What Is POS Malware?

POS system: Point of Sale systems are used at the point of transaction in retail, consisting of hardware and software used to process consumer information off credit or debit cards. 

When the consumer uses a card in a POS system, the card’s magnetic stripe is read, data (PIN Block) is encrypted and sent for approval to the merchant gateway which uses an HSM (Hardware Security Module) to decrypt the PIN Block, re-encrypt it and send it to the bank which confirms the  PIN is correct. The confirmation is communicated back to the POS which approves the transaction.

Source: citoc.com

POS Malware:  POS systems can be targeted via physical devices; a tactic known as “skimming”.  There are many forms of skimming: fake hardware-based skimmers, pre-compromised POS devices and DIY kits.  These methods are designed to simply intercept the card data before it makes it to the network and deliver it back to the hackers.

Software attacks are usually performed with a malware called memory scrapper, which looks at data dumps and filters through them to find the necessary info.

Lately, more sophisticated attacks have emerged such as Dexter, Alina and Stardust (a variant of Dexter). The latest form of attack has baffled security experts, this is the code responsible for the Target breach, BlackPOS. 

What distinguishes BlackPOS from a memory scrapper is that it runs in the memory of the system, specifically customized to the organization it infiltrates (Target’s home-grown systems). 

It also has specific hooking points and it performs encryptions in the process of exporting data, in order to avoid detection systems. BlackPOS also features extensive anti-forensic and cleanup modules that allow it to successfully infiltrate machines which carry POS software without leaving any traces. 

The Curious Case of BadBIOS

The latest story keeping cyber security experts awake at night is the existence of a super virus with the digital footprint of a ghost, discovered by a reputable researcher in software security.

Image ID: 1153286 via www.sxc.hu

In theory, most of the industry experts agree with Dragos Ruiu’s superbug – BadBIOS. In reality, he’s the only one to have experienced it. So it doesn’t come as a surprise that people are questioning the accuracy of his findings. The whole story started three years ago, when Ruiu was installing a new version of Apple OS X and his laptop started to update its BIOS, unprompted. His computers behaved strangely ever since, even when unplugged and with the Wi-Fi and Bluetooth being turned off. This led him to believe that the hidden virus – called BadBIOS due to the infection in the computer’s Basic Input/ Output System – can propagate on infected machines via ultrasound signals, from the speakers of one machine to the microphone of another. But it was only a month ago, when he first posted his findings on his Google+ account that the story picked up interest from media and peers alike.  

The tech community is in a bit of a twist over this new information and opinions are clearly split. Some believe that many reputable years in the industry, have driven him to paranoia; some believe he may be right, with governmental institutions having the capability of creating something as stealthy and high-tech as an undetectable malware, some believe that it’s nothing more than a publicity stunt.

Whilst even the sceptics agree that everything he’s pointing out is theoretically plausible, the question that seems to plague his research is: Is it real-life applicable?

The fact that no one else has stumbled across a copy of BadBIOS makes it difficult to believe its existence. When Stuxnet came out, it spread quickly and more importantly it came out for a reason. If BadBIOS does exist, what is the motivation behind it? And why is Dragos Ruiu the only one to find it?

The controversy remains high due to Ruiu’s status in the worldwide scientific community. He’s not an ordinary security geek, but the man behind CanSecWest, PacSex and the creator of Pwn2Own hacking contest. Now, it seems, he is also the sole identifier of this invisible, untraceable bug, which deletes any evidence of its existence.

However, even if this newly sparked interest may only be the Twitter hashtag of today, peers agree that Ruiu’s findings can happen given the right circumstances, resources and motivations. So even if there’s nothing there yet, it has made researches pay attention to something that may not be merely science fiction after all.