Slashdot Mirror
TJX Security Breach Described
Bunderfeld notes more details coming out about how bad guys got into the TJX network. Last time we discussed this, the best information indicated that a WEP crack had started the ball rolling. Now we learn that instead, or in addition: "Poorly secured in-store computer kiosks are at least partly to blame for acting as gateways to the company's IT systems, InformationWeek has learned. According to a source familiar with the investigation who requested anonymity, the kiosks, located in many of TJX's retail stores, let people apply for jobs electronically but also allowed direct access to the company's network, as they weren't protected by firewalls. 'The people who started the breach opened up the back of those terminals and used USB drives to load software onto those terminals,' says the source. In a March filing with the Securities and Exchange Commission, TJX acknowledged finding 'suspicious software' on its computer systems."
Sounds to me like incompetence. You're a big company, pay for people to look after your infrastructure... ... I hate it when publicly traded companies cut corners to put that stock price up just a fraction of a nanocent.
-- incubus
Sticking feathers up your butt does not make you a chicken.
THE HAXXXXXXXX
Once again, a firewall would not help. If these kiosks can connect to a central computer for their normal business, then the attack vector could be through that.
I'm sick of people saying firewalls cure everything. They do not. More often they cause problems. The real issue is application security. Always has been.
the blame game!
The same kiosks that print out gift registries can be turned into kiosks that print out credit cards to pay for the purchase!
I'm rapidly strengthening my belief that this will not be the only company (large or small) to go through this - that many, many other companies are probably having the same done to them *right now* and don't even know it!
:(
This is a really crappy situation; it shouldn't have happened and frankly the entry points described here are a result of negligence plain and simple! But its hard; its hard to manage a large organisation and to enforce correct and watertight procedures; security is a hard concept, one of continuous cat and mouse - but played out in your mind - hoping to God never in reality.
Everything gets more complex, and things are more often set up and run by muppets. There will be many more of these
I love it how people talk about how they're using "encryption" when possessing the algorithm is enough to break it.
Idiots.
http://outcampaign.org/
Was shaping up to be a decent tech article until this. I don't know what irks me more about this quote:
- Needing to define an old-ass term like wardriving
- defining it as poaching
- "putting" the "word" in "quotes" (I can just see the author's fingers in the air)
Firewalls, disabling usb, corporate LAN, etc are tossed around freely... why jack with wardrivers?
I am billdar, and I approve this message.
It's only a matter of time. The problem described is not isolated, it's symptomatic for a very large amount of companies.
What do we have:
1. A company with many kiosks/outlets/POS
2. A company network with the doctrine that everything "outside" needs to be kept out, while the "inside" has far too high privileges.
3. Untrained, unskilled and "do we need to pay minimum wage?" staff at the POS.
It is fairly easy to get a job at one of those POS. Hire and fire. You want it, you have it. No background check, no security check. You're simply assumed to be a vegetable because, well, if you had some kinda skill, you wouldn't work for 5 bucks an hour. You'd be a consultant for 50 an hour.
It's usually trivial to circumvent the security between the company's computer network and the POS, if there is one at all. Let me ramble about an audit for a moment.
We did an audit for some company. All went fairly well, an "outsider" would've had a very hard time getting past the walls and checks. All POS were VPN connected to the main network, secured again with various (IMO superfluous) encryption, so a mitm attack would've been fruitless either. Good security, overall.
Until we checked the POS computers and found pretty much everything you needed to get access to the servers in the main office. You had the complete set of private keys (yes, all, including accounting, administration and the CEOs), the admin passwords were the same in every POS and inside the main network. You hack a POS, you hack the company.
Facing this, the response was akin to "What do you want? The people in our POS' can barely turn the computer on, that's no threat."
Maybe not. But if I wanted to hack that company (or any company), I'd first of all try to get a vegetable job at a POS. It's usually a quite good way to gain access to more than you could ask for.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
'The people who started the breach opened up the back of those terminals and used USB drives to load software onto those terminals'
No one noticed the guys opening the backs of these terminals in the middle of the store? Sounds like there store security is worse than the network security. I would hate to see how much they write off each year to theft.
Life is pain. Anyone who says differently is selling something.
Well, if THAT isn't an incentive to go start looking for work, I don't know what is!
Another company I worked for. It uses a VB based tool to update the jobs of its traveling salesmen and repair staff. Said tool uses DCOM (don't ask...) to connect to its server, which runs an SQL database. The user used to make those connections has top privileges, including altering the database and any (not just the specific user's) data. Mostly because all the users use the same username/password combination, which is of course stored within the binary used to make the transfer.
It's trivial to dig that user/pass combination out of the code. It's also trivial to get access to the code, all you have to do is to steal one of the notebooks. Or, to make it simple, just download it from the internal homepage (so everyone working in this company at the very least has access to the tool and thus to the user/pass combination). With it, you have all the necessary information to feed the database incorrect data, change prices, change orders and repair jobs, change car and tool assignments and of course, if you're so inclined, simply corrupt the database or drop it altogether.
This is an international company, the stock of which is traded at the NY stock exchange. Thus, it complies (with this security hole large enough to shove planets through) with the requirements of the Sarbanes-Oxley Act.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You'd be surprised what people let you have access to if you're wearing some shirt that looks official (like TJMaxx or Verizon)..oh we're just upgrading the Kiosks.
Who here has gotten a free year with a credit watchdog service due to your information having been leaked by some company you dealt with? (The letter I got actually said that my information was put at risk due to some kind of sloppy law enforcement access. WTF?)
I normally hate calling for more laws but there should be more severe penalties for this kind of error. Otherwise... it will keep happening.
So let me get this straight, the data thieves had physical access to a computer on the stores network. Sounds like a physical security issue that a security guard should have noticed. Not all computer and network security is electronics and software. Sometimes you gotta watch who you let in the store and watch what they are doing once inside.
I've applied for job in retail once before. I went to a store and they had placed the units near a corner next to the bathroom. Their view was obscurred by a rack of greeting cards. Even though they had the application blocking access to the desktop; I could have easily rebooted the machine by either pressing reset.
After that I could have worked quickly to either access the BIOS and slip in a password wiping utility disk and create an account for myself. I guess after that; installing third party apps to establish access to it from home would have been the next step. Probably restarting(after the aforementioned)the system and claiming the machine had died while I was writting to the application would have made it looked like I genuinely had a problem.
I've never done this (I'm probably clueless but I don't think it's hard, right?)but if people working in teams took similar steps; their profile would have been reduced. They could easily accomplish some major damage over long period of time.
In fact if they constructed a special application on a USB stick that wrote to the Windows SAM on a reboot and wiped out the admin password, or created and an administrative account which in turn relayed system information remotely via smtp or another way; then the hard work is over. All it would take was for someone to go to the kiosk. Pretend to write to the store application, drop their pen, bend over under the desk, and insert the USB device, and reset the computer. Next, send someone later to retrieve the USB stick to remove the evidence.
I've never done this but If I can imagine this; then I would take precautions as best I could to prevent this. I'm sure the techncians would have gotten around to securing the kiosks but like most IT departments; they are really pressed for time and stretched dangeroulsy thin. Scary stuff!
Ten to one, we hear next week that some large repository of Student papers is vulnerable too.
What the heck is TJX? I've never heard of it.
(checks article)
Oh... the none-name corporate parent of TJ Maxx and Marshalls... why the heck didn't the author just say so? I mean seriously... how many people have ever heard of that company name? It's hardly a tech company, either, so it's not like Slashdot is some unusual audience where TJX is a company on the tip of everyone's tongue.
are designed for this type of system. If your application is secure enough to live on the internet, then it is secure enough to be used on an intranet with thin clients.
Most thin clients out of the box boot with a low-privilege account. You can even set up some to "reimage" their flash memory on each boot (or boot disklessly from a central image server). Think someone compromised a system? Lockdown passwords on your master image and reboot all the terminals. No changes should be able to be made to the system without elevating to root or administrator.
Seriously - carving up your network and firewalling everything two ways to sunday is great, but this problem could have been simply solved with a little bit of thought ahead of implementation.
-ted
We gave up our financial security for convienence.
Instant credit at stores, Drive the car off the lot today, get a cell phone in 10 minutes...
Maybe, instead of the consumers credit rating being damaged when a business gives credit without solid proof of indentity, the company needs to eat the loss.
I wonder if anyones tried sueing a company for Slander/Libel over a false credit report entry...
Linux?
; en-us;555324&sd=rss&spid=3198 And then there's the very permeable "user mode" security that isn't what it claims to be.
Let's assume the kiosk distro has hotplugging enabled. Flash drive mounts, But the files.... Are not executable! So, the hostile doesn't have the opportunity to change permissions much less execute something on a flash drive.
OSX?
Flashdrive mounts. Hmmm can't install anything without su/sudo.
Windows?
Hmm... Sure, there is an enourmously complicated policy system. But none of which sets noexec on everything on a flash drive... http://support.microsoft.com/default.aspx?scid=kb
Got Trader Joe's? friendwich.com RSS feeds work now!
I called this the "TJ Maxx Effect". Yes, I shop there; it's near my house and I can usually do better on housewares and necessary items than I could do even in thrift stores.
So anyway, the "Effect" is this: If you are shopping, and you take an interest in some category of items, say, curtain rods, and another shopper sees you checking out curtain rods, all of a sudden *they* are interested in curtain rods. Same thing happens if you look in the towel aisle. Someone who wasn't looking at towels suddenly needs to crowd into your space to look at towels as well. I've observed this phenomenon numerous times and particularly at TJ Maxx, and I believe the psychology of it is "they" don't want "you" to get a deal that they missed out on.
To be fair, sometimes there really are awesome deals to be had, because the people setting the prices don't tend to be particularly savvy as to desirability of certain kinds of items. For instance, I got a JA Henckel knife set -- a really high quality made in Spain set -- that was priced the same as another made in China set. These are completely different products, massively differently priced in retail stores, and the TJ Maxx manager didn't know. (I'm not above capitalizing on the misfortune of others.)
Anyway, as for the article, I got as far as realizing that physical access means you have the keys to the store, so to speak. At my local store, the clerks watch the application machine, as well as everything else in the shop, like a hawk. I get the impression that shoplifting is more common in discount stores than in regular retail stores; maybe I can study this and name THAT effect as well.
-fb Everything not expressly forbidden is now mandatory.
If you are aware of a serious crime that has gone down,. you are supposed to report it. No NDA shields you from that responsibility. You are not required to do anything about it, but you have to report it.
Try harder!
A set of coveralls and a nametag that says "Bob" will get you access that a suit and tie never would.
I take it you aren't a Windows sysadmin then. You can very easily set 'noexec' on a flash drive (or any other path / volume) using Software Restriction Policy built into XP and Server 2003. That link is a quick tutorial for setting up SRP for a 'default disallow' that only allows the execution of files in the program files and windows directories, all other areas are 'noexec'. When used in combination with a Windows LUA account (restricted user) this will stop the execution of unauthorised files, since LUA accounts can only write to their own profile (home) folders.
I'm surprised that no one has come out with Bastille-like hardening scripts for Windows?
PCI compliancy does not prohibit the storage of major cardholder information. As quoted form teh PCI Audit Procedures document:
3.1 Keep cardholder data storage
to a minimum. Develop a data
retention and disposal policy. Limit
storage amount and retention time to
that which is required for business,
legal, and/or regulatory purposes, as
documented in the data retention
policy.