Target knew about the hack, in time to stop it, and didn't

According to an investigation after the Target hack, their security software raised alarms when the malware was added to their network, but didn't do anything about it. Apparently, they even turned off the feature that would have removed the malware automatically.

www.businessweek.com...

On Nov. 30, according to a person who has consulted on Target’s investigation but is not authorized to speak on the record, the hackers deployed their custom-made code, triggering a FireEye alert that indicated unfamiliar malware: “malware.binary.” Details soon followed, including addresses for the servers where the hackers wanted their stolen data to be sent. As the hackers inserted more versions of the same malware (they may have used as many as five, security researchers say), the security system sent out more alerts, each the most urgent on FireEye’s graded scale, says the person who has consulted on Target’s probe.

The breach could have been stopped there without human intervention. The system has an option to automatically delete malware as it’s detected. But according to two people who audited FireEye’s performance after the breach, Target’s security team turned that function off.

reply to post by kmb08753


Ha, that's priceless...maybe some guy was downloading some torrents at the time and needed to ignore the malware warning...

If they were alerted then maybe they left it open so that they could trace those responsible, kinda like a honey pot?

DP

Target recently opened a store near my home... I hadn't gone there yet.

Great publicity for them... erm...

Great, great publicity.

VoidHawk
If they were alerted then maybe they left it open so that they could trace those responsible, kinda like a honey pot?

The only possible defense I saw was that the security software was a recent addition and may not have been fully trusted. Still, an alarm goes off, don't you think you should check it?

kmb08753

VoidHawk
If they were alerted then maybe they left it open so that they could trace those responsible, kinda like a honey pot?

The only possible defense I saw was that the security software was a recent addition and may not have been fully trusted. Still, an alarm goes off, don't you think you should check it?

That was my point, maybe they did, and decided to leave it so that they could see where it would lead?

VoidHawk

kmb08753

VoidHawk
If they were alerted then maybe they left it open so that they could trace those responsible, kinda like a honey pot?

The only possible defense I saw was that the security software was a recent addition and may not have been fully trusted. Still, an alarm goes off, don't you think you should check it?

That was my point, maybe they did, and decided to leave it so that they could see where it would lead?

Target isn't an intelligence agency, they are a consumer company. First priority is to protect consumer information.

Unless maybe an intelligence agency was behind the hack?

boncho

VoidHawk

kmb08753

VoidHawk
If they were alerted then maybe they left it open so that they could trace those responsible, kinda like a honey pot?

The only possible defense I saw was that the security software was a recent addition and may not have been fully trusted. Still, an alarm goes off, don't you think you should check it?

That was my point, maybe they did, and decided to leave it so that they could see where it would lead?

Target isn't an intelligence agency, they are a consumer company. First priority is to protect consumer information.

Unless maybe an intelligence agency was behind the hack?

LOL but these days thats entirely possible!
My thinking was that if they were alerted by their security software of malware, then maybe they reported it to...one of those agencies!, who might have told them to leave it open so that they could trace the guilty party.
But I like your possible theory better

I was gonna guess analysis paralysis or that someone couldn't make a decision or wanted to take a chance and not reveal a weakness.

This is worse, but working in IT? I can totally believe that some overworked or inexperienced person would very well have done this.

I could also tell you stories about inside jobs.

If the IT person in charge of making these decisions did in fact ignore the warnings, couldn't this leave Target open to multiple lawsuits from the banks to cover the cost of new cards and consumers to cover the expenses associated with fixing the mess the breach made of their checking accounts? They would now be negligent and something this big could bankrupt the company.

Someone working in Targets IT department probably just made a lot of money selling bulk data, they probably even orchestrated it themselves.