[Dataloss] TJX is at it again...

[TS Glassey]

By Dan
<http://forms.theregister.co.uk/mail_author/?story_url=/2008/05/23/tjx_fires
_whistleblower/> Goodin in San Francisco
Published Friday 23rd May 2008 22:54 GMT

TJX Companies, the mammoth US retailer whose substandard security led to the
world's biggest credit card heist, has fired an employee after he left posts
in an online forum that made disturbing claims about security practices at
the store where he worked.

Security was so lax at the TJ Maxx outlet located
<http://www.tjx.com/contact/storemap.aspx?sid=08-624> in Lawrence, Kansas
(http://www.tjx.com/contact/storemap.aspx?sid=08-624), that employees were
able to log onto company servers using blank passwords, the fired employee,
Nick Benson, told The Register. This policy was in effect as recently as May
8, more than 18 months after company officials learned a massive network
breach had leaked the details of more than 94 million customer credit cards.
Benson said he was fired on Wednesday after managers said he disclosed
confidential company information online

Other security issues included a store server that was running in
administrator mode, making it far more susceptible to attackers. He said he
brought the security issues to the attention of a district loss prevention
manager name Allen in late 2006, and repeatedly discussed them with store
managers. Except for a stretch when IT managers temporarily tightened
password policies, the problems went unfixed.

"I was basically hitting a glass wall," said Benson, a 23-year-old freshman
at the University of Kansas who worked at TJ Maxx beginning in October 2005.
"Not one single thing was done. My store manager even posted the password
and username on a post-it note. I told her not to do that."

So last August, Benson took to Sla.ckers.org, a website dedicated to web
application security, and began anonymously reporting the shoddy practices
in this  <http://sla.ckers.org/forum/read.php?13,15148,page=1> user forum
(http://sla.ckers.org/forum/read.php?13,15148,page=1). Over the next nine
months, he left eight posts in which he chafed at the password policy and
what he should do about it.

"I am not sure if this is just an isolated incident within this specific
store, but it goes to show that you can't trust a company to protect your
information, especially TJX," Benson wrote under the moniker CrYpTiC_MauleR.
"Today was a very sad day for me =o("

A TJX spokeswoman declined to comment for this story and turned down our
request to discuss the company's policies for passwords and other security
matters.

Benson's May 8 posting was prompted by news that managers had changed the
password for employees to access the store server. Inexplicably, it was set
to blank. When Benson first began working for TJX, his password was the same
as his user name, he said. Then came word in January 2007 that unknown
hackers had brazenly intruded on the company's network over a 17-month
period. For a time following the disclosure, TJX employees were required to
use relatively strong passwords. The change to a blank password clearly
represented a step backward, Benson thought.

The posts eventually caught up to Benson. On Wednesday, while marking down
items on the TJ Maxx retail floor, he was summoned to the store office.
Inside, a regional loss prevention manager told him his critiques had come
to the attention of the company hired to monitor internet postings about the
retailing giant. The manager told Benson he was being fired for disclosing
confidential company information.

No one at Slackers.org was willing to defend TJX or the shoddy security
practices it is accused of following, but some have questioned Benson's
decision to speak so openly.

"I would assume your disclosure of your company's inner server workings on
the internet means that they can't trust employees to protect their
information?" one forum participant wrote in a response to Benson's posts.

But critiques like that seem to overreach. Benson's disclosures weren't
specific enough to give attackers information needed to successfully breach
TJX's networks. And when you consider the right of TJX's customers and
employees to know that their data may be at risk, it's not unreasonable to
call him a whistleblower.

The account has us wondering if other TJX employees have tales similar to
Benson's. If so, please contact your reporter using this
<http://forms.theregister.co.uk/mail_author/?story_url=/2008/05/23/tjx_fires
_whistleblower/> link
(http://forms.theregister.co.uk/mail_author/?story_url=/2008/05/23/tjx_fires
_whistleblower/). (Anonymity assured.)

For Benson's part, he has no regrets. "They're telling the public they're
PCI compliant," he said, referring to so-called payment card industry
security rules governing businesses that accept credit and debit cards.
"That I think is unethical."

But he says his actions were also fueled by a healthy dose of self-interest.

"My information is still on that server," he continued, referring to the
machine that sits in an office at the TJ Maxx where he once worked. "So if
their network is insecure, then my information is insecure. I'd prefer they
get it fixed."