Feeds

Dexter malware targets point of sale systems worldwide

Payment cards plundered in 40 countries

SANS - Survey on application security programs

You could be getting more than you bargained for when you swipe your credit card this holiday shopping season, thanks to new malware that can skim credit card info from compromised point-of-sale (POS) systems.

First spotted by security firm Seculert, the malware dubbed "Dexter" is believed to have infected hundreds of POS systems in 40 countries worldwide in recent months. Companies targeted include retailers, hotel chains, restaurants, and private parking providers.

The US, the UK, and Canada top the list of countries where the malicious app has been found, accounting for 30 per cent, 19 per cent, and 9 per cent of the total number of affected systems, respectively.

This certainly isn't the first time cybercrooks have targeted POS systems. In fact, such attacks are becoming increasingly common – which is no surprise, given how lucrative they can be.

In September, four Romanian hackers pled guilty to charges that they hacked into the POS systems of 150 Subway sandwich shops in the US. Their scheme reportedly lasted two years, during which time they were able to make off with more than $10m in fraudulent charges and funds transfers from stolen payment cards.

What sets Dexter apart from earlier incidents, however, is its relative sophistication.

Most hacks targeting POS systems – the Romanian job included – are essentially spyware attacks in which crooks use Remote Desktop exploits or other means to grab screenshots of the affected systems. In essence, the thieves are simply reading credit card information off the POS screens.

Dexter, on the other hand, uses a more subtle approach – and a more thorough one. Once the malware is installed on a POS system, it grabs the machine's list of active processes and sends them to a command-and-control server – a highly unusual step for POS malware, according to security researchers at Trustwave.

If the server determines that any of the programs currently running on the machine correspond to known POS software, it orders Dexter to dump the memory of those processes, parse them for payment card–related data, and upload that data to the server, so that criminals can use it to clone the cards.

That much we know. What isn't known is just how Dexter finds its way onto POS terminals to begin with. According to Seculert, about 30 per cent of the POS systems targeted were running Windows Server, which makes it unlikely that the malware was installed using typical social-engineering or drive-by web download methods.

Still, if you do encounter unrecognized charges on your credit card bill in the coming months, now you know what to tell the bank when you call to dispute the transactions: "It wasn't me. It was that POS system that swiped my card!" ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.