Hacked casino operator alleges breach continued while Trustwave was investigating.
A Las Vegas-based casino operator has sued security firm Trustwave for conducting an allegedly “woefully inadequate” forensics investigation that missed key details of a network breach and allowed credit card thieves to maintain their foothold during the course of the two-and-a-half-month investigation.
In a legal complaint filed in federal court in Las Vegas, Affinity Gaming said it hired Trustwave in October 2013 to investigate and contain a network breach that allowed attackers to obtain customers’ credit card data. In mid January 2014, Trustwave submitted a report required under payment card industry security rules on all merchants who accept major credit cards. In the PCI forensics report, Trustwave said it had identified the source of the data breach and had contained the malware responsible for it. More than a year later after Affinity was hit by a second credit card breach, the casino operator allegedly learned from Trustwave competitor Mandiant that the malware had never been fully removed.
According to the December, 2015 complaint: Mandiant’s forthright and thorough investigation concluded that Trustwave’s representations were untrue, and Trustwave’s prior work was woefully inadequate. In reality, Trustwave lied when it claimed that its so-called investigation would diagnose and help remedy the data breach, when it represented that the data breach was “contained,” and when it claimed that the recommendations it was offering would address the data breach. Trustwave knew (or recklessly disregarded) that it was going to, and did, examine only a small subset of Affinity Gaming’s data systems, and had failed to identify the means by which the attacker had breached Affinity Gaming’s data security. Thus, Trustwave could not in good faith have made the foregoing representations to Affinity Gaming.
Trustwave officials have denied any wrongdoing. “We dispute and disagree with the allegations in the lawsuit and we will defend ourselves vigorously in court,” an official told The Financial Times, which reported the lawsuit earlier Friday.
Trustwave had said the last breach activity occurred in October 2013. Mandiant’s later PCI forensics report, by contrast, said it happened again in December of that year while Trustwave was investigating. The report also noted that the breach “occurred on a continuous basis both before and after Trustwave claimed that the data breach had been ‘contained.'” Trustwave allegedly failed to detect several pieces of malware infecting network servers or that the breach was ultimately the result of people who were able to access Affinity’s virtual private network and install backdoor software.
“Mandiant’s report also concluded that the various recommendations Trustwave had presented to improve Affinity Gaming’s data security were pointless,” the complaint alleged. “None addressed the source of the data breach, and none would have prevented the attacker from again accessing Affinity Gaming’s data systems (for instance, through the backdoors that Trustwave failed to find and close).”
The complaint provides a rare glimpse inside the confidential world of security incident response and underscores the consequences when investigations don’t have the results customers expect. As a result of the follow-on breaches, Affinity was required to obtain the second PCI forensics report from Mandiant and to pay additional assessments so banks could reissue credit cards.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
