 Before diving too deep into this story here is a brief timeline of what occurred:
Let’s start with the beginning. At the current moment we don’t have all the details. Without having all the details we can only speculate how the attackers got FAZIO’s credentials to Target’s network. It is possible FAZIO’s own network was compromised and the attackers were able to sniff the credentials off the network. Another avenue could have been password reuse. Perhaps the credentials FAZIO used to login to Target’s network they also used elsewhere. If they used the same credentials on another site that was compromised the attackers could have got them there. It hasn’t been stated how this login actually was used. Typically a third party vendor like this would have a VPN setup locked down to IP address. If Target was allowing them to VPN in from anywhere it is very possible that is all the attackers did too. Maybe Target had an external SSH server or remote desktop setup for them. Either way, the attackers were able to use this login to gain access to Target’s network on November 15, 2013. Apparently, there are two separate pieces of malware involved in this attack, a collector malware that sat on the point of sale (POS) devices and sent data back to an exfiltration server, and an uploader malware that sent the collected data harvested from the POS devices to an external drop site. Between November 15th and November 28th is when the attackers deployed their custom-coded malware, and insured it was working correctly before exfiltrating any data. They deployed the initial collector malware to each POS device during this time. How it was deployed exactly is still not known. It may be possible that the attackers gained access to an internal software deployment server and used it to load the malware on Targets POS devices. This POS malware has come to be known as POSWDS. This piece of malware installs itself as a service using an almost identical name (svchosts.exe) to the Windows Service host process (svchost.exe). This is a very common tactic used by malware authors to hide in plain sight. Card data is written by this malware to %WinDir%\system32\winxml.dll. This file is periodically moved off of the POS device to an intermediate dump server using an external mount point. It has been reported that this internal Target server’s IP address was 10.116.240.31. It is believed that the user name used to transmit this data was “Best1_user”, and the password for this account was “BackupU$r”. It is also believed that “ttcopscli3acs” is a Target internal domain name. The exact share location used to collect the card data was \\10.116.240.31\c$\WINDOWS\twain_32\. Once the attackers were able to transfer the card data to a centralized location they then found a way to send that data out of the Target network. BladeLogic is the name of the service the malware spawned on the exfiltration server. This service collected the card data from the POS devices and sent it off network. Something I find really interesting is the time at which this data was sent. Both the POS malware and the uploader malware were coded to only exfiltrate card data between the hours of 10 AM and 6 PM. What that tells me is that the attackers wanted their exfiltration to look like normal every day network traffic. Instead of moving the data in the middle of the night when not much should be going on they only transmitted during the high activity time of day. Around December 11th is when the first samples of this malware were uploaded to VirusTotal.com. This could possibly indicate a time when Target personnel first became aware of the infection. On December 18th Brian Krebs posted that he received word from sources indicating a breach at Target. On December 19th Target confirmed in a post on their website that payment card data had been stolen. In the middle of the investigation into this breach Target found that 70 million Target users personal information was also stolen in this attack. This included name, email address, phone number, and mailing address. How this data was stolen has not yet been detailed but we can make a few observations based on the tools discovered on the Target network. The following are tools that were used in this attack:
All of the database tools listed here make me think the 70 million customers whose personal information was stolen came from a database. It may be possible that an employee at Target had a file with this information sitting on their desktop but I have a feeling the attackers were able to access their database. How could Target have detected this? The fact a third party companies credentials were used by the attackers initially to get in is not necessarily the third parties fault. An HVAC company should only need access to the network to check the A/C units when they are connecting in. In fact, it’s a PCI requirement:
Both of the pieces of malware used in this attack were not caught by anti-virus. The BlackPOS malware was uploaded to VirusTotal.com and not one of the 40+ anti-viruses flagged it as being malicious. In today’s threat landscape you can’t stop determined attackers from bypassing anti-virus. Anti-virus only works for known malware. Anything custom written or polymorphic will not be caught. Application whitelisting would have probably stopped this malware. What application whitelisting does is essentially the opposite of anti-virus. Instead of blocking known malware application whitelisting will only allow known-good files to run. This would have been an ideal solution for the POS devices as they generally should require little change. The tools discovered after the attack are all very common hacker tools that should have thrown red flags on the network. How the data was exfiltrated should have been stopped by egress filtering on their firewalls. Apparently the attackers found a system that had ftp access outbound to the internet. How they gained access to this system hasn’t been disclosed but judging by the fact a password cracking tool was found it may be safe to assume the hackers were able to gain access to an account used on this system. It’s also possible that the attacker used psexec to pass the hash from a different system previously compromised. It’s possible that the 70 million customers whose personal information was stolen came from a database. Database security software that could monitor connections and only allow approved queries would have been extremely helpful in protecting this data. In conclusion This attack was very complex. It demonstrates how determined attackers can maneuver around security controls to gain access to what they want. The initial compromise of an organization always is seemingly easy. Whether it's a phishing message with a malicious payload, or stealing a third party vendors network credentials attackers always seem to find the crack in the wall that becomes a gaping hole. This wasn't the first time this level of attack has occurred and it certainly won't be the last. Maybe, the fact that this breach has made so much news will end up helping organizations get the backing they need to properly secure their networks. |
root@dafthack:~# >
