Target Breach

Linux_Kidd · 01-03-2014, 09:29 AM

PCI DSS does not require in-motion card data to be encrypted inside the CDE. granted, better to have encrypt with in-motion data.
CC data sitting needs to be encrypted and some CC data cannot be stored at all, but this encryption usually comes from the storage device or file system, which is useless for a virus that has rights to access the stored data. data at rest really needs to be encrypted by application thus reducing the risk vector down to just the apps, etc.

some news suggests the swipe terminals themselves were all infected. i suspect not, as the ones used at target dont likely have a comm path to the outside world. other news suggests Target had a virus that got onto all of their POS terminals (the OS that runs the software to which swipe terms are connected). this to me sounds like Dexter or variant.however, i am not 100% that Target has a homogenous POS landscpe which makes Dexter less probable to hit every in-store terminal. i am leaning on what others are suggesting, a central aggregate point.

perhaps a lesson for Target is, dont build solutions under aggregation model, use segregated stacks. sure, the latter requires more effort but limits probability of a "got all" attack.

metaschima · 01-03-2014, 02:23 PM

There is this article that recommends using EMV chips that contain your info encrypted on the card:
http://it.slashdot.org/story/14/01/0...y-breach-video

However, there exist vulnerabilities for these as well:
http://en.wikipedia.org/wiki/EMV_Chip#Vulnerabilities

I'd say maybe cash + .357 Magnum may be the best

metaschima · 01-13-2014, 01:54 PM

They have released details on the attack:
http://it.slashdot.org/story/14/01/1...used-in-attack

It was caused by point-of-sales malware, specifically RAM scrapper.

Quote:

According sources who spoke to Reuters, attackers used RAM scraper, or Memory parser malware to steal sensitive data from Target and other retail victims.

Visa issued alerts about attacks utilizing these types of malware in April 2013 (PDF) and again in August 2013 (PDF).

After gaining access to a merchant’s network, attackers can install memory-parsing malware on register systems or backend processing servers to extract magnetic-stripe data as it moves through the through the payment process.

Memory parser malware targets payment card data being processed “in the clear” (unencrypted) in a system’s random access memory (RAM).

“The malware is configured to hook into a payment application binary responsible for processing payment transactions and extracts the systems memory for full track data,” Visa explained in a security advisory.

“These binaries are responsible for processing authorization data, which includes full magnetic-stripe data. When authorization data is processed, the payment application decrypts the transaction on the cash register system or BOH server and stores the authorization data in random access memory (RAM). The data must be decrypted for the authorization to be completed, so hackers are accessing full track data when it is stored in RAM and using malware such as memory-parsers to steal it.”

Visa first warned about these types of attacks targeting grocery merchants, but said merchant segment is vulnerable. According to Visa, these types memory parser malware attacks have been found only targeting Windows-based operating systems.

http://www.securityweek.com/target-c...as-used-attack

metaschima · 01-18-2014, 04:09 PM

More info on the attack:
http://it.slashdot.org/story/14/01/1...target-malware
It indeed seems that Windoze is required at the point of sale for this attack to work.

Linux_Kidd · 01-18-2014, 11:34 PM

yep, as i was figuring, a variant of Dexter.

it still baffles me as to why from card swipe there is any non-encrypted data anywhere. the simple use of PKI would rid this problem. public key on the swipe terminal, data is decrypted on processor side, tokenization used for the approval/denial, etc.

even swipe terminals can be hacked, but way harder to do so then infecting the stupid OS that has the application. why in the world are POS terminals using Windows??? mistake #1.

other news has a C2 server in Target network, from there they carefully deployed hack to many of the POS terminals. where's the IDS/IPS, where's the anomalous detection??? omg Target, are you kidding.

someone needs to request their PCI ROC !!!

metaschima · 01-23-2014, 11:38 AM

Looks like info on the breach is being wiped from the net by security companies:
http://www.computerworld.com.au/arti...shes_from_web/

frankbell · 01-30-2014, 01:58 PM

The NetSec podcast finally addressed this situation; it's in the early part of this episode. They were delayed in getting to it because one of the podcasters was moving from the US to the UK at the end of last year.

http://netsecpodcast.com/?p=1289

You might find it an interesting listen.

metaschima · 01-30-2014, 02:04 PM

Also note that this kind of breach is not limited to Target. Similar breaches have been reported for Nieman Marcus and Michaels:
http://krebsonsecurity.com/2014/01/s...chaels-stores/

They seem to also be point-of-sales malware related.

metaschima · 02-14-2014, 04:29 PM

Looks like their security team warned management about it and were ignored:
http://it.slashdot.org/story/14/02/1...ned-management

Linux_Kidd · 02-17-2014, 02:47 PM

Quote:

Originally Posted by metaschima

Looks like their security team warned management about it and were ignored:
http://it.slashdot.org/story/14/02/1...ned-management

i deal with this all the time. i get paid good $$ to be a security advisor. i have made many suggestions where management just didnt see the value-add. i mark these items on my side as "declined by customer, risk accepted by customer management". in the end, it's customer owners (whoever that may be) are the ones who own the risk.

Target upper management either had a good insurance plan for such risk, or they were negligent of the matter. my guess is, the 1st is likely the case given this article.

did Target have a passing ROC for PCI (either by 3rd party or did they have a ISA?)???