As Target Breach Unfolds, Information Vanishes From Web

At least three security companies have scrubbed information related to Target from the Web, highlighting the ongoing sensitivity around one of the largest-ever data breaches.

By Jeremy Kirk
Wed, January 22, 2014

IDG News Service — At least three security companies have scrubbed information related to Target from the Web, highlighting the ongoing sensitivity around one of the largest-ever data breaches.

iSight Partners, Target, data breach
iSight Partners is one of three security companies that has modified or removed information posted on the Internet related to the Target data breach.

How hackers broke into Target and installed malware on point-of-sale terminals that harvested up to 40 million payment card details is extremely sensitive. Now, details that give insight into the attack are being hastily removed or redacted, perhaps not to tip off hackers or jeopardize the investigation.

On Dec. 18, a malicious software sample was submitted to ThreatExpert.com, a Symantec-owned service. But the public report the service generated vanished.

The report was a technical description of how the Target malware functioned, including network drive maps, an IP address and a login and password for an internal company server.

Last week, iSight Partners, a Dallas-based cybersecurity company that is working with the U.S. Secret Service, published a series of questions and answers on its website related to the attacks on point-of-sale devices at U.S retailers. That too vanished on Thursday.

In another example, Intel-owned McAfee redacted on Tuesday a blog post from last week that contained technical detail similar to the ThreatExpert.com report.

ThreatExpert.com is an automated service that analyzes submitted files to figure out how they behave. It has an archive of reports as a resource for the security community, which can be searched.

Brian Krebs, a security writer, noted ThreatExpert.com's report on the Target malware was removed and that it also disappeared from Google's cache shortly after he published a post on Jan. 15. He preserved a PDF of it, however, when it was still available in Google's cache.

When queried, a Symantec spokeswoman said "we took the initiative to remove it because we didn't want the information to compromise the ongoing investigation."

Alex Holden, founder of Hold Security, said it was the right move for Symantec to pull the report, as attackers might have been able to use the information to compromise other point-of-sale devices at other retailers.

"I was surprised that this information was posted on the Internet in the first place," Holden said. "Besides having a Target machine's name and its IP address, system structure and drive mapping, it discloses a very vital set of credentials setup specifically for exploitation of the device."

Many other malware reports on ThreatExpert.com can be found through Google's search engine that display login credentials.

Continue Reading

Our Commenting Policies