Target Hackers Broke in via HVAC Company

http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/

by panarky • 12 years ago

151 84 12 years ago

mdaniel• 12 years ago

Is it common and responsible to name the source of the credential leak like that? I can imagine that maybe other retailers would want to know that information, but I can also imagine the investigation is continuing and thus the opportunity exists for the story to become more complex.

brown9-2• 12 years ago

Other retailers should be less concerned about if they have done business with this vendor than they should be able letting any vendor have insecure access to their network.

jessaustin5• 12 years ago

It’s not immediately clear why Target would have given an HVAC company external network access...

jauer2• 12 years ago

When you reach a certain size of HVAC system it is common for the dealer to regularly service the system and proactively monitor it. This requires access to the controllers to see a pump has failed, coolant pressure dropped, etc.

They should have ordered a stand-alone Internet connection for such things but probably figured they'd save the money and use the existing network connection.

Shivetya• 12 years ago

the real problem here is that they should have had two distinct networks, one for their payment system that is wholly separate from all other network activity.

Its boggling to me that any company would permit another company on the same network when their work is wholly unrelated.

ericcumbee• 12 years ago

Really all they would need is a VLAN and a proper set of ACLs.

ChuckMcM• 12 years ago

There was a really funny story about a vendor of some equipment at one of Google's new data centers trying to convince Google that it had to have access to the data center network so that it could monitor its doo-dads. As I recall the "solution" was some plenum rated CAT5 that went out of the roof and attached to a DSL line on a pole at the corner of the property.

fidotron• 12 years ago

I for one welcome the fantastic security enabled by the Internet of Things.

stakent• 12 years ago

This already started.

TV receivers broadcasting metadata about files on devices connected to the LAN.

Routers allowing anonymous access over ftp to the disks connected to them.

Routers protected on the WAN side with factory set passwords.

Kettles and irons equipped with wifi and looking for open networks to broadcast something to the world.

(Smart)phones with broadband processors with DMA access to the applications processor's memory.

Computers, tablets and game consoles equipped conveniently with cameras and microphones.

We live in the future, do we like this or not.

toomuchtodo3• 12 years ago

I have seen TV broadcast equipment with SNMP and web interfaces exposed on public internet addresses. Days ago.

jauer2• 12 years ago

This doesn't surprise me.

From what I've seen on the provider side HVAC (and access control) companies want their devices right on the Internet. If you push them they'll deal with being behind NAT with a port forward but mention using a VPN and that's too much work for them.

Ask them about security and they hand wave and say it is secure because it is a "appliance" or "controller" as if that magically protects them.

This is changing somewhat as vendors move to a "phone home to the cloud" approach instead of direct access so they can get in on the revenue stream between the end user and the dealer. This removes the direct exposure to the internet but the local/insider threat remains.

benmarks• 12 years ago

And, evidently, they've broken into Krebsonsecurity.com to delete this.

a3n• 12 years ago

Go up one level in the URL.

panarky• 12 years ago

Edit: The article is back up now.

---

The article has disappeared. Here's the text of the first part of the post from Google cache.

http://webcache.googleusercontent.com/search?q=cache:mG2INOj...

Feb 14 Target Hackers Broke in Via HVAC Company

Last week, Target told reporters at The Wall Street Journal and Reuters that the initial intrusion into its systems was traced back to network credentials that were stolen from a third party vendor. Sources now tell KrebsOnSecurity that the vendor in question was a refrigeration, heating and air conditioning subcontractor that has worked at a number of locations at Target and other top retailers.

Sources close to the investigation said the attackers first broke into the retailer’s network on Nov. 15, 2013 using network credentials stolen from Fazio Mechanical Services, a Sharpsburg, Penn.-based provider of refrigeration and HVAC systems.

Fazio president Ross Fazio confirmed that the U.S. Secret Service visited his company’s offices in connection with the Target investigation, but said he was not present when the visit occurred. Fazio Vice President Daniel Mitsch declined to answer questions about the visit. According to the company’s homepage, Fazio Mechanical also has done refrigeration and HVAC projects for specific Trader Joe’s, Whole Foods and BJ’s Wholesale Club locations in Pennsylvania, Maryland, Ohio, Virginia and West Virginia.

Target spokeswoman Molly Snyder said the company had no additional information to share, citing a “very active and ongoing investigation.”

It’s not immediately clear why Target would have given an HVAC company external network access, or why that access would not be cordoned off from Target’s payment system network. But according to a cybersecurity expert at a large retailer who asked not to be named because he did not have permission to speak on the record, it is common for large retail operations to have a team that routinely monitors energy consumption and temperatures in stores to save on costs (particularly at night) and to alert store managers if temperatures in the stores fluctuate outside of an acceptable range that could prevent customers from shopping at the store.

“To support this solution, vendors need to be able to remote into the system in order to do maintenance (updates, patches, etc.) or to troubleshoot glitches and connectivity issues with the software,” the source said. “This feeds into the topic of cost savings, with so many solutions in a given organization. And to save on head count, it is sometimes beneficial to allow a vendor to support versus train or hire extra people.”

Continue reading →

PhasmaFelis• 12 years ago

It appears to be back up now. It returned right around 3:40PM EST.

freehunter• 12 years ago

It's back now, it seems.

benkillin• 12 years ago

This is a non cached link that appears to still function:

http://krebsonsecurity.com/2014/02/target-hackers-broke-in-v...

reeses4• 12 years ago

One of the key parts of this for consumers to keep in mind is that this is a massive PCI violation. Target neglected many of the most basic requirements in terms of network segmentation and data protection. Target is a large tier-one retailer. They had 3rd party audits to "guarantee" PCI compliance.

However, the 3rd party is usually a single 'auditor' who interviews the staff and looks at the network diagrams provided by the IT department. This information may be inaccurate to the point that it may not even exist.

The focus in these audits is almost always ecommerce. I'm sure Target's ecommerce site has been scoped very thoroughly. Almost every retailer is just as exposed. While every client I've worked with has (by the time I left) been PCI compliant on the ecommerce side, the internal networks are often completely flat, even across global locations. SOX is a joke as a result, as there is no separation of concerns.

maxerickson3• 12 years ago

What lessons beyond "Even major retailers have serious security problems" should a consumer be worried about here?

I don't know much about PCI compliance, but I don't get the idea that it is something I should have to worry about as a user of a credit card.

derekp7• 12 years ago

The lesson is to have more than one credit card, because eventually the one you use regularly will be compromised -- even if you only use it at physical locations. And when it is compromised, you will have to get a replacement, which is an inconvenience (hence the need for a second card). Oh, and keep an eye on your statements. And if you use a debit card, you may be worse off -- when it is compromised, you will have bills bouncing until you can get it straightened out. Even more of an inconvenience.

If you use a debit card, go to your bank and have them turn off the "feature" that lets you overdraft (and get charged a $35.00 fee each time). Set up a separate account (one that doesn't have a debit card), to use for all your bill payments, so at least that doesn't get behind if your main account is cleaned out.

reeses4• 12 years ago

You should not use any card that does not give you a 100% guarantee that you will not be held responsible for erroneous charges. It really doesn't matter the retailer – they almost all suck. The older the company or the faster its growth, the more you should worry. Push that worry onto Amex or your bank.

PCI is surprisingly easy (and anyone can look it up at https://www.pcisecuritystandards.org/security_standards/docu...). It's basically all about "data at rest," covering what can be stored, how it must be stored, and how it should be stored. If a merchant can't meet the requirements, then they are required to demonstrate "compensating controls" which can literally be "we have a project in place to fix this before the audit a year from now."

"Data at rest" involves (in this case) credit card information stored on "disk" (SSD, etc.) for more than a short period of time. This generally excludes virtual memory, some queueing software, etc. If it touches the disk for ten seconds but is then wiped, you're compliant.

Then there are a list of "musts". You must have firewalls protecting the internal network (and review the rulesets), documentation on any connectivity to cardholder data, dataflow diagrams, only allow essential traffic in the card info environment, wall off wireless access, have an IPS, change all vendor defaults on any devices that could possibly screw you, minimize server responsibility (so don't run your smtp relay on the machine that also encrypts your card info), rotate encryption keys every x days, don't store CID/CVV/track 2/full mag-tape data from the card, scan your systems for changes/compromise/unauthorized access, maintain nonreputable audit trails, etc.

PCI is ratcheting down the requirements so that there is less room for interpretation. Previously, just using Oracle's obfuscation toolkit would be enough. This would protect you (more or less) if someone had access to your block device in raw mode or your data files in what-the-hell-is-your-dba-thinking mode, but an Edward Snowden could log in and SELECT all of your card info.

csense• 12 years ago

Pay with cash when that option is available.

raverbashing2• 12 years ago

I wouldn't be surprised if these auditors were like this or even worse: http://serverfault.com/questions/293217/our-security-auditor...

fragsworth3• 12 years ago

The way credit cards are designed should be illegal. They are basically a piece of plain text that can be used by anyone to purchase things from someone's account.

It's basically the worst security you could possibly have for one of the highest-risk systems (direct access to money) that exist.

People need to be angry at the credit card industry for designing such an insecure system, not Target. There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer.

MichaelGG4• 12 years ago

How is it bad security? As a consumer, there's practically no issue. Data mining for fraud detection is pushed off onto the card provider - not my problem. There's no "direct access to money". It's a bill from a service provider that I can easily dispute. At worst, it's a slight inconvenience if my CC info is compromised.

mathattack2• 12 years ago

Exactly. And fraud is low enough that they're happy to do this.

cheald• 12 years ago

Well, maybe we should talk about debit cards, which are functionally identical. The Target breach included theft of PINs - a purchase made with your debit card plus PIN is on you, not on a CC company.

jessaustin5• 12 years ago

There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer.

Why doesn't Target use those payment systems? Wait, I think I know... because their customers don't use those payment systems. Are you saying that customers should "be angry at" themselves?

It has been years since I've used a credit card at a big-box store. They all still take cash.

Guvante2• 12 years ago

People need to be angry at the credit card industry for designing such an insecure system, not Target.

He explicitly said the blame doesn't lie on Target.

Payments systems are a chicken and egg problem, however you would think the entity that feels the most pain from credit card fraud would try harder to replace the broken system.

ars2• 12 years ago

Ever heard of worse is better?

This simple method works fine. The amount of fraud is not enough to make switching worth it. (And don't forget credit cards need to work even without persistent data connection.)

sliverstorm• 12 years ago

What system, exactly?

GFK_of_xmaspast• 12 years ago

Yeah but the cool thing about credit cards is : consumer protection laws.

cynwoody5• 12 years ago

What you say is true.

However, it doesn't really matter. Despite all the hue and cry, credit card fraud losses run in the single-digit basis point range as a fraction of transaction volume and around 1.2% as a fraction of issuer expenses.† Losses due to uncollectible debt (the "charge-off rate") are much higher, at around three or four percent in 2013 (but 10.9% in the second quarter of 2010).††

The pain point isn't financial. It's the bad publicity when breaches occur and the nagging fear is that losses could suddenly get out of hand due to some unanticipated vulnerability.

†http://web.archive.org/web/20091229101826/http://www.sas.com...

††http://www.federalreserve.gov/releases/chargeoff/chgallsa.ht...

fragsworth3• 12 years ago

So this means we're effectively all paying 1.2% extra (indirectly through retailer's credit card fees) to accept these fraud losses. But you have to add to that some amount for overhead of dealing with fraud reports, and the expense of required security practices in order to be PCI compliant, which is entirely a result of the plain-text nature of credit cards. It probably results in 1.5-2% extra to all purchases, entirely hidden to consumers.

And, from your own citation, on average, 10% of Americans are victims of credit card fraud and 7% of debit card fraud - this probably results in about 16% of Americans total if you assume both groups are random samples of the population.

If you've ever dealt with credit card fraud, you'd know that it's an ordeal that can be a huge pain in the ass. It can take many hours of your own time, and time from your card issuer. The cost isn't just directly financial, it's the overhead that comes as a result of the fraud.

I am certain that if given the choice, nearly everyone would take a 1.5% discount on all of their purchases if they had to do two-factor authentication on all of them in exchange.

coldcode• 12 years ago

Transaction volume is a poor way to measure the problem. I might use my card 1,000 times before getting hacked and having to replace my card. It's not a .01% loss it 100% as far as the consumer is concerned.

zequel• 12 years ago

Well the pain point is financial, it just lies with the merchant which gets a chargeback, I believe, when a fraudulent cc is used.

watty• 12 years ago

Why should I be angry? My credit card has been comprimised twice in my life and both times my credit card company contacted me immediately (before I even noticed) and refunded all fraudelent transactions immediately. I didn't have to do anything.

Credit card companies should be pissed at themselves for making it this easy.

ams6110• 12 years ago

Your checking account is just as insecure. All that's needed to debit your checking account is your bank's routing number (which is public) and your account number. No PIN, nothing else.

akira2501• 12 years ago

It's a design that's iterated over many decades, and it hasn't always been easy for them; the payment network is huge.

Plus, if you think security is bad now, remember that before this we were writing checks for most transactions. At least with credit cards I can discover fraud usually the same day it occurs, and they are far more convenient that checks ever were -- as someone who has used both, I'm not all that bothered by the current state of the system.

mathattack2• 12 years ago

This kind of reminds me of the original Wall Street movie, where Charlie Sheen broke into companies via their cleaning service, and then stole inside information.

mikegioia• 12 years ago

Wow, I'm more surprised that they had $100M "cyber" insurance.

ceejayoz• 12 years ago

@patio11: "Makes sense - I have one million, as a rider to E&O policy. The insurance companies practically give it away."

https://twitter.com/patio11/status/431219958047965185

patio112• 12 years ago

So if I check my actual policy documents, it's described as a "Data Breach Expense And Regulatory Defense Coverage rider to your Errors and Omissions Policy." But hey, computers are involved, so the news media would probably call that my cyberinsurance.

chatmasta• 12 years ago

Curious: What are the ethical implications for the thieves? They effectively stole from a giant, multinational corporation, and inconvenienced consumers. At the end of the day, no consumer lost money from this. I wonder how this differentiation affects the consciences of the thieves, who are probably sitting on quite a large pile of money right now...

(I hope this comment doesn't show up in a background check..)

gergles• 12 years ago

Consumers have not lost money directly, but they certainly will lose it in higher interchange fees, interest rates, store prices, and all the other tiny components that make up the American payment infrastructure.

blueskin_• 12 years ago

This reminds me of the vulnerable Google HVAC last year.

dzhiurgis• 12 years ago

Finally someone to blame...

Target Hackers Broke in via HVAC Company

Related Stories