Target says attackers stole vendor credentials

The retailer has updated and limited access controls as the investigation continues
  • (IDG News Service)
  • 30 January, 2014 02:10

Target said Wednesday that intruders accessed its systems by using credentials "stolen" from a vendor, one of the first details the retailer has revealed about how hackers got inside.

The vendor was not identified. A Target spokeswoman said she had no further details to share.

As the forensic investigation continues, the spokeswoman said Target has taken measures to secure its network, such as updating access controls and in some cases, limiting access to its platforms.

Up to 110 million payment cards and personal records were stolen between Nov. 27 and Dec. 15, when Target first confirmed it was the victim of a data breach. The company publicly announced the intrusion on Dec. 19.

Malicious software was installed on its point-of-sale terminals, which recorded payment card details, and 11GB of data was moved around Target's network before it was sent to remote servers.

Clues to the Target attackers' methods emerged in technical descriptions of the malware published by security companies, several of which later redacted or removed the information. The descriptions included an internal IP address, a Windows domain name, plus a login and password, which indicated the attackers had deep knowledge about Target's systems.

The Target malware is believed to be a modified version of "BlackPOS" or "Kaptoxa," which was first spotted by researchers around March 2013.

The malware's code contained a reference to "bladelogic," which is a server management tool made by software vendor BMC. BladeLogic is used for patching, configuring and updating servers.

Jim Walter, manager of McAfee's Threat Intelligence Service, wrote in a Jan. 21 blog post that the reference by the malware to BladeLogic was merely a ruse, as the malware wasn't designed to attack BMC products. Target hasn't described how its internal systems are architected and whether BMC systems may have been involved.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Computerworld Australia group on Linkedin. The group is open to IT Directors, IT Managers, Infrastructure Managers, Network Managers, Security Managers, Communications Managers.

More about: BMC, BMC, McAfee, Threat Intelligence
Comments are now closed.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: Target, security, data breach, data protection, Exploits / vulnerabilities
Whitepapers
All whitepapers

Australia needs effective government cyber policy leadership: report

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Sign up now to get free exclusive access to reports, research and invitation only events.

Computerworld newsletter

Join the most dedicated community for IT managers, leaders and professionals in Australia