Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

1/5/2018
03:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

LockPoS Malware Sneaks onto Kernel via new Injection Technique

"Alarming evolution" of Flokibot bypasses antivirus software and was likely built by a group of advanced attackers, researchers say.

A sneaky new injection technique delivers LockPoS malware straight into the kernel, researchers report. This "silent" method bypasses traditional antivirus software.

LockPoS is a type of point-of-sale (PoS) malware designed to snatch credit card data from the memory of computers connected to PoS card scanners. It reads the memory of processes running on the system to look for data that looks like payment card info and sends it to the command and control servers.

There are multiple stages of unpacking and decryption in LockPoS, but Cyberbit researchers report its most interesting traits are the injection technique and routines for code injection. The team discovered a new way LockPoS is arriving on machines.

LockPoS comes from the same botnet used to send Flokibot PoS, a bot based on leaked Zeus code discovered by Malwarebytes in 2016. The LockPoS injection technique is similar to the one used by Flokibot but uses different API calls for injection, and is more advanced overall.

Meir Brown, Cyberbit's director of research for endpoint detection and response, says researchers detected the new technique when they discovered a LockPoS malware sample using remote access but couldn't identify the injection. Usually the technique is obvious.

"It was somehow injected without us being able to see the injection technique," Brown explains, noting that malware typically uses a Windows API to operate code injection and there are many different APIs that malware can use. "Here, there is no evidence of injection," he says. 

Cyberbit malware analyst Hod Gavriel ran the malware through a reversing lab to understand this. He discovered the injection was silent because it directly entered the kernel. All the routines used to inject the code are exported from a core dll file of the Windows OS, which serves as a "gate" from the user space to the kernel space, researchers report. The malware avoids antivirus systems by mapping this core file from the disk to its own virtual address space.

"Flokibot was not that impressive because the injection was still discoverable," says Gavriel. "Here, in LockPoS, it is totally silent. It can inject code without raising any flags. Somebody put a lot of effort into this malware … it's not simple code."

He calls this an "alarming evolution" of Flokibot that was likely built by a group of advanced attackers. "This is not something that can be done by five people in a lab. This is an operation."

Brown says this discovery is a sign PoS malware is evolving. Authors are investing more in generating attacks on vendors and creating more advanced threats to both stay hidden and evade security tools. While it has been used in the wild, he notes researchers have not seen any evidence of specific breaches that used this LockPoS injection technique.

"The whole point-of-sale, retail market should be aware they're being targeted," he says. "They need to raise the bar in security." This doesn't only mean investing in the right technology, but the right people. Businesses need someone to understand and respond to threats they detect.

Ed Cabrera, chief cybersecurity officer at Trend Micro, says researchers at the company are "seeing a lot of innovation going on" in PoS malware. While the bot delivery method has been around for a while, attackers are evolving their strategies around distributing malware.

"They're not improving the malware itself but they're improving the process for delivering, and becoming much more effective in their tactics," he explains. Attackers are refining their campaigns, using automation to launch attacks and exfiltrate information. Many are narrowing their focus on smaller businesses, which typically don't have strong security measures in place.

"One trend we're seeing is -- thanks to PoS malware bots that are conducting these types of attacks -- criminals can be much more effective in doing automated attacks, possibly reaching small and medium-sized businesses in a much more effective way," he explains.

Cabrera says retailers are becoming better at understanding the threats they face but usually don't ramp up their security strategies until after a breach, when their vulnerabilities are made much more obvious. Depending on the store, they start building security programs in response, he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/9/2018 | 3:39:18 PM
Re: Which "Kernel"? PUT TARGET PLATFORM FRONT AND CENTER
Don't be too hard - after all most EVERYTHING is on a Windows platform to start with.  However nice and wonderful Ubuntu and Linux are ... percentage is always windows, the curse we have to live with. 
SchemaCzar
50%
50%
SchemaCzar,
User Rank: Strategist
1/8/2018 | 10:31:50 AM
Which "Kernel"? PUT TARGET PLATFORM FRONT AND CENTER
It's ridiculous that a Windows-only attack technique is barely identified as such until well through the article.
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...