THE BREACH FILES

Welcome to The Breach Files. In this series, we do not just recount history; we dissect it. We put you in the shoes of the Digital Forensics and Incident Response (DFIR) teams to analyze the attack vectors, the lateral movement, and the ultimate downfall of the world's most secure networks.

What's your plan to steal 40 million credit card numbers of one of the world's biggest retail companies? You won't hack their mainframe computer. Instead, you'll hack their HVAC contractors.

During the period preceding Thanksgiving in 2013, the cybersecurity strategy of Target Corporation was quite state-of-the-art. The company had invested millions into purchasing advanced malware detection system by FireEye. It had its own Security Operation Center (SOC). Its perimeter defenses were fully deployed and operational.

If an adversary attempted to brute force his way into the corporate network of Target Corporation through the front door, he'd be detected within minutes.

However, the adversary did not attempt to go through the front door of Target. He sought the weakest link in the supply chain, and that was Fazio Mechanical Services, a heating, ventilation and air conditioning (HVAC) contractor located in Pennsylvania.

This is the postmortem of one of the most destructive yet perfectly executed supply chain attacks ever.

The Infiltration: Phishing the Plumber

When it comes to cybersecurity, an enterprise can be as weak as its weakest vendor.

While the threat actors (believed to be a gang from Eastern Europe) knew that the Target corporate network was a castle that would be hard to crack into, they also knew that the company had network access granted to its external vendors in order to make billing, submissions of contracts, and project management.

The attack chain started with a regular phishing email.

Two months before the cyber attack, an employee of Fazio Mechanical Services received a phishing email, where clicking the link resulted in a standard malware installation on his computer called Citadel. Citadel is a password-stealing software. The criminals obtained access to Fazio's username and password for Target's external vendor network (Ariba).

Now they had a legitimate authentication token in their possession. However, it could give access only to a separated billing system.

Lateral Movement: Pivoting Through the Perimeter

This is where the architecture of Target failed terribly.

Having gained entry into the vendor portal using the HVAC credentials, they knew that they could not be confined to a sandbox environment. This is because of the total lack of Network Segmentation, which would have ensured that the billing system was isolated from the rest of the corporate network.

Network Segmentation is the cyber equivalent of sub-division in submarines where in case of flooding of one section, you close the doors to the other sections and save the submarine. The doors were open at Target.

They then pivoted to gain control of the POS servers which control the cash registers in 1,797 retail stores of Target in the United States.

The Payload: Scraping the Memory

The hackers didn't target the static database containing the credit cards but built a live data pipeline.

They infected the cash registers with a customized malware known as BlackPOS. However, credit card information is highly encrypted while transmitting it to the processing software. How did they decrypt it?

This process involved a method known as RAM Scraping. At some point in time during the transaction, credit card data needs to be decrypted in the memory (RAM) to validate the track data. The malware was configured to remain in the memory, identify the exact moment when the data gets decrypted and copy it to an internal server.

During every transaction when a customer made a purchase using his/her credit card, the data was copied silently from the RAM and stored at the drop location to be extracted through FTP.

The Alarms That Rang in Empty Rooms

This is the most painful aspect of this whole autopsy of an attack for any SOC analyst: The defense systems worked.

At the end of November, when the hackers were busy assembling the credit cards stolen and transmitting them to the servers in Russia, Target's new FireEye system spotted the irregularities. It did its job perfectly and issued a high priority alert.

The alert appeared in the screens of the Target's SOC Bangalore. The Bangalore SOC escalated the alert to the main security center in Minneapolis.

But that's not all — nothing happened.

The analysts in Minneapolis reviewed the alert and classified it as false-positive and simply ignored it. Why? Alert Fatigue. When a SOC system is badly tuned, the analysts receive thousands of low-level alerts on daily basis. The noise numbs them. When the alert sounded in Minneapolis it was just another false alert.

Only after weeks of silence from the company, when the Department of Justice told Target about the breach, it turned out that 40 million credit card numbers and 70 million pieces of personal customer information have been stolen.

The Takeaway

In assessing the Target breach, the following three major failings, which have come to represent the greatest threats for today's modern threat hunters and security architects, are identified:

1. Vulnerability of Supply Chain: You cannot simply check out your code; you need to ensure the integrity of access control of all vendors you hire.
2. The Lack of Segmentation: The HVAC contractor never had to have the access route to any financial POS system. The breach wouldn't happen if the network were segmented because it would be confined to the billing portal alone.
3. Alert Fatigue is Critical: No matter how good you are at acquiring the best security software available, you will not be able to use its power to the full if your analysts are exhausted from the flood of false positives.

The attackers did not destroy the fortress. They found the person who fixes the air conditioning, took his keys, and entered without the guards even looking up.