[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ISN] Lax security led to TJX breach


By Dan Goodin in San Francisco 
4th May 2007 

A wireless network that employed less protection than many people use on 
their home systems appears to be the weak link that led TJX Companies, 
the US-based retailing empire, to preside over the world's biggest known 
theft of credit-card numbers.

Despite a market capitalization of almost $13bn, it appears the company 
couldn't afford to secure its Wi-Fi network with anything more robust 
than the woefully inadequate Wired Equivalent Privacy protocol. (The 
much more secure Wi-Fi Protected Access has come standard on most 
routers for four years now.) It also failed to use firewalls or install 
software patches and disregarded requirements imposed by Visa and 
MasterCard concerning how card information is stored and transmitted.

According to a front-page article in today's Wall Street Journal [1], 
the nonfeasance allowed hackers to use a simple telescope-shaped antenna 
and a laptop to intercept data flowing through a Wi-Fi network used at a 
Marshalls discount clothing store near St. Paul, Minnesota.

"It was as easy as breaking into a house through a side window that was 
wide open," a person familiar with the investigation told the Journal.

The hackers, who bore the hallmarks of Romanian gangs and Russian 
organized crime groups, were able to eavesdrop on employees logging into 
TJX's central server in Framingham, Massachusetts, where the miscreants 
eventually were able to set up their own accounts. From then on, they 
were able to log onto the system remotely, from anywhere in the world.

The trespassers brazenly used the network as a communication post, 
leaving each other encrypted messes so one wouldn't duplicate the work 
of another. They also may have lifted card information that was being 
processed over the network, taking advantage of TJX's failure to use 
encryption when transmitting the data, as required by credit-card 
company guidelines.

TJX has fessed up to losing 45.7m credit and debit card numbers and 
personal information relating to almost 500,000 people. But according to 
one person, the thieves may have purloined as many as 200m accounts. 
(TJX rejects that claim as "speculation.") Stolen card numbers have been 
used in at least seven US states and at least eight countries, including 
Mexico, China, Italy, Australia and Japan. In one case, police in 
Florida charged a single gang with using hacked TJX card data to steal 
$8m in transactions at Wal-Mart Stores and other outlets.

All told, the breach could cost TJX $1bn over five years in costs for 
consultants, security upgrades, attorney fees and damage-control 
marketing, analysts from Forrester Research estimate.

Significantly, Forrester's estimate doesn't include liabilities that may 
result from lawsuits, such as one recently filed by associations 
representing almost 300 Northeastern banks in the US.

Plenty of banks have been saddled with costs resulting from the breach. 
Banking associates are lobbying federal and state lawmakers for 
legislation that would require companies who suffer security breaches to 
absorb the costs of issuing new credit cards.

[1] http://online.wsj.com/article/SB117824446226991797.html

Subscribe to InfoSec News