As Target breach unfolds, information vanishes from Web

Did security companies publish too much, too soon on the Target breach?

iSight Partners is one of three security companies that has modified or removed information posted on the Internet related to the Target data breach.

iSight Partners is one of three security companies that has modified or removed information posted on the Internet related to the Target data breach.

At least three security companies have scrubbed information related to Target from the Web, highlighting the ongoing sensitivity around one of the largest-ever data breaches.

How hackers broke into Target and installed malware on point-of-sale terminals that harvested up to 40 million payment card details is extremely sensitive. Now, details that give insight into the attack are being hastily removed or redacted, perhaps not to tip off hackers or jeopardize the investigation.

On Dec. 18, a malicious software sample was submitted to ThreatExpert.com, a Symantec-owned service. But the public report the service generated vanished.

The report was a technical description of how the Target malware functioned, including network drive maps, an IP address and a login and password for an internal company server.

Last week, iSight Partners, a Dallas-based cybersecurity company that is working with the U.S. Secret Service, published a series of questions and answers on its website related to the attacks on point-of-sale devices at U.S retailers. That too vanished on Thursday.

In another example, Intel-owned McAfee redacted on Tuesday a blog post from last week that contained technical detail similar to the ThreatExpert.com report.

ThreatExpert.com is an automated service that analyzes submitted files to figure out how they behave. It has an archive of reports as a resource for the security community, which can be searched.

Brian Krebs, a security writer, noted ThreatExpert.com's report on the Target malware was removed and that it also disappeared from Google's cache shortly after he published a post on Jan. 15. He preserved a PDF of it, however, when it was still available in Google's cache.

When queried, a Symantec spokeswoman said "we took the initiative to remove it because we didn't want the information to compromise the ongoing investigation."

Alex Holden, founder of Hold Security, said it was the right move for Symantec to pull the report, as attackers might have been able to use the information to compromise other point-of-sale devices at other retailers.

"I was surprised that this information was posted on the Internet in the first place," Holden said. "Besides having a Target machine's name and its IP address, system structure and drive mapping, it discloses a very vital set of credentials setup specifically for exploitation of the device."

Many other malware reports on ThreatExpert.com can be found through Google's search engine that display login credentials.

Although the ThreatExpert.com report remains offline, McAfee published similar information last week.

McAfee's revision removes the IP address, substituting instead the phrase "EPOS_IPaddr," or electronic point-of-sale IP address. Other specific data was replaced with <username> and <password>.

The information published on iSight Partners' website did not contain the level of technical detail matching either ThreatExpert.com or McAfee. It wasn't clear what might have triggered its disappearance, but it did describe the malware as using a "a new kind of attack method" that made it harder to forensically detect.

An iSight spokeswoman didn't directly address why the information was withdrawn. "As this evolves, we are working on the best way to get the most important information out to people," she wrote via email on Sunday.

As many as six other U.S. companies are believed to be victims of point-of-sale related attacks, where malware intercepts unencrypted card details. So far, Target and high-end retailer Neiman Marcus have acknowledged the attacks.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwaresymantecmcafeeintrusionTargetiSight Partners

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Skywatcher Dobsonian 8″ Collapsible Telescope

Learn more >

Family Friendly

Whodunnit™ Duo-Scope MFL-007 Microscope Kit

Learn more >

Stocking Stuffer

Logitech Ultimate Ears Wonderboom 2 Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?