How Hackers Stole Your Credit Card Data in the Cyber Attack on Target Stores « Null Byte :: WonderHowTo

Welcome back, my fledgling hackers!As nearly everyone has heard, Target Corporation, one of the largest retailers in the U.S. and Canada, was hacked late last year and potentially 100 million credit cards have been compromised. Happening just before Christmas, it severely dampened Target's Christmas sales, reputation, and stock price (the company's value has fallen by $5B).Although the details are still rather sketchy at this time, I'll try to fill you in on what we've learned about this attack from leaked details. Target and its forensic investigators at iSight still haven't divulged any specifics, but some reliable sources have info on what actually transpired. I will try to make some sense from those sketchy details to reveal what probably happened.The Target Attack from the HeadlinesOn December 19th, 2013, Targetannouncedthat the Point of Sale (POS) systems in their "brick and mortar" stores had been compromised. Interestingly, their website Target.com was not compromised. Apparently, someone had placed a zero-day exploit on the POS terminals and was gathering credit card and personal information.Some immediately suspected a card skimmer device—those small devices that can unobtrusively be placed on credit card scanning machines (ATMs being a huge target) to capture the magnetic data on the strip of the card.This theory was immediately dispelled by the fact that nearly every POS system in all of Target's stores were compromised, meaning that a physical device would've had to been placed in over 10,000 physical locations. That seems highly unlikely.Here's What We Know Now About the Target BreachFirst, the attack seems to have come from Eastern Europe, probably Russia or the Ukraine. Although forensic investigators can trace the IP address to that region, attackers often "bounce" their attack off proxy servers in that part of the world. This would make it look like it came from there, but it could just as easily have come from Peoria, IL or anywhere else in North America.That being said, much of the cyber-crime related to credit card theft comes from the former Soviet Union Republics largely because they are beyond the reach of U.S. and other nations' law enforcement. Also, they do not have extradition treaties with the West.Further support for the Russian source of the attack is that the malware used had been seen for sale on the Russian cybercrime black market months before the attack. In addition, when the malware was examined, the comments in the code were in Russian.This doesn't necessarily mean that the attack came from Russia, as anyone could have purchased the software and used it, but it is strong circumstantial evidence.The Zero-Day Exploit That Was UsedBecause the malware was a zero-day exploit, no anti-malware orNIDSdetected it. Antivirus, anti-malware, and IDS systems are dependent upon knownsignaturesof known malware, as we've learned inmy guide on evading Snort, the leading IDS/IPS.If a piece of malware has never been seen in the wild, then a signature doesn't exist in any anti-malware databases to detect it. In addition, even if a signature did exist, it's easy enough to change the signature by mutating and/or re-encoding it, as I've shown inmy tutorial on changing Metasploit payload signaturesanddisguising an exploit's signature.It now seems that a 17-year-old from St. Petersburg, Russia developed the software that has been named BlackPOS. It first appeared on the black market around March of last year. This does not necessarily mean that he actually carried out the security breach. More likely (as often happens in these situations), he simply developed the code and then sold it to the highest bidder.Target Had Unpatched Windows SystemsIt appears that Target was using unpatched Windows operating systems on their POS systems. This is a REALLY bad idea, but common. Obviously, theWindows vulnerabilitiesarewell-documentedand leaving them unpatched is just asking for trouble.Apparently, developers of these POS systems—like any other system used to take credit cards—must be PCI-DSS certified. Once they become certified, if they upgrade or patch the operating system, they must go through the certification process again. As a result, they are reluctant to upgrade or patch as they would have the additional time and expense of re-certifying. This anti-incentive is clearly counter intuitive to the goals of PCI-DSS, but there you have it.A much better idea would have been to develop a proprietary operating system where the vulnerabilities are unknown (boosting security through obscurity), but the POS developers don't want to invest the time and money in doing so. As long as they don't, attacks like this will likely continue.Attack One POS & Pivot to the RestThe attackers apparently compromised one system on the network and then pivoted from that one system to every POS system in the Target U.S. network. This is very similar to what I've just discussed inmy recent guide on pivoting.This one system could have been compromised by something as seemingly innocuous asa malicious link sent from an emailora malicious PDF file attachment. If just ONE person on the network clicks on the link, it's possible to compromise the entire network.Exfiltrate (Remove) The Data to a Web ServerOnce the attackers had their malware in place on every POS system, they then moved the data to a centralized server in the Target network. From that repository, and when Target's system were busiest, they exfiltrated the data to a compromised web server (it appears that this web server was an unsuspecting accomplice) in Russia.This was apparently to obfuscate the exfiltration. In other words, so much normal data was moving in and out over the pipe at that time that security engineers didn't detect this anomalous communication. It was probably also encrypted, making detection even more difficult, as I've demonstrated inmy tutorial on exfiltrating encrypted data with cryptcat.We now know that they were able to remove 11 GB of data, and by the time the forensic researchers had traced the data to the compromised web server, it had been wiped clean.Sell the Credit Card NumbersOften times, when cyber criminals steal credit card information they don't actually use it themselves as that's the easiest way to get caught. Instead, they prefer to sell them on adeep web black marketas stolen credit numbers. In this way, they are able to firewall themselves from the trail if someone gets caught using a stolen card number.Generally, stolen card numbers sell for between $5 and $50 each, depending upon the quality (American Express, Platinum Cards, etc.) and the credit limit. This means if 100 million cards were stolen from Target, the take for the criminals would range between $500 million and $5 billion!On Monday, January 20, 2014, law enforcement officials in Texasarrested two Mexican nationalswith 96 of these card numbers in their possession. It's clear from this information that not only are the numbers being sold, but fake cards are being generated with the magnetic strip information stolen from Target customers.And That's How It Probably Went DownAs said before, no official details were released yet, but this is probably how it went down. As the vulnerable POS systems Target uses are also used in other chains, I wouldn't be surprised if we start hearing about other stores being hacked as well in the coming weeks. Keep coming back, my fledgling hackers, as I will update this information as I learn more about this historic hack.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover images via Shutterstock (1,2)RelatedNews:8 Tips for Creating Strong, Unbreakable PasswordsHow to Hack Databases:The Terms & Technologies You Need to Know Before Getting StartedNews:The Hack of the Century!News:Can We Hack the Hackers?How To:Hack WPA & WPA2 Wi-Fi Passwords with a Pixie-Dust Attack Using AirgeddonHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyNews:A Brief History of HackingHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksNews:U.S. Justice Department Indicts Iranian HackersNews:Predictions for the New YearAdvice from a Real Hacker:Why I'm Skeptical That North Korea Hacked SonyHow to Hack Like a Pro:Getting Started with MetasploitThe Sony Hack:Thoughts & Observations from a Real HackerHow To:The Five Phases of HackingHow To:The Ultimate Guide to Hacking macOSHow To:Hack RFID enabled credit card & steal money for cheapHow to Hack Databases:Extracting Data from Online Databases Using SqlmapHow To:Conduct Recon on a Web Target with Python ToolsHow To:Exploit Recycled Credentials with H8mail to Break into User AccountsHow To:4 Apps to Help Keep Your Android Device SecureHow To:Your Phone's Biggest Security Weakness Is Its Data Connection — Here's How to Lock It DownHow To:Learn the Ins & Outs, Infrastructure & Vulnerabilities of Amazon's AWS Cloud Computing PlatformNews:Jobs & Salaries in Cyber Security Are Exploding!Android for Hackers:How to Backdoor Windows 10 & Livestream the Desktop (Without RDP)News:Apple Says iPhone & iCloud Are Safe After Claimed Breach by 'Turkish Crime Family'News:Islamic State (ISIS) Attacks U.S. Power Grid!Hack Like a Pro:The Hacker MethodologyHow To:Use Ettercap to Intercept Passwords with ARP SpoofingHow To:Use Maltego to Target Company Email Addresses That May Be Vulnerable from Third-Party BreachesHow To:Why You Should Study to Be a HackerHacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHow To:Steal Ubuntu & MacOS Sudo Passwords Without Any CrackingNews:Indie and Mainstream Online Games Shut Down by LulzSecNews:1.5 Million Credit Cards Hacked in the Global Payments Breach: Was Yours One of Them?How To:Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP PoisoningNews:FBI Shuts Down One of the Biggest Hacking ForumsSocial Engineering, Part 1:Scoring a Free Cell PhoneHow To:How Hackers Steal Your Cash on Trusted Sites & How to Prevent Against ItCISPA:What You Need to Know