Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/13/2019
03:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Visa Warns of Targeted PoS Attacks on Gas Station Merchants

At least two North American chains have been hit in sophisticated new campaigns for stealing payment card data.

Point of Sale (PoS) systems belonging to at least two North American gas station merchants and a hospitality chain have been attacked over the last few months by what Visa this week described as sophisticated cybercrime groups looking to harvest payment card data.

Unlike card theft operations where criminals attach hidden skimmers to card readers at gas pumps and other PoS systems, the latest attacks have involved the use of malware on the backend systems that merchants use to process card transactions. As a result, the attacks were a lot more sophisticated, Visa said in an alert.

"It is important to note that this attack vector differs significantly from skimming at fuel pumps, as the targeting of POS systems requires the threat actors to access the merchant’s internal network, and takes more technical prowess than skimming attacks," Visa's alert said.

Visa's payment fraud division have identified at least three separate attacks targeting PoS systems since August. Two of them appear to have been carried out by FIN8, a threat group that has previously been associated with numerous attacks on PoS systems.

In one of the attacks that Visa identified this summer, the breach began when an employee at one of the gas station chains that was hit, clicked on a link in a phishing email and accidentally downloaded a Remote Access Trojan. The attackers used the Trojan to conduct reconnaissance on the breached network and eventually to move laterally into the merchant's PoS environment where they deployed a RAM memory scraper for harvesting payment card data.

The modus operandi was similar in the second incident as well, but investigators have so far been unable to determine how the attackers got initial access to the merchant's network, Visa said. In the second incident, the targeted gas station merchant accepted both chip transactions and magnetic stripe payments for in-store payments and only magnetic stripe payments at the gas pumps. Visa's analysis shows the attackers specifically targeted the mag stripe data, the company said.

Visa's alert did not mention how the attackers gained initial access to the network of the hospitality company though in that case as well, the attackers targeted the PoS system.

Sophisticated Cybercrime Groups

Telemetry from both of the latter two incidents suggested that FIN8 was involved, Visa said.  The command and control server used in the attack on the second merchant and the file used to store stolen payment card data for instance, have both been previously linked to FIN8. Similarly, the malware that was used in the hospitality chain attack is also something that FIN8 has used in the past.

Visa's alert did not identify the cybercrime group behind the first attack. But in the past it has warned about a group called FIN6 compromising multiple PoS environments via a malware tool called Trinity POS or FrameworkPOS.

Card-stealing attacks against gas station chains in particular are increasing because many have yet to implement the EMV smartcard standard for payment transactions, Visa said. Chip cards offer significantly better protection against card data theft and cloning, compared to cards using magnetic stripes to store account and cardholder information.

Visa, MasterCard, American Express, and other card companies have for some time required all organizations accepting payment card transactions to cut over to EMV chip card technology. The migration has been happening in a phased manner across industry sectors for several years. Fuel merchants have until October 2020 to enable chip acceptance at fuel pumps. After that date, the liability for breaches will shift to the merchants that experience the breach.

Visa and the other major credit card associations have also recommended the use of point-to-point encryption, tokenization and other measures for protecting card data. Some of these measures are mandatory requirements under the Payment Card Industry Data Security Standard (PCI DSS).

Despite such measures, the US payment card infrastructure has lagged considerably behind other countries that have long ago moved to Chip and PIN technology.  The continued use of magnetic stripes has made the US payment environment an attractive target for criminals in recent years.

“EMV chips were created to make it expensive to manufacture counterfeit cards or steal money by tampering with a card or a transaction," says Craig Young security threat researcher at Tripwire.

Chip-and-PIN enabled cards provide stronger defenses against misuse when lost or stolen though neither implementation eliminates the RAM scraping threats described in the Visa alert, he says. "Elimination of magnetic stripes would force adversaries to adjust their tradecraft," but not completely eliminate the threat he says.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Next Security Silicon Valley: Coming to a City Near You?"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6196200
50%
50%
6196200,
User Rank: Apprentice
12/16/2019 | 10:18:40 AM
Educated
Thank you very much for sharing helpful articles.
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7981
PUBLISHED: 2020-01-25
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
CVE-2019-0141
PUBLISHED: 2020-01-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-7596
PUBLISHED: 2020-01-25
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.
CVE-2020-7980
PUBLISHED: 2020-01-25
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.
CVE-2012-6613
PUBLISHED: 2020-01-25
D-Link DSR-250N devices with firmware 1.05B73_WW allow Persistent Root Access because of the admin password for the admin account.