[ISN] TJX employee fired for exposing shoddy security practices

From: InfoSec News (alerts@private)
Date: Mon May 26 2008 - 23:10:08 PDT


By Dan Goodin in San Francisco 
The Register
23rd May 2008

TJX Companies, the mammoth US retailer whose substandard security led to 
the world's biggest credit card heist, has fired an employee after he 
left posts in an online forum that made disturbing claims about security 
practices at the store where he worked.

Security was so lax at the TJ Maxx outlet located in Lawrence, Kansas, 
that employees were able to log onto company servers using blank 
passwords, the fired employee, Nick Benson, told The Register. This 
policy was in effect as recently as May 8, more than 18 months after 
company officials learned a massive network breach had leaked the 
details of more than 94 million customer credit cards. Benson said he 
was fired on Wednesday after managers said he disclosed confidential 
company information online.

Other security issues included a store server that was running in 
administrator mode, making it far more susceptible to attackers. He said 
he brought the security issues to the attention of a district loss 
prevention manager name Allen in late 2006, and repeatedly discussed 
them with store managers. Except for a stretch when IT managers 
temporarily tightened password policies, the problems went unfixed.

"I was basically hitting a glass wall," said Benson, a 23-year-old 
freshman at the University of Kansas who worked at TJ Maxx beginning in 
October 2005. "Not one single thing was done. My store manager even 
posted the password and username on a post-it note. I told her not to do 

So last August, Benson took to Sla.ckers.org, a website dedicated to web 
application security, and began anonymously reporting the shoddy 
practices in this user forum. Over the next nine months, he left eight 
posts in which he chafed at the password policy and what he should do 
about it.

"I am not sure if this is just an isolated incident within this specific 
store, but it goes to show that you can't trust a company to protect 
your information, especially TJX," Benson wrote under the moniker 
CrYpTiC_MauleR. "Today was a very sad day for me =o("

A TJX spokeswoman declined to comment for this story and turned down our 
request to discuss the company's policies for passwords and other 
security matters.

Benson's May 8 posting was prompted by news that managers had changed 
the password for employees to access the store server. Inexplicably, it 
was set to blank. When Benson first began working for TJX, his password 
was the same as his user name, he said. Then came word in January 2007 
that unknown hackers had brazenly intruded on the company's network over 
a 17-month period. For a time following the disclosure, TJX employees 
were required to use relatively strong passwords. The change to a blank 
password clearly represented a step backward, Benson thought.

The posts eventually caught up to Benson. On Wednesday, while marking 
down items on the TJ Maxx retail floor, he was summoned to the store 
office. Inside, a regional loss prevention manager told him his 
critiques had come to the attention of the company hired to monitor 
internet postings about the retailing giant. The manager told Benson he 
was being fired for disclosing confidential company information.

No one at Sla.ckers.org was willing to defend TJX or the shoddy security 
practices it is accused of following, but some have questioned Benson's 
decision to speak so openly.

"I would assume your disclosure of your company's inner server workings 
on the internet means that they can't trust employees to protect their 
information?" one forum participant wrote in a response to Benson's 

But critiques like that seem to overreach. Benson's disclosures weren't 
specific enough to give attackers information needed to successfully 
breach TJX's networks. And when you consider the right of TJX's 
customers and employees to know that their data may be at risk, it's not 
unreasonable to call him a whistleblower.

The account has us wondering if other TJX employees have tales similar 
to Benson's. If so, please contact your reporter using this link. 
(Anonymity assured.)

For Benson's part, he has no regrets. "They're telling the public 
they're PCI compliant," he said, referring to so-called payment card 
industry security rules governing businesses that accept credit and 
debit cards. "That I think is unethical."

But he says his actions were also fueled by a healthy dose of 

"My information is still on that server," he continued, referring to the 
machine that sits in an office at the TJ Maxx where he once worked. "So 
if their network is insecure, then my information is insecure. I'd 
prefer they get it fixed." ®

Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com

This archive was generated by hypermail 2.1.3 : Mon May 26 2008 - 23:27:40 PDT