This is page 2 of:
Gonzalez: The Al Capone Of Cyber Thieves?
The attacks began with Gonzalez and others “reviewing a list of Fortune 500 companies,” to identify targets that would likely have tons of credit card data on file. “It was further part of the conspiracy that Gonzalez and P.T. would travel to retail stores of potential corporate victims, both to identify the payment processing systems that the would-be victims used at their point of sale terminals and to understand the potential vulnerabilities of those systems. It was further part of the conspiracy that P.T. would also visit potential corporate victims’ websites to identify the payment processing systems that the would-be corporate victims used and to understand the potential vulnerabilities of those systems.”
Other research: They tested their malware “against approximately 20 different antivirus programs.”
They would create backdoors and install sniffers to “capture credit and debit card numbers, corresponding card data and other information on a real-time basis as the information moved through the Corporate Victims’ credit and debit card processing networks, and then periodically transmit that information to the coconspirators.” The malware also erased some evidence of the attack, according to the indictment (and, for that matter, common sense).
One retail security expert, who agreed to discuss the indictment if neither her name nor employer was identified, said much in the indictment points out inherent weaknesses in PCI.
The back door approach used, a time-honored hacking technique for decades, is a red flag. “Being on the inside, these probably would have passed right through firewalls as the data would be travelling in the ‘safe’ direction. Also note that any gains a company would have from a password rotation scheme would be negated by the installation of a back door. My main point there is that password rotation schemes are not an effective defense, and shouldn’t be elevated to such by PCI or corporate ‘security policies.’ In any case, Hackers 2, PCI 0.”
Another concern that she listed involved Heartland details. “The attackers installed sniffers to capture the traffic, they did not harvest data intentionally stored by Heartland on hard drives. PCI doesn’t say anything about encrypting data on private networks, only that you must protect stored cardholder data or encrypt data traveling over open, public networks. And the networks obviously have the business need-to-know, that’s what they do: carry data. That’s a three-point shot for the Hackers; Hackers 6, PCI 0.”
She also questioned the PCI requirement to update antivirus software. There’s no doubt it’s a good thing to do, but she pointed to the indictment as evidence it won’t block any serious attack. “The hackers coded their own malware and tested their code against 20 anti-virus programs (I didn’t even know there were 20 AV programs out there!) Of course custom code is not going to be recognized as viral, especially if it performs no viral behaviors,” the expert said.
-Marc
August 19th, 2009 at 10:21 am
The Tiger Woods of Cyber Crime. Amazing to me that after busting into Dave & Barry’s, he worked as informant for FBI on Shadowcrew thing and, after that gig, decided to go back to hacking into corp data.
August 19th, 2009 at 6:16 pm
A good post, and thanks for pointing out the potentially conflicting numbers between the indictments and press releases…very interesting to see how that works out.
I have spoken with some colleagues at 403 Labs (full disclosure: we are a QSA, PA QSA, and ASV firm) and we would take some exception to the comments of the retail security expert you quote. She begins by saying that the attack against Heartland Payment Systems came in the form of a back door and that such an attack obviated the efficacy of both firewalls and password rotation schemes. My colleagues and I would not dismiss too casually these controls. The intent of good network architecture and proper firewall policy is to limit access to the minimum necessary (e.g., default “deny all”) for business use. This is intended to include internal network segments (PCI DSS 1.2.1). Further, PCI specifies the need for both documentation and justification of open ports and services (PCI DSS 1.1.5-1.1.6). It’s not enough to use your firewall or firewalls to divide the company network from the Internet; PCI actively encourages segmentation between various internal zones and treating zones not directly involved in card data transactions as untrusted. Good network architecture and strict firewall rules that limit traffic don’t, by themselves, preclude the possibility of a back door being installed, but they certainly make it harder for the bad guy in question to do so and they limit the network-level access a back door has.
I would also challenge her point that password rotation “isn’t an effective defense, and shouldn’t be elevated to such by PCI or corporate ’security policies.’” Protecting access to user accounts, especially administrative or other critical accounts, is the core of password controls and very relevant to the attacks that led to many of the recent breaches. For example, the attacker needs first to install a back door onto the system in question. Often, these attacks require the attacker to compromise a privileged user account in order to install hostile software; strong passwords enforced by system-level controls defend against these attacks.
She argues that maintaining current anti-virus software is not an effective control because custom malware “will not be recognized as viral, especially if it performs no viral behaviors.” It’s not entirely clear what she means by viral behavior. Nonetheless, I’m not sure it’s wise to cease maintaining anti-virus software in the face of the numerous extant attacks that said software will detect, including keystroke capture malware used in compromising credit card data.
As for PCI’s security testing and security policies, PCI DSS 11.2 and 11.3 call for both automated vulnerability scans and penetration testing directed against both the external (e.g., Internet-facing) environment and the internal environment. The penetration tests are intended to simulate real attacks and skilled penetration testers are entirely capable of doing so. As such, a “PCI-test-detectable breach” is a pretty broad category that does include situations like these. It’s entirely possible that the penetration testing performed either wasn’t adequate or that the environment changed between the testing and the compromise, but to say that the PCI security testing requirements were inadequate sounds too broad. Also, remember that PCI DSS 12.1.2 specifically requires an annual risk assessment to identify and propose strategies to deal with threats and vulnerabilities. If you want to conclude, based on your risk assessment, that your organization needs end-to-end encryption, weekly penetration tests, and replacing card data with tokens, any competent assessor will agree with you wholeheartedly and help see to it that your information security practice lives up to this.
We may want to wait to learn more before making the statement “Heartland could have been (and probably was) breached while being 100 percent PCI 1.1 compliant on all their points.” Based on what I’ve noted above, we could conclude that this is not true. Organizations are obligated to comply with the PCI DSS, meaning they must meet all of the requirements all of the time. An assessor validates their compliance on (usually) an annual basis. It’s entirely possible that an organization could pull together to make things look good for the assessor and then let their controls lapse as soon as the report is finalized, but this misses the point entirely. PCI critics who regard the distinction between compliance and validation as a weakness ought to direct their criticism towards the organizations that claimed compliance but let their security controls lapse, rather than at the standard itself.
PCI DSS is not intended to be the maximum data security effort; it does not limit anyone from going above what the requirements dictate based on their own risk assessment. PCI doesn’t limit implementing additional controls like end-to-end encryption or additional security testing. On the contrary, it encourages this kind of activity.
August 20th, 2009 at 8:46 am
Editor’s Note: The retail exec quoted in the piece wanted to respond to Walt’s thoughts. Her comments:
I am not disagreeing with Walt on some of his points. He is certainly correct that PCI 6.5 does talk about protecting web-facing applications SQL injection and Heartland should have been looking for that exposure. If that’s the case, Hackers 11, PCI 1. The real question is if SQL injection was used as the original method of forcing entry, or only as the means for elevating privilege once the hackers were inside? The indictment text suggests the former, but one of the documents mentioned the xp_cmdshell exploit which suggests the latter, and that could have been outside the PCI review requirements.
I also agree that a properly firewalled and segmented network environment is an excellent defense, and is one of the best ways to limit exposure and maintain damage control. The problem there lies in the wriggle room around the word proper, and how that is interpreted by the company and the individual QSA. A processor is likely to run all their card handling systems in a single segment, but once that segment is breached at a processor the hackers have access to it all.
I did not say anti-virus software is ineffective against all attacks, only that it will always be ineffective against custom written malware. For software to behave like a virus it would have to spread itself, and there are some anti-virus products that detect that bad behavior. What is more effective than AV is a software execution policy that uses a whitelist instead of a blacklist, or a FIM product.
Regarding the argument against password rotation, I claim only that enforced rotation is an ineffective defense, not that policies enforcing strong passwords aren’t effective. Rotation is theoretically supposed to limit the damage, but hackers who gain system authority routinely install backdoors that render passwords ineffective, rotated or not. Password rotation primarily harms the users’ ability to remember them, forcing them to be written down.
Most security testing is thought of as walking a fence. The security team built the fence to keep the attackers out, so the natural test procedures focus on examining the fence. They look at the gate and make sure the lock is secured, they look at the walls and make sure there are no gaps, etc. They look for the vulnerabilities they expect to find. But hackers rarely come in over the fence. Instead they will find a new way to disguise themselves, or move the fenceposts, or send a purchase order for a new padlock for the gate, or trick the owners to bring their valuables outside the fence. As researchers learn these new tricks from successful hacks, they can and should be added to test suites, but it makes the hackers’ jobs easier to avoid detection when they know exactly what is being looked for.
I think Heartland was honestly trying to be PCI compliant – no company wants to leave themselves exposed. And PCI DSS does a great job of helping to keep the run of the mill hackers out of the environment. But as the article claims, Gonzales may be the Al Capone of cyber thieves. I don’t believe that 100% perfect PCI compliance would have stopped him.
August 20th, 2009 at 11:28 am
PCI DSS is a good set of practices for defense in depth, regardless of whether it is effective in every single case, or if it was applied perfectly.
I realize the discussion is about who did the stealing, and not what they stole, which is unfortunate. It misses the root cause of the problem, which is why the banks, retailers and processors are not using smart cards and cryptographic protocols to avoid all this handling of raw, valuable data in the first place. Get the valuables out of the retailers and processors hands, and the cyber-crooks will have nothing to steal.
Some people continually complain about the cost or the complexity or the inconvenience of securing the data properly. People like Gonzalez show why we must bite the bullet and do it anyway.
August 21st, 2009 at 12:54 pm
Let me make a point about PCI. I think we can all agree that compliance is not the same thing as security. In fact, I could make the case that PCI by its very nature assumes you *will* be breached and that your systems will be compromised. What PCI says is that when — notice I did not say “if” but “when” — your systems are breached, the cardholder data you are (foolishly?) storing won’t be compromised.
Just like compliance is not security, a breach doesn’t have to result in a data compromise.