More on the home Depot Breach

[cruelsister]

Just wanted to pass on some depressing new news on the recent Home Depot massive breach. As has already been reported. someone somewhere in Home Depot clicked on a file that they should not have. The malware then dropped some files, the main malware disguising itself as a Mcafee Endpoint service.

Although an extra Mcafee service may be overlooked if Home Depot was using Mcafee, but they weren't (they used another extremely popular Endpoint system- the maker of which was also called in to investigate the breach). So the IT "Pros" at Home Depot suddenly see a service appear for a product that they don't use and just let it go on for 6 months while the malware transmits every Credit card number used at HD during this period to Russia.

Amazing.

 

[Cats-4_Owners-2]

Maybe they thought McAffey had given Home Depot a free 6 month trial for Enterprise. Lucky for those ' IT "Pros" ' cruelsister wasn't their boss, or they would have been cruel- fired!!

 

[cruelsister]

I tried to give your post a dozen "Likes" but it won't let me...

 

[NullPointerException]

An insult for computer scientists....

 

[cruelsister]

I know it seems like I'm obsessing over this (mainly because I am), but this thing is such a disappointment.Even sadder is the fact that the Exec's a Home Depot are sitting on the magnitude of the problem. With the breach at Target last December the malware had only about 19 days to collect data (the IT folks there got alerts, but considered them to be False Positives). With Home Depot the malware was active for 6 months.

And something else that's not exactly public (and may never be)- in the Target breach, the malware not only jacked current credit card purchases, but also looted the database of past purchases that Target kept- and the fools kept customer info on file for 10 YEARS.

 

[cruelsister]

Finally an insider at Home Depot has come forward confirming exactly what security package they used (the identity of which I've danced around for the past few days). Yes indeed Symantec Endpoint was used. Note that in the story linked to above they blame the breach on HD using SEP 11 instead of SEP 12.1; what they don't mention is that the massive Target breach last December occurred on systems also protected by SEP, but in that case the product was current (12.1) and fully updated.