Advance Auto Parts Store Data Breach

From The Register:

Advance Auto Parts, the US motoring parts retailer, is the latest firm to give up customer credit card data to hackers.

The bad guys gleaned financial information on up to 56,000 customers, through an attack affecting 14 stores nationwide...

Advance Auto Parts website provides more information. So this only affects a handful of stores. Interesting. Methods and perps unknown.

I'm a big fan of companies being held accountable to standards of due care in the form of PCI standards and legal obligations. Significant penalties encourage companies to do the right thing.

Having worked at companies whose execs and upper management didn't give a rip about data security, due care, or anything that didn't involve raking in money, and having heard from more than a few infosec peers that this is the rule, not the exception, the only way my data and yours is going to stay protected is through penalties.

Penalties that significantly affect the bottom line --- or better, penalties that personally affect CEOs: in the form of wearing orange jumpsuits. The only reason SOX got any traction in companies is the threat of jail time for management. HIPAA has been largely ignored by a surprising number of healthcare companies. Bigger fines and jail time for execs would fix that fast.

And remember, we wouldn't even be hearing about these breaches in the first place if it weren't for California's SB1386 and all the copycat state laws that states created thereafter. The effect of these laws should be obvious to anyone following infosec news before and after 2003. Companies were hardly voluntarily disclosing data breaches --- until they were required to by law.

Even then, I'll bet cash money there are still companies ignoring this requirement. I've already posted about delayed notifications. Penalties and laws don't fix everyone and everything, but they do help to counter temptation and encourage honesty.

Targeted Malware Used in Hannaford Credit Card Heist

Targeted Malware Used in Hannaford Credit Card Heist (eWeek)

A targeted malware attack described as "new and sophisticated" is to be blamed for the data breach at Hannaford Bros. Co. that exposed more than four million credit and debit card numbers to identity thieves, the supermarket chain said in a letter to regulators in Massachusetts.

...the malicious Trojan was programmed to hijack what is described as "Track 2" data from the magnetic stripe of credit and debit cards being swiped at Hannaford's checkout counters.

The Hannaford breach is the first publicly acknowledged theft of sensitive card authorization data in transit between a retailer and bank for authorization.

Infrastructure Attacks

I'm not big on arm waving, notions of cyber terrorism, or blowing things out of proportion. Still, this PC World article is kind of interesting. It reports on internet-based infrastructure attacks on cities in an undisclosed location (outside the U.S.). While the reality of these specific attacks is news, the possibility of such attacks is surely no huge surprise to anyone in IT security.

As long as one doesn't jump to conclusions or fall into the trap of overestimating the risk because of its recency or other factors, such a report is a good reminder that infosec professionals need to methodically analyze and address a wide array of threats and risks. Of course, not all infosec pros have to deal with this sort of issue.

Another reminder are the (count them) five undersea cable cuts in the Middle East. Whether from anchors, sharks, terrorists, intelligence agencies, or just normal failures that the media hypes into a story ("Cable cuts happen on average once every three days"), there are lots of risks that maybe we don't think about, and occasionally the unlikely does occur. Thinking carefully about such rarities, we may choose to accept the risk even if our ill adapted brains scream that we need to prepare immediately right after reading the news article.

Back to the infrastructure attacks. The motivation in this instance was extortion. When doing risk analysis at different levels (individual facility, city, county, state, country) I could see that motivation would change the nature of the threat and risk. I wouldn't expect extortion to be extremely widespread or coordinated in locale or temporally. The impact of such an attack might be more limited. If instead the motivation of the threat source was some sort of military action, terrorist action, etc., that would change matters and the scope of impact would be greater if the attack were successful.

Let's hope the infrastructure security folks are on top of this. It makes me a little nervous to read "The U.S. is taking steps to lock down the computers that manage its power systems, however." Shouldn't we have already done that years ago?

Article in The Register:

A security researcher says he has observed criminals using a new form of attack that causes victims to visit spoofed banking pages by secretly making changes to their high-speed home routers.

Talk about a targeted attack... Thing is, broadband users don't have all have the same router so that lowers the usefulness of this attack for the big money criminal operations, I would think, even if the attack can be carried out over the internet versus in a car across the street. Homogeneity in the digital gene pool does pay off, I think.

Seems this would be more on the level of neighborhood crime. Perhaps in the future when people are more tech savvy overall, this type of crime will make stealing radios and CDs out of cars obsolete. Meanwhile I suppose this attack could be interesting if the target of the attack is, let's say, a financial planner...

While the likelihood is probably on the low side, impact is high. But really, who cares? Changing your router password is not that tough. A near zero risk mitigation cost is a no-brainer no matter what the risk.

Although it's One More Thing for the average home user has to fix. Wouldn't it be neat if manufacturers could set the router password to be unique per box or at least chosen from a reasonably sized set? DIP switches? Programmed Logic Array? A batch of different EEPROMs? If they can print unique serial numbers can't they give routers unique passwords?