Slashdot Mirror
Target Credit Card Data Was Sent To a Server In Russia
angry tapir writes "The stolen credit card numbers of millions of Target shoppers took an international trip — to Russia. A peek inside the malicious software that infected Target's POS (point-of-sale) terminals is revealing more detail about the methods of the attackers as security researchers investigate one of the most devastating data breaches in history. Findings from two security companies show the attackers breached Target's network and stayed undetected for more than two weeks. Over two weeks, the malware collected 11GB of data from Target's POS terminals. The data was first quietly moved to another server on Target's network and then transmitted in chunks to a U.S.-based server that the attackers had hijacked. Logs from that compromised server show the data was moved again to a server based in Russia starting on Dec. 2."
A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.
Target's terminals are aptly named.
In Soviet Russia We Target You!
Does moving data usually make a noise?
Time for bed, said Zebedee - boing
If the attackers had left a script behind to effectively re-partition or even reformat the compromised servers' hard-drives.
But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?
Where's our protection from Russian financial terrorists? Were the NSA employees in charge distracted by their Starbucks carmel macchiatos at the time this was coming down?
A clear instance of international crime/terrorism and NSA was asleep at the wheel.
Target suffered similar data theft in 2005, and now again in 2013. By storing cardholder information, CVV's and (worst) PIN's in the clear, they obviously are not PCI DSS compliant. If this happened to any other retailer, Visa would revoke their PCI compliance status. If nothing happens regarding their PCI compliance status, what does it say about PCI compliance in general? PCI compliance is nothing but a joke, not to be taken seriously. Why even go through the work and trouble to get PCI DSS certified if companies like Target can flout the rules and get away without any penalties.
Did anyone else get an email from them offering free credit monitoring?
Do they not care enough to delete the logs or are the logs on another machine somewhere above in the hierarchy?
Curiously yours, crip.
OK, so there's a lot of talk about this situation at Target. At least that one is discovered and allegedly fixed. Do these pranksters only target one store chain? Was this the easiest one to get into, and they are happy with that for now? Or are other stores similarly compromised, but either have not gone public, or do not know it yet?
Traget outsourced IT operatations and field work is subbed out as well.
So maybe the IT people within the company that see the problems and may know how to fix them are so far apart form the people who work that team that they can't get stuff down or things are setup up that way so it's easier to sub work out vs locking stuff down and giving each Subcontractor there own logins / private email / info on the system.
Using common logins / just giving the info contractors who then giving that info out to the subcontracts is easier and makes it easier to change firms on each level. But then that info may not get changes / ends in the hands of non tech people who may not give it the security it needs.
To Russia, of course. Where else? The end of an investigation. Very convenient.
Reality is usually more complicated.
I'm not going to defend Target for being embarrassingly sloppy, however, no matter how you look at it, it largely doesn't matter:
a) It's a business decision to invest in cyber-insurance or cyber-security, they picked insurance. As technical people, we like technical solutions, but maybe insurance was the right choice.
b) If a consumer gets hit by a fraudulent cc charge, they don't eat the charge. They call their cc issuer and the issuer eats the charge. That is in part what your double digit interest rate is paying for.
c) Everyone gets credit monitoring. If the credit monitoring is not snake oil, then it'll catch cc fraud that's not a direct result of this Target screw up. This may actually be a benefit. People who were dimly aware of how the cc system works will become informed. This is probably a net positive here.
d) Awareness is raised about POS security; other companies who are running the similarly secured systems may be motivated to fix it. Another net positive.
The only people getting screwed are Target (for operating a shit system) and/or the cc issuers (for permitting Target to run a shit system).
I got the email notice from Target at TWO of my email accounts that my information had been stolen.
I pored over my financial data and found that I have not used any credit card at a Target store since 2008. So, obviously the breadth and depth of this attack are a lot more extensive than what they are telling us.
Either that or Target is simply blasting everyone in their email database whether or not they believe the customer's information was stolen, which says that Target still really has no idea whose information was taken and whose wasn't.
It really is a reflection of the vast incompetency of Target management. They don't know ANYTHING, and have just been firing the shotgun since this whole story broke.
So, time for me to rant, but on-topic, for a second.
Everybody knows, I would hope, that best practice is to never allow an Internet-facing server to initiate outbound traffic. This is both because, should the server get compromised, it becomes a new attack vector - as in Code Red or SQL Slammer. This is also because, as in Target's case, it makes it fairly trivial to exfiltrate stolen data.
But services still persist that require that this very access be enabled. My current case in point: ReCAPTCHA. Google hosts the URL for this service, intended to provide additional security, on a www.google.com URL, which means that, at minimum, I have to allow outbound access from any server hosting a ReCAPTCHA on port 443 to everything Google owns. In practice, of course, it's all but impossible to keep track of Google's address space for firewall purposes, so this means that I have to allow that server out on port 443 to the entire Internet. It's either that, or set up a proxy solution that can do URL filtering and then require the CAPTCHA verification code to use that. Not exactly something your typical smaller company using ReCAPTCHA is apt to do.
I've talked to competing, for-pay, services, and they require the same thing, despite the fact that they're smaller and have only a few, well-defined networks, but they won't commit to keeping me up-to-date with network changes.
We really need to start pushing back on this crap. Servers accepting inbound traffic should never need to initiate outbound communications.
Should there be more proactive blackholing of Russia?
Is even practical given the many proxies, hacked non-Russian servers, etc?
I keep all my important financial information on servers in Eastern Europe and the Balkins.
They think they hacked me, but I'm just using them for free cloud storage.
Sig Follows: "Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." -- Mark Twain
They usually target more then 1 chain, but have to taylor it to each chain as the pci-dss standard is enacted differently in each chain. Usually they will breach a big chain and use the same method for others but taylor the way they do it a bit differently and most times this helps them avoid early detection. Often the breach is discovered later, much later because it was not using the same carbon copy methods that were used in another breach.
This package Does Not Contain a Winner
What's happening is that victims are canceling those cards and everyone is on the lookout for. So, when the Russian hackers try to sell or use them, they're not going to work.
Their booty is worthless.
Who's to say this wasn't the goal? Perhaps the actual goal was to adversely affect Target or the US card processing regime.
Where would one fence eleventy billion credit card numbers, anyway? It's not like this a tenable amount, considering the depth of market for stolen credit card numbers.
Unless I'm reading it wrong you're basically disabling webservices like making a SOAP call to a third party on behalf of the connecting user-agent. That's a non-starter for just about all companies that have at least one business partner.
I came to the datacenter drunk with a fake ID, don't you want to be just like me?
They spent months selling them already. The guys who did this have already made out like bandits.
I read the internet for the articles.
Target's security is especially lax, but part of the problem here is the POS terminals that are apparently stuck running old unpatched versions of Java. That's an industry wide problem. You can limit the exposure with proper network security, but it means if anybody does breach your security they will have no trouble escalating that into full blown card disclosure.
I read the internet for the articles.
So if the person the credit card is issued to is gay, the Russians won't use the data?
OK.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
I'm tired of those who pretend to want to help us by giving a false link by clicking on the grounds that we can watch the film for free, but in the end we are exposed to computer viruses, if you want to watch this film I suggest to you free of charge for saw this film in http://goo.gl/Yde2KF there you can watch it free or you can download it, hopefully the information I provide will help you
That's not how fraud works, economically. You've just described a number of costs, borne by various parties in a fairly-competitive economic market place, including "that's what your double digit interest rate is paying for." And the conclude that "the consumer doesn't eat the fraud."
Economic losses from fraud are first borne by the directly-impacted party, and then those economic losses are passed around the economy according to various factors like pricing power and elasticities of supply and demand. Since 70% of the economy is consumer spending, then I posit that approximately 70% of all economic losses due to fraud are borne by consumers. Might be more or less, but just because Target's 100+ million affected customers are not directly impacted financially in a first-order way does not mean that they, or all consumers, don't ever see the financial impact of this fraud. They just absorb the financial impact in a thousand minor and unseen ways, as the fraud loss is absorbed into the macro-economy and attenuates down to imperceptible levels like the CMB.
Fraud is sand in the gears of the economy, and the resulting inefficiency ultimately affects every participant in or user of that machine.
They spent months selling them already. The guys who did this have already made out like bandits.
Perhaps they made out like bandits because they are bandits?
John
The only problem here is that the credit card industry will then figure out yet another way to screw the small merchant. PCI compliance is a great idea. The various "insurance policies" and "penalty fees for PCI noncompliance" pushed by the interchange companies are a rip off and farce. They aren't going after my small business......but I'll pay more money to someone because some Russians hacked Target. Thanks !!! By the way, why do we have interchange companies anyway ???
the reason is that they have outsourced their IT to India. So, now, you have 200 IT making $10K/year, who are not very well educated, and are not strong coders. They work for a company that employs ~250 ppl who have NO loyalty to a foreign company. After all, they have NO shops in India. Along comes somebody from Russia or China and offers just 1 person $100-200K to release a virus on the network. That money will set that person's extend family up for 5-10 years. And if that coder uses it just for his/her immediate family, they retire.
Now, to really make this interesting, they installed other trojans at the same time that it was spreading. If the systems are not all replaced in roughly the same time frame, then the trojans can simply move around. And in a couple of years, they can then re-start things up.
As long as America uses Windows for POSs, Mag stripe cards and outsources their work, they will continue to get ripped off.
I prefer the "u" in honour as it seems to be missing these days.