Skip Links

Inside knowledge likely in Target breach, experts say

By Antone Gonsalves, CSO
December 20, 2013 09:06 AM ET

CSO - The Target security breach that left millions of debit and credit card holders at risk of becoming victims of fraud left experts pondering the question of how such a massive theft might have occurred.

Theories varied, but the scant details released by the retailer Thursday left some experts believing the criminals had to have some inside knowledge of the company's point-of-sale system in order to compromise it so effectively.

Either people inside the organization were involved or, "at the very least, (the thieves) had sophisticated knowledge and a clear understanding of the cardholder data flows, in order to pinpoint where to steal this very specific data and then exfiltrate it," Mark Bower, director of information protection solutions at Voltage Security, said.

Target reported Thursday that card data, including customer name, credit or debit card number and the card's expiration date and CVV code, had been stolen from 40 million accounts used for shopping between Nov. 27 and Dec. 15. The CVV code is the three-digit security number found on the back of cards.

+ ALSO ON NETWORK WORLD  The worst security snafus of 2013 +

The theft may have involved tampering with the machines used to swipe cards when making purchases, The Wall Street Journal reported. The information stolen, called track data, is stored in the metal strip on the back of cards.

Target declined to discuss the breach, which a spokeswoman described as "a very sophisticated crime." The Journal reported that the theft involved Target stores nationwide and as many as 40,000 card devices may have been affected. Target has 1,797 stores in the U.S.

Bower believes the thieves may have planted malware in the electronic cash register attached to the card reader. When a card was swiped, the malicious app would copy the data likely traveling in plain text from the reader.

Modern cash registers often run on Linux or Windows operating systems, so are as vulnerable to malware as regular computers. However, how the collected data got to the thieves' computers is a head-scratcher, because the registers were likely on a closed network that isn't accessible from the Internet.

Because of the difficulty of compromising so many point-of-sale systems, other experts believed the breach more likely occurred at the corporate data center where card data may have been sent from stores before being relayed to a card-processing company.

Lucas Zaichkowsky, enterprise defense architect at AccessData, said hackers may have compromised the corporate system and planted malware that copied data just before it entered the system.

If the network between the stores and corporate systems were closed, then the data may not have been encrypted, until it left the internal network, said Zaichkowsky, a former employee of card processor Mercury Payment Systems.

"There's only three, maybe five, of these really advanced financial attackers, and they're really good at breaking in and hacking and they understand credit-card processing inside and out," Zaichkowsky said.

Our Commenting Policies
Latest News
rssRss Feed
View more Latest News