Slashdot Log In
TJX Fires Employee For Disclosing Vulnerability
Posted by
kdawson
on Tue May 27, 2008 03:57 PM
from the shoulda-used-wikileaks dept.
from the shoulda-used-wikileaks dept.
I Don't Believe in Imaginary Property writes "A TJX employee was fired for an online post mentioning that TJX hasn't beefed up security after the recent, massive data breach that saw 94 million credit card numbers copied by criminals and money from their accounts stolen. The employee mentioned that, at first, their usernames were the same as their passwords. After they required stronger passwords, some managers complained, so they 'compromised' by allowing blank passwords. The whistleblower said he discussed his concerns with management, but that it was like talking to a brick wall. In spite of the weak internal security, TJX now has a firm that scours the internet to find bad things posted about them, which is how they found the message and fired him for it. Too bad they don't appear to have hired anyone to beef up operational security or to convince people to use strong passwords."
Related Stories
[+]
TJX Security Breach Described 104 comments
Bunderfeld notes more details coming out about how bad guys got into the TJX network. Last time we discussed this, the best information indicated that a WEP crack had started the ball rolling. Now we learn that instead, or in addition: "Poorly secured in-store computer kiosks are at least partly to blame for acting as gateways to the company's IT systems, InformationWeek has learned. According to a source familiar with the investigation who requested anonymity, the kiosks, located in many of TJX's retail stores, let people apply for jobs electronically but also allowed direct access to the company's network, as they weren't protected by firewalls. 'The people who started the breach opened up the back of those terminals and used USB drives to load software onto those terminals,' says the source. In a March filing with the Securities and Exchange Commission, TJX acknowledged finding 'suspicious software' on its computer systems."
Submission: TJX Fires Employee for Disclosing Vulnerability by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I was about to say... (Score:5, Informative)
Re:I was about to say... (Score:5, Informative)
Parent
Re:I was about to say... (Score:4, Funny)
Parent
Re:I was about to say... (Score:5, Funny)
My wife once had her credit card stolen (physically stolen). We got the CC bill a week later.
"Honey, look! The bill's $700 cheaper than last month!"
Now I go out with her when she decides to buy something.
Parent
Re:I was about to say... (Score:4, Interesting)
Parent
One store (Score:4, Informative)
Re:One store (Score:5, Informative)
The original loss of data was caused by weak passwords on wireless routers. War dialers parked outside a store (or stores) captured data that was then used to collect millions of credit card numbers from the HQ servers. One of the problems was that TJX kept CC numbers on file long after they had any use for the information. This is a case where bad security at one store compromised the whole corporation. Sounds like nothing has changed
Parent
Re:One store (Score:5, Informative)
Parent
Re:One store (Score:4, Insightful)
Um, isn't this what the US government wants done with the new regulations? As well as sharing this info with the gov, of course...
Parent
Same happened to me :( (Score:5, Funny)
Re:Same happened to me :( (Score:5, Funny)
That's what you get for using "12345" as your password, Mr. President!
Parent
Re:Same happened to me :( (Score:4, Funny)
Parent
Luggage? Pfft (Score:4, Funny)
Parent
Re:Luggage? Pfft (Score:4, Funny)
President Skroobs' director of IT recomends using 2-4-6-8-10 for ssh, since it's obviously double secure over the standard 1-2-3-4-5.
Parent
Does the CEO condone this firing act? (Score:4, Interesting)
Weak American Dollar (Score:5, Funny)
In case you're wondering who TJX is... (Score:4, Informative)
Blank passwords. Wow. No bad guys would ever try that. Disclosing that policy would really compromise security, wouldn't it?
Dear TJX (Score:5, Funny)
We're the Slashdot community, and would like you to meet Ms Barbara Streisand, who can help you with your media relations problem.
Yours Truly,
Slashdot Community.
Since when? (Score:4, Interesting)
Additional Information (Score:4, Informative)
http://www.cgisecurity.com/2008/05/11 [cgisecurity.com]
Gold Mine (Score:4, Funny)
Then they've found a Gold Mine here on Slashdot.
RTFA (Score:5, Informative)
Parent
Re:RTFA (Score:5, Informative)
http://ha.ckers.org/blog/20080522/tjx-whistle-blower/ [ckers.org]
At least it'll be harder to get your IP from a foreign company.
Parent
Re:RTFA (Score:5, Interesting)
He should fixate on this and sue them.
Parent
Re:RTFA (Score:5, Insightful)
Parent
Re:RTFA (Score:5, Insightful)
Trouble is, due to their own well-documented incompetence in security, they'd have a pretty good chance to claim they simply didn't know it was illegal.
Parent
Re:RTFA (Score:5, Insightful)
Parent
Re:RTFA (Score:5, Insightful)
Parent
Re:RTFA (Score:4, Interesting)
P.S. I am not an attorney. Do not take this as valid legal advice.
Parent
Re:RTFA (Score:5, Interesting)
I concede that IANAL, so of course, I could be wrong, however the courts have already ruled that blogs and other web based news sites qualify under protections provided to the media.
Parent
Re:RTFA (Score:5, Informative)
Parent
Re:um duh (Score:5, Insightful)
Anyone remember Nixon... and a few others.
-- sig.com not found post halted
Parent
I think there are laws. . . (Score:5, Insightful)
The thing I'm puzzled about is, I thought that the electronic payment networks (MasterCard, Visa, Discover, Amex, etc) had very specific requirements for data security, including audits, which filter down to merchants (I realize that merchants don't generally do business directly with the networks [unless, maybe, they're Walmart or Sears], and instead go through intermediate companies that 'resell' the network services, but I thought the security requirements, and audit regimen, bubble down through the whole hierarchy?)
Parent
Re:I think there are laws. . . (Score:5, Informative)
Parent
Re:I think there are laws. . . (Score:5, Insightful)
Apparently PCI Compliance doesn't allow for input from the "little people" -- or would someone care to post a link that allows for submitting information to them?
Parent
Re:I think there are laws. . . (Score:4, Insightful)
Neither set of laws will keep you from getting fired for coming back from lunch 3 minutes late.
If your company wants a reason to fire you, unless you're perfect, they'll find one.
Parent
Re:I think there are laws. . . (Score:4, Interesting)
Has anyone else been 3 minutes late and not fired? what does your policy say?
The courts are suspicious of those kind of amazing coincidence.
Even if you are 'perfect' they can find one, no doubt. That doesn't mean you don't have recourse.
Parent
Re:I think there are laws. . . (Score:5, Insightful)
As a Public Company, TJX is subject to Sarbanes Oaxley.
Section 302 demands the certification of Internal Control on Financial data. With such shoddy password system I fail to see how they can comply with it.
Section 404 demands management to assess risk and solve it
Section 802 accrues criminal penalties for violations to Sarbanes Oaxley and (TADAM!!!)
Section 1107 accrues criminal penalties for retaliations against whistleblowers.
I think this guy should get hold of Section 1107 and run it for all it is worth!!!!
From Wikipedia:
http://en.wikipedia.org/wiki/Sarbanes-Oxley_Act [wikipedia.org]
" Whoever knowingly, with the intent to retaliate, takes any action harmful to any person, including interference with the lawful employment or livelihood of any person, for providing to a law enforcement officer any truthful information relating to the commission or possible commission of any federal offence, shall be fined under this title, imprisoned not more than 10 years, or both.
My 2 cents
Parent
Re:I think there are laws. . . (Score:4, Informative)
I think you've pretty much got to the root of the problem there: if this behaviour isn't criminally negligent, it should be. In a world where identity theft is one of the fastest growing (and most damaging) crimes in town, dealing with a business that has previously shown itself to be incompetent in handling personal data and is actively avoiding improving the situation, it's time to start throwing the directors in jail.
Parent
Another older guy loses his capacity for outrage (Score:5, Interesting)
Maybe he expected exactly what happened and blew the whistle anyway. So, wise elder, what would you have done?
Parent
Re:Another older guy loses his capacity for outrag (Score:5, Insightful)
Parent
Re:Another older guy loses his capacity for outrag (Score:5, Insightful)
Parent
Re:Another older guy loses his capacity for outrag (Score:5, Insightful)
But it really sounds like you are going further, saying that not only is this how things are, but how they ought to be. It really sounds like you are coming down on the guy for doing the right thing.
Or maybe you are trying to say that everyone should be as cynical as you are? Maybe you believe that we should all expect to get fucked over for doing the right thing, and anyone who doesn't expect that is an idiot who deserves what they got.
Please clarify, do you think this guy got the treatment he deserves? Should we not be outraged here? I'm confused as to your motives for posting what you originally did.
Parent
Re:Another 23 year old realizes that McJobs suck (Score:5, Interesting)
If they had any integrity - Yes, that sounds like the best possible outcome of this.
Think about it - The CIO didn't say "okay, after a major data breach, go ahead and keep using pathetic passwords". The order came down from On High to use secure passwords. This proved inconvenient to hundreds of piddling middle-managers, who ordered "their" IT guys to find a way around all that nasty security. The local IT guys complied, by allowing blank passwords (Corporate probably never expected anything that stupid, and so didn't have a policy stating otherwise).
So, sometime later, Corporate discovers what has happened, and it enrages them. They meet, discuss, take aim, and fire...
And what did he think they were going to do when they caught him, give him a raise and a promise to change their cheap lazy ways?
They could have addressed the problem and rewarded the child who dared to laugh at the naked emperor. By chosing not to, they have very effectively told me they care more about appearances than the security of my credit card data. As a result, I will no longer shop there.
Parent
Re:Another 23 year old realizes that McJobs suck (Score:4, Informative)
The heck it didn't. It had to do with a complete lack of security on computer systems that were used in financial transactions. It's hard to keep accurate financial records if key financial systems can be trivially compromised. It also represents a HUGE threat to the financial viability of the company, and technically, failure to include such risks as part of your regular corporate reporting to the SEC is a pretty major case of investor fraud, which was the whole point of Sarbanes-Oxley....
Sadly, covering up security problems seems to be the norm in banking circles. Really gives you a lot of trust in their ability to guard your money, doesn't it?
Oh, and here's a similar story [hugesettlements.com] from 2005 that also suggests that this is likely SarbOx territory.
Parent
Re:ah well (Score:4, Funny)
McDonalds is always hiring. It'll be a step up for him.
Parent
Re:Sad State of Affairs (Score:5, Insightful)
Good managers understand this and realize that spending that much money on protecting something that's really not very important to the company (customer identities) is just not good business. Until people start hearing on the nightly news that "TJMaxx gave your credit information to terrorists who used it to buy nuclear weapons and assassinate Jesus," the negative publicity they'll suffer is negligible.
Parent
Re:Sad State of Affairs (Score:5, Interesting)
What if your bank decided that those pesky safe deposit boxes would be a whole lot cheaper if only they could use unlocked filing cabinets instead. Would you still want to do business with them?
The sad state of affairs here is that the problem doesn't become apparent until someone gets hacked.
I think a firm that has a security breech ought to be forced to make restitution to the customers. Managers may not understand security, but they will understand lawsuits and damages.
Only once you've rubbed a manager's nose in the problem can you expect a solution. We don't HAVE to address everything, but managers should at least be aware of the risks they're taking.
It's a telling point that they've chosen to persecute instead of promote the person who exposed the flaws. These idiots would rather hide in the corner than address the risks up front.
Parent
Re:Sad State of Affairs (Score:5, Funny)
Engineer: "I don't care what you read in 'Feudal Lords Monthly', if you want this castle to be secure, we need 2000 foot tall walls, 700 feet thick with a moat of pure acid that's 200 feet deep."
Lord: "But I read that this spell of invisibility and Norton(tm) balsa wood framework is just as good. It leads the industry!"
Parent
Re:Sad State of Affairs (Score:4, Insightful)
Good security can be expensive. But adequate security is fairly cheap. "password == username" and "blank password" are essentially equal to "no password". Having any password at all, even if it's weak from the POV of a security expert (say, a word from the dictionary) is still a whole lot better than having no password. And it's not very expensive. A billion people in millions of companies manage to remember their login password from monday through friday, and sometimes even over the weekend. I'm sure with just a little training, TJX managers would be able to do that, too.
Parent