The Target Corporation Heist

How do hackers steal? Examining a well-known exploit helps explain what they do. A few days before Thanksgiving in 2013, hackers began an exploit that eventually stole information from 40 million credit and debit cards from a mass retailer, Target Corporation. To put this another way, more than one person in ten in the entire United States had a card number stolen. The stolen card numbers and other information were spirited off to “dark” trading sites, sort of criminal eBays, and sold for a few dollars apiece to other criminals called carders, who manufacture new cards bearing the stolen data. They use the fake cards to purchase expensive items on the unsuspecting cardholder’s accounts. The purchased items are often sold on the real eBay.

Like most hacking exploits , the Target heist began with social engineering . See Figure 1-1. Social engineering is jargon for tricking a person into revealing information that a hacker can use to gain entrance to a system. The tricks can be elaborate, often involving meticulously prepared fake emails, or simple, like asking someone for their password for a seemingly innocent purpose. Disgruntled former employees are often willing to be social engineered into helping with, or leading, an invasion.

Figure 1-1. The Target heist involved a series of carefully planned steps

Social engineering is less spectacular than cracking, a favorite tactic of hackers in the popular media. Crackers obtain user passwords by guessing or de-encrypting password information. Cracking a password is frequently possible, but hackers often decide cracking is too much work. Social engineering is much easier, so some form of social engineering is the first step in most hacking invasions.

For the Target exploit , hackers used social engineering to penetrate a weak point in Target’s defensive perimeter. Heating and air-conditioning equipment is now frequently connected to corporate computer networks. Corporate facilities staff use the network to adjust heating and air-conditioning, which is automated for comfort and energy efficiency. Heating and air conditioning contractors log into the system to monitor for issues and make remote adjustments. These contractors are frequently less experienced in managing cybersecurity. The Target hackers began by searching for contractors with connections to Target. They found a heating and air conditioning (HVAC) contractor with unsophisticated security and the kind of connection to the Target network they needed.

The hackers sent emails to the contractor’s employees to trick them into revealing a username and password . The social engineering challenge was to send a carefully contrived email that would trick a contractor employee into revealing their password. The effort succeeded and the hackers logged into the Target network. That login was the intrusion that began the exploit . They broke into the system using their knowledge of human nature and gullibility rather than technical knowledge or skill.

The contractor was apparently blind to the situation. They issued a press release stating that their connection was only used for billing, contract submission, and project management. In other words, the contractor was apparently unaware that they were an unwitting attack vector for the plunder that followed.

The hackers gained access on November 15, which was 12 days prior to the sales flurry of Black Friday on November 27. Using their access, the hackers got ready for Black Friday by loading their malicious software into the Target system. The software was then pushed down to most of Target’s automated cash registers all over the country. The hacker’s software was designed to grab credit card data as customers purchased their goods and slid their cards through card readers attached to the cash registers. The hackers had several days to ready their credit and debit card information collection system. The hackers, like good software engineers, used the time to test their systems before the full-scale launch.

By television hacker standards, the Target hackers were painfully slow and pedestrian, but unlike fiction, they stole real data and hurt real people. They stole so much data that transporting it out of the Target system was a logistical challenge. It is not clear exactly where all the data was sent. They covered their tracks by sending data over difficult-to-trace clandestine networks; the credit card information was eventually sent to computers in the United States, Brazil, and other obscure locations. The stolen data recipient’s systems may have been hacked and the owner was not aware that their computer was used for an illegal purpose.

Eventually, the credit card numbers appeared on criminal sites that traffic in goods like stolen credit card numbers. These sites are not difficult to access and they are a ready market for purloined data. Credit card numbers go for a few dollars apiece. As the data gets older, the price goes down as more card numbers are cancelled or flagged with a fraud alert.

Some estimate that Target lost nearly half a billion dollars from this hack, which did not have to take place. There were several points where the breach could have been prevented. The air conditioning contractor could have trained their employees to be more aware of efforts to swipe passwords . Target could have divided up their network so that contractors only had access to data they needed, not critical payment systems. Target could have monitored activity on their network and noticed that an air conditioning contractor was accessing data that had nothing to do with air conditioning. Target could have guarded their point-of-sale systems from installation of unauthorized software. Superior hindsight does not mean culpability for allowing these gaps, but stopping up any one of them could have prevented disaster. Although the issues of a large distributed corporation like Target are different from personal cybersecurity issues, Target’s woes offer clues to what can happen on our personal devices. I will discuss them in more detail later.

What Are Hackers Looking For?

By far the most common reason for invading a computing device is money, although a few hackers breach systems to make a political point or as a personal assault on the device owner. Obtaining access to personal email often goes with this sort of assault. Others invade with an intelligence or military objective. Still others are just snooping. Nevertheless, most hacking is for money.

Money can be made from a compromised computer in various ways. Personal data suitable for stealing an identity can be sold readily on the black market. Payment card information can also easily be sold, but a personal device is not likely to yield many cards compared to a business. Beyond stealing data, ransom is a possibility. An intruder can disable a critical resource, such as encrypting a file system, and then demand payment for releasing the resource.

Hackers may also try to “own” a victim’s device. An “owned” device is under control of the hacker. Usually, the hacker obtains administrative control of the device and has deposited code or scripts that prevent the true owner, or anyone else, from taking back control. An owned device can be very useful. It can become a slave computer that is part of a mass spam mailing machine. It might be used as a relay in an effort to obscure the source of an attack. Perhaps the worst part of having an owned computer is that the rightful owners may not be aware of the mischief their computers are performing.

Perhaps the most sinister use of owned devices is spying. Some malware can be installed that will capture the screen images, take control of the device’s camera, and install key loggers that record every stroke from the keyboard, as well as spirit away all the files on the system. Techniques like this are used by law enforcement and other government agencies for investigation and spying. Criminals use malware like this for less savory purposes such as stealing financial credentials or extortion. Cyberbullies and stalkers also use this kind of malware.

How Do Hackers Get In?

We have all heard about master hackers who have nearly supernatural powers for guessing or cracking passwords , but that is not the most common way personal devices are invaded. There are much easier ways.

Man-In-The-Middle

A man-in-the-middle attack inserts a third party between two communicating systems. For example, a victim might attempt to use an online interface to pay off a mortgage with a large wire transfer. The hacker hijacks the network connection between the victim and his bank, and inserts himself in the middle. When the victim sends the transfer request, the hacker intercepts the request, inserts his account as the recipient of the transfer, and sends the modified version to the bank. When the bank sends the confirmation to the victim, the hacker intercepts the confirmation and puts the original recipient back in. Neither the bank nor the victim is aware of the attack. The money is transferred to the hacker and the victim assumes the transfer went through until the mortgage company asks about the expected payment. See Figure 1-2 for a graphic depiction of a man-in-the-middle attack.

Figure 1-2. The man-in-middle interrupts normal communication between parties

A variant method inserts a fake version of a website a victim intends to connect with. The hacker then scoops up the information that victim enters, sends whatever they want to the target, and returns to the victim whatever the hacker wants the victim to receive.

In another man-in-the-middle exploit , an attacker sets up his laptop as a hot spot in a public place and names the hot spot something plausible like “Free Wi-Fi.” When users connect, the attacker skims the incoming data for ­valuables like bank credentials and passes on the connection to a legitimate Wi-Fi service.

How often man-in-the-middle attacks occur is contested. Some experts think they occur frequently; others think they are rare. This is an indication of the difficulty of detecting man-in-the-middle attacks. If the connection is a normal unsecured connection, a man-in-the-middle is nearly impossible to detect. Using a secured connection, the browser may raise an invalid certificate error. (I’ll discuss certificates later, but reliable certificates are a foundation of Internet security.) The error may indicate a man-in-the-middle attack, but there are other trivial reasons for certificate errors and a well-executed man-in-the-middle attack can avoid certificate errors.

Man-in-the-middle attacks can be used in different ways. Besides changing the intent of interactions, they can be used to glean information about the client or to deposit malware on the victim’s computing device.

Denial of Service and Botnet Invasions

Denial of service (DoS) and botnets are related attacks that occur frequently. They are responsible for both economic disruption and annoyance. Denial of service attacks are often performed by botnets.

Botnets

Personal computing device users are more involved in denial of service attacks than they may think. Distributed attacks are often executed by systems called botnets, which run on the personal computing devices of unsuspecting victims.

Botnet is an elision of “robot” and “network.” A network of robots, or bots, is a botnet. Bots are devices, usually personal computers, that have been commandeered to do the bidding of a bot master. Bots are recruited using techniques such as phishing and drive-bys . See Figure 1-3.

Figure 1-3. Victim computers become bots under the control of the bot master

Bots receive orders from the master. Depending on the sophistication of the botnet, a bot may take only simple orders, or they may be able to execute complex programs.

The user often is unaware that their device has become a slave to the bot master. Bots are not always active, and when they are, the slave device may be slow and occasionally hang, but these symptoms can be explained by any number of conditions. Most bots can be detected and removed by anti-malware software, although the bot software changes frequently to evade detection.

Botnets can be huge. Some nets have had millions of users, although lately there is a trend to limit sizes to tens of thousands. The rationale is guessed to be that bot masters have decided many smaller nets are harder to detect and shut down than a single mega-net. Individual bots are relatively easy to detect and remove compared to taking down an entire botnet. The nets can be managed in intricate hierarchies, as peer-to-peer networks, or other patterns. Even the botnet servers may be installed on compromised devices to thwart pursuit of the bot master. Authorities may take down a botnet and see it reappear a few months or weeks later.⁷

Tracing a net back to its origin can be very difficult. When an Internet message arrives, the author and location of origin may be buried in the body of the message, but they are not a required part of the wrapper where the information necessary to send the message appears. The only thing required on the wrapper is an address for the recipient and an address for a return message.

An analogy with paper mail may help fix Internet communications in your mind. The post office requires some information on the envelope, but the contents of the envelope can be anything the sender wants, similar to the requirement that an Internet message wrapper must have an address and a return address, but the body can be anything. The required envelope information is an address that the post office will use to deliver the letter. The envelope can have a return address, but the letter will still be delivered if the return address is blank, incorrect, or deceptive. The Internet is similar. Messages must have a deliverable address. If the address is wrong, the message can’t be delivered. End of story. An origin address is also required. In this the Internet is tighter than the post office, which ignores absent return addresses; but the Internet is lax about the contents of the origin address. Like a return address, it can be deceptive. The lack of a requirement for a verified return address on paper letters has been the crux of many mystery novels about anonymous threats and blackmail, which is not far from what can happen on the Internet.

To further complicate Internet messages, Internet addresses are not like a street address. They are more like street directions for getting to the address. They can be simple and direct, or they may be complicated and intentionally difficult to follow. Even when the directions are simple and direct, pinning down the exact device that sent a message is often difficult or impossible because a group of devices may have the same address. For example, a home Wi-Fi network with several devices is usually seen from the outside as all having the same address. The home Wi-Fi router, which is plugged into an Internet feed, sorts out the addresses. These routers keep tables that they use to match incoming messages to the correct device, but these tables usually don’t stay around for long, so finding the exact match later may be impossible. People who want to be anonymous make sure the directions are excruciatingly difficult to follow and their tracks are wiped out instantaneously. Most networks work more or less this way. Botnets and hackers in general rely on the vagaries of Internet addressing to evade discovery.

Botnets are used for several kinds of mischief. I’ve mentioned launching distributed denial of service attacks. Much of the Internet’s spam is distributed by botnets. Each bot sends out spam, combining into an avalanche of email. At some times, botnets have been estimated to generate from 10% to 20% of global email traffic. Besides launching distributed denial of service attacks, botnets can be used to provide the computing resources for cracking passwords or mining cyber currency like Bitcoin. The owners of botnets sometimes offer botnet services for sale on the same exchanges where credit card information is sold. Criminals with few computing or network can use these services to launch their own attacks.

Cyberwarfare

Cyberwarfare is a threat that individuals can do little to prevent but puts all in danger. Cyberwarfare means surreptitiously entering the computer networks of another nation in order to do harm, spy, or steal information. Like many Internet threats, the possibility of waging cyberwarfare comes from the wide accessibly of the Internet. Cyberwarfare is fought with the same tools as a hacker attack.

Cyberwarfare can harm us in many ways. An attack on the power grid could leave part or all of the country without electricity. Industry and commerce would stop. An attack on the financial system would stop our debit and credit cards from working and reduce the stock and commodity markets to shambles, which could hinder the economy for years to come. Nuclear plants, oil pipelines and refineries, railroads, and air traffic are all vulnerable to cyberattack and disastrous industrial accidents; fires and crashes are sure to result. The effect could exceed the destructive power of an attack with nuclear weapons.

Cyberwarfare is also found in tactical military fights. For example, a cyber assault can blind defense radar systems to approaching air attacks. Cyberattacks can scramble battlefield communications networks. The potential uses are many, and most of them are probably secret.

Less open countries like China and North Korea are better prepared for cyber defense because their networks are more easily shut off from the outside world than more open countries like the United States. The first defense against a prolonged cyberattack is to shut off networks from the Internet. Open countries like the United States do not have mechanisms in place for isolating the entire country from the Internet quickly and easily.⁸

Also, in less developed countries, computer networks have a smaller role in industry and commerce. Control networks are little used in their utilities. In other words, less developed countries do not have extensive systems to defend.

A cyberwar places the highly developed nations in a lopsided position. An advanced country like the United States has great resources for launching cyberattacks, probably exceeding those of any other country, but they also have the greatest vulnerability because the make most use of computer systems in their economy. In addition, their networks are largely privately owned. These private owners may not feel that cyber defense is their responsibility, but their networks are a logical point for defensive measures.

To be effective, a cyberattack relies both on computing access to critical systems and on knowledge of the workings of the content of the system. For example, an attack on a power grid requires knowing how to run the equipment that the computer system controls. Without that knowledge, the attacker won’t understand the effects of his attack, and instead cascading blackouts that blanket the country, the whole attack may fizzle into a minor event. This applies to all infrastructure cyberattacks. Attacking a financial system, air traffic control radar, or petroleum pipeline pumps and valves all require knowledge of the system to be attacked if the attack is to be a success. Infrastructure knowledge may be as hard to obtain as the computing skills necessary to hack into adversary systems. Consequently, a complex infrastructure such as a power grid or pipeline may not be as vulnerable to cyberattack as it might appear.

Traditional military strategy has difficulty with cyberwarfare. A cyberenemy may not be detectable until long after the damage is done. It may be difficult to ever identify the enemy. During the Cold War, strategies were based on detecting and neutralizing enemy missiles and bombers before they could do damage. A cyberattack may begin long before any effects are seen. For instance, the attackers may stealthily place scripts or snippets of code in place months before the visible attack begins or a worm may be launched that slowly winds its way through the network, searching for vulnerable points. The attack itself may be undetectable: a series of flaming oil train crashes may seem to be unrelated until months later when an internal system review reveals hacked code in the railroad control system. All of this must present challenges to military strategists for whom a nuclear attack was unmistakable.

Cyberbullies

Humans bully each other all the time. The desire to push other people around and make them feel bad is a perennial characteristic of human nature. Bullying among children and teenagers appears in the news often. The Center for Disease Control estimates that in 2013, one in seven high and middle school students were bullied in school. They also estimate more students were bullied electronically: one in five.¹⁰

The effects of cyberbullying , especially among children and teenagers, is troubling. Teenage suicides have been attributed to cyberbullying. Suicide is the most extreme form of loss of self-esteem, but many lesser forms, such as declining grades, depression, acting out, and drug use. At the most extreme, mass killings, such as Columbine, are blamed in part on cyberbullying. Unlike physical bullying, cyberbullying often occurs in the victim’s home, which turns what should be a sanctuary into a crime scene.

Electronic or cyberbullying is a form of cybercrime that is quite different from data theft. Bullies do not invade systems by taking advantage of security weaknesses. Much of the time, bullies do the same things that ordinary computer users do: they send emails, they send messages, they post photographs on Instagram and Facebook. In doing these things, the bullies don’t break computer system rules or encroach into forbidden areas. Instead, they maliciously break social rules by using these innocent tools to cause pain and anguish to their victims.

Cyberbullying is easy; individuals weakly inclined toward injuring others can be drawn into acts that they would probably not perform if the effort and risk was greater. Physical bullying relies on the bully’s power, which may be from physical strength, economic advantage, social position, or other traits. Cyberbullying requires only malice.

Social media makes communication easier and more efficient than physical interaction. Opening a Facebook page and posting a photograph of your latest family gathering is easier than physically visiting each friend to present a photograph. Unfortunately, the same efficiency applies to bullying. Bullies can take embarrassing photos of their victims and broadcast them to hundreds of friends in seconds. Without much effort, the identity of the bully can be obscured from the victim and their cohort. The prevalence of cyberbullying is not surprising. Malicious uses subvert the good intentions of the developers of social media, which is an unfortunate irony.

Authorities also have more difficulty dealing with cyberbullying than physical bullying. In the old version of the schoolyard brawl, the hulking bully threatens his scrawny victim, the principal rushes out, separates the combatants, and sends the bully to detention. Cyberbullying is much different. The aggression is hidden on the network. If the victim does not tell, the authorities are likely not to find out. If the victim tells, the authorities have to investigate before they can act. Authorities may be eager to pursue the bully, but this investigation is not nearly as easy as the old-school walk across the school yard.

What can be done to avoid cyberbullying? Cyberbullying is behavioral, not technical. Technical solutions may help identify bullying patterns in the use of computers and networks and help find the bully, but technical solutions are unlikely to prevent bullying. Most social media , such as Facebook, offer to remove objectionable material and restrict or ban users who don’t conform to published community standards. However, cyberbullies can conform to social standards and still hurt their victims.

Changing a social pattern is not like tightening security on a financial site or patching a flaw in a browser. Successful anti-bullying campaigns in schools or communities usually involve raising awareness of the problem and convincing victims to seek help instead of suffering in silence. The same applies to cyberbullying. If all cyberbullying victims realized that help is available, and managers and administrators can move to neutralize the bully, far less cyberbullying would occur. Some bullies will be clever enough to circumvent any barriers to abusive activity. Without the cooperation of the victim in spotting abuse, little can be done. This can be accomplished only when potential victims know what bullying is and how to find help. This applies especially to children and young people.

Social Media Abuses

Social media is one of the wonders of the Internet. Services like Facebook bring families and friends together and provide a communication channel for community organizations and governments. Unfortunately, the qualities that make social media effective and desirable to ordinary users also attract cybervillains.

Social media, such as Facebook, Google+, Pinterest, Instagram, Twitter, and others assume that people are sincere and well-intentioned. That is as true for most social media users, as it is in life. But there are exceptions and when the sample is large, the number of exceptions is also large. Facebook has around a billion users¹¹ and Twitter has over 300 million users.¹² If one in a thousand users are bad eggs, Facebook has a million and Twitter has 300,000 bad ones.

The bad eggs who want to maneuver in the background and avoid being identified like electronic social media. Anonymity is easy in electronic communications. A user can take on different personas to suit their purposes. Impersonation, using another person’s identity or shapeshifting, is not difficult. There are legitimate, or at least innocuous, reasons to be a shapeshifter on Facebook or Twitter, but shapeshifting also can cover up crime or vicious behavior. An impersonator can damage or destroy the reputation of the person impersonated. A shapeshifter can commit mayhem and disappear into another persona.

Geography means little on the Internet. Delivering a message from a block away can take longer than a message from the other side of the planet. Although some nations attempt to limit traffic in and out of their country, the Internet has no borders. An ordinary user has no easy way of finding the geographical origin of a message, and there are ways of hindering even forensic experts from finding the origin of a message. Geographic obscurity is a boon to miscreants. A scurrilous post on a Facebook timeline that appears to be from a hometown local could be from anywhere: Eastern Europe, South America, West Africa, anywhere. Unless someone tries to ferret out the origin of the message, no one will ever know where it came from. And even a smart cyberferret cannot guarantee that the origin will be found.

The anonymity and ignorance of location are in the design of the Internet. When the Internet was developed, an important goal was to connect existing networks into the Internet with minimal changes to their configuration. This was to promote rapid and wide expansion of the Internet. Requiring a verified identity and location of the sender would have complicated the interface between networks. Consequently, geography and authenticated identity are not part of the Internet’s design.

Social media attracts users because social ties are built and reinforced on the media. Distant relatives can be brought into family events. Acquaintances can converse and become real friends. With the casual exchange of images and communication, trust is easy to establish.

The combination of anonymity, ease of impersonation, and easily obtained trust with little oversight and few rules is an ideal environment for gulling the unwary. Predators of every stripe love a communication channel like Facebook, which gives them access to over a billion trusting users. They can hide behind a fake persona and not reveal their location. A grizzled and tattooed convicted felon can plausibly impersonate a 6-year-old girl. If he is good at mimicking the mannerisms of a little girl, his deception can go undetected and he is free to use the guise of an innocent to indulge in mischief and mayhem. This kind of deception, which is possible on all forms of social media based on the Internet, including chat rooms, provides opportunities for many varieties of troubling activities.

At the least destructive end of the spectrum, are trolls who deceive, insult, and disrupt discussions. Some trolls are genuine cyberbullies; others are only distracting and annoying grumps. At best, they ignore the rules of social discourse and are distracting and annoying. At worst, they bully their victims with insults.

Other mild forms of social media abuse are phony reviews of various kinds. Businesses get bad reviews from competitors and biased good reviews are submitted by proprietors and their friends. Retail sites like Amazon have to deal with both bogus good and bad reviews. Some shady businesses offer reviews in bulk for a fee. These scams rely on the anonymity and openness of the Internet.

There are many lucrative and elaborate scams. An often-reported and lucrative Internet crime in 2014 was automobile fraud. The fraud commonly begins on a website or a solicitation from an acquaintance on social media or via email. The fraudster offers to sell an auto at an attractive price, probably an unreasonably low price. The fraudster explains that he is in the armed forces, about to be sent overseas, and needs quick money, or some similar story tailored to evoke incautious empathy. The victim transfers the money, perhaps by wire transfer or Western Union. The vehicle never materializes and the fraudster disappears in to cyberspace. Per the FBI, this was a common Internet fraud in 2014. Almost 1,800 victims lost a total of 56 million dollars.¹³And that is reported victims, which could be lower than the actual number of victims.

Sinister organizations like the Islamic State of Iraq and Syria (ISIS) or other hate groups use social media to promote and recruit because social media is an effective vehicle for any kind of subversive activity. The dilemma is that subversion and legitimate dissent are not easily differentiated. This dilemma is a challenge to a democratic and free society like the United States. Dangerous, subversive groups are hard to distinguish from legitimate dissenters. Both ­subversion and suppression of dissent threaten democracy. Consequently, protecting legitimate social media users and preventing misuse of social media at the same time is difficult.

Social media is subject to the same techniques as other Internet services. A link on Facebook can be as dangerous as a link anywhere else. A click on a social media site that leads to a page that requests confidential information like passwords or credit card numbers is likely to be harmful. Pages can also deposit drive-by malware that opens your device to the hacker or performs other mischief. Caution is advised. Later, I will talk about how to avoid and deal with this type of threat.