Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Encryption Wireless Networking Hardware IT

TJX Breach Began With WEP Crack 164

Posted by kdawson from the pwn3d-by-Pringles dept.
An anonymous reader sends us to the Wall Street Journal for a detailed report on what is known to date about the TJX data breach. It seems that the loss of over 45 million credit card numbers and more than 450,000 SSNs, driver's license numbers, and military identifications began with someone using a "telescope-shaped" antenna at a wireless link at a Marshall's near St. Paul, Minnesota in July 2005. The link was encrypted using WEP, which had been known to be broken since 2001. The crackers who got into the TJX central databases are believed to be Romanians or Russians with ties to the Russian mobs. The eventual cost of the TXJ fiasco could exceed $1 billion — not including the numerous lawsuits filed against the retailer.
This discussion has been archived. No new comments can be posted.

TJX Breach Began With WEP Crack More

TJX Breach Began With WEP Crack

Comments Filter:

  • Why isn't WEP recalled? (Score:4, Interesting)

    by krbvroc1 ( 725200 ) on Saturday May 05, 2007 @03:37PM (#19003867)
    WEP is seriously flawed. What hasn't it been recalled and all router manufacturers forced to replace the hardware (or firmware)?
    In most industries if you ship such a flawed product, the manufacturer has some liability. They are still selling them today too.

    Of course shame on TJ Max and the whole handling of this fiasco. Not that I ever did previously, but I would never shop there.

    • Terrorism (Score:1, Insightful)

      by HomelessInLaJolla ( 1026842 )
      The damage that such a recall would have in terms of liability, lost profit, and plain flat out admitting that they royally screwed the pooch is so enormous that, in the interest of promoting the free world, we simply can't allow it.

      If you continue to press your treasonous assertions you can and will be sent to Gitmo for social reconditioning: do not mess with their profit margin.
      • It isn't even that far into it. There is a spec. They sold you a product that meets the spec. The spec turned out to be flawed but their product still meets the spec. The manufacturers have provided you with exactly what they claimed they would.

        This is different from say, a laptop battery that by spec shouldn't burst violently into flames. When the flaw doesn't meet the spec, it is a recall. But like the 802.11N products. They conditioned the sales with PreN or something else describing how it doesn't meet

    • Re:Why isn't WEP recalled? (Score:4, Insightful)

      by smittyoneeach ( 243267 ) * on Saturday May 05, 2007 @03:45PM (#19003945) Homepage Journal
      WEP is 'good enough' for running your home network. It lets the neighbors now to keep out, like a lock on the door.
      Like any lock, (including WPA, no?) you can beat it with enough hardware.
      If you're that paranoid, you're running a wired network anyway, right?

      • Re:Why isn't WEP recalled? (Score:5, Insightful)

        by _Sharp'r_ ( 649297 ) <sharper@@@booksunderreview...com> on Saturday May 05, 2007 @03:49PM (#19003973) Homepage Journal
        At this point in time, WEP is more like the lock on your bathroom door. Fine to let people know that you don't want visitors, but not really designed to keep anyone out who wants to get in.

        WPA is more like a front-door with a keylock and a deadbolt. Someone could break in, but they'd have to at least take a little more trouble than pulling a coin out of their pocket like you can do with "interior" locks.

        If it's something you need to be secure, then yeah, you should be running encrypted traffic over a physically secure wired connection, not broadcasting everything to the neighborhood.
        • So WEP is like jaywalking, and WPA is using the crosswalk.
          Yet getting smacked by a bus is likely fatal in either case.
          Just getting hardware that is compatible and configuring it for proper use is daunting.
          Under Gentoo, my ipw3945 has been an absolute mother to get configured. Udev this, regulatory daemon that, kernel driver the other, firmware the fourth. Good thing that I'm into pain and suffering. ;)

          • Re:Why isn't WEP recalled? (Score:4, Insightful)

            by sumdumass ( 711423 ) on Saturday May 05, 2007 @08:09PM (#19006299) Journal
            The real way to secure a wireless connection is to set the wireless devices outside the network and VPN any access that needs to be inside the network. It is difficult and sometimes expensive but thats what really needs to be done. End then your not completley safe, you just have one more layer to defeat. And if you IDS is functioning properly, it should alert you to most attempts and possible sever the connection.

            I have talked to (business) customers who had their "son" or neighbor who is a part time rocket scientist put wireless in because they didn't want to run cables and I have cracked it while letting them tell us how secure it is. I'm not using anything special either, it is just commonly available script kiddie tools.

            I'm not knocking WPA, I just know physical access to the network is a key part of any security. You wouldn't run a couple ports out to the street for anyone to connect to and do whatever. This is essentially what your doing with wireless. And once they do "whatever", you need another layer that you can detect intrusions with before the real network gets accessed in order to remain secure.

            • Re: (Score:2)

              by DrSkwid ( 118965 )
              > It is difficult and sometimes expensive but thats what really needs to be done.
              If you consider it difficult, I suggest you advertise for a new member of staff for the IT Dept.
              • The difficult part is convincing management is needs to be done because of the wireless connections (they insisted on) and when you look at the options available for your current setup, they aren't always clear and workable.

                Not every desktop operating system support the same feature in an VPN connection and some have alternative clients already installed that you have to account for. I have one setup were I need to un-install one VPN client to use another (internal conflicts and neither work with both insta
      • Which brings us to the question of why a major retailler is using wireless in the first place. I'm personally no more than an interested amatur, but I've read professionals running corperate networks who, if they have to include a wireless component at all, keep it completely seperate from the secure, WIRED, network. You get internet access, but no accessing the company databases from the wireless. Can anyone come up with a scenario where it would be ESSENTIAL for store operations to be able to send SSNs a

        • Which brings us to the question of why a major retailler is using wireless in the first place.
          Major retailers do not attract the best IT staff, it's really cheap and easy to set up WEP, and the moment you get into WPA 2 and a Radius server it becomes a more complex, expensive and administrative-heavy issue to deal with. I say, run wires, baby! Wireless is just a insecure easily DOS'able crap technology!

        • Re: (Score:3, Insightful)

          by hankwang ( 413283 ) *

          Can anyone come up with a scenario where it would be ESSENTIAL for store operations to be able to send SSNs and drivers license #s over a wireless connection?

          If you had read the article, you would have noted this passage:

          After they used that data to crack the [WEP] encryption code the hackers digitally eavesdropped on employees logging into TJX's central database in Framingham and stole one or more user names and passwords, [...] collected transaction data including credit-card numbers [...] They were able

        • Which brings us to the question of why a major retailler is using wireless in the first place
          It's so all the poncey salespeople & marketers can "hot-desk" about and make themselves look important.
        • Retailers use wireless for things like the portable scanners they use for inventory functions. In the past I have noticed Walmart, Target, and KMart all using Symbol PDT 6800s. As to why they only use WEP, that's all the scanners support. Early models only supported 40-bit WEP. Later releases supported 128-bit WEP and Symbol's proprietary KeyGuard, which requires using (expensive) Symbol access points. Although the PDT6800s have been end-of-lifed, you aren't going to rush out and replace them with newer tec

      • If you're that paranoid, you're running a wired network anyway, right?

        s/paranoid/sensible/
        • I don't know if it's Cox cable or too much interference, buy I've been having some hellish stability problems lately. May have to go back to wired just so the junk works.

          • I don't know if it's Cox cable or too much interference, buy I've been having some hellish stability problems lately.

            A few months ago - maybe a year ago - a bunch of my colleagues were having a chin-wag during a course at work. One is a proper radio ham (Morse code license, 10m antenna hanging out of him parents house, that sort of thing), and the other was a serious hi-fi dork (one of "silver-coated power lead" brigade). All of us were bitching about how the reception on the (FM) radio has been getting wor

    • Re: (Score:1)

      by blhack ( 921171 )
      Because some people still depend on it. I've got a handful of inventory tracking devices built in the late 1990's that depend upon WEP if you want any sort of security at all. What needs to become that standard is VPN. Put all your wifi devices onto a separate lan, and only allow access to your "real" network via VPN. With companies like AML [linuxdevices.com] producing hand held inventory tracking devices build on debian, doing this with openvpn could actually become a reality. I recently demoed the model linked to abov

    • Re:Why isn't WEP recalled? (Score:5, Informative)

      by arth1 ( 260657 ) on Saturday May 05, 2007 @03:50PM (#19003991) Homepage Journal
      There's plenty of older hardware that doesn't have the processing power to do WPA, and has to rely on WEP. This is especially true for embedded devices (like print servers and bar code scanners) and PDAs. And for larger companies, replacing every single access point AND WiFi-device isn't a small thing.
      Could you imagine being the IT manager who has to tell upper management that the big expense you added to the budget two years ago, which was supposed to last five years before being incrementally replaced, now has to be completely trashed and replaced in one go because the encryption turned out to not be safe?

      The best thing many companies can do short term is to limit the damage, by restricting the use of WEP to data that they can afford losing. But even that requires admitting flaws, and is likely to get your head chopped off for bringing the bad news.

      • Have you bothered to read the article? These kinds of devices were one of the main sources of information.

        Maybe instead of being terrified and covering their ass at the expense of the company and its customers, these IT managers should do their jobs.

        • Re: (Score:2)

          by Kelz ( 611260 )
          You must be new here (to IT).

        • Re:Why isn't WEP recalled? (Score:4, Insightful)

          by lordDallan ( 685707 ) on Saturday May 05, 2007 @04:57PM (#19004511)
          Sure, or maybe the "I have a business major and/or MBA!" Senior Execs who the IT managers undoubtedly report to, need to get a clue and allocate a real budget to their IT staff.

          I bet replacing/upgrading/changing the hardware/software that was to blame across TJX's entire corporate infrastructure would have cost much less than the $1 billion dollars that dealing with the current situation could purportedly cost.

          [Rant begins here]Now I'm not saying the IT management were blameless either. But the greater issue IMHO is that IT is treated with disdain. IT managers are often treated as something to be tolerated by businesses. This is a horrible backwards, outdated mindset. Unfortunately, IT professionals seem to be doing very little to change this.

          At this point, IT is vital, vital to any $10M/year or higher in revenues (to pick an arbitrary number) business. But it is often treated as though it's some glorified janitorial service. Attention MBAs, IT is not there to clean up your screwed up PC and make sure your blackberry works. Sure, that's part of their bailiwick, but until corporate managers start realizing that their business live and die by their IT infrastructure (as the TJX debacle clearly demonstrates), these mistakes will happen over and over again.

          The other side of the coin are the people who work in IT itself. I don't know if it's because we were the ones who were picked on in junior high, or what. But I do know that IT professionals are the most ill-treated group of highly-skilled professionals around. Why there isn't some sort of real guild/league/association of IT professionals eludes me. Look at doctors and lawyers. They have the AMA, and the bar (forgive me if my details here aren't exactly correct, but I think my point is clear), they have specialized degrees, and they don't take sh*t from anyone. Why because they know they have unique knowledge and they expect to be compensated accordingly. And when someone tries to muck up their good racket they have going, their professional organizations lobby groups kick into high gear and start shredding whoever it is that wants to take their candy.

          On the other hand, when anyone even tries to mention the idea of some formalized "union-like" IT organization, all of the IT types start screaming bloody murder, and all this weird pseudo-libertarian, free market babble starts gurgling out from their pie holes. Attention IT professionals, this isn't about political philosophy. It's about fighting, scratching, "give me my piece of the pie you *sshole" capitalism. IT professionals need to wake up and take control of their situation. I assure you the big boys at the top of the heap love watching you scramble about at their beckon call while their billions of dollars are funneled through systems you keep running with wire and glue because you don't want to rock the boat by asking for a bigger, strike that, realistic budget.

          I'm not sure what the right steps would be to start moving towards forming a professional IT organization with real power (as in you can't get jack done on your computers unless you use someone from our guild anymore than you can litigate or perform surgery with out a bar certified lawyer or board certified doctor), but until that happens, IT workers will be thralls and TJX's and TSA laptop debacles, and IBM outsourcing hoo-ha's etc. will happen based solely on the whims of people who think that Excel macros are software and phone cords are what connect computers on a LAN. And just to be clear, Microsoft, ITT Tech, COMP-TIA, CISCO certifications do not cut the mustard as they do not exist to help you in anyway. The benefit you gain is a sliver of what the organizations who dole them out make from your labor.[Rant ends here]

          • Its our own fault. (Score:5, Insightful)

            by LibertineR ( 591918 ) on Saturday May 05, 2007 @05:21PM (#19004687)
            "I don't know if it's because we were the ones who were picked on in junior high, or what. But I do know that IT professionals are the most ill-treated group of highly-skilled professionals around."

            This is because as a group, we are the LEAST professional of the professional vocations. With our paper MCSE's to our lack of communication skills, our refusal in some cases to "dress for success" and sometimes questionable bathing habits. Everybody who has worked in IT knows someone personally who fits this description.

            You are correct, we do need organizations to screen our professionals as much as any other field. The 'soft' skills are just as important as technical prowess to be a true professional. It always helps when people assume that instead of spending all of your free time memorizing Battlestar Gallactica scripts, that you might actually have time for a girlfriend.

            We did this to ourselves.

            • Hmm. We're a mixed lot.

              I'm not sure an "organization" to certify us will help, though. It's likely to be another MCSE-like, useless paper trail to protect managers for hirinig "certified" engineersw, instead of the real necessary skill sets to do solid work.

              And I've seen, recently, exactly the kind of hapless corporate security that leads to unencrypted or WEP-based wireless traffic. As a visitor at a corporate office, my jaw dropped to the floor upon discovering that they were using WEP in a first-floor of

            • This is because as a group, we [IT professionals] are the LEAST professional of the professional vocations
              That's what I used to think as well. Then I found out that most vocations have their share of nerds. Take lawyers, auditors, econometrists -- I've met some that were so totally focused on their job that they couldn't talk about anything else.
              Nerds are everywhere.
          • >At this point, IT is vital, vital to any $10M/year or higher in revenues

            Very good point...perhaps this is why a Business-Centric refocus of IT resources is occurring worldwide. ITIL, ISO, and many other standards are part of the effort to ensure that IT is PART of the decision making process. I bet that TJXs IT department, if it did NOT have a seat in the boardroom, does now.

            IT, like plumbing, has always been a service component, and regarded as important. Sure you need electricity to run a company, but

        • Re: (Score:2, Interesting)

          by Anonymous Coward
          Have YOU bothered to read the article?

          The security issue was not the existence of WEP on the network. The issue was having a wireless network with full access to the rest of the network including financial systems etc.. (plus, as the article vaguely mentions, not implementing some other security they had available... VPN? SSL? Who knows.)

          WPA (particularly WPA-PSK, which is a relatively common form of WPA, due to less support for WPA-Ra

      • Re:Why isn't WEP recalled? (Score:5, Insightful)

        by krbvroc1 ( 725200 ) on Saturday May 05, 2007 @04:16PM (#19004191)

        Could you imagine being the IT manager who has to tell upper management that the big expense you added to the budget two years ago, which was supposed to last five years before being incrementally replaced, now has to be completely trashed and replaced in one go because the encryption turned out to not be safe?
        Except WEP has been known to be broken since 2001. Also your IT manager example is putting profit above the safeguard of customer information such as their credit cards. Didn't Ford Motor company balk at the expense of adding an $11 fuel bladder to prevent the Ford Pinto from exploding? They figured they would just pay whatever damages, but when they were punished by a jury, the damages for a single death totaled more than their entire estimate. The damages were so high partly because the jury was made aware that Ford actually made a thought process like your IT manager that they understood the risks, but didn't want to spend money on the problem.

        If there are older devices that only support WEP, those can be moved to a separate router and firewalled/VLAN/etc.

        I wonder how much money the 'Credit Monitoring' services make out with all these breeches?

        It seems to me the only solution to this is to pass strong data ownership protections for consumers. Right now, the companies place very little value on the data (except for marketing/advertising purposes), but this needs to change somehow.

        • Re: (Score:3, Insightful)

          by maxume ( 22995 )
          There needs to be some sort of data protection regulation, but there also needs to be some legislation that says that I'm not responsible for anything and everything that somebody impersonating me does, simply because I'm in no position to prevent those attempts. At the moment, individuals bear the brunt of the consequences when a credit card issuer gives a card to somebody committing fraud; that's insane, the issuer should be forced to face the consequences, because then they would quickly become much more
      • Said IT manager could point at this very disaster as a good reason for upgrading all your hardware. Really Bad PR + Lawsuits by the dozen Replacement of WEP-enable hardware (because there's just so much of it lying around, right?). If said company's a good customer of some hardware provider they could even inquire about discounts on new inventory for this very reason to spice things up in their favor.

      • Could you imagine being the IT manager who has to tell upper management that the big expense you added to the budget two years ago, which was supposed to last five years before being incrementally replaced, now has to be completely trashed and replaced in one go because the encryption turned out to not be safe?

        Can you imagine being the IT manager who has to tell upper managment that criminals just got millions upon millions of credit card numbers and SSNs off of the network? Oh, and then tell them you n

        • and you chose not to do nothing.

          God damn lack of coffee. Should read: "and you chose to do nothing."

      • Wii (Score:2)

        by antdude ( 79039 )
        Even Wii uses WEP. What's up with that? Saving cost for Nintendo?

        • Even Wii uses WEP. What's up with that? Saving cost for Nintendo?

          The Wii is entirely capable of using WPA - provided you don't use any super-badass characters which you can't enter using the on-screen keyboard, naturally (but it does support upper+lowercase, numbers and basic punctuation).

          However, as far as I can tell, the Nintendo DS is utterly incapable of WPA.

          In fact... *fiddle, taptaptap, *poke*. Yep, since I moved my wlan over to WPA (I used to use a cruddy old .11B wifi adaptor, which only supported WEP - the recent "sub-1-minute" developments spurred me into buyi

    • Windows is still being sold isnt it?

    • Clear data over WEP? (Score:3, Insightful)

      by kherr ( 602366 )
      It's a rather frightening notion that people think of WEP or WPA as their sole means of security. The underlying data were apparently unencrypted, which implies open protocols like telnet and http. WEP was intended to make wireless as "secure" as wired networking, which means not much. WEP shouldn't be used because it's completely compromised, but even WPA shouldn't be the sole level of security. WPA should be viewed as a means to thwart casual snooping of network traffic, but I'd still hope secure data lay
      • This is a very relevant point, sir or madam. Unfortunately, the reason for *that* is a nasty legal one. The US remains the biggest software creating country in the world, and the export of encryption technologies is oddly regulated. The result is that basic software tools, such as Windows and web authorship tools and file-sharing tools, rarely include good encryption built-in.

        Take a look at the history of PGP and Phil Zimmerman's legal troubles to see why people don't include robust security by default. It
    • > Not that I ever did previously, but I would never shop there.

      Almost every piece of clothing I currently have has been purchased through Winners at some point (in Canada - a subsidiary of TJX). I am pretty much on the brink of never shopping there again either. I haven't purchased anything from them since news of this broke. And I always use credit with them - ouch.

      I've never given out my postal (zip for you guys) code whenever they asked after a purchase. That makes the existing breach so much more dam

  • 45 million or 200 million? (Score:3, Insightful)

    by E IS mC(Square) ( 721736 ) on Saturday May 05, 2007 @03:39PM (#19003897) Journal
    TFA says "A person familiar with the firm's internal investigation says they may have grabbed as many as 200 million card numbers all told from four years' records."

    Gets better, doesn't it?
    • Not to belittle the problem here, but do that many people really shop at TJ Maxx/Marshall's? I know there are a few in my area, but they seem to be crappy little stores in crappy little strip malls. I didn't realize 45 million people shopped there, let alone 200 million.
      • They're a pretty big chain. They've filled some of the clothing market niches in places where a Wal-mart or a K-mart or an S-mart would be just too big. I've bought cheap socks and underwear there when traveling and running out of clean clothes on a business trip.

      • Re: (Score:2)

        by DrSkwid ( 118965 )
        TJX is one of those Global Multinationals

        http://en.wikipedia.org/wiki/TJX_Companies [wikipedia.org]

        Net income $690,420,000 (2006)

        http://news.bbc.co.uk/1/hi/business/6508983.stm [bbc.co.uk]
        The company also told the BBC that 100 files were moved from its UK computer system in 2003, and two files were later stolen.
        However, a spokesperson admitted that the firm may never know what was in those files.

        The data was accessed on TJX's systems in Watford, Hertfordshire, and Massachusetts over a 16-month period from July 2005 and covers tran

  • Sue? (Score:2, Interesting)

    by PetriBORG ( 518266 )
    So, as someone who had at least their CC number stolen thanks to these ass hats, when can we sue them and take a major chunk out of their ass? People in TJX should be jailed...
    • In all likelihood, the managers were assured by the IT people that their system was safe. Should they be jailed for believing their hired experts?

      The IT people are not paid to take the sort of risk that involves being jailed for mistakes.

      A large part of the penalty cost here is likely to be covered by insurance. This is the sort of thing that insurance companies, in their own defense, should correct. Insurance companies like to give medical exams for high value policies involving their customer's health;

      • My experience as a consultant delivering the bad news like (and even specificially including): "WEP has been cracked, you need to replace all your wireless access points immediately because they don't support WPA" indicates otherwise. Managers are often given many goals which are difficult to balance. Short term budget constraints are typically the foremost issue for them. Replacing systems that "work just fine" because they are vulnerable to a security defect which they don't understand is seldom high
  • Fortunately, the mobsters only used a telescope shaped device to improve their range.

    Imagine if they had known enough to make a satellite dish [youtube.com], of sorts...

  • Ironic (Score:5, Insightful)

    by segedunum ( 883035 ) on Saturday May 05, 2007 @03:57PM (#19004041)
    It's ironic really. Many thought it might be some insider job, a complicated back door, some flaw in an internet facing system - but no. The company was daft enough to put their internal data over a network that is explicitly designed to get around physical barriers to access, and no one, and I mean no one, seems to understand this.

    A friend of mine has a reasonable but small IT business in the UK, and recently he started pushing the wireless expertise side - setting up wireless networks, explaining why they are a bigger risk than a wired network, securing them (and what do do if you are really paranoid) and trying to guarantee QoS more by setting it up correctly. Positioning your access points properly, doing wireless scanning to pick out any interference spots etc.

    No one is interested, and I don't just mean small businesses, but some quite large companies who should know an awful lot better. It's not a UK thing either, because most people believe setting up a wireless network is about popping down to the local store, picking up a Netgear, switching it on and letting Windows attach you to the nearest wireless network it can find. Astonishing.

    The only thing that shocks me is that this doesn't happen all the time, because many networks are just an open invitation. I mean OK, it's not that easy because you have to watch the network traffic and find out where the useful juicy bits of data are. That isn't completely straightforward, but once you are inside an average company's network it's doable because everything tends to act as if it is safe and fenced off.

    • Re: (Score:1, Informative)

      by Anonymous Coward
      It wasn't that sensitive info was going over WEP, it's that getting in through WEP allowed them to install a sniffer on wired router. The weakness of WEP is only the first link in an insecure chain. No servers were compromised because none needed to be.

    • Re: (Score:2, Insightful)

      by trav242 ( 645556 )

      The only thing that shocks me is that this doesn't happen all the time, because many networks are just an open invitation.

      I'm with you there. It's really unfortunate that people seem to think this is an isolated incident. I mean, it's not like these guys are your average junior high kids with a laptop and some time to kill -- they are professionals. This is an industrial-strength cracking operation where people are out there in search of networks to exploit. It's a business. For every TJX that we hear about, I'm sure there are many, many more that go under the radar.

  • .... will there be another story on slashdot today about another data leak?

  • Leave the WEP out for a moment (Score:4, Insightful)

    by Actually, I do RTFA ( 1058596 ) on Saturday May 05, 2007 @03:59PM (#19004049)
    WEP comprimised the communication of one retail store. Apparently enough information was stored in that one store to compromise a database with 4 years of records. So, an inside job at that level (assistant cashier probably had enough access to their wires) would be trivial. A better question... why would 4 years of CC number, etc. be accessible over the internet at all. Why not have that server offline, with updates posted occassionally via sneakernet? And hash the CC numbers. And otherwise, protect consumer information.

    • Good point. What's to say that some employee, either through a plant or bribe simply plugs a wireless access point into a spare RJ-45 jack in the back room.

      As for their databases, they should be shamed for not improving the security for accessing them, such as tiered levels of access (what in hell is a store employee/manager doing with full database access?), adding something like RSA SecerID pin generators and the like.

  • Pringles .... (Score:1, Flamebait)

    by taniwha ( 70410 )
    Next step will be a gross overreaction by the govt and Homeland Security, monitoring of convenience store purchase and the midnight roundups of the owners of pringles resulting in a one way trip to a Cuban internment camp
    • Well, I could only hope that further intrusion from the government and Homeland Security will not happen. Well, at least I try to be optimistic. Realistically, TJX should be punished because it was widely known that WEP is weak encryption. Presumably, TJX should have a competent IT Department. At my job, we have wireless, which on its face appears to be open. It is instead protected by IPSec. Anyone can get an IP address but without IPSec, you'll get absolutely nowhere. I would really like to see con

      • Re: (Score:2)

        by taniwha ( 70410 )
        well my comment was intended to be tongue-in-cheek ... but you're right the only way to think of wireless is open - it's by definition outside your corporate fire wall even if the hardware is physically inside your building - you have to treat it always as such - so WEP to make it hard to get in but a VPN of some sort as real security
  • The thing is, only hardware credit cards with internal key generators are a plausible solution. I just yawn whenever a credit card breach is mentioned, because ANY store that accepts credit cards ANYWHERE could have a breach. It's a waste of time to say "X store should have been secure". There must be tens of thousands of places those numbers could be grabbed from. After all, just ONE store with WEP turned on (it wasn't totally unsecure in the minds of the managers of the store, they felt they had locke

  • Well, I Wouldn't Shop With Them - Ever (Score:4, Interesting)

    by segedunum ( 883035 ) on Saturday May 05, 2007 @04:23PM (#19004249)
    Just read through the article more thoroughly, and several things worry me:

    TJX declined to comment on those numbers, but says it is undertaking a "thorough, painstaking investigation of the breach," hiring a team of 50 data security experts in December and taking a charge of $5 million in its first fiscal quarter.
    Well, we all know how brilliant data security experts are, and I really hope that sentence doesn't mean that they are simply throwing $5 million at them. You know what consultants are like - give them enough money and they will tell you everything you want to hear, even if the reality is a horror show.

    It says it will also pay for a credit-card fraud monitoring service to help avert identity theft for customers whose Social Security numbers were stolen. "We believe customers should feel safe shopping in our stores," says a letter from Chief Executive Carol Meyrowitz posted on TJX's Web site.
    The whole bloody point of this is that you don't get to that point in the first place. Stable door, horse bolted?

    The TJX hackers did leave some electronic footprints that show most of their break-ins were done during peak sales periods to capture lots of data, according to investigators.
    What the hell were they using this wireless network for?

    The TJX hackers did leave some electronic footprints that show most of their break-ins were done during peak sales periods to capture lots of data, according to investigators. They first tapped into data transmitted by hand-held equipment that stores use to communicate price markdowns and to manage inventory.
    So they were using an unsecured wireless network to enable hand-held equipment to function - and they used this to run their day-to-day business?! Christ. At first I thought this was just some wireless network someone had plugged into the network somewhere arbitrarily, not something they actually used in day-to-day operations.

    The company says the hackers may even have lifted bank-card information as customers making purchases waited for their transactions to be approved. TJX transmitted that data to banks "without encryption," it acknowledged in an SEC filing.
    I'm not 100% sure what system is used for credit card purchases in the US now, but this highlights why I like using cash a bit more with the advent of chip and pin. I would also never, ever use a debit card in one of these things. You transmit your card details, and the pin as well. Brilliant. Access to your bank account, and that hard earned pay that just went in today. I'm slightly confused though, because surely this communication with banks would all happen on another network?

    At that point, TJX hired forensics experts from International Business Machines Corp. and General Dynamics Corp. and notified the U.S. Secret Service, which spent a month trying to catch the hackers in the act.
    So you take no responsibility for your own systems, and you have no internal expertise? Wonderful.

    Massachusetts Rep. Barney Frank, chairman of the House Financial Services Committee, said in March he believes Congress will move to require a company responsible for allowing a breach to bear the costs of notifying customers and reissuing cards.
    That's probably the only way, because some companies simply believe they don't have to take responsibility for IT, data, security and especially wireless security. It's something that is best swept under the carpet, and setting up a wireless network is as easy as spending a bit of money on a little access point you've seen at a local store, right? Why spend money doing it properly?

  • The entire credit industry is complicit in the design of the credit-card as an open invitation to replay attacks. Then this distract our attention from the fact that this horrendous credential is being compromised exactly in the manner the design dictates while telling us that it's *our* identities that are under fire. Let's get this straight: my indentity remains secure, it's only my credit-card credential is additionally compromised with every use.

    The central problem here is the architecture of the huma
  • A lot of people are going to be criticizing the wireless link and arguing that they should have used a physical link for this kind of stuff. The fact is, at some point you're going to have to get secure data over an insecure network, whether it be the internet or a wireless link.

    If you're building a wifi link, you really should be using VPN over your WPA (not WEP!) link. If this was a database backup between servers then the protocol they were using should have been secure (SCP). If it was a client acces

    • Re: (Score:2)

      by pe1chl ( 90186 )
      You should understand that it is not always possible to do this because of limitations in the devices.

      When you want to use a wireless scanner or handheld terminal (as was the case in this shop) you can yell 'use a VPN' but what if the device does not offer that option?

      Similarly, when you want to link two offices using a point-to-point wireless link bridging between switches, where do you implement the VPN? You would need to put routers inbetween, an extra purchase.

      So it is not always that simple.

    • Re: (Score:2)

      by DrSkwid ( 118965 )
      They started at a store in the US and got all the way to the data centres in the UK and US and then took the data for $25,000,000,000.00 of transactions from the US, UK, Eire and Puerto Rico and more data that TJX don't even know the contents of !

      A system that allows that path just shouldn't even exist, VPN or no VPN.

       

  • Put Management's Data In The Databases (Score:5, Interesting)

    by NeverVotedBush ( 1041088 ) on Saturday May 05, 2007 @04:35PM (#19004343)
    And shareholder's data. Make a law that puts the money-grubbing CEO and other officer's data in the databases with the customer's data. Then sit back and see what kind of directives management gives to their IT departments to secure data, networks, and workstations. But put their personal data to the same risk as what they deem is sufficient for all the people they don't know or care about. Then see how responsible they get.

  • The real issue isn't WEP, though. (Score:3, Insightful)

    by Artifex ( 18308 ) on Saturday May 05, 2007 @04:48PM (#19004433) Journal
    (the following is speculation. TJMaxx, don't sue me, I'm not claiming to know what really went on, or real details of your network. This is just my impression from reading the story)

    Yes, WEP is insecure for real stuff. It's like the little latch on a high school display case. It's to keep honest people honest. It shouldn't be used in a commercial network as the only encryption.

    But what the heck kind of network design allows IPs from local stores direct access to central databases? The big issue here isn't that a few dozen or hundreds of cards were snagged by being sent through WEP -- we don't know, maybe the company ran a tunnel across that WEP link for those transactions, and they didn't get anything locally. The big issue is that it looks like the company was storing historical data on transactions online, and in databases that apparently were accessible from that link. WEP was a weak entry point to the network. But where was the security inside the network?

    It sounds like possibly either the designers of the overall network hadn't limited access sufficiently to just IPs/MACs from their account department, on a secure network, or the hackers managed to break through security layers in between, perhaps by knocking over a server that was straddling networks or something. If they designed in layers, with firewalls as gatekeepers between layers and IDS and IPS monitoring, I don't think they would have servers straddling, to start. IDS and IPS would also help them notice, for example, if someone spoofed an email from a store to an accounting department person, included a trojan, and attempted to gain access that way.

    I'm saying this not so much just to point out what sound like potential design issues with this company's networks, but to get people thinking about their own networks, instead of blowing this off as a WEP issue. If you administer a small network, and haven't had training on how to set it up and maintain it securely, you ought to look into Cisco's SAFE blueprint at bare minimum. It's free and the lessons can be applied to almost any brand of networking gear out there. It basically builds the network up from modules, which are easy to figure out. If you're administering a large network, well, as someone with CCSP training, I'd suggest you hire someone who's been properly trained, obviously. Cisco's track or someone else's. At the very least, everyone should consider thinking in terms of layers, like an onion, and discreet modules residing in, but not crossing, those layers. You should be really wary of any packets from across any WAN link to your core systems, obviously, but you should also set up security policies so that you know which administrative departments have access to which internal networks, too. Ask yourself, if an attacker can get into my network, what can he or she do?

    One last thing: network security can't just be set up and left. It has to be monitored and maintained, both to respond to immediate attacks, and to see when people are just poking around, doing reconnaissance.

  • RBC Visa (Score:5, Interesting)

    by jjohnson ( 62583 ) on Saturday May 05, 2007 @04:48PM (#19004435) Homepage
    pre-emptively changed my Visa card number a couple months before this became public. I found out that I was not affected by this break-in later, so I'm unsure whether or not it was in response to

    The question in my mind is, given the basic vulnerability of a long-term CC number, why they don't move to something like SecureId token one-time passwords? If you can have a different six digit number every sixty seconds for five years on one device, surely the same (now public domain) algorithms could be embedded in a credit card. The infrastructure for real-time verification is already in place. With one stroke, the whole CC# theft business could be out of business, and the first mover CC company on this would have a huge marketing advantage: "No one can ever steal your Visa number again".
  • I can tell you beyond a shadow of a doubt both the big card processors and many banks knew what was going on. But they were loathe to admit it because to do so would be to admit the gaping holes in bank security. It's all based on the demand draft principle. In essence, if I knew your account number I could write it on a napkin and the bank is pretty much honor bound to cash it. Same is true for credit and debit cards except in those cases, no tangible evidence is required since it's purely electronic.

    Th
  • We've been getting our balls busted by customers to become PCI compliant so they can maintain their status with the Credit Card industry... where the hell are they when this crap goes down? Four years running a weak wep protected network and nobody bothered to question them on it?

  • The link was encrypted using WEP, which had been known to be broken since 2001. The crackers who got into the TJX central databases are believed to be Romanians or Russians with ties to the Russian mobs. The eventual cost of the TXJ fiasco could exceed $1 billion -- not including the numerous lawsuits filed against the retailer.

    Well first WEP does encrypt the link. That's kind of part of the point of it. So saying "the link was unencrypted using WEP" makes absolutely no sense. Second when I read a different article yesterday, it seemed to cite a standard open network. So there seems to be conflicting reports. In any event whether or not it had WEP or not, it still shows they should have better security. WEP *is* better than nothing, and it shows intent to hack/illegaly access the network. However, WPA(2) should always be f

  • Just a week ago, I bought a set of equipment from a well known 5-letter corp that shall remain nameless, that doesn't work. It has WEP and 3 modes of WPA and not one of those actually work. The only way I can get a connection between the USB adaptor and the home router is in plain text. That problem used to be common some years ago, but in 2007? Sigh...
    • Don't feel too bad. I run my home network unencrypted so that I can use a 2005 iogear print server which cannot negotiate any tupe of wireless encryption. Luckily, I (a) don't live in a dense area and (b) have nothing of particular interest on my home network, which gets backed up remotely. Someday I'll get a new printserver - my epson actually doesn't work well with it, but I don't have space for a cheap computer - and fix it, but for now. I just walk around naked.
  • Companies should use end-to-end encryption for data links and should not rely on the simple encryption built into WiFi devices anyway. It should not matter whether WEP is working or broken. The data stream should be encrypted all the way, not just over the air.
  • One of the real question is: why IEEE standardised the WEP in the first place?
    If they made such basic mistakes in security on one standard, what prevents them to do other identical mistakes.

    Sure, it tough to devise 100% secure scheme, but there is a huge difference between coming with say MD5 which took years to be broken and WEP which was seen as broken as soon as it was studied by security experts..

Slashdot Top Deals

Get hold of portable property. -- Charles Dickens, "Great Expectations"

Close