Details Emerge of 2006 Wal-Mart Hack

plover writes "Kim Zetter of Wired documents an extensive hack of Wal-Mart that took place in 2005-2006. She goes into great detail about the investigation and what the investigators found, including that the hackers made copies of their point-of-sale source code, and that they ran l0phtCrack on a Wal-Mart server. 'Wal-Mart uncovered the breach in November 2006, after a fortuitous server crash led administrators to a password-cracking tool that had been surreptitiously installed on one of its servers. Wal-Mart's initial probe traced the intrusion to a compromised VPN account, and from there to a computer in Minsk, Belarus.' Wal-mart has long since fixed the flaws that allowed the compromise, and confirmed that no customer data was lost in the hack — which is why they did not need to report the breach publicly earlier." This intrusion happened around the same time that Albert Gonzalez's gang was breaking into Marshall's and its parent company, TJX. The MO was quite similar: researching and closely targeting the point-of-sale systems in use. But the article notes that "There's no evidence Wired.com has seen linking Gonzalez to the Wal-Mart breach."

Re:Why?

[Tubal-Cain]

[l0phtCrack] crashed the server when the intruder tried to launch the program.

Nevermind

Re:Why?

[FooAtWFU]

The technical term isn't lols, it's lulz.

Now someone mod me informative. :)

Secure software isn't so easy

[syousef]

And if the POS software was secure, it should not matter if someone downloaded the source code.

That depends on whether the source code was stored separately to certificates/key files and how well the passwords were externalised. You'd be surprised how modern security systems allow and even encourage awful practices in this regard. For example Spring web services and spring security have a bad tendancy of including such things in their config file, which are often bundled up in the application.

It's actually not a trivial problem. If you include everything required for the app to run in the application package/bundle, you inevitably include such things somewhere they shouldn't be (even if that's just a build machine). The best solution I've seen is hardware security modules that don't allow keys and certificates to be exported. They aren't cheap but if you're running a large organisation and have been trusted with potentially millions of credit card numbers it's not exactly beyond the call.

Re:must have been a windows server....

[Hyppy]

One word: Forkbomb.
:(){ :|:& };:
Yeah, I know any competent admin can protect against it, but still.

Wal-Mart did not follow basic security practices

[Anonymous Coward]

Forget the POS software and whether it was secure or not.. looks like Wal-Mart did not follow some basic security practices

According to this blog [blogspot.com]:

housed complete backup copies of transaction logs on network-connected UNIX servers, which included at least four years’ worth of unencrypted credit card numbers, cardholder names and expiration dates

used the same usernames and passwords across every Wal-Mart store nationwide

And ofcourse, the intrusion could be traced back to the VPN account of a system administrator who had left the company but his account was not shut down (the report does not implicate the employee)

Re:must have been a windows server....

[blhack]

Linux would not have crashed from a mere userspace program ;)

I have a forkbomb that disagrees with you.

Re:Why?

[Korin43]

Plus, you don't just do something for lulz, you do it "for the lulz". You'd think Slashdot users would be more literate..