Target Credit Card Data Was Sent To a Server In Russia 137
angry tapir writes "The stolen credit card numbers of millions of Target shoppers took an international trip — to Russia. A peek inside the malicious software that infected Target's POS (point-of-sale) terminals is revealing more detail about the methods of the attackers as security researchers investigate one of the most devastating data breaches in history. Findings from two security companies show the attackers breached Target's network and stayed undetected for more than two weeks. Over two weeks, the malware collected 11GB of data from Target's POS terminals. The data was first quietly moved to another server on Target's network and then transmitted in chunks to a U.S.-based server that the attackers had hijacked. Logs from that compromised server show the data was moved again to a server based in Russia starting on Dec. 2."
A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.
POS (Score:5, Funny)
Re: POS (Score:5, Insightful)
Considering that the terminals in question were running un-patched, net booted XP SP2 WinPE instances with an old Java 4 version, the fact that there were attack vectors should be a long ways from shocking.
Re: POS (Score:5, Insightful)
Target doesn't really care. They had $100 million in cyber security insurance so most of the cost of this will be covered. AFA the public not trusting Target, well, it will pass quickly because the masses have a short attention span.
Re: POS (Score:5, Interesting)
They might care, but I can bet their solution will be more bureaucracy rather than better technology. There are likely IT people within the company that see the problems and know how to fix them but they will be ignored. CxO types hate those annoying IT people that are always complaining about security. They will bring in a solution sold by a slick sales person at a major company.
Traget outsourced IT operatations (Score:4, Insightful)
Traget outsourced IT operatations and field work is subbed out as well.
So maybe the IT people within the company that see the problems and may know how to fix them are so far apart form the people who work that team that they can't get stuff down or things are setup up that way so it's easier to sub work out vs locking stuff down and giving each Subcontractor there own logins / private email / info on the system.
Using common logins / just giving the info contractors who then giving that info out to the subcontracts is easier and makes it easier to change firms on each level. But then that info may not get changes / ends in the hands of non tech people who may not give it the security it needs.
Re: (Score:2)
Re: (Score:3)
Is likely the most accurate statement I've seen in a while. In my 20+ years in the tech/IT/OT field, what a salesman
Re: POS (Score:5, Informative)
Re: (Score:1)
It is also possible that their underwriters could claim that Target did not take due diligence in protecting its network and thus a full payout is not warranted. Insurance companies do not like being treated like a blank check to not take precautions.
That's not what underwriters do. Underwriters would be the ones responsible for not researching the security measures Target had in place when they estimated the premiums that should be charged.
Re: (Score:1)
That will probably satisfy the card processing industry and insurers. Clearly it satisfied the director and C-level executives.
OTOH, they are pretty clueless about how to secure an IT infrastructure. Practices likely followed typical industry norms: minimum length passwords containing upper/lower case, a number and a speci
Re: POS (Score:5, Interesting)
I am curious regarding your information. Got source?
Last I'd heard, the expected sum of lawsuits, settlements, fines, etc. would be WELL over $100mil (as in several times that). Apparently, for reference, a similar breach, TJ Maxx, ended up being closer to $200mil.
Furthermore, it seems Target was self-insured for this. So it isn't quite correct to think they will glibly had this bill to an insurer - they ARE their own insurer.
Re: (Score:1)
Here's one [businessinsurance.com]
Re: (Score:3)
Last I'd heard, the expected sum of lawsuits, settlements, fines, etc. would be WELL over $100mil (as in several times that). Apparently, for reference, a similar breach, TJ Maxx, ended up being closer to $200mil.
While $200 million is a lot of money to a lot of people, it's less than 10% of Target's typical annual profit. Some financial summaries [target.com]
So yes, it will sting a bit, but it's not going to put them under.
Re: (Score:2)
And on the plus side, it will hurt the CxO types (less bonuses & dividends) who would have blocked the decision to upgrade to a better, but more expensive, POS.
Re: (Score:2)
That's a real knee slapper!
The performance bonuses will be paid out on time and at maximum value. Employee hours will be cut and managers will make speeches about how they all have to pull together and do more with less (except the CxOs of course) to get through the tough times.
Re: (Score:2)
there shouldn't be insurance for breaking the rules.
the insurance company should just fuck 'em at this point for not keeping up their part of the deal - there's certain ways of acting that was expected from target - and well, if they happen this often then they should charge them 15 million per year for the insurance at least.
oh and you know, the fucking big cc companies should just treat them the same as any smaller business, but they don't. if some mom'n'pop had similar happening they wouldn't be charging
Re: POS (Score:5, Interesting)
Re: POS (Score:5, Informative)
Doesn't appear that way to me..
The actual report on the software installed on the agent makes it pretty clear that the information was being gathered locally and forwarded internally to a collection point before being sent to Russia, like I suggested in previous threads:
http://krebsonsecurity.com/wp-content/uploads/2014/01/POSWDS-ThreatExpert-Report.pdf [krebsonsecurity.com]
The point of sale machines try to make a connection to \\10.116.240.31\c$\WINDOWS\twain_32 -- an obvious store-and-forward point on the network for exporting the card data otuside of Target. Hackers compromised this box, likely named ttcopscli3acs, since the credentials passed to 10.116.240.31 were ttcopscli3acs\Best1_user with a password of BackupU$r.
It also made port 80 requests to 10.116.240.31 -- the server the hackers "owned" inside of Target.
The rest of the breakdown only details the registry changes that happen when you install a service -- which was the install vector. There isn't a discussion of how the skimming/scanning/card-stealing software was distributed, but...
IT WAS OBVIOUS THEY WERE ALREADY INSIDE THE NETWORK - they (p)owned servers - so it's a reasonable guess that they just deployed the software without needing any hole on the workstations.
The twain_32 folder is one of those things that casual inspection would overlook - and obviously did.
Re: (Score:2)
....one obvious conclusion jumped to is that the test box for ThreatExpert might also just be called "ttcopscli3acs" but the means by which this works (fowards data to an internal box) remains the same.
Re: (Score:2)
While I'm tacking stuff onto this, I should also say that it doesn't appear as though ThreatExpert installed this sniffer with any sort of parameters - meaning the default behavior for this executable contained the 10.116.240.31 machine expected the c$ share and twain_32 folder to exist.
Although the "kit" form of this executable may include space for selecting a new drop-off point, or the executable they examined might just have a wrapper on it that passes shares and credentials to the real executable, it w
Re: (Score:2)
Welcome to the world of embedded Windows. The cost of updating all of those systems would be huge not to mention testing every system with the new OS. What I do not get is if they are running Java why are they running Windows? Why not Linux?
Re: (Score:3)
Things like the multiple Barcode Scanners, Thermal Printers, Cash Drawers, Magcard Readers, etc. are typically only provided with Windows drivers.
Like it or not, an organization like Target *NEEDS* warranty support for when something fails, and saying "we use linux" doesn't really fly.
Re: (Score:2)
"Things like the multiple Barcode Scanners, Thermal Printers, Cash Drawers, Magcard Readers, etc. are typically only provided with Windows drivers."
I wonder if Target or Walmart said to the makers of those,"We need Linux drivers" if that would change? Magcard readers should not be much of an issue since they are probably USB or serial devices. A cash drawer should be an easy interface as well. The printer and Barcode scanners are the only iffy one and for all I know the Barcode scanners are USB HID devices.
Re:POS (Score:4, Funny)
In Soviet Russia: Credit Cards -> Target -> YOU.
Seriously, though, this means that the perps were able to setup a relay station in Russia. I would hope that a person/organization capable of this kind of operation would have the resources/foresight to relay data through several foreign countries.
How embarrassing would it be for the Target data to have been heisted straight to young Matthew Broderick's bedroom? Even if something like that did happen, I'd expect the circulated news stories to tell tales of a massive, sophisticated, international syndicate of PhD hackers, who have now been arrested and jailed, or terminated by drone strike if they were hiding in uncooperative countries. Which story inspires more confidence in the safety of our financial systems? That is likely the story that will be told.
Re: (Score:2)
in soviet russia (Score:5, Funny)
In Soviet Russia We Target You!
Re:in soviet russia (Score:4, Informative)
Quietly moved ??? (Score:2, Funny)
Re: (Score:2)
Then there are hard drive noises, tape noises, CD noises...
So I'd say moving data usually makes a noise. Not always, but usually.
Re: (Score:2)
Re: (Score:2)
Most of the servers that serve content over the Internet use hard drives ;-)
Re: (Score:1)
any IDS worth a damn should be flashing red lights any time a lot of traffic is sent to russia, china and anywhere else east of the iron curtain
Re: (Score:3)
Re: (Score:2)
Most IDS systems should trigger alerts and close the route when sending massive amounts of data ANYWHERE !
All my gear is set up that if your sending a pack over 5 megs and you didn't get auth from secops and the mac cleared the route is shut down. Yes it's draconian but it prevents a lot of network abuse and has left me with 2 300 meg circuits instead of 2 gig circuits.
Re: (Score:2)
Of course, this is a metaphor, saying they moved the data in a manner not to be detected, although I suspect that is not quite accurate. Most likely they did make a lot of noise while moving the data, but no one listened.
Re: (Score:2)
you must be new here...
Have you ever picked up the phone to hear modem transmission? If was LOUD!
It could have been worse... (Score:3)
If the attackers had left a script behind to effectively re-partition or even reformat the compromised servers' hard-drives.
But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?
Re: (Score:1)
But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?
Who are some of these common American citizens? The figment of someone's imagination.
Re: (Score:1)
we have the "biggest and greatest" technology companies, right?
Target is a low-price, high-value retail store, not a technology company. In other words, a low cost provider of stuff for people's homes.
I believe they have as many, if not more, IT personnel in their India data centers as they have at their headquarters.
An exemplar of a US technology company they are not, no matter how much they spend on IT.
And the NSA Missed All Of This? (Score:5, Interesting)
Where's our protection from Russian financial terrorists? Were the NSA employees in charge distracted by their Starbucks carmel macchiatos at the time this was coming down?
A clear instance of international crime/terrorism and NSA was asleep at the wheel.
Re:And the NSA Missed All Of This? (Score:5, Funny)
Re: (Score:1)
NSA is too busy reading their ex emails...
Ha, Love it!
Re: (Score:1)
I get what your saying but you have the Chinese also "attacking" the US for secrets. I guess the tragic comedy in this, is this quote.
""A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.""
It appears nether the government or companies learn there lessons, government for being pathetically stupid enough to run infrastructure, and classified information onto open networks. Instead of closed loops...
And companies for lacking common sense,
Re:And the NSA Missed All Of This? (Score:4, Interesting)
I keep asking myself why the NSA isn't more involved in large-scale financial fraud considering their ample abilities to sample international data networks and their likely considerable focus on Russia and the involvement of shady financial transactions in funding terrorism.
In the case of Russia specifically, I would expect the NSA to be heavily involved in monitoring Russian hackers given the shadowy nexus of hackers, organized crime, ex-KGB agents, and the current FSB.
Re: (Score:2)
Dang it -- you said my comment first!
The only thing I would add is; I've never thought the NSA and agencies like them are interested in the Security of the USA for the people of the USA -- that's just the PR cover story.
The NSA needs all that data, and the CIA needs Facebook, and the TSA has to know everything about Joe Worker but totally ignores who gets on a Leer jet because this is all about the USA Police State. We are clearly on the path from a First Tier Developed Nation to a 2nd Tier and controlling
Re: (Score:1)
It's probably all about money - involving NSA in such operations would be a net loss regardless of the result. I'm too lazy now to check the numbers, so it's just a guess.
PCI compliance? (Score:5, Interesting)
Re: (Score:2, Insightful)
Because you don't have a choice if you want to stay in business.
Most of us aren't big enough to tell the CC companies to go fuck themselves, and customers kind of require CC processing for online purchases. Many people have learned to stay the fuck away from things like paypal by this point. A business that can't take credit cards is a business about to cease to exist, or shouldn't really be called a business in the first place.
--BitStream
Re:PCI compliance? (Score:4, Interesting)
it's like SOX and HIPAA
you do a lot of work "certifying' that things work according to someone's checklist and repeat next year
they are nothing more than jobs programs for auditors and a get out of jail free card for everyone involved
Re: (Score:3)
If reports are to believed, the malicious programs grabbed the information from memory on the infected POS machines. This wasn't a database that was dumped that had all the information in nice organized columns all in the clear.
While PCI compliance does call for not storing, encrypting, and/or otherwise taking certain precautions with certain data, I don't believe end to end encryption between th
Re: (Score:1)
Having had to write code to talk to PIN pads back in the late '90s, they still should never have had the unencrypted PINs, even with access to memory in a POS terminal. The PIN pad should be epoxy potted, with have the encryption key (and maybe even its entire firmware) injected into battery-backed RAM. The only thing leaving that PIN pad should be an encrypted blob based on the PIN. I even vaguely recall having to provide the card number to the PIN pad, making it a sort of salt to the encryption process. A
Won't shop there again, but... (Score:2)
Re: (Score:2)
Re: (Score:2)
Yeah - it was hilarious. It had a link to a sign up page that warned:
Be wary of calls or email scams that may appear to offer protection but are really trying to get personal information from you. Please navigate directly to websites rather than clicking on links within emails.
Straight from an email that appeared to offer protection and asked for personal information. At least the link showed the URL in plain text so you could copy/paste or retype it easily.
I don't get it (Score:2)
Re: (Score:2)
Could very well be router or firewall logs that saw the packets as they passed out of wherever the compromised server was.
Re: (Score:2)
There is supposed to be multiple log servers, and they get backed up.
So what happens is the logs are kept in the machines as well as shipped to a log server.. Depends on how they went about this.... but everything should be logging to multiple places for just this reason, hackers have automated log scrubbers that they can hide as a binary like say cd. the cd bin will get executed, but after the hook runs and scrubs the logs.
Obviuos question - Who else is infected? (Score:1)
OK, so there's a lot of talk about this situation at Target. At least that one is discovered and allegedly fixed. Do these pranksters only target one store chain? Was this the easiest one to get into, and they are happy with that for now? Or are other stores similarly compromised, but either have not gone public, or do not know it yet?
Re: (Score:2)
They usually target more then 1 chain, but have to taylor it to each chain as the pci-dss standard is enacted differently in each chain. Usually they will breach a big chain and use the same method for others but taylor the way they do it a bit differently and most times this helps them avoid early detection. Often the breach is discovered later, much later because it was not using the same carbon copy methods that were used in another breach.
Re: (Score:2)
too obvious (Score:2)
Reality is usually more complicated.
It largely doesn't matter (Score:4, Interesting)
I'm not going to defend Target for being embarrassingly sloppy, however, no matter how you look at it, it largely doesn't matter:
a) It's a business decision to invest in cyber-insurance or cyber-security, they picked insurance. As technical people, we like technical solutions, but maybe insurance was the right choice.
b) If a consumer gets hit by a fraudulent cc charge, they don't eat the charge. They call their cc issuer and the issuer eats the charge. That is in part what your double digit interest rate is paying for.
c) Everyone gets credit monitoring. If the credit monitoring is not snake oil, then it'll catch cc fraud that's not a direct result of this Target screw up. This may actually be a benefit. People who were dimly aware of how the cc system works will become informed. This is probably a net positive here.
d) Awareness is raised about POS security; other companies who are running the similarly secured systems may be motivated to fix it. Another net positive.
The only people getting screwed are Target (for operating a shit system) and/or the cc issuers (for permitting Target to run a shit system).
Re: (Score:2)
Re:It largely doesn't matter (Score:4, Informative)
Fraudulent credit card charges are paid for by the merchant who sold the goods to the fraudster. When you contest a charge, the credit card issuer does a chargeback and reverses the charges on the merchant who made that transaction. The merchant then has to try to prove the charge is legit (e.g. produce a signed receipt whose signature matches the cardholder's), or he is out both the merchandise and the money. The issuer pays nothing for fraud, except for small transactions where they may decide to credit the cardholder without reversing the charges on the merchant (the charge is deemed too small and not worth the expense of investigating).
Your double-digit interest rate pays for other credit card holders who default on their bills. And to line the pockets of the credit card issuer.
Re: (Score:2)
Ah fair enough, didn't realise it was the merchant got stiffed. But the main point still stands: the consumer doesn't eat the fraud.
Re: (Score:2)
Debit cardholders suffer, due to fewer protections legislated for cardholders. Credit cardholders do suffer lost time to clean up, or lost income if they get stuck with charges they either don't notice or are unable to clear. While apocryphal: my having a card stolen and abused ate about a day of my time, plus days of additional little inconveniences. Competitors get stuck with costs for compliance that Target dodged, which is anticompetitive.
And yet you're right: it largely doesn't matter... **to Target*
it DOES matter! (Score:2)
That's not how fraud works, economically. You've just described a number of costs, borne by various parties in a fairly-competitive economic market place, including "that's what your double digit interest rate is paying for." And the conclude that "the consumer doesn't eat the fraud."
Economic losses from fraud are first borne by the directly-impacted party, and then those economic losses are passed around the economy according to various factors like pricing power and elasticities of supply and demand.
Re: (Score:2)
You're right, the cost of fraud is spread out thinly over a variety of things, and yes, we're a bit less well off than we would be in a fraud-free scenario. It's very much like insurance, although less explicitly spelled out. A loss due to shady criminals, or a loss due to lightning strike, it's still a loss.
I got the notice... (Score:2)
I got the email notice from Target at TWO of my email accounts that my information had been stolen.
I pored over my financial data and found that I have not used any credit card at a Target store since 2008. So, obviously the breadth and depth of this attack are a lot more extensive than what they are telling us.
Either that or Target is simply blasting everyone in their email database whether or not they believe the customer's information was stolen, which says that Target still really has no idea whose info
Re: (Score:3)
I read an article on this recently, it appears that Target contacted both those whose name/address/email had been compromised AND those who use their credit card there during the time period using the same email. They should have split the two.
So it's likely that your personal information was compromised, but not your credit card number. Be on the lookout for phishing attempts.
Re: (Score:1)
It's funny, because at first I thought their email was a phishing attempt, because it did not come from target.com directly, and linked me to a website that had target logos and such but was also not a target.com domain. I had to make a phone call to find that it was legitimate.
Re: (Score:1)
You think this matters? We should have real concerns. In late October Resers had a listeria recall [fda.gov] on a lot of products produced at one assembly plant for lots of sub-companies. There has been no followup in the news (post november) detailing any further testing by them or the FDA. That original recall was initiated due to testing done in Canada. Should there be any consumer confidence by the American public that we can trust a factory like this to produce safe food? Look at their recall window on those pro
Re: (Score:2)
Limiting outbound access to servers is too tough (Score:3)
So, time for me to rant, but on-topic, for a second.
Everybody knows, I would hope, that best practice is to never allow an Internet-facing server to initiate outbound traffic. This is both because, should the server get compromised, it becomes a new attack vector - as in Code Red or SQL Slammer. This is also because, as in Target's case, it makes it fairly trivial to exfiltrate stolen data.
But services still persist that require that this very access be enabled. My current case in point: ReCAPTCHA. Google hosts the URL for this service, intended to provide additional security, on a www.google.com URL, which means that, at minimum, I have to allow outbound access from any server hosting a ReCAPTCHA on port 443 to everything Google owns. In practice, of course, it's all but impossible to keep track of Google's address space for firewall purposes, so this means that I have to allow that server out on port 443 to the entire Internet. It's either that, or set up a proxy solution that can do URL filtering and then require the CAPTCHA verification code to use that. Not exactly something your typical smaller company using ReCAPTCHA is apt to do.
I've talked to competing, for-pay, services, and they require the same thing, despite the fact that they're smaller and have only a few, well-defined networks, but they won't commit to keeping me up-to-date with network changes.
We really need to start pushing back on this crap. Servers accepting inbound traffic should never need to initiate outbound communications.
Re:Limiting outbound access to servers is too toug (Score:4, Interesting)
More proactive blackholing of Russia? (Score:2)
Should there be more proactive blackholing of Russia?
Is even practical given the many proxies, hacked non-Russian servers, etc?
Re: (Score:2)
That will not effectively stop credit card fraud.
Re: (Score:2)
I don't see what the big deal is (Score:1)
I keep all my important financial information on servers in Eastern Europe and the Balkins.
They think they hacked me, but I'm just using them for free cloud storage.
Russia? (Score:2)
So if the person the credit card is issued to is gay, the Russians won't use the data?
OK.
nice film (Score:1)
Yet another excuse to surcharge the small merchant (Score:2)
target can not secure it, anymore than the others (Score:2)
Re: (Score:2)
What's happening is that victims are canceling those cards and everyone is on the lookout for. So, when the Russian hackers try to sell or use them, they're not going to work.
Their booty is worthless.
Who's to say this wasn't the goal? Perhaps the actual goal was to adversely affect Target or the US card processing regime.
Where would one fence eleventy billion credit card numbers, anyway? It's not like this a tenable amount, considering the depth of market for stolen credit card numbers.
Re: (Score:3)
Re: (Score:2)
They spent months selling them already. The guys who did this have already made out like bandits.
Perhaps they made out like bandits because they are bandits?