Slashdot Mirror
Target Credit Card Data Was Sent To a Server In Russia
angry tapir writes "The stolen credit card numbers of millions of Target shoppers took an international trip — to Russia. A peek inside the malicious software that infected Target's POS (point-of-sale) terminals is revealing more detail about the methods of the attackers as security researchers investigate one of the most devastating data breaches in history. Findings from two security companies show the attackers breached Target's network and stayed undetected for more than two weeks. Over two weeks, the malware collected 11GB of data from Target's POS terminals. The data was first quietly moved to another server on Target's network and then transmitted in chunks to a U.S.-based server that the attackers had hijacked. Logs from that compromised server show the data was moved again to a server based in Russia starting on Dec. 2."
A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.
Target's terminals are aptly named.
In Soviet Russia We Target You!
Does moving data usually make a noise?
Time for bed, said Zebedee - boing
If the attackers had left a script behind to effectively re-partition or even reformat the compromised servers' hard-drives.
But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?
Where's our protection from Russian financial terrorists? Were the NSA employees in charge distracted by their Starbucks carmel macchiatos at the time this was coming down?
A clear instance of international crime/terrorism and NSA was asleep at the wheel.
Target suffered similar data theft in 2005, and now again in 2013. By storing cardholder information, CVV's and (worst) PIN's in the clear, they obviously are not PCI DSS compliant. If this happened to any other retailer, Visa would revoke their PCI compliance status. If nothing happens regarding their PCI compliance status, what does it say about PCI compliance in general? PCI compliance is nothing but a joke, not to be taken seriously. Why even go through the work and trouble to get PCI DSS certified if companies like Target can flout the rules and get away without any penalties.
Did anyone else get an email from them offering free credit monitoring?
Traget outsourced IT operatations and field work is subbed out as well.
So maybe the IT people within the company that see the problems and may know how to fix them are so far apart form the people who work that team that they can't get stuff down or things are setup up that way so it's easier to sub work out vs locking stuff down and giving each Subcontractor there own logins / private email / info on the system.
Using common logins / just giving the info contractors who then giving that info out to the subcontracts is easier and makes it easier to change firms on each level. But then that info may not get changes / ends in the hands of non tech people who may not give it the security it needs.
I'm not going to defend Target for being embarrassingly sloppy, however, no matter how you look at it, it largely doesn't matter:
a) It's a business decision to invest in cyber-insurance or cyber-security, they picked insurance. As technical people, we like technical solutions, but maybe insurance was the right choice.
b) If a consumer gets hit by a fraudulent cc charge, they don't eat the charge. They call their cc issuer and the issuer eats the charge. That is in part what your double digit interest rate is paying for.
c) Everyone gets credit monitoring. If the credit monitoring is not snake oil, then it'll catch cc fraud that's not a direct result of this Target screw up. This may actually be a benefit. People who were dimly aware of how the cc system works will become informed. This is probably a net positive here.
d) Awareness is raised about POS security; other companies who are running the similarly secured systems may be motivated to fix it. Another net positive.
The only people getting screwed are Target (for operating a shit system) and/or the cc issuers (for permitting Target to run a shit system).
I got the email notice from Target at TWO of my email accounts that my information had been stolen.
I pored over my financial data and found that I have not used any credit card at a Target store since 2008. So, obviously the breadth and depth of this attack are a lot more extensive than what they are telling us.
Either that or Target is simply blasting everyone in their email database whether or not they believe the customer's information was stolen, which says that Target still really has no idea whose information was taken and whose wasn't.
It really is a reflection of the vast incompetency of Target management. They don't know ANYTHING, and have just been firing the shotgun since this whole story broke.
So, time for me to rant, but on-topic, for a second.
Everybody knows, I would hope, that best practice is to never allow an Internet-facing server to initiate outbound traffic. This is both because, should the server get compromised, it becomes a new attack vector - as in Code Red or SQL Slammer. This is also because, as in Target's case, it makes it fairly trivial to exfiltrate stolen data.
But services still persist that require that this very access be enabled. My current case in point: ReCAPTCHA. Google hosts the URL for this service, intended to provide additional security, on a www.google.com URL, which means that, at minimum, I have to allow outbound access from any server hosting a ReCAPTCHA on port 443 to everything Google owns. In practice, of course, it's all but impossible to keep track of Google's address space for firewall purposes, so this means that I have to allow that server out on port 443 to the entire Internet. It's either that, or set up a proxy solution that can do URL filtering and then require the CAPTCHA verification code to use that. Not exactly something your typical smaller company using ReCAPTCHA is apt to do.
I've talked to competing, for-pay, services, and they require the same thing, despite the fact that they're smaller and have only a few, well-defined networks, but they won't commit to keeping me up-to-date with network changes.
We really need to start pushing back on this crap. Servers accepting inbound traffic should never need to initiate outbound communications.
Unless I'm reading it wrong you're basically disabling webservices like making a SOAP call to a third party on behalf of the connecting user-agent. That's a non-starter for just about all companies that have at least one business partner.
I came to the datacenter drunk with a fake ID, don't you want to be just like me?
They spent months selling them already. The guys who did this have already made out like bandits.
I read the internet for the articles.