Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/25/2013
06:31 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Record-Setting Data Breach Highlights Corporate Security Risks

Case of five men indicted Thursday for allegedly stealing more than 160 million credit card numbers, in what Justice Department calls a record size scheme, shows how hard it is for business to deal with SQL injection attacks and similar approaches.

Businesses aren't doing enough to defend their systems against hackers, like the five men charged Thursday by the Justice Department with conspiring to steal data from corporate databases over a seven-year period, according to a San Diego State MIS professor. The Justice Department characterized the alleged criminal enterprise as the largest of its kind to be prosecuted in the United States.

The defendants, four Russians and a Ukrainian, are said to have stolen more than 160 million card numbers and to have inflicted hundreds of millions of dollars in financial harm to more than a dozen major companies. No audit of said costs or detailed breakdown was provided.

The indictment says that the men used a variety of hacking techniques, including SQL injection attacks, to place malware on networks, thereby obtaining login credentials and credit card numbers, known as "dumps," for sale. It also says that the men used network sniffer programs to capture credit card transaction data in real-time from payment networks.

One particular passage in the indictment is noteworthy, in light of recent reports about the extent to which U.S. law enforcement and intelligence agencies can monitor global communication channels, even ostensibly encrypted services like Skype. "After becoming aware that law enforcement tracked certain communications using known messaging services, the co-conspirators established private and encrypted communications channels to avoid detection. Fearing that even these encrypted communication channels could be monitored, several of the co-conspirators ultimately attempted to conduct their communications in person."

[ How deep can U.S. surveillance actually go? Read Can The NSA Really Track Turned-Off Cellphones? ]

Even technically savvy computer hackers, it seems, have doubts about their ability to operate computers securely.

Two of the men, Vladimir Drinkman, 32, of Syktyykar and Moscow, Russia, and Dmitriy Smilianets, 29, of Moscow, were arrested June 28, 2012, while traveling in the Netherlands, at the request of the United States. Smilianets was extradited in September 2012.

The three others, Alexandr Kalinin, 26, of St. Petersburg, Russia, Roman Kotov, 32, of Moscow, and Mikhail Rytikov, 26, of Odessa, Ukraine, remain at large.

The men are alleged to have targeted corporate financial transaction data from 7-Eleven, Carrefour, Commidea, Dexia, Diners Singapore, Dow Jones, Euronet, Global Payment, Hannaford, Heartland, Ingenicard, JCP, JetBlue, NASDAQ, Visa Jordan and Wet Seal.

Kalinin and Drinkman were previously charged in a 2009 indictment with Albert Gonzalez, 32, of Miami, in conjunction with five data breaches, including the 2008 breach of Heartland Payment Systems. Gonzalez is currently serving a 20-year sentence in federal prison sentence for his involvement in those incidents.

"Those who have the expertise and the inclination to break into our computer networks threaten our economic well-being, our privacy and our national security," said U.S. attorney Paul J. Fishman of the District of New Jersey, in a statement. "And this case shows, there is a real practical cost because these types of frauds increase the costs of doing business for every American consumer, every day. We cannot be too vigilant and we cannot be too careful."

However, San Diego State University MIS professor Murray Jennex suggests that companies believe they can be too vigilant and careful, at least in terms of security spending. Despite recent improvements in dealing with SQL injection attacks and other hacking techniques, made after the defendants were engaged in their alleged conspiracy, he said many companies are still susceptible because they don't test their systems adequately and they don't spend enough money on security.

"We've had economic issues so people haven't put as much money into security as they should," Jennex said in a phone interview. Computer security, he explained, doesn't generate revenue, so it's often not a priority, and risk assessments are only as good as the people who conduct them.

Both small and large companies could do more, Jennex argues. "We do audits in small companies and what we still find, over and over again, is that companies don't really understand the way hackers attack," he said.

And even in large companies with substantial IT resources, there's a tendency to do something less than due diligence. Many large companies, Jennex said, rely on open source software but fail to adequately examine the code they're implementing. "If you don't do your research and validate the code, you may overlook vulnerabilities," he said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
proberts551
50%
50%
proberts551,
User Rank: Apprentice
7/29/2013 | 1:30:58 PM
re: Record-Setting Data Breach Highlights Corporate Security Risks
What also disturbs me, is I heard several years ago, that the IRS has it's Storage hosted in India. Why India? Other than cheap costs?
If this is true, this is a National Security problem in not having the data warehousing local so it can be closely guarded and monitored by US experts? You should never trust anyone with the retirement, and identity of all Americans to a foreign country. If true, this is very bad. I think the SSN numbers should not be retained buy any business any longer than it takes to properly identify the person. It should
not be on any medical records, bank servers, nowhere but the IRS. And pray that
they have the means to guard it.
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...