Checking in from Home, Leaves Entry for Hackers

The Same Tools that Help Millions of Americans Work from Home are Being Exploited by Cybercriminals to Break into the Computer Networks of Retailers like Target and Neiman Marcus. The Homeland Security Department, in a New Report, Warns that Hackers are Scanning Corporate Systems for Remote Access Software — Made by Companies like Apple, Google and Microsoft — that Allows Outside Contractors and Employees to Tap into Computer Networks over an Internet Connection. When the Hackers Discover such Software, they Deploy High-Speed Programs that Guess Login Credentials until they Hit the Right One, Offering a Hard-to-Detect Entry Point into Computer Systems. The Report, which Homeland Security Produced with the Secret Service, the National Cybersecurity and Communications Integration Center, Trustwave SpiderLabs, an Online Security Firm Based in Chicago and Other Industry Partners, is Expected to be Released on Thursday.


It Provides Insight into What Retailers are Up Against as Hackers Find Ways into Computer Networks without Tripping Security Systems. It is also a Reminder that a Typical Network is More a Sprawl of Loosely Connected Computers than a Walled Fortress, Providing Plenty of Vulnerabilities — and Easily Duped Humans — for Determined Hackers. “As we start to make more secure software and systems, the weakest link in the information chain is the human that sits on the end — the weak password they type in, the click on the email from the contact they trust”, Said Vincent Berq of FlowTraq, a Network Security Firm. While the Report Doesn't Identify the Victims of these Attacks, Citing a Policy of Not Commenting on Current Investigations, 2 People with Knowledge of these Investigations Say that, More than a Dozen Retailers Have been Hit. They include Target, P. F. Chang’s, Neiman Marcus, Michaels, Sally Beauty Supply and as Recently as this Month, Goodwill Industries International, the Non-Profit Agency that Operates Thrift Stores Around the Country.


Once Inside the Network, the Hackers Deploy Malicious Software Called, 'Backoff', that is Devised to Steal Payment Card Data Off the Memory of In-Store Cash Register Systems, the Report Says. After that Information is Captured, the Hackers Send it Back to their Computers and Eventually Sell it on the Black Market, Where a Single Credit Card Number Can Go for $100. In Each Case, Criminals Used Computer Connections that would Normally be Trusted to Gain their Initial Foothold. In the Target Breach, for Example, Hackers Zeroed in on the Remote Access Granted through the Retailer’s Computerized Heating and Cooling Software, the 2 People with Knowledge of the Inquiry Said. In an Interview, Brad Maiorino, Recently Hired as Target’s Chief Information Security Officer, Said a Top Priority was What he Called “attack surface reduction”.  “You don’t need military-grade defense capabilities to figure out that you have too many connections”, Mr. Maiorino Said. “You have to simplify and consolidate those as much as possible.”


The Secret Service 1st Discovered the 'Backoff' Malware (Named for a Word in its Code) in October 2013. In the Last Few Weeks, the Agency Said that, it had Come Across the Malware in 3 Separate Investigations. Most Troubling, the Agency Said that, Even Fully Updated Antivirus Systems were Failing to Catch it. Low Detection Rates Meant that “fully updated antivirus engines on fully patched computers could not identify the malware as malicious”, the Report Concluded. 'Backoff' and its Variants All Perform 4 Functions. First, they Scrape the Memory of In-Store Payment Systems for Credit and Debit Card “Track” Data, which Can include an Account Number, Expiration Dates and Personal Identification Numbers, or PINs. The Malware Logs Keystrokes, as When a Customer Manually Enters her PIN and Communicates Back to the Attackers’ Computers so they Can Remove Payment Data, Update the Malware or Delete it to Escape Detection. The Hackers also Install a So-Called Backdoor into In-Store Payment Machines, Ensuring a Foothold Even if the Machines Crash or are Reset.


And they Continue to Tweak the Malware to Add Functions and Make it Less Detectable to Security Researchers. Security Experts Say Antivirus Software Alone will Not Prevent these Attacks. They Recommend Companies Take What is Called a “defense in depth” Approach, Layering Different Technologies and Empowering Security Professionals to Monitor Systems for Unusual Behavior. Among the Report’s Recommendations: Companies should Limit the Number of People with Access to its Systems; Require Long, Complex Passwords that Cannot be Easily Cracked and Lock Accounts after Repeated Login Requests. The Report also Suggests Segregating Crucial Systems like In-Store Payment Systems from the Corporate Network and Making “two factor authentication”— a Process by which Employees Must Enter a 2nd, 1-Time Password in Addition to their Usual Credentials — the Status Quo.


The Report also Recommends Encrypting Customers’ Payment Data from the Moment their Cards are Swiped at the Store, Logging All Network Activity and Deploying Security Systems that Can Alert Staff to Unusual Behavior, like a Server Communicating with a Strange Computer in Russia. At Target, Mr. Maiorino Said, he Planned to Build a Security Program as Tough as What was Expected from Military Contractors. “All of the same tools and techniques that nation states are using for attacks have been commoditized and are available for sale in the black market”, Mr. Maiorino Said. “And for the right amount of money you can go out and create a cybercrime ring at a relatively low cost.”