Wal-Mart’s VPN Data Breach Raising Server Log Questions
Written by Evan SchumanOctober 15th, 2009
Back in June 2005, right around the time that several major retailers (including TJX, BJ's Wholesale Club, Boston Market and DSW) were being attacked by Albert Gonzalez's cyber thief gang, Wal-Mart was quietly experiencing its own data breach. In Wal-Mart's case, though, the breach began in June 2005 and wasn't discovered by the chain until some 17 months later.
These new details of Wal-Mart's data breach—which saw POS source code grabbed and zapped to parties unknown in Eastern Europe—are shedding more light on the early days of such retail assaults and how various chains learned of and then dealt with them. But here’s the rub: Wal-Mart maintains that no customer or employee data was taken. Does it truly stand to reason that those thieves would have had secret access to the systems from the world's largest retailer for 17 months and not taken any names or card data? Oddly enough, it seems likely that they, in fact, didn't. And therein lies the potentially most intriguing part of the story.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
2 Comments | Read Wal-Mart’s VPN Data Breach Raising Server Log Questions
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
October 15th, 2009 at 11:01 am
There is significance in the fact that the attacker was able to gain access to not one, but multiple VPN accounts. There must have been an underlying security failure to account for that.
October 15th, 2009 at 5:52 pm
@Lucas – one aspect of the story talks about how the security staff found a copy of l0phtcrack on the initial server that crashed. So, they could have (a) stolen multiple accounts initially or (b) cracked multiple accounts once into the environment.
Once you have an intruder in your environment you need to start making all sorts of assumptions about security – account compromise, data compromise, etc – unless you can prove otherwise. One good thing they learned from the lesson was to implement 2-factor for remote access, which at least should reduce remote attacks in the future.