Slashdot Mirror
Details Emerge of 2006 Wal-Mart Hack
plover writes "Kim Zetter of Wired documents an extensive hack of Wal-Mart that took place in 2005-2006. She goes into great detail about the investigation and what the investigators found, including that the hackers made copies of their point-of-sale source code, and that they ran l0phtCrack on a Wal-Mart server. 'Wal-Mart uncovered the breach in November 2006, after a fortuitous server crash led administrators to a password-cracking tool that had been surreptitiously installed on one of its servers. Wal-Mart's initial probe traced the intrusion to a compromised VPN account, and from there to a computer in Minsk, Belarus.' Wal-mart has long since fixed the flaws that allowed the compromise, and confirmed that no customer data was lost in the hack — which is why they did not need to report the breach publicly earlier." This intrusion happened around the same time that Albert Gonzalez's gang was breaking into Marshall's and its parent company, TJX. The MO was quite similar: researching and closely targeting the point-of-sale systems in use. But the article notes that "There's no evidence Wired.com has seen linking Gonzalez to the Wal-Mart breach."
when you can just pay for everything with a million dollar bill?
<Complete your profile by adding a signature!>
Someone had installed L0phtcrack, a password-cracking tool, onto the system, which crashed the server when the intruder tried to launch the program.
Linux would not have crashed from a mere userspace program ;) Windows saved the day! Hooray!
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Surely they could have dumped the user accounts from AD (like the SAM under NT) and crack all the accounts on a remote machine. Then maybe it wouldn't have even been noticed. And if the POS software was secure, it should not matter if someone downloaded the source code.
Who will guard the guards?
...no customer data was lost in the hack.
Surely they didn't simply notice it quickly enough that the hacker didn't have time to grab anything... So why go through all the trouble if he's not going to take anything?
Was it just for lols?
I can't help but wonder if it was related to this:
http://www.orlandosentinel.com/news/local/breakingnews/orl-bk-walmart-safe-heist-100909,0,3026268.story
And if the POS software was secure, it should not matter if someone downloaded the source code.
That depends on whether the source code was stored separately to certificates/key files and how well the passwords were externalised. You'd be surprised how modern security systems allow and even encourage awful practices in this regard. For example Spring web services and spring security have a bad tendancy of including such things in their config file, which are often bundled up in the application.
It's actually not a trivial problem. If you include everything required for the app to run in the application package/bundle, you inevitably include such things somewhere they shouldn't be (even if that's just a build machine). The best solution I've seen is hardware security modules that don't allow keys and certificates to be exported. They aren't cheap but if you're running a large organisation and have been trusted with potentially millions of credit card numbers it's not exactly beyond the call.
These posts express my own personal views, not those of my employer
Did anyone else jump to the same conclusion or have i been gaming too much? Now i might RTFA. :o
It seems kind of silly for the US Attorney General to hack into Marshall's.
Isn't that what the NSA does for him?
Forget the POS software and whether it was secure or not.. looks like Wal-Mart did not follow some basic security practices
According to this blog:
This what they for have the lowest cost IT workers and outsourcing IT work.
But, why would the Attorney General have wanted to hack WalMart? What can this mean? Conspiracy theories abound...
Wal-mart's Chief Privacy Officer http://www.microsoft.com/presspass/features/2004/oct04/10-28privacy.mspx">took home a privacy innovation award for non-profits while Microsoft took home the corporate award when she worked for USPS.
Albert Gonzalez, not to be confused with the former US Attorney General, Alberto Gonzalez.
to use green backs. Also cultivate the habit of not spending the money you don't have...
ELOI, ELOI, LAMA SABACHTHANI!?
You're assuming the certificate is used immediately to establish a connection.
No, I'm not. Where did I say that?
Point of sale terminals are not always on-line, and when they are off-line they must encrypt the authorization request and store it until it can be sent to the settlement system once they're back on-line.
Encryption and authentication (signing) are two different things. You almost certainly want both but you can encrypt without authenticating and vice versa.
In that case, the terminal really needs to assure itself that the certificate is valid, because it might not be able to attempt the decryption until long after the customer has left with your merchandise and their charge card.
First as you've probably conceded unless you replace the certificates at both ends, you won't authenticate or encrypt/decrypt the message or both so that it's recognised at the other end. So the funds don't get transfered.
As for merchandise leaving the store, once your POS is compromised, it's compromised. You can replace the entire set of certificates. You can even make the terminal pretend it has gone out and connected with the bank and transfered the money. There is NOTHING you can do to ensure that the certificates you have cached and the software you have aren't compromised to allow the sale to go through, since anything you are relying on to authenticate can itself be compromised.
I'm pretty certain you don't know what you're talking about, and that's dangerous if you're advising others on security.
These posts express my own personal views, not those of my employer
The POS controllers only store the current day and the day prior. Complete transaction logs (electronic reciept transcriptions, basically) were kept containing full account numbers up until a few years ago, but have now been purged of all but the last 4 digits of any sort of financial data (credit/debit, gift card, check routing numbers).
Any paper copies of this data should also have cycled to the shredder by now, too.
Is this information about POS backends still valid?
FTA:
"Wal-Mart has thousands of servers nationwide, and any one of them crashing would ordinarily be a routine event."
"Someone had installed L0phtcrack, a password-cracking tool, onto the system, which //crashed the server// when the intruder tried to launch the program." [emph. added]
From http://www.sco.com/company/success/story.html?ID=21 :
"Nearly all of the 350 chains using PDI/RMS are deployed on SCO UNIX® technology [...]"
"McLane Co., Wal-Mart's wholesale subsidiary, acquired PDI in 1991. Fischer says one goal of the acquisition was to achieve tighter integration with some of the 30,000 c-stores that McLane serves. However, PDI continues to operate as a stand-alone entity and many of its customers are served by other wholesalers."
JeR
... looks like Wal-Mart did not follow some basic security practices...
Oh, that's so funny it hurts. I think my ears are bleeding.
This wouldn't be a case of "you get what you pay for" now would it?
Do not mock my vision of impractical footwear
Damnit!
Oh well, I tried. I guess I have to pay for stuff now.
What does "compromised VPN account" mean? did the hackers find the password of the user? the article does not explain that.
One of the first things that stood out, they said was, that a Canadian employee that was let go that still had an active account.
Then another, then another, seems the Canadian admins are not doing their jobs properly, hopefully this was rectified, and scripts were created for easy deletion / or suspension of accounts of employees let go.
This what they for have the lowest cost IT workers
I that you a verb or two.
Posting AC because Wal-Mart is one of our customers... they may have a fuckton of money, but they are VERY stingy with it. They demand all kinds of documentation on support hours over and above what most other places do, and try to play major hardball with us to try to get the price down, which doesn't happen with ANY of our other clients because they realize we provide a unique service that they just can't get anywhere else. The cheapness at Wal-Mart is endemic. And cheapness is a very different beast from thrift.
confirmed that no customer data was lost in the hack
That's exactly what the data thieves wanted them to confirm.
I hope English isn't your first language.
This what they for have....
I assume you mean "This is what they get for having...."
In which case, you're absolutely right.
"City hall" in German is "Rathaus" Kinda explains a few things......
Ehm, WTF, I don't think customers wouldn't be all to miffed about all that data these chains collect on them being lost. I wouldn't care, I would actually love the option to have them NOT KEEP DATA ON ME. What customers would love to hear and need to be made aware about is if the hackers copied all that data, who gives a freck if it was lost.