How To Breach Affecting Home Depot's Pay Card System

What do Premara Blue Cross, Anthem, Chick-fil-A, Sony, USPS, MCX, Staples, Kmart, Dairy Queen, SuperValue, Jimmie John's, Viator, Home Depot, PF Chang's, Community Health Systems, and JP Morgan all have in common? Each of these companies were hacked during 2014-2015. Sadly, this is just a short list showing the breadth of industries and size of operations that are vulnerable. According to Time Magazine in March, 2015, "You're not just imagining it: Lately, a new data breach has been reported almost every week."

This paper explores seven references that report the results from research conducted on-line regarding the 2013 Target breach. According to the website “Timeline of Target 's Data Breach And Aftermath: How Cybertheft Snowballed For The Giant Retailer” (2015), the breach occurred November and December 2013 in which customers who shopped at Target locations credit and debit cards were breached and their personal information was exposed. Upon their investigation, it was determined their point of sale system was hacked. “Wikipedia” states point of sale system which is used by third party vendors has cash registers as well as barcodes which stores customer’s information. The website “What is Packet Sniffer” (2016), Packet Sniffing may have been a way the attacked happened. “RAM Scraping Attack” website indicates what RAM means and how this type of attack happens. “What is a Firewall in Networking and How They Protect Your Computers” (2014), “What is Endpoint Security? Data Protection 101” and “Why SSL? The Purpose of using SSL Certificates” websites each provide ways to reduce and/or prevent future attacks.

This paper explores seven references that report the results from research conducted on-line regarding the 2013 Target breach. According to the website “Timeline of Target 's Data Breach And Aftermath: How Cybertheft Snowballed For The Giant Retailer” (2015), the breach occurred November and December 2013 in which customers who shopped at Target locations credit and debit cards were breached and their personal information was exposed. Upon their investigation, it was determined their point of sale system was hacked. “Wikipedia” states point of sale system which is used by third party vendors has cash registers as well as barcodes which stores customer’s information. The website “What is Packet Sniffer” (2016), Packet Sniffing may have been a way the attacked happened. “RAM Scraping Attack” website indicates what RAM means and how this type of attack happens. “What is a Firewall in Networking and How They Protect Your Computers” (2014), “What is Endpoint Security? Data Protection 101” and “Why SSL? The Purpose of using SSL Certificates” websites each provide ways to reduce and/or prevent future attacks.

The Target Corporation was exploited in December 2013 and then again in 2015. These breaches included customer’s personal identifying information and retailer’s data. This credit card data breach is a prime example of weak security and infrastructure. This breach happened over the course of one of the United States’ major holiday seasons, Christmas. The security issue involved hackers accessing Target’s customer 's credit and debit cards by the machines that were being used to swipe the cards. These hackers accessed Target’s network with a stolen username and password from a company that was providing refrigeration and HVAC services. This company could access Target’s network `remotely to monitor energy consumption and temperatures. With that, the hackers uploaded malware software on the Target’s credit card machines. The customer data hack happened across the nation, and it was performed in stores and not an online breach of Target customer information.

One of the largest issues with this data breach is, just six months prior, Target had installed “a $1.6 million malware detection tool made by the computer security firm FireEye (FEYE), whose customers also include the CIA and the Pentagon” (Riley, Elgin, Lawrence, & Matlack, 2014). The problem was not the software, it was a lack of reaction by Target’s security team located in Minneapolis. Once the credit card and personal information was stored, the hackers moved the information to various locations throughout the U.S. before sending the data to their computers in Russia. On December 12, 2013, Federal investigators notified Target of a massive data breach; and on December 15, 2013, Target confirmed and eradicated the malware, after all of the credit card and personal information had been stolen.

On Dec 19, 2013 Target Corporation announced to the world that they had suffered a major data security breach. Due to Target Corporations poor stance on network security, hackers were able to steal over 40 million payment card records, encrypted PINs and 70 million customer records during the Black Friday sales week. Initial reports indicated that it was malware placed on their Point of Sales (POS) system, but that was just the tip of the iceberg of the breach. If there had been better security from the start this breach could have been avoided or greatly reduced.

Home depot was the target of a cyberattack on their information system infrastructure that lasted from April of 2014 to September of 2014. As a result of the attack and following data breach, 56 million credit-card accounts and 53 million email addresses were stolen. (“Home Depot Hackers Exposed 53 Million Email Addresses”) The cyberattack involved several steps. First, the attackers gained third party credentials allowing them into the system. Next they exploited an unknown weakness in the system that allowed for the attackers to elevate their own access privileges. Finally, they installed malware on Home Depot’s self-checkout systems in the U.S. and Canada, allowing

Every good company will have checks and balances in place to prevent or stop mistakes from happening. The Target company had all the industry standard security technology and had also installed a malware detection tools a few months before the breach occurred. Human error was the main fault of Target being able to be breached. Target’s management and security team both failed to respond to system warnings of malware that has been detected.

From November 27 to December 15, 2013 Target Corporation released 70 million customers’ personal information. On average, it takes companies 200 days to uncover they are being hacked (Lunden, 2015). It only took Target 12 days to figure out the crisis that began happening. On December 19, Target originally said only 40 million credit and debit card accounts may have been compromised during Black Friday weekend to December 15. “The information stolen included customer names, credit or debit card number, and the card’s expiration date and CVV” (McGrath, 2014). Although Target never clarified how they were hacked, security experts say that hackers targeted their POS system. “Target spent $61 million through Feb. 1 responding to the breach, according

Michael’s Store, Inc. is an arts & crafts Retail chain. It has more than 1040 stores located in 49 US states & Canada. The company also owns and operates the Aaron brother’s retail chain, which happens to have an additional 115 stores across the Country. Michael’s store Inc. had a Security breach, which took place between May 8, 2013 and January 27, 2014. About 2.6 million cards or about 7 percent of payment cards used at its stores during the period were affected. Alarmingly, its subsidiary Aaron brothers also had been breached between June 26, 2013 and February 27, 2014. It was reported that Aaron brothers had 400,000 cards impacted. The duration of the treacherous attack in total was 8 months (Schwartz, 2014). In this report, security breach of Michael’s store Inc. is analyzed. The topics covered are how the breach occurred, what did the authorities do to educate the customers & how in future such attacks can be avoided.

The hackers were able to update the malware two times to strengthen their malware in order to extract data efficiently. The hackers managed to stay in Target’s network and move from one part of the network to the other without detection. The final stage of APT kill chain was data extraction. Data extraction in Targets case was done on many levels. First, the hackers were able to copy credit card credentials of previous shoppers. Secondly, hackers were able to steal phone numbers and addresses from Target’s reward program. Finally, hackers were able to steal credit card information as costumers were using the POS to finalize their shopping. 2. What were the significant breakdowns in Target’s security operations that may have intensified the magnitude and impact of the breach?There were many downfalls of Target’s security system that lead to the significance of the attack.i.Target did not perform security checks with the vendors to examine their security protocols such as using a free malware detection software that was not suitable for business

Once on Target’s network with elevated privileges the attackers were able to launch malware to the POS systems that would capture the credit card information of the consumers as they swiped their cards to pay for their items. They launched a second piece of malware that that would take the captured information and move it to a dump server on the internal network. Once the information was on the dump server it them

Target Corporation acknowledged a breach in their systems just as the 2013 holiday season was in full swing. The hacker have taken the information of nearly 40 million credit and debit cards from shoppers who shopped in its stores over the initial three weeks of the holiday season. This is the second biggest penetration of its kind announced by a United States retailer, of which Target is the third largest retailer. Apparently, the hackers worked quite speedily with the operation lasting from the day before Thanksgiving to Sunday December 15, 2013. These nineteen days are part of the large kickoff to the Christmas sales season. Target is said to be working with federal law enforcement and other experts to avert comparable future attacks. The company has not and does not seem to have an intention of revealing exactly how the system was compromised. It is known, however, that the company did not find the attack alone.

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

There are many ways to help prevent breaches such as the Home Depot and the similar Target breach. Most retailers these days have multiple locations possibly in two or more countries like The Home Depot. Because of this the retailers need to know exactly where the business of the organization is being conducted. These organizations need to take the extra steps and know where the customer data is at all times especially payment information. They need to keep track of how it is being accessed and how it is being secured. Tom Bain, who is a senior vice president at a company called Security CounterTack, says “Retailers need to get a better grasp on who is being granted access to their networks and why” (Vijayan). Home Depot failed to do this on a daily basis and this is why the breach was so extensive. People do not know the reason as to why the company did not check these daily logs for payment information but this is the reason that they had such a big breach on their payment systems.