13 ms·
Target Hackers Broke in via HVAC Company
- mdaniel 13y agoIs it common and responsible to name the source of the credential leak like that? I can imagine that maybe other retailers would want to know that information, but I can also imagine the investigation is continuing and thus the opportunity exists for the story to become more complex.
- deleted 13y ago[deleted]
- jessaustin 13y agoStill on the Krebs front page...
- brown9-2 13y agoOther retailers should be less concerned about if they have done business with this vendor than they should be able letting any vendor have insecure access to their network.
- jessaustin 13y agoIt’s not immediately clear why Target would have given an HVAC company external network access...
- jauer 13y agoWhen you reach a certain size of HVAC system it is common for the dealer to regularly service the system and proactively monitor it. This requires access to the controllers to see a pump has failed, coolant pressure dropped, etc. They should have ordered a stand-alone Internet connection for such things but probably figured they'd save the money and use the existing network connection.
- Shivetya 13y agothe real problem here is that they should have had two distinct networks, one for their payment system that is wholly separate from all other network activity. Its boggling to me that any company would permit another company on the same network when their work is wholly unrelated.
- VLM 13y ago"Its boggling to me that any company would permit another company on the same network when their work is wholly unrelated." Not really, you've got a store manager who wants instant access to the same refrigeration alarms and control system his vendor sees and live sales figures all from the same PC. I can totally see it happening. Wholly unrelated would be the Target store manager (or district mgr or whatever) having access to Walmarts backup generator telemetry.
- ericcumbee 13y agoReally all they would need is a VLAN and a proper set of ACLs.
- deleted 13y ago[deleted]
- jessaustin 13y agoIt's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Defense at the perimeter only is flawed, especially when the perimeter is the only thing protecting cash registers that update with unsigned firmware. One wouldn't connect such a client directly to the internet, so neither should one connect it directly to a network shared by millions of devices at 1700 stores.
- bdunbar 13y ago> It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Exactly this. I realized this a few years ago, at a previous employer. We had _excellent_ security at the firewall boundary. Inside the network gave me cause for concern. Once could plug into any port, in any building, get an IP address and ping anything on our network. And how good was site security at a given location? Who knew, really. When your server's security depends on J. Random Employee not allowing tail-gaters at the back door ... you got problems.
- ChuckMcM 13y agoThere was a really funny story about a vendor of some equipment at one of Google's new data centers trying to convince Google that it had to have access to the data center network so that it could monitor its doo-dads. As I recall the "solution" was some plenum rated CAT5 that went out of the roof and attached to a DSL line on a pole at the corner of the property.
- fidotron 13y agoI for one welcome the fantastic security enabled by the Internet of Things.
- stakent 13y agoThis already started. TV receivers broadcasting metadata about files on devices connected to the LAN. Routers allowing anonymous access over ftp to the disks connected to them. Routers protected on the WAN side with factory set passwords. Kettles and irons equipped with wifi and looking for open networks to broadcast something to the world. (Smart)phones with broadband processors with DMA access to the applications processor's memory. Computers, tablets and game consoles equipped conveniently with cameras and microphones. We live in the future, do we like this or not.
- toomuchtodo 13y agoI have seen TV broadcast equipment with SNMP and web interfaces exposed on public internet addresses. Days ago.
- jauer 13y agoThis doesn't surprise me. From what I've seen on the provider side HVAC (and access control) companies want their devices right on the Internet. If you push them they'll deal with being behind NAT with a port forward but mention using a VPN and that's too much work for them. Ask them about security and they hand wave and say it is secure because it is a "appliance" or "controller" as if that magically protects them. This is changing somewhat as vendors move to a "phone home to the cloud" approach instead of direct access so they can get in on the revenue stream between the end user and the dealer. This removes the direct exposure to the internet but the local/insider threat remains.
- brubaker 13y ago"but mention using a VPN and that's too much work for them." I don't understand the problem, if they want access they will have to deal with the security protocols.
- benmarks 13y agoAnd, evidently, they've broken into Krebsonsecurity.com to delete this.
- a3n 13y agoGo up one level in the URL.
- panarky 13y agoEdit: The article is back up now. --- The article has disappeared. Here's the text of the first part of the post from Google cache. http://webcache.googleusercontent.com/search?q=cache:mG2INOjNyFUJ:krebsonsecurity.com/+&cd=2&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:mG2INOj... Feb 14 Target Hackers Broke in Via HVAC Company Last week, Target told reporters at The Wall Street Journal and Reuters that the initial intrusion into its systems was traced back to network credentials that were stolen from a third party vendor. Sources now tell KrebsOnSecurity that the vendor in question was a refrigeration, heating and air conditioning subcontractor that has worked at a number of locations at Target and other top retailers. Sources close to the investigation said the attackers first broke into the retailer’s network on Nov. 15, 2013 using network credentials stolen from Fazio Mechanical Services, a Sharpsburg, Penn.-based provider of refrigeration and HVAC systems. Fazio president Ross Fazio confirmed that the U.S. Secret Service visited his company’s offices in connection with the Target investigation, but said he was not present when the visit occurred. Fazio Vice President Daniel Mitsch declined to answer questions about the visit. According to the company’s homepage, Fazio Mechanical also has done refrigeration and HVAC projects for specific Trader Joe’s, Whole Foods and BJ’s Wholesale Club locations in Pennsylvania, Maryland, Ohio, Virginia and West Virginia. Target spokeswoman Molly Snyder said the company had no additional information to share, citing a “very active and ongoing investigation.” It’s not immediately clear why Target would have given an HVAC company external network access, or why that access would not be cordoned off from Target’s payment system network. But according to a cybersecurity expert at a large retailer who asked not to be named because he did not have permission to speak on the record, it is common for large retail operations to have a team that routinely monitors energy consumption and temperatures in stores to save on costs (particularly at night) and to alert store managers if temperatures in the stores fluctuate outside of an acceptable range that could prevent customers from shopping at the store. “To support this solution, vendors need to be able to remote into the system in order to do maintenance (updates, patches, etc.) or to troubleshoot glitches and connectivity issues with the software,” the source said. “This feeds into the topic of cost savings, with so many solutions in a given organization. And to save on head count, it is sometimes beneficial to allow a vendor to support versus train or hire extra people.” Continue reading →
- 13y ago
- benkillin 13y agoThis is a non cached link that appears to still function: http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/#more-24698 http://krebsonsecurity.com/2014/02/target-hackers-broke-in-v...
- reeses 13y agoOne of the key parts of this for consumers to keep in mind is that this is a massive PCI violation. Target neglected many of the most basic requirements in terms of network segmentation and data protection. Target is a large tier-one retailer. They had 3rd party audits to "guarantee" PCI compliance. However, the 3rd party is usually a single 'auditor' who interviews the staff and looks at the network diagrams provided by the IT department. This information may be inaccurate to the point that it may not even exist. The focus in these audits is almost always ecommerce. I'm sure Target's ecommerce site has been scoped very thoroughly. Almost every retailer is just as exposed. While every client I've worked with has (by the time I left) been PCI compliant on the ecommerce side, the internal networks are often completely flat, even across global locations. SOX is a joke as a result, as there is no separation of concerns.
- maxerickson 13y agoWhat lessons beyond "Even major retailers have serious security problems" should a consumer be worried about here? I don't know much about PCI compliance, but I don't get the idea that it is something I should have to worry about as a user of a credit card.
- derekp7 13y agoThe lesson is to have more than one credit card, because eventually the one you use regularly will be compromised -- even if you only use it at physical locations. And when it is compromised, you will have to get a replacement, which is an inconvenience (hence the need for a second card). Oh, and keep an eye on your statements. And if you use a debit card, you may be worse off -- when it is compromised, you will have bills bouncing until you can get it straightened out. Even more of an inconvenience. If you use a debit card, go to your bank and have them turn off the "feature" that lets you overdraft (and get charged a $35.00 fee each time). Set up a separate account (one that doesn't have a debit card), to use for all your bill payments, so at least that doesn't get behind if your main account is cleaned out.
- ars 13y ago
- fragsworth 13y agoThe way credit cards are designed should be illegal. They are basically a piece of plain text that can be used by anyone to purchase things from someone's account. It's basically the worst security you could possibly have for one of the highest-risk systems (direct access to money) that exist. People need to be angry at the credit card industry for designing such an insecure system, not Target. There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer.
- MichaelGG 13y agoHow is it bad security? As a consumer, there's practically no issue. Data mining for fraud detection is pushed off onto the card provider - not my problem. There's no "direct access to money". It's a bill from a service provider that I can easily dispute. At worst, it's a slight inconvenience if my CC info is compromised.
- mathattack 13y agoExactly. And fraud is low enough that they're happy to do this.
- cheald 13y agoWell, maybe we should talk about debit cards, which are functionally identical. The Target breach included theft of PINs - a purchase made with your debit card plus PIN is on you, not on a CC company.
- MichaelGG 13y agoDebit cards are terrible for this reason. And as I understand, chip-and-PIN models also start moving the security onto the consumer. Nice for merchants, crappy for consumers.
- jarek 13y agoGet back to us when there's a major practical breach of a chip-and-PIN system and consumers aren't compensated.
- mathattack 13y agoThis kind of reminds me of the original Wall Street movie, where Charlie Sheen broke into companies via their cleaning service, and then stole inside information.
- mikegioia 13y agoWow, I'm more surprised that they had $100M "cyber" insurance.
- ceejayoz 13y ago@patio11: "Makes sense - I have one million, as a rider to E&O policy. The insurance companies practically give it away." https://twitter.com/patio11/status/431219958047965185 https://twitter.com/patio11/status/431219958047965185
- patio11 13y agoSo if I check my actual policy documents, it's described as a "Data Breach Expense And Regulatory Defense Coverage rider to your Errors and Omissions Policy." But hey, computers are involved, so the news media would probably call that my cyberinsurance.
- chatmasta 13y agoCurious: What are the ethical implications for the thieves? They effectively stole from a giant, multinational corporation, and inconvenienced consumers. At the end of the day, no consumer lost money from this. I wonder how this differentiation affects the consciences of the thieves, who are probably sitting on quite a large pile of money right now... (I hope this comment doesn't show up in a background check..)
- gergles 13y agoConsumers have not lost money directly, but they certainly will lose it in higher interchange fees, interest rates, store prices, and all the other tiny components that make up the American payment infrastructure.
- blueskin_ 13y agoThis reminds me of the vulnerable Google HVAC last year.
- dzhiurgis 13y agoFinally someone to blame...