Attacks/Breaches
11/24/2015
12:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Stealthy ModPOS Is 'Most Sophisticated PoS Malware' Ever

More than just a point-of-sale card scraper, it's modular malware, and every module is a rootkit.

Just in time for the holidays, researchers at iSIGHT Partners are warning retailers about ModPOS -- malware in their point-of-sale systems that is nearly impossible to detect, can do a whole lot more than just scrape customers' credit card data, and has already successfully breached U.S. retailers.

"This is by far the most sophisticated PoS malware I've ever seen," says Maria Noboa, senior threat analyst at iSight.

BlackPOS was behind the monster breach at Target, BackOff hit UPS and over a thousand others, and now new PoS malware like CherryPicker and AbaddonPOS have hit the scene. Yet, none of them have the same level of complexity and committment to stealth that ModPOS does.

"It took us two to three weeks just to determine it was malicious," says Noboa. It then took researchers several more weeks to pick ModPOS apart and figure out how it works. In comparison, it only took them about 20 minutes to reverse engineer CherryPicker, says Noboa.

[PoS malware proves that Cyber Monday isn't the only thing retailers and shoppers have to worry about over the holidays. Read "Black Friday Security: Brick-and-Mortar Retailers Have Cyber Threats Too."]

ModPOS is modular. In addition to the PoS card scraper module, it also has a keylogger, an uploader/downloader (with which it could add other pieces), and plug-ins for scraping credentials, and gathering local system and network information.

So, explains Noboa, if it compromises the point-of-sale system and finds that the retailer has wisely encrypted all of the cardholder data or stored it elsewhere, ModPOS can still find ways to make its attack fruitful for them and damaging to the target.

The code was written by someone with exceptional skill, says Noboa. "The shell code they use," she says, "are effectively full programs." They found one piece of shell code contained over 600 functions.

The malware is able to stay persistent and obfuscated because every one of those modules operates in kernel mode, so, "each one is a rootkit," says Noboa.

It's also difficult to detect because all hashes are unique to the victim system. So the researchers can't just hand out a list of hashes along with indicators of compromise, because it wouldn't do anybody any good.

The researchers have not found any evidence of anyone selling ModPOS or even discussing it on underground forums. 

"All of this points to [the malware] being a profit center for someone," says Noboa. They're making their money from use of the malware, not sale of it, and they're not interested in sharing.

All of this has helped ModPOS be quietly lucrative. iSight researchers believe the ModPOS attacks began as early as 2013, and have since stolen millions of credit and debit cards from unnamed U.S. retailers.

They don't know yet how it's being distributed right now or have a fix on the threat actor. They do say there are indications that point to Eastern Europe.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cybersecurity's 'Broken' Hiring Process
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/11/2017
How Systematic Lying Can Improve Your Security
Lance Cottrell, Chief Scientist, Ntrepid,  10/11/2017
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.