The Shifting Landscape of PoS MalwareOutput

Silas Cutler: Sr. Security Researcher

The Shifting Landscape of PoS Malware

INTRO

2015 CrowdStrike, Inc. All rights reserved.

Current

•CrowdStrike - Sr. Security Researcher•Malshare•Project 25499•RIT Honeynet Project

Contact

•Twitter : @SilasCutler / @CrowdStrike•Email : [email protected] / [email protected]

AGENDA

1. Technical Overview

2. Rise of the Commodity Brands

3. Targeted Breaches

4. Looking Forward

5. Questions


The Shifting Landscape of PoS Malware

Introduction PoS Malware


• Malware designed to steal credit card data from Point-of-Sale (PoS) terminals

• PoS Terminals • Out-of-date software• Limited technical support• Appliance mentality

• Plug it in and replace it when it breaks

2014 Breaches - Short List


Sally Beauty MichaelsGoodwillDairy QueenUPSSuperValuHome DepotStaples

Neiman MarcusBebeKmartAlbertsonsJimmy JohnsP.F. ChangesShaw’s and Star Market…

Introduction PoS Malware


• Cards sold in online marketplaces. • Often sold in bulk• Payment : Perfect Money / Bitcoin

Webmoney / etc• Cards:

• US Credit/Debit: $20/each• UK Credit/Debit: $35/each

• Bank Logins (BoA): • Balance > $3k = $100• Balance > $11k = $300

• Cash out schemes / Mules / Sellers and buyers


Technical OverviewThe Shifting Landscape of PoS Malware


MAGNETIC STRIPS

%B6011898748579348^DOE/ JOHN^37829821000123000789?

;6011898748579348=1412101110000000000?*

;011234567890123445=724724100000000000030300XXXX040400099010=******==1=0000000000000000?*

ISO / IEC 4909:2006 • Defines standard format for track

data on Credit Cards


TRACK DATA

Track 1: %B6011898748579348^DOE/ JOHN^14121011000000000000001230000?*Track 2: ;6011898748579348=1412101110000000000?*

Index:• % – Start Sentinel• B – Format Code• 6011898748579348 – Card Number• ^ – Field Separator • DOE/ JOHN – Cardholder name• 1412 – Expiration Date (2014 – Dec)• 1100 – Encrypted Pin• 123 – CVV Number• ? – End Sentinel

MEMORY SCRAPING


1. Enumerates Processes– CreateToolhelp32Snapshot() /

Process32Next()

2. Open and Read process memory– OpenProcess() / VirtualQueryEx() /

ReadProcessMemory()

3. Search for Track Data4. Validation

– Luhn Algorithm / Mod 10– Expiration Date Check


Rise of the CommodityThe Shifting Landscape of PoS Malware

Commodity PoS Malware


• Highlights• Off-the-shelf kits• Communicate via HTTP request• Price < $1k

• Source code for several publicly available

• Names:• Alina• Dexter• vSkimmer• Backoff• JackPoS• POSCardStealer


ARCHITECTURE

Control Server

Infected hosts

•Traditional Client / Server architecture– Infected hosts beacon and send data

to control server – Replies from server contain status /

command instructions•Communicates over HTTP requests•Operator views bots via web portal

– Can send some basic commands

Spreading


• Brute-forcing Remote Management• User/Password Lists tailored for PoS systems

• PcAnyWhere• VNC• Remote Desktop• LogMeIn

• Phishing• Vendor Targeting *• Exploitation of Opportunity


Targeted BreachesThe Shifting Landscape of PoS Malware

What makes it targeted


• [ Quality of Malware ] != Targeted

• Tailored options( Implants designed to work in one infrastructure)

• Only targets specific PoS terminal types• Logs to Internal IP addresses• Forensic countermeasures

• Limited client-side controls*

2014 Players


• FrameWork PoS• Called BlackPoS 2.0 by Trend Micro• Limited Distribution• Exfiltration done using SMB shared drives

• Hard coded credentials • Contains links to Anti-US websites

• Mozart PoS• Limited Distribution• Specifically designed to work against Java based PoS solutions • Designed to look like a PoS remote monitor service from NCR• Contains links to Anti-US websites

Case Study: Target


• Initial statement released 19 December 2013

• 40 Million Credit Cards stolen• PII for up to 70 Million individuals• Statement stated “criminals forced

their way into our system, gaining access to guest credit and debit card information”

• Largest hack of a US retailer’s PoS infrastructure

Case Study: Target


• PoS infrastructure was directly targeted• Malware used was Kaptoxa (mmon) • Part of BlackPoS malware

• Traces back to 2010

• Data pushed stolen data to an internal drop-site• Used credentials to authenticate to internal SMB file store• leveraged stolen HVAC credentials

• Internal Drop-sites exfiltrated data to external FTP server

• Adversary may have known sensitive details about Target’s infrastructure


Looking ForwardThe Shifting Landscape of PoS Malware

Looking Forward


• October 2015 Liability Shift• “ The party that has made investment in EMV deployment is protected from

financial liability for card-present counterfeit fraud losses on this date. If neither or both parties are EMV compliant, the fraud liability remains the same as it is today.” [1]

• Tokenization of Payment Methods• iPay• Google Wallet

[1]http://www.emv-connection.com/emv-migration-driven-by-payment-brand-milestones/


QUESTIONSThe Shifting Landscape of PoS Malware

YOU DON’T HAVE A MALWARE PROBLEM,YOU HAVE AN ADVERSARY PROBLEM


The Shifting Landscape of PoS MalwareOutput

Internet

Transcript of The Shifting Landscape of PoS MalwareOutput