Feeds

TJX employee fired for exposing shoddy security practices

Blank passwords for the company that lost 94m credit cards

SANS - Survey on application security programs

TJX Companies, the mammoth US retailer whose substandard security led to the world's biggest credit card heist, has fired an employee after he left posts in an online forum that made disturbing claims about security practices at the store where he worked.

Security was so lax at the TJ Maxx outlet located in Lawrence, Kansas, that employees were able to log onto company servers using blank passwords, the fired employee, Nick Benson, told The Register. This policy was in effect as recently as May 8, more than 18 months after company officials learned a massive network breach had leaked the details of more than 94 million customer credit cards. Benson said he was fired on Wednesday after managers said he disclosed confidential company information online.

Other security issues included a store server that was running in administrator mode, making it far more susceptible to attackers. He said he brought the security issues to the attention of a district loss prevention manager name Allen in late 2006, and repeatedly discussed them with store managers. Except for a stretch when IT managers temporarily tightened password policies, the problems went unfixed.

"I was basically hitting a glass wall," said Benson, a 23-year-old freshman at the University of Kansas who worked at TJ Maxx beginning in October 2005. "Not one single thing was done. My store manager even posted the password and username on a post-it note. I told her not to do that."

So last August, Benson took to Sla.ckers.org, a website dedicated to web application security, and began anonymously reporting the shoddy practices in this user forum. Over the next nine months, he left eight posts in which he chafed at the password policy and what he should do about it.

"I am not sure if this is just an isolated incident within this specific store, but it goes to show that you can't trust a company to protect your information, especially TJX," Benson wrote under the moniker CrYpTiC_MauleR. "Today was a very sad day for me =o("

A TJX spokeswoman declined to comment for this story and turned down our request to discuss the company's policies for passwords and other security matters.

Benson's May 8 posting was prompted by news that managers had changed the password for employees to access the store server. Inexplicably, it was set to blank. When Benson first began working for TJX, his password was the same as his user name, he said. Then came word in January 2007 that unknown hackers had brazenly intruded on the company's network over a 17-month period. For a time following the disclosure, TJX employees were required to use relatively strong passwords. The change to a blank password clearly represented a step backward, Benson thought.

The posts eventually caught up to Benson. On Wednesday, while marking down items on the TJ Maxx retail floor, he was summoned to the store office. Inside, a regional loss prevention manager told him his critiques had come to the attention of the company hired to monitor internet postings about the retailing giant. The manager told Benson he was being fired for disclosing confidential company information.

No one at Sla.ckers.org was willing to defend TJX or the shoddy security practices it is accused of following, but some have questioned Benson's decision to speak so openly.

"I would assume your disclosure of your company's inner server workings on the internet means that they can't trust employees to protect their information?" one forum participant wrote in a response to Benson's posts.

But critiques like that seem to overreach. Benson's disclosures weren't specific enough to give attackers information needed to successfully breach TJX's networks. And when you consider the right of TJX's customers and employees to know that their data may be at risk, it's not unreasonable to call him a whistleblower.

The account has us wondering if other TJX employees have tales similar to Benson's. If so, please contact your reporter using this link. (Anonymity assured.)

For Benson's part, he has no regrets. "They're telling the public they're PCI compliant," he said, referring to so-called payment card industry security rules governing businesses that accept credit and debit cards. "That I think is unethical."

But he says his actions were also fueled by a healthy dose of self-interest.

"My information is still on that server," he continued, referring to the machine that sits in an office at the TJ Maxx where he once worked. "So if their network is insecure, then my information is insecure. I'd prefer they get it fixed." ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.