Feeds

Lax security led to TJX breach

Security pros left windows open

Internet Security Threat Report 2014

A wireless network that employed less protection than many people use on their home systems appears to be the weak link that led TJX Companies, the US-based retailing empire, to preside over the world's biggest known theft of credit-card numbers.

Despite a market capitalization of almost $13bn, it appears the company couldn't afford to secure its Wi-Fi network with anything more robust than the woefully inadequate Wired Equivalent Privacy protocol. (The much more secure Wi-Fi Protected Access has come standard on most routers for four years now.) It also failed to use firewalls or install software patches and disregarded requirements imposed by Visa and MasterCard concerning how card information is stored and transmitted.

According to a front-page article in today's Wall Street Journal, the nonfeasance allowed hackers to use a simple telescope-shaped antenna and a laptop to intercept data flowing through a Wi-Fi network used at a Marshalls discount clothing store near St. Paul, Minnesota.

"It was as easy as breaking into a house through a side window that was wide open," a person familiar with the investigation told the Journal.

The hackers, who bore the hallmarks of Romanian gangs and Russian organized crime groups, were able to eavesdrop on employees logging into TJX's central server in Framingham, Massachusetts, where the miscreants eventually were able to set up their own accounts. From then on, they were able to log onto the system remotely, from anywhere in the world.

The trespassers brazenly used the network as a communication post, leaving each other encrypted messes so one wouldn't duplicate the work of another. They also may have lifted card information that was being processed over the network, taking advantage of TJX's failure to use encryption when transmitting the data, as required by credit-card company guidelines.

TJX has fessed up to losing 45.7m credit and debit card numbers and personal information relating to almost 500,000 people. But according to one person, the thieves may have purloined as many as 200m accounts. (TJX rejects that claim as "speculation.") Stolen card numbers have been used in at least seven US states and at least eight countries, including Mexico, China, Italy, Australia and Japan. In one case, police in Florida charged a single gang with using hacked TJX card data to steal $8m in transactions at Wal-Mart Stores and other outlets.

All told, the breach could cost TJX $1bn over five years in costs for consultants, security upgrades, attorney fees and damage-control marketing, analysts from Forrester Research estimate.

Significantly, Forrester's estimate doesn't include liabilities that may result from lawsuits, such as one recently filed by associations representing almost 300 Northeastern banks in the US.

Plenty of banks have been saddled with costs resulting from the breach. Banking associates are lobbying federal and state lawmakers for legislation that would require companies who suffer security breaches to absorb the costs of issuing new credit cards. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.