In essence, "look, we're really really sorry."

In light of the recent, massive breach that saw the store lose data for 40 million customer credit cards, Target CEO Gregg Steinhafel took to the Web yesterday to offer updates, apologies, and special discounts.

Steinhafel said "the issue has been identified and eliminated" and that shoppers’ PINs, birth dates, and Social Security numbers were not stolen. Still, he empathized with customers for the stress and confusion caused by this situation. He said Target will be in touch with all impacted customers, but that the store has heard “very few reports of actual fraud.” Even so, Steinhafel made a point to note any customers who were affected “will not be held financially responsible for any credit card or debit card fraud.”

As for the difficulty some customers have experienced when trying to contact Target through both the Web and its call center, the CEO chalked up wait times and unresponsive pages to “unprecedented call volume.” Steinhafel said Target is “working continuously to build capacity” for these resources.

Read 1 remaining paragraphs | Comments



We have received a pcap sample of DNS queries that display a strange behavior. The queries are type ANY for domains ghmn.ru and fkfkfkfa.com. When doing a nslookup, both domains have 100 IPs listed under their domain names with each of them resolving exactly the same last octets (i.e. .1, .10, .100, etc). Queries with the same transaction ID are often repeated several times. The traffic samples we have received indicate the queries are sent by either a host or a server.

If anyone else is seeing queries for either of these domains or queries with a similar behavior and can share some pcap or logs, you can submit them via our contact page.

Wireshark example of a query:

Update 1:

Domain fkfkfkfa.com

We have received logs that indicate this behavior has been ongoing as early as 23 Sep 2013.

Domain ghmn.ru

We have received logs that indicate this behavior has been ongoing as early as 15 Dec 2013.

[1] https://www.robtex.com/dns/ghmn.ru.html#shared
[2] https://www.robtex.com/dns/fkfkfkfa.com.html#shared


Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
More than a dozen smart glass products are expected to ship in the first half of next year, ranging in price from $79 to $3,000. So raise your glass to the coming wave of face-top computing gadgets.
Internet Storm Center Infocon Status