There's been a lot of wheel spinning about the Heartland breach and what it will mean for PCI, consumer confidence, life, the universe and everything. I've been following it all with semi-detached interest as I've done some (albeit smaller) PCI-related breach response before, but I felt I had to comment on
the article that popped up yesterday at StorefrontBacktalk.
"The sniffer malware that surreptitiously siphoned tons of payment card data from card processor Heartland Payment Systems hid in an unallocated portion of a server’s disk. The malware, which was ultimately detected courtesy of a trail of temp files, was hidden so well that it eluded two different teams of forensic investigators brought in to find it after fraud alerts went off at both Visa and MasterCard, according to Heartland CFO Robert Baldwin."
Having worked on teams of forensic investigators, I can tell you it's not often hard to elude them (no slight to the capabilities of those involved). If you're working a large, vague breach using standard forensic methodologies, you may eventually find what you're looking for but it is equally likely that you'll find it by chance as by skill - this is the Infinite Monkeys, Infinite EnCase Dongles theorem.
"“A significant portion of the sophistication of the attack was in the cloaking,” Baldwin said.
Payment security experts pretty much agreed that hiding files in unallocated disk space is a fairly well-known tactic. But it requires such a high level of access—as well as the skill to manipulate the operating system—that is also indicates a very sophisticated attack...
Baldwin also added more details to the sketchy timeframes that have been revealed thus far about the attacks, specifying that Heartland was contacted by Visa and MasterCard “in very late October,” possibly October 28.
Baldwin said Justice Department and U.S. Secret Service officials have told him “the bad guys they think got us have successfully breached other financial institutions.”
Apparently, federal law enforcement was focusing on suspects in other breaches when the Heartland breach became known, which explains the relative speed of the Secret Service identifying a key suspect, apparently in Eastern Europe.".
Other articles are stating the breach may stretch as far back as May.
Let's recap. The facts we know are as follows:
