Was breach at Target internal or a vendor?

X-force has information on the specific malware that breached the Point of Sale terminals (POS).

The Internet Storm Center has an interesting comment,which is discussed in their newssummary section.

Is a refrigeration vendor ultimately to blame for the target breach?

This brings up another point – your vendors better have good security, as the weakest link in the chain breaks and allows the criminals in.

PHP CGI Query String Parameter Processing Remote Code Execution


This vulnerability in PHP 5.3.12 and 5.4x before 5.4.2 when configured as a CGI script (php-cgi), a query which lacks and = sign will not be properly handled. So a remote attack may be possible.

And the problem will be that one will not know it is on the web server, unless one check for odd ports being open on the server.

Since after the PHP “bad code” it will cause more code to be opened and downloaded on the now infected machine.


Small orgs still have to do the right thing

The problem with looking at this sophisticated target and Michaels attacks can make you think:

That only happens to the big companies – my business does not provide a large target, so I don’t have to worry.


That is unfortunately not true.  Small organizations need to do the right thing and secure their resources as much as possible, since thety will get different attackers, different attacks. And undefended you will get hammered as the smaller attacks pile up.