The Citi data breach revealed last week is yet another piece of evidence pointing to a shift in behavior on the part of sophisticated hackers, one that many current security policies aren’t always prepared to handle.
The Data Security/Compliance firm Trustwave has circulated a mini-Q&A which notes that the Citi breach likely was accomplished by someone who gained access to the Citi customer portal with valid credentials, the took advantage of flaws in the web application to gain access to the records of other customers. While the stolen data did include card account numbers, that was probably the least valuable part of the electronic haul.
According to Trustwave: “The real concern is have the Citi customers been targeted with other types of attacks using the name, addresses, email, etc, info that was breached.”
Combined with a card number, this information could be used for targeted “spear-phishing” ploys that persuade customers to volunteer additional data that can be used to gain access to bank accounts and other lucrative information.
The targeting of non-card data (as in the Sony and Epsilon breaches earlier this year), the use of valid customer credentials to hack into customer records through web applications for the purpose of spear-phishing attacks, represent a distinct shift in tactics on the part of hackers, who are acting on a common weakness in web based applications, like customer portals.
Says Trustwave: “Credential attackers are becoming the new way that attackers are getting access to the real data they are looking for. As companies are only testing their systems for security issues from an unauthenticated point of view, they are not identifying critical vulnerabilities that an attacker with a user name and password to a customer portal can exploit.”
