Pa. vendor confirms link to Target data probe

AP ^ | Feb. 7, 2014 | AP

[bgill]

A western Pennsylvania heating and refrigeration contractor said it was the victim of a "sophisticated cyberattack operation" that is being investigated by the Secret Service and possibly linked to the data breach that enabled hackers to access millions of credit card numbers belonging to Target store customers.

Fazio Mechanical Services Inc., of Sharpsburg, issued the statement after Internet security bloggers identified it as the third-party vendor through which hackers accessed Target's customer information. Target had previously told reporters the store believed hackers accessed 40 million of its customers' card numbers through a vendor's system.

[bgill]

Either someone at this company hacked into Target's data or the hacker got through to Target via this vendor. Either way, expect a lot more of this in the future.

[Steely Tom]

Physical access to Target’s server hardware.

Social engineering.

[Born to Conserve]

I used to work for a service vendor. We had networking hardware all over, in and amongst the customer’s network, inside their firewall — no passwords, no nothing. The clients were all the big banks in NYC. Could have snooped packets all day long from the comfort of my home. Tracing would have been impossible. At banks, the janitors are vice presidents.

[cicero2k]

I used to work for a service vendor. We had networking hardware all over, in and amongst the customer’s network, inside their firewall — no passwords, no nothing. The clients were all the big banks in NYC. Could have snooped packets all day long from the comfort of my home. Tracing would have been impossible. At banks, the janitors are vice presidents.

There's an unreasonable presumption of trust for system administrators.

I have had access to millions of customer credit cards, SSNs, and addresses from time to time. My clients and these customers would never suffer harm from me, but who else has this level of access.

Sooner or later the wrong person will.

Just because it is complex and not easily understood, does not make it safe. That only works until the technology is mature and ubiquitous.