更新：01/13 -Target首席执行官兼总裁Gregg Steinhaffel在接受CNBC采访时证实，该商店的POS（销售点）终端被恶意软件感染了，此后已被删除。“我们所知道的是我们的销售点登记册上安装了恶意软件。我们已经建立了很多。”他在采访中说。“我们删除了该恶意软件，以便我们可以提供安全的购物环境。”
阅读以下有关目标购物者目前的全部信件。
Image: Joe Raedle/Getty Images
Update:12/30 –Target has verified thatPIN numbers were stolen during the breach。However, Target representatives have stated this information—along with customer names and card numbers—was all encrypted within their systems.
Nevertheless, we would recommend both card and PIN numbers be changed if you were a victim during the attack.
本事：
By now you may have heard reports about a security breach affecting some 40 million customer debit/credit cards used at the Minneapolis-based retail store Target.
Initial reports of the breach had stated it started sometime around Black Friday. Security expert Brian Krebs was one of the first to report on the incident, and the story was featured on今天美好的美国今天。
“From the bad guy’s perspective, that is the perfect day to launch an attack,” Krebs said of the Black Friday attack. “The more traffic you have, the more deals you have. [You have] more people swiping their cards.”
Krebs also mentioned how cyber-criminals may be able to reproduce cards belonging to victims of the breach, provided they criminals had access to PIN data along with the stolen numbers contained on the magnetic stripe.
Target, the second-largest retailer in the U.S., was quick to respond andpublished a blog this morningthat confirms the attacks had occurred between November 27 and December 15.
“ Target今天证实，它已经意识到未经授权访问付款卡数据，这些数据可能影响了某些客人在其美国商店中购买信用卡和借记卡。Target正在与执法和金融机构紧密合作，并确定并解决了这一问题。”
Considering this, it’s only natural to wonder how this could have happened, and continued for nearly three weeks. Unfortunately, there haven’t been many details released surrounding the breach.
大规模的数据泄露继续增加。2007年，拥有T.J.的TJXMaxx和Marshalls遭受了违规行为，损害了超过4500万张卡号，据报道该公司损失了2.56亿美元。
But today’s breaches can be even more threatening, and even streamlined with the adaption of PoS (Point of Sale) malware like ‘Dexter’.
德克斯特是第一个大约一年前由以色列安全研究人员在Seculert发现。恶意软件通过扫描POS系统中的扫描过程和内存转储中查找TRACK1或TRACK2信用卡信息（Tracks包含卡片中的数据）来工作。
Dexter campaigns are still on the move, and the malware has since undergone several version revisions.
据报道InterCrawler。
Arbor Networks的人们在跟踪恶意软件的发展及其广告系列方面做得很好，并总结了许多有关它的好信息这里。
Another type of PoS malware is known as “vSkimmer” and was discovered by McAfee earlier this year. The vSkimmer malware works by creating a processes “whitelist”, and then scanning those processes not on the whitelist, looking to match the正则表达式“？[3-9] {1} [0-9] {12,19} [d = \\ u0061] [0-9] {10,30} \\ ??”在设备上提取任何信用卡信息。
Along with PoS malware, there are also reports of PoS hacking have also emerged. Back in 2012,两个罗马尼亚黑客对超过1000万美元的盗窃罪表示认罪from Subway restaurants. The two hackers would crack passwords on PoS terminals and then install keyloggers and sniffers to collect payment card data.
It’s easy to speculate that something similar might have happened with Target, although the details of the breach are currently not available.
调查正在进行中，希望在随后的日子中提供更多信息。Target还确认他们已经与第三方法医公司联系，这可能会提供更多细节。
In light of these events, however, consumers are likely wondering how to keep themselves out of a cyber-criminal’s hands. While this list is far from being exhaustive, there are some easy steps our readers can take to help maintain their own financial security.
- Don’t use your card at a business you don’t trust
- Change your card numbers at least once per year, even if it’s not expired
- When making online purchases, avoid storing your card information, and ensure your submitted transactions are over a secure connection.
- If a data breach has occurred somewhere you’ve recently shopped, change your number right away, and monitor your credit report and bank accounts frequently until the dust settles.
随着我们了解更多信息，我们将在此处为您提供最新信息。
_________________________________________________________________
约书亚·坎内尔（Joshua Cannell）is a Malware Intelligence Analyst at Malwarebytes where he performs research and in-depth analysis on current malware threats. Follow him on Twitter@joshcannell
注释