Ryan Paulsen Chris Lafferty Nilesh Nipane

 Intruders gained access to credit card information between  ~50 million credit card and debit card numbers stolen  ½ million driver’s license and SSN stolen  Largest theft to date  Previous was 1.5 million credit card numbers

 WEP key crack at St. Paul Marshalls store  Hackers monitor and gather network traffic  Gather data and crack encryption key for traffic destined for central database  Gathered usernames and password from decrypted traffic  Created accounts in TJX systems

 Create accounts on central database systems in Framingham, MA  Gathered historical data from storage systems ▪ Used by TJX to track returns  Install specially made blabla sniffer tool gathering credit card numbers before they were encrypted ▪ Hackers then logged into the systems and transferred data files off of the system  Used in Wal-Mart gift card scam ($1 Million)

 Monetary Cost/Loss for nearly all involved  Customers may lose money/time or other resources directly  Banks lose customers or reputation points  TJX loses substantial amounts of money ▪ Approximately $1.5 billion to fees, settlements, and new security measures mandated by FTC ▪ More than $195 million in new security equipment and training

 Reputation/Business costs  Customer confidence  Federal Trade Commission’s response  Ethical and Policy Implications/Movements  Ethical concerns of information protection, misuse of resources, privacy, etc.

 Impacts still being felt and analyzed…  Legal Issues / Legislation insufficiencies  The full extent of these attacks and just how many systems were attacked by the same people (still finding out of new cases today)  The actions and lack of actions being taken in response by other companies

 2004 audit found failure of 9/12 criterion for credit card merchants  Misconfigured wireless networks  Poor antivirus protected  Weak intrusion detection  Easily crackable usernames and passwords  Poor log maintenance  Failed to install data encryption software

 Initial Breach  Due to deficiencies in the wireless network and WEP encryption scheme ▪ WEP is known to be broken since (FMS attack)  Collected data transmitted by handheld devices used to communicate price markdowns and to manage inventory ▪ Used that data to crack the encryption code.

 Other Vulnerabilities  Kiosks, equipped with USB drives, were located in many of TJX's retail stores ▪ Allowed direct access to the company's network and were not protected by firewall

 Feds tracked down and arrested 11 coconspirators  Discovered credit theft ring known as “Operation Get Rich or Die Trying”  Led by Albert Gonzalez  Ring responsible for most major credit card thefts in US ▪ Including Homestead breach which is now the largest of its kind

 Class Action Lawsuits  TJX reluctant to disclose data on the breach  Failed to detect for 7 months, took another month to disclose  Prosecutors hope to show negligence  Watershed Case  Companies now must be more open and transparent about how they protect customer data

 PCI Security Standards Council Data Security Standard (DSS)  Special recommendations published July 2009 for wireless networks  Covers best practices in relation to processing credit card information around wireless networks

 Wireless Intrusion Detection/Prevention System (IDS/IPS)  Investigate and classify wireless networks and their access to customer data  Create automatic alerts of rouge wireless connections  Response plans to remove rouge connections

 Filter wireless networks that do not need access to customer data with firewall  Do NOT use VLAN separation  Monitor rules every 6 months From Information Supplement: PCI DSS Wireless Guideline

 Protect wireless networks that transmit card holder data  Physical protection ▪ Secure access points so no one can reset to factory defaults ▪ Make sure access points aren’t stolen ▪ Don’t store PSKs in obvious locations

 Protect wireless networks that transmit card holder data  Change default configuration ▪ Use enterprise mode when possible ▪ Do not advertise company name in SSID ▪ Only use SNMPv3 ▪ Disable unnecessary ports and protocols

 Protect wireless networks that transmit card holder data  Logging and Monitoring ▪ Store event logs for 90 days ▪ Maintain updates to network topology  Security ▪ Use AES when possible ▪ Use enterprise security when possible ▪ 13 character PSK

 Protect wireless networks that transmit card holder data  Encryption ▪ Use SSLv3 with 256 bit encryption ▪ Treat wireless networks as outside network From Information Supplement: PCI DSS Wireless Guideline

 Chapter 6 – Database Security  Chapter 7 – Security in Computing  Chapter 9 – Economics of Cybersecurity  Chapter 10 – Privacy  Chapter 11 – Cryptography Explained

  s.pdf s.pdf     ,00.html ,00.html  ,00.html ,00.html  ,00.html ,00.html   id=AW4H134JQ43VXQE1GHOSKHWATMY32JVN?articleID= id=AW4H134JQ43VXQE1GHOSKHWATMY32JVN?articleID=   heartland/ heartland/