Target says attackers stole vendor credentials
The retailer has updated and limited access controls as the investigation continues
IDG News Service - Target said Wednesday that intruders accessed its systems by using credentials "stolen" from a vendor, one of the first details the retailer has revealed about how hackers got inside.
The vendor was not identified. A Target spokeswoman said she had no further details to share.
As the forensic investigation continues, the spokeswoman said Target has taken measures to secure its network, such as updating access controls and in some cases, limiting access to its platforms.
Up to 110 million payment cards and personal records were stolen between Nov. 27 and Dec. 15, when Target first confirmed it was the victim of a data breach. The company publicly announced the intrusion on Dec. 19.
Malicious software was installed on its point-of-sale terminals, which recorded payment card details, and 11GB of data was moved around Target's network before it was sent to remote servers.
Clues to the Target attackers' methods emerged in technical descriptions of the malware published by security companies, several of which later redacted or removed the information. The descriptions included an internal IP address, a Windows domain name, plus a login and password, which indicated the attackers had deep knowledge about Target's systems.
The Target malware is believed to be a modified version of "BlackPOS" or "Kaptoxa," which was first spotted by researchers around March 2013.
The malware's code contained a reference to "bladelogic," which is a server management tool made by software vendor BMC. BladeLogic is used for patching, configuring and updating servers.
Jim Walter, manager of McAfee's Threat Intelligence Service, wrote in a Jan. 21 blog post that the reference by the malware to BladeLogic was merely a ruse, as the malware wasn't designed to attack BMC products. Target hasn't described how its internal systems are architected and whether BMC systems may have been involved.
Send news tips and comments to firstname.lastname@example.org. Follow me on Twitter: @jeremy_kirk
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Logicalis eBook: SAP HANA: The Need for Speed Without timely business insights, organizations today can suffer logistical, manufacturing, and even financial disaster in a matter of minutes
- Neustar 2014 DDoS Attacks and Impact Report For the third consecutive year, Neustar surveyed hundreds of companies on distributed denial of service (DDoS) attacks. The survey reveals evidence that the...
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Top 4 Digital Signage Fails Join RMG Networks for a look at four of the most common reasons digital signage fails in corporate businesses. Learn about strategies to...
- Building Tomorrow's Infrastructure Listen to this podcast to discover how Crider Foods worked with PC Connection to update their IT infrastructure, while maintaining compliance and control. All Cybercrime and Hacking White Papers | Webcasts