlying data were apparently unencrypted, which implies open protocols like telnet and http. WEP was intended to make wireless as "secure" as wired networking, which means not much. WEP shouldn't be used because it's completely compromised, but even WPA shouldn't be the sole level of security. WPA should be viewed as a means to thwart casual snooping of network traffic, but I'd still hope secure data layer protocols like ssh and https are being employed, not to mention encrypting data files that contain sensitive data.
The real way to secure a wireless connection is to set the wireless devices outside the network and VPN any access that needs to be inside the network. It is difficult and sometimes expensive but thats what really needs to be done. End then your not completley safe, you just have one more layer to defeat. And if you IDS is functioning properly, it should alert you to most attempts and possible sever the connection.
I have talked to (business) customers who had their "son" or neighbor who is a part time rocket scientist put wireless in because they didn't want to run cables and I have cracked it while letting them tell us how secure it is. I'm not using anything special either, it is just commonly available script kiddie tools.
I'm not knocking WPA, I just know physical access to the network is a key part of any security. You wouldn't run a couple ports out to the street for anyone to connect to and do whatever. This is essentially what your doing with wireless. And once they do "whatever", you need another layer that you can detect intrusions with before the real network gets accessed in order to remain secure.