How Not To Secure Your Company (Target Data Breach)

We'd have a lot less incidents like these if the CEO and employees were affected too. You know they'd try harder to do basic security and push for less data retention if they knew that their credit cards would get leaked if they got lazy.

the jojo stand stats on the citadel virus dgbhdbgdbh

also cant believe we have viruses w customer support now.

1:01 interesting, if I'm reading the Cyrillic correctly, that literally spells "tsitadel troyan", which is a pretty good approximation

How dumb you have to be, to make cash registers reachable from a corporate server?

PHP ❤

I worked contract in software through the 2010's and security was alwats forefront in my mind (I was pretty paranoid, but for good reason) alongside writing the best-standardised code you can. Layering security is broadly misunderstood, the assumption is the external front is "where it matters' but its really about layer upon layer of security if someone gets in. Actually lost a couple of contracts because some architects got upset when I called out obvious security issues. Did my job though as mostly people (many PM's analysts) knew that unless 'someone' on the front line with some level of experience says something they genuinely dont dont how exposed they are.

Some of the more abstract concepts are hard to understand.

A friend and I conducted a penetration test of Target's network about a year earlier and found several issues, one of them being several boxes on the network were phoning home suspicious data to Russian IPs. It was in our 300+-page report, that of COURSE they didn't read, but still paid our almost quarter of a million dollar fee to the company I worked at. After the breach and inevitable investigation, they tried to pin it on us, saying we were somehow responsible in that we didn't alert them to an issue. However, we sent yet another 300+-page paper describing how we did show them, and cited multiple pages in the original report along with multiple pages on how to mitigate the risks and on top of the report though was a cease and desist from our legal team, stating they could damage the reputation of our company with false claims if they went public with this nonsense claim. We never heard from them again. If they did try to save their ass with this bullshit claim and throw us under the bus, we were in no position to fight it, because we had signed a non-disclosure agreement with Target.

Wait... I suddenly understand why hacking can be fun and satisfying

"SQL Server 2000 Developer Edition on NT 5.1 SP2" 😭😭😭

we're sorry for exposing your info, here's a generous $.46 for the trouble

TARGET BECAME A TARGET 😂

Gotta love being able to VNC into servers via a Windows-based weighing scale

Still not as big a fuck up as their Canada launch lol