As Americans gear up for another holiday shopping season, the threat posed by point-of-sale malware remains high. More than a year after the discovery of the first major attacks against POS networks, many US retailers are still vulnerable to this type of attack and are likely to remain so until the complete transition to more secure payment card technologies in 2015.
While some retailers have enhanced security by implementing encryption on their POS terminals, others have not and retailers will continue to be a low-hanging fruit for some time. While the introduction of new technologies will help stem the flow of attacks, it will not eliminate fraud completely and attackers have a track record of adapting their methods.
Point-of-sale malware is now one of the biggest sources of stolen payment cards for cybercriminals. Although it hit the headlines over the past year, the POS malware threat has been slowly germinating since 2005 and the retail industry missed several warning signals in the intervening period. This allowed attackers to hone their methods and paved the way for the mega-breaches of 2013 and 2014, which compromised approximately 100 million payment cards and potentially affected up to one-in-three people in the US.
Attacks have reached epidemic proportions in part because POS malware kits are now widely available, which means attackers can target retailers without having to develop their tools from scratch. For example, BlackPOS (detected by Symantec as Infostealer.Reedum), which was used in the some of the most high profile attacks, has been for sale since February 2013 with a price tag of US$2,000. This is a relatively small investment for attackers, who are likely to net millions from a successful operation.
Figure 1. Point-of-sale attacks exploded once malware kits became widely available on the cyberunderground
Hopelessly exposed
Attacks on point-of-sale terminals had their genesis as far back as 2005, when attackers began using networking-sniffing malware to intercept payment card data while in transit. A group of attackers led by Albert Gonzalez were the main perpetrators, stealing more than 90 million card records from retailers.
As payments processors and retailers tightened up their security, the attackers adapted and attention turned to the point-of-sale terminal. When a card is swiped, its details are briefly stored in the terminal’s memory while being transmitted to the payment processor. This provides a brief window for malware on the terminal to copy the card data, which it then transmits back to the attackers. The technique is known as “memory scraping”.
POS malware was first discovered October 2008, when Visa issued an alert on a new type of exploit. During a fraud investigation, it found that attackers had been installing debugging software on POS systems that was capable of extracting full magnetic stripe data from its memory. Little heed appears to have been taken of this warning, giving malware developers time to perfect their methods. In the intervening period, developers have worked to streamline the malware, integrating all functionality into a single piece of software.
This development process eventually led to fully featured POS malware kits emerging on underground markets from 2012 onwards. US retailers were hopelessly exposed and what followed was a flood of high profile breaches, with several major US retailers hit by POS malware attacks.
Spotlight: BlackPOS
One of the most widely used forms of POS malware is BlackPOS which is also known as KAPTOXA, Memory Monitor, Dump Memory Grabber, and Reedum. Variants of BlackPOS have been used to mount some of the biggest retail POS breaches.
Its development mirrors the evolution of the broader POS malware market. The earliest versions of BlackPOS date from 2010. Over time, it has evolved into a highly capable cybercrime tool which employs encryption to cover its tracks and can be customized to suit the target environment.
By February 2013, BlackPOS was ready for the mass market and the group behind one of its variants began selling it on underground forums, charging customers $2,000 for the package.
Thriving marketplace
While the malware used to mount POS attacks is usually sold on underground forums, these forums are also often where the bounty of those attacks returns to be sold. For example, stolen credit card details from some of the biggest US breaches were sold on a forum known as Rescator.
New research from Symantec found that prices can vary heavily depending on a number of factors, such as the type of card and its level, i.e. gold, platinum or business. Card data originating from the US tends to be cheaper because of the widespread availability stolen US cards. Card details along with extra information, known as “Fullz”, tend to attract higher prices because details such as someone’s date of birth or credit card security password make it easier to perform fraudulent transactions or other activities.
Single credit cards from the US tend to cost $1.50 to $5, with discounts often available for those who buy in bulk. Single cards from the EU tend to cost more, selling for $5 to $8. Fullz start at $5 and can range up to $20. A single embossed plastic card with custom number and name meanwhile will sell for approximately $70. The stolen cards uploaded to Rescator were initially selling at a cost of $45 to $130 per card before prices later settled down.
Will new technologies render POS malware obsolete?
New payment card technologies, many of which are already in use in Europe, have been promoted as effective countermeasures for POS malware but are not a silver bullet. Their arrival is likely to herald the end of the large-scale POS breaches seen in recent years, but they will not eradicate theft of credit card data completely.
The adoption of EMV, chip-and-pin cards to replace traditional magnetic stripe cards ought to render the current generation of memory-scraping POS malware ineffective. However, chip-and-pin cards are still susceptible to skimming attacks and stolen credit card numbers can still be used in “card-not-present” transactions, such as online purchases.
Additionally, stolen credit card information in Europe is often used in the US since it doesn’t have chip and pin as a verification method. Going by this precedent, the advent of chip and pin in the US may mean attackers will continue to attempt to steal card information but use it in other countries that don’t use the chip-and-pin standard.
The chip-and-pin standard itself may be superseded at some point by the adoption of NFC mobile payment solutions such as Apple Pay, Google Wallet or CurrentC. With these payment technologies, the credit card number isn’t transmitted during the transaction. NFC is still susceptible to exploitation by attackers, but most attacks require physical proximity, making large-scale thefts almost impossible.
Advice for consumers
Some retailers are rolling out encryption on their point-of-sale networks to prevent memory scanning, which is encouraging. However, attackers have a tendency to adapt and evolve, and will no doubt look to circumvent these additional countermeasures.
There are several steps you can take to remain vigilant against this type of fraud:
- Monitor your bank account and credit card statements for any strange or unfamiliar transactions. Notify your bank immediately if you notice anything suspicious. Small transactions, such as a $1 charitable donation, are often used by criminals to test if a card is still usable.
- Carefully guard personal information such as your address, your Social Security number, or date of birth, and don’t use easily guessed passwords or PIN codes. All of these details can be used to facilitate identity theft and defeat additional security checks.
Advice for businesses
Symantec has a number of solutions for retailers who wish to guard their point-of-sale systems from attack. For more details, please read: Secure Your Point-of-Sale System
Symantec protection
Symantec products detect all of the currently known variants of point-of-sale malware, including:
BlackPOS
FrameworkPOS
Dexter
Chewbacca
JackPOS
RawPOS
Vskimmer
Backoff
Further information
For more information about attacks against POS systems, please read our whitepaper entitled: Attacks on point of sales systems