security considerations aside, this is also more expensive and harder to implement than a private net. so someone actually sat down, and made this decision deliberately.
pretty fucking amazing, if you ask me.
Historical reasons? target does has a /16.
They can probably fill that block many times over now, but it would make sense that their numbering scheme has historical roots and to continue using that space for interstore communication today. They got it in 1993, back when we were still pretending like exhausting the v4 space wasn't a thing and before everyone started acting like the fact a many-to-one NAT requires what is effectively a statefull firewall somehow offered a security advantage you couldn't get by just writing those firewall rules.
I was at an organization with a large v4 block once. It took a few years of having my desktop, laptop, and cellphone wifi connections all with routable v4 addresses before I stopped thinking it was weird, bad design and really came to appreciate: "oh shit, this is how the internet is supposed to be and it is so much nicer to work with."
(I worked at the company with /8 IP block and always thought that this is how the founding fathers intended it to be).
Since the POS terminals were all running a variant of Windows, it might have been as simple as querying the Active Directory to find out where everything was located within the Target network (at least for the Windows machines). Comments in the Krebs article also speculated that they exploited an account with a BMC systems management tool used at Target as well.
Best practice would have the POS systems on a separate air gaped network to the main Target intranet as well.
Practical business requirements on inventory management, sales metrics, system administration and (funnily enough) payment processing all prevent a register network from being airgapped. If you want to say their protection of those communication channels was shit, well, we already have proof it was. But airgapping? Not so much.
PCI rules just state the cardholder data environment (CDE) needs to be segmented from the rest of the corporate network (in addition to many other obligations). That would usually be done with VLANs and firewalls, but both are still on the same layer 2 network.
A typical small-shop retail arrangement is to have the POS terminals behind a NAT router which is behind another NAT router that also serves up the customer-convenience WiFi AP.
When a terminal wants to put through a charge, it simply makes an HTTPS request to the payment processor. One or two seconds later, the request comes back, declined or accepted and here's the approval code. At that point, the POS sanitizes away the credit card details and applies the credit tender. Enjoy your latte, ma'am!
To hack such a system, you need to get onto the POS LAN. E.g., maybe there's a store server on the with an SSH login, which you've uncovered after breaking into the corporate above-store network. Or maybe a disgruntled employee installs malware from a USB stick.
Then you exfiltrate the captured swipes, hopefully without leaving enough tracks to get caught. E.g., the malware periodically uploads the intercepts to some FTP site to which you can get access. Or, in the case of the disgruntled employee, it could simply involve dragging the files to the USB stick.
Between the store and the payment processor, we should be safe, given we're using HTTPS. However, payment processors have themselves been hacked. E.g., Heartland†.
†http://voices.washingtonpost.com/securityfix/2009/01/payment...