Pesky POS poison won't Backoff

Providing a secure and efficient Helpdesk

Infections from the Backoff point-of-sale malware are still rising in America, according to security bods from Damballa.

The company reckons it spotted a 57 per cent rise in Backoff detections in August and September 2014, and a 27 per cent rise in September alone.

In August, the malware had already hit 1,000 US businesses, including big names like Target, Supervalu, and UPS.

Black hats also skimmed cream from Dairy Queen in August.

The usual modus operandi is to brute-force too-simple passwords protecting remote desktop protocol channels to drop Backoff onto the POS systems to exfiltrate customer data.

As this Fortinet analysis describes, once Backoff infection is in place, the malware creates a set of registry keys; launches a memory parser, command & control, and keylogger threads, and modifies explorer.exe to provide persistence in case it's removed. As evidence of its sophistication, Fortinet notes that the malware checks not just the validity of card numbers, but also expiry dates and service codes.

Damballa notes that it's important for enterprises to enable reconfigure their network security to make POS traffic visible to their security scanners. ®

Intelligent flash storage arrays

from ffffff http://go.theregister.com/feed/www.theregister.co.uk/2014/10/26/pesky_pos_poison_wont_backoff/

via IFTTT