Feeds

Scammers scrape RAM for bank card data

Malware sidesteps encryption

Internet Security Threat Report 2014

Forget keyloggers and packet sniffers. In the wake of industry rules requiring credit card data to be encrypted, malware that siphons clear-text information from computer memory is all the rage among scammers, security researchers say.

So-called RAM scrapers scour the random access memory of POS, or point-of-sale, terminals, where PINs and other credit card data must be stored in the clear so it can be processed. When valuable information passes through, it is uploaded to servers controlled by credit card thieves.

While RAM scrapers have been around for a few years, they are a "fairly new" threat, according to a report released Wednesday that outlines the 15 most common attacks encountered by security experts at Verizon Business. They come in the wake of Payment Card Industry rules that require credit card data to be encrypted as it passes from merchants to the processing houses.

"They are definitely a response to some of the external trends that have been going on in the cybercrime environment," says Wade Baker, research and intelligence principal for Verizon Business. "Within a year, we've seen quite a few of them in the wild."

Verizon employees recently found the malware on the POS server of an unnamed resort and casino that had an unusually high number of customers who had suffered credit card fraud. The malware was sophisticated enough to log only payment card data rather than dumping the entire contents of memory. That was crucial to ensuring the malware didn't create server slowdowns that would tip off administrators.

The RAM scraper dumped the data onto the server's hard drive. The perpetrators visited at regular intervals through a backdoor on the machine to collect the booty.

RAM scrapers played a role in four percent of the 592 breaches Verizon Business investigated over a four year period starting in 2004. By contrast, keyloggers and spyware (which comprise a single category) and backdoors factored into 19 percent and 18 percent of the cases respectively.

Jason Milletary, a researcher with SecureWorks' Counter Threat Unit, said he's also seen an uptick in RAM scrapers over the past few years.

"Typically, these are specialized malware used in more targeted attacks," he says. "Often times, they are customized to to work with specific vendors' point-of-sale systems, so they understand how the data is formatted and stored."

As such, they are rarely detected by anti-virus programs, he and Verizon's Baker say. Tell-tale signs they've been installed include the presence of strange rdump files and perl scripts on a hard drive, sudden changes in free disk space and the monitoring of registries and system processes.

The Verizon report is available here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.