Why Encryption Didnt Save TJX

TJX: Its the target of the largest known customer record theft of all time, and its a case in point that encryption is not a silver bullet.

This is the heart of the encryption problem, quoted from the 10-K filing The TJX Companies made to the Securities and Exchange Commission:

"Despite our masking and encryption practices on our Framingham system in 2006, the technology utilized in the Computer Intrusion during 2006 could have enabled the Intruder to steal payment card data from our Framingham system during the payment card issuers approval process, in which data (including the track 2 data) is transmitted to payment card issuers without encryption. Further, we believe that the Intruder had access to the decryption tool for the encryption software utilized by TJX."

Encryption has no value when data isnt encrypted, obviously, but credit cards cant be processed when their numbers are encrypted. Hence, a smart crook will seek a way to get the data during that window of time when its in that state of being "in the clear"—that is, unencrypted.

Resource Library:

TJXs intruder also had a backup plan if data in the clear wasnt attainable: namely, the decryption key.

There are several reasons why encryption didnt save TJX and wont save many companies, regardless of how much legislators have mandated or want to mandate its use. (One example of which is the June 2006 White House mandate requiring federal agencies to encrypt the hard drives of all their laptops and mobile devices.)

In an interview with eWEEK, McAfee Chief Security Officer Dr. Martin Carmichael said that after he had read TJXs take on the intrusion, he was curious if TJX was using data masking as articles indicated, or some sort of data encryption. Dr. Carmichael indicated there were different methods of encryption key methods: shared key, in which the sender and receiver of encrypted data both have the same key, or asymmetric, which uses a public/private key pair.

Data stolen from TJX was used in an $8 million scheme before the breach was discovered. Click here to read more.

Shared-key encryption is inherently risky, since humans think up convenient but absurdly insecure places to store their keys. "We have seen … some companies that chose to use shared-key [encryption] that stores the key with the data," Carmichael said. "Which is outside of most policy. Sometimes ease of development can be [counter to] good security process." In fact, Carmichael has seen keys in data files that are named "key to data."

Another encryption trap is the use of weak encryption. Original DES (Data Encryption Standard) encryption is now considered to be insecure for many applications, chiefly due to its 56-bit key size being too small. DES keys have been broken in less than 24 hours. Some analytical results point to theoretical weaknesses in the cipher, as well, although those have not been proven in practice. In May 2002, DES was superseded by AES (Advanced Encryption Standard) following a public competition, but DES remained in widespread use as late as 2004; Carmichael said it was "very common in a lot of applications."

Did TJX use DES? TJX has determined that its data was first accessed by an unauthorized intruder in July 2005, and DES was widely used in 2004, so its imaginable that the company did.

Asymmetric cryptography gives part of a key to the data sender and part of the key to the data receiver. The receiver of data—for example, a bank thats receiving your bank account number or user name and PIN—can publish whats called the public part of the key to the whole world. The only thing that encrypts data, however, is the private part of the key. You as a bank customer can contact your bank using one part of the key, and the bank can match that up with its part of the key, thus having an encrypted session with two different keys.

This type of public/private key cryptography is used because key distribution is a major problem, Carmichael said. Shared keys have to be stored somewhere. They can be unsecure, no matter where theyre kept.

Those who use public/private key cryptography have the private key have more options with asymmetric cryptography and a certificate server thats hard-ened and secured, Carmichael said. The certificate server offers options for key escrow and certificate revocation list offering greater control over keys and their use.

Did the TJX intruder stumble on a key stored with the encrypted data, a la shared-key cryptography, or did the intruder have access to a certificate server? The question is moot, given that the intruder figured out a way to take the data before it was encrypted, but the details of nabbing an encryption key will be instructive if we discover them as TJXs investigation continues.

And so that leaves us with asymmetric, aka public/private, key cryptogra-phy. Is it safe to consider that form of encryption a silver bullet? Encryption is not a silver bullet and weaknesses in key management represent a bullet that can backfire.

Next Page: The downside of encryption.