Feeds

Scammers scrape RAM for bank card data

Malware sidesteps encryption

The essential guide to IT transformation

Forget keyloggers and packet sniffers. In the wake of industry rules requiring credit card data to be encrypted, malware that siphons clear-text information from computer memory is all the rage among scammers, security researchers say.

So-called RAM scrapers scour the random access memory of POS, or point-of-sale, terminals, where PINs and other credit card data must be stored in the clear so it can be processed. When valuable information passes through, it is uploaded to servers controlled by credit card thieves.

While RAM scrapers have been around for a few years, they are a "fairly new" threat, according to a report released Wednesday that outlines the 15 most common attacks encountered by security experts at Verizon Business. They come in the wake of Payment Card Industry rules that require credit card data to be encrypted as it passes from merchants to the processing houses.

"They are definitely a response to some of the external trends that have been going on in the cybercrime environment," says Wade Baker, research and intelligence principal for Verizon Business. "Within a year, we've seen quite a few of them in the wild."

Verizon employees recently found the malware on the POS server of an unnamed resort and casino that had an unusually high number of customers who had suffered credit card fraud. The malware was sophisticated enough to log only payment card data rather than dumping the entire contents of memory. That was crucial to ensuring the malware didn't create server slowdowns that would tip off administrators.

The RAM scraper dumped the data onto the server's hard drive. The perpetrators visited at regular intervals through a backdoor on the machine to collect the booty.

RAM scrapers played a role in four percent of the 592 breaches Verizon Business investigated over a four year period starting in 2004. By contrast, keyloggers and spyware (which comprise a single category) and backdoors factored into 19 percent and 18 percent of the cases respectively.

Jason Milletary, a researcher with SecureWorks' Counter Threat Unit, said he's also seen an uptick in RAM scrapers over the past few years.

"Typically, these are specialized malware used in more targeted attacks," he says. "Often times, they are customized to to work with specific vendors' point-of-sale systems, so they understand how the data is formatted and stored."

As such, they are rarely detected by anti-virus programs, he and Verizon's Baker say. Tell-tale signs they've been installed include the presence of strange rdump files and perl scripts on a hard drive, sudden changes in free disk space and the monitoring of registries and system processes.

The Verizon report is available here. ®

5 things you didn’t know about cloud backup

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.