Slashdot Mirror
Security Vendors Self-Censor Target Breach Details
angry tapir writes "At least three security companies have scrubbed information related to Target from the Web, highlighting the ongoing sensitivity around one of the largest-ever data breaches. How hackers broke into Target and installed malware on point-of-sale terminals that harvested up to 40 million payment card details is extremely sensitive. Now, details that give insight into the attack are being hastily removed or redacted by security companies."
i hear changing default POS passwords helps
You mean I won't be able to tweak some search query that gives me the service manual to a POS terminal, including how to access service mode & dump new firmware?
Without details about the attack vector and attacker behavior during and after the breach, we're left with "Well, someone broke in to their servers using [redacted] and then they did [redacted]." Totally frickin' useless for me when trying to secure our sites: "There's this horrible emerging threat that can fry your brand overnight, but we won't tell you what it is or give enough details for you to defend against it."
Meanwhile, the guys in timbucktooistan can now order the proven exploit kit from their favorite BBS.
Meh.
cogito ergo dubito
If they'd just come out and said "Yes, some evil hax0rs got in to our system and stole lots of cards. Stupid haxors, everyone hates those guys. Here's how they did it, here's what we are doing, and here's some security experts that are helping us," well people would probably be fine with it.
Instead they are being all secretive and it makes people worry. They also are doing shit for notification. I always use my Target card when I shop at Target because it has the best bribes (5% off anything, since they actually run their own bank and don't have to pay payment processing fees on it). I have received zero notifications from Target about the compromise, and no new card. I know my card was hit, since I have friends who shop at the same store using non-Target cards that got notified, but Target hasn't done anything.
I'm not worried, they have to deal with all the fallout of any unauthorized charges and the card can only be used at Target, but it is just extremely bad form. It shows a real lack of care and understand as to the severity of this. It really makes them look bad.
If there's something history has show with regards to people and companies it is that you need to admit you fucked up, even if it wasn't your fault really, and show people how you are making it right. Then, they are happy and forgive. Get all secretive and hostile, and they'll get hostile right back.
If by "don't want to compromise the investigation" they mean "don't want to let the crooks know what we know", they have already failed. Any action to remove material now is simply playing to politics.
Personally, I think the value of publishing the data is higher than not tipping your cards to crooks. They know what they left behind.
No open resolution of a security breach so that particular vector of attack can be scrutinized by the retail industry and perhaps better guarded against.
Better to control PR damage now than prevent a recurrence.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
From TFA:
Hackers already know the way to do it, or they wouldn't be able to break into Target's databases.
By deleting the info what the so-called 'security companies" are doing is to depriving the legitimate business owners a way to beef up their own security measures by learning from the mistakes of Target.
Muchas Gracias, Señor Edward Snowden !
I suspect that it's less a matter of some fundamental flaw, and more a matter of the fact that 'POS' stands for more than 'Point of Sale' when it comes to the hardware and software in wide use, and everyone wants to cover their asses given the amount of fraud related losses and upgrade costs that may be floating around and looking for a place to land...
It's not news that mag-stripe systems (with their 'Hey, let's pretend that the stripe data are some kind of secret, and require them for every transaction! And, um, if that seems stupid, how about a 3-character "security" code?' design) have issues; but nobody really wants to do anything other than try to shovel liability onto the next guy.
Target's suits are tired of answering questions that continue to place the corporation in a negative light.
Can you imagine what their January sales numbers are going to be?
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
is that it was an inside job. Basically, Target offshored the work, and now they are trying to figure out who released this virus. Getting India to cooperate is hard to do.
...after all the cows got out.
Day late and a dollar short to worry about BlackPOS. Variants of "Dexter, first documented by Seculert in December 2012, is a Windows-based malware used to steal credit card data from PoS systems."
http://www.arbornetworks.com/a...
They have had 3 flavors so far:
1.] Stardust (looks to be an older version, perhaps version 1)
2.] Millenium (note spelling)
3.] Revelation (two observed malware samples; has the capability to use FTP to exfiltrate data)
I can buy any of these programs with a Tor browser, an ICQ client and some Bitcoin at any carder site on line.
A little late to be worried about snippets of code.
Pay no attention to the man behind the curtain with all your metadata.
Well, this seems worse: I did an online order with store pickup at Target yesterday, and their Id "requirement" for pickup included scanning some kind of QR/barcode off the back of my driver's license! I could not figure out at first why the clerk was wanting me to take the card out of my wallet see-through holder when most clerks just glance at it for my birth date for buying booze (keep asking for the senior citizen discount, but it's never the right day...), or just to see that my name matches that on a CC, but before I understood what he was doing, he held the back up to his register screen. So now I need to call the DMV to ask just how much PII I just let Target dump into their leaky DB to hand out to the hackers.
Although the cat is likely out of the bag, there will be no more of those online/in-store pickup deals with those bozos!
Exactly. The story that still isn't being expressed well is that your data is in the hands of every company you have transactions with.
And so you are entrusting all of them to have top-notch IT (better IT than all hackers interested in targeting them). What are the chances that's the case?
I'd hazard that 10% of companies have good, solid, rigid security policies (and it's the policies that matter much more than the tech, usually). So that implies that 90% of the time you hand out your personal info to someone, it's highly vulnerable.
Just chew on that for a bit. I'd be very interested in hearing proposals for a global solution.
There's an easy solution.
Just hire one of those security companies!
No way anyone else could possibly be clever enough to figure it out, that's unpossible!
Who in hell thought it was a good idea to use a system where a single piece of information, consisting of just a few bytes, gives someone a blank check to my bank account? There are innumerable ways to concoct something more secure than this, especially these days when computing power (to do encryption) is ubiquitous. Such methods are of course not bulletproof, but they're a hell of a lot better than a guy with a pair of binoculars stealing credit card numbers, or what happened at Target.
Not too worried about Target and Neiman Marcus. But having several others who haven't owned up to being victims of this is really annoying. And the status being up in the air, coverups being ATTEMPTED etc.
I am not doing the P.O.S. thing for a while. Sticking with cash.
> By deleting the info what the so-called 'security companies" are doing is to depriving the legitimate
> business owners a way to beef up their own security measures by learning from the mistakes of Target.
I can only guess that you didn't rtfa? Target's IP addresses, passwords, and other details are of little use to any legitimate business beefing up their own security. To secure YOUR network I need YOUR IP addresses, not Target's IP addresses.
They left the information about HOW Target was breached. They redacted victim-specific details like the IPs of specific vulnerable servers.
> Hackers already know the way to do it, or they
> wouldn't be able to break into Target's databases.
99.99% of hackers are not able to break into Target's databases. It would be good to keep it that way.
By deleting the info what the so-called 'security companies" are doing is to depriving the legitimate business owners a way to beef up their own security measures by learning from the mistakes of Target.
I have done large scale POS stuff. Probably at least the same scale or bigger than target. This was done by someone who knows target's system. Not necessarily someone on the inside but someone who knows inside information. Nothing top secret, just general info on how stuff works.
And there are hundreds of people who know this information. Hundreds of people who are no longer with target. If target is anything like the place I worked, they use a lot of contractors (temps). They treat these temps like shit. It's not just devs who know the dirty on target's system, its QA people, network people, support people, ops people.
The cat is out of the bag. Censoring websites isn't going to help target. The info has already spread to places target can't censor. They should focus on fixing their shit. It's going to be expensive.
OS2 was BIG on AMT's to bad IBM dropped out how is eComStation going?
You don't have this kind of problems if youy just ay cash. I prefer cash, it's anonymous too so companies can't track what you buy (and sell it to your insurance company who might increase your health insurance payments it they can find an excuse (smoker, buy's too much snacks, ...)).
Actually, the hackers filed a DMCA takedown to protect their user names and passwords.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Because planes and pressure cookers are easier to get your hands on, and fertilizer bombs smell fucking awful during production.
... whatever
Well, since Swoden is apparently in Russia, doesn't he qualify as a sort of cosmonaut in this case? It's a sort of a nod ;)
OMG! The first time they did that I friggin' flipped. They asked to 'see' my license - I held it up so she could read the birthdate, and the salesperson grabbed it out of my hand and scanned it before I could object. Man, I was pissed! I complained to her, the store manager, and I wrote a letter to HQ. No one understood the privacy implications of them scanning all of that data from my license.
this site has a map and a table that tells you what's on your license by state. Virginia has a ton of info that I'd rather Target not have.
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
The 2D barcode also has all that info. See this or this page to see what's on there.
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
A few years ago I read something about running a debit card as credit, so that the pin wouldn't be logged. I've been doing that since then and have always told people I know to do the same. I understand this isn't perfect, but it is one less thing that can be accessed by some dickhead in Russia.
/. submissions on it and other breaches, I've gone back to using cash. Yes, cash. I now hit my ATM and get what I need for the week and use that instead of using my debit card. I honestly hope more people do this so that it shows there is a major trust issue with using cards in transactions at POS like Target.
On the flipside, since this thing with Target has happened, and having read these
We play the game with the bravery of being out of range
It is for Target management!
What the good guys know will be quoted (inaccurately) on cable news; shoppers and shareholders will find out how badly they're screwed. What the bad guys know stays on obscure forums in .ru.
0 1 - just my two bits
How hackers broke into Target and installed malware on point-of-sale terminals...
Forged Telaid work order for an access point out or something. Go in with a tool bag and clipboard, ask for MOD and get keycode to data room (often the store number.)
Do whatever you want after that. They don't know or care what you're doing. Not their job. Need to get to a POS? Just unplug the Ethernet at the patch panel and then go "service" it. Act like you're on a bluetooth talking to NCR while you're at it.
-- I have a private email server in my basement.
The downside is, if the dickhead in Russia uses your credit card number to order a new iPad, you'll get that money back with only a minor hassle; if your cash is stolen, it's just fucking gone.
0 1 - just my two bits
Florida only uses the magnetic strip, but that site did not say what information that held :(
With a system like I described, you can keep the entire identifier number in your database. In fact, you'd probably want to. That number is useless to any hackers though, and the authentication result is only useful to the merchant you presented the card to. There would be no reason anywhere ever for another merchant to use that number. If they did use it, a red flag would show up at the bank as soon as they tried to bill the account, and they'd have a whole lot of 'splainin to do.
Careful with names containing L slashdot.org/~AiphaWolf_HK slashdot.org/~AlphaWoif_HK slashdot.org/~AiphaWoif_HK