Slashdot Mirror
Target Credit Card Data Was Sent To a Server In Russia
angry tapir writes "The stolen credit card numbers of millions of Target shoppers took an international trip — to Russia. A peek inside the malicious software that infected Target's POS (point-of-sale) terminals is revealing more detail about the methods of the attackers as security researchers investigate one of the most devastating data breaches in history. Findings from two security companies show the attackers breached Target's network and stayed undetected for more than two weeks. Over two weeks, the malware collected 11GB of data from Target's POS terminals. The data was first quietly moved to another server on Target's network and then transmitted in chunks to a U.S.-based server that the attackers had hijacked. Logs from that compromised server show the data was moved again to a server based in Russia starting on Dec. 2."
A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.
Target's terminals are aptly named.
In Soviet Russia We Target You!
Does moving data usually make a noise?
Time for bed, said Zebedee - boing
If the attackers had left a script behind to effectively re-partition or even reformat the compromised servers' hard-drives.
But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?
has there ever been anything but criminal activity coming out of there?
Former Eastern Bloc citizens involved in credit card fraud? Hold the presses! Make way for a new headline!
In all seriousness, some of the brightest programmers I have met over the decades have been from Eastern Europe. The combination of general poverty, lack of access to modern hardware, and (?) vodka forces them to learn about the guts of the hardware in order to make do - much like the original computer hobbyist community in the U.S.
What will be interesting to watch is Putin's reaction if this highly publicized crime originated in Russia. I am sure with uncertainty about Sochi in the wings, he will bring down an - excuse the obvious pun - iron sledgehammer on the responsible parties.
Where the data stopped moving? Maybe. If their payload didn't self-destruct then they might have made an additional mistake and used too few hops during the getaway.
and then moved to Iran by North Korean hackers, I mean cybercriminals, and then used to fund terrorism by the Syrian govern- I mean regime.
Right? Gotta keep that anti-Chinese bias alive somehow.
Yes you are so correct! The People's Republic of China is governed by some of the most honest, kindhearted, honorable people in the world. Who could possibly have a bias against them?!
I mean they're so very thoughtful, when they shoot someone for having the wrong political opinion, they even send the family a bill for the bullet! It's so nice for the family members not to be forgotten during their time of grieving. Considerate! And the glorious sweatshops! What child wouldn't want to work 12hrs a day in there!
Yessir, anyone who doesn't like them is obviously biased.
They hoped China could be blamed again.
Where's our protection from Russian financial terrorists? Were the NSA employees in charge distracted by their Starbucks carmel macchiatos at the time this was coming down?
A clear instance of international crime/terrorism and NSA was asleep at the wheel.
It was Snowden
Target suffered similar data theft in 2005, and now again in 2013. By storing cardholder information, CVV's and (worst) PIN's in the clear, they obviously are not PCI DSS compliant. If this happened to any other retailer, Visa would revoke their PCI compliance status. If nothing happens regarding their PCI compliance status, what does it say about PCI compliance in general? PCI compliance is nothing but a joke, not to be taken seriously. Why even go through the work and trouble to get PCI DSS certified if companies like Target can flout the rules and get away without any penalties.
Did anyone else get an email from them offering free credit monitoring?
What's happening is that victims are canceling those cards and everyone is on the lookout for. So, when the Russian hackers try to sell or use them, they're not going to work.
Their booty is worthless.
Do they not care enough to delete the logs or are the logs on another machine somewhere above in the hierarchy?
Curiously yours, crip.
OK, so there's a lot of talk about this situation at Target. At least that one is discovered and allegedly fixed. Do these pranksters only target one store chain? Was this the easiest one to get into, and they are happy with that for now? Or are other stores similarly compromised, but either have not gone public, or do not know it yet?
Traget outsourced IT operatations and field work is subbed out as well.
So maybe the IT people within the company that see the problems and may know how to fix them are so far apart form the people who work that team that they can't get stuff down or things are setup up that way so it's easier to sub work out vs locking stuff down and giving each Subcontractor there own logins / private email / info on the system.
Using common logins / just giving the info contractors who then giving that info out to the subcontracts is easier and makes it easier to change firms on each level. But then that info may not get changes / ends in the hands of non tech people who may not give it the security it needs.
To Russia, of course. Where else? The end of an investigation. Very convenient.
Reality is usually more complicated.
I'm not going to defend Target for being embarrassingly sloppy, however, no matter how you look at it, it largely doesn't matter:
a) It's a business decision to invest in cyber-insurance or cyber-security, they picked insurance. As technical people, we like technical solutions, but maybe insurance was the right choice.
b) If a consumer gets hit by a fraudulent cc charge, they don't eat the charge. They call their cc issuer and the issuer eats the charge. That is in part what your double digit interest rate is paying for.
c) Everyone gets credit monitoring. If the credit monitoring is not snake oil, then it'll catch cc fraud that's not a direct result of this Target screw up. This may actually be a benefit. People who were dimly aware of how the cc system works will become informed. This is probably a net positive here.
d) Awareness is raised about POS security; other companies who are running the similarly secured systems may be motivated to fix it. Another net positive.
The only people getting screwed are Target (for operating a shit system) and/or the cc issuers (for permitting Target to run a shit system).
I got the email notice from Target at TWO of my email accounts that my information had been stolen.
I pored over my financial data and found that I have not used any credit card at a Target store since 2008. So, obviously the breadth and depth of this attack are a lot more extensive than what they are telling us.
Either that or Target is simply blasting everyone in their email database whether or not they believe the customer's information was stolen, which says that Target still really has no idea whose information was taken and whose wasn't.
It really is a reflection of the vast incompetency of Target management. They don't know ANYTHING, and have just been firing the shotgun since this whole story broke.
So, time for me to rant, but on-topic, for a second.
Everybody knows, I would hope, that best practice is to never allow an Internet-facing server to initiate outbound traffic. This is both because, should the server get compromised, it becomes a new attack vector - as in Code Red or SQL Slammer. This is also because, as in Target's case, it makes it fairly trivial to exfiltrate stolen data.
But services still persist that require that this very access be enabled. My current case in point: ReCAPTCHA. Google hosts the URL for this service, intended to provide additional security, on a www.google.com URL, which means that, at minimum, I have to allow outbound access from any server hosting a ReCAPTCHA on port 443 to everything Google owns. In practice, of course, it's all but impossible to keep track of Google's address space for firewall purposes, so this means that I have to allow that server out on port 443 to the entire Internet. It's either that, or set up a proxy solution that can do URL filtering and then require the CAPTCHA verification code to use that. Not exactly something your typical smaller company using ReCAPTCHA is apt to do.
I've talked to competing, for-pay, services, and they require the same thing, despite the fact that they're smaller and have only a few, well-defined networks, but they won't commit to keeping me up-to-date with network changes.
We really need to start pushing back on this crap. Servers accepting inbound traffic should never need to initiate outbound communications.
Should there be more proactive blackholing of Russia?
Is even practical given the many proxies, hacked non-Russian servers, etc?
I keep all my important financial information on servers in Eastern Europe and the Balkins.
They think they hacked me, but I'm just using them for free cloud storage.
Sig Follows: "Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." -- Mark Twain
What about having a strong Computer Engineer Order to protect the public, like all other real professions have?
They usually target more then 1 chain, but have to taylor it to each chain as the pci-dss standard is enacted differently in each chain. Usually they will breach a big chain and use the same method for others but taylor the way they do it a bit differently and most times this helps them avoid early detection. Often the breach is discovered later, much later because it was not using the same carbon copy methods that were used in another breach.
This package Does Not Contain a Winner
Unless I'm reading it wrong you're basically disabling webservices like making a SOAP call to a third party on behalf of the connecting user-agent. That's a non-starter for just about all companies that have at least one business partner.
I came to the datacenter drunk with a fake ID, don't you want to be just like me?
It would be easier to just admit that you have absolutely no idea what you're talking about than to demonstrate it so completely.
Target's security is especially lax, but part of the problem here is the POS terminals that are apparently stuck running old unpatched versions of Java. That's an industry wide problem. You can limit the exposure with proper network security, but it means if anybody does breach your security they will have no trouble escalating that into full blown card disclosure.
I read the internet for the articles.
So if the person the credit card is issued to is gay, the Russians won't use the data?
OK.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
I'm tired of those who pretend to want to help us by giving a false link by clicking on the grounds that we can watch the film for free, but in the end we are exposed to computer viruses, if you want to watch this film I suggest to you free of charge for saw this film in http://goo.gl/Yde2KF there you can watch it free or you can download it, hopefully the information I provide will help you
. . .to pay for all the security at the Olympics.
No, he just wants to have a whitelist of acceptable outbound targets, and he wants the companies in charge of them to keep him up to date. So every time a business partner gets a new IP, he wants them to somehow instantly reconfigure his whitelist securely.
My emailed offer from Target specifies Experian’s® ProtectMyID® product. Actually, it came from "target.bfi0.com", so aroused my suspicions of typical phishing scams with a legitimate name padded in front of an unknown domain. However, some searching around on this topic revealed that this is a real Target effort, and that bfi0.com is one of those outsource companies that Target uses for bulk emails (yet another stupid Target "miss" - they should at least made it look like it was from target.com).
I guess it is ok, but am holding off for a few weeks (up until the deadline) to see if any more "interesting" revelations come out about this follow-up (as in is it a follow-up attack using the emails and other PII that were also stolen?). Probably it would be a good idea to contact Experian directly to see if they are aware of, and participating, in this supposed mollification attempt by Target.
Then there is the story of Target not cooperating with someone who spotted a $1200 bogus charge on his Target card until he coughed up all kinds of PII - in violation of "official" Target policy once a Boston CBS TV station started inquiring on behalf of the individual:
http://boston.cbslocal.com/2014/01/16/target-now-offering-free-credit-monitoring-for-customers-in-massive-data-breach/
Making me think more seriously about not doing anything electronic with Target, nor using their CC elsewhere (school where my wife teaches was getting a "kickback" from Target for any CC use, so that would hurt a bit, but others do that, too). I would still deal with them on a cash basis when they have good deals, but that will inhibit the big purchases for sure (and miss out on their 5% RedCard discount).
Damn, Target, you keep being too careless/obnoxious/stupid for me to want to deal with you!
YMMV
A "business decision" to put customers at risk in expectation of being able to buy them off, is not ethical, and, in the long run, could well turn out to be a bad "business decision" if enough customers decide not to do any more business with that short-sighted, cynical business as a result. I am leaning strongly that way now...
Nope, you're free to allow traffic to specific servers and ports, just not allow everything by default. It would make attack vectors so much less effective that it should be considered worth the effort.
That's not how fraud works, economically. You've just described a number of costs, borne by various parties in a fairly-competitive economic market place, including "that's what your double digit interest rate is paying for." And the conclude that "the consumer doesn't eat the fraud."
Economic losses from fraud are first borne by the directly-impacted party, and then those economic losses are passed around the economy according to various factors like pricing power and elasticities of supply and demand. Since 70% of the economy is consumer spending, then I posit that approximately 70% of all economic losses due to fraud are borne by consumers. Might be more or less, but just because Target's 100+ million affected customers are not directly impacted financially in a first-order way does not mean that they, or all consumers, don't ever see the financial impact of this fraud. They just absorb the financial impact in a thousand minor and unseen ways, as the fraud loss is absorbed into the macro-economy and attenuates down to imperceptible levels like the CMB.
Fraud is sand in the gears of the economy, and the resulting inefficiency ultimately affects every participant in or user of that machine.
SNOOOOOWWWWDEEEENNNN!!!
The only problem here is that the credit card industry will then figure out yet another way to screw the small merchant. PCI compliance is a great idea. The various "insurance policies" and "penalty fees for PCI noncompliance" pushed by the interchange companies are a rip off and farce. They aren't going after my small business......but I'll pay more money to someone because some Russians hacked Target. Thanks !!! By the way, why do we have interchange companies anyway ???
Has anyone managed to blame this on Snowden yet?
the reason is that they have outsourced their IT to India. So, now, you have 200 IT making $10K/year, who are not very well educated, and are not strong coders. They work for a company that employs ~250 ppl who have NO loyalty to a foreign company. After all, they have NO shops in India. Along comes somebody from Russia or China and offers just 1 person $100-200K to release a virus on the network. That money will set that person's extend family up for 5-10 years. And if that coder uses it just for his/her immediate family, they retire.
Now, to really make this interesting, they installed other trojans at the same time that it was spreading. If the systems are not all replaced in roughly the same time frame, then the trojans can simply move around. And in a couple of years, they can then re-start things up.
As long as America uses Windows for POSs, Mag stripe cards and outsources their work, they will continue to get ripped off.
I prefer the "u" in honour as it seems to be missing these days.
http://articles.timesofindia.indiatimes.com/2011-07-21/strategy/29799173_1_retail-industry-outsourcing-vendors