Point-of-sale malware

A point of sale card terminal

Point-of-sale malware (POS malware) is a type of malicious software (malware) that is used by cybercriminals to target point of sale (POS) terminals with the intent to obtained credit card and debit card information by reading the device memory from the retail checkout point of sale system. POS malware is released by hackers to process and steal thousands of transaction payment data.^[1] The card information which is usually encrypted and sent to the payment authorization is not encrypted by POS malware but sent to the cybercriminal.

List of POS RAM scraper malware variants

• Rdasrv – It was discovered in 2011, and installs itself into the Windows computer as a service called rdasrv.exe.^[2] It scans for track 1 and track 2 credit card data using Perl compatible regular expressions which includes the customer card holder’s name, account number, expiry date, CVV code and other discretionary information. Once the information gets scraped it is been stored into data.txt or currentblock.txt and sent to the hacker.
• Alina – It was discovered in October 2012 and gets installed into the PC automatically. It gets embedded into the Auto It script and loads the malware into the memory. Then it scrapes credit card (CC) data from POS software.^[3]
• VSkimmer – Vskimmer scrapes the information from the Windows system by detecting the card readers attached to the reader and then sends the captured data to the cyber criminal or control server.^[4]
• Dexter – It was discovered in December 2012 to steal system information along with the track 1 and track 2 card details with the help of keylogger installed onto the computer.
• BlackPOS – It is a spyware, created to steal credit and debit card information from the POS system. BlackPOS gets into the PC with stealth-based methods and steals information to send it to some external server.^[5]
• Backoff – This memory-scraping malware tracks Track 2 data to access the card magnetic stripe with the help of magnetic stripe readers and sends data to hacker to clone fake credit cards.
• FastPOS – FastPOS Malware is a POS malware that was discovered by Trend Micro researchers. This strikes the point of sale system very fast and snatches the credit and debit card information and sends the data to the cyber criminal instantly. The malware has the capability to exfiltrate the track data using two techniques such as key logger and memory scraper.^[6][7][8]
• PunkeyPOS Malware - PandaLabs discovered this malware and it infects the point of sale system to breach credit and debit card details.^[9] PunkeyPOS Malware uses two functions such as keylogger and RAM Scraper to steal information at Point of Sale Terminal.^[10] Once the information is stolen, it is been encrypted and send to cybercriminal’s Control and Command Server (C&C).^[11]
• Multigrain Malware - This new variant of pos malware or point of sale malware was discovered by FireEye.^[12] It follows new advanced technique to steal retail customer’s card information with the help of Lunh Algorithm.^[13] To exfiltrate the stolen information it first block http and ftp traffic that monitors the data exfiltration. It belongs to the family of NewPosThings malware.^[14]
• CenterPOS_Malware - CenterPOS is a POS (Point of Sale) Malware that been found in the year 2015 of September along with the other malicious malwares such as BlackPOS, NewPOSThings and Alina Malware by FireEye Experts.^[15] It scrapes the stolen credit and debit card and sends the data HTTP POST request with the help of Triple DES encryption.
• MalumPOS Malware - MalumPOS is a point of sale malware that records point of sale’s data which is running in an Oracle MICROS payment system and has breached 333,000 data's all over the world. It uses Delphi programming language for stealing the credit and debit card details. The stolen data is then been sent to the cyber criminal or sold in the black market.

See also

• Point of sale
• Cyber security standards
• List of cyber attack threat trends
• Cyber electronic warfare
• Malware

References

1. "What is POS Malware? - Point of Sale Malware Definition and FAQ". Retrieved 4 November 2016.
2. Rdasrv POS RAM Scraper Malware
3. Constantin, Lucian. "Point-of-sale malware creators still in business with Spark". Retrieved 4 November 2016.
4. "vSkimmer botnet targets card payment terminals". Info Security.
5. "Researchers find new point-of-sale malware called BlackPOS". Retrieved 4 November 2016.
6. "FastPOS malware instantly delivers stolen credit card data". 3 June 2016. Retrieved 4 November 2016.
7. "FastPOS: Quick and Easy Credit Card Theft - TrendLabs Security Intelligence Blog". 2 June 2016. Retrieved 4 November 2016.
8. "FastPOS Malware Breaches and Delivers Credit Card Data Instantly". Retrieved 4 November 2016.
9. "News Alert! PandaLabs Discovers New POS Malware". 23 June 2016. Retrieved 4 November 2016.
10. PunkeyPOS Malware
11. "New Episode of Punkey PoS Malware Airs". Retrieved 4 November 2016.
12. "MULTIGRAIN – Point of Sale Attackers Make an Unhealthy Addition to the Pantry « Threat Research Blog". Retrieved 4 November 2016.
13. "New Multigrain Malware steals Point of Sale Data Over DNS". Retrieved 4 November 2016.
14. Constantin, Lucian. "New point-of-sale malware Multigrain steals card data over DNS". Retrieved 4 November 2016.
15. https://www.fireeye.com/blog/threat-research/2016/01/centerpos_an_evolvi.html CENTERPOS: AN EVOLVING POS THREAT