Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/13/2019
03:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Visa Warns of Targeted PoS Attacks on Gas Station Merchants

At least two North American chains have been hit in sophisticated new campaigns for stealing payment card data.

Point of Sale (PoS) systems belonging to at least two North American gas station merchants and a hospitality chain have been attacked over the last few months by what Visa this week described as sophisticated cybercrime groups looking to harvest payment card data.

Unlike card theft operations where criminals attach hidden skimmers to card readers at gas pumps and other PoS systems, the latest attacks have involved the use of malware on the backend systems that merchants use to process card transactions. As a result, the attacks were a lot more sophisticated, Visa said in an alert.

"It is important to note that this attack vector differs significantly from skimming at fuel pumps, as the targeting of POS systems requires the threat actors to access the merchant’s internal network, and takes more technical prowess than skimming attacks," Visa's alert said.

Visa's payment fraud division have identified at least three separate attacks targeting PoS systems since August. Two of them appear to have been carried out by FIN8, a threat group that has previously been associated with numerous attacks on PoS systems.

In one of the attacks that Visa identified this summer, the breach began when an employee at one of the gas station chains that was hit, clicked on a link in a phishing email and accidentally downloaded a Remote Access Trojan. The attackers used the Trojan to conduct reconnaissance on the breached network and eventually to move laterally into the merchant's PoS environment where they deployed a RAM memory scraper for harvesting payment card data.

The modus operandi was similar in the second incident as well, but investigators have so far been unable to determine how the attackers got initial access to the merchant's network, Visa said. In the second incident, the targeted gas station merchant accepted both chip transactions and magnetic stripe payments for in-store payments and only magnetic stripe payments at the gas pumps. Visa's analysis shows the attackers specifically targeted the mag stripe data, the company said.

Visa's alert did not mention how the attackers gained initial access to the network of the hospitality company though in that case as well, the attackers targeted the PoS system.

Sophisticated Cybercrime Groups

Telemetry from both of the latter two incidents suggested that FIN8 was involved, Visa said.  The command and control server used in the attack on the second merchant and the file used to store stolen payment card data for instance, have both been previously linked to FIN8. Similarly, the malware that was used in the hospitality chain attack is also something that FIN8 has used in the past.

Visa's alert did not identify the cybercrime group behind the first attack. But in the past it has warned about a group called FIN6 compromising multiple PoS environments via a malware tool called Trinity POS or FrameworkPOS.

Card-stealing attacks against gas station chains in particular are increasing because many have yet to implement the EMV smartcard standard for payment transactions, Visa said. Chip cards offer significantly better protection against card data theft and cloning, compared to cards using magnetic stripes to store account and cardholder information.

Visa, MasterCard, American Express, and other card companies have for some time required all organizations accepting payment card transactions to cut over to EMV chip card technology. The migration has been happening in a phased manner across industry sectors for several years. Fuel merchants have until October 2020 to enable chip acceptance at fuel pumps. After that date, the liability for breaches will shift to the merchants that experience the breach.

Visa and the other major credit card associations have also recommended the use of point-to-point encryption, tokenization and other measures for protecting card data. Some of these measures are mandatory requirements under the Payment Card Industry Data Security Standard (PCI DSS).

Despite such measures, the US payment card infrastructure has lagged considerably behind other countries that have long ago moved to Chip and PIN technology.  The continued use of magnetic stripes has made the US payment environment an attractive target for criminals in recent years.

“EMV chips were created to make it expensive to manufacture counterfeit cards or steal money by tampering with a card or a transaction," says Craig Young security threat researcher at Tripwire.

Chip-and-PIN enabled cards provide stronger defenses against misuse when lost or stolen though neither implementation eliminates the RAM scraping threats described in the Visa alert, he says. "Elimination of magnetic stripes would force adversaries to adjust their tradecraft," but not completely eliminate the threat he says.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Next Security Silicon Valley: Coming to a City Near You?"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6196200
50%
50%
6196200,
User Rank: Apprentice
12/16/2019 | 10:18:40 AM
Educated
Thank you very much for sharing helpful articles.
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3113
PUBLISHED: 2021-01-17
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and ...
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...