Anatomy of the World's Largest Retail Breach 2013-2014

1. The Target Breach: Friends Don‘t Let Friends Get Hacked
http://securityintelligence.com/targ
et-breach-protect-against-similar-
attacks-retailers/

2. November December
Breach High-Level
Access to Vendor
Purchasing Portal
Data Exfiltration to
Remote Site
Credentials Lifted Planting of POS
Malware
Remote Downloading
HVAC Vendor Phished

3. One or more recipients
clicks link(s) and/or
downloads file
Research
Study social media:
Facebook, LinkedIn,
Instagram, Twitter
Phishing Malware/Exploit
Craft targeted email with
malware on website link.
Send to target(s).
Anatomy of Phishing and Credential Theft

4. Compromise Network
Exploit Portal
Easily found Vendor Portals
for National Labs
VPN Network Breach
Remote Access with Multi-
Factor Vendor Portal
Vendor Portal

5. Sample Memory Search
Commodity Malware
Malware Commonly
Available on Internet
Customizable Search Memory
Black POS
Plant Malware

6. Criminals Retreive from
External Servers
Package Data to Internal Server
Copy to Internal Windows
Server
Drop on External Server Retreive from External Server
Job Transfers Compressed
Card Data on Schedule
Exfiltrate Data

7. November
HVAC Vendor Phished Access to Vendor
Purchasing Portal
Data Exfiltration to
Remote Site
Credentials Lifted Planting of POS
Malware
Remote Downloading
December
What can be done to Stop this?
Block
Malware
Educate
Vendors
VPN
Token
Protect
Systems
Third Party
Monitoring
Block
Egress

8. Implement
Proper
Security
Controls
Educate
Associates
Partner with
your Vendors