STE WILLIAMS

Home Depot just beat another major retailer — but not in a way the company would like.

According to Home Depot, an investigation has revealed that the recent data breach put some 56 million credit and debit cards at risk, a number that far surpasses the roughly 40 million cards exposed in last year’s attack on Target.

Trey Ford, global security strategist at Rapid7, said in a statement:

Fifty-six million cards may not be as big as the huge Heartland Payment Systems breach, but it eclipses both the TJX and Target breaches, and that’s going to cost Home Depot a lot of money. We can expect other large global retailers, such as Wal-Mart, Carrefour, Tesco and Metro AG, will be paying close attention as the investigation continues.

This is why big box retailers are great targets for sophisticated, well-resourced cybercriminals. They are able to invest time in researching their targets to find a way into the network. Once they’re in, they stay quiet and fly unobserved under the radar, potentially for months at a time. It’s really hard for organizations to detect them in many cases because they can be using stolen account details and look like a bona fide user.  It’s well worth the planning and patience involved for the attacker when the potential pay day is this significant.

The criminals used custom-built malware to evade detection that Home Depot’s security partners have not seen in previous breaches. The malware is believed to have been present between April and September.

One common thread in a number of breaches is a lack of configuration monitoring on point-of-sale terminals, says Steven Ransom-Jones, senior consultant at Neohapsis, in a statement:

The Payment Card Industry requires the use of file integrity monitoring to detect unauthorized changes to servers that run in the cardholder processing environment. The intent of this control is to stabilize a secure processing environment and identify the effects of changes, whether it is by malware or direct intervention (either by a hacker or an administrator circumventing a change management process).

As payment terminals are dedicated to a single purpose… changes on these devices should be infrequent and managed through an appropriate management process and testing cycle. In this environment, integrity monitoring would be an extremely effective control: any change should be considered as suspicious and investigated immediately.

To protect data until the malware was eliminated, any terminals identified as infected were taken out of service. The hackers’ method of entry has been closed off, and the company has rolled out enhanced encryption of payment data to all U.S. stores, according to Home Depot. Roll out of encryption to Canadian stores will be completed by early 2015. Canadian stores are already enabled with EMV Chip and Pin technology.

There is no evidence that customers’ PIN numbers were compromised in the attack, according to the company.

“We apologize to our customers for the inconvenience and anxiety this has caused, and want to reassure them that they will not be liable for fraudulent charges,” says Frank Blake, chairman and CEO, in a statement. “From the time this investigation began, our guiding principle has been to put our customers first, and we will continue to do so.”

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/home-depot-breach-surpasses-target-in-scope-/d/d-id/1315916?_mc=RSS_DR_EDT