Forgot your password?
typodupeerror
Security

Target Credit Card Data Was Sent To a Server In Russia 137

Posted by Soulskill
from the really-just-a-misformatted-order-for-vodka dept.
angry tapir writes "The stolen credit card numbers of millions of Target shoppers took an international trip — to Russia. A peek inside the malicious software that infected Target's POS (point-of-sale) terminals is revealing more detail about the methods of the attackers as security researchers investigate one of the most devastating data breaches in history. Findings from two security companies show the attackers breached Target's network and stayed undetected for more than two weeks. Over two weeks, the malware collected 11GB of data from Target's POS terminals. The data was first quietly moved to another server on Target's network and then transmitted in chunks to a U.S.-based server that the attackers had hijacked. Logs from that compromised server show the data was moved again to a server based in Russia starting on Dec. 2." A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.
This discussion has been archived. No new comments can be posted.

Target Credit Card Data Was Sent To a Server In Russia

Comments Filter:
  • POS (Score:5, Funny)

    by tompatman (936656) on Friday January 17, 2014 @09:36AM (#45985635)
    Target's terminals are aptly named.
    • Re: POS (Score:5, Insightful)

      by Anonymous Coward on Friday January 17, 2014 @09:45AM (#45985725)

      Considering that the terminals in question were running un-patched, net booted XP SP2 WinPE instances with an old Java 4 version, the fact that there were attack vectors should be a long ways from shocking.

      • Re: POS (Score:5, Insightful)

        by Anonymous Coward on Friday January 17, 2014 @09:59AM (#45985855)

        Target doesn't really care. They had $100 million in cyber security insurance so most of the cost of this will be covered. AFA the public not trusting Target, well, it will pass quickly because the masses have a short attention span.

        • Re: POS (Score:5, Interesting)

          by ChromaticDragon (1034458) on Friday January 17, 2014 @10:16AM (#45986035)

          I am curious regarding your information. Got source?

          Last I'd heard, the expected sum of lawsuits, settlements, fines, etc. would be WELL over $100mil (as in several times that). Apparently, for reference, a similar breach, TJ Maxx, ended up being closer to $200mil.

          Furthermore, it seems Target was self-insured for this. So it isn't quite correct to think they will glibly had this bill to an insurer - they ARE their own insurer.

          • by Anonymous Coward

            Here's one [businessinsurance.com]

          • Last I'd heard, the expected sum of lawsuits, settlements, fines, etc. would be WELL over $100mil (as in several times that). Apparently, for reference, a similar breach, TJ Maxx, ended up being closer to $200mil.

            While $200 million is a lot of money to a lot of people, it's less than 10% of Target's typical annual profit. Some financial summaries [target.com]

            So yes, it will sting a bit, but it's not going to put them under.

            • And on the plus side, it will hurt the CxO types (less bonuses & dividends) who would have blocked the decision to upgrade to a better, but more expensive, POS.

              • by sjames (1099)

                That's a real knee slapper!

                The performance bonuses will be paid out on time and at maximum value. Employee hours will be cut and managers will make speeches about how they all have to pull together and do more with less (except the CxOs of course) to get through the tough times.

        • by gl4ss (559668)

          there shouldn't be insurance for breaking the rules.

          the insurance company should just fuck 'em at this point for not keeping up their part of the deal - there's certain ways of acting that was expected from target - and well, if they happen this often then they should charge them 15 million per year for the insurance at least.

          oh and you know, the fucking big cc companies should just treat them the same as any smaller business, but they don't. if some mom'n'pop had similar happening they wouldn't be charging

      • Re: POS (Score:5, Interesting)

        by Megane (129182) on Friday January 17, 2014 @10:19AM (#45986077) Homepage
        The thing that bugs me most is that they were on a network that was routed to the entire internet. Yeah, I don't think a POS terminal needs to be able to check Google or Facebook, much less "chernyykhod.ru". Even simply putting them on a VLAN with a very restrictive firewall to the public internet would have avoided the problem. And a RFC-1918 network doesn't count if it's behind a NAT router, since these packets went outbound from the POS. Belt and suspenders.
        • Re: POS (Score:5, Informative)

          by mythosaz (572040) on Friday January 17, 2014 @11:56AM (#45987627)

          Doesn't appear that way to me..

          The actual report on the software installed on the agent makes it pretty clear that the information was being gathered locally and forwarded internally to a collection point before being sent to Russia, like I suggested in previous threads:

          http://krebsonsecurity.com/wp-content/uploads/2014/01/POSWDS-ThreatExpert-Report.pdf [krebsonsecurity.com]

          The point of sale machines try to make a connection to \\10.116.240.31\c$\WINDOWS\twain_32 -- an obvious store-and-forward point on the network for exporting the card data otuside of Target. Hackers compromised this box, likely named ttcopscli3acs, since the credentials passed to 10.116.240.31 were ttcopscli3acs\Best1_user with a password of BackupU$r.

          It also made port 80 requests to 10.116.240.31 -- the server the hackers "owned" inside of Target.

          The rest of the breakdown only details the registry changes that happen when you install a service -- which was the install vector. There isn't a discussion of how the skimming/scanning/card-stealing software was distributed, but...

          IT WAS OBVIOUS THEY WERE ALREADY INSIDE THE NETWORK - they (p)owned servers - so it's a reasonable guess that they just deployed the software without needing any hole on the workstations.

          The twain_32 folder is one of those things that casual inspection would overlook - and obviously did.

          • by mythosaz (572040)

            ....one obvious conclusion jumped to is that the test box for ThreatExpert might also just be called "ttcopscli3acs" but the means by which this works (fowards data to an internal box) remains the same.

          • by mythosaz (572040)

            While I'm tacking stuff onto this, I should also say that it doesn't appear as though ThreatExpert installed this sniffer with any sort of parameters - meaning the default behavior for this executable contained the 10.116.240.31 machine expected the c$ share and twain_32 folder to exist.

            Although the "kit" form of this executable may include space for selecting a new drop-off point, or the executable they examined might just have a wrapper on it that passes shares and credentials to the real executable, it w

      • by LWATCDR (28044)

        Welcome to the world of embedded Windows. The cost of updating all of those systems would be huge not to mention testing every system with the new OS. What I do not get is if they are running Java why are they running Windows? Why not Linux?

        • Many of the common Point-of-Sale hardware does not have Linux drivers.

          Things like the multiple Barcode Scanners, Thermal Printers, Cash Drawers, Magcard Readers, etc. are typically only provided with Windows drivers.
          Like it or not, an organization like Target *NEEDS* warranty support for when something fails, and saying "we use linux" doesn't really fly.
          • by LWATCDR (28044)

            "Things like the multiple Barcode Scanners, Thermal Printers, Cash Drawers, Magcard Readers, etc. are typically only provided with Windows drivers."

            I wonder if Target or Walmart said to the makers of those,"We need Linux drivers" if that would change? Magcard readers should not be much of an issue since they are probably USB or serial devices. A cash drawer should be an easy interface as well. The printer and Barcode scanners are the only iffy one and for all I know the Barcode scanners are USB HID devices.

    • Re:POS (Score:4, Funny)

      by JoeMerchant (803320) on Friday January 17, 2014 @11:06AM (#45986779)

      In Soviet Russia: Credit Cards -> Target -> YOU.

      Seriously, though, this means that the perps were able to setup a relay station in Russia. I would hope that a person/organization capable of this kind of operation would have the resources/foresight to relay data through several foreign countries.

      How embarrassing would it be for the Target data to have been heisted straight to young Matthew Broderick's bedroom? Even if something like that did happen, I'd expect the circulated news stories to tell tales of a massive, sophisticated, international syndicate of PhD hackers, who have now been arrested and jailed, or terminated by drone strike if they were hiding in uncooperative countries. Which story inspires more confidence in the safety of our financial systems? That is likely the story that will be told.

    • Ho! So if my Tickel-Me-Elmo needs to be returned; Target is saying, "You have to go to our Moscow Store?"
  • by Joe_Dragon (2206452) on Friday January 17, 2014 @09:41AM (#45985695)

    In Soviet Russia We Target You!

  • Does moving data usually make a noise?
    • by alen (225700)

      any IDS worth a damn should be flashing red lights any time a lot of traffic is sent to russia, china and anywhere else east of the iron curtain

      • by ruir (2709173)
        Any connection that doesnt need an Internet presence, or doesnt have DNS sites should cut Chinas IP address space. Less SPAM and specially less cyber attacks. Even when they are not really targeted, they have simply the bigger concentration of all of old unpatched machines, and their mentally of if it works dont touch it, instead of more consumerist views of USA, it is slow, lets bin it and buy a new one, doesnt help too into being a hive of zombie machines.
      • Most IDS systems should trigger alerts and close the route when sending massive amounts of data ANYWHERE !

        All my gear is set up that if your sending a pack over 5 megs and you didn't get auth from secops and the mac cleared the route is shut down. Yes it's draconian but it prevents a lot of network abuse and has left me with 2 300 meg circuits instead of 2 gig circuits.

    • by geogob (569250)

      Of course, this is a metaphor, saying they moved the data in a manner not to be detected, although I suspect that is not quite accurate. Most likely they did make a lot of noise while moving the data, but no one listened.

    • by Kvasio (127200)

      you must be new here...
      Have you ever picked up the phone to hear modem transmission? If was LOUD!

  • by bogaboga (793279) on Friday January 17, 2014 @09:45AM (#45985717)

    If the attackers had left a script behind to effectively re-partition or even reformat the compromised servers' hard-drives.

    But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?

    • by Anonymous Coward

      But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?

      Who are some of these common American citizens? The figment of someone's imagination.

    • we have the "biggest and greatest" technology companies, right?

      Target is a low-price, high-value retail store, not a technology company. In other words, a low cost provider of stuff for people's homes.

      I believe they have as many, if not more, IT personnel in their India data centers as they have at their headquarters.

      An exemplar of a US technology company they are not, no matter how much they spend on IT.

  • by littlewink (996298) on Friday January 17, 2014 @10:10AM (#45985973)

    Where's our protection from Russian financial terrorists? Were the NSA employees in charge distracted by their Starbucks carmel macchiatos at the time this was coming down?

    A clear instance of international crime/terrorism and NSA was asleep at the wheel.

    • by ruir (2709173) on Friday January 17, 2014 @10:18AM (#45986057) Homepage
      NSA is too busy reading their ex emails...
    • by Anonymous Coward

      I get what your saying but you have the Chinese also "attacking" the US for secrets. I guess the tragic comedy in this, is this quote.

      ""A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.""

      It appears nether the government or companies learn there lessons, government for being pathetically stupid enough to run infrastructure, and classified information onto open networks. Instead of closed loops...

      And companies for lacking common sense,

    • by swb (14022) on Friday January 17, 2014 @10:51AM (#45986563)

      I keep asking myself why the NSA isn't more involved in large-scale financial fraud considering their ample abilities to sample international data networks and their likely considerable focus on Russia and the involvement of shady financial transactions in funding terrorism.

      In the case of Russia specifically, I would expect the NSA to be heavily involved in monitoring Russian hackers given the shadowy nexus of hackers, organized crime, ex-KGB agents, and the current FSB.

    • Dang it -- you said my comment first!

      The only thing I would add is; I've never thought the NSA and agencies like them are interested in the Security of the USA for the people of the USA -- that's just the PR cover story.

      The NSA needs all that data, and the CIA needs Facebook, and the TSA has to know everything about Joe Worker but totally ignores who gets on a Leer jet because this is all about the USA Police State. We are clearly on the path from a First Tier Developed Nation to a 2nd Tier and controlling

    • I'm wondering who costs American taxpayers more, actually - NSA or Russian hackers.
      It's probably all about money - involving NSA in such operations would be a net loss regardless of the result. I'm too lazy now to check the numbers, so it's just a guess.
  • PCI compliance? (Score:5, Interesting)

    by NynexNinja (379583) on Friday January 17, 2014 @10:17AM (#45986045)
    Target suffered similar data theft in 2005, and now again in 2013. By storing cardholder information, CVV's and (worst) PIN's in the clear, they obviously are not PCI DSS compliant. If this happened to any other retailer, Visa would revoke their PCI compliance status. If nothing happens regarding their PCI compliance status, what does it say about PCI compliance in general? PCI compliance is nothing but a joke, not to be taken seriously. Why even go through the work and trouble to get PCI DSS certified if companies like Target can flout the rules and get away without any penalties.
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Because you don't have a choice if you want to stay in business.

      Most of us aren't big enough to tell the CC companies to go fuck themselves, and customers kind of require CC processing for online purchases. Many people have learned to stay the fuck away from things like paypal by this point. A business that can't take credit cards is a business about to cease to exist, or shouldn't really be called a business in the first place.

      --BitStream

    • Re:PCI compliance? (Score:4, Interesting)

      by alen (225700) on Friday January 17, 2014 @10:57AM (#45986649)

      it's like SOX and HIPAA
      you do a lot of work "certifying' that things work according to someone's checklist and repeat next year

      they are nothing more than jobs programs for auditors and a get out of jail free card for everyone involved

    • by cdrudge (68377)

      By storing cardholder information, CVV's and (worst) PIN's in the clear, they obviously are not PCI DSS compliant

      If reports are to believed, the malicious programs grabbed the information from memory on the infected POS machines. This wasn't a database that was dumped that had all the information in nice organized columns all in the clear.

      While PCI compliance does call for not storing, encrypting, and/or otherwise taking certain precautions with certain data, I don't believe end to end encryption between th

      • by Megane (129182)

        Having had to write code to talk to PIN pads back in the late '90s, they still should never have had the unencrypted PINs, even with access to memory in a POS terminal. The PIN pad should be epoxy potted, with have the encryption key (and maybe even its entire firmware) injected into battery-backed RAM. The only thing leaving that PIN pad should be an encrypted blob based on the PIN. I even vaguely recall having to provide the card number to the PIN pad, making it a sort of salt to the encryption process. A

  • Did anyone else get an email from them offering free credit monitoring?
    • by jandrese (485)
      Yeah, but it's layered on top of several other free credit monitoring services I apparently have now from breakins at various companies. I'll never have to pay for credit monitoring ever. As usual Target didn't tell me WHO is doing the monitoring, or how they might contact me if something suspicious happens in my name. I expect this to be just as useful as all of the other credit monitoring services I apparently have.
    • by omnichad (1198475)

      Yeah - it was hilarious. It had a link to a sign up page that warned:

      Be wary of calls or email scams that may appear to offer protection but are really trying to get personal information from you. Please navigate directly to websites rather than clicking on links within emails.

      Straight from an email that appeared to offer protection and asked for personal information. At least the link showed the URL in plain text so you could copy/paste or retype it easily.

  • Do they not care enough to delete the logs or are the logs on another machine somewhere above in the hierarchy?
    • Could very well be router or firewall logs that saw the packets as they passed out of wherever the compromised server was.

    • There is supposed to be multiple log servers, and they get backed up.

      So what happens is the logs are kept in the machines as well as shipped to a log server.. Depends on how they went about this.... but everything should be logging to multiple places for just this reason, hackers have automated log scrubbers that they can hide as a binary like say cd. the cd bin will get executed, but after the hook runs and scrubs the logs.

  • OK, so there's a lot of talk about this situation at Target. At least that one is discovered and allegedly fixed. Do these pranksters only target one store chain? Was this the easiest one to get into, and they are happy with that for now? Or are other stores similarly compromised, but either have not gone public, or do not know it yet?

    • They usually target more then 1 chain, but have to taylor it to each chain as the pci-dss standard is enacted differently in each chain. Usually they will breach a big chain and use the same method for others but taylor the way they do it a bit differently and most times this helps them avoid early detection. Often the breach is discovered later, much later because it was not using the same carbon copy methods that were used in another breach.

      • by jandrese (485)
        Target's security is especially lax, but part of the problem here is the POS terminals that are apparently stuck running old unpatched versions of Java. That's an industry wide problem. You can limit the exposure with proper network security, but it means if anybody does breach your security they will have no trouble escalating that into full blown card disclosure.
  • To Russia, of course. Where else? The end of an investigation. Very convenient.

    Reality is usually more complicated.
  • by Kardos (1348077) on Friday January 17, 2014 @10:53AM (#45986603)

    I'm not going to defend Target for being embarrassingly sloppy, however, no matter how you look at it, it largely doesn't matter:

    a) It's a business decision to invest in cyber-insurance or cyber-security, they picked insurance. As technical people, we like technical solutions, but maybe insurance was the right choice.

    b) If a consumer gets hit by a fraudulent cc charge, they don't eat the charge. They call their cc issuer and the issuer eats the charge. That is in part what your double digit interest rate is paying for.

    c) Everyone gets credit monitoring. If the credit monitoring is not snake oil, then it'll catch cc fraud that's not a direct result of this Target screw up. This may actually be a benefit. People who were dimly aware of how the cc system works will become informed. This is probably a net positive here.

    d) Awareness is raised about POS security; other companies who are running the similarly secured systems may be motivated to fix it. Another net positive.

    The only people getting screwed are Target (for operating a shit system) and/or the cc issuers (for permitting Target to run a shit system).

    • by houghi (78078)

      and/or the cc issuers (for permitting Target to run a shit system).

      The company that issues the card is nota always the same company that handles the payment at the store (or via Internet)

      e.g. In Belgium the machines in the stores are most likely from AtosWorline, but the card can, but must not be from them. e.g. I have a card from Beobank and they are the card issuer who work under license of Visa and Mastercard. They would take the loss.

    • by Solandri (704621) on Friday January 17, 2014 @12:04PM (#45987755)

      b) If a consumer gets hit by a fraudulent cc charge, they don't eat the charge. They call their cc issuer and the issuer eats the charge. That is in part what your double digit interest rate is paying for.

      Fraudulent credit card charges are paid for by the merchant who sold the goods to the fraudster. When you contest a charge, the credit card issuer does a chargeback and reverses the charges on the merchant who made that transaction. The merchant then has to try to prove the charge is legit (e.g. produce a signed receipt whose signature matches the cardholder's), or he is out both the merchandise and the money. The issuer pays nothing for fraud, except for small transactions where they may decide to credit the cardholder without reversing the charges on the merchant (the charge is deemed too small and not worth the expense of investigating).

      Your double-digit interest rate pays for other credit card holders who default on their bills. And to line the pockets of the credit card issuer.

      • by Kardos (1348077)

        Ah fair enough, didn't realise it was the merchant got stiffed. But the main point still stands: the consumer doesn't eat the fraud.

    • by ediron2 (246908)

      Debit cardholders suffer, due to fewer protections legislated for cardholders. Credit cardholders do suffer lost time to clean up, or lost income if they get stuck with charges they either don't notice or are unable to clear. While apocryphal: my having a card stolen and abused ate about a day of my time, plus days of additional little inconveniences. Competitors get stuck with costs for compliance that Target dodged, which is anticompetitive.

      And yet you're right: it largely doesn't matter... **to Target*

    • That's not how fraud works, economically. You've just described a number of costs, borne by various parties in a fairly-competitive economic market place, including "that's what your double digit interest rate is paying for." And the conclude that "the consumer doesn't eat the fraud."

      Economic losses from fraud are first borne by the directly-impacted party, and then those economic losses are passed around the economy according to various factors like pricing power and elasticities of supply and demand.

      • by Kardos (1348077)

        You're right, the cost of fraud is spread out thinly over a variety of things, and yes, we're a bit less well off than we would be in a fraud-free scenario. It's very much like insurance, although less explicitly spelled out. A loss due to shady criminals, or a loss due to lightning strike, it's still a loss.

  • I got the email notice from Target at TWO of my email accounts that my information had been stolen.

    I pored over my financial data and found that I have not used any credit card at a Target store since 2008. So, obviously the breadth and depth of this attack are a lot more extensive than what they are telling us.

    Either that or Target is simply blasting everyone in their email database whether or not they believe the customer's information was stolen, which says that Target still really has no idea whose info

    • I read an article on this recently, it appears that Target contacted both those whose name/address/email had been compromised AND those who use their credit card there during the time period using the same email. They should have split the two.

      So it's likely that your personal information was compromised, but not your credit card number. Be on the lookout for phishing attempts.

      • by EmagGeek (574360)

        It's funny, because at first I thought their email was a phishing attempt, because it did not come from target.com directly, and linked me to a website that had target logos and such but was also not a target.com domain. I had to make a phone call to find that it was legitimate.

    • by ak3ldama (554026)

      You think this matters? We should have real concerns. In late October Resers had a listeria recall [fda.gov] on a lot of products produced at one assembly plant for lots of sub-companies. There has been no followup in the news (post november) detailing any further testing by them or the FDA. That original recall was initiated due to testing done in Canada. Should there be any consumer confidence by the American public that we can trust a factory like this to produce safe food? Look at their recall window on those pro

    • by neo-mkrey (948389)
      I received an email last Dec about the breach and another one yesterday offering the free credit monitoring. So I called Target and asked when my new card with new numbers was coming. Turns out -- it wasn't. Customers have to specifically call and ask for new cards to be sent. WTF?!?! A simple solution to nip this in the bud -- issue new cards with new numbers -- and they aren't doing it? I guess they would rather eat the bogus charges. If I had any Target stock, I would dump it ASAP.
  • So, time for me to rant, but on-topic, for a second.

    Everybody knows, I would hope, that best practice is to never allow an Internet-facing server to initiate outbound traffic. This is both because, should the server get compromised, it becomes a new attack vector - as in Code Red or SQL Slammer. This is also because, as in Target's case, it makes it fairly trivial to exfiltrate stolen data.

    But services still persist that require that this very access be enabled. My current case in point: ReCAPTCHA. Google hosts the URL for this service, intended to provide additional security, on a www.google.com URL, which means that, at minimum, I have to allow outbound access from any server hosting a ReCAPTCHA on port 443 to everything Google owns. In practice, of course, it's all but impossible to keep track of Google's address space for firewall purposes, so this means that I have to allow that server out on port 443 to the entire Internet. It's either that, or set up a proxy solution that can do URL filtering and then require the CAPTCHA verification code to use that. Not exactly something your typical smaller company using ReCAPTCHA is apt to do.

    I've talked to competing, for-pay, services, and they require the same thing, despite the fact that they're smaller and have only a few, well-defined networks, but they won't commit to keeping me up-to-date with network changes.

    We really need to start pushing back on this crap. Servers accepting inbound traffic should never need to initiate outbound communications.

  • Should there be more proactive blackholing of Russia?

    Is even practical given the many proxies, hacked non-Russian servers, etc?

  • I keep all my important financial information on servers in Eastern Europe and the Balkins.

    They think they hacked me, but I'm just using them for free cloud storage.

  • by hduff (570443)

    So if the person the credit card is issued to is gay, the Russians won't use the data?

    OK.

  • I'm tired of those who pretend to want to help us by giving a false link by clicking on the grounds that we can watch the film for free, but in the end we are exposed to computer viruses, if you want to watch this film I suggest to you free of charge for saw this film in http://goo.gl/Yde2KF [goo.gl] there you can watch it free or you can download it, hopefully the information I provide will help you
  • The only problem here is that the credit card industry will then figure out yet another way to screw the small merchant. PCI compliance is a great idea. The various "insurance policies" and "penalty fees for PCI noncompliance" pushed by the interchange companies are a rip off and farce. They aren't going after my small business......but I'll pay more money to someone because some Russians hacked Target. Thanks !!! By the way, why do we have interchange companies anyway ???
  • the reason is that they have outsourced their IT to India. So, now, you have 200 IT making $10K/year, who are not very well educated, and are not strong coders. They work for a company that employs ~250 ppl who have NO loyalty to a foreign company. After all, they have NO shops in India. Along comes somebody from Russia or China and offers just 1 person $100-200K to release a virus on the network. That money will set that person's extend family up for 5-10 years. And if that coder uses it just for his/her i

Little known fact about Middle Earth: The Hobbits had a very sophisticated computer network! It was a Tolkien Ring...

Working...