Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

10/13/2015
07:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Prolific Cybercrime Gang Favors Legit Login Credentials

FireEye researchers shed more light on infamous cybercriminals associated with RawPOS malware. and christen it 'FIN5.'

FIREEYE CYBER DEFENSE SUMMIT -- Washington, D.C. -- No 0days. No spearphishing, either: The cybercriminal group tied to numerous payment card breaches including Goodwill and best known by its so-called "RawPOS" malware employed legitimate user credentials to access its targets' networks.

Researchers at FireEye here today shared their recent findings on this prolific and long-running cybercrime gang that has been the subject of multiple Visa security alerts to merchants. The RawPOS memory scraper malware has been infecting the lodging industry in epidemic proportions over the past year, and is considered one of the first memory scrapers to target point-of-sale systems.

FireEye has dubbed the cybercrime gang FIN5. "One of the most unique things about FIN5 is that in every intrusion we responded to where FIN5 has been active, legitimate access was identified. They had valid user credentials to remotely log into the network," said Barry Vengerik, principal threat analyst at FireEye. "No sexy zero-days, no remote exploits -- not even spearphishing. They had credentials from somewhere."

FIN5, which earlier this year was profiled by researchers at Trend Micro and has been in action since at least 2008, uses real credentials from the victim organization's virtual private network, Remote Desktop Protocol, Citrix, or VNC. Vengerik says the attackers got those credentials via third parties associated with the victims' POS systems.

"Most of the maintenance and administration of POS systems are done by a third party -- the maintenance, patching, troubleshooting" is done remotely via those credentials, he said.  

"FIN5 maintained access to two or more payment processor networks primarily for the goal of logging into and accessing their customers' environments," he said. "It's a textbook case of a lateral compromise between companies based on trust."

FireEye last year investigated a massive breach at a casino hotel with 1,200 endpoints that suffered losses to more than 150,000 payment cards. Vengerik declined to name the hotel.

The casino attackers used a stolen VPN account to gain access, said Emmanuel Jean-Georges, senior consultant with FireEye's Mandiant.

FIN5 uses a tool called GET2 Penetrator, a brute force scanning tool that looks for remote login and hard-coded credentials, as well as a free tool called EssentialNet that scans the victim's network to give the attackers "the lay of the land," Vengerik said.

RawPOS pulls information from a POS system's memory. The malware includes several components, FireEye found: Duebrew, which ensures the malware remains on the infected Windows machine, even when it gets rebooted; Fiendcry, a memory scraper that grabs the payment card data; Driftwood, which encodes the stolen payment card information to hide it from analysis tools.

Another unusual feature of FIN5's operation is that the malware code is "well-commented," Vengerik said. "That's incredibly rare in malware, the author taking time to comment on the code and to show what section of code is doing what," he said. It's like a secure development lifecycle approach, he noted.

The release notes for the Driftwood code are written in an older Russian language character set, the researchers showed.

Why would the malware author actively comment on the code? "It points to a possible ecosystem -- for advertising or support" of the malware as a product, Vengerik told Dark Reading.

FireEye says the attackers first target the Active Directory to get to the card data, and use tools such as Windows Credentials Editor in their quest for legit credentials. They also created several custom tools for covering their tracks and cleaning up any traces of the malware, as well as proxy tools for accessing segregated network segments.

"They also encoded hard kill-times into most of their malware for a hard end date" of the attack, he said.

Trend Micro earlier this year noted how RawPOS was able to evolve to target various types of POS software. "Aside from being multi-component, RawPOS is notable for its support for multiple PoS software. Since business establishments would have different PoS software, attackers have modified RawPOS’ code to support multiple PoS software over time," Trend Micro researchers wrote in a blog post in late April.

Meanwhile, FireEye today also announced that is has partnered with Visa Inc. to power a new threat intelligence service for merchants and card issuers. The so-called Visa Threat Intelligence service is the first product under a newly forged partnership between Visa and FireEye.

"We want to offer faster, actionable intelligence to our constituents," said Mark Nelson, senior vice president of risk products at Visa.

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...