Security Vendors Self-Censor Target Breach Details

angry tapir writes "At least three security companies have scrubbed information related to Target from the Web, highlighting the ongoing sensitivity around one of the largest-ever data breaches. How hackers broke into Target and installed malware on point-of-sale terminals that harvested up to 40 million payment card details is extremely sensitive. Now, details that give insight into the attack are being hastily removed or redacted by security companies."

Oh good

[gamanimatron]

Without details about the attack vector and attacker behavior during and after the breach, we're left with "Well, someone broke in to their servers using [redacted] and then they did [redacted]." Totally frickin' useless for me when trying to secure our sites: "There's this horrible emerging threat that can fry your brand overnight, but we won't tell you what it is or give enough details for you to defend against it."

Meanwhile, the guys in timbucktooistan can now order the proven exploit kit from their favorite BBS.

Meh.

Target just couldn't handle this any worse

[Sycraft-fu]

If they'd just come out and said "Yes, some evil hax0rs got in to our system and stole lots of cards. Stupid haxors, everyone hates those guys. Here's how they did it, here's what we are doing, and here's some security experts that are helping us," well people would probably be fine with it.

Instead they are being all secretive and it makes people worry. They also are doing shit for notification. I always use my Target card when I shop at Target because it has the best bribes (5% off anything, since they actually run their own bank and don't have to pay payment processing fees on it). I have received zero notifications from Target about the compromise, and no new card. I know my card was hit, since I have friends who shop at the same store using non-Target cards that got notified, but Target hasn't done anything.

I'm not worried, they have to deal with all the fallout of any unauthorized charges and the card can only be used at Target, but it is just extremely bad form. It shows a real lack of care and understand as to the severity of this. It really makes them look bad.

If there's something history has show with regards to people and companies it is that you need to admit you fucked up, even if it wasn't your fault really, and show people how you are making it right. Then, they are happy and forgive. Get all secretive and hostile, and they'll get hostile right back.

Useless effort

[pegr]

If by "don't want to compromise the investigation" they mean "don't want to let the crooks know what we know", they have already failed. Any action to remove material now is simply playing to politics.

Personally, I think the value of publishing the data is higher than not tipping your cards to crooks. They know what they left behind.

Wonder Why It keeps Happening?

[rmdingler]

Now you know.

No open resolution of a security breach so that particular vector of attack can be scrutinized by the retail industry and perhaps better guarded against.

Better to control PR damage now than prevent a recurrence.

Re:Happy Wednesday from The Golden Girls!

[Taco Cowboy]

From TFA:

... Now, details that give insight into the attack are being hastily removed or redacted by security companies Security through obscurity at play ?

Hackers already know the way to do it, or they wouldn't be able to break into Target's databases.

By deleting the info what the so-called 'security companies" are doing is to depriving the legitimate business owners a way to beef up their own security measures by learning from the mistakes of Target.

Re:Oh good

[abirdman]

I agree 100%. The security companies who advise the likes of Target aren't talking about the whole exploit-- indeed, are pro-actively hiding the details-- because they don't want to explain how their hideously expensive security best practices were utterly pwned by some foreigners who weren't interested in any of their acronyms. These security guys are like Stratfor-- pugnacious, pistol-packing, ex-military folk who think computer security is just a variation on any other kind of security detail, and are prepared to sell the hell out of their ideas, even when they can't secure their own passwords.

Re:Target just couldn't handle this any worse

[phantomfive]

No one cares about backups until their hard drive crashes.
No one cares about security until they get hacked.

Your data is in everyone else's hands

[Toe, The]

Exactly. The story that still isn't being expressed well is that your data is in the hands of every company you have transactions with.

And so you are entrusting all of them to have top-notch IT (better IT than all hackers interested in targeting them). What are the chances that's the case?

I'd hazard that 10% of companies have good, solid, rigid security policies (and it's the policies that matter much more than the tech, usually). So that implies that 90% of the time you hand out your personal info to someone, it's highly vulnerable.

Just chew on that for a bit. I'd be very interested in hearing proposals for a global solution.

doesnt matter

[EMG at MU]

I have done large scale POS stuff. Probably at least the same scale or bigger than target. This was done by someone who knows target's system. Not necessarily someone on the inside but someone who knows inside information. Nothing top secret, just general info on how stuff works.

And there are hundreds of people who know this information. Hundreds of people who are no longer with target. If target is anything like the place I worked, they use a lot of contractors (temps). They treat these temps like shit. It's not just devs who know the dirty on target's system, its QA people, network people, support people, ops people.

The cat is out of the bag. Censoring websites isn't going to help target. The info has already spread to places target can't censor. They should focus on fixing their shit. It's going to be expensive.

Re:Credit cards are stupid.

[jader3rd]

Who in hell thought it was a good idea to use a system where a single piece of information, consisting of just a few bytes, gives someone a blank check to my bank account?

Someone trying to lower the costs of moving money around. The system currently has one big important factor to it, and that's the fact that if anybody tries to break the trust of the big players, the big players won't let them back into the system. So they can have as little security as possible, because of the belief that the desire to continue to do business with the big players will keep everybody in check.