- Apr 13, 2013
- 3,147
(A few weeks ago I noted that the price of stolen credit/debit card credentials had plummeted to 4 USD on the DeepNet. The following story is one of the reasons why it is so inexpensive to acquire.)
Cybercrooks have created an improved version of the Dexter point-of-sale malware that's being blamed for slurping the credit and debit card details of holiday shoppers.
A new version of Dexter, first discovered by security researchers Seculert about a year ago, has been planted on 31 infected point-of-sale terminals, located in restaurants and famous shops in various major cities of the US, according to infosec start-up IntelCrawler.
The criminals behind the attack are using StarDust, a modified version of the earlier Dexter malware that takes features from other malware strains including BlackPOS and VSkimmer. StarDust (aka Dexter v.2) has been offered for sale on underground hacking forums since August. The new variant is capable of extracting credit card data from the RAM of compromised devices or by key-logging, as well as by capturing and exfiltrating internal network traffic, according to IntelCrawler. Data is sent via FTP to hosts based in Russia.
“Approximately 20,000 credit cards may have been compromised via this Stardust variation and evidence has been sent to the card associations to determine the points of compromise”, said Dan Clements, president of IntelCrawler.
The problem is far from confined to the US. Security researchers at Arbor Networks have been independently documenting the same threat. They note some infections in the US but a much greater number in the world's eastern hemispheres.
Point-of-sale malware is not unprecedented. One previous well known case involved the infection of 150 terminals at Subway sandwich shops. What sets the latest version of Dexter apart is its in-depth “knowledge” of the workings of PoS applications such as Clearview PoS.
It's unclear how the Dexter malware gets itself onto infected systems. Curt Wilson, a senior research analyst with Arbor Networks, does however have a few theories about how the Windows-based malware is spreading.
"The exact method of compromise is not currently known, however PoS systems suffer from the same security challenges that any other Windows-based deployment does,"Wilson writes. "Network and host-based vulnerabilities (such as default or weak credentials accessible over Remote Desktop and open wireless networks that include a PoS machine), misuse, social engineering and physical access are likely candidates for infection."
”Additionally, potential brittleness and obvious criticality of PoS systems may be a factor in the reportedly slow patch deployment process on PoS machines, which increases risk," he added.
http://www.theregister.co.uk/2013/12/10/dexter_pos_malware/
and some further info with a map showing where the malware was located:
http://www.arbornetworks.com/asert/...e-campaigns-targeting-credit-and-debit-cards/
Cybercrooks have created an improved version of the Dexter point-of-sale malware that's being blamed for slurping the credit and debit card details of holiday shoppers.
A new version of Dexter, first discovered by security researchers Seculert about a year ago, has been planted on 31 infected point-of-sale terminals, located in restaurants and famous shops in various major cities of the US, according to infosec start-up IntelCrawler.
The criminals behind the attack are using StarDust, a modified version of the earlier Dexter malware that takes features from other malware strains including BlackPOS and VSkimmer. StarDust (aka Dexter v.2) has been offered for sale on underground hacking forums since August. The new variant is capable of extracting credit card data from the RAM of compromised devices or by key-logging, as well as by capturing and exfiltrating internal network traffic, according to IntelCrawler. Data is sent via FTP to hosts based in Russia.
“Approximately 20,000 credit cards may have been compromised via this Stardust variation and evidence has been sent to the card associations to determine the points of compromise”, said Dan Clements, president of IntelCrawler.
The problem is far from confined to the US. Security researchers at Arbor Networks have been independently documenting the same threat. They note some infections in the US but a much greater number in the world's eastern hemispheres.
Point-of-sale malware is not unprecedented. One previous well known case involved the infection of 150 terminals at Subway sandwich shops. What sets the latest version of Dexter apart is its in-depth “knowledge” of the workings of PoS applications such as Clearview PoS.
It's unclear how the Dexter malware gets itself onto infected systems. Curt Wilson, a senior research analyst with Arbor Networks, does however have a few theories about how the Windows-based malware is spreading.
"The exact method of compromise is not currently known, however PoS systems suffer from the same security challenges that any other Windows-based deployment does,"Wilson writes. "Network and host-based vulnerabilities (such as default or weak credentials accessible over Remote Desktop and open wireless networks that include a PoS machine), misuse, social engineering and physical access are likely candidates for infection."
”Additionally, potential brittleness and obvious criticality of PoS systems may be a factor in the reportedly slow patch deployment process on PoS machines, which increases risk," he added.
http://www.theregister.co.uk/2013/12/10/dexter_pos_malware/
and some further info with a map showing where the malware was located:
http://www.arbornetworks.com/asert/...e-campaigns-targeting-credit-and-debit-cards/
