Slashdot Mirror
Security Vendors Self-Censor Target Breach Details
angry tapir writes "At least three security companies have scrubbed information related to Target from the Web, highlighting the ongoing sensitivity around one of the largest-ever data breaches. How hackers broke into Target and installed malware on point-of-sale terminals that harvested up to 40 million payment card details is extremely sensitive. Now, details that give insight into the attack are being hastily removed or redacted by security companies."
i hear changing default POS passwords helps
You mean I won't be able to tweak some search query that gives me the service manual to a POS terminal, including how to access service mode & dump new firmware?
Without details about the attack vector and attacker behavior during and after the breach, we're left with "Well, someone broke in to their servers using [redacted] and then they did [redacted]." Totally frickin' useless for me when trying to secure our sites: "There's this horrible emerging threat that can fry your brand overnight, but we won't tell you what it is or give enough details for you to defend against it."
Meanwhile, the guys in timbucktooistan can now order the proven exploit kit from their favorite BBS.
Meh.
cogito ergo dubito
If they'd just come out and said "Yes, some evil hax0rs got in to our system and stole lots of cards. Stupid haxors, everyone hates those guys. Here's how they did it, here's what we are doing, and here's some security experts that are helping us," well people would probably be fine with it.
Instead they are being all secretive and it makes people worry. They also are doing shit for notification. I always use my Target card when I shop at Target because it has the best bribes (5% off anything, since they actually run their own bank and don't have to pay payment processing fees on it). I have received zero notifications from Target about the compromise, and no new card. I know my card was hit, since I have friends who shop at the same store using non-Target cards that got notified, but Target hasn't done anything.
I'm not worried, they have to deal with all the fallout of any unauthorized charges and the card can only be used at Target, but it is just extremely bad form. It shows a real lack of care and understand as to the severity of this. It really makes them look bad.
If there's something history has show with regards to people and companies it is that you need to admit you fucked up, even if it wasn't your fault really, and show people how you are making it right. Then, they are happy and forgive. Get all secretive and hostile, and they'll get hostile right back.
If by "don't want to compromise the investigation" they mean "don't want to let the crooks know what we know", they have already failed. Any action to remove material now is simply playing to politics.
Personally, I think the value of publishing the data is higher than not tipping your cards to crooks. They know what they left behind.
That information like this starts disappearing from the internet?
Call me paranoid, but this makes me think there is a far, far worse problem either with the system in general, or the equipment pertaining to a certain manufacture that is in widespread use.
Normally security companies are all over this kind of thing, blasting their findings far and wide so they can get fixed. The fact that they're trying to cover it up makes me think that there is some fundamental flaw somewhere that cannot easily be fixed.
No open resolution of a security breach so that particular vector of attack can be scrutinized by the retail industry and perhaps better guarded against.
Better to control PR damage now than prevent a recurrence.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
From TFA:
Hackers already know the way to do it, or they wouldn't be able to break into Target's databases.
By deleting the info what the so-called 'security companies" are doing is to depriving the legitimate business owners a way to beef up their own security measures by learning from the mistakes of Target.
Muchas Gracias, Señor Edward Snowden !
I think its fairly obvious that the "bad guys" already know this information. Is it that bad for the "good guys" to know too?
is that it was an inside job. Basically, Target offshored the work, and now they are trying to figure out who released this virus. Getting India to cooperate is hard to do.
You say "Muchas Gracias" to Edward Snowden but what do The Golden Girls get for giving you a first post to leach onto? Nada, Señor. Nada. What kind of amigo are you?
What did they use before 'upgrading` to the Windows industry standard?
...after all the cows got out.
Day late and a dollar short to worry about BlackPOS. Variants of "Dexter, first documented by Seculert in December 2012, is a Windows-based malware used to steal credit card data from PoS systems."
http://www.arbornetworks.com/a...
They have had 3 flavors so far:
1.] Stardust (looks to be an older version, perhaps version 1)
2.] Millenium (note spelling)
3.] Revelation (two observed malware samples; has the capability to use FTP to exfiltrate data)
I can buy any of these programs with a Tor browser, an ICQ client and some Bitcoin at any carder site on line.
A little late to be worried about snippets of code.
Pay no attention to the man behind the curtain with all your metadata.
Well, this seems worse: I did an online order with store pickup at Target yesterday, and their Id "requirement" for pickup included scanning some kind of QR/barcode off the back of my driver's license! I could not figure out at first why the clerk was wanting me to take the card out of my wallet see-through holder when most clerks just glance at it for my birth date for buying booze (keep asking for the senior citizen discount, but it's never the right day...), or just to see that my name matches that on a CC, but before I understood what he was doing, he held the back up to his register screen. So now I need to call the DMV to ask just how much PII I just let Target dump into their leaky DB to hand out to the hackers.
Although the cat is likely out of the bag, there will be no more of those online/in-store pickup deals with those bozos!
Exactly. The story that still isn't being expressed well is that your data is in the hands of every company you have transactions with.
And so you are entrusting all of them to have top-notch IT (better IT than all hackers interested in targeting them). What are the chances that's the case?
I'd hazard that 10% of companies have good, solid, rigid security policies (and it's the policies that matter much more than the tech, usually). So that implies that 90% of the time you hand out your personal info to someone, it's highly vulnerable.
Just chew on that for a bit. I'd be very interested in hearing proposals for a global solution.
There's an easy solution.
Just hire one of those security companies!
No way anyone else could possibly be clever enough to figure it out, that's unpossible!
confidant, not cosmonaut
You would see the biggest gift would be from me
Or from Symantec...
As you say, if the "security companies" are involved and covering up, you can be dead certain that:
1. It was Windows malware that enabled the breach.
2. Their malware detection tools failed to perform as advertised.
Using Windows for financial transactions should be a criminal offence.
Haven't been to Target since xmas 5yrs ago. Went to sign my name , using debit card as credit, and there was a real pen attached to pin/signing terminal. I used a hatch pattern for my signature. What were they gonna do ... close down the register after a rich looking customer went thru and then go around and take a cell phone pic of the sig.
In the same town I was at the teller window of a bank when I realized something was wrong. A girl had gotten out of line, had come up close behind me and was looking over my shoulder at my banking slips. I stopped what I was doing and just starred at her till she went back into the line. Teller just pretended it didn't happen.
Who in hell thought it was a good idea to use a system where a single piece of information, consisting of just a few bytes, gives someone a blank check to my bank account? There are innumerable ways to concoct something more secure than this, especially these days when computing power (to do encryption) is ubiquitous. Such methods are of course not bulletproof, but they're a hell of a lot better than a guy with a pair of binoculars stealing credit card numbers, or what happened at Target.
Not too worried about Target and Neiman Marcus. But having several others who haven't owned up to being victims of this is really annoying. And the status being up in the air, coverups being ATTEMPTED etc.
I am not doing the P.O.S. thing for a while. Sticking with cash.
> By deleting the info what the so-called 'security companies" are doing is to depriving the legitimate
> business owners a way to beef up their own security measures by learning from the mistakes of Target.
I can only guess that you didn't rtfa? Target's IP addresses, passwords, and other details are of little use to any legitimate business beefing up their own security. To secure YOUR network I need YOUR IP addresses, not Target's IP addresses.
They left the information about HOW Target was breached. They redacted victim-specific details like the IPs of specific vulnerable servers.
> Hackers already know the way to do it, or they
> wouldn't be able to break into Target's databases.
99.99% of hackers are not able to break into Target's databases. It would be good to keep it that way.
By deleting the info what the so-called 'security companies" are doing is to depriving the legitimate business owners a way to beef up their own security measures by learning from the mistakes of Target.
This should not be an issue because any breach should require a mandatory card reset.
I have done large scale POS stuff. Probably at least the same scale or bigger than target. This was done by someone who knows target's system. Not necessarily someone on the inside but someone who knows inside information. Nothing top secret, just general info on how stuff works.
And there are hundreds of people who know this information. Hundreds of people who are no longer with target. If target is anything like the place I worked, they use a lot of contractors (temps). They treat these temps like shit. It's not just devs who know the dirty on target's system, its QA people, network people, support people, ops people.
The cat is out of the bag. Censoring websites isn't going to help target. The info has already spread to places target can't censor. They should focus on fixing their shit. It's going to be expensive.
From TFA:
Hackers already know the way to do it, or they wouldn't be able to break into Target's databases.
By deleting the info what the so-called 'security companies" are doing is to depriving the legitimate business owners a way to beef up their own security measures by learning from the mistakes of Target.
No, they still have a way. Purchase some high-price services from these security firms!
OS2 was BIG on AMT's to bad IBM dropped out how is eComStation going?
So now I need to call the DMV to ask just how much PII I just let Target dump into their leaky DB to hand out to the hackers.
If it's just a bar code, then all it contains is your driver's license number. (And you can decode it yourself if you want, google around a bit for the format)
If it's a magnetic strip, then it has all the data which is visible on the license.
I've never seen anyone use QR codes on licenses... at least not yet.
You don't have this kind of problems if youy just ay cash. I prefer cash, it's anonymous too so companies can't track what you buy (and sell it to your insurance company who might increase your health insurance payments it they can find an excuse (smoker, buy's too much snacks, ...)).
The report posted above is not one of the the really hot shit ones. The real stinkers are these two: The ThreatExpert Report iSIGHT Partners Report
Actually, the hackers filed a DMCA takedown to protect their user names and passwords.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Yeah, that same idea came to mind. And your probably being sarcastic, but I don't see the NSA interested in what people are buying from a shitty department store?
Maybe some is buying up to many "cleaning chemicals" or "fertilizer"!!!
{sarcasm} because that is the preferred bomb making material of the supposed terrorist.
That type of bomb making information has been around since the 50's, and yet few seem to use it!!
Magnetic stripe terminals deserve to get pawned, companies have had years to go to chip and pin or some other more secure technology any idiot can read the stripe cards. Its just horribly lazy to leave that 70s 80s tech in place is anyone still using a cassette, I don't think so. Well its the same for MAG stripe cards.
I don't have an account with Target and I haven't shopped there since around 2009. All I ever did once was give the cashier my zip code, yet Target set my email address an apology letter about the breach.
There's more to this than retailers are letting on.
Well, since Swoden is apparently in Russia, doesn't he qualify as a sort of cosmonaut in this case? It's a sort of a nod ;)
Did you notice that Target sent out a mea-culpa email and told everybody to get signed up for their free year of experian credit monitoring, but they forgot to mention something?!? They forgot to mention to everybody that when they change their CARD, they need to change their PIN as well.
Many people just use the same PIN always, everywhere they go. The carders now have a tidy database of name to pin. If they get access to your card info in the future, they will have your pin ready as well.
You mean I gotta change my PIN too? Now I am pissed! haha...
To target's reputation not to their security.
Apprently, the credentials necessary to get in are public.
They could admit this, and suffer the consequences while they fix it.
(Can you say credit card timeout?)
Or they can keep the money flowing but also keep putting their customers at risk.
It's amazing that the CC companies put up with it.
Definitely interesting theater.
OMG! The first time they did that I friggin' flipped. They asked to 'see' my license - I held it up so she could read the birthdate, and the salesperson grabbed it out of my hand and scanned it before I could object. Man, I was pissed! I complained to her, the store manager, and I wrote a letter to HQ. No one understood the privacy implications of them scanning all of that data from my license.
this site has a map and a table that tells you what's on your license by state. Virginia has a ton of info that I'd rather Target not have.
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
The 2D barcode also has all that info. See this or this page to see what's on there.
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
Gee, that sounds like the system we had back in 96, gee that was a great year for wine. But, then, they added the requirement for keeping the 3/4 number identifier in their databases, and the PIN, and other identifiers for the withdrawl of funds from the account? so security was better in 96 then now?
No, but, I still wonder?
After reading the articles, I'm still wondering which security agency or mob hired these russian kids, six years ago, to implement this attack.
Shirly, damn sp chk. they didn't develop the BF attack that to down a major Walmart opponent. Without help. Who? Russians? Chicoms? Interesting...NSA?
Maybe they were tracking the phone with the B/C thru a POS device, but that still begets the question, did they get into the ATM, or the HST...They should then be in the Wall Street, so don't count on the market daily, or the banks to keep you safe anymore..So are they doing the mouse that roared? skimming off the .00009's from all transactions now, because they haven't been found or reported, I'd say they either work for a government, or are dead...Mob would have killed them for the 9's. Because they know too much.
"How hackers broke into Target and installed malware on point-of-sale terminals that harvested up to 40 million payment card details is extremely sensitive."
That, my dear human noobs, is the same essence of national security.
If you disagree then perhaps you deserve no protection from the state because of your inability to grasp that remedial concept.
A few years ago I read something about running a debit card as credit, so that the pin wouldn't be logged. I've been doing that since then and have always told people I know to do the same. I understand this isn't perfect, but it is one less thing that can be accessed by some dickhead in Russia.
/. submissions on it and other breaches, I've gone back to using cash. Yes, cash. I now hit my ATM and get what I need for the week and use that instead of using my debit card. I honestly hope more people do this so that it shows there is a major trust issue with using cards in transactions at POS like Target.
On the flipside, since this thing with Target has happened, and having read these
We play the game with the bravery of being out of range
How hackers broke into Target and installed malware on point-of-sale terminals...
Forged Telaid work order for an access point out or something. Go in with a tool bag and clipboard, ask for MOD and get keycode to data room (often the store number.)
Do whatever you want after that. They don't know or care what you're doing. Not their job. Need to get to a POS? Just unplug the Ethernet at the patch panel and then go "service" it. Act like you're on a bluetooth talking to NCR while you're at it.
-- I have a private email server in my basement.
The downside is, if the dickhead in Russia uses your credit card number to order a new iPad, you'll get that money back with only a minor hassle; if your cash is stolen, it's just fucking gone.
0 1 - just my two bits
Surprised that it hasn't shown up on pastebin or as a torrent. Locking this data up only supports the "security through obscurity" paradigm.
It's not classified as it was a product of a commercial vendor and they are releasing it to interested parties on a need to know basis. The DHS NCCIC is a joke, all they do is process open source findings. The good stuff on SIPRNet and JWICS never makes the light of day regardless of how much it would save commercial industry's bacon. Can't reveal your sources, methods, and TTPs you know....
Sort of like knowing someone is going to get wacked at 2 pm today but you stand back and watch it happen because you want to protect your informant.
It is all security theater and as a previous poster said on another Slashdot topic related to this one: "PCI-DSS is not about security it is about transferring risk from the banks and payment card processors to the merchant...."
I am posting as an AC due to the position I held in the DHS cyber community and I don't want/need the attention. I debated logging in first and have decided it is not worth the potential hassle later.
Florida only uses the magnetic strip, but that site did not say what information that held :(