When Target was hacked late last year there must have many heads in hands and slumped shoulders in the upper reaches of the retailer’s management echelons. Not to mention ranting and raving and the verbal hurling of unrepeatable phrases. There’s …

An In-Depth Look at the Hack That Rocked the Consumer World

  • By Alex Balan, BullGuard
  • 12:38 PM

Image: Patrick Hoesly/Flickr

Image: Patrick Hoesly/Flickr

When Target was hacked late last year there must have many heads in hands and slumped shoulders in the upper reaches of the retailer’s management echelons. Not to mention ranting and raving and the verbal hurling of unrepeatable phrases. There’s no word on whether heads have rolled following the theft of 40 million payment card details, but it’s not the first time the company has suffered a breach.

Back in 2005 the retailer was also hacked. At that time a chain of companies were hit in the same attack, most notably Heartland Payments. Target seems to have got off relatively lightly that time. Clearly this time it didn’t. To add to its woes it later announced that 70 million user records, including email addresses, had also been stolen.

A Tidal Wave

In a damage limitation exercise the company has played it by the PR rule book. It had to given the tidal wave of public backlash that threatened to engulf it. Target immediately came clean about the hack a day after the news broke; later said the source of the hack had been eliminated and even wheeled out its CEO Gregg Steinhafel, who usually only inhales rarefied boardroom air, to face the press.

Steinhafel told ABC News: “… we want to reassure guests that they will not be held financially responsible for any credit and debit card fraud… And to provide guests with extra assurance, we will be offering free credit monitoring services. We will be in touch with those impacted by this issue soon on how and where to access the service.”

And all because of some little old computer code. Target has kept tight lipped about how the hack was carried out, but it’s widely believed that Point-of-Sale (POS) malware was used. Specifically it’s understood to be BlackPOS which is available for sale in the deep web. Apparently, there are two versions, one is a scaled down available for $1,800, while the fuller version will put the buyer $2,300 out of pocket.

Homing In On Weakness

It’s designed to get past firewalls and its creator sometimes goes by the name of ‘Antikiller.’ He’s believed to be a teenager who is connected to St Petersburg in Russia. Antikiller has clearly spent a little bit too much time in his bedroom but that said, he’s not short of a dollar or two either. In fact he’s probably raked in about $120,000 given that BlackPOS has been downloaded from the deep web about 60 times.

This type of malware works by attacking a vulnerability in PoS systems, once it has sneaked past a firewall and been secretly installed on a server.

Imagine that you’re buying something at retailer; you slip your card into the reader and key in your pin number. The card reader picks up your details from the magnetic strip on the back of the card and then sends them over a network where they are stored. This data is encrypted as it makes its short journey over the network to stop someone from ‘sniffing’ the details and making off with them. It’s then securely stored on the server.

However, hackers will find where the card details are momentarily exposed. This is often on the keypad/card reader. That is details are not encrypted. The information may only be vulnerable for fractions of a second but for malware like BlackPOS it’s long enough. The malware ‘scrapes’ the information from the card reader and then stores it in batches on the compromised server. The hackers then visit the server on a regular basis to scoop up the batches of information before usually heading off to the deep web where they are sold.

Deep and Hidden

You might reasonably ask why a company doesn’t notice its firewalls have been breached and servers compromised? The answer comes down to money. To detect this sort of breach usually requires 24/7 network monitoring and not just with automated software but teams of security experts who are constantly checking and validating network traffic. It’s an expensive business and not many companies avail themselves of it. Besides, it’s not foolproof either.

Hackers know this and will hack into and compromise servers to sell onto other hackers, who then use them for all sorts of nefarious activities from hosting deep web sites to, well… launching POS attacks.

A Set Up

Brian Krebs a well known security consultant says the personal details stolen from Target were flooding sites on the deep web within a short time of the hack. Apparently they were selling in batches of one million cards and being sold for prices ranging from $20 to more than $100 per card. Krebs is usually on the money with this sort of thing and has been targeted in the past by hackers upset at his revelations. In one case, heroin was bought on the deep web and sent to his address. Police were then informed. Hackers were trying to set him up.

The deep web is a like a virtual ocean where all manner of nefarious trade is plied. Of course, it’s not exclusive, there’s lots of good stuff there too, but because users can hide behind a cloak of anonymity it makes a perfect underground market. And those with investments keep a close eye on it. A major bank bought a large chunk of the bank’s card accounts from a well-known deep web site, believed to have been lifted in the Target hack, to protect its customers and its own reputation.

The deep web sites that sell stolen card information are many and varied. Some sell wholesale cloning services so stolen details can be printed onto new plastic complete with authentic branding and holograms. Some sell just the card details and trade on their reputation to keep on producing ‘fresh’ details. Others buy and then sell on. The stolen details are used for all sorts of things. If the thieves also have access to PIN numbers for the corresponding card details they can use cloned cards at ATMs to withdraw cash from the victim’s bank account.
$10,000 – for sale

Some buyers set up deep web sites that use the stolen details to buy goods from online stores such as Amazon. They create a business selling these goods on, often high-end electronic items, at a massively discounted price. Other deep web sites sell cards complete with descriptions of the owners, for example, Greek man, Spanish woman and so on.

Some trade in live details with PayPal accounts seemingly a particular favorite at the moment. At any given time you’ll find deep web sites offering PayPal accounts for sale according to how much money is sitting in the accounts. Typical amounts range from several thousand dollars up to $10,000. The accounts are sold with details on how to cash them out. The owners have no idea their accounts have been hacked and will probably only discover it when the account is emptied out.

A Tsunami

Target says PIN numbers weren’t stolen as the PIN data is encrypted at the terminal, using something called Triple Data Encryption Standard (3DES) algorithm. The encryption key is not stored on its own systems, but is kept by the payment processor. This means the key was not compromised as part of the hack. This is probably cold comfort to those who had their details stolen.

If there any positives that come out of this, it’s the fact that as a result of the scale of the breach and the wall-to-wall media coverage that followed, there is a far greater awareness of the potential for identity theft. Credit/debit card details are like manna from heaven for identity thieves and a perfect foundation for creating false identities.

You may have heard of the Texas woman who was a victim of the Target hack discovering her personal information had been used to create an identity for a thief who burned through $30,000 in fraudulently charged diamond rings, children’s toys and other goods. There’s no way that the Target hack and identity theft can be connected but there’s no way you can say they’re not connected either.

In fact, much of the stolen Target information is apparently surfacing in Europe. That’s the trouble with these large scale hacks. Thanks to the deep web, it’s like dropping a 10,000 tonne piece of space rock into the middle of an ocean. It creates a tsunami effect and the waves spread out to all corners of the world.

Alex Balan is Head of Product Management at BullGuard.

Originally posted by: