12:15 PM
Connect Directly

Stealthy ModPOS Is 'Most Sophisticated PoS Malware' Ever

More than just a point-of-sale card scraper, it's modular malware, and every module is a rootkit.

Just in time for the holidays, researchers at iSIGHT Partners are warning retailers about ModPOS -- malware in their point-of-sale systems that is nearly impossible to detect, can do a whole lot more than just scrape customers' credit card data, and has already successfully breached U.S. retailers.

"This is by far the most sophisticated PoS malware I've ever seen," says Maria Noboa, senior threat analyst at iSight.

BlackPOS was behind the monster breach at Target, BackOff hit UPS and over a thousand others, and now new PoS malware like CherryPicker and AbaddonPOS have hit the scene. Yet, none of them have the same level of complexity and committment to stealth that ModPOS does.

"It took us two to three weeks just to determine it was malicious," says Noboa. It then took researchers several more weeks to pick ModPOS apart and figure out how it works. In comparison, it only took them about 20 minutes to reverse engineer CherryPicker, says Noboa.

[PoS malware proves that Cyber Monday isn't the only thing retailers and shoppers have to worry about over the holidays. Read "Black Friday Security: Brick-and-Mortar Retailers Have Cyber Threats Too."]

ModPOS is modular. In addition to the PoS card scraper module, it also has a keylogger, an uploader/downloader (with which it could add other pieces), and plug-ins for scraping credentials, and gathering local system and network information.

So, explains Noboa, if it compromises the point-of-sale system and finds that the retailer has wisely encrypted all of the cardholder data or stored it elsewhere, ModPOS can still find ways to make its attack fruitful for them and damaging to the target.

The code was written by someone with exceptional skill, says Noboa. "The shell code they use," she says, "are effectively full programs." They found one piece of shell code contained over 600 functions.

The malware is able to stay persistent and obfuscated because every one of those modules operates in kernel mode, so, "each one is a rootkit," says Noboa.

It's also difficult to detect because all hashes are unique to the victim system. So the researchers can't just hand out a list of hashes along with indicators of compromise, because it wouldn't do anybody any good.

The researchers have not found any evidence of anyone selling ModPOS or even discussing it on underground forums. 

"All of this points to [the malware] being a profit center for someone," says Noboa. They're making their money from use of the malware, not sale of it, and they're not interested in sharing.

All of this has helped ModPOS be quietly lucrative. iSight researchers believe the ModPOS attacks began as early as 2013, and have since stolen millions of credit and debit cards from unnamed U.S. retailers.

They don't know yet how it's being distributed right now or have a fix on the threat actor. They do say there are indications that point to Eastern Europe.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
New 'Mac-A-Mal' Tool Automates Mac Malware Hunting & Analysis
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/14/2018
Microsoft Report Details Different Forms of Cryptominers
Kelly Sheridan, Staff Editor, Dark Reading,  3/13/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.