Home Depot transaction security reportedly ramshackle since 2008

Following the revelation that 56 million credit card transactions were stolen by miscreants, more information is coming out about the hack and the company's reportedly long-term lackadaisical security. According to employees familiar with the situation, the company was warned as early as 2008 that security would be a problem, and that the company was excruciatingly slow to respond to threats and often took no action agains perceived attacks or dangers.

An array of current and former Home Depot employees speaking to the New York Times on the condition of anonymity said that the company relied on outdated software for years to cut costs, and handled customer data poorly. One security source told the paper that he warned his friends to use cash, instead of credit cards, at the company's stores.

Two former employees also said that mandatory security scans of computers, as required by the credit card industry were either not performed, or performed haphazardly. According to the sources, "more than a dozen" vital computers that stored customer information, including transaction data, were not accessed, never scanned, and were off-limits to the security staff responsible for oversight.

Additionally, Home Depot hired Ricky Joe Mitchell to oversee Internet security in 2012. In 2014, Mitchell was sentenced to four years in prison for his role in a scheme at energy firm EnerVest Operating where he intentionally disabled computers while he was departing, shutting down data processing for a month. It is unknown if Mitchell had any role in the distribution of the malware, but much of the pre-collection malware penetration happened during his tenure.

The company has said that the malware was a custom-built package that evaded traditional detection. Those helping Home Depot research the attack say that it was a previously unknown strain of malware that had yet to be seen perform such an attack. Analyst Brian Krebs and Trend Micro had similar conclusions after the breach was confirmed.

Home Depot says that malware is eliminated, with the company going as far as removing any terminals that were identified as being affected by the penetration. The company continues to maintain that there is no evidence PIN numbers were compromised during the breach. Bank sources tell Brian Krebs that compromised cards were still being reported on September 7, five days after Home Depot stated it was looking into activity.

By Electronista Staff

Excerpt from:
Home Depot transaction security reportedly ramshackle since 2008