StatewardStateward
← All vulnerabilities
CRITICALOpSeccurated

OPSEC-TARGET-2013

Retail · POS · Target

Summary

During the 2013 holiday shopping season, attackers stole about 40 million payment-card numbers and personal data on roughly 70 million Target customers, one of the largest retail breaches in history. They did not start at Target. They started at Fazio Mechanical, a refrigeration and HVAC contractor that held an account on Target's vendor portal for billing and project management, phished its staff, and stole its login. Contrary to the popular retelling, Fazio had no remote access to Target's heating or refrigeration systems; it was an ordinary billing account. But because Target's network was flat, that low-value vendor login became a path all the way to the checkout lanes, where the attackers installed memory-scraping malware on the registers to grab card data as it was swiped. Target's own recently deployed detection system caught the malware and raised alerts, and the alerts were not acted on. The breach cost well over $200 million and became the defining lesson in third-party risk, network segmentation, and actually responding to your own alarms.

How it happened

The way in was a vendor account nobody thought to guard. In the autumn of 2013, attackers sent phishing emails to employees of Fazio Mechanical Services, a Pennsylvania refrigeration contractor, and infected its machines with malware (reported to be Citadel, a password-stealing trojan) that stole the credentials Fazio used to log into Target's external vendor portal for electronic billing, contracts, and project management. Those credentials should have been a dead end: a contractor's billing account has no business reaching a cash register. But Target's network was not segmented, so the attackers used that foothold to upload a web shell to a Target web application, queried Active Directory for database servers, used pass-the-hash to escalate and move laterally, and created a domain-admin account (named best1_user to blend in) before reaching the point-of-sale environment.

There they deployed BlackPOS (also called Kaptoxa), a piece of RAM-scraping malware. Card data is encrypted on disk and in transit, but for a brief moment, while the point-of-sale software processes a swipe, the card number sits in plaintext in memory. BlackPOS read it straight out of RAM on roughly 40,000 of Target's 60,000 registers across all 1,797 US stores, collected it on an internal staging server, and pushed it out through the built-in Windows FTP client to drop sites. Between 27 November and 15 December 2013 it harvested around 40 million cards.

The part that stung most: Target had deployed FireEye about six months earlier, and it worked. It flagged the malware on 30 November and again on 2 December, and the alerts went from Target's monitoring team in Bangalore to its security operations center in Minneapolis, which did not act on them (an auto-delete feature that could have removed the malware had been turned off), and even Symantec's antivirus independently flagged the activity. The breach became public only when the journalist Brian Krebs reported it on 18 December, after banks noticed a wave of fraud.

The damage

About 40 million payment cards and personal information on roughly 70 million people were stolen. Banks reissued millions of cards; costs to issuers and to Target ran to roughly $202 million net ($292 million gross, less about $90 million of insurance), and Target later agreed to an $18.5 million settlement with 47 states and the District of Columbia, the largest data-breach settlement of its time, which also required it to segment its network, add two-factor authentication, and appoint a chief information security officer. Its CEO, Gregg Steinhafel, resigned, one of the first chief executives to lose his job directly over a cyberattack, followed by its chief information officer. The breach also became a major argument for moving the US to chip-based (EMV) payment cards, which make stolen magnetic-stripe data far less useful.

Why Target still matters

Target is the canonical third-party-risk story: the weakest link in your security is not always inside your own walls, and an attacker will happily enter through a contractor you forgot you had connected. It is also a segmentation lesson, a flat network turned a billing-portal foothold into access to every register, and a detection lesson with a painful twist. Target was not blind; it had bought and deployed exactly the technology that caught the attack. The failure was the human loop after the alert, which is the part no tool fixes for you.

How to fix it

  • Cut the compromised third-party access immediately and reset the affected vendor and internal credentials.
  • Pull the malware from POS and endpoints, reimage, and rotate keys and certificates the attacker could have reached.
  • Act on the alerts: triage what monitoring already flagged and reconstruct lateral movement from vendor portal to POS.
  • Notify the card networks and issuers, and contain the cardholder-data environment.

How to avoid it

  • Segment the network so a vendor or low-trust system can never route to payment or production systems; isolate the cardholder-data environment.
  • Give third parties least-privilege, scoped, MFA-protected access, and monitor and time-box it.
  • Tune and staff your alerting so high-fidelity detections get acted on, not buried.
  • Restrict and monitor egress so bulk data exfiltration stands out.
  • Use point-to-point encryption or tokenization so POS memory never holds usable card data.

References

Related vulnerabilities

All OpSec →