Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/9/2014
04:10 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

BrutPOS Botnet Targets Retail's Low-Hanging Fruit

FireEye discovers a botnet that's going after point-of-sale systems showing bad passwords and other basic security no-nos.

In the midst of so many advanced persistent threats that seem impossible to prevent, there is a new threat out there that's still going after the low-hanging fruit. FireEye has discovered a new botnet, BrutPOS, that is being used to find point-of-sale systems' remote administration software and brute force its way into the ones with weak passwords.

Attackers are manipulating poor password practices and lax remote desktop protocol (RDP) implementations to lift payment card information from active processes within POS terminals and other places where payment data is stored.

FireEye has discovered five BrutPOS command-and-control servers, three of which are now inactive; the two active servers, both based in Russia, were set up in late May and early June. FireEye says that the operators of BrutPOS are based in Eastern Europe, most likely Ukraine or Russia.

The botnet has been active since February. At latest count, BrutPOS consisted of 5,622 bots in 119 countries -- many of them in Russia (15.67%), India (13.45%), Vietnam (7.51%), Iran (6.07%), and Taiwan (4.13%). Only a small fraction of the bots are active at any given time.

The bots scan ranges of IP addresses looking for poorly locked-down POS remote admin software.

"What's really interesting here is that the way the malware is propagating is not from some proprietary malware. It's using remote desktop protocol," says Joshua Goldfarb, chief security officer of the enterprise forensics group at FireEye. "It's misusing or abusing a legitimate protocol."

Over the course of two weeks, the attackers gained access to 60 POS systems; 51 of those were in the United States.

The most common username used by the breached systems was "administrator." The most common passwords were "pos" and "Password1."

The attackers use their admin access to install other executables that extract payment card information -- from POS terminals and elsewhere -- and exfiltrate it back to the C&C server.

Goldfarb says that the BrutPOS attackers are exploiting the fact that some organizations are still not following the basic security best-practices that have been recommended for 10 to 20 years.

"Essentially, the theme here is hackers can be lazy because [companies] allow them to be," he says. "They're only as fancy as they need to be."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
dadsu
100%
0%
dadsu,
User Rank: Apprentice
7/16/2014 | 1:07:28 PM
Re: So what is the statistical significance
Yes, and for some reason I thought a security standard was to disable guest accounts and rename "administrator" accounts to something besides administrator or admin....
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
7/10/2014 | 6:25:02 PM
Re: So what is the statistical significance
@Marilyn   "You would think that the retail industry could do better than allowing these User Ids and passwords these days."  You would, but one thing Joshua Goldfarb pointed out to me was the fact that sometimes these very big retailers have so many POS terminals that it's awfully hard to get every single one right. That said, the password "pos" meets almost NONE of your basic requirements -- only three characters, no numbers, no special characters, no mix of caps and lowercase. It's pitiful.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/10/2014 | 12:52:15 PM
Re: So what is the statistical significance
The most common username used by the breached systems was "administrator." The most common passwords were "pos" and "Password1."

You would think that the retail industry could do better than allowing these User Ids and passwords these days. 

 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
7/10/2014 | 9:46:16 AM
Re: So what is the statistical significance
@progman2000  The attackers were scanning 57 IP address ranges, 32 of which are located in the U.S. So it still looks like the US's were easier to break into than other countries'. But Goldfarb was hesitant to speculate on why that is, because they didn't have more information. It's possible that most of the usernames/passwords used for brute-forcing were in English, or simply that American companies still struggle with bad passwords and bad password management.
progman2000
50%
50%
progman2000,
User Rank: Apprentice
7/9/2014 | 9:21:12 PM
So what is the statistical significance
of 51 of the 60 compromised systems being in the US?  Are these things primarily scanning US addresses?  Are they equally scanning other countries but US has more electronic POS?  More vulnerable POS?
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I've never actually seen the corporate ladder before.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18898
PUBLISHED: 2020-01-23
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14...
CVE-2019-19837
PUBLISHED: 2020-01-23
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
CVE-2020-7210
PUBLISHED: 2020-01-23
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.
CVE-2019-19835
PUBLISHED: 2020-01-23
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
CVE-2020-5216
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...